Wifi

What is Wi-Fi?

Wi-Fi is the Wi-Fi Alliance brand name for wireless local area networks (WLANs) that operate according to the IEEE 802.11 standard, in which devices use radio waves in the 2.4, 5 or 6 GHz band to connect to an access point attached to the wired network. The IEEE writes the technical standard; the Wi-Fi Alliance, founded in 1999, tests and certifies products so that devices from different manufacturers work together. In industrial environments, Wi-Fi is used for mobile HMIs, wireless sensors, AGVs and maintenance access, but it requires strict control because of its susceptibility to interference and its security risks.

🧠 How does Wi-Fi work?

A Wi-Fi network consists of clients and one or more access points (APs). The AP broadcasts a network name (SSID) and is connected to the wired network through a switch or router. The key principles:

• Shared medium - all devices on a channel share the same radio space. Wi-Fi uses CSMA/CA (listen before talk): a device first listens whether the channel is free. Collisions and waiting times therefore cannot be ruled out.
• Frequency bands - 2.4 GHz has a longer range but little room: in practice three non-overlapping channels are used (1, 6 and 11); 5 GHz offers many more channels; 6 GHz (from Wi-Fi 6E onwards) has been opened in Europe from 5945 to 6425 MHz, for low-power indoor use and for very-low-power devices.
• Range - typically around 20 metres indoors per AP; steel structures, tanks and machines shorten this considerably.
• Roaming - moving clients switch between APs. The amendments 802.11k, 802.11v and 802.11r (fast BSS transition) speed up that handover.
• Security - WPA2 or WPA3 encrypts the traffic; in enterprise environments with 802.1X authentication against a RADIUS server.

🕰️ Which Wi-Fi generations exist?

In 2018 the Wi-Fi Alliance introduced generation numbers, so users no longer need to deal with IEEE letters:

The year is that of the IEEE standard. Certified products often appear earlier: the Wi-Fi Alliance started certifying Wi-Fi 6 in 2019 and Wi-Fi 7 in January 2024, before 802.11be had been finally approved. These maximum speeds are theoretical. In a factory with dozens of clients, reflections and interference, the real throughput per device is much lower. For OT, Wi-Fi 6 is interesting because OFDMA handles many small data packets more efficiently. With Multi-Link Operation, Wi-Fi 7 can use several bands at the same time, which improves robustness.

🏭 Where is Wi-Fi used in industry?

• Mobile operation - tablets and wireless HMIs for operators and technicians on the shop floor
• Maintenance and diagnostics - temporary access to PLCs and drives during commissioning or calibration
• Logistics - handheld scanners for barcodes and RFID in warehouses and production
• Mobile systems - AGVs and AMRs that exchange orders and positions with a fleet manager
• Hard-to-reach locations - sensors and cameras on rotating or movable parts of a plant

Standard Wi-Fi is less suitable for cyclic fieldbus communication and safety functions. Vendors offer their own extensions for this, such as Siemens iPCF for ProfiNET over WLAN. These only work within that vendor’s ecosystem.

🔄 When should you choose Wi-Fi and when another wireless protocol?

Wi-Fi is a broadband technology. For battery-powered sensors, long distances or guaranteed delay, other technologies are often a better fit:

Where hard real-time requirements apply, a cable with industrial Ethernet or TSN remains the norm, because Wi-Fi cannot guarantee deterministic behaviour and its jitter is unpredictable.

🔐 How do you secure Wi-Fi in an OT environment?

Radio signals do not stop at the fence: an attacker with a directional antenna can reach a network from outside the site. Well-known weaknesses include KRACK (2017) in WPA2, Dragonblood (2019) in early WPA3 implementations and FragAttacks (2021) in the 802.11 standard itself. Since July 2020, WPA3 has been mandatory for Wi-Fi CERTIFIED devices. Key measures:

• WPA3-Enterprise with 802.1X and RADIUS, preferably with certificates (EAP-TLS) and sound certificate management instead of a shared password
• Protected Management Frames (802.11w) enabled; WPA3 enforces this and it limits deauthentication attacks
• Own segment - each wireless network in its own VLAN and zone, with a firewall as the boundary, following the zones and conduits model of IEC 62443
• Separate SSIDs - a dedicated guest network for visitors, never shared with OT equipment
• MAC filtering only as an extra layer: a MAC address is easy to forge (spoofing)
• Port Security and NAC on the uplinks of access points
• Detection - logging to a SIEM, network monitoring and a wireless IDS that tracks down a rogue access point
• No default settings - unique SSIDs, passwords and admin accounts, firmware kept up to date

IEC 62443-3-3 contains specific requirements for wireless access, such as wireless access management (SR 1.6) and wireless use control (SR 2.2). A segmented design also supports compliance with the Dutch Cyberbeveiligingswet, the national implementation of NIS2, which has been in force since 15 August 2026.

