Building a factory wireless LAN is not a matter of spacing access points evenly and running a speed test. In an operating brownfield plant in Thailand, metal machines, liquids, shutters, mobile racks, welders, legacy networks, limited shutdown windows and several generations of clients all become design constraints. A high peak rate is of little value if an AGV disconnects at a cell boundary, a scanner must reauthenticate, an incident cannot be traced, or the service cannot recover after a power failure.
This guide turns the complete journey—site investigation, use-case classification, the wired/wireless boundary, RF surveys, bands and channels, roaming, OT security, PoE, UPS, redundancy, RFP, FAT/SAT, a 30-day stability decision and operations records—into one procurement process. Wi-Fi 6E and Wi-Fi 7 are evaluated as options, not as reasons for a blanket replacement without checking Thai radio rules, client support and test evidence.
Start factory wireless LAN design with continuity, not speed
Classify the consequence of a disconnect, not just the client count
Ask which operation runs where, how much delay or loss it can tolerate, and how the machine and operator move to a safe state when communications fail. A maintenance tablet displaying a manual does not carry the same consequence as a scanner committing a product identity to a production step.
Separate fixed, nomadic and mobile uses. Fixed devices include sensors and gateways that do not move. Nomadic devices, such as scanners and maintenance laptops, move but are normally used while stationary. Mobile devices, such as AGVs and AMRs, may need a session while travelling. Then classify control, monitoring, traceability, voice/video and general business traffic.
| Use case | Movement | Main consequence of loss | First design questions |
|---|---|---|---|
| Sensor / edge gateway | Fixed | Missing data or delayed monitoring | Buffering, retry, time, power and maintenance |
| Handheld scanner | Nomadic | Duplicate/missing transaction, stopped work | Transaction ID, offline procedure and authentication time |
| Maintenance terminal | Nomadic | Slower diagnosis and recovery | Destination limits, privileges, audit and emergency access |
| AGV / AMR | Mobile | Stop, congestion or route update failure | Roaming, latency, loss and safe behaviour |
| Camera | Fixed/mobile | Lost video and bandwidth contention | Uplink load, retention, priority and privacy |
| PLC or safety-related path | Case-specific | Control or safety impact | Prefer wired; require specialist validation |
Availability means that the client is authenticated, can reach only its required destination, completes the application transaction before its deadline, and records one unambiguous result. Safety means a communications failure must not push a vehicle, machine or task into a hazardous state; WLAN testing does not replace a safety function. Recoverability means a named person can restore an AP, switch, certificate or configuration after failure.
NIST SP 800-82 Rev.3 explicitly addresses OT security together with unique performance, reliability and safety requirements. The practical response is neither “apply an IT control immediately” nor “the line cannot stop, so do nothing.” Every material change needs an impact assessment, controlled test and recovery plan.
Site investigation in an operating Thai brownfield plant
Observe both running and stopped conditions
An empty-plant survey cannot reproduce live interference, inventory, material movement or door positions. During production, observe welders, drives, wireless equipment, AGV traffic, worker density, Bluetooth and personal hotspots. During a controlled stop, inspect candidate AP locations, cable routes, panels, ceiling spaces, grounding, power, environmental ratings and safe installation access.
Do not measure only today’s RF. Propagation changes when racks are added, lines move, shutters close, tanks fill or finished goods stack up. Metal reflects and blocks; liquids and people absorb; racks and doors create time-varying obstacles. Heat, dust, oil, chemicals, condensation, washdown and vibration affect the AP, antenna, connector and enclosure choice.
Inventory the existing industrial network before adding radio
Record switches, fibre/copper links, VLANs, routing, DHCP, DNS, NTP, AAA, firewalls, monitoring, spare ports, PoE headroom, UPS and configuration backups. “An unused port exists” does not mean that port is safe for an OT service. Include support status, power source, uplink and single points of failure.
