Manufacturing Wi-Fi: Designing Wireless Networks for Building-to-Building Roaming

A forklift rolls from the bonded warehouse into the finished-goods building. Eight pallets, two RFID-tagged scanners, a WMS session that's been alive since the start of shift. Somewhere between the loading bay and the new dock door, the radio loses the AP it had a lock on, scans for a new one, finds three at marginal signal, re-authenticates, re-acquires the WMS session — and in the half-second that whole sequence took, the driver's scanner buffered two reads that didn't make it back to the server.

One forklift, two reads, one shift. Multiply that across a few hundred handhelds, a fleet of AGVs and the voice handsets your supervisors carry, and "seamless roaming" stops being a feature on a vendor datasheet and starts being the difference between a clean inventory count and an audit headache. This piece is about how the wireless networks inside real Singapore factories — Jurong, Tuas, Tampines, Woodlands — are designed so that handoff doesn't show up on the production line as a problem.

Why manufacturing Wi-Fi is its own discipline

Office Wi-Fi optimises for people sitting still. Manufacturing Wi-Fi optimises for everything moving — handhelds, AGVs, AMRs, technicians with tablets, supervisors on voice handsets, the small army of IoT sensors clipped to every fifth machine on the production floor.

The gap to the office network is bigger than people expect:

• Buildings are taller and emptier. Factory floors with 8-15m ceilings and high-bay racking behave nothing like a 2.7m drop-ceiling office. Sound and RF bounce off concrete and metal in ways that defeat office AP placement heuristics.
• Clients move at speed. A forklift at 15 km/h crosses an AP coverage cell in seconds. A misconfigured roam at that speed means a dropped barcode scan, a paused AGV, a stalled production line.
• Heavy machinery generates RF noise. Welders, induction heaters, microwave equipment and large motors all leak into the 2.4 GHz band. Coverage that looked clean in a Friday-afternoon walkthrough vanishes when Monday's first shift starts.
• Client devices are mixed. Modern smartphones speak Wi-Fi 6/7 with full 802.11kvr. A legacy Zebra scanner still in service speaks 802.11n with proprietary roaming quirks. The design has to serve both.
• OT systems can be safety-critical. An AGV that loses Wi-Fi and stops mid-aisle is a production hit; one that loses control of a robotic arm mid-cycle is potentially a safety event. The reliability bar is higher than for human users.

For these reasons, manufacturing Wi-Fi is closer in spirit to large-venue and warehouse Wi-Fi than to enterprise office Wi-Fi. The design discipline reflects that.

How seamless roaming actually works

Roaming is the process of a client device handing off from one access point to another without losing its IP session. In a well-designed network, the user sees nothing — their VoIP call doesn't blip, their MES tablet doesn't lose its TCP session, their warehouse scanner doesn't dump its queued reads. In a badly designed network, every cell boundary is a hiccup.

Modern roaming relies on three IEEE amendments, usually deployed together as the "kvr" set:

Before 802.11r became universal, vendors used OKC (Opportunistic Key Caching) and PMK caching to accomplish much of the same thing. Both are still supported as fallbacks for clients that don't speak 802.11r. A practical campus typically enables 11r as primary, with OKC enabled for legacy clients — most controllers do this transparently.

A few things to keep in mind once it's running:

• The decision to roam is client-side, not AP-side. The AP can suggest with 11v, but the client device chooses when to actually move. A "sticky" client with poor roaming logic will hold on to a weak signal long past where it should have moved.
• Same SSID, same security, same VLAN (or seamless L3 mobility) across all APs. If the client has to re-DHCP when it moves between buildings, the session breaks.
• Coverage overlap matters. Cells need to overlap by roughly 15-20% at the design RSSI threshold (commonly -67 dBm for voice/AGV, -65 dBm for high-throughput). Below 15% overlap, roams happen too late.

