A payload meets its carrier at one seam, and four things cross it. The carrier sends power down and offers a data bus. It expects a safety interlock back, and it will not put power on the feed until that chain says the payload is home and safe. Under all three, the two machines have to agree on ground, or the payload finds a ground of its own through a shield braid or a mounting bolt, and that ground carries current nobody designed.
Those four things are four harnesses, each with its own shell, its own bundle, its own test and its own brief on the UAV line. None of them is designed on its own. They are one interface, engineered together, keyed together and proved together, because a seam designed in four pieces is not designed. It is discovered.
The mechanism
The set has four parts. The power feed carries the carrier's supply out and the payload's return back, in its own bundle and its own shell. The data bus carries the traffic both ways, shielded, in its own bundle and shell, with the shield terminated where the interface specification says. The safety-interlock set is a chain: the carrier's permission goes out, the payload's state comes back, and the loop closes only through the payload's own contacts, so an empty socket reads absent and a broken wire reads absent too. The ground and bond is the fourth part, the one most often left to chance: a designed path from the payload's chassis to the carrier's, made on purpose and not by the mounting bolts or any shield.
Three shells, then, and a bond the drawing places, not one connector. The three never share a shell, because the interlock never shares a shell with power and the bus does not want power's noise on its reference. They sit together on one plate on the payload and one on the carrier, so fitting the payload is one motion, not three, and inside that motion the contacts decide the order. Where the drawing puts the bond on a contact, that contact is the longest in the set and makes first. Power and data seat next, dead. The interlock's sense contacts are the shortest and close last, when everything else is already home. On the way out the same geometry runs backwards: the interlock opens first, the carrier drops the feed, the power contacts part with nothing across them, and the bond breaks last. Where the drawing puts the bond on a strap, the strap is made before the plate goes on and broken after it comes off, and the order is the same order.
Each shell is keyed apart from the others, so a power plug will not enter the data socket, and the payload's plate is keyed to the carrier's plate, so a payload built to a different specification does not go on at all. What connects to what is written once, in the interface specification, and the shop builds the four parts from it: the power feed, the data bus, the safety-interlock set and the ground and bond.
What it is engineered to
- An interface is a list of promises.
- The carrier promises a feed that is dead at the socket until the chain permits it, and protected at the carrier's end, so a fault in the payload is the carrier's to clear.
- It promises a bus that is terminated correctly whether a payload is fitted or not.
- It promises a bond point the drawing names, bare metal under a finish that stays bare, as the payload's only reference to the airframe.
- It promises to read the chain the safe way round: open is absent, and absent means no power.
- The payload promises to take power only from the feed and to send its return only on the feed's return conductor, never through the bond and never through a shield.
- It promises to reference the bus as the definition says.
- It promises to report its own state into the chain through its own contacts and its own loop, so that when it is not there, or not ready, or not sure, the chain is open.
- It promises one path to ground and no other.
Both halves of the seam are defined apart, not only mated. The carrier with no payload fitted is a defined condition: its plate is capped, its feed is dead, its bus is terminated at the carrier, and its chain reads absent rather than fault. The payload on the shelf is a defined condition too: its plate is capped, its loop is open, and its identity is on its shell. A seam defined only in the mated state is half a seam, and the other half is where the surprises live.
The joint has to survive the airframe. Vibration is constant and works at every contact and every crimp. Temperature swings from cold soak on the ramp to hot under load, and every material in the set moves at its own rate. Hands mate the set and break it in gloves, in the dark and in a hurry, and a hand in a hurry pulls on the harness rather than the shell, so the plate takes the pull and the backshell holds the bundle. Get this wrong and the failure arrives later, as an intermittent on the interlock, which the carrier reads as absent and refuses to power, and which the crew reads as a bad payload and starts swapping.
Safety circuits never share a bundle, a splice or a shell with power.
The discipline applied to this harness
Safety circuits never share a bundle, a splice or a shell with power. The interlock chain is its own bundle on both sides of the plate, from the carrier's controller to the payload's state contacts. It has no splice, because a splice in a safety chain is a place where a fault can close the chain. It shares no shell, because a shell shared with power is a place where a bent pin can close it too. The bus runs apart from the feed, and where the two must cross they cross once, square. That is segregation, decided on the drawing.