For each asset, keep location, role, owner, management address, software release, support status, authoritative configuration, replacement method, supply source and neighbours. If an unmanaged switch or domestic AP is found, first identify the use and consequence; migrate it in stages to an approved path rather than creating an uncontrolled production outage.
Draw the wired/wireless boundary from the use cases
Ask whether wireless adds value, not merely whether it can work
Wireless adds value for mobility, difficult cable routes and frequently changing areas. A fixed control device, high-frequency cyclic communication, strict jitter limit or high-consequence path may remain simpler and more predictable on wire. Passing a radio test does not automatically make wireless the best operating choice.
Cisco’s PROFINET Wireless Design and Implementation Guide is a vendor primary source for validated scenarios. It stresses that an application must not time out while a device moves, and that RF coverage, site survey and frequency planning matter. The 10 ms and 100 ms examples in that document belong to its tested architecture and use cases; they are not universal factory SLAs. Validate the actual PLC, client, authentication, topology and load.
Use factory edge computing to contain data loss
The value of factory edge computing is not only fast processing. A local edge service can timestamp and buffer sensor or scanner data and retry it with the same transaction identity when upstream connectivity returns. It can also transform protocols, attach quality and expose health.
Buffering still needs a capacity limit, expiry rule, clock, order, duplicate prevention, acknowledgement, disk-failure behaviour and protected power. The same principle applies when connecting process parameter records and a production progress monitor: define the system of record and the owner of retry before a link fails.
RF survey: running, stopped and future layouts
Combine predictive, passive, active and roaming work
A predictive model uses drawings, materials, antennas and power to propose locations. A passive survey observes neighbouring APs, channel use and noise. An active survey connects a test client and measures throughput, latency, loss and retry. A roaming survey follows defined paths at different speeds, headings and load states while recording AP transitions and application results.
A survey adapter and a real client may behave differently because antenna count, supported bands, transmit capability, roaming logic, driver, power saving and mounting differ. The acceptance test must use representative production clients. For an AGV, include actual speed, stops, turns, passing vehicles, loaded/empty states and shutter crossings.
A heatmap is evidence, not the whole acceptance decision
RSSI alone is only an entry point. Overlay SNR, noise, channel utilisation, co-channel and adjacent-channel interference, retry, modulation, client counts, uplink/downlink asymmetry and roam history. Raising AP power may not improve the client uplink and may make a client remain attached to a distant AP.
The RFP should state areas, production states, time windows, representative clients, measurement height, door/rack/material conditions, metrics, raw data, editable project files and the condition for resurvey. A PDF image alone is not sufficient for later change analysis.
Choosing 2.4, 5 and 6 GHz, Wi-Fi 6E and Wi-Fi 7 in Thailand
NBTC figures are regulatory categories and ceilings—not target power
The current NBTC SDoC Online page, checked on 24 August 2026, lists WLAN 2.4 GHz at 2400–2500 MHz and 100 mW e.i.r.p.; 5.2 GHz at 5150–5350 MHz and 200 mW e.i.r.p.; 5.4 GHz at 5470–5725 MHz and 1 W e.i.r.p.; and 5.8 GHz at 5725–5850 MHz and 1 W e.i.r.p. For 6 GHz, it lists 5925–6425 MHz: LPI indoors at 250 mW e.i.r.p. and VLP indoors/outdoors at 25 mW e.i.r.p.
