Industrial WiFi Module Case Studies

Conducted EMI from VFDs couples directly onto the RS-485 bus through shared power and ground bonds rather than through air. Measured common-mode voltage on RS-485 during VFD ramp-up reached 12 V_pk-pk at 4 kHz switching frequency—well above the TIA/EIA-485-A receiver input limit of −7 V to +12 V. Radiated EMI is attenuated by the steel enclosure (20–30 dB @ 2.4 GHz), but conducted noise bypasses the enclosure entirely. A ferrite common-mode choke (TDK ZCAT3035-1330) with 3 turns provides >200 Ω impedance at 4 kHz–300 MHz, which eliminated the CRC errors in Case 2.

A 16-gauge (1.5 mm) cold-rolled steel enclosure attenuates 2.4 GHz signals by 22–28 dB; stainless steel 304 adds 3–5 dB additional loss due to lower conductivity. Aluminum enclosures attenuate 8–12 dB less than steel of the same thickness. In the PLC retrofit case (Case 2), the measured RSSI inside a 16-gauge steel NEMA 4X cabinet was −78 dBm vs −62 dBm with the module placed 50 cm outside the cabinet—a 16 dB improvement purely from antenna relocation. For existing installations, an external antenna on a 1 m LMR-400 pigtail with an N-type bulkhead feedthrough is the minimum viable modification.

The RTL8188EU module performed IEEE 802.11 active scanning per Clause 11.1.3 of IEEE 802.11-2020: it disassociated from the current AP, transmitted Probe Request frames sequentially on each supported channel (1–11 in 2.4 GHz), waited for Probe Response (MinChannelTime 100 ms, MaxChannelTime 400 ms per channel), selected the AP with the strongest RSSI, completed Open System Authentication, then executed the 4-way handshake (EAPOL-Key message 1–4). Total: 3.1 seconds median. At 34 km/h (9.44 m/s), this equates to 29.3 m of blind travel. The QCA6391 with 802.11r FT (Fast Transition) over DS performed the FT Authentication and FT Reassociation exchange in a single frame sequence without disconnecting from the current AP, completing in 31 ms median. The mobility domain is authenticated in advance over the distribution system, so no full 802.1X/EAP re-authentication is needed.

In the 64-sensor trial (Case 5), synchronized ADC triggering caused all 64 nodes to transmit within 100 ms, resulting in 17% collision rate. With randomized timing (100–500 ms window) and CCA at −78 dBm threshold, collisions dropped to 2.1% at 64 nodes. Scaling analysis: at 100 nodes with 50-byte payloads at 1-minute intervals, airtime utilization is approximately 2.8% assuming 1 Mbps PHY rate (ESP-NOW max). The practical limit for a single ESP-NOW gateway without TDMA scheduling is approximately 80 nodes at 1-minute intervals. Beyond 100 nodes, a partitioned topology with 2–3 gateway nodes or TDMA slot assignment per IEEE 802.15.4 superframe structure is recommended.

Minimum toolset: (1) Spectrum analyzer (Keysight N9342C or equivalent) with max-hold sweep over 2.4–2.5 GHz and 5.15–5.85 GHz to capture intermittent noise sources; (2) Wireshark with radiotap header for 802.11 management frame analysis (roaming latency, retry rates, CRC errors); (3) iperf3 in reverse mode for sustained throughput and jitter measurement with 10 ms logging interval; (4) Modbus TCP-specific: Wireshark with Modbus dissector filter (mb.tcp.func) for transaction error rate; (5) ESP-NOW: enable ESP32 PHY collision counter through esp_wifi_set_event_mask() and log send_cb() status per node.

IEEE 802.11r-2008 (now incorporated in IEEE 802.11-2020 Clause 11) defines Fast BSS Transition, a roaming mechanism that eliminates the full 802.1X/EAP re-authentication at each AP boundary. FT over DS (Distribution System) uses a single FT Authentication Request/Response pair plus FT Reassociation, completing in 4–8 ms over the air. The client pre-authenticates with target APs via the distribution system before disconnecting from the current AP, reducing total roam time from seconds to milliseconds. Required hardware: both client STA and AP must support 802.11r FT. Reference: IEEE 802.11-2020 Clause 11.5.

CCA is the physical layer carrier sensing mechanism defined in IEEE 802.11-2020 Clause 10. The STA listens on the operating channel before transmitting; if detected signal power exceeds the CCA threshold (default −82 dBm for 20 MHz at 2.4 GHz), the STA defers transmission and applies a random backoff. In the ESP-NOW sensor trial (Case 5), enabling CCA at −78 dBm threshold reduced collisions by 87% (from 17% to 2.1%). CCA is distinct from virtual carrier sensing (NAV) and is essential for uncoordinated multi-node topologies.

Conducted EMI propagates along electrical conductors (power lines, signal cables, ground bonds) as common-mode or differential-mode noise. It is measured via LISN (Line Impedance Stabilization Network) per CISPR 16/IEC 61000-4-6. Radiated EMI propagates through air as electromagnetic waves, measured via antenna per CISPR 11. In industrial environments, VFDs generate significant conducted EMI at switching frequencies (2–16 kHz) and their harmonics (up to 30 MHz). Radiated EMI from VFDs typically dominates at >30 MHz. For PLC wireless retrofits, conducted EMI is more destructive because it couples onto the RS-485 data lines inside the cabinet where no antenna gain or external filtering applies.

Modbus TCP uses a 16-bit CRC (cyclic redundancy check) per frame as defined in MODBUS Application Protocol Specification V1.1b. A CRC error occurs when the receiver’s computed CRC does not match the transmitted CRC, indicating frame corruption during transmission. Diagnosis: capture traffic with Wireshark Modbus dissector, filter mb.tcp.func && mbtcp.crc_error (older Wireshark) or parse the TCP payload CRC directly. In Case 2, CRC errors exclusively occurred during VFD ramp events, confirmed by cross-correlating with motor current log. Error rate: 12% (1,200 of 10,000 transactions). After ferrite choke + shielded cable, 0% over 72 hours.