20.3 Industrial Wireless Design

The BAT products provide capable hardware. Deploying them successfully requires understanding the unique challenges of wireless in industrial environments — interference sources, coverage planning, and security monitoring.

When Wireless Is Appropriate

Wireless is appropriate in OT networks when:

• Equipment moves (AGVs, forklifts, cranes, rotating machinery)
• Cabling is impractical (remote sensors, temporary installations, retrofits)
• The application tolerates soft real-time latency (monitoring, configuration, non-critical data)

Wireless is not appropriate for:

• Hard real-time control (PROFINET IRT, EtherCAT) — latency is variable and unbounded
• Safety systems — wireless cannot guarantee delivery within safety response times
• Applications where a dropped connection causes a safety incident

Caution

Never use wireless for safety-critical control loops. Use wired connections for PLCs, safety controllers, and any device where a communication failure causes a safety incident.

Industrial Interference Sources

Industrial environments contain interference sources that do not exist in office environments:

Source	Frequency	Impact
Variable frequency drives (VFDs)	Broadband	Raises noise floor, reduces SNR
Arc welding equipment	Broadband	Severe interference during welding
Induction heaters	10 kHz to 10 MHz	Harmonic interference
Microwave ovens	2.4 GHz	Direct interference with 2.4 GHz WLAN
Other 2.4 GHz WLAN	2.4 GHz	Co-channel and adjacent-channel interference
Bluetooth devices	2.4 GHz	Frequency hopping interference

Mitigation strategies:

• Use 5 GHz band near VFDs and welding equipment (less interference than 2.4 GHz)
• Use directional antennas to focus signal and reduce interference pickup
• Use shielded cables for Ethernet connections to access points
• Perform a site survey before deployment to identify interference sources

Coverage Planning

Metal structures, machinery, and walls attenuate wireless signals more severely in industrial environments than in offices. Plan coverage with these factors:

Key metrics:

• RSSI (Received Signal Strength Indicator) — signal strength in dBm; target -65 dBm or better for reliable operation
• SNR (Signal-to-Noise Ratio) — signal strength minus noise floor; target 25 dB or better
• Roaming overlap — 20% coverage overlap between adjacent APs ensures seamless handover

Detecting Rogue Access Points

A rogue AP connected to the production network bypasses all wired security controls. The following script uses Scapy to scan for wireless networks and alerts when an SSID is not in the approved list:

# pip install scapy
# Requires wireless interface in monitor mode:
# sudo ip link set wlan0 down
# sudo iw wlan0 set monitor none
# sudo ip link set wlan0 up

from scapy.all import sniff, Dot11Beacon, Dot11

APPROVED_SSIDS = {"PlantWLAN", "EngineeringWLAN", "GuestWLAN"}
seen: set[str] = set()

def detect_rogue_ap(pkt):
    if not pkt.haslayer(Dot11Beacon):
        return
    ssid = pkt[Dot11].info.decode(errors="ignore")
    bssid = pkt[Dot11].addr2
    if ssid in seen:
        return
    seen.add(ssid)
    if ssid not in APPROVED_SSIDS:
        print(f"ROGUE AP DETECTED: SSID='{ssid}' BSSID={bssid}")
    else:
        print(f"Known AP: SSID='{ssid}' BSSID={bssid}")

sniff(iface="wlan0", prn=detect_rogue_ap, store=False)

Any SSID not in the approved list is a potential rogue AP. Investigate immediately — it may be an unauthorized device or an evil twin attack.

Key Takeaways

Use 5 GHz near industrial interference sources

VFDs, welding equipment, and microwave ovens interfere with 2.4 GHz. Use 5 GHz in areas with heavy industrial equipment.

Never use wireless for safety-critical control

Wireless cannot guarantee delivery within safety response times. Use wired connections for PLCs, safety controllers, and safety-critical devices.

What Comes Next

Industrial wireless completes the product coverage. The next chapter covers market-specific network designs — railway, substation, and hazardous location networks each have unique requirements, certifications, and product choices.

References

• Hirschmann. (2024). Belden/Hirschmann Essentials 2024. Belden.
• IEEE 802.11-2020 — IEEE Standard for Information Technology — Wireless LAN
• IEC 61000-4-3 — Electromagnetic compatibility — Radiated immunity