The RF environment in a factory

The biggest design errors come from treating a manufacturing building like a large open office. Some realities you have to design around:

• Metal racking and pallets reflect and absorb RF unpredictably. A racked warehouse changes propagation as pallets are filled, moved or emptied — the survey done on an empty floor is not the steady state.
• High ceilings cause the "umbrella effect." An AP mounted at 12m on standard omni antennas sprays signal far horizontally but weak vertically; clients at floor level see only the edge of the beam. The fix is purpose-built directional / sector / patch antennas aimed downward.
• Concrete and tilt-up panel walls between buildings will not pass usable signal. Don't plan for "spill-over" between buildings — design each building with its own AP coverage and rely on the wired backbone (or licensed/unlicensed P2P wireless) to interconnect.
• 2.4 GHz is largely unusable for performance. Only three non-overlapping channels, and shared with Bluetooth, ZigBee, microwave ovens, cordless phones, and the EMI leakage of heavy industrial equipment. Use it only for legacy scanners that can't speak 5 GHz, and design it as a thin coverage layer, not a capacity layer.
• 5 GHz is the workhorse. 19+ non-overlapping 20 MHz channels (depending on regulatory domain) — but DFS channels can be lost temporarily to radar events near coastal sites. In Singapore (and APAC generally), watch DFS carefully if your factory is near LTA radar or maritime/aviation systems.
• 6 GHz (Wi-Fi 6E / 7) gives you another ~1200 MHz of clean spectrum — but only newer client devices can use it, and Singapore allows it indoors under IMDA's Low Power Indoor (LPI) rules. Outdoor 6 GHz is restricted.

Campus design — one network, many buildings

The architectural choice that defines a multi-building factory Wi-Fi network is whether all buildings share one logical wireless network or are operated as separate networks that simply happen to use the same SSID name.

For seamless roaming, you want the former. That typically means:

1. One Wi-Fi controller or one cloud-managed organisation covering all buildings. Each building has its own APs, but they're all peers in the same logical network.
2. Shared SSIDs with the same security parameters (same WPA3/WPA2-Enterprise config, same RADIUS realm) across every AP.
3. Mobility between buildings handled either by L2 VLAN extension (simpler, but doesn't scale beyond a few buildings) or by L3 mobility tunnels (controller-anchored, so the client keeps its IP when crossing controllers/zones). Mist, Cisco and Aruba all support L3 mobility natively; Meraki uses its cloud-anchored design implicitly.
4. RADIUS / IdP centralised — typically NPS (Microsoft), Aruba ClearPass, Cisco ISE, FreeRADIUS, or a cloud identity service like Mist Edge or Azure AD. One auth backend so a user roams the same identity, not a separate per-building account.
5. RRM (Radio Resource Management) running campus-wide — so channel and power assignments take into account every AP on the campus, not just each building in isolation.

Two different control planes will show up in proposals; both work, and which one the integrator pitches usually says more about their bench than about your factory:

• Cloud-managed (controller-less in the building): Meraki, Mist, Aruba Central, Extreme Cloud, Ruckus Cloud, UniFi. APs phone home to the cloud for config and analytics; data traffic stays local. Operationally simpler, but requires a robust internet link out of each building (or local-survival features that keep APs functional during WAN outage).
• Controller-based: Cisco Catalyst 9800 series, Aruba Mobility Controllers, traditional Ruckus SmartZone. Controllers live in your data centre; APs tunnel to them. More moving parts and dedicated boxes, but for security-sensitive or air-gapped manufacturing environments, often still preferred.

Inter-building backhaul — how the buildings are stitched together

Wi-Fi only solves the last 30m. The buildings still need to be physically connected by a wired (or licensed wireless) backbone for any of the controller, mobility or roaming behaviour to work. Common patterns:

The general rule: fiber if you can, P2P wireless if you must, mesh only as a last resort. AGVs, safety systems and voice need predictable latency — wireless backhaul introduces hops and jitter that compound at every cell boundary.

Wi-Fi 5 vs 6 vs 6E vs 7 — what to actually deploy

Manufacturing campuses are usually multi-vintage. Some APs you install today will still be in service in 2032. The right call as of 2026:

• Wi-Fi 5 (802.11ac): Don't install new. Only acceptable as a retain-in-place for existing healthy deployments.
• Wi-Fi 6 (802.11ax): Solid default for new staff/general-purpose deployments. OFDMA, target wake time and BSS coloring genuinely help in dense factory environments. Hardware widely available, costs have stabilised.
• Wi-Fi 6E: Recommended for any new deployment where you can. 6 GHz access in Singapore is open under IMDA's LPI rules (indoor only). The extra 6 GHz spectrum is clean — no legacy 2.4/5 GHz contention. Client device support is now broad on flagship phones, modern laptops and newer industrial scanners.
• Wi-Fi 7 (802.11be): Worth specifying for any greenfield deployment in 2026. Multi-Link Operation (MLO) lets a client use 5 GHz and 6 GHz simultaneously for resilience and throughput. 4K-QAM modulation, 320 MHz channels. Most enterprise vendors now ship Wi-Fi 7 APs; budget for them.