These NBTC primary-source values do not instruct a designer to configure the ceiling. Immediately before purchase, verify conformity of the exact hardware, e.i.r.p. including antenna gain, installation class, current import/sale/use procedures and firmware country code with NBTC information and a competent supplier. A loading bay or covered bridge must not be assumed to be indoor.
| Band | Current NBTC SDoC listing | Factory decision point |
|---|---|---|
| 2.4 GHz | 2400–2500 MHz, 100 mW e.i.r.p. | Broad client support, but congestion and few non-overlapping channels |
| 5.2 GHz | 5150–5350 MHz, 200 mW e.i.r.p. | Client/channel conditions and cell plan |
| 5.4 GHz | 5470–5725 MHz, 1 W e.i.r.p. | Radar-avoidance behaviour and operational impact |
| 5.8 GHz | 5725–5850 MHz, 1 W e.i.r.p. | Client support, interference and conformity |
| 6 GHz LPI | 5925–6425 MHz, indoor, 250 mW e.i.r.p. | 6E/7 clients, indoor status, propagation and conformity |
| 6 GHz VLP | 5925–6425 MHz, indoor/outdoor, 25 mW e.i.r.p. | Low-power limits, use case and field evidence |
Do not accept or reject a design by the Wi-Fi generation name
IEEE 802.11ax-2021 defines high-efficiency PHY/MAC modifications between 1 and 7.125 GHz. IEEE 802.11be-2024 is the EHT amendment; its official page describes mechanisms for at least one mode capable of a maximum throughput of at least 30 Gbit/s at the MAC SAP and improved worst-case latency/jitter. Those are standard capabilities, not a guarantee through factory walls, interference, clients, switching and applications.
Six gigahertz may provide cleaner capacity for new clients, but old industrial scanners may not support it, propagation differs, and indoor status, spare clients and driver validation matter. A Wi-Fi 7 AP alone cannot deliver value if the clients, AAA, switch uplinks, PoE and monitoring are not ready. Pilot it in a new zone or high-density use case and expand only where measured benefit justifies it.
Design capacity and channels from bidirectional transactions
Scanner data may be small but burst at shift changes or dispatch cut-offs. Cameras consume sustained uplink. Maintenance computers create sudden update and cloud-sync traffic. AGVs exchange small continuous messages but may be sensitive to brief interruption. Capture peak, direction, packet size, cycle, retry and deadline, not just average Mbps.
Wider channels can increase single-link headroom but reduce channel reuse and complicate interference management. In a brownfield plant, do not make the maximum width the default. If automatic channel/power management is used, define its OT impact, allowed change window, audit record and locked conditions.
| Input | Site evidence | Design use |
|---|---|---|
| Concurrent clients | Peak by shift and area | Include growth rather than average only |
| Uplink/downlink | Per-application measurement | Isolate camera and upload demand |
| Transaction deadline | Business tolerance | Separate network and application processing |
| Retry/loss | Live distribution | Find the bad period, not just the mean |
| Channel utilisation | AP and band | Correlate Wi-Fi and non-Wi-Fi interference |
| Growth | Clients, data and area | State headroom and expansion trigger |
Accept roaming, latency and loss at application level
Use two layers: radio KPIs and business KPIs
A fast roam can still fail if AAA, DHCP, DNS, firewall, server or application reconnection adds delay. Conversely, a short loss may have no business consequence if a client buffers and retries idempotently. Correlate radio and transaction records using the same clock.
The following table is an illustrative RFP assumption, not an IEEE or NBTC requirement, a generic Cisco value, or a TOMAS TECH performance promise. Replace it using the real timeout, safe behaviour, client specification and survey results.
| Example KPI | Illustrative RFP target | Measurement definition |
|---|---|---|
| Communication success on defined routes | ≥99.95% over 30 days | Named clients, shifts and planned exclusions |
| Roaming interruption | 95th percentile ≤150 ms | Named AGV, speed, AP boundary and AAA method |
| RTT | 95th percentile ≤80 ms | Client to production application under load |
| Packet loss | <0.5% in a five-minute window | Packet type, direction and observation points |
| Scan transaction | 99.9% completed within 2 s | From read to database acceptance |
| Recovery | ≤15 min from one AP failure | Spare, approved configuration and trained owner present |
Record percentile, outliers, duration and area—not merely averages. Acceptance must state whether the AGV stopped, a scan duplicated, or buffered data arrived exactly once. A synthetic ping alone cannot close an application test.
