La IA planea. Las reglas gobiernan. Los humanos autorizan. La seguridad tiene veto.
Steady Eddie lleva su inteligencia a bordo, en capas, cada una con un trabajo y un límite. Las capas que perciben y planifican son modelos de software, y los actualizamos: a medida que los modelos mejoran, cada unidad mejora con ellos. Las reglas que gobiernan a los modelos, el controlador que mueve la máquina y el sistema de seguridad que puede detener todo no son tocados por una actualización, y ningún modelo puede convencerlos de lo contrario.
La máquina trabajando, girando en el modelo de ingeniería.
Qué propone, qué decide, qué detiene.
Cada comando pasa hacia abajo a través de esta pila. El razonamiento es reemplazable. Las partes que gobiernan, mueven y protegen no lo son, y están debajo, donde un modelo no puede alcanzarlas.
Habla con la cuadrilla y lee el trabajo.
La parte que entiende un plan, una pregunta o un dibujo, y explica qué pretende hacer Eddie. Asesora. Nunca ordena un control.
Convierte un trabajo aprobado en acciones ordinarias y acotadas.
Un corte, un levantamiento, una pasada, un giro, cada uno dentro de los límites fijados para esa máquina. Un plan es una propuesta hasta que todo lo que está debajo lo admite.
Observa, y solo puede decir alto.
Detección, clasificación y seguimiento de lo que rodea a la máquina, con una confianza en cada uno. La percepción puede retirar autoridad. No puede otorgarla. Puede decir alto; no puede decir adelante.
Cada comando se admite o se rechaza aquí.
Reglas simples, las mismas cada vez. Esta es la línea entre lo que quiere la IA y lo que se le permite hacer a la máquina.
Un controlador de ciclo fijo opera cada control.
Mueve la palanca, el pedal, la manija, de la manera en que se lo enseñó la calibración, y nada más. Un modelo más rápido toma una mejor decisión; no hace que una válvula hidráulica abra más rápido, y los controles propios de la máquina fijan el piso de cada respuesta.
Un controlador de seguridad independiente con veto sobre todo lo que está arriba.
Cableado por separado, alimentado por separado, respondiendo a la persona junto a la máquina y a sus propios sensores. Cuando dice alto, nada por encima tiene voto.
Ocho cámaras en un anillo, y un disco a los propios pies de la máquina que ninguna cámara puede ver.
El anillo no es una cámara atornillada donde hubo espacio. Es una geometría calculada: cuántas lentes, a qué altura, inclinadas cuánto hacia abajo, de modo que se vea cada metro cuadrado desde la propia huella de la máquina hasta el círculo de visibilidad que la norma traza alrededor de una máquina de su clase, y desde cinco metros hacia afuera sea visto por dos cámaras a la vez.
Por qué ocho.
Siete cámaras dejan terreno que solo una lente ve. Ocho dejan casi ninguno, y un objetivo visto por dos cámaras es un objetivo con una distancia, no solo un rumbo. El anillo está girado de modo que ninguna cámara quede sobre la línea central de la pluma, donde la pluma la bloquearía.
El disco ciego, declarado.
Una cámara en lo alto de una máquina no puede ver el terreno a sus propios pies. La geometría deja un disco de poco más de dos metros de diámetro, en el centro de rotación, que el anillo no cubre, y el dibujo lo declara en lugar de ocultarlo. Ese disco es la razón por la que existe la banda cercana: no se permite que nada esté en ella cuando la máquina está armada, y los controles propios de la máquina, junto con la regla de que nada puede estar ahí cuando la máquina está armada, son lo que lo mantiene así. La cifra proviene de la geometría, y la verificamos en la máquina.
Delgado a propósito.
La propia visión de un operador está protegida por una norma que fija cuánto puede bloquear un accesorio a la altura de los ojos. Los módulos de cámara de Eddie están dimensionados según esa regla: lo suficientemente delgados para que una persona en el asiento vea lo que siempre vio.
- Lentes anchas, cada una abarcando un tercio del horizonte, inclinadas bien hacia abajo desde un anillo a la altura del techo.
- Cada cámara lee el cuadro completo a la vez, así que una cabina que vibra no deforma el mundo.
- Alto rango dinámico: un sol bajo y un taller oscuro en el mismo cuadro.
- Instaladas en los propios puntos de espejo y pasamanos del fabricante, nunca en una estructura antivuelco.
Dos lentes, un obturador, una regla sobre la luz.
