Machine builders evaluating a functional safety CAN joystick are rarely shopping for “another CAN handle.” They are designing a safety-related control chain where the joystick, grip switches, and network messages must meet Performance Level d (PLd) or SIL 2 — and where a standard CAN node that merely talks fast enough is not acceptable evidence for a notified body or internal functional safety manager.
Trunsin manufactures industrial CANbus joysticks including the ZS40 for construction and mobile equipment. Our catalog ZS40 programs target non-safety-rated machine control and diagnostics — not certified safety inputs without a dedicated safety project. This article explains what buyers mean by functional safety CAN, how it differs from everyday CANopen or J1939 integration, and when to engage Trunsin engineering for a custom safety-related evaluation versus specifying a certified competitor joystick from elobau, Bosch Rexroth, or Walvoil.
Functional safety CAN joystick requirements — PLd and SIL2 in plain language
ISO 13849-1 defines Performance Levels (PL a through PL e) for safety-related parts of control systems. Mobile machine OEMs often specify PLd for operator controls that must fail safely when a sensor channel degrades. IEC 61508 / ISO 13849 SIL 2 language appears in the same RFQs — particularly when the buyer’s corporate standard maps hydraulic and electronic controls to safety integrity levels.
A functional safety CAN joystick in that context is not only a proportional input. It typically includes:
- Redundant position sensing or dual-channel analog paths evaluated by a safety PLC or safety monitor
- Safety-rated grip switches (dead-man or enable) wired or messaged at the same integrity level
- Safe communication — CANopen Safety with SRDO, or vendor-specific safety telegrams — not generic PDO streams
- Documented failure modes — FMEA, diagnostic coverage, and proof tests per the safety manual
elobau’s JE product family illustrates the market benchmark: IP6K9K sealing options, PLd on the joystick axis, PLc on selected pushbuttons, and CANopen / CANopen Safety variants documented in public comparison PDFs [Source: ISO 13849-1]. Walvoil’s DJW and Bosch Rexroth SIL2 joystick announcements show the same pattern — safety certification is sold as a system property, not a firmware toggle on a standard grip.
Standard CAN vs CANopen Safety — what changes on the wire
Everyday CANbus joystick wiring articles cover 120 Ω termination, stub length, and J1939 source addresses. Functional safety CAN adds protocol rules where redundant signals traverse the bus under time-monitored contracts.
CiA 301 CANopen defines PDO mapping for process data. CANopen Safety (CiA 304 / EN 50325-5 lineage) introduces Safety Related Data Objects (SRDO) with inverted duplicate channels, watchdog timing, and state machines that standard CANopen nodes do not implement. A machine that already runs non-safety CANopen joysticks cannot assume a safety grip is “the same connector, different firmware” without re-architecting the safety controller and validation evidence.
Trunsin’s live articles on CANopen joystick integration and CANopen diagnostics address commissioning for standard nodes. Use those when your hazard analysis classifies the joystick as non-safety machine control. When the hazard analysis marks operator enable as safety-related, escalate to a safety-rated product line or a formal custom program.
Functional safety CAN joystick compared — catalog paths
| Approach | Typical integrity | Bus | Trunsin fit |
|---|---|---|---|
| Standard CAN / J1939 joystick | Non-safety control | PDO / PGN | ZS40 catalog — Configure PDF, ECU integration support |
| CANopen machine control | Non-safety (PLC) | CANopen PDO | ZS40 + integration guides; not SRDO-certified |
| Certified safety joystick | PLd / SIL2 system | CANopen Safety / vendor SRDO | Competitor benchmarks (elobau JE, Walvoil DJW); Trunsin custom evaluation only |
| Dual-channel analog + safety relay | PLd on analog path | Hardwired | Trunsin analog outputs where architecture separates safety from CAN |
The honest procurement split: if the RFQ names PLd and CAN in the same sentence, ask whether the joystick assembly must ship with a certificate or whether a safety PLC reads dual analog channels from a non-certified grip. Many architectures achieve PLd with redundant monitoring outside the handle — but only the functional safety plan decides.
How Trunsin ZS40 fits non-safety CAN programs
The ZS40 industrial joystick supports CANbus machine integration for construction OEMs — baud rate, identifier planning, and harness specification pair with our ZS40 construction equipment guide. IP sealing and Hall sensing address durability; they do not, by themselves, constitute a safety certificate.
When a buyer asks for “SIL2 CAN joystick” but the hazard analysis only requires non-safety proportional control, Trunsin can often simplify cost and lead time by specifying ZS40 with documented CAN integration rather than over-specifying a safety grip. When the hazard analysis requires certified safety, we say so early and point to architecture options: certified competitor assembly, dual-channel analog into a safety PLC, or a scoped engineering study for custom safety-related design.
RFQ checklist for safety-related joystick specs
- Safety target — PLd, SIL2, or corporate equivalent; which standard (ISO 13849-1 vs IEC 61508)?
- Safety function — enable only, motion limit, or emergency stop contribution?
- Bus type — CANopen Safety SRDO, J1939, or hardwired redundant analog?
- Grip switches — same PL as axis or lower (PLc) with separate evaluation?
- Diagnostics — required proof tests, fault reaction times, safe state definition?
- Environmental — IP6K9K washdown vs IP65 cab — affects seal design, not safety math alone
- Evidence package — certificate, FMEA, installation manual, or internal self-certification only?
Send completed rows with machine type and ECU family to sales@trunsin.com or build a ZS40 configurator PDF as the mechanical and electrical starting point.
Frequently asked questions
Is Trunsin ZS40 a certified functional safety CAN joystick?
Standard catalog ZS40 is marketed for industrial CAN control, not as a certified safety input device. Safety-rated requirements trigger a separate engineering and compliance path.
What is the difference between PLd and SIL2 in RFQs?
They arise from different standards families but buyers often use them interchangeably for mobile machine controls. Your functional safety manager should map the required Performance Level to architecture — do not rely on marketing sheets alone.
Can CANopen Safety use the same harness as J1939?
Physical layer may share ISO 11898 cabling practices [Source: ISO 11898 / CiA 301], but protocol stacks, timing, and safety monitors differ. Rewiring without revalidation is not a drop-in change.
When should we specify elobau or Walvoil instead?
When the RFQ demands a published PLd safety joystick with CANopen Safety documentation and your program lacks time to certify a custom path. Trunsin competes on non-safety CAN integration and configurable OEM programs.
Next steps
- Confirm whether the joystick is safety-related in your hazard analysis.
- If non-safety CAN suffices, start with ZS40 configuration and CAN integration articles.
- If PLd/SIL2 is mandatory on the grip, collect competitor safety manuals and open a Trunsin engineering dialog for boundary options.