A shield does its work grounded where the drawing grounds it. Tie the other end down as well and the braid becomes a conductor with a current of its own, and nobody drew that circuit. The interface specification names the end. The bus shield terminates at the shell at that end and floats at the other. The bond exists so the two chassis sit at one potential; it carries no designed current, and the payload's return goes home on the feed's return conductor. The mounting bolts are not the bond unless the drawing makes the mounting interface the bond and says how it is prepared. A bond that happens because metal met metal is not a bond anybody can find when it fails. That is shielding and bonding for the set as a whole.
The connectors are keyed apart, and the keying is proved on both halves against every socket on both plates. The routing treats the set as separate harnesses: the interlock takes the shortest and most protected run, nothing crosses a hinge unsupported, and the service loop at the plate is drawn, not left to the fitter. Every conductor carries its circuit identity, end to end, and each shell carries the set's identity and its position in it, on both halves, so the pair is recorded as a pair under labelling and traceability.
- The bench check of the two mated halves proves the interface, not the machines.
- It proves continuity on every circuit through the mated joint, and isolation between every pair of circuits that must never meet: power to bus, power to chain, chain to bus, and everything to shell except the bond.
- It proves the bond path present through the bond contact and absent through every other route a meter can find.
- It proves the chain closes only at full mate and opens first at demate.
- It proves that each plug is refused by each wrong socket.
- What each check is set to is written on that assembly's own record against its own specification.
- The seam is proved in the shop, under test and acceptance, so it is not discovered on the ramp.
A set engineered as four separate parts fails a particular way. Four parts, four people, four desks. The power designer and the bus designer each pick a shell from the same drawer, with the same key, because that is what the drawer had. The interlock is drawn last, by whoever has time, and threaded through the spare contacts of the power shell because the contacts were there. Ground is nobody's, so it happens through whatever touches. Each drawing is correct. The set is wrong. At integration the power plug goes into the data socket and the pins line up. The chain reads present before the power contacts are home, and a live socket is in someone's hand. The bracket is a ground until a maintainer fits an isolator mount, and after that the return goes home through the bus shield and the bus drops out under load, which is the moment the payload was doing its job. It shows in the field, as an intermittent, on a machine nobody can hold still, and it is paid for in a flight lost, a payload swapped that was never faulty, and a truck to a site with no road.
How it is bought
The set is bought from an issued interface specification with one owner, usually the carrier's integrator, sometimes the payload's builder, and never four people. We take the specification as issued. If it exists only in four parts, the first job is to make it one, on paper, with the owner, before anything is drawn. The set's drawing belongs to that owner and not to us.
The takeoff comes off the definition: every conductor, contact, shell, backshell, strap, sleeve and label in the set, counted as a set. The shop drawing draws the set as one drawing, with the mate order and the keying on its face, and it is signed before anything is cut. Nothing is fabricated until the drawing is signed. Then we walk the carrier and the payload with the drawing in hand and fix where each plate sits, where each bundle runs, and how much loop the mount needs when it moves. Lengths come off the walk and go to the formboard as walked. Where the walk finds a value the specification does not carry, the value goes back to the owner as a question, not onto a wire as an assumption. A value nobody measured never reaches a wire.
Every assembly in the set leaves with its own record: its identities, its bench results, the keying proof for both halves, and who ran the check. The whole pack goes back to the drawing's owner: the takeoff, the signed shop drawing, the walk sheet and the records. The next carrier, or the next payload built to the same definition, is built from that record. Nobody has to remember which end the shield was grounded at, because the drawing says so and the record shows the check that proved it. We build to a customer's issued set and we return the manufacturing detail.
The components we specify carry their own certification. The approval route for a finished, project-specific assembly is confirmed with the certifying body for that assembly before it is built, and we tell you where yours sits before we build it, not after. CSA and the Canadian Electrical Code govern, and the route is confirmed for the set as an assembly, not inferred from its parts.
We refuse three jobs. We do not build one part of the set from anything less than the whole set's definition, so a data whip cut this week is cut from a specification that already carries the feed, the interlock and the bond, whether or not those three are on the order. We do not build a payload half to mate with a carrier socket whose definition we have not been given. And we do not build from four drawings with four owners, because that set has already failed and the only question left is where. To start, bring the interface specification, or bring the four drawings and the name of the person who will own the one they become. The conversation starts at enquiries, and how it is built walks the same path for every set in the harness library.