The pragmatic 2026 spec for new manufacturing rollouts: Wi-Fi 6E (minimum) or Wi-Fi 7 (preferred), dual or tri-radio, multi-gig (2.5/5/10G) uplink, 802.3bt PoE++ (60-90W) for power. Specify all of these on the wired side too — multi-gig switches and bt-class power are no longer optional for Wi-Fi 6E/7.

Enterprise Wi-Fi vendors that win in factories

The enterprise WLAN market in APAC manufacturing is concentrated. Six brands account for the overwhelming majority of new factory deployments; a couple of others show up in price-sensitive or specific-niche cases.

In Singapore's market specifically, the dominant brands across new factory Wi-Fi tenders over the last few years have been Cisco (Meraki and Catalyst), Aruba, Juniper Mist, and Ruckus — usually narrowed down to two of those four in any given RFP. Fortinet and UniFi appear in SMB and price-driven deployments. The remainder appear in specific niches.

Industrial wireless — for the OT side

Staff laptops, scanners and tablets are happy on enterprise Wi-Fi. The OT side — AGVs, AMRs, mobile robots, PLCs on moving rigs, overhead cranes — often needs something more deterministic. The dominant industrial wireless brands:

There's a real architectural fork in the road here: one wireless network for everything, or two?

• One network, segmented: Same APs, different SSIDs and VLANs for staff vs OT. Lower capex; demands a vendor whose roaming and QoS reliably serve OT clients. Works for most factories.
• Two networks, separate: Enterprise WLAN for staff, dedicated industrial wireless (Cisco IW, Siemens SCALANCE, MOXA) for AGVs and PLCs. Higher capex, but the OT network is fully insulated from staff-side traffic spikes, software updates, and IT-driven changes. Common in automotive, semiconductor and pharma plants where OT downtime is unacceptable.

The client devices you're designing for

The user is rarely just "a person with a laptop." A typical manufacturing campus has:

• Handheld scanners and mobile computers — Zebra (TC-series, MC-series), Honeywell (CK / CT-series), Datalogic, Bluebird. Battery life and roaming behaviour are firmware-driven; specify firmware versions in the design.
• Voice-over-Wi-Fi (VoWiFi) handsets — Spectralink, Ascom, Polycom. The most demanding clients for roaming latency. If voice roams cleanly, everything else will.
• AGVs / AMRs — MiR, Geek+, Quicktron, Locus, Omron, Fetch. Each platform has its own preferred Wi-Fi behaviour; involve the integrator early.
• Operator tablets and ruggedized laptops — Panasonic Toughbook, Dell Latitude Rugged, Getac, Zebra ET-series. Generally well-behaved with modern roaming standards.
• Wearables — RealWear, Vuzix, smart glasses, ring scanners. Lightweight clients with limited radio capability; coverage and signal strength matter more than throughput.
• IoT sensors — environmental, vibration, energy, access control. Often single-band 2.4 GHz; design a thin coverage layer for them and don't let them consume capacity-tier APs.
• Video surveillance and IP cameras — usually wired, but PTZ and outdoor cameras occasionally on Wi-Fi. Consume capacity; segregate onto their own VLAN.

Before committing to a design, audit the actual client population: brand, model, OS, radio capability (Wi-Fi 5 / 6 / 6E / 7), supported security (WPA2 / WPA3), and supported roaming protocols (11k / v / r). The lowest-common-denominator client constrains the design.

Site surveys done right

The single highest-leverage thing a manufacturing customer can spend on at the start of a project is a competent site survey. The phases:

1. Predictive (desktop) survey. The integrator imports floor plans and rack layouts into Ekahau, iBwave or Hamina, models materials and obstacles, and proposes AP placement. Gets the design 80% right and the BoQ accurate.
2. AP-on-a-stick (validation) survey. A temporary AP is mounted on a tripod or pole at proposed locations; live RSSI and SNR readings are taken on the actual floor with the actual obstructions. Adjusts placement before any AP is permanently mounted.
3. Post-installation survey. After APs are mounted and cabled, a passive and active survey verifies coverage, channel plan, roaming behaviour and throughput against design targets. Produces a heatmap and an acceptance report.
4. Re-survey after any major change — adding racking, changing tenants, installing new heavy machinery, swapping a section of roof for solar panels. Manufacturing floors change; the survey is a living document.