El anillo quiere amplitud. La herramienta quiere detalle. La cabina vibra. El sol está sobre el horizonte a las cuatro de la tarde en enero. Cada una de esas es una decisión de lente, y cada una se tomó en papel antes de comprar una cámara.
The awareness lens.
A lens on each ring camera that takes in a third of the horizon, so a quadrant is covered with margin and a person at the edge of the circle still fills enough of the frame to be a person and not a smudge. The eight overlap; the overlap is where depth comes from.
The work lens.
A lens half as wide on the roof, looking forward and down at the tool and the cut: the bucket, the face, the load, the edge. What an operator's eyes do for most of a shift.
The shutter.
A camera that reads its frame line by line, the way most phone cameras do, bends a straight post into a lean when the cab it sits in is shaking. Eddie's cameras read the whole frame at once. A vibrating cab is the normal condition on a working machine, so this was never optional.
The dash, read the way you read it.
One camera in the cab looks at the instrument cluster and reads it optically: engine running, temperature, fuel, the warning and fault lamps. No wire enters the machine to ask. It can stop Eddie. It can never start the machine.
A spinning lidar, radar where the weather calls for it, and a plain account of what each one loses.
Cameras give the picture. The lidar gives structure and a direct range to everything it hits. Radar, fitted as an option where rain, dust and snow are the normal condition, gives presence when they blind everything else. None of the three is trusted alone, because each one has weather it cannot see through.
The lidar.
A hundred-and-twenty-eight-channel spinning lidar on the cab roof, above the ring, with a vertical field an eighth of a circle top to bottom, turning ten times a second. It hands the picture its metric structure: the shape of the ground, the extent of a pile, the edge of a trench, the return from a person. It is the weakest sensor in fog and the first to lose a person in dark workwear, so it is never the only one.
Radar, as an option.
Where rain, dust or snow are the normal condition on a site, radar units are added at waist height around the machine, each used only in the core of its field where its angles are honest. Dust that stops a lidar dead is almost transparent to radar. So radar is used for presence in dust and snow, never for position, and never on its own: a person standing still is invisible to it, and two people standing together are one radar object.
The sweep, and the swing.
A machine that swings drags its own boom through the lidar's field. Eddie knows where its boom is at every instant and removes the boom from the picture, rather than seeing a wall that is not there.
Cameras and lidar lose it. Radar, where fitted, holds.
Lidar sees every particle as a hard target. Radar barely sees them at all, which is why dusty sites get it.
Lidar loses first. Cameras hold longer.
The lidar's returns fall away in fog before a camera's picture does.
Forward sensors bury. The ring holds.
Five minutes of driving snow can blind a forward-facing sensor; eight cameras around the machine do not all face the weather.
Radar loses it. Cameras and lidar hold.
A radar that reads motion cannot see someone standing still.
Lidar loses it. Cameras hold, and radar where fitted.
Dark clothing returns almost nothing to a lidar.
Eddie removes its own authority.
When the sensors disagree or the weather takes them, perception is allowed to do one thing with doubt: take authority away.
It knows which way is up, which way it is pointing, and where its bucket is.
A machine on a slope, swinging a load, is not the same machine as one on the flat. Eddie carries the sensors that tell the difference, and it carries two of the most important kind, because a cab and a chassis do not agree.
Two inertial units, not one.
One in the cab, one on the chassis. On an excavator they differ by the swing and by the cab's own mount, and treating them as one is a metre of error at the tool. The unit chosen is the class that can hold its attitude for minutes without correction, not the class in a phone; the difference was calculated before it was bought.
The swing, and the cylinders.
A band on the carbody read by a downward camera, giving the angle between the house and the tracks. Inclination sensors on the boom and the stick, because measuring the cylinder puts the bucket's edge where it actually is, and measuring at the link does not.
Heading from two antennas.
Gravity tells a machine which way is down. It has no opinion on heading. Eddie takes heading from the line between two satellite antennas on the roof, held far enough apart to trust, and a survey-grade corrector where the job wants grade.
Fast, corrected, anchored.
The sensors on the controls are fast and close the loop. The attitude sensors correct it. The satellite fix is slow and drift-free, and it anchors the picture to the site's own grid; it never closes a loop on its own.
Objects, the ground, the near band where it stops, the far band where it watches.
The sensing set is built for the ground we work: dust, snow, fog, dark, and a machine that swings. This is the picture it builds.
An illustration of the picture Eddie builds: objects, the ground, the near band where it stops on entry, the far band where it watches. Not a live output.
Eight cameras around the machine.
