Which measurements can go wireless? WirelessHART, ISA100 and the gateway you must secure

The quotation for the cold store extension came back with one line that stopped the meeting. Thirty new temperature points, cable trays through a finished wall, a fire-stopping contractor and two weekends of shutdown. The instrument supplier had attached an alternative on a single page: battery-powered wireless transmitters, one gateway on the mezzanine, a few days of installation. The quality lead asked what happens to the record when a reading does not arrive. The network engineer asked where the gateway plugs in, and who holds its password.

Both questions are the right ones, and neither is about the radio. Wireless field instruments rest on two international standards and a large installed base in oil, gas and chemicals. What a regulated site has to decide is which measurements may depend on a radio link, and how the one box that joins the radio to the plant network is secured, qualified and kept under change control.

Two standards on the same radio

Two protocols cover most wireless process instruments. WirelessHART extends HART (Highway Addressable Remote Transducer), the digital layer that rides on 4–20 mA loops, to a radio while keeping its commands, devices and tools, as FieldComm Group, which maintains it, describes it. Its international form is IEC 62591, whose second edition was published on 30 March 2016.

ISA100 Wireless was written by the International Society of Automation (ISA) and approved by the American National Standards Institute (ANSI) as ANSI/ISA-100.11a-2011. ISA announced its unanimous approval by the International Electrotechnical Commission (IEC) on 16 September 2014, and the IEC published it as IEC 62734 on 28 October 2014; an amendment followed in 2019.

Underneath, the two look alike. Both use the IEEE 802.15.4 low-rate radio in the licence-free 2.4 GHz band, both let instruments relay each other’s messages in a mesh, and in both a network manager schedules who talks when. The scope of IEC 62734 is candid about the limit: it addresses monitoring and control “where end-to-end communication latencies on the order of at least 100 ms can be tolerated”. Neither was designed to replace a fast loop.

The differences show at the gateway more than in the field. WirelessHART speaks HART end to end, which suits a site whose asset management tools already know HART devices. ISA100 carries IPv6 addressing and was built to tunnel other protocols. Its promoters, interviewed by Automation.com for its August/September 2025 issue, stress that tunnelling and a star arrangement with few hops for time-critical uses. Those are vendors’ arguments. On most sites the right choice is the one the existing distributed control system (DCS) and asset tools already support.

Which readings may depend on a radio

Wired or wireless is a poor question for a whole plant. The useful one is asked measurement by measurement: what happens to the process, the product and the record if this value is late, missing or frozen for ten minutes? On the sites we work with, the answer sorts measurements into four groups, and only the first is easy.

Storage monitoring is where wireless helps a pharmaceutical site most, and where quality reads it most closely. The EU Guidelines on Good Distribution Practice (GDP) of 2013 ask in section 3.2.1 that monitoring devices be placed where the temperature mapping shows the extremes, and in section 3.3 that monitoring equipment be calibrated at defined intervals and that alarm systems alert on excursions, with alarms “regularly tested”.

A wireless probe makes the first requirement easy: it goes where the mapping says, not where the cable tray runs. The alarm needs a design decision. A lost radio link is not a temperature excursion, and a host that keeps the last good value on screen hides it. The 2016 edition of IEC 62591 added stale data detection to the standard; check that the gateway and the monitoring software use it, and that a stale value raises an alarm of its own.

Safety sits at the far end. The same magazine feature reports vendors offering ISA100 gas detectors certified to safety integrity level (SIL) 2, with safety messages tunnelled over the radio. The principle is the “black channel” of IEC 61784-3 (2021, amended 2024): the safety layer at each end detects loss, delay or corruption, whatever carries the message.

That can be valid. On a pharmaceutical site it is a decision for the safety lifecycle, never a way to save a cable run, and the security of the radio then joins the safety case, as our article on cybersecurity as part of functional safety explains.

The mesh is encrypted, the gateway is the conduit

Field-level security in both standards is better than many engineers expect. FieldComm Group states that WirelessHART security “is built in and cannot be disabled”: end-to-end 128-bit Advanced Encryption Standard (AES) encryption on every message, integrity checks at two layers, and a separate 128-bit join key that authenticates a new device to the network’s security manager. ISA100 devices likewise join with a key and receive their session keys from a security manager.

Two choices stay with the site. Join keys “can either be unique to each device, or be common to a given WirelessHART network based on the user security policies”, in FieldComm Group’s words. A common key is quicker on commissioning day, and it means that one leaked key admits any device afterwards. Second, no encryption stops a jammer. The 2.4 GHz band can be drowned, deliberately or by a badly placed access point, and the answer is a defined behaviour on loss of data, not more cryptography.

The exposure that matters is the gateway. It terminates the radio network and hands the data on, by Modbus, OPC Unified Architecture, HART-IP or a vendor protocol, to the control system, the historian and often an asset management server. It has a web interface, accounts, firmware and services.

IEC 62443-3-3:2013 gives the vocabulary. The wireless network and its gateway form a zone, the wired link to the control system is a conduit, and the standard gives wireless two system requirements (SR) of its own: SR 1.6, wireless access management, and SR 2.2, wireless use control. The method in zones and conduits: start from the risk applies unchanged: name the zone, write down the flows, allow only those.

On the sites we assess, the gateway is often the least managed box in the plant. The instrument supplier installed it, its administrator account was never renamed, and it is missing from the asset inventory because nobody thought of it as a computer. Put it in the inventory with its firmware version, give it named accounts, and keep its configuration under the same change control as a controller.

