A carrier supplies power and a data bus to whatever it carries, and it expects a set of safety interlocks back before it will arm. A payload consumes the power, talks on the bus and reports its state into the interlock chain. Between them there is a seam, and in that seam there is a fourth circuit that rarely makes the first sketch: ground and bond. The four cross one boundary, usually through one connector or a small connector group, and they have to be kept apart while the shell holds them together.
We engineer the four as one matched set. Power feed, data bus, safety-interlock set, and ground and bond are designed together, keyed together and checked together as a single interface, not as four items that happen to share a shell. The set is built from an interface specification that the carrier's programme issues and owns, and the manufacturing detail we produce goes back to that specification.
Why the payload seam is the hard part
Every other electrical joint on an airframe is made once, at assembly, by the people who drew it, and then left alone. The payload seam is different in three ways.
The first is that two design authorities meet there. The carrier's designer owns the airframe, its distribution, its arming logic and its airworthiness. The payload's designer owns the sensor or the package and the boards behind it. Neither owns the other's drawing. The seam is the one place on the machine where a conductor leaves one drawing set and lands in another, and a conductor that crosses that line with a different name on each side, or a different return on each side, is a fault waiting for its first flight.
The second is that the seam is handled. It is mated and broken by people, in the field, between flights, in weather, often in a hurry. A joint that is made once can be fussy. A joint that is made again and again by a crew in gloves cannot be.
The third is that the seam carries the one circuit the carrier trusts with the decision to arm. Power and data are recoverable. A bus that drops resends. A feed that sags browns out a sensor and the log says so. An interlock that reads closed when the payload is not safe cannot be corrected in software, because the software is reading that interlock to decide what it is allowed to do. Safety circuits never share a bundle, a splice or a shell with power, and at the payload seam that sentence has to survive a connector that a tired person is pushing home in the dark.
Ground is the part of the seam most often left to sort itself out. A payload that is not given a drawn return will find one. It will find it through the shield of the data bus, because the shield is a conductor and it goes where the payload goes. It will find it through the mounting bolts, because they are metal and they touch the airframe. Either way the payload has built a return path that nobody drew and nobody sized. Anyone who has watched a starter crank slowly while the headlights dim already knows this circuit. The strap from the engine to the frame has corroded, and the current is coming home through the throttle cable and whatever else bridges the two. It works in the yard and fails on the coldest morning of the year. A payload that grounds through its mounting bolts is the same fault, in the air, where nobody can reach it.
The topology of the set
The set has four circuits and one boundary. What is connected to what, and where each bundle splits, is settled before any cable is chosen, because segregation settles it.
The power feed begins at the carrier's distribution point, and it is protected there. The device that protects the feed lives at the source, on the carrier, so that a fault anywhere downstream, in the harness, in the connector or in the payload, is cleared by something upstream of it. A feed protected at the payload end protects nothing between the source and the payload. The feed runs as a pair, supply and its own return, twisted where the route allows so that the loop it makes is as small as the airframe permits. It lands in a shell that carries power and nothing that must never see power.
The data bus is its own bundle. Each signal pair is twisted with its own return, and the pairs are shielded end to end. The shield is continuous from the payload's board to the carrier's, is terminated at each end by the method the drawing states, which at one end may be no termination at all, and is bonded to the shell at the connector rather than carried through a contact as though it were a signal. The bus is matched along its length: one cable construction from end to end, no splice, no change of cable type where the run passes a bulkhead, no unshielded pigtail where somebody ran short.
The safety-interlock set is a third bundle, and it has its own shell. The chain is a set of links the carrier reads before it arms. A presence link closes only when the payload connector is fully home. A ready link the payload closes only when its own checks have passed. A fault link it opens the moment it detects a condition it does not trust. The programme's arming logic decides what else the chain carries. The set is wired so that every failure reads as not safe. An open chain is not safe. A chain shorted to itself is not safe, because the sense is designed to tell a genuine closure from a short. A dead payload is not safe, because the carrier is reading a state, not the absence of a fault. None of this shares a bundle, a splice or a shell with the feed.
Ground and bond is the fourth circuit, and it is drawn. The power return is one conductor with one path. The signal reference travels with the bus. The chassis bond is separate from both: a conductor, a strap or a prepared mounting interface named on the drawing, so that the shield is never the return and no bond happens by accident. Where the connector has a ground contact that makes first and breaks last, the bond is in place before power arrives and stays in place until after power is gone. Shielding and bonding carries the shop's rules for both.