OT security: segmentation, AAA, certificates and monitoring
A separate SSID is not complete segmentation
Map each role to an SSID, VLAN, address plan, allowed flow, authentication and monitoring policy, but avoid an uncontrolled number of SSIDs. Enforce destination, direction and port at the appropriate control point. Explicitly decide client-to-client, internet, IT, other-line and management-plane reachability.
CISA’s ICS Recommended Practices hub provides official defense-in-depth and incident-response guidance. The design objective is to know assets and flows, avoid a single control, detect abnormal behaviour and be able to isolate and recover. Strong radio encryption does not limit the blast radius if one credential reaches the whole factory.
Connect AAA and certificates to the device lifecycle
Where supported, evaluate individual authentication such as 802.1X and certificates instead of a shared password. Design redundant AAA, failure behaviour, time synchronisation, certificate issuance, storage, renewal, revocation and replacement-device onboarding. Put unsupported legacy clients in a tightly constrained segment with individual inventory and a replacement plan.
Monitor expiry before a certificate stops a line. Test renewal, identify the owner and keep an emergency procedure. Contractor access should be requested, time-bound, destination-limited and logged rather than permanently enabled.
Observe wired, wireless and application events on one clock
Correlate AP status, authentication failure, roam, channel change, interference, retry, client health, DHCP/DNS/NTP, switch ports, PoE, firewall denies and application transactions. Define retention, access, capacity, alert ownership and first-response procedures.
A MES implementation in a Thai factory joins shop-floor events with orders and production results. WLAN operations should similarly trace a failed transaction across the scanner, edge, network and MES using time and transaction identity.
PoE, UPS and redundancy: remove non-RF single points of failure
Check total switch PoE budget, per-port capacity, power supplies, redundancy, start-up, cable length and temperature derating. A replacement AP may restrict radios or auxiliary features when power is insufficient; verify the exact manufacturer’s condition rather than stating a universal value.
A PoE switch on UPS does not preserve service if the uplink, controller, AAA, DHCP, firewall or edge server loses power. Draw dependencies from client to application, then test hold-up time, orderly shutdown, restoration sequence and generator transfer.
Two APs are not redundancy if they share the same switch, supply, fibre and AAA. For important areas, assess cell overlap, switching paths, power feeds, uplinks, management, AAA, DHCP and monitoring. Execute failure tests only under an approved plan with observers, recovery criteria and rollback, while recording both packet loss and operational impact.
RFP: make factory WLAN bids comparable
Give every bidder the same use-case register, drawings, production conditions, installed assets, constraints, deliverables and acceptance rules. Separate hardware, licences, surveys, design, cabling, construction, configuration, tests, training, documents, warranty, maintenance, spares, night work and shutdown support.
| RFP section | Required content |
|---|---|
| Purpose and scope | Areas, uses, clients, business consequence and exclusions |
| Investigation | Running/stopped RF, interference, existing network, power and environment |
| Design | Wired boundary, bands, channels, cells, capacity and segmentation |
| Security | AAA, certificates, flows, management, logs, vulnerability/change handling |
| Infrastructure | APs, antennas, mounts, cabling, PoE, UPS and redundancy |
| Migration | Pilot, staged cutover, shutdown, rollback and legacy removal |
| Tests | FAT, SAT, roam, failure, recovery and 30-day observation |
| Deliverables | Drawings, configuration, raw survey files, register, backups and procedures |
| Support | SLA, contacts, spares, certificates, software lifecycle and onsite response |
Do not accept names such as “AI optimisation,” “zero touch” or “Wi-Fi 7 ready” as test criteria. Ask what is observed, when a change is made, how it is audited and how it is rolled back.
Stage the brownfield migration
Changing existing SSIDs, static addresses, certificates, old security, client profiles and application destinations at once makes diagnosis difficult. Pilot representative clients in one zone, monitor old and new service, then migrate by approved batches.
