Build the switch
From REV-A on the bench to a unit you can hold.
The full engineering disclosure for the Mk.II REV-B severance interlock: how the boards are split, how the PCB is laid out, every component and what it costs, the ten-stage build, the test plan each unit must pass, and how that adds up to the finished price.
REV-B
Production revision taken from the REV-A bench rig
4 boards
Severance, authority, custody and supply, all separable
6 layers
Mixed power/signal stack-up, 2 oz outer copper
4U
Production chassis the REV-B boards are designed into
Architecture
Four boards, because the cut must not depend on the clever one.
The authority and severance boards contain no processor in the decision path. The custody board watches and signs but cannot command. Separating them is the whole safety argument — a compromised controller still cannot cut, and still cannot hide a cut.
A
Authority board (no microcontroller in the cut path)
Two certified key barrels drive dual redundant SPDT switches into a hardwired AND gate built from a relay-logic pair. The arming timer is a discrete 555-class monostable with an 8 s window. Nothing on this board can be commanded over a bus — the cut decision is metal and logic, not firmware.
B
Severance board (four latched channels)
Channel 1: 2-pole 40 A AC-3 contactor with arc chutes for mains. Channel 2: fibre/SFP bypass relay that opens the uplink. Channel 3: NVMe and weight-store power rail via back-to-back MOSFET solid-state switch. Channel 4: BMC/IPMI out-of-band isolator. Each channel latches open mechanically and reports its real contact state back, not its commanded state.
C
Custody board (signed, append-only)
A secure element with an internal monotonic counter signs every cover lift, key turn, arm, cut, verify and restore. An RTC with its own cell stamps each entry. Logs go to onboard flash and out through a read-only optically isolated UART — the host has no write path to this board.
D
Supply and hold-up board
Dual 100–240 V AC inputs with ORing, an isolated flyback front end, and a supercapacitor plus LiFePO4 pack that holds the interlock alive through a total mains loss so the cut still completes and still gets signed.
PCB design
Layout zones and stack-up.
Mains switching stays left of the barrier, authority and custody stay right of it, and the only thing crossing is reinforced isolation. The barrier is a routed slot, not a keep-out note someone can overrule in layout review.
Board layout — severance assembly
Stack-up — 6 layer
| L1 — Top | Signal + component side, 2 oz copper, controlled-impedance sense traces |
|---|---|
| L2 — GND | Solid chassis-referenced ground plane, no splits under the isolation barrier |
| L3 — Power | Split planes: 24 V coil, 12 V logic, 5 V secure element |
| L4 — Isolated | Secondary-side plane for the custody and telemetry domain |
| L5 — GND | Second ground plane, return path for the contactor drive |
| L6 — Bottom | Heavy-current pours, 4 oz on the severance board, screw-terminal side |
Layout rules that are not negotiable
- —8 mm creepage and 5 mm clearance across the mains-to-logic isolation barrier, with a routed slot under the optocouplers.
- —Contactor coil drive kept in its own return loop; flyback diode within 5 mm of the coil terminals.
- —The key-switch AND gate is routed as a hard-wired series path — there is no test point, no jumper and no firmware bypass across it.
- —Secure element sits inside a tamper mesh pour tied to the cover switch; lifting the lid without clearing the seal trips it.
- —Current-sense shunts on every channel are Kelvin-connected so verification reads real load, not driver state.
- —All four channels report contact position from an auxiliary contact set, never from the drive signal.
Enclosure
The 4U chassis the boards live in.
The enclosure is part of the safety case, not packaging. It separates mains from logic, carries arc energy away, and makes an undocumented opening visible.
Form factor
19-inch 4U rack chassis, 482 × 177 × 450 mm, 1.5 mm cold-rolled steel, powder coated graphite. Wall variant MK2-W uses the same boards in a 600 × 400 × 250 mm steel wall box.
Compartments
Three internal bays: mains severance (rear, behind an earthed steel barrier), authority and custody logic (front), and supply with hold-up cell (side). No mains conductor crosses the logic bay.
Front panel
Hinged polycarbonate cover over the lever, two key barrels, amber/cyan state lamps, frangible tamper seal and a cover switch logged to the ledger. IP31 front, IP20 rear.
Arc and heat
Arc chutes vent through a baffled rear grille away from operators. Passive cooling only — no fans, so no fan failure mode and no airflow path into the logic bay.
Cable entry
Rear gland plate with separated entries for mains, fibre and management. Fibre shear module mounts on its own tray. All entries sealed and labelled per channel.
Security fixings
Tamper-resistant fasteners, lockable to the cabinet rail, chassis-open switch independent of the cover switch. Seals are serialised to the unit's build record.
Component list
Every part, what it does, what it costs.
Quantities are per unit. Unit costs are volume-tier estimates, not signed supplier quotes — the tier table on the manufacturing page sets the run sizes these assume.
