Skip to content
Secure Systems Integrators
MeshSafeMeshSafe-CAN built to order in Australia

One e-stop stops every machine in the group.

MeshSafe Site Stop links separate machines into one emergency stop group by radio. There is no site stop cable to run, protect or re-run when the machines move.

Talk about your site: 0430 178 187See how it works

Every machine keeps an e-stop within reach; a radio stop from another machine is never the only one.

Design render of a MeshSafe-CAN unit at an angle, with its rating plate, whip antenna and two cable glands.

Design render, enclosure as specified.

A site stop without the cable

Each machine gets one MeshSafe unit. The units find each other by radio. There is no trench, no cable tray and no cable to damage.

If a unit goes quiet, the group stops

Every unit reports ten times a second. If an e-stop station cannot be heard for longer than its allowance, every machine in the group stops. Silence is treated as a stop.

No single point of failure in the link

There is no master and no base station. Every unit relays for the others, so a unit without line of sight to another reaches it through a neighbour.

Reset stays with the machine

Nothing restarts on its own. When the cause is cleared, each machine still needs its normal manual reset at its own safety controller.

Built as a safety device

Two independent safety channels, each with its own supply and supervision, running separately developed firmware.

Safety level

Declared PL d (ISO 13849-1) and SIL 2 (IEC 62061), self-declared. Hardware engineered to PL e / SIL 3, pending certification.

How it works

MeshSafe does one job, and treats silence as a stop.

Press an e-stop. That machine's safety PLC tells its unit, the unit tells the group, and every other unit tells its own machine's safety PLC to stop.

Lose a unit. If an e-stop station isn't heard for longer than its allowance, every machine stops, within 400 ms on a direct link.

Release and reset. MeshSafe never restarts a machine. Each one waits for its normal manual reset at its own safety controller.

Try it on the panel: tap any machine to press its e-stop.

MeshSafe
Group run permit
CrusherScreenStackerConveyorWash plantSite officeLoaderPump skid
  1. t=0Group healthy: 8 units, 10 updates/s each

Design values, shown at ¼ speed: about 120 ms on a direct link, lost unit within 400 ms, about 100 ms more per relaying unit.

In three steps

Fit, group, stop.

  1. 1

    Fit a unit to each machine.

    MeshSafe-CAN connects to the machine's CANopen Safety PLC with a 24 V supply and a CAN cable.

  2. 2

    Join the units into a group.

    Each group has its own identity and key. Units outside the group are ignored.

  3. 3

    Press any e-stop.

    Every machine in the group gets a stop from its own safety PLC. Release the e-stop, then reset each machine in the normal way.

Watch a group stop, and reset.

Six machines, one e-stop. Every machine stops, each is reset by hand, and when one unit is no longer heard, every machine stops again.

Mesh relaying

No master, no base station, no fixed route.

Every unit relays the latest state it holds for every other unit. If two units can't hear each other directly, the message goes through a neighbour, with up to three relaying units between any two units.

When machines move and the radio path changes, the group carries on. A change of path is not a reason to stop.

Diagram of two MeshSafe groups working side by side. An e-stop in one group stops that group only; the other keeps running.

Separate groups

One group can't stop another.

Each group has its own identity and key, every message is authenticated, and messages from other groups are ignored.

Groups that share a site also share the radio band, so tell us how many groups you plan and we'll set them up to stay clear of each other.

The range

One safety core, two ways to connect to the machine.

Both units share the safety core, radio and enclosure, so they can be mixed freely in one group. Only the connection to the machine differs.

MeshSafe-CAN

Built to order · 3–4 weeks

For machines with a CANopen Safety PLC.

Design render of the MeshSafe-CAN board in its grey polycarbonate enclosure with the lid removed, showing the push-in terminal block, radio module and status LEDs.
Design render, enclosure as specified.

