AI plans. Rules govern. Humans authorize. Safety has veto.
Steady Eddie carries its intelligence on board, in layers, each with a job and a limit. The models that plan and perceive can be replaced as the field moves. The rules that govern them, the controller that moves the machine and the safety system that can stop everything are fixed, and no model can talk them out of it.
The machine working, turning in the engineering model.
What proposes, what decides, what stops.
Every command passes down through this stack. The thinking is replaceable. The governing, moving and protecting parts are not, and they sit underneath, where a model cannot reach them.
It talks to the crew and reads the job.
The part that understands a plan, a question or a drawing, and explains what Eddie intends. It advises. It never commands a control.
It turns an approved job into ordinary, bounded actions.
A cut, a lift, a pass, a swing, each within the limits set for that machine. A plan is a proposal until everything below it has admitted it.
It watches, and it can only say stop.
Detection, classification and tracking of what is around the machine, with a confidence on each. Perception can take authority away. It cannot grant it. It can say stop; it cannot say go.
Every command is admitted or rejected here.
Plain rules, the same every time. This is the line between what the AI wants and what the machine is allowed to do.
A fixed-cycle controller works each control.
It moves the joystick, the pedal, the lever, the way the calibration taught it, and nothing else. A faster model makes a better decision; it does not make a hydraulic valve open faster, and the machine's own controls set the floor of every response.
An independent safety controller with the veto over everything above it.
Separately wired, separately powered, answering to the person at the machine and to its own sensors. When it says stop, nothing above it gets a vote.
Eight cameras on a ring, and nothing on the ground it cannot see past its own shadow.
The ring is not a camera bolted wherever there was room. It is a calculated geometry: how many lenses, at what height, tilted how far down, so that every square metre from the machine's own footprint out to the visibility circle the standard draws around a machine of its class is seen, and from five metres out is seen by two cameras at once.
Why eight.
Seven cameras leave ground that only one lens sees. Eight leave almost none, and a target seen by two cameras is a target with a distance, not just a bearing. The ring is turned so that no camera sits on the boom's centreline, where the boom would block it.
The blind disc, stated.
A camera high on a machine cannot see the ground at its own feet. The geometry leaves a disc about 2.3 m across the centre of rotation that the ring does not cover, and the drawing says so rather than hiding it. That disc is the reason the near band exists: nothing is allowed to be in it when the machine is armed, and the radar ring and the machine's own controls are what keep it that way. The figure is the design's; it is confirmed on the machine, not assumed.
Slim on purpose.
An operator's own view is protected by a standard that sets how much a fitting may block at the eye line. Eddie's camera pods are sized to that rule: slim enough that a person in the seat sees what they always saw.
- Wide lenses, each taking in a third of the horizon, tilted well down from a ring at roof height.
- Every camera reads the whole frame at once, so a shaking cab does not bend the world.
- High dynamic range: a low sun and a dark shop in the same frame.
- Fitted to the maker's own mirror and handrail points, never to a roll-over structure.
Two lenses, one shutter, one rule about light.
The ring wants width. The tool wants detail. The cab shakes. The sun sits on the horizon at four in the afternoon in January. Each of those is a lens decision, and each one was made on paper before a camera was bought.
The awareness lens.
A lens on each ring camera that takes in a third of the horizon, so a quadrant is covered with margin and a person at the edge of the circle still fills enough of the frame to be a person and not a smudge. The eight overlap; the overlap is where depth comes from.
The work lens.
A lens half as wide on the roof, looking forward and down at the tool and the cut: the bucket, the face, the load, the edge. What an operator's eyes do for most of a shift.
The shutter.
A camera that reads its frame line by line, the way most phone cameras do, bends a straight post into a lean when the cab it sits in is shaking. Eddie's cameras read the whole frame at once. A vibrating cab is the normal condition on a working machine, so this was never optional.
The dash, read the way you read it.
One camera in the cab looks at the instrument cluster and reads it optically: engine running, temperature, fuel, the warning and fault lamps. No wire enters the machine to ask. It can stop Eddie. It can never start the machine.
A spinning lidar, six radars, and a plain account of what each one loses.
Cameras give the picture. The lidar gives structure and a direct range to everything it hits. The radars give presence where dust and snow blind everything else. None of the three is trusted alone, because each one has weather it cannot see through.
The lidar.
A 128-channel spinning lidar on the cab roof, above the ring, with a vertical field an eighth of a circle top to bottom, turning ten times a second. It hands the picture its metric structure: the shape of the ground, the extent of a pile, the edge of a trench, the return from a person. It is the weakest sensor in fog and the first to lose a person in dark workwear, so it is never the only one.
The radars.
Six radar units at waist height, sixty degrees apart, each used only in the core of its field where its angles are honest. Dust that stops a lidar dead is almost transparent to radar. So radar is used for presence in dust and snow, never for position, and never on its own: a person standing still is invisible to it, and two people standing together are one radar object.
The sweep, and the swing.
A machine that swings drags its own boom through the lidar's field. Eddie knows where its boom is at every instant and removes the boom from the picture, rather than seeing a wall that is not there.
Cameras and lidar lose it. Radar holds.
Lidar sees every particle as a hard target. Radar barely sees them at all.
Lidar loses first. Cameras hold longer.
The lidar's returns fall away in fog before a camera's picture does.
Forward sensors bury. The ring holds.
Five minutes of driving snow can blind a forward-facing sensor; eight cameras around the machine do not all face the weather.
Radar loses it. Cameras and lidar hold.
A radar that reads motion cannot see someone standing still.
Lidar loses it. Cameras and radar hold.
Dark clothing returns almost nothing to a lidar.
