The dangerous thing on this line is not the round. It is the air behind it. Here is the launch line as a safety officer walks it: what holds the energy, who stands where, what must be made before the breech opens, and what only a person may do.
Human safety comes first, and every zone, permissive and valve below is that rule turned into hardware.
Human safety comes first, on every line. On the launch line the hazard is not the thing that leaves the tube. It is the compressed air standing behind it, and it is there whether or not anyone intends to take a shot.
So the architecture answers in hardware first and in firmware second. The stored energy sits in one place and can be taken out by hand. The permissives are wired in series, so a broken link opens the chain rather than closing it. The breech valve rests shut and needs power to open. A named person turns a key for every round, and a partner's signal cannot turn it for them.
Nothing here transmits, and nothing receives a command in flight. What is left to make safe is the ground equipment and the sequence the people around it work to. The machine is on The Launch Platform; the loop it runs is on The Engagement.
Carriers, not munitions. No warhead, no fuze, no energetic material, and nothing on this line operates a weapon. A human arm action is mandatory for every shot, and no automated or remote-only fire path exists.
A hazard register, the exclusion zones and the safety architecture are held in one data sheet, and every row on it points at a physical feature rather than a procedure.
The register is short because the machine is simple. A large volume of gas at working pressure. A valve that can release it in milliseconds. A heavy body accelerating down a steel tube, a mount that slews under power, a three-phase supply, and the round as an object to be handled and stored. Each is a row, and each row is answered by something that does not depend on a person remembering.
Procedure sits on top of hardware, never in place of it. The isolation valve, the vent and the drain are manual. The stop is a dual-channel unit wired into the arm chain, its two channels in their own dedicated conduit as a hardware constraint rather than a wiring preference.
| What the hazard is | Where it sits | What answers it |
|---|---|---|
| Stored pneumatic energy | The accumulator bank, at 30 bar | A vessel and relief valve carrying the certification the pressure-equipment law asks of them, plus a manual isolation valve and vent. |
| The fast valve | The breech, opening in under 5 ms | Normally closed and fail-safe. It needs power and a made chain to open, and shuts when either goes. |
| The round in the tube | 1.6 kg accelerating over a 3.0 m stroke | A muzzle-cover switch in the arm chain, and a zone set from the bore line. |
| The mount under power | ±170° azimuth, −3° to +75° elevation | The laying solution is checked against the mount envelope before the mount is driven. |
| The three-phase supply | The compressor at 480 V | Segregated by at least one loom diameter, with the stop channels in separate dedicated conduit. |
| The round as an object | Handling, storage and a miss | Nothing on it is powered or armed, and nothing in it burns. |
The hazard register behind the launch line. Every row is answered by a physical feature of the machine.
Everything else on the line is smaller than the bank of air that throws the round, and the order of every procedure on the machine follows from that.
A pneumatic launcher stores its whole shot before it takes it. The accumulator bank holds air at 30 bar working pressure, and the energy in that bank is 0.89 MJ. The machine is arranged around that energy, not around the round.
Three things follow, and all are physical. The vessel and its relief valve are bought items carrying their own certification, and the relief path is set above working pressure so a control fault cannot drive the bank past it. The energy comes out by hand: a manual isolation valve shuts the bank off and a manual vent and drain puts it to atmosphere. And it is charged with the zone clear, because charging is what puts the energy in.
What leaves the tube is a fraction of what the bank holds. The round is in the barrel for 28.6 ms, exits at 189.2 m/s, and the 9.0 bar residual behind it vents at the muzzle. What the pressure-equipment law asks of the design is on The Launch Platform.
The slim upright rods standing at the receiver deck are not radio aerials. Nothing on a launch platform transmits.
A zone belongs to the state the machine is in rather than to the job it is doing, and the charging zone is the strictest of the three.
Three zones are drawn, and each belongs to a state. The charging zone applies while the bank is brought up to pressure and while it holds pressure unarmed. The armed zone applies once the chain is made and the mount may move, taking in the swept volume and the bore line ahead of the muzzle. The maintenance zone applies when the machine is open for work, and it goes with isolation and venting rather than pressure.