🧭 How do you set up industrial Wi-Fi step by step?

1. Decide whether wireless is needed - make a risk assessment per application. Deploy only where residual risks to safety, the environment and production are low.
2. Carry out a site survey - before installation, measure coverage, signal strength and sources of interference such as frequency converters, welding equipment and metal storage.
3. Choose band and channels - preferably use 5 or 6 GHz. Watch out for DFS channels in the 5 GHz band: when radar is detected, the AP must change channel, which can briefly interrupt clients.
4. Select industrial hardware - APs with wide temperature ranges, IP-rated enclosures, redundant power supplies and, where needed, an ATEX-certified version for explosive atmospheres.
5. Design for redundancy - overlapping coverage, so that the failure of one AP does not cause a production stop.
6. Secure and segment - WPA3-Enterprise, separate VLANs per application and firewall rules towards the OT network.
7. Monitor continuously - track clients, roaming times and interference, and repeat the survey after building alterations.

When purchasing wireless equipment, note that since 1 August 2025 new radio equipment placed on the EU market must meet the cybersecurity requirements of the Radio Equipment Directive, which can be demonstrated through the harmonised EN 18031 standards. From 11 December 2027 the Cyber Resilience Act takes over that role; the European Commission has repealed the relevant delegated regulation with effect from that date. In the Netherlands, the Dutch Authority for Digital Infrastructure (RDI) supervises the licence-exempt use of the Wi-Fi bands.

❓ Frequently asked questions

Is Wi-Fi suitable for real-time control?

Standard Wi-Fi is not suitable for hard real-time control, because it is a shared, unlicensed medium with varying delay. Wi-Fi works very well for tablets, scanners and monitoring. Critical control loops and safety functions belong on a wired industrial network.

What is the difference between Wi-Fi and WLAN?

WLAN (wireless local area network) is the general term for a wireless local network. Wi-Fi is the Wi-Fi Alliance brand name for WLAN products that operate according to IEEE 802.11 and have been certified. In practice, both terms are used interchangeably.

Is WPA2 still secure enough for an OT network?

WPA2 with a strong, unique password is not immediately insecure, but a shared password can be guessed offline and leaks with every employee who leaves. For OT networks, WPA3-Enterprise with 802.1X and certificates is the better choice. Place older devices that only support WPA2 in a separate, strictly filtered segment.

Which Wi-Fi band is best for a factory?

The 5 GHz band is usually the best choice in factories, because many more channels are available than in the crowded 2.4 GHz band. The 6 GHz band of Wi-Fi 6E and Wi-Fi 7 is even quieter, but has a shorter range. The 2.4 GHz band remains useful for older equipment and longer distances.

Which is better for a factory: Wi-Fi or 5G?

Wi-Fi is cheaper and widely supported, and it is sufficient for most mobile applications in a factory. Private 5G uses licensed spectrum and offers more predictable performance and better mobility across large sites. Many companies combine both: Wi-Fi for offices and logistics, 5G for critical mobile systems.

How do you detect an unauthorised access point?

You detect an unauthorised or rogue access point with a wireless IDS or with the detection function of a central WLAN controller. It compares all observed SSIDs and MAC addresses with the list of your own APs. Periodic measurements on the shop floor and port security on switch ports prevent a router brought in from outside from ending up unnoticed on the OT network.

📌 In summary

Wi-Fi is the widely supported wireless networking technology based on IEEE 802.11 that brings mobility to operators, scanners and AGVs in industry. Because it is a shared, unlicensed radio medium without guaranteed delay, Wi-Fi does not belong in critical control loops. A site survey, WPA3-Enterprise and a dedicated segmented zone according to IEC 62443 make Wi-Fi in OT reliable and secure.