Eddie removes its own authority.
When the sensors disagree or the weather takes them, perception is allowed to do one thing with doubt: take authority away.
It knows which way is up, which way it is pointing, and where its bucket is.
A machine on a slope, swinging a load, is not the same machine as one on the flat. Eddie carries the sensors that tell the difference, and it carries two of the most important one, because a cab and a chassis do not agree.
Two inertial units, not one.
One in the cab, one on the chassis. On an excavator they differ by the swing and by the cab's own mount, and treating them as one is a metre of error at the tool. The unit chosen is the class that can hold its attitude for minutes without correction, not the class in a phone; the difference was calculated before it was bought.
The swing, and the cylinders.
An encoder on the swing between the house and the tracks. A length sensor on the boom, stick and bucket cylinders, because measuring the cylinder puts the bucket's edge where it actually is, and measuring at the link does not.
Heading from two antennas.
Gravity tells a machine which way is down. It has no opinion on heading. Eddie takes heading from the line between two satellite antennas on the roof, held far enough apart to trust, and a survey-grade corrector where the job wants grade.
Fast, corrected, anchored.
The sensors on the controls are fast and close the loop. The attitude sensors correct it. The satellite fix is slow and drift-free, and it anchors the picture to the site's own grid; it never closes a loop on its own.
Objects, the ground, the near band where it stops, the far band where it watches.
The sensing set is built for the ground we work: dust, snow, fog, dark, and a machine that swings. This is the picture it builds.
An illustration of the picture Eddie builds: objects, the ground, the near band where it stops on entry, the far band where it watches. Not a live output.
Eight cameras around the machine.
Wide lenses, spaced evenly, tilted down, sized so there is no blind ground from the machine's own footprint out to the visibility circle the standard draws around a machine of its class.
One camera on the tool and the cut.
What the operator's eyes do: the bucket, the face, the load, the edge.
One camera reads the dash.
Engine running, oil temperature, fuel, the warning and fault lamps, the way an operator glances at them. It can stop Eddie. It can never start the machine.
A spinning lidar on the cab roof.
Structure, extent and the shape of the ground. The weakest sensor in fog, so it is never the only one.
Six radars for presence in dust.
The strongest sensor in dust and snow, and blind to a target that is not moving, so it is never the only one either.
It knows which way is up.
Inertial units on the cab and the chassis, an inclinometer on the upper structure and an encoder on the swing.
Every axis knows where it is.
Position and force sensing on each control Eddie works, a length sensor on each cylinder, and satellite positioning with a survey-grade corrector where the job wants it.
When it is unsure, it removes authority.
Snow buries forward sensors. Fog blinds lidar. A still target is invisible to radar. So perception is allowed to do one thing with doubt: take authority away. No performance level is claimed for the sensing set. Designed against ISO 13849 architecture, toward ISO 17757. No certification is claimed.
Each sensor on its own branch, so a failure has a name.
The picture is not one soup of pixels and points. Each sensor is read on its own, judged on its own reliability, and only then combined at the level of objects. When one sensor fails, Eddie can say which one, and carry on without it. Fusing everything early was tested and rejected: in fog it saw less than a single camera did.
The scene Eddie keeps never becomes fully certain about anything, by design. It keeps two separate books: ground it has never observed, and ground where its sensors disagree. Both are treated as unknown, and unknown means no authority there.
It is required to know when it cannot see.
Weather that scatters light is measured, not assumed away. A sensor that quietly loses range as it heats up is not trusted to say so; the limit is set from outside it. When the picture thins, Eddie's authority thins with it. The rule the whole set lives under is short: external sensing may remove authority. It may never create it. No AI layer may grant or restore motion authority.
Authority is not a ladder anyone can climb.
A move happens only when the safety system is clear, a named person has signed for this plan, the move is inside the limits that person approved, and the rate and force clamps are satisfied. All four, every time, or the machine does not move. There is no order to re-sort and no override.
How a new model earns its seat.
Perception and planning models are the fastest-moving technology in the world right now, and Eddie is built to take the next one. The thinking is replaceable on its own; the rules, the motion controller and the safety system underneath do not change when a model does. What changes is the bar a new model has to clear.
Four gates.
Nothing unsigned ever runs on a machine that can move. A new model has to fit the interface, keep to its time and memory, and be able to say stop, not only go; a model that can only ever emit a trajectory does not get in, however clever. It then runs in shadow beside the model it would replace, with no authority, until it has agreed with it long enough to trust. The swap happens at a beat of the controller, with the old model still resident. Rolling back drops the approval and a person signs again; there is no reverting to the last command.
It records how good operators move.
In manual mode, with a person in the seat, Eddie records what a skilled operator's hands actually did, at a rate and a resolution that make the record worth keeping. Where the stick paused. How the throttle came up before the swing. How the bucket was feathered into the face.
That record has no authority. It cannot move a control. Learning happens off the machine, is reviewed by a named person, and ships signed, governed so that no one person's technique is reproducible from it and no one person's contribution dominates it. There is no learning on the machine and no weight that changes itself in the field. Every update runs on our own fleet before it reaches yours.
The hands, drawn from the model.
Every control unit is drawn in the engineering model as built: the joystick pods, the pedal pod, the travel pod and the platform they sit on. These are the model's own views, drawn from the same model the machines are built against.
Where the job is prepared.
Before Eddie moves, the job is prepared off the machine: the site, its boundary, its datum, the drawings the work calls for, and the readiness checks. That preparation never touches the machine, holds no session and moves no control. It hands a ready job to the stack above, and the stack decides, in order, whether the machine moves.
The STE Site Foreman is where that preparation lives.