Safety and Standards
Robot Cybersecurity: What IEC 62443 Requires
Robot safety and robot security became the same conversation in 2025. What IEC 62443 asks for, the zones and conduits model, and the five weaknesses found in real cells.
Security became a safety requirement in 2025, when the revised ISO 10218 added cybersecurity requirements and the EU Machinery Regulation made protection against corruption leading to a hazardous situation explicit. IEC 62443 is the framework both point toward. Its core idea is simple: divide the system into zones with defined trust, control the conduits between them, and assign each zone a security level from 1 to 4 derived from the threat.
Why this is a safety question
A robot is a machine that moves with enough force to kill. If its safety configuration, its speed limits or its zone definitions can be changed over a network by someone unauthorised, then the protective measures are only as trustworthy as the network. That is the reasoning behind the 2025 additions, and it is why security requirements now sit inside a safety standard rather than beside it.
| Level | Protects against | Typical setting |
|---|---|---|
| 1 | Casual or coincidental violation | Isolated cell, no external connection |
| 2 | Intentional violation with simple means and low motivation | Typical connected factory cell |
| 3 | Intentional violation with sophisticated means and moderate resources | Critical production, remote access |
| 4 | Intentional violation with sophisticated means and extensive resources | Critical infrastructure |
Zones and conduits applied to a cell
The model asks you to draw boundaries around groups of components that share security requirements, then define and control every path between them.
| Zone | Contains | Conduit to | Control |
|---|---|---|---|
| Safety zone | Safety controller, scanners, interlocks | Control zone | Strictly limited, ideally read-only |
| Control zone | Robot controller, PLC, drives | Cell zone | Whitelisted protocols only |
| Cell zone | HMI, vision system, local server | Plant network | Firewalled, authenticated |
| Plant network | MES, historian, engineering stations | Enterprise | Segmented, monitored |
| Remote access | Vendor support connection | Cell zone | Time limited, logged, locally approved |
The five weaknesses in real cells
- Flat networks. Robot, PLC, vision, HMI and office traffic on one subnet, so anything reaching the office reaches the machine.
- Default credentials. Robot controllers, HMIs and safety configuration tools shipped with published defaults that were never changed.
- Permanent vendor remote access. A support tunnel installed for commissioning, still open years later, often unlogged and not requiring local approval.
- Unpatched engineering workstations. The laptop that configures the safety controller is frequently the least maintained computer in the building.
- USB as the update path. Configuration and programs carried on removable media between machines and between sites.
Practical steps in order
- Inventory first. Every device, its firmware version, its network address and who can reach it. Most sites cannot produce this, and nothing else can be planned without it.
- Segment. Separate the cell from the plant network, and the safety layer from the control layer. This delivers more risk reduction than any product purchase.
- Fix credentials. Change defaults, remove shared accounts, and give the engineering workstation an owner.
- Control remote access. On demand rather than permanent, logged, and requiring an action at the machine to enable.
- Sign and verify updates. Especially anything touching safety configuration.
- Write it into the safety file. The 2025 standard expects security to be addressed there, so a separate security document that the safety assessment never references is an incomplete answer.
Security over the life of a cell
A cell is secure on the day it is commissioned and drifts afterwards. The obligations are ongoing rather than one-time.
| Phase | Task | Typical effort |
|---|---|---|
| Specification | Threat assessment, target security level, zone model | 1 to 3 days |
| Design | Network architecture, access control, update path | 2 to 5 days |
| Commissioning | Change defaults, document accounts, verify segmentation | 0.5 to 2 days |
| Operation, monthly | Review remote access logs and account list | 30 min |
| Operation, quarterly | Firmware review against published vulnerabilities | 2 to 4 h |
| Modification | Re-assess zones and conduits after any change | 2 to 8 h |
| Decommissioning | Wipe credentials and configuration before disposal | 1 to 2 h |
The monthly review is thirty minutes and catches the most common real problem, which is an access account or a support tunnel that outlived its purpose by several years.
Frequently asked questions
Why does a safety standard now cover cybersecurity?
Because a robot's protective measures are implemented in configurable controllers. If those can be altered over a network by an unauthorised party, the safety case depends on network trust, which is why ISO 10218:2025 added security requirements.
What are zones and conduits?
Zones are groups of components sharing security requirements; conduits are the controlled communication paths between them. Each zone gets a security level from 1 to 4 derived from the threat it faces, and every conduit is defined and restricted.
Which security level does a robot cell need?
Level 2 covers most connected factory cells, protecting against intentional violation using simple means. Critical production with remote access typically targets level 3. The level is derived from a threat assessment rather than chosen.
What is the most common weakness?
Flat networks, where robot, PLC, vision, HMI and office traffic share one subnet. Segmenting the cell from the plant network and the safety layer from the control layer delivers more risk reduction than any product purchase.
Is a separate security document enough?
No. The 2025 standard expects security to be addressed within the safety assessment, so a security document the safety file never references leaves the connection between the two unmade.
Sources
- IEC 62443, security for industrial automation and control systemsInternational Electrotechnical Commission, zones, conduits and security levels
- ISO 10218-1:2025, Robotics, Safety requirements, Part 1International Organization for Standardization, cybersecurity requirements added in the 2025 revision
- Regulation (EU) 2023/1230 on machineryEU-OSHA, protection against corruption leading to a hazardous situation