When the operator leaves the seat, the machine loses the person who would have hit the stop. The kit that takes the seat has to bring a stop with it, and it has to bring one that still works when the kit itself is the thing that has failed. That rules out any stop a computer has to permit. A stop that asks software for permission fails with the software, and software fails in ways nobody drew. The chain this harness carries is contacts and copper from the first button to the last coil, and nothing in it waits on an instruction to open.
The kill cord on an outboard is the whole idea. Clip it to your wrist, go over the side, and the engine dies. The cord does not ask the engine whether stopping is convenient. It opens a contact. Everything below is that contact, made to survive a working machine and made so that nobody can defeat it without knowing they have.
The mechanism
The chain is a loop of contacts in series, closed while every device in it says run and open the moment any one of them says stop. The devices are the kit's own stop buttons, mounted where the programme's drawing puts them; the receiver for the remote stop, whose contact opens when the link is lost as well as when the button is pressed; the interlocks on the kit's guards and enclosures; and the kit's watchdog, a relay that holds only while the kit's controller keeps proving it is alive. That last device is the only place software touches the chain, and it touches it one way. Software can let the relay drop and stop the machine. It cannot hold the relay up once the hardware has dropped it, and it cannot close a button a person has pressed.
The loop runs as two channels, each its own pair of conductors through every device, and a monitoring relay at the end of the chain compares them.
The chain has its own bundle, its own shells and no splice. Every conductor runs from a device terminal or a chain connector to the next and joins nothing on the way. No butt connector, no in-line join, no place where somebody could later add a wire.
At the end of the kit's chain is one contact, the output of the monitoring relay, and it sits in series in the host machine's own stop chain, at the point the programme's drawing names, through a connector on the host side. The host's chain is the one the machine's maker built, from the machine's own buttons through the machine's own relay to whatever it holds up: the engine run circuit, the hydraulic enable, the pilot pressure dump. The kit's contact is one more link in that chain and replaces nothing. Any kit stop opens the host's chain, and the machine stops the way its maker intended. Any host stop opens the host's chain on its own, and the kit is not consulted.
When the kit is removed, its contact leaves with it, and what must remain is the host's chain, complete, with every one of its original stops working. The socket the kit's contact occupied is closed by a blanking plug: a keyed, labelled, tethered part that is on the programme's drawing, fits that socket and no other, and cannot be fitted while the kit is. The socket holds one or the other.
What it is engineered to
The kit promises the host's chain a contact that is closed when the kit says run and open in every other condition: a button pressed, the remote link lost, a guard lifted, the controller silent, the kit unpowered, the kit's harness cut. The host promises the kit a point in its own chain where a series contact can sit, a connector to sit it through, and that opening the chain still stops the machine in the way its maker designed.
Open, short and de-energised all read as stopped. A broken conductor is an open loop, and an open loop is stop. The monitoring relay tests the two channels against each other, so a short between them, or from either channel to the frame, is a disagreement it sees, and a disagreement is stop. A loss of supply to the relay drops it, and a dropped relay is stop. The only state that reads as run is both channels closed, both in agreement, the relay powered, and a person having reset it since the last stop. The chain does not reset itself, because a machine that restarts when a fault clears is a machine that restarts while somebody is fixing it.
This joint is handled harder than any other. A stop button is the one thing on the machine a person hits with the flat of a hand, in a hurry, from whatever angle they were standing at. The conductors behind it take that blow every time, so the button's cable arrives with strain relief that carries the load into the mounting and not into the terminals. The remote stop's receiver sits where its antenna sees the sky, which is a place that vibrates and gets washed. The series connector on the host side is made and broken every time the kit comes off, in the dark, with gloves on, by a person thinking about something else.
When either side changes, the interface changes with it. A service bulletin that alters the host's stop circuit, or a new stop device on the kit, is a new revision of the issued set, and the chain is built to that revision. A chain is not modified in place.
Nothing is fabricated until the drawing is signed.
The discipline applied to this harness
Safety circuits never share a bundle, a splice or a shell with power. A power conductor that chafes into a network pair corrupts data. A power conductor that chafes into a stop pair can hold the chain closed, and a chain held closed by a chafe reads run for as long as the chafe lasts.