Wide lenses, spaced evenly, tilted down, sized so there is no blind ground from the machine's own footprint out to the visibility circle the standard draws around a machine of its class.
One camera on the tool and the cut.
What the operator's eyes do: the bucket, the face, the load, the edge.
One camera reads the dash.
Engine running, oil temperature, fuel, the warning and fault lamps, the way an operator glances at them. It can stop Eddie. It can never start the machine.
A spinning lidar on the cab roof.
Structure, extent and the shape of the ground. Structure, extent and the shape of the ground.
An option for rain and dust.
The strongest sensor in dust and snow, and blind to a target that is not moving, so it is never the only one either. Added where a site's weather calls for it.
It knows which way is up.
Inertial units on the cab and the chassis, an inclinometer on the upper structure and an encoder on the swing.
Every axis knows where it is.
Position and force sensing on each control Eddie works, a length sensor on each cylinder, and satellite positioning with a survey-grade corrector where the job wants it.
When it is unsure, it removes authority.
Snow buries forward sensors. Fog blinds lidar. A still target is invisible to radar. No performance level is claimed for the sensing set. Designed against ISO 13849 architecture, toward ISO 17757. No certification is claimed.
Each sensor on its own branch, so a failure has a name.
The picture is not one soup of pixels and points. Each sensor is read on its own, judged on its own reliability, and only then combined at the level of objects. When one sensor fails, Eddie can say which one, and carry on without it. Fusing everything early was tested and rejected: in fog it saw less than a single camera did.
The scene Eddie keeps never becomes fully certain about anything, by design. It keeps two separate books: ground it has never observed, and ground where its sensors disagree. Both are treated as unknown, and unknown means no authority there.
It is required to know when it cannot see.
Weather that scatters light is measured, not assumed away. A sensor that quietly loses range as it heats up is not trusted to say so; the limit is set from outside it. When the picture thins, Eddie's authority thins with it. The rule the whole set lives under is short: external sensing may remove authority. It may never create it. No AI layer may grant or restore motion authority.
Authority is not a ladder anyone can climb.
A move happens only when the safety system is clear, a named person has signed for this plan, the move is inside the limits that person approved, and the rate and force clamps are satisfied. All four, every time, or the machine does not move. There is no order to re-sort and no override.
How a new model earns its seat.
Perception and planning models are the fastest-moving technology in the world right now, and Eddie is built to take the next one. The thinking is replaceable on its own; the rules, the motion controller and the safety system underneath do not change when a model does. What changes is the bar a new model has to clear.
Four gates.
Nothing unsigned ever runs on a machine that can move. A new model has to fit the interface, keep to its time and memory, and be able to say stop, not only go; a model that can only ever emit a trajectory does not get in, however clever. It then runs in shadow beside the model it would replace, with no authority, until it has agreed with it long enough to trust. The swap happens at a beat of the controller, with the old model still resident. Rolling back drops the approval and a person signs again; there is no reverting to the last command.
A separate rig records how good operators move.
With a person in the seat and the unit out of it, a separate recording rig takes down what a skilled operator's hands actually did, at a rate and a resolution that make the record worth keeping. Nothing of Eddie's is connected while it runs, control units included, and the rig is wired to nothing on the machine. Where the stick paused. How the throttle came up before the swing. How the bucket was feathered into the face.
That record has no authority. It cannot move a control. Learning happens off the machine, is reviewed by a named person, and ships signed, governed so that no one person's technique is reproducible from it and no one person's contribution dominates it. There is no learning on the machine and no weight that changes itself in the field. Every update runs on our own fleet before it reaches yours.
The eyes and the brain, named.
The cameras are Leopard Imaging on Sony IMX490 imagers. The lidar is an Ouster OS0-128. Position and heading come from an SBG Systems Ellipse-D, the motion of the house from a VectorNav VN-110, the boom and stick angles from SICK inclination sensors. The computer is an NVIDIA Jetson AGX Orin on a Connect Tech carrier. Every part STE Integrate is engineered around, by maker.
The hands, drawn from the model.
Every control unit is drawn in the engineering model as built: the joystick pods, the pedal pod, the travel pod and the platform they sit on. These are the model's own views, drawn from the same model the machines are built against.
Where the job is prepared.
Before Eddie moves, the job is prepared off the machine: the site, its boundary, its datum, the drawings the work calls for, and the readiness checks. That preparation never touches the machine, holds no session and moves no control. It hands a ready job to the stack above, and the stack decides, in order, whether the machine moves.
The STE Site Foreman is where that preparation lives.