Connects directly to the machine's safety PLC over CANopen Safety. There is no relay interfacing and nothing is added to the e-stop wiring. The PLC treats the group stop like any other safety input, with CANopen Safety's own timing and integrity checks on top of ours.

Call for a quote: 0430 178 187Pricing on request, or send an enquiry

MeshSafe I/O

Coming next

For machines with a safety relay or plain e-stop wiring.

Design render of the MeshSafe I/O board in its grey polycarbonate enclosure with the lid removed, showing the two safety relays and the push-in terminal blocks.
Design render: MeshSafe I/O is not yet in production.
  • Two isolated 24 V safety inputs read the machine's own e-stop state.
  • Force-guided relay contacts sit in series with the e-stop circuit and open on a group stop.
  • Outputs for 24 VDC control circuits; other voltages through an interposing relay.
  • A plain e-stop button wired to a unit makes a standalone e-stop station.

MeshSafe I/O (order code MSI-AU-01) is designed and is not yet in production. It follows MeshSafe-CAN. We don't have a delivery date yet.

Register your interest

MeshSafe-CAN

How it connects to a CANopen Safety PLC.

A CANopen Safety device to EN 50325-5 (CiA 304), exchanging two safety-related data objects with the PLC.

Machine run request
PLC to MeshSafe: the machine's own e-stop chain is healthy.
Group run permit
MeshSafe to PLC: every e-stop station in the group is healthy and heard.

If the permit drops, is late, is corrupt or goes missing, the PLC goes to its safe state. Setting up is standard CANopen work: import the supplied EDS file, set the node-ID with the service tool, and wire 24 V, 0 V, CAN high and CAN low plus the shield.

Diagram of a MeshSafe-CAN unit connected by a CAN bus to a machine's safety PLC, exchanging a machine run request and a group run permit.

Safety

A safety product should say exactly what it claims.

Declared PL d (ISO 13849-1) and SIL 2 (IEC 62061), self-declared. Hardware engineered to PL e / SIL 3, pending certification.

The declared level is the one we stand behind today: PL d to ISO 13849-1 and SIL 2 to IEC 62061, both self-declared. The hardware is a Category 4 architecture, engineered to PL e / SIL 3, pending certification, so a later move to the higher level is a matter of validation, documentation and certification, not a redesign.

For MeshSafe-CAN the probability of a dangerous failure per hour (PFHd) is 2.66 × 10⁻⁹ per unit, calculated (ISO 13849-1 / IEC 62061 method), pending certification, for use in your own performance level calculation. The datasheet sets out the safety-related figures and their status.

The design also follows

  • ISO 13850 for the emergency stop function
  • IEC 60204-1 for cableless control: stop on loss of communication, link indication, warning before the link degrades
  • IEC 62745 for cableless control systems of machinery
  • EN 50325-5 (CiA 304) for the CANopen Safety interface
MeshSafe safety principleTwo independent safety channels monitor each other. Both take part in every radio message and every output to the machine, so neither can signal run on its own, and any disagreement results in a stop.Group radio linkevery message authenticatedSafety channel Aindependentcontinuously self-testedSafety channel Bindependentcontinuously self-testedcross-monitoringboth check every messageRun permit to the machineonly while both channels agree the whole group is healthy
Neither channel can signal “run” on its own. Any disagreement reaches the machine as a stop.
MeshSafe-CAN circuit board seen from the front right, with its radio module, push-in terminal block and status LEDs.

Two independent safety channels

Each with its own supply and supervision, running separately developed firmware. Neither channel can signal "run" on its own. If they disagree, the unit stops.

Every radio message checked by both channels

A message does not go on air until both channels agree on it, and a received message is checked by both before either acts on it.

Authenticated radio link

Every message is authenticated and integrity-checked. Messages from outside the group, corrupted messages and replayed messages are rejected.

Continuous self-tests

Each channel tests its processor, memory and program while it runs, and checks the other channel's supply. A detected fault puts the unit into stop and the group stops with it.