Segregation is total on this harness. The chain's bundle runs apart from power, apart from actuator motor lines and apart from the network and fieldbus loom, on its own clamps, because a clamp shared with a power bundle is a place where two jackets rub each other for the life of the machine. It enters every enclosure through its own gland, because a shared gland is where a stripped end can meet a stripped end. The chain does not depend on a shield to be safe; where the drawing gives it one, it is grounded at the named end only. No conductor of the chain uses the frame as its return. A chain that returns through the frame has a channel that a corroded bolt can open and a loose bolt can close, and neither event appears on any drawing.
The connectors carry the chain alone, keyed so that no chain plug fits a power or network socket and none of theirs fits a chain socket, with secondary locks on the contacts and seals where they live outside. Routing keeps the chain away from pinch points, out of the grommet the motor lines use and off the outside of a bend where a hose will rub it. Each stop button's cable arrives with a drip loop below the button. Every conductor carries its identity, end to end, and on this harness the identity says what the conductor is for, so that nobody lands one on a power terminal because it was the right colour and to hand, and so that a person testing the chain knows which channel they are opening.
Test asks what the bench can prove. It proves that every stop device opens the chain, that each channel on its own opens it, that a short across the channels reads as a fault, that removing power from the relay reads as stop, and that the kit's output contact is open whenever the kit is unpowered. It proves that no chain conductor shows continuity to any power conductor or to the frame, and that test is run on every finished assembly before it leaves. When the chain is landed, the same sequence is walked on the machine by whoever commissions it, with the host's own stops pressed too, and then again with the kit removed and the blanking plug fitted, to prove that the machine given back to its operator is the machine the operator had.
A jumper fitted to make a machine run on the bench is the most dangerous object in the shop. It is made in a moment of need: a controller on the bench needs the chain closed to test a motor, and somebody bridges the socket with a length of wire. It has no label, no drawing and no record. It works, which is the problem, because a thing that works is not looked at again. The person who fitted it is not the person who packs the machine, and the machine leaves with every stop button on it wired to nothing. The first anyone knows is a machine that should have stopped and did not. The blanking plug is the answer to the jumper: a drawn part whose fitting is a recorded act. Nothing bridges a safety socket except a drawn plug. A bench harness that closes a chain for test is itself a drawn, labelled assembly; it lives on the bench, and it is counted before the shop closes.
Done badly, this harness fails in one of two directions. It stops when it should not, because a crimp opened or water got into a shell, and the machine sits in a field until somebody drives out. Or it does not stop when it should, because a stop contact was wired into the kit's controller instead of the host's chain, a power conductor in a shared bundle held a channel closed, or a jumper went to the field. The first costs a truck roll. The second is the failure the whole chain exists to make impossible.
How it is bought
The machine programme owns the design and the drawing master. The stop devices and their positions, the channel arrangement, the monitoring relay, the point in the host's chain where the kit's contact sits and the connector it sits through, all come from the programme's issued set. We build the full shop pack to that set and we return the manufacturing detail to it.
The takeoff comes first: every conductor, contact and shell, the relay, the buttons, the receiver, the blanking plug, every clamp and every label, taken off the issued set as a list the programme can check. The shop drawing follows, and nothing is fabricated until it is signed. Before it is signed, the chain is walked on the machine, from each button and each guard to the relay and from the relay to the host's socket, and the walk fixes every length, because the schematic knows where a button is and not what the cable has to go around to reach it.
CSA governs, and the Canadian Electrical Code with it. The components we specify carry their own certification. The approval route for a finished, project-specific assembly is confirmed with the certifying body for that assembly before it is built, and we tell you where yours sits before we build it, not after.
Each chain leaves with its own record: the reel, the contacts and shells, the tool and its setting for every crimp, the person who built it, the result of every test above, the labels end to end, and the blanking plug, counted and tethered. The record, the shop drawing, the cut list and the formboard go back to the programme's drawing master, so that the master carries what was built.
To start, send us the issued set, or a description of the host's stop chain and the kit's stop devices if the set is not complete. The enquiries page says how.
- We do not splice a safety conductor.
- We do not land a safety contact in a shell that carries power, and we do not run one in a bundle that does.
- We do not fit a jumper, and a chain that arrives at our bench with one in it is opened before anything else is done to it.
- We do not put a chain drawing in front of you for signature until we have walked it on the machine.
- A stop is the one part of an autonomous machine that must work on the day everything else has failed, and it is built as if that day is the only one that counts.