The rule for the first is absolute and it sits in the commissioning sequence: nobody is inside the exclusion zone during charging. The zones are marked where people can see them. A zone that exists on a screen and not on the ground is not a zone, and the person who walks it turns the area-clear key at the end of the walk.
Applies while the compressor runs the bank up and while it holds pressure unarmed. Nobody is inside during charging. A leak-check at 5 bar comes first, then the charge to 30 bar.
Applies once the arm relay is energized. It takes in the swept volume across full azimuth and elevation, and the bore line ahead of the muzzle.
Applies when the machine is opened for work, with the isolation valve shut and the vent and drain open. The energy is already out of it.
The arm relay cannot energize until four independent conditions are satisfied at once, wired one behind the next so that a broken link opens the chain instead of closing it.
The chain is in series by design. Four permissives sit one behind the next with the arm relay at the end. Any one that is not made leaves the relay de-energized and the machine in its safe state. To a series chain, a cut wire and a pressed stop are the same event.
| The link | What it confirms | What an open link does |
|---|---|---|
| The dual-channel stop | Two channels agree that no stop is pressed on the line. | Opens the chain. Both channels run in their own dedicated conduit. |
| The area-clear key | A named person has walked the zone and turned the key. | Opens the chain. Nothing on the machine decides this on its own. |
| The muzzle-cover switch | The cover is off the muzzle, on the bore line that was walked. | Opens the chain. A covered muzzle and an armed machine cannot exist together. |
| The relief-path switch | The relief path is open and free to do its job. | Opens the chain. The bank cannot be armed behind a blocked relief. |
| Accumulator pressure | The controller confirms the bank is at the pressure the shot needs. | Holds the arm condition. A fifth, in firmware rather than in the series chain. |
Four permissives in series ahead of the arm relay, and a fifth in firmware. Six arm conditions and nine safety functions sit in the control system's own definition.
Above the chain sits a small state machine: SAFE, ARMED, FIRING and FAULT. FAULT is a hard latch: it does not clear itself, it does not time out, and it does not clear from a console at a distance. Someone resets it at the machine.
The breech valve is a normally-closed solenoid. Shut is what it does with no power on it; open is the state that has to be paid for.
A fast valve on a charged bank is where the failure direction matters most, so it is chosen rather than inherited. The breech solenoid is normally closed and fail-safe. With no current in the coil the valve is shut, and it stays shut through a power loss, a halted controller, a cut conductor or a pressed stop.
That shapes the end of a shot as much as the start. The solenoid de-energizes, the breech closes because closed is where it rests, the state returns to ARMED and the magazine indexes. Nothing has to be commanded shut. The port is sized above 95 cm² and opens in under 5 ms.
Arming is not a mode the machine can be left sitting in. It is a deliberate act by a person on the line, and the shot spends it.
A human arm action is mandatory for every shot, and a second rule closes the door behind it: no automated or remote-only fire path exists. The arm key is turned by a person on the line who has the area-clear condition in front of them, and the key is re-set for every shot. One turn authorizes one round.
So the machine cannot be parked in a state where it acts by itself. It can be charged and it can be laid, and it will still be waiting. Six arm conditions must be satisfied before the relay will energize, and the person turning the key is the last of them and the only one no device can satisfy. Nine safety functions sit beside those conditions, and the key resetting for each shot is one of them. Where the arm action falls in the loop is on The Engagement.
Detect, track and classify belong to the customer's own systems. What reaches this launcher is permission, and permission is not an instruction.
The boundary is one line. A partner fire-control signal is a permissive only, and it can never bypass the manual interlock chain or the arm action. A cue carries a bearing, a range and a height. The software turns that into a laying solution and checks it against the mount envelope. Nothing on that path reaches the arm relay or the breech coil.
The interface is wired, and at the machine end it is left open: the fire-control connector is capped and its conductors reserved. A partner system arrives as an engineering change with the boundary already drawn: the chain, the key and the person holding it.
Nothing here transmits by radio and nothing guides on a link. The cue comes in on a wire, the laying solution stays in the launcher, and the round receives nothing past the muzzle. Where each program sits across the three guidance tiers is on Guidance on This Line.
The strongest safety fact on this line is a design boundary rather than a procedure. There is no energetic material anywhere in it.
