What is Bluetooth?
Bluetooth is an open standard for short-range wireless communication that lets devices exchange data over the 2.4 GHz ISM band using frequency hopping, without cables or network infrastructure. The technology is managed by the Bluetooth Special Interest Group (SIG), founded in 1998 by Ericsson, IBM, Intel, Nokia and Toshiba. Originally intended for consumer devices, Bluetooth is used in OT environments mainly for configuration, diagnostics and wireless sensors, and almost never for critical control.
In industry, Bluetooth is a maintenance and support link: an engineer reads out a field device with a smartphone or tablet without opening its housing, even in a hard-to-reach or hazardous Ex zone.
🧠 How does Bluetooth work?
In practice, Bluetooth consists of two radio technologies that are described in the same specification (the Core Specification) but cannot talk to each other directly:
- Bluetooth Classic (BR/EDR) - the original variant for continuous data streams such as audio and serial links. It uses 79 channels of 1 MHz and hops channel around 1,600 times per second (frequency hopping), so interference on one frequency does not break the connection.
- Bluetooth Low Energy (BLE) - introduced in version 4.0 (2010) for small, periodic data packets with minimal power consumption. It uses 40 channels of 2 MHz, three of which are used for advertising (broadcasting presence and small measured values).
The roles used to be called master and slave; in BLE they are now central (for example a smartphone or gateway) and peripheral (for example a sensor). A BLE sensor can also work without a connection by simply advertising its measured value, so several receivers can listen at the same time. There is also Bluetooth Mesh (since 2017), a separate specification on top of BLE in which nodes relay messages for each other, used mostly in building automation and lighting.
| Characteristic | Bluetooth Classic (BR/EDR) | Bluetooth Low Energy (BLE) |
|---|---|---|
| Channels | 79 × 1 MHz | 40 × 2 MHz |
| Gross data rate | 1 Mbit/s (BR), 2–3 Mbit/s (EDR) | 1 or 2 Mbit/s; 125 or 500 kbit/s with Coded PHY |
| Typical range | about 10 m, up to 100 m for class 1 | 10–100 m, several hundred metres with Coded PHY |
| Power consumption | Medium | Very low, batteries last for years |
| Topology | Point-to-point, piconet | Point-to-point, broadcast, mesh |
| Use in OT | Serial cable replacement, older handhelds | Sensors, configuration apps, beacons |
Transmit power determines range. Class 1 devices transmit up to 100 mW (+20 dBm), class 2 up to 2.5 mW. In Europe, 100 mW EIRP is also the legal limit for the 2.4 GHz band. In a factory hall full of steel, concrete and rotating machinery, the real range is usually well below what the specification promises.
📜 Which Bluetooth versions matter?
Each version of the Core Specification is backward compatible; a connection uses only the features that both devices support. For OT, the security and range improvements matter most.
| Version | Year | Key addition |
|---|---|---|
| 2.1 | 2007 | Secure Simple Pairing (pairing without a fixed PIN) |
| 4.0 | 2010 | Bluetooth Low Energy |
| 4.2 | 2014 | LE Secure Connections (ECDH P-256 key exchange), privacy through changing addresses |
| 5.0 | 2016 | 2 Mbit/s mode and Long Range (Coded PHY) |
| 5.1 | 2019 | Direction finding (Angle of Arrival/Departure) for indoor positioning |
| 5.2 | 2019 | Isochronous channels and LE Power Control, the foundation for LE Audio |
| 5.4 | 2023 | Periodic Advertising with Responses and encrypted advertising data |
| 6.0 | 2024 | Channel Sounding: accurate distance measurement between devices |
| 6.1 / 6.2 | 2025 | Better privacy, lower power use and shorter connection intervals |
Version 5.4 is interesting for sensor networks: with Periodic Advertising with Responses, a single gateway can control thousands of low-power devices, such as electronic shelf labels or wireless measuring points, in both directions.
🏭 Where is Bluetooth used in OT?