Define rollback by owner, decision time, configurations, cabling, client profiles and data reconciliation—not simply “return if a problem occurs.” Record the approval, implementer, configuration difference, test, result and open point for each change.
FAT, SAT and the 30-day stability decision
FAT removes configuration and recovery defects before site work
Build a representative AP, switch, management/controller, AAA, certificate, DHCP, VLAN, firewall and monitoring environment. FAT cannot reproduce the full plant RF environment, but it can prove templates, roles, authentication, allowed flows, logs, backups, restoration, upgrades and replacement.
Each record needs a test ID, prerequisite, procedure, expected and actual result, logs, configuration release, deviation, correction, retest and approval. A photo showing “connected” is not evidence of repeatability.
SAT uses the real factory, clients, routes and load
| SAT scenario | Method | Passing evidence |
|---|---|---|
| Coverage | Named points/heights, door and material states | Raw data, heatmaps and exception register |
| Capacity | Shift-peak clients and traffic | KPI distribution, utilisation and application result |
| Roaming | AGV/scanner on production route | AP transitions, loss, transaction and stop/no-stop |
| Authentication | Join, renewal, expiry, revocation, AAA outage | Allow/deny, recovery and audit records |
| Failure | AP, uplink, supply and service interruption | Scope, failover, recovery and data consistency |
| Interference | Busy production interval | SNR, utilisation, retry and business KPI |
| Restoration | Restore approved configuration to spare | Connectivity, monitoring and register version match |
Functional and machine safety validation remains a separate competent activity under applicable law, standards, risk assessment and safety requirements. A WLAN SAT is not safety certification.
Observe normal production long enough to close exceptions
An acceptance day may miss month-end volume, all shifts, cleaning, maximum inventory and maintenance. An illustrative RFP approach is a 30-calendar-day stability period after SAT; change it to the plant’s production cycle.
Review connection success, authentication failure, roam, latency, loss, utilisation, AP restarts, PoE events, application failure and tickets by day, shift and area. Classify planned work, client fault, application fault and radio cause. Every exception needs impact, controlled workaround, owner, due date and retest. The contract should state its relationship to final payment and warranty start.
Operations register, change control and restoration drills
Receive editable physical/logical diagrams, AP location and antenna direction, cable/port records, VLAN/SSID/address plan, allowed flows, AAA/certificates, PoE/UPS, licences, releases, raw survey data, configuration backups, restore procedures, test evidence and spares. Keep secrets in an approved secret-management system, not in a plain register.
Verify that the authoritative configuration, running devices and backups match. Restore a spare AP or switch from initial state and prove authentication, traffic, monitoring and logging. Do not accept a design that exists only on a contractor’s laptop.
Evaluate RF, security and application impact together when racks, lines, APs, channels, certificates, firewall rules or drivers change. Periodically review rogue/unmanaged devices, certificate and licence expiry, support lifecycle, retry trends, interference, capacity, incidents and configuration history.
Pre-procurement checklist
Before the survey
- List areas, shifts, shutdown windows and safe-work rules.
- Register fixed, nomadic and mobile clients with business consequence.
- Gather authoritative diagrams, VLAN, power, PoE, UPS, AAA and monitoring data.
- Define running/stopped, door, rack and material survey conditions.
- Confirm client model, OS, driver, supported bands and spares.
Before issuing the RFP
- Approve the wired/wireless boundary per use case.
- Derive KPIs from application transactions and failure consequences.
- Assign responsibility to reconfirm current NBTC rules and conformity before purchase.
- Include OT segmentation, AAA, certificates, monitoring and change control.
- Price FAT, SAT, stability observation, deliverables and restore drills.
Before handover
- Complete SAT with production clients, routes, load and interference.
- Safely test AP, uplink, AAA and power failures.
- Reconcile configurations, drawings, surveys, register and backups.
- Give every open point an impact, workaround, owner, date and retest.
- Have plant personnel demonstrate restore and first diagnosis.