Carriers, not munitions. The round is a moulded body with a steel nose and six bonded fins, and it carries no warhead, no fuze, no primer, no propellant and no initiator. The launch energy is compressed air, and all of it is spent inside the barrel. There is nothing aboard to arm, because there is nothing aboard that could be armed.
The same holds at the magazine. The indexer is a motor and an encoder, and there are no pyrotechnics in it. A rack of rounds is stored as heavy inert stock.
The capture nose does not change that. Its release runs on cold gas from a small bottle, and the mechanism that opens the bay is a nose that collapses on contact. What each nose is, and what crosses the interface, is on Heads and the Nose Interface.
Every interceptor has to answer what happens when it does not connect. The answer here is short, because there is nothing aboard the round to complicate it.
A miss is a falling 1.6 kg moulded round, and the range behind the target is sized for it. The round flies a ballistic arc on six fixed fins with the energy it left the tube carrying. If it does not meet its target it comes down as what it is, a moulded body with a steel nose. There is no unspent charge and no residue on the ground.
That shapes siting rather than removing the need for it. The ground beyond the muzzle is set from the arc the laying solution puts the round on, and the arc is a property of the quadrant elevation the mount is laid to. A high-angle solution and a flat one put the round in very different places, and both are settled at the console before the mount is driven. The flight itself, with the drag assumption that governs it, is on Goose CS-110.
The commissioning sequence runs in one direction. What stops the machine is exercised on control power alone, and only after that does the energy go in.
The interlock chain is walked through on control power alone with the pneumatics uncharged. Each permissive is opened in turn and the arm relay is watched to drop out.
The pressure vessel's certification and its hydrostatic test interval are confirmed current, and the relief valve is confirmed free.
The system is brought to 5 bar and checked for leaks, where a fitting not made up correctly is found cheaply.
With the exclusion zone clear, the bank is charged to 30 bar and held so the leak-down can be watched.
Both axes are driven to absolute-encoder home, a fixed reference is sighted through the bore reference and the cueing optic, and the offset is stored.
The harness is landed to the same discipline. The 480 V side is routed apart from the 24 V control side by at least one loom diameter, the stop channels take their own dedicated conduit, the protective bond is landed, every circuit is re-tested for continuity, and the fire-control connector is left capped. The harness is built by Wired Industries.
Intervals are set for the whole machine, pneumatic side, electrical side and mount. Two items on that list decide when the launcher stops, not merely when it is looked at.
Most of what a launch platform needs is what any pneumatic and electrical machine needs: filters, drains, fittings, bonding, encoder checks and the condition of the mount drives. Two items are different, because between them they set the working life of the machine.
The breech seal sits at the fastest and most violent transition in the system, and it is watched on a schedule of its own as a wear item. The vessel has a life and an inspection interval that belong to the vessel rather than to the machine it is fitted in.
Intervals are set for the pneumatic side, the electrical side and the mount, and they are written for this machine.
The seal at the fast valve takes the whole transition on every shot. It carries its own watch in the schedule and is treated as a consumable.
The accumulator's life and its inspection interval belong to the vessel. A vessel outside its interval stops the launcher until it is back inside it.
Three people usually decide whether a launch platform is allowed onto a piece of ground: the safety officer, the pressure-equipment authority and counsel.
A conversation about this line starts with a screened enquiry and with the ground a launch platform would stand on. Nothing on this page is an offer.
Bring the site, the zones you can mark on it, the pressure-equipment authority you answer to and the questions your own safety officer would put first. If you run a hazard analysis of your own, send it: the rows here are meant to sit beside yours, not replace them. Every enquiry is screened before any discussion; international transfer is export-controlled and subject to Canadian government permits taken per shipment, and export posture is counsel-first. The reply comes in writing, from a person.
The line as a whole is on CDNS UAV Platforms. The machine this page makes safe is on The Launch Platform, and the loop it runs from cue to reload is on The Engagement. The round is on Goose CS-110, and who the line is built for is on Who the Line Is For.
All CDNS UAV Platforms designs are patent pending; international transfer is export-controlled and subject to Canadian government permits taken per shipment, and nothing on this page is an offer.