The splits follow the circuits. Power branches toward distribution on the carrier side and toward the payload's power entry on the other. Data branches toward the flight computer and the payload's controller. The interlock branches toward the arming circuit and nowhere else. Where two bundles pass through the same bulkhead, the drawing states the separation between them and the routing keeps it.
Nothing is fabricated until the drawing is signed.
What the connector at the seam has to survive
The connector at the payload seam has the hardest life of any connector on the machine, and the harness behind it is designed for that life rather than for the bench.
It is mated between flights. Every mate wears the contacts and works the coupling. The coupling is positive, threaded or bayonet, with a lock a person can feel and hear, so that a connector that is nearly home never reads as home. The presence loop in the interlock set is wired through the last contacts to make, so that a connector that is not fully coupled cannot report the payload present.
It is mated in the dark. Keying is found by feel. The shell is polarised so that the wrong orientation refuses to enter rather than entering crooked and bending a pin, and the orientation mark is a raised feature, not a printed one, because paint wears and light fails.
It is mated with gloves. The coupling ring is sized for a gloved hand. There is no small latch, no tool, no locking tab that needs a fingernail. A crew that has to take a glove off to mate a connector in a prairie winter will find a way not to, and the way they find will be the wrong one.
It rides a vibrating airframe. Contacts are retained in the insert by the insert, not by the crimp. The harness is clamped close behind the backshell so that vibration is taken by the clamp, not by the contacts. There is enough service loop to mate and unmate without strain and not enough to flog against structure. The bend out of the backshell is gentle, because a tight bend at a fixed end fails later, as an intermittent, on an airframe between flights, when there is no time to look.
It is left unmated, facing the weather. When the payload comes off, the carrier's half stays on the airframe with the elements on it. That half carries a cap on a lanyard, and it is sealed against the cap as well as against its mate. The half that would carry power if anything ever energised it unmated is the socket, so that its contacts are recessed and no finger, tool or dropped washer can reach them. The interlock shell, when open, reads open, which is to say not safe.
Every rule above exists because the person mating the connector is not the person who drew it. The connector is chosen on the drawing, from the carrier's issued specification, and the drawing states the contact, the plating, the backshell, the seal and the strain relief. We build what the drawing states, and connectors sets out how.
What each side promises the other
An interface is a set of promises. At the payload seam there are four pairs of them, and they are written into the interface specification before the harness exists.
| Circuit | The carrier promises | The payload promises |
|---|---|---|
| Power feed | A feed of stated character on stated contacts, protected at the source, and removed whenever the interlock chain is not safe | To draw within the stated envelope, never to backfeed, and to accept the feed being removed at any moment |
| Data bus | A bus with a stated reference, a stated termination, and a shield bonded at the end the specification names, by the stated method | To carry its pairs on the stated contacts, to keep the shield off its own return, and to terminate as the drawing states |
| Safety-interlock set | To read the chain before arming, and to treat open, shorted and dead as not safe | To close the chain only when it is safe, through its own contacts, and never from a power fault |
| Ground and bond | One bond point, and one drawn return for the feed | To return through the drawn path, to bond through the designed one, and to find no other |
The promises hold as long as both sides keep them, and the harness is the thing that either keeps them or breaks them in copper. A harness that lands the feed's return on the shield has broken the ground promise for both sides at once.
When one side changes, the specification changes first. A payload revision that draws more, a carrier with different arming logic, a connector that goes out of production: each is a change to the promises, and it goes through the owner of the specification before it goes through the shop. A harness that follows a change nobody wrote down has been built to a seam nobody owns.
How a bad seam presents in service, and who pays
A return that was never drawn presents as a payload problem. The bus drops when the motors spool up. The sensor reads noise on climb and clean on the ground. The payload reboots when the gimbal slews. Every one of those is logged as a payload fault, and someone spends weeks inside the payload looking for a fault that lives in the harness, in a return that carries current only when something else on the airframe is pulling hard.
An interlock that shares a shell with power presents late, and it presents as the wrong thing. A bent pin, a drop of moisture or a chafed bundle bridges a power contact to an interlock contact, and the carrier reads armed from a fault. On the bench that is a scare. In the field it is the reason the rule exists.
A pinout without an owner presents on the first mate. Two teams each know the contact assignment. One of them revises it. The harness is built to the other. The first time the new payload is mated, a power contact lands on a signal pin, and the result is either smoke or silence, with a drawing on each side of the seam that says its own side is right. The build was correct to its drawing. The drawing was correct to its issue. The seam had nobody.