FAQ: factory WLAN, OT security and Wi-Fi 7
How is a factory wireless LAN different from office Wi-Fi?
Metal, liquid, mobile inventory, welding, environment and long operations matter, while AGV and scan transactions directly affect production. Acceptance therefore includes roaming, retry, identity, power, segmentation, application completion and recovery—not signal strength alone.
Is a shutdown survey enough?
Not necessarily. It shows installation conditions but misses live machinery, material, people and surrounding radio. Combine safely controlled running and stopped observations and model future layout changes.
What roaming time should an AGV/AMR meet?
There is no universal number. Derive it from vehicle architecture, application timeout, buffers, safe state, route and speed. Values in this article are illustrative RFP assumptions. Test both interruption and the operational outcome.
Should a factory replace everything with Wi-Fi 7?
Not on the generation name alone. Check client support, Thai conditions, 6 GHz conformity, propagation, PoE, switching, AAA, monitoring, spares and measured benefit. Pilot a suitable zone and retain Wi-Fi 6/6E or wired paths where they remain better.
What does NBTC currently list for 6 GHz?
The NBTC SDoC page checked on 24 August 2026 lists 5925–6425 MHz, LPI indoor at 250 mW e.i.r.p. and VLP indoor/outdoor at 25 mW e.i.r.p. Confirm the exact device, procedure, antenna and installation class immediately before procurement.
Are separate SSIDs and passwords sufficient OT security?
No. Add restricted flows, individual identity or compensating controls, certificate lifecycle, protected management, monitoring, backup, change control and incident response.
Can industrial network bids be compared by AP count?
No. Align survey scope, cabling, PoE, UPS, redundancy, security, migration, night work, FAT/SAT, observation, editable records, restoration and support. Separate hardware, services and recurring licences.
Does edge computing eliminate wireless outages?
It does not remove the outage. Buffering, transaction identity, retry and deduplication can contain the impact. Capacity, time, order, acknowledgement, disk and power behaviour still require design.
Conclusion: procure measurable continuity
A successful brownfield factory WLAN in Thailand is not a row of the latest APs. Classify fixed, nomadic and mobile uses; retain wire where it is the more predictable boundary; and measure live RF, clients, capacity, roaming and transactions. Recheck NBTC conditions and exact equipment conformity. Adopt Wi-Fi 6E/7 only where supported clients and field results justify it.
Put OT segmentation, AAA, certificates, monitoring, PoE, UPS, redundancy, authoritative configurations and restoration in the same RFP. Use FAT for configuration and failure, SAT for the real plant and a stability period for closing exceptions. The deliverable is a service that detects failure, moves operations safely, preserves evidence and can be restored.
Even before choosing an AP count or architecture, a plant can define use cases, survey conditions, an RFP and a pilot boundary. For a Thai factory WLAN or OT network renewal, discuss the concept stage through the TOMAS TECH contact page.
Official primary sources
- Cisco, Validated Designs for Digital Manufacturing: https://www.cisco.com/c/en/us/solutions/design-zone/industries/manufacturing.html
- Cisco, Connected Factory—PROFINET Wireless Design and Implementation Guide: https://www.cisco.com/c/en/us/td/docs/solutions/Verticals/PROFINET/2-0/DIG/PROFINET2-DIG/PROFINET2-DIG-Chapter.html
- NIST SP 800-82 Rev.3: https://csrc.nist.gov/pubs/sp/800/82/r3/final
- NBTC SDoC Online: https://standard.nbtc.go.th/บริการออนไลน์/SDoC-Online.aspx
- NBTC 6 GHz information: https://nbtc.go.th/News/Information/66915.aspx?lang=th-th
- IEEE 802.11ax-2021: https://standards.ieee.org/ieee/802.11ax/7180/
- IEEE 802.11be-2024: https://standards.ieee.org/ieee/802.11be/7516/
- CISA ICS Recommended Practices: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
