C ONVERGING S AFETY AND S ECURITY: IO-L INK W IRELESS AND OPC UA OVER 5G UNDER PR EN 50742 ∗ A P REPRINT
arXiv:2607.15840v1 [eess.SY] 17 Jul 2026
Henry Beuster Electrical Measurement Engineering Helmut-Schmidt-University Hamburg, Germany [email protected]
Thomas Doebbert Jungheinrich AG Norderstedt, Germany [email protected]
Gerd Scholl Electrical Measurement Engineering Helmut-Schmidt-University Hamburg, Germany [email protected]
A BSTRACT The integration of wireless communication technologies in industrial automation offers greater flexibility, but also exposes safety systems to a broader threat vector. Emerging regulations, such as the draft standard prEN 50742, mandate the convergence of functional safety and cybersecurity by requiring cryptographic security mechanisms directly in safety-critical communication. This paper presents an empirical evaluation of this safety-security convergence across a complete control chain, spanning from an IO-Link Wireless Safety device to a PLC via an OPC UA backbone. We measure the latencies and jitter of different Safety-Related Security Levels under prEN 50742 over Ethernet, Wi-Fi 6, and private 5G. Our results reveal that while cryptographic execution time is negligible, the resulting frame payload expansion severely restricts wireless fieldbus capacity, reducing the maximum number of devices per IO-Link Wireless track from 8 to 2. Furthermore, we demonstrate that, despite higher average latency, a private 5G provides sufficiently deterministic latency characteristics to preserve functional safety watchdog margins, unlike unlicensed Wi-Fi 6. Keywords Cybersecurity · Functional safety · Industrial wireless communication · IO-Link Wireless · OPC UA · 5G · prEN 50742
1
Introduction
The digital transformation of industrial automation is driving the integration of wireless networks across all levels, from field sensors to cloud systems. Architectures combining IO-Link Wireless (IOLW) at the field level, OPC Unified Architecture (OPC UA) as the interoperability backbone, and 5G networks as the transport medium enable highly flexible and scalable cyber-physical production systems. Traditionally, functional safety protocols rely on the black-channel principle, using non-cryptographic checks (e.g., CRC, sequence numbers) to detect transmission errors. However, emerging regulations such as the draft standard prEN 50742 [1] mandate the integration of cryptographic security mechanisms directly into the safety-critical data stream. Although these mechanisms enhance security, their timing and packet size overheads might violate safety watchdogs and reduce availability. The empirical impact of different Safety-Related Security Levels (SRSLs) under prEN 50742 ∗
This is the author’s version of a paper that has been accepted for presentation at the 31st IEEE International Conference on Emerging Technologies and Factory Automation (ETFA 2026), to be held in Västerås, Sweden, on September 08–11, 2026.
Converging Safety and Security
on timing behavior over wireless links remains unquantified. To address safety-security convergence, a testbed bridging IO-Link Wireless Safety (IOLWS) and OPC UA Safety is implemented to measure the timing and capacity behavior over Ethernet, Wi-Fi 6, and private 5G under different security configurations. The remainder of this paper is organized as follows: Section 2 reviews the state of the art, Section 3 presents the security-for-safety methodology, Section 4 details the testbed architecture, Section 5 discusses the empirical results, and Section 6 concludes the paper.