Severance board
$306 per unit
| Ref | Part | Qty | Unit | Line |
|---|---|---|---|---|
| K1 | 2-pole contactor, 40 A AC-3, 24 V DC coil Arc chutes, auxiliary contact block for position read-back | 1 | $96 | $96 |
| K2 | Fibre / SFP bypass relay, latching Opens the uplink and stays open without holding current | 1 | $34 | $34 |
| Q1–Q4 | Back-to-back MOSFET pair, 100 V 120 A Solid-state severance of the NVMe / weight-store rail | 4 | $11 | $44 |
| K3 | BMC / IPMI isolation relay, 2-form-C Out-of-band management severance channel | 1 | $18 | $18 |
| R1–R4 | Kelvin current-sense shunt, 0.5 mΩ, 3 W Per-channel verified-dead-load measurement | 4 | $6 | $24 |
| U1–U4 | Isolated current-sense amplifier Reinforced isolation across the mains barrier | 4 | $7 | $28 |
| PCB-S | 6-layer PCB, 2 oz outer / 4 oz bottom, 233 × 180 mm ENIG finish, IPC Class 3, slotted isolation barrier | 1 | $62 | $62 |
Authority board
$467 per unit
| Ref | Part | Qty | Unit | Line |
|---|---|---|---|---|
| SW1, SW2 | Certified key barrel, dual-detent, registered blanks Two independent barrels, keys registered to named holders | 2 | $148 | $296 |
| K10, K11 | Safety relay, force-guided contacts Hardwired AND gate — both keys or no travel | 2 | $29 | $58 |
| U10 | Precision monostable timer 8 s arming window, relocks automatically | 1 | $3 | $3 |
| SW3 | Lever actuator with mechanical interlock plate Cannot travel unless both barrels are turned | 1 | $74 | $74 |
| SW4 | Cover / tamper switch, frangible seal kit Logged independently of the key path | 1 | $12 | $12 |
| PCB-A | 4-layer PCB, 160 × 120 mm Relay-logic authority board, no MCU in the cut path | 1 | $24 | $24 |
Custody board
$96 per unit
| Ref | Part | Qty | Unit | Line |
|---|---|---|---|---|
| U20 | Secure element, monotonic counter, ECDSA P-256 Signs every custody entry; host has no write path | 1 | $9 | $9 |
| U21 | Application MCU (telemetry and display only) Reads state, drives the panel — cannot command a cut | 1 | $8 | $8 |
| U22 | RTC with backup cell Timestamps that survive a power loss | 1 | $4 | $4 |
| U23 | Onboard log flash, 256 Mb, append-only partition Local custody record | 1 | $5 | $5 |
| U24–U27 | Digital isolator, reinforced Read-only outbound UART to the operator network | 4 | $3 | $12 |
| DSP1 | Front panel display and status ring Per-channel live / severed / out-of-scope indication | 1 | $27 | $27 |
| PCB-C | 6-layer PCB with tamper mesh pour, 140 × 100 mm Mesh tied to the cover switch | 1 | $31 | $31 |
Supply and hold-up board
$197 per unit
| Ref | Part | Qty | Unit | Line |
|---|---|---|---|---|
| PS1, PS2 | Isolated flyback module, 100–240 V AC to 24 V, 60 W Dual feed with ORing diodes | 2 | $38 | $76 |
| BT1 | LiFePO4 pack, 12.8 V 3 Ah, with protection board Completes and signs the cut through total mains loss | 1 | $46 | $46 |
| C1–C6 | Supercapacitor, 10 F 2.7 V, balanced stack Rides out the contactor inrush during severance | 6 | $5 | $30 |
| F1–F4 | Fuse holder and HRC fuse set Per-channel protection, front-serviceable | 4 | $4 | $16 |
| PCB-P | 4-layer PCB, 4 oz, 200 × 120 mm Heavy-current supply board | 1 | $29 | $29 |
Chassis and wiring
$359 per unit
| Ref | Part | Qty | Unit | Line |
|---|---|---|---|---|
| ENC1 | 4U 19-inch steel chassis, powder coated, IP31 front Lockable to the cabinet rail, tamper-evident lid | 1 | $214 | $214 |
| TB1 | Screw terminal block set, 40 A rated Field wiring for all four channels | 1 | $38 | $38 |
| WH1 | Internal wiring harness, pre-crimped and labelled Mains, coil, sense and isolated telemetry looms | 1 | $57 | $57 |
| MISC | Fasteners, standoffs, busbar, thermal pads, gaskets Mechanical build kit | 1 | $41 | $41 |
| LBL1 | Rating plate, serial label and seal set Serialised per unit, tied to the custody record | 1 | $9 | $9 |
Total bill of materials, per unit
$1,425
Build guide
Ten stages, in this order, every time.
The order matters. Low-voltage and custody provisioning happen before the board ever meets mains, and nothing gets sealed until the load tests and the signed log both pass.
01
Fabricate and verify the boards
Order the four boards to IPC Class 3 with electrical test on every net. Before any parts go on, check the isolation slot is routed and measure barrier creepage on a bare board. A board that fails here never gets populated.
02
Populate low-voltage first
Reflow the custody and authority boards, then hand-fit the key barrels and connectors. Power the custody board on the bench, provision the secure element, burn in its key pair and record the public key against the unit serial before it ever meets mains.