A connector mated badly in the dark presents as an intermittent that only happens in the air. A pin pushed back in its insert makes on the bench, where the harness is still, and opens under vibration, where it is not. A harness carried by its contacts rather than its clamp fatigues at the crimp, and the open arrives after a run of flights as a fault that can be wiggled closed and cannot be found.
Everyone in the chain pays, in their own currency. The operator pays in aircraft on the ground. The field crew pays in swap time and in flights that abort at the arming check. The programme pays in a fault chased in the wrong place, in a payload sent back to its maker with nothing wrong with it, and in a truck sent to a site to change a harness. Where the interlock is the circuit that failed, the payment is a hazard: a payload armed when nobody meant it to be, on a machine with no one aboard to notice.
How a set is bought
A matched set is built from an issued interface specification, and it is not built from anything less.
The carrier's programme owns the seam. Its specification states the connector at the boundary, the contact assignment, the character of the feed, the bus and its reference, the safe state of the interlock chain and how it is read, the bond point, and the envelope the payload and its harness have to fit. The payload side either works to that specification or issues its own half against it. Either way the seam has an owner, and the owner has a document.
We take the issued specification and perform the takeoff against it. From that we design the set: the routing and segregation of each bundle, the cable construction for each circuit, the contact and backshell for each shell, the strain relief, the identity of every conductor, and the test each assembly has to pass before it leaves. That work produces a shop pack, and the shop pack goes back to the specification's owner. We build to the issued set and we return the manufacturing detail. The design authority stays where it was, and the record we owe back completes our side of the seam. How to engage sets out what to send and what comes back.
Nothing is fabricated until the drawing is signed. A verbal pinout is not a drawing. A specification with a contact still to be confirmed is a drawing that is not finished, and we wait for it to be finished rather than guess, because a harness built to a guessed contact is a hazard, not a harness.
Each assembly is tested against its own drawing before it leaves, and the values on the test come from that drawing, not from a table of ours. Continuity asks whether every conductor lands where the drawing says. Isolation asks whether two circuits that must never meet are in fact separate. A shield test asks whether the shield is continuous and bonded where it should be and nowhere else. The interlock set is exercised open, shorted and dead, and it has to read not safe in every case. Then the four assemblies are mated and checked as one interface, because a set that passes as four parts and fails as a set has not passed. Every conductor carries its circuit identity end to end, and the test record carries it too. Test and acceptance and labelling and traceability describe how.
The airframe's wiring answers to the carrier's airworthiness rules, which the carrier's programme owns. The ground side of a set, the bench lead, the test stand, anything that plugs into a wall in Canada, answers to CSA and the Canadian Electrical Code. The components we specify carry their own certification. The approval route for a finished, project-specific assembly is confirmed with the certifying body for that assembly before it is built, and we tell you where yours sits before we build it, not after. CSA and the Code has the rest.
The harnesses in this line
Power feed is the feed from carrier to payload: sized on the drawing for the load and the run, protected at its source on the carrier, run as supply and its own return, and never sharing a shell with a safety contact.
Data bus is the bus that carries the payload's traffic: each pair twisted with its own return, shielded end to end, bonded at the shell by the stated method, and matched along its whole length with no splice and no change of construction.
Safety-interlock set is the chain the carrier trusts before it arms: in its own bundle and its own shell, wired through the last contacts to make, and reading not safe when it is open, when it is shorted and when the payload is dead.
Ground and bond is the one return path that is drawn rather than discovered, and the bond that is a mechanical fact about metal touching metal, designed on the drawing rather than left to the mounting bolts.
The matched set is power, data, interlock and ground engineered together, keyed together and proven together as one interface, so that the four cannot be mated wrong and none is built to a definition the other three do not share.
What this line refuses
No safety contact beside a power contact. The interlock set has its own bundle, its own splice-free run and its own shell, and it is never a spare contact in the power connector. A shell that carries both has made the arming decision depend on a bent pin.
No shield used as a return. A shield is a shield. It is bonded where the drawing says and it carries no circuit's current by design. The moment it carries a return it is a ground path nobody designed, and the bus it was protecting is exposed.
No pinout without an owner. We build to a contact assignment that is issued, revised and signed by the person who owns the seam. A pinout that lives in two people's heads, or in a photograph, is not built to. When the two sides disagree, we stop and the owner decides.
No build to a seam nobody owns. A payload seam without an issued interface specification is not a harness order; it is a design job that has not been done yet. We will help do it. We will not skip it. A set built into a seam nobody owns fails on the first mate, and by then the programme has paid for the harness, the payload, the aircraft and the day.