- Configuration and diagnostics of field instruments - process instrument makers offer apps that let you set up and read out radar level gauges, flowmeters or pressure transmitters over Bluetooth. Endress+Hauser does this with its SmartBlue app, at up to about 10 metres; existing HART instruments can get the same function through a plug-in module.
- Wireless vibration and temperature sensors - BLE sensors on motors, pumps and fans deliver data for condition monitoring and predictive maintenance without pulling cables.
- Gateways to edge and cloud - an edge gateway collects BLE readings and forwards them via MQTT to a platform for edge computing or IoT analytics.
- Handhelds and scanners - wireless barcode and RFID scanners, printers and headsets for warehouses and production.
- Location tracking - beacons and direction finding (5.1) for tracking tools, load carriers or people.
- Limited operator interaction - a smartphone as a local HMI for status information, rarely for actual operation.
In OT environments, Bluetooth is not used for deterministic real-time control. Latency is not guaranteed and the 2.4 GHz band is shared with Wi-Fi and other wireless systems. A PLC talks to its I/O over fieldbuses or Industrial Ethernet, not over Bluetooth.
🔍 How does Bluetooth compare with other industrial wireless technologies?
| Technology | Frequency | Typical range | Characteristic | Use in OT |
|---|---|---|---|---|
| Bluetooth Classic | 2.4 GHz | about 10 m | Continuous data stream | Cable replacement, older handhelds |
| Bluetooth Low Energy | 2.4 GHz | 10–100 m | Very low power, smartphone apps | Configuration, sensors, positioning |
| Wi-Fi | 2.4 / 5 / 6 GHz | 50–100 m | High bandwidth | Data transport, mobile terminals, IT integration |
| IO-Link Wireless | 2.4 GHz | 10–20 m | Deterministic 5 ms cycle, up to 40 devices per master | Machine sensors and actuators |
| WirelessHART | 2.4 GHz (IEEE 802.15.4) | 50–200 m per hop | Self-healing mesh | Process instrumentation |
| Zigbee | 2.4 GHz (IEEE 802.15.4) | 10–100 m | Mesh, low power | Building automation |
| LoRaWAN | 868 MHz in Europe | kilometres | Very low data rate | Distributed outdoor measuring points |
Because Bluetooth, Wi-Fi, IO-Link Wireless, WirelessHART and Zigbee all operate in the 2.4 GHz band, frequency planning in a plant is not a luxury. Adaptive frequency hopping and channel blacklisting help, but with many concurrent systems the number of retransmitted packets rises noticeably.
🔐 What are the security risks of Bluetooth?
For security, Bluetooth offers authentication through pairing and encryption of the link, but the strength depends heavily on version and implementation:
- Pairing method - Just Works offers no protection against a man-in-the-middle; Numeric Comparison, Passkey Entry and Out of Band (for example via NFC) do.
- Legacy versus Secure Connections - older Classic links use the E0 stream cipher, and older BLE devices use LE Legacy Pairing, whose key can be cracked by an eavesdropper. Secure Connections (BLE since 4.2) uses elliptic-curve key exchange and 128-bit AES-CCM.
- Known vulnerabilities - BlueBorne (2017) enabled code execution without pairing on Windows, Linux, Android and iOS; KNOB (2019, CVE-2019-9506) let an attacker reduce the key length to a single byte; SweynTooth (2020) hit the BLE software of chip vendors in hundreds of products; BLUFFS (2023) forced weak, predictable session keys on Classic links in versions 4.2 up to and including 5.4.
- Firmware that is never updated - the Bluetooth stack lives in the firmware of the chip or field device. Vendors ship updates, but in OT devices often stay unpatched for years.
- Spoofing and tracking - fixed MAC addresses make devices recognisable; an attacker can impersonate a sensor or broadcast fake advertising data.
- Unnoticed access - a Bluetooth interface on a field device is an entry point into the OT network that bypasses firewalls and segmentation.
The US guideline NIST SP 800-121 Rev. 2 (Guide to Bluetooth Security, 2017, updated in 2022) provides an extensive checklist for organisations. NIST SP 800-82 covers wireless links in industrial systems more broadly.