2
State of the Art
2.1
Regulations and Standards
The convergence of safety and security in industrial automation is driven by evolving European regulatory frameworks (Machinery Regulation (EU) 2023/1230 and the Cyber Resilience Act (EU) 2024/2847 (CRA)). The Machinery Regulation introduces explicit requirements that connectivity must not lead to hazardous situations, particularly where external or remote connections can influence machine behavior. The draft standard prEN 50742 provides the technical framework to implement these requirements by defining measures to prevent corruption of safety-related data and control functions. In parallel, the CRA establishes baseline cybersecurity requirements for products, including secure design, vulnerability management, and lifecycle support, without explicitly addressing the interaction between cyber threats and functional safety. This is the focus of prEN 50742, that can be interpreted as a safety-specific extension of general security requirements. From a standardization perspective, prEN 50742 complements and bridges established frameworks in both safety and security domains. Functional safety is traditionally governed by IEC 61508, which defines the lifecycle-based approach to hazard analysis and risk reduction for electronic systems. IEC 61784-3 specifies functional safety communication. In parallel, IEC 62443 provides a comprehensive framework for industrial security. prEN 50742 integrates these perspectives by focusing on the impact of data integrity and system connectivity on safety functions. 2.2
Wireless Automation
Deploying safety-critical applications over wireless media requires stringent determinism and reliability [2]. At the field level, IOLW (IEC 61139-3 [3]) achieves cable-grade reliability via adaptive frequency hopping and time-division scheduling in the 2.4 GHz band [4]. While IO-Link Safety (IEC 61139-2) defines safety over wired links, the wireless extension is not yet standardized. We previously proposed a black-channel protocol architecture for IOLWS [5] and demonstrated its feasibility with a roaming emergency-stop prototype [6]. For backbone communication, OPC UA provides transport-layer independence, making it well suited for Wi-Fi 6 and private 5G. The comparative performance and co-existence of these two wireless technologies have been evaluated in various industrial IIoT settings, highlighting the trade-offs between Wi-Fi 6’s low average latency under light traffic and private 5G’s bounded latency distributions and scalability under load [7, 8]. The OPC UA Safety extension defines a black-channel approach up to SIL 3 [9], which can be enhanced via PubSub and Time-Sensitive Networking [10]. Previously, we determined the baseline latency by measuring the Safety Function Response Time (SFRT) of non-secured safety communication over private 5G and IOLW without OPC UA [11]. Integrating cryptographic security directly into safety protocols is now mandated by prEN 50742. Wieczorek and Schiller [12] analytically showed that cryptography alters traditional safety fault models and recommended blackchannel integration. However, the empirical timing and capacity overhead of different SRSLs over heterogeneous wireless networks remains unquantified, which this work addresses.
3
Security-for-Safety Methodology
3.1
Safety-Related Security Levels
prEN 50742 introduces SRSLs as a central concept for addressing cybersecurity threats to functional safety. They provide a graded classification of protection requirements that define the extent to which safety-related functions must be protected against corruption. The primary objective is to ensure that the integrity of safety-related functions is maintained even in the presence of cybersecurity threats. Unlike conventional IT security levels, SRSLs are derived from a safety perspective, based 2
Converging Safety and Security
SRSL Plain SRSL 0 SRSL 1
Table 1: SRSL Configuration Mapping IOLW OPC UA No Safety, No Cryptography No Safety, No Cryptography Safety, No Cryptography Safety, No Cryptography Safety + 4-byte MAC Safety + HMAC-SHA256
SRSL 2
Safety + 4-byte MAC
Safety + Aes128Sha256RsaOaep
SRSL 3
Safety + AES-CCM (128 bit) + 4-byte MAC
Safety + Aes128Sha256RsaOaep
Security Target Baseline Reference Safety baseline Data origin authenticity and integrity Backbone confidentiality and integrity Full encryption security