See Enterprise Wireless Site Surveys for the deliverables a good survey should produce.

Security and segmentation

Manufacturing networks attract attention. Ransomware actors target OT downtime; nation-state actors target IP. Design from day one with segmentation in mind:

• Multiple SSIDs, mapped to VLANs. Staff (corporate), guests (internet-only), OT (locked-down, only to specific services), IoT (no inter-VLAN routing), voice (QoS-prioritised). Each on its own subnet, each gated by firewall policy.
• WPA3-Enterprise where supported, WPA2-Enterprise as fallback. 802.1X with EAP-TLS (certificate-based) for staff and laptops. Pre-shared key (PSK) only for legacy IoT and only on a heavily segmented VLAN.
• NAC (Network Access Control) — Cisco ISE, Aruba ClearPass, Forescout, or the cloud-IDP equivalent — enforces who and what gets on which VLAN based on device posture and identity.
• OT-IT segmentation isn't optional. AGV controllers and PLCs should never see corporate user devices. Modern reference architectures (Purdue model, IEC 62443) treat this as a hard requirement.
• Wireless Intrusion Prevention (WIPS). All enterprise WLAN vendors include some form of WIPS; turn it on. Detects rogue APs, evil twin attacks, deauth floods.
• Patch the APs. Cloud-managed vendors update silently; controller-based vendors require deliberate maintenance windows. Don't let APs sit on years-old firmware.

Common pitfalls

• Designing for empty buildings. Survey when the warehouse is empty, deploy, then watch coverage collapse when pallets arrive. Always design against a "fully racked, fully populated" worst case.
• Treating 2.4 GHz as a capacity band. It's not. Use it only as a thin coverage layer for legacy clients that can't speak 5 GHz; disable it on most APs once those clients are retired.
• Ignoring client roaming logic. The infrastructure can be flawless and a fleet of legacy scanners with poor roaming firmware will still produce dropped sessions. Test with real client devices, not just the engineer's laptop.
• Skipping the AP-on-a-stick survey. Predictive surveys are wrong in factory environments more often than in offices. The validation pass catches it before you mount and cable 200 APs.
• Same SSID, different security or VLAN by accident. Roaming silently degrades to full re-auth between buildings. Audit the SSID/security configuration across every controller and group.
• Power-budget shortfalls. Wi-Fi 6E and 7 APs with multi-gig uplinks need 802.3bt PoE++ (60-90W). Specify the switches before discovering the existing 802.3af switches can't even bring the APs up.
• Mixing the staff and OT networks. The first wireless DoS against your corporate guest SSID will take down the AGVs too. Segment before deployment, not after the first incident.
• No second backhaul path. A single fiber run between two buildings, severed by a contractor's excavator, will silently strand a building's worth of APs. Plan for diverse paths or a wireless failover.
• Buying APs without a refresh budget. Wi-Fi 6E APs deployed today will need replacing for Wi-Fi 8 within 8-10 years. Treat APs as a 5-7 year capital cycle, not a once-and-done install.

Where to go next

• Wireless choices in context: The Modern Wireless Stack — Wi-Fi 6/7, 5G, LoRa, and when each is the right tool.
• The survey deliverables: Enterprise Wireless Site Surveys — what a good RF design package looks like.
• IoT layer on the same network: IoT for Business — architecture, protocols and what's actually deployed in Singapore.
• Pre-wireless plumbing: Structured cabling vendors in our directory — the fiber and Cat6A that the wireless campus depends on.
• Finding implementation partners: Choosing a System Integrator — what to look for when scoping a multi-building Wi-Fi project.

Spectrum rules drift. 6 GHz indoor power limits, DFS sub-band availability, outdoor allocations — all of these have moved in Singapore in the past few years, and the design that was code-compliant when it was signed off in 2024 may not be the one that gets approved in 2027. Treat IMDA's spectrum allocations as the live source on anything touching 6 GHz or outdoor power.

Find Singapore Wi-Fi vendors and integrators

Looking for a system integrator or wireless specialist to design and deploy a multi-building Wi-Fi network?

Browse System Integrators →