Signed firmware

Each channel verifies the firmware's digital signature independently before it runs. An update has to be confirmed by someone at the unit.

Nuisance trips treated as a safety problem

Operators bypass a site stop that trips for no reason. Short, self-clearing events are handled separately from real faults, which latch until someone clears them.

What MeshSafe is

  • An additional emergency stop measure that links machines into a group.
  • A device that fails to stop: loss of power, loss of radio and internal faults all lead to a stop.
  • A component in your safety system. The integrator adds its response time to each machine's own stopping time in the risk assessment.

What MeshSafe is not

  • It is not a stop that may be any machine's only means of emergency stop when received by radio from another machine.
  • It is not a reset: reset stays manual at each machine.
  • It is not a machine control or a start signal. It can only take the run permit away.
  • It is not for hazardous (explosive atmosphere) areas.

MeshSafe-CAN

Key specifications.

Response times and range are design values. The first bench measurements agree with them, and field range tests are in progress. The full figures and their status are in the datasheet.

Call for a quote: 0430 178 187Request the datasheet
MeshSafe-CAN key specifications
Order codeMSC-AU-01 (Australia and New Zealand)
Machine interfaceCANopen Safety (EN 50325-5 / CiA 304): one SRDO in, one SRDO out
CAN bit rates125, 250 and 500 kbit/s. Factory setting 500 kbit/s
Node-IDSet with the service tool (LSS). Factory setting 32. Use node-IDs 1 to 32
Bus terminationExternal: a 120 ohm resistor at each end of the bus
Group size2 to 20 units. Several separate groups can work on one site
Radio band915 to 928 MHz (Australia and New Zealand)
Radio linkMesh radio, every unit relays. 10 updates a second from every unit
Transmit powerAdjustable up to +22 dBm conducted
RelayingEvery unit relays. Up to 3 relaying units between any two units
RangeDesigned for 200 m between units with the standard antenna
Stop time, radio pathAbout 120 ms from a stop at one unit to the stop decision at another, direct link. Each relaying unit adds about 100 ms
Loss of a unitDetected and acted on within 400 ms, direct link
Safety designTwo independent safety channels, Category 4 architecture
Safety levelDeclared PL d (ISO 13849-1) and SIL 2 (IEC 62061), self-declared. Hardware engineered to PL e / SIL 3, pending certification.
FirmwareDigitally signed. Updated over the CAN bus and confirmed at the unit
Supply24 VDC nominal (20.4 to 28.8 VDC) from the machine's SELV/PELV supply
EnclosurePolycarbonate, IP65 rated by its manufacturer when fitted with suitable cable glands. 171 × 121 × 55 mm, with mounting flanges
ConnectionsPush-in terminals for 0.2 to 1.5 mm² wire, through cable glands
AntennaExternal 915 MHz whip on an SMA connector. It can be extended outside a metal cabinet
Indicators and controlsRUN, STOP, FAULT and two LINK LEDs. One recessed PAIR button. No reset button
Operating temperatureDesigned for -25 °C to +60 °C
Wearing partsNone

Service tool

Set up and maintained over the CAN bus.

The MeshSafe Service Tool for Windows shows each unit's state, fault history and radio link quality. It sets the node-ID and bit rate and loads signed firmware updates. Any change that matters to safety has to be confirmed by someone at the unit.

MeshSafe Service Tool overview page showing six MeshSafe-CAN units on the bus, all in RUN, with firmware and group status.

See the whole group at once.

The mesh map is a live map of the group: every unit, every direct radio link and its signal strength where measured, how each unit is reached, and plain-language warnings, such as a unit that can only be reached through one relay.

MeshSafe Service Tool mesh map: six units with radio links coloured by quality, timing sources, and a warning that one unit is reachable only through a single relay.
MeshSafe Service Tool firmware update, loading a signed release into both safety channels.