Figure 1: Converged safety-security system architecture and communication chain. on the potential consequences of corruption rather than purely on confidentiality, integrity, and availability goals. At the lowest level, SRSL 0, no specific security measures are required from a safety perspective, due to isolation or lack of safety impact. Safety is ensured through inherent system design and isolation. SRSL 1 introduces basic protection against unintentional, accidental or low-effort interference. Measures focus on fundamental integrity checks and controlled access, ensuring that common operational errors do not compromise safety. At SRSL 2, protection addresses intentional manipulation by moderately capable attackers in connected environments. This requires stronger safeguards, including authenticated access, integrity protection for communication and data, and traceability of relevant changes. SRSL 3 represents high protection against sophisticated attackers in highly interconnected systems. It requires a defense-in-depth approach, including strong cryptographic mechanisms, strict access controls, and comprehensive monitoring and traceability. An extended level, SRSL 4, may be considered for systems with very high exposure and critical safety impact, requiring the highest degree of assurance and resilience against highly capable adversaries. Overall, SRSLs follow an impact-driven, safety-oriented approach, ensuring that the integrity of safety functions is maintained under accidental and malicious corruption scenarios. 3.2
SRSL Configuration Mapping
To evaluate the timing impact, the conceptual safety-related security levels are mapped to concrete configurations at the field and backbone levels, as detailed in Table 1. At the field level (IOLW) under Plain and SRSL 0, no cryptography is used. For SRSL 1 and SRSL 2, authenticity and integrity are protected by appending a 4 B truncated MAC (generated via mbedtls_poly1305) [5]. For SRSL 3, the payload is encrypted and authenticated using AES-CCM with a 128-bit key to prevent physical-layer eavesdropping. The backbone between the Edge Gateway and the programmable logic controller (PLC) uses standard OPC UA security policies. Plain and SRSL 0 use None security mode. SRSL 1 uses the Sign mode with the Aes128Sha256RsaOaep policy, calculating an HMAC-SHA256 signature. SRSL 2 and SRSL 3 use the SignAndEncrypt mode with the same policy, applying symmetric AES-128-CBC encryption and asymmetric RSA-OAEP for key exchange.
4
Testbed Architecture
4.1
System Overview
To evaluate the timing behavior, we implemented a demonstrator replicating a complete industrial control chain, from a field-level sensor node to a PLC in a backend environment, as depicted in Fig. 1. At the field level, a sensor/actuator node periodically samples process values at an application cycle time of 50 ms. This is implemented on a TI CC2650 wireless MCU acting as an industrial IOLWS device, transmitting via IOLW in the 2.4 GHz band to the Edge Gateway. The Edge Gateway serves a dual function: it acts as the Wireless-Master (W-Master) and hosts an OPC UA Server exposing the safety variables. It is implemented on a TI TMDSAM64GPEVM evaluation board running a Linux kernel. 3
Converging Safety and Security
Three communication channels are implemented between the Edge Gateway and the PLC (OPC UA Client): (1) Wired Gigabit Ethernet (1000BASE-T) as a low-latency, low-jitter baseline; (2) Unlicensed Wi-Fi 6 (IEEE 802.11ax) in the 5 GHz band via an enterprise-grade access point; and (3) a Licensed Private 5G Network operating in standalone SA mode (Band n78, 100 MHz bandwidth from 3.7 to 3.8 GHz) with a subcarrier spacing of 30 kHz. The network was configured with a TDD frame pattern of 7:2 (DDDDDDDSUU) and ran on a eMBB network slice, utilizing an industrial 5G gateway. 4.2
Field Level: IO-Link Wireless
Field-level transmission uses IOLW with a 5 ms cycle time, divided into three 1.66 ms subcycles. To support safety, we use the IOLWS protocol architecture [5], treating the link as a black-channel. Safety data is encapsulated in a Wireless Safety Protocol Data Unit (W-SPDU) with a safety header (to detect packet loss, replication, or insertion) and a CRC-32. Cryptographic mechanisms (MAC/encryption) are layered based on the SRSL configuration (Table 1) using pre-shared keys to avoid handshake delays. 4.3
Network Level: OPC UA
The Edge Gateway maps the incoming IOLWS frames directly to the OPC UA information model and encapsulates them into an OPC UA Safety SPDU for backbone transmission. The OPC UA safety communication runs between the gateway and the PLC. Backbone transport security is enforced via standard OPC UA Secure Channel policies according to the active SRSL configuration (Table 1).
