The fault is part of the specification
A production bench is electrically untidy. Ground offsets, accidental cross-wiring, half-connected shields, and hot-plug events are normal inputs, not exotic edge cases. The first design artifact should be a fault model: what can arrive at each connector, where the energy goes, and what the operator sees afterward.
Protection before density
The board spends more area on isolation, return paths, protection, and test access than on signal conversion. That trade paid for itself as soon as the first real fault arrived.
cif (bus_fault_detected()) {
transceiver_disable();
event_log(FAULT_BUS_OVERVOLTAGE);
ui_status_set(DEGRADED_SAFE);
}
The important part is the final line. A protection circuit that silently disappears from the operator's mental model creates a different failure: uncertainty. Good engineering makes the safe state visible.
One system, not three adapters
The physical interface, protocol registry, acquisition worker, and desktop experience were developed against the same failure vocabulary. That lets a checksum error, transport timeout, overvoltage event, and missing instrument remain distinct all the way to the operator.
- Define faults before selecting the interface parts.
- Preserve observability across every abstraction boundary.
- Validate with intentional abuse, not only a clean loopback.
- Make recovery boring and documented.
That is how a bench tool becomes something people trust enough to leave connected.