Coexistence is a site job, not a device feature

The 2.4 GHz band is shared with Wi-Fi, Bluetooth and every other licence-free radio. Channel hopping and blacklisting of busy channels help the instruments live with their neighbours; FieldComm Group lists channel hopping for “security protection and co-existence”. Neither tells anyone on site who owns the spectrum.

IEC 62657-2, the coexistence management standard (fourth edition, 2025), treats coexistence as a lifecycle task, from planning and installation to operation, maintenance and training. In practice that means one register per area: which wireless systems run there, on which channels, approved by whom. A warehouse that adds Wi-Fi for its scanners next to a wireless temperature network, with nobody checking both, runs the coexistence test in production.

What GMP asks of a value that travelled by radio

Annex 11 of the EU Good Manufacturing Practice (GMP) Guide, in its 2011 text, never mentions radios, and it does not need to. Clause 5 asks that systems exchanging data electronically include “appropriate built-in checks for the correct and secure entry and processing of data”. Clause 9 asks, based on a risk assessment, for an audit trail of GMP-relevant changes, and clause 12.1 restricts access to authorised persons. On a wireless network, that gives four things to specify and to test.

1. Time. Decide where the value is time-stamped: in the device, at the gateway or in the historian. A reading that waited in a buffer and was stamped on arrival is a different record from one stamped at measurement; metadata makes the number explains why that context decides what the value means.
2. Gaps. Define what the host does when a value is missing or stale: a distinct alarm, a visible gap in the record, and never a frozen last value presented as current.
3. Configuration. Update rates, ranges and join settings changed through the gateway leave who, when, old value and new value, and the gateway’s own log is part of the periodic review.
4. Batteries. The update rate drives battery life. A faster rate chosen at commissioning can bring the battery change far ahead of the plan, and a low-battery warning that reaches nobody ends as a data gap.

In the operational qualification (OQ), test the failures rather than the normal case. Switch a transmitter off, shield it, restart the gateway, put traffic on the band, and check the record and the alarm each time. The reasoning of degraded-mode tests in an OQ carries over directly: what the system does when a resource disappears is part of what it is qualified to do.

The radio itself is regulated in the EU

Radio equipment placed on the EU market carries cybersecurity essential requirements under the Radio Equipment Directive from 1 August 2025. Commission Delegated Regulation (EU) 2022/30 activates them, and Delegated Regulation (EU) 2023/2444 moved the date from 1 August 2024 to 1 August 2025. The network-protection requirement covers “any radio equipment that can communicate itself over the internet, whether it communicates directly or via any other equipment”.

Whether a transmitter behind a gateway falls inside that definition is the manufacturer’s assessment, so ask for it in writing, with the declaration of conformity and the standards applied. The harmonised standards EN 18031-1, -2 and -3:2024 were cited in the Official Journal by Commission Implementing Decision (EU) 2025/138, with restrictions on some clauses. The Cyber Resilience Act will add its own essential requirements for products with digital elements from 11 December 2027.

Where to start

1. List what is already on the air. Walk the site with the instrument and network teams and record every gateway: location, firmware, accounts and wired connections. It is done when every gateway has a named owner and a line in the asset inventory.
2. Sort the wireless points into the four groups. For each GxP point, write down where the time stamp is taken and which alarm a stale value raises, then test one of them.
3. Write the rules before the next project. Unique join keys, who may add a device, and a coexistence register per area, approved by engineering, IT and quality together.

Five common mistakes

1. Treating the gateway as an instrument accessory. It is a networked computer with accounts, services and firmware.
2. One join key for the whole site. Convenient on commissioning day, and a single secret that admits any device for years.
3. Showing the last value when the link is lost. On a storage monitor, a frozen 5 °C looks exactly like a cold store that works.
4. Leaving batteries out of the maintenance plan. The update rate chosen at commissioning decides the replacement interval, not the brochure.
5. Adding Wi-Fi without a coexistence check. Two well-designed networks on one band can still degrade each other.

The transmitter is the easy part. Decide which readings may depend on a radio, secure the box where the radio meets your network, and test what the record shows when a value does not arrive.

References

• Jack Smith, “ISA100 Wireless: Mature Technology Expands Its Application Portfolio”, Automation.com Monthly (ISA), August/September 2025, online 4 September 2025: automation.com
• IEC 62591:2016, Industrial networks – Wireless communication network and communication profiles – WirelessHART, edition 2.0: webstore.iec.ch
• IEC 62734:2014, Industrial networks – Wireless communication network and communication profiles – ISA 100.11a: webstore.iec.ch
• FieldComm Group, WirelessHART Security: fieldcommgroup.org
• IEC 62443-3-3:2013, System security requirements and security levels, SR 1.6 and SR 2.2: webstore.iec.ch
• IEC 61784-3:2021+AMD1:2024, Functional safety fieldbuses – General rules and profile definitions: webstore.iec.ch
• EudraLex Volume 4, Annex 11: Computerised Systems (2011): health.ec.europa.eu
• Guidelines of 5 November 2013 on Good Distribution Practice of medicinal products for human use (2013/C 343/01), sections 3.2.1 and 3.3: eur-lex.europa.eu)
• Commission Delegated Regulation (EU) 2022/30, as amended by Delegated Regulation (EU) 2023/2444: eur-lex.europa.eu