03
Build the supply board and prove hold-up
Populate the flybacks, cap stack and pack. Load it to the contactor's worst-case inrush, pull mains and confirm the rail holds long enough to complete and sign a cut. This is the step that turns 'it usually works' into 'it works when the building goes dark'.
04
Populate the severance board and torque the power path
Fit the contactor, relays, MOSFET pairs, shunts and terminal block. Torque every power connection to spec with a calibrated driver and paint-mark it, so a loose joint is visible at the next inspection instead of found in an incident.
05
Wire the mechanical AND gate
Land the two key barrels into the force-guided relay pair and the lever interlock plate. Verify by hand that one key alone produces no lever travel and no coil drive. There is deliberately no jumper, no test mode and no service bypass across this path.
06
Assemble into the 4U chassis
Mount the four boards on standoffs with the barrier between mains and telemetry domains kept physically clear. Dress the harness so mains and isolated looms never share a bundle. Fit the cover switch, frangible seal and rating plate.
07
Electrical safety test
Insulation resistance, dielectric withstand across the barrier, protective earth bond, and creepage inspection against IEC 60947 practice. Record the readings against the serial number. A unit with no recorded readings does not leave the bench.
08
Functional severance test under load
Run each channel under rated load: arm, cut, and confirm verified dead load on the Kelvin shunts within the latency budget. Then confirm the refusals — one key does nothing, arming an empty scope is rejected, the lever relocks after eight seconds.
09
Custody and restore verification
Pull the signed log and confirm every cover lift, key turn, arm, cut, verify and restore appears with a monotonic counter value. Then run the staged restore with inrush limiting, channel by channel, with supervisor confirmation on each.
10
Burn-in, seal and factory acceptance
Fifty loaded cut cycles, thermal soak at the temperature extremes, then reseal, serialise and run the witnessed factory acceptance test. The acceptance pack ships with the unit and is the first entry in its life record.
Test plan
What every unit has to pass before it is a unit.
Each result is recorded against the serial number and ships with the unit as its acceptance pack. Readings, not ticks.
| Dielectric withstand | Barrier tested at type-test voltage, per unit, reading recorded |
|---|---|
| Insulation resistance | Measured mains-to-logic and mains-to-chassis, logged to the serial |
| Earth bond | Protective earth continuity to every exposed metal part |
| Rated break | 40 A @ 250 V AC per pole, 2-pole, AC-3 duty, under load |
| Severance latency | Arm to verified dead load, measured on the shunts, per channel |
| Hold-up | Cut completed and signed during a total mains loss |
| Interlock refusals | One key, empty scope and expired arming window all rejected |
| Custody integrity | Signed, gap-free log with a monotonic counter across the whole test |
| Burn-in | 50 loaded cut cycles with contact erosion measured before and after |
| Thermal | Full function at -10 °C and 55 °C after soak |
Finished unit pricing
What it costs to build, and why it lists where it does.
Below is the build cost of one finished, tested, sealed MK2-R against its list price. The gap covers engineering, the installation and rehearsal programme behind every unit, support across the warranty term, and the margin that keeps the line running.
| Bill of materialsAll four boards, chassis and wiring, at volume pricing | $1,425 |
|---|---|
| Assembly and wiring labourBoard population, chassis build, harness dressing | $1,150 |
| Test, burn-in and calibrationSafety test, 50-cycle burn-in, thermal soak, shunt calibration | $780 |
| Certification amortised per unitThird-party electrical safety certification, spread across the build run | $1,400 |
| Key registration and custody provisioningRegistered blanks, secure element provisioning, serial binding | $260 |
| Warranty and spares reserve3-year parts and labour, 10-year severance-core guarantee | $890 |
| Total cost of a finished, tested unit | $5,905 |
Sentinel Mk.II MK2-R
$18,400
List price per unit, before installation and commissioning.
- Build cost
- $5,905
- Gross contribution
- $12,495
- Gross margin
- 68%
Partner pricing
Certified partners order off the same line at 15–32% off list depending on tier, with minimum order quantities per build slot. The tiers, lead times and terms are on the manufacturing page.
Partner build line →Straight answers
What this disclosure is and is not.
01
This is a REV-B design, not a shipped product
REV-A exists on the bench and has taken 4,200 loaded cut cycles. REV-B is the production design derived from it, moving to the 4U chassis. No REV-B unit has been through third-party certification yet, so nothing here is a certified product claim.
02
Costs are engineering estimates
Component costs are volume-tier estimates at the quantities in the tier table, not signed supplier quotes. Labour and test figures come from timing the REV-A build and its test campaign. Expect movement on contactors, key barrels and enclosure as the run size settles.
03
Do not build this from the page
This is a design and cost disclosure for buyers, partners and reviewers — it is not a DIY kit. The unit switches mains at 40 A. Building, installing or commissioning one is licensed electrical work, and a unit without the recorded safety tests above has no evidentiary value.
Next
Run the interlock, then read the specs.
The prototype page has the live demo and the measured REV-A bench results. The hardware page has the full unit specifications and the order form.