Robot cybersecurity and safety-related control

Robot product boundary

This document addresses robots as partly completed machinery

ISO 10218-1:2025 introduction — English original

ISO 10218-1:2025 addresses the robot. ISO 10218-2:2025 addresses robot applications and cells. This distinction matters for cybersecurity because the relevant corruption path may sit in the robot controller, teach pendant, safety-related parameter set, external control capability, cell integration, or application software.

The Machinery Regulation analysis should follow the product and integration boundary used for the conformity assessment. A standalone robot, a partly completed robot, and a complete robot cell can have different safety responsibilities and evidence.

Safety-related control

Cybersecurity matters for robotics when corrupted software, data, communication, or configuration can affect a safety function or a safety-related part of the control system. ISO 10218-1:2025 points to mode selection and activation, safety function parameterisation, communications used in safety functions, stopping functions, speed limits, software-based limiting, and external control capability.

Safety parameterisation

ISO 10218-1:2025 clause 5.3.5 treats software-based parameterisation of safety-related application software as a safety-related aspect. Once a safety function is activated, it must always be active on power-up, and an identifier, such as a checksum, must be generated to identify setting changes. Manual changes to safety-related parameters require a robot restart after the change.

Clause 5.3.5 also prohibits reconfiguring safety-related parameters during automatic execution of the task program. This differs from automatically selecting a value from a preconfigured set for a specific program part, which the clause permits. Active safety settings and configuration must be viewable and documentable.

Parameter integrity is therefore part of the cybersecurity assessment. The file should show which settings are safety-related, how changes are identified, and how unauthorised or accidental changes are prevented from creating a hazardous situation.

Safety communications

ISO 10218-1:2025 clause 5.3.6 requires IEC 61508-2:2010 clause 7.4.11 to be applied when data communication implements a safety function. An internal robot network must be treated as transmission category 1; an external network must be treated as category 2 or 3, according to Table 2. The categories describe network properties, participants, and the opportunity for unauthorised access. Table 3 specifies the corresponding countermeasure requirements.

• internal communication can still need countermeasures when it implements a safety function;
• external network capability can increase the need to address unauthorised access, delay, corruption, insertion, deletion, replay, or masquerade;
• the Machinery Regulation question remains the same: whether the communication path can lead to a hazardous situation.

Robotics evidence

The assessment should trace each relevant access or communication path to the robot safety function it can affect. A statement that the robot is connected or the factory network is segmented does not explain the effect on safe robot behaviour.

Source status

ISO 10218-1:2025 is a final industrial robot safety standard. prEN 50742 remains a draft machinery cybersecurity standard. Regulation (EU) 2023/1230 is the binding legal source for protection against corruption in the EU Machinery Regulation context.