Selection of Hirschmann cSCALE S6/C8 Mobile Safety Controller

Hirschmann cSCALE S6/C8 Mobile Machinery Safety Controller Selection and Safety Architecture Analysis

Introduction: Challenges in Safety and Flexibility of Mobile Machinery Control

In off-road vehicles, construction machinery, agricultural equipment, and material handling equipment, control systems face extreme environments such as vibration, impact, wide temperature, dust, and spray, while also complying with strict safety regulations such as the Machinery Directive 2006/42/EC and EN ISO 13849, IEC 62061. Traditional PLCs often struggle to balance high-performance computing and functional safety certification, while WIKA Mobile Control's cSCALE series controllers (including models S6, C8, I2, etc.) provide a complete solution that balances performance and safety with a 1GHz high-performance CPU, integrated safety CPU, modular I/O, and IP66/67 protection level. This article is based on the official product manual and systematically outlines the product line division, safety architecture (PL d/SIL 2), I/O modular configuration, communication interfaces, and programming ecology of the cSCALE series, helping engineers to accurately select and quickly deploy in mobile machinery control projects.

Chapter 1 Product Family and Core Positioning

1.1 The three major platforms cover different application scales

The cSCALE series provides a complete product line for mobile automation needs, ranging from compact integration to high-performance expansion:

CSCALE I2: Integrating 4.3-inch graphical HMI with PLC control, suitable for small applications (such as simple agricultural machinery control consoles), using CoDeSys 3.5 programming, HMI and logic control run in the same device, and data exchange does not require network communication. Can run independently or expand distributed I/O (cSCALE DIO) through CANopen. Protection level IP66, working temperature -30 ° C~+70 ° C (optional -40 ° C).

CSCALE S6: Core series, divided into two types of housings: IP20 (cabinet installation) and IP66/67 (direct outdoor installation). Provide 28-168 I/O points, equipped with 2 Ethernet channels USB、 1-3 CAN channels (supporting CANopen, CANopen Safety, J1939). The TrueSafety version integrates a secure CPU and has obtained TUV certified PL d Cat.2/SIL 2 level (compliant with EN ISO 13849 and IEC 62061). High performance application CPU with a clock speed of 500MHz~1GHz, equipped with hardware floating point unit (FPU), built-in 2MB battery buffer RAM and FRAM (no battery required).

CSCALE C8: 1 GHz single core CPU, 2GB Flash, 128MB RAM, supports CoDeSys 3.5 or C/C++programming, also has PL d/SIL 2 certification, suitable for the most complex control tasks.

1.2 Key Common Characteristics

Environmental adaptability: -40 ° C~+70 ° C wide temperature range, shock and vibration resistance, EMC higher than standard requirements.

Programming uniformity: The entire series supports CoDeSys (IEC 61131-3) or C/C++, and the same application software can run on different CPUs.

Redundant architecture: Supports redundant system architecture (primary/backup switching) to enhance availability.

Storage: 2GB Flash is used for program and file storage, and FRAM ensures that critical data is non-volatile.

Chapter 2 Security Architecture and PL d/SIL 2 Certification

2.1 Safety standards and performance levels

Mobile machinery must comply with the Machinery Directive 2006/42/EC and determine the required performance level (PL) through risk assessment. EN ISO 13849 divides PL into five levels, a to e, and most mobile applications require PL d (corresponding to SIL 2 of IEC 62061). The trueSafety versions of cSCALE S6 and C8 have been certified by TUV and meet PL d Cat.2/SIL 2 requirements.

2.2 Dual CPU architecture

The cSCALE S6 safety controller adopts a dual core architecture of functional CPU and safety CPU:

Functional CPU: Run the main application program (IEC 61131 or C/C++), handle complex algorithms, communication, and logic.

Security CPU: Independently monitors security related functions, executes security tasks (such as emergency stop and security shutdown), and runs independently and non destructively with functional CPUs.

Both hardware and firmware have been fully certified to ensure that security features are not affected by non security features. Each I/O module (including digital, analog, PWM output, etc.) is equipped with an independent processor and watchdog. Once a fault (short circuit, overload, disconnection, etc.) is detected, the module immediately cuts off the output on its own without affecting other modules.

2.3 Self diagnostic capability of safety I/O

The safety related I/O has the following self diagnostic functions (compliant with PL Cat. 2 requirements):

Short to battery detection

Short to ground detection

Open load detection

These diagnostic information are fed back to the system integrator in real-time, facilitating quick fault location and reducing downtime. All digital outputs adopt the new generation of high-voltage PROFET technology, integrating short-circuit protection, TVS (transient voltage suppression), and overheat protection.

2.4 Redundant safety cut-off relay

Each power base module is integrated with 2 series connected safety cut-off relays (1+1 redundancy) for emergency shutdown or safety status switching. These two relays can independently or simultaneously disconnect the load circuit under safety logic control, ensuring reliable disconnection in case of dangerous movement or overload.

Chapter 3 Modular I/O Configuration and Selection

3.1 Power Base Module (with I/O)

The cSCALE system starts from the power base module and is equipped with a built-in DC/DC power supply (compliant with ISO 7637-2 car power standard) and basic I/O. Three types of power supply:

Type A: Internal power supply, only providing power.

Type B: External 8.2V NAMUR input (for proximity sensors, etc.), integrated NAMUR interface.

Type C: Powered by 12V CAN bus, suitable for in car networks.

The base module also provides diagnostic LEDs (power ON, power OK, safety relay ON, RUN, Error, and user programmable LEDs).

3.2 Selection of IP20 and IP66/67 I/O modules

According to the installation location (inside the control cabinet or directly outdoors), users can choose IP20 or IP66/67 versions of I/O modules. The mainstream I/O types include:

DI (Digital Input): With HSC (High Speed Counting) option, the highest counting frequency can process encoder signals.