What's in the box

  • The MeshSafe-CAN unit in its enclosure, with the antenna connector fitted
  • A 915 MHz whip antenna
  • Rating and identification label
  • Operating Instructions
  • Software: the MeshSafe Service Tool, the EDS file and signed firmware release packages

You provide

A 24 VDC SELV/PELV supply, cable glands rated IP65 or better (the enclosure is supplied undrilled), shielded 120 ohm CAN cable with a terminator at each end, M4 fixings, and a USB-CAN adapter for the service tool (Kvaser, PEAK and IXXAT adapters are supported).

Downloads

Everything you need to choose, design in and commission.

The EDS file for your PLC tool, and a 3D model and dimension drawing of the unit for your machine design. The datasheet, operating instructions and service tool guide are available on request.

CAD models are modelled by Secure Systems Integrators from published dimensions and are free to use for integrating MeshSafe into your designs.

Documents on request

More detail for integrators.

  • MS-SAL-001Technical overview
  • MS-DVM-002Device manual and object dictionary
  • Release notesFirmware release notes
  • Safety analysisBasis of the declared level
Request documents

Questions

Can MeshSafe be a machine's e-stop circuit?
Yes. Wire a local e-stop button to a MeshSafe I/O unit and its safety relays open the machine's safety circuit straight from that button, without depending on the radio, and stop the rest of the group too. What the standards (IEC 60204-1, IEC 62745) don't allow is a machine whose only e-stop is a radio stop from somewhere else, so every machine keeps an e-stop within reach. On MeshSafe-CAN machines the safety PLC keeps its own e-stop devices. Reset stays manual at each machine.
How fast is it?
On a direct radio link the stop decision reaches another unit in about 120 ms. From an e-stop on one machine to another machine's stop, including both safety PLCs, the design estimate is about 0.5 s. Each relaying unit in the path adds about 100 ms. These are design values, and first bench measurements agree with them. Your risk assessment adds them to each machine's own stopping time.
What happens if the radio drops out?
The group stops. If an e-stop station is not heard for longer than its allowance, every machine stops, within 400 ms on a direct link. Short dropouts are allowed for: two missed updates in a row are tolerated and three stop the group. The LINK LEDs warn of a weak link before it causes a stop.
What is the range?
MeshSafe is designed for 200 m between units with the standard antenna. Units relay for each other, so a group can cover more ground than one link. Longer links are possible with the right antenna, mounted high and clear, and we assess that for each site. Field range tests are in progress and we will publish the results.
Can someone stop my site, or stop it from stopping, with a radio?
Messages that are forged, altered or replayed are rejected, because every message is authenticated with the group's key. Jamming the band cannot hold the machines running. If the units cannot hear each other, the group stops.
Which PLCs does it work with?
MeshSafe-CAN works with CANopen Safety PLCs: safety PLCs that support CANopen Safety SRDOs to EN 50325-5 (CiA 304). We supply an EDS file for the PLC's configuration tool. Ask us about your PLC and we will tell you what has been tested.
A machine comes and goes from my site. Will it stop the others when it leaves?
In this release every unit is an e-stop station, so a unit that is switched off or leaves range stops the group. A second role is in development for machines that come and go: a unit that obeys the group stop but whose absence does not stop the others. Ask us where it stands.
Is it certified?
Declared PL d (ISO 13849-1) and SIL 2 (IEC 62061), self-declared. Hardware engineered to PL e / SIL 3, pending certification. Ask us for the details for your application.
How much does it cost?
It depends on how many machines are in the group and how they connect, so we quote each site. Contact us with your machines and site layout and we'll come back with a quote and a recommendation.
Where is it available, and what is the lead time?
Australia first. MeshSafe-CAN is built to order with a lead time of 3 to 4 weeks. Other regions are planned on the same hardware.

Building the first sites now.

MeshSafe-CAN is the first release. It is built to order in Australia with a lead time of 3 to 4 weeks. Tell us about your machines and we will tell you plainly whether MeshSafe suits them.

Call 0430 178 187Send an enquiry