🔧 How do you deploy Bluetooth securely in an OT environment?
A practical approach in six steps:
- Inventory - record every device with a Bluetooth radio in the asset inventory, including instruments whose radio is on by default. A passive RF scan on the shop floor often finds more than the documentation does.
- Disable what is not needed - switch Bluetooth off on field devices by default, or enable it only during maintenance. Many instruments have a parameter or switch for this.
- Require strong pairing - accept only Secure Connections (preferably Secure Connections Only mode), no Just Works, and replace default passwords of instrument apps.
- Limit the function - preferably allow Bluetooth to read only; parameter changes go through a controlled, logged process. Where the device supports it, a Filter Accept List (formerly whitelist) restricts connections to known devices.
- Manage the mobile devices - smartphones and tablets of engineers and maintenance contractors should be managed and up to date; treat them as part of the zone they work in.
- Patch and monitor - follow vendor advisories through patch management and, where possible, use RF monitoring to detect a rogue device.
Within IEC 62443, a Bluetooth link is a conduit into a zone: the risk assessment determines the security level required. For European manufacturers, the cybersecurity requirements of the Radio Equipment Directive (Delegated Regulation (EU) 2022/30) have applied to internet-connected radio equipment since August 2025. From 11 December 2027, the requirements of the Cyber Resilience Act take over that role. Organisations within the scope of NIS2 and the Dutch Cybersecurity Act must also include wireless access paths in their risk management.
❓ Frequently asked questions
What is the difference between Bluetooth Classic and Bluetooth Low Energy?
Bluetooth Classic is designed for continuous data streams such as audio and serial links and uses 79 channels of 1 MHz. Bluetooth Low Energy (BLE) sends small, periodic packets at very low power over 40 channels of 2 MHz. The two radio technologies are not compatible with each other, although many chips support both.
Is Bluetooth suitable for industrial control?
Bluetooth is not suitable for deterministic, critical control, because latency is not guaranteed and the 2.4 GHz band is shared. In industry, Bluetooth is therefore used for configuration, diagnostics and monitoring. IO-Link Wireless was designed for wireless machine sensors with fixed cycle times.
How far does Bluetooth reach in a factory?
The range of Bluetooth depends on transmit power, version and environment: typically 10 metres for class 2 devices and up to 100 metres for class 1. With the Coded PHY of Bluetooth 5, BLE can reach several hundred metres in open space. Steel, concrete and machinery shorten the practical range considerably.
Is Bluetooth secure enough for field devices?
Bluetooth can be secure enough if the device uses Secure Connections, rules out Just Works pairing and runs up-to-date firmware. Older implementations with legacy pairing are vulnerable to eavesdropping and to attacks such as KNOB and BLUFFS. Switch Bluetooth off on field devices when it is not needed.
Which European rules apply to Bluetooth devices?
As radio equipment, Bluetooth devices fall under the Radio Equipment Directive, which since August 2025 also sets cybersecurity requirements for internet-connected devices. From 11 December 2027, the requirements of the Cyber Resilience Act apply to products with digital elements. Users within the scope of NIS2 must include wireless links in their risk management.
What is Bluetooth Mesh?
Bluetooth Mesh is a separate specification from the Bluetooth SIG in which BLE devices relay messages for each other, so a network covers a larger area than a single radio. It is used mainly for lighting and building automation. For process instrumentation, WirelessHART or ISA100.11a is usually chosen instead.
📌 In summary
In OT, Bluetooth is a convenient, cheap and energy-efficient link for configuration, diagnostics and wireless sensors, but it does not replace fieldbuses or industrial Ethernet. Its security stands or falls with the version, the pairing method and the maintenance of firmware and mobile devices. If you inventory Bluetooth, disable it by default and treat it as a conduit in your zone model, you keep the benefits without an unguarded back door.
Bluetooth is a short-range wireless standard that is valuable in OT for maintenance, sensor monitoring and configuration, provided you treat it as a managed access path with strong pairing and current firmware.