Connecting a refurbished welding cell to your network: the safe way under the 2027 rules
"Can I check my cell from the office?" "Can the integrator log in from home?" Buyers ask us this more and more. With the EU Machinery Regulation applying from 20 January 2027, the answer matters more than it used to. This page is the practical part: what to plug into what, and what never to plug in at all.
If you want the legal side first (legacy CE marking, substantial modification, imports), read our guide to the EU 2027 cybersecurity rules. Here we stay on the shop floor.
The short answer
A robot cell belongs on its own small network. Robot, PLC, welding power source and HMI talk to each other there. If anything has to leave the cell, it leaves through one controlled door. And the robot is never reachable from the internet. Not directly, not "just for a day".
Why older robots and the internet don't mix
Industrial robots were built for physical safety: fences, light curtains, emergency stops. They were not built to face hackers. A KUKA KRC2 controller, for example, runs Windows XP Embedded for its user interface next to the VxWorks real-time system that drives the axes. That Windows has not received updates for years, and you cannot install an antivirus on it.
This is not a hypothetical. In 2017 Trend Micro and Politecnico di Milano scanned the internet for robot controllers and found more than 83,000 exposed, over 5,100 of them without any authentication.
The new Machinery Regulation does not ask for an unbreakable robot. It asks for protection against corruption of the software and data that safety depends on, and for evidence when someone intervenes (Annex III, 1.1.9). For an older controller the realistic way to get there is to protect the cell around it.
Three networks, two doors
The red line is the one we see far too often in the field: a 4G router fitted "so we can see the robot from home", a remote desktop tool installed on the controller PC, a cable run to the office switch to copy programs faster. Each one bypasses both doors at once.
A note for welding cells: modern power sources often have their own network port and web interface. Treat the welder exactly like the robot. It lives inside the cell network, behind the cell firewall.
Where the firewall actually goes
A common instinct is to put the firewall between the robot and the PLC. Don't. That link is your fieldbus (Profinet, EtherNet/IP and similar), it runs in real time, and a device in the middle adds latency and odd faults while protecting nothing from outside. The firewall sits at the edge of the cell.
Industrial firewalls exist that can be dropped into an existing network without changing a single IP address on the machines ("stealth" mode). For a refurbished cell that is often the cleanest option.
Three ways to set up your cell
A. Isolated cell
No cable leaves the cell. Programs are loaded on the teach pendant or by USB. For many fabrication shops this is all they need. Block unused USB ports and lock the cabinet.
B. Cell behind a firewall
To collect production data or send programs from the office. The firewall allows only what is needed, for example PLC to data server, and nothing back in.
C. Controlled remote access
When an integrator must connect from outside: always over VPN, through the cell firewall, enabled by a key switch in the cabinet that your staff turn on only when required, with a log of who connected.
What we do, and what we don't
We do not provide remote support. We keep no open connection to the cells we sell and we never log into your machine from Bilbao. If a service provider offers remote maintenance, ask for option C.
How you connect the cell is your decision. Once it is in your plant we have no way of knowing whether it is on your network or on the internet. That is why we say it plainly, here and in the handover documents: the robot is not designed to be online. Its place is the internal cell network.
Passwords. Factory default passwords for robot user levels are printed in manuals and easy to find online. Shipping every robot with one common password would only replace one known password with another. Cybersecurity standards and the Cyber Resilience Act point the same way: no universal default passwords. So each unit gets its own.
Unique password
Every robot leaves with its own password, different from every other unit and from the default.
Delivered separately
It goes in the handover record, not taped inside the cabinet or sent with the invoice.
Customer changes it
At commissioning, the person in charge at your plant sets a new one. From then on we don't know it.
One user per person
Operator, programmer and maintenance each get their own level. No shared login.
Checklist for commissioning day
- Choose your setup: A, B or C. When in doubt, start with A.
- Change the password we hand over on the first day.
- Create one user per person, each with the level their job needs.
- Block unused USB ports and keep the cabinet locked.
- Back up the controller, store the copy outside the cell, and note the software version.
- Put the welding power source on the cell network, not on the office network.
- Any outside engineer connects over VPN, with a local key switch, and it is logged.
- If your company falls under NIS2 (medium and large firms in sectors such as food, chemicals or manufacturing), involve your IT manager. They will likely ask for exactly this.
FAQ
My cell isn't connected to anything. Do I need a firewall?
No. An isolated cell already has no door to the outside. Keep it that way and make sure nobody adds a cable "temporarily".
Can I install security software on the robot controller?
No. Controllers run closed systems and manufacturers do not allow it. Protection goes around the cell, not inside the robot.
Will you set up the firewall for us?
That is a job for your IT team or your integrator, because it is your network. If you have no one, we can introduce you to integrators from our partner network.
Sources: EU-OSHA, Regulation (EU) 2023/1230 · IBF, prEN 50742 status · Trend Micro, Rogue Robots (2017) · CSO Online, study figures · Microsoft, KR C2 on Windows Embedded · TÜV SÜD, universal default passwords