DI DIAG: Digital input with extended diagnostics, capable of detecting short circuits and broken wires.

DI NAMUR: A digital input specifically designed for NAMUR proximity sensors.

AI 4... 20mA: Analog input (4~20mA), some channels can be switched to 0~10V.

AI 0-UB: Wide range analog input (up to 36V), can be used as 0~10V or digital input.

DO (Digital Output): 1A average current, high side drive.

DO PWM with CC: PWM output with current control, 2A or 4A version, adjustable frequency from 50 to 400Hz, used for directly driving hydraulic proportional valves.

8.2V/500mA power output: for external sensors (such as NAMUR).

12V/500mA CAN power supply: for CAN bus devices.

Configuration example (manual legend):

Basic type (28 I/O): 4 DI+HSC, 8 DI DIAG, 8 AI, 4 DO, 4 DO PWM, 1 safety relay.

Expansion type (100 I/O): 8 DI+HSC, 20 DI DIAG, 24 AI, 32 DO, 14 DO PWM, 2 DO PWM 4A, 1 safety relay.

High density type (168 I/O): 24 DI+HSC, 40 DI DIAG, 16 AI, 60 DO, 24 DO PWM, 4 DO PWM 4A, 1 safety relay.

3.3 Local I/O Expansion

Through the SYS ext interface, IP20 and IP66/67 controllers can be connected to expansion racks (up to 6 I/O modules), enabling up to 208 additional I/O points. The expansion module communicates with the main CPU through a dedicated high-speed bus to ensure real-time performance.

Chapter 4 Communication Interface and Network Integration

4.1 Built in communication capability

Ethernet: 10/100 Base-T (M12 connector), supports TCP/IP, can be used for programming, HMI communication, and remote monitoring.

USB 2.0: Used for firmware updates, data recording (via USB flash drive), and program downloads.

CAN: Supports CANopen, CANopen Safety, J1939 (SAE J1939 commercial vehicle protocol), and can be expanded to up to 6 independent CAN interfaces (through expansion modules).

4.2 CANopen Safety and J1939

CANopen Safety: Complies with EN 50325-5 and enables the exchange of safety related data (such as emergency stop signals and safety limits).

J1939: Native support, suitable for scenarios such as trucks and agricultural machinery that require communication with the engine ECU.

4.3 Distributed Control Architecture

CSCALE supports centralized or distributed control architectures. Multiple cSCALE controllers or third-party devices can be networked through CANopen or Ethernet to achieve collaborative control of large mobile devices. The redundant system architecture (primary/backup) further improves the availability of critical applications.

Chapter 5 Programming Environment and Development Support

5.1 CoDeSys and IEC 61131-3

All cSCALE controllers support CoDeSys (version 2.3 or 3.5, depending on the model) and comply with IEC 61131-3 standards (IL, ST, FBD, LD, SFC). Users can use familiar languages to write logic, security functions, and HMI interactions. Pre certified functional blocks, such as safety cutoff and emergency stop monitoring, can accelerate development.

5.2 C/C++Programming

For scenarios that require high-performance algorithms or complex data processing, cSCALE supports C/C++native programming, allowing engineers to directly access hardware resources and implement more efficient custom algorithms.

5.3 Unified software platform

The entire series of controllers use the same software platform, and applications can be migrated between different CPUs (taking into account I/O mapping differences), reducing training costs and maintenance complexity. Firmware updates can be easily completed through a USB memory stick.

5.4 Security Development Support

WIKA Mobile Control provides the following authentication support services:

Design and verification of security functions/security chains

SISTEMA calculation (performance level evaluation based on EN ISO 13849-1)

Application Programming (C/C++/IEC 61131)

Technical support during the TUV certification process

Chapter 6 Typical Applications and Selection Suggestions

6.1 Applicable Scenarios

Hydraulic proportional control, speed control, and safe parking of agricultural machinery (combine harvesters, tractors).

Load monitoring, overload protection, and anti overturning of construction machinery (excavators, cranes).

Tilt safety and limit control for material handling (forklifts, high-altitude work platforms).

Operation action control and safety interlocking of municipal vehicles (garbage trucks, cleaning vehicles).

6.2 Selection Decision Tree

Do you need HMI integration? → Select cSCALE I2 (with 4.3-inch screen).

Is safety certification (PL d/SIL 2) required? → Select cSCALE S6 TrueSafety or C8.

I/O point requirements? → Basic 28 points select S6 IP66/67 standard version; Select extended configuration for over 100 points.

Installation environment? Select IP20 for cabinet installation and IP66/67 for outdoor installation.

Programming language preference? CoDeSys uses S6/C8, while C++uses C8 for greater efficiency.

Chapter 7 Reliability and Diagnostic Function

7.1 Hardware Redundancy and Protection

Power input reverse protection (withstand voltage 100V).

Short circuit protection, overvoltage protection, low-pass filtering.

Redundant safety relays (double series) ensure that the load can still be cut off when a single relay fails.

7.2 Intelligent Diagnosis

Each I/O unit has an independent safety system (processor+watchdog) that isolates immediately in the event of a malfunction.

Diagnostic information can be transmitted to the monitoring system via CAN or Ethernet for preventive maintenance.

FRAM (ferroelectric memory) can store key parameters without the need for a battery, avoiding data loss.

7.3 Environmental Tolerance

Working temperature -40 ° C~+70 ° C (I2 starts at -30 ° C and can be customized to -40 ° C).

IP66/67 protection, capable of withstanding high-pressure water flushing and immersion (short-term).

The anti vibration level meets the most stringent requirements for mobile machinery (such as EN 60068-2-6).