5
Experimental Evaluation
5.1
Measurement Setup
To validate the performance of the SRSL configurations specified in prEN 50742, we constructed a measurement setup designed to isolate network transport latencies from cryptographic processing delays. The nodes are instrumented using hardware GPIO pins connected to a high-resolution digital oscilloscope to capture microsecond-level timings. We measure latencies along the communication chain, specifically at the over-the-air field level and the backbone network, and analyze statistical parameters over 10,000 communication cycles per scenario, with parallel network captures (Wireshark) monitoring packet overhead. The trials were conducted without RF isolation from the environment. Instead, measurements were performed in a typical office setting with active concurrent Wi-Fi networks, exposing the links to co-channel interference and background traffic, representing a realistic, non-shielded radio channel with the most pronounced impact expected on the unlicensed 5 GHz Wi-Fi 6 backbone. 5.2
Latency and Jitter Results
To evaluate the impact of functional safety and cryptographic security layers on the timing behavior of the industrial communication chain, the measurements reflect the three physical media and five security configurations. Table 2 and Table 3 provide a comprehensive overview of the latency and standard deviation (jitter) profiles at the field and backbone levels. Table 2: Field-Level (IOLW) Protocol Overhead and Latency SRSL Plain SRSL 0 SRSL 1 SRSL 2 SRSL 3
5.2.1
Overhead down-/uplink [B] 1/2 7/8 11/12 11/12 11/12
Latency ± σ [ms] 1.50 ± 0.51 1.50 ± 0.51 1.86 ± 0.53 1.86 ± 0.53 1.86 ± 0.53
Max Latency [ms] 2.70 2.70 2.90 2.90 2.90
Field-Level Performance
The baseline latency of IOLW is 1.50 ± 0.51 ms for Plain and SRSL 0. Introducing software cryptography at SRSL 1–3 increases the average latency by a delta of 0.36 ms to 1.86 ± 0.53 ms. Crucially, the standard deviation remains constant, confirming that software cryptography execution does not significantly degrade channel determinism. 4
Converging Safety and Security
Table 3: Backbone (OPC UA) Protocol Overhead and Latency SRSL Plain SRSL 0 SRSL 1 SRSL 2 SRSL 3 Plain SRSL 0 SRSL 1 SRSL 2 SRSL 3 Plain SRSL 0 SRSL 1 SRSL 2 SRSL 3
Overhead [B] Latency ± σ [ms] Max Latency [ms] Local Wired Ethernet 132 1.78 ± 0.51 6.47 128 4.29 ± 1.43 8.27 148 4.24 ± 1.46 8.68 155 4.12 ± 1.53 8.95 155 4.12 ± 1.61 9.80 Wi-Fi 6 Unlicensed Wireless 132 3.23 ± 3.51 76.76 128 5.47 ± 3.23 85.85 148 5.09 ± 3.06 89.54 155 5.53 ± 3.21 72.86 155 5.45 ± 3.23 76.81 Private 5G 132 15.36 ± 3.85 29.53 128 27.02 ± 4.57 52.37 148 27.66 ± 4.76 52.15 155 30.73 ± 5.02 61.39 155 30.88 ± 5.05 59.44
However, the packet size expansion (from 1 B overhead in Plain to 7 B in SRSL 0 and 11 B in SRSL 1–3) introduces a severe trade-off regarding the capacity of the wireless fieldbus operating at a 5 ms cycle. In the non-safety configuration, up to 8 devices with 2 B payload in the uplink can be scheduled per track. When transitioning to SRSL 0, the safety header and CRC require double-slot devices with up to 15 B payload in the uplink, reducing the number of devices per track to 4. At SRSL 1–3, the introduction of the 4 B MAC reduces the capacity to schedule only to 2 devices per track under this configuration, because of IOLW’s maximum downlink payload of 37 B shared by all devices. Security regulations directly limit sensor density in this case. 5.2.2
Backbone Latency
The timing behavior over the backbone shows distinct patterns: First, the transition from Plain to SRSL 0 introduces a substantial latency penalty: +2.51 ms on Ethernet (1.78 to 4.29 ms), +2.24 ms on Wi-Fi 6 (3.23 to 5.47 ms), and +11.66 ms on 5G (15.36 to 27.02 ms). This additional latency is not caused by network delays but is instead a direct consequence of the safety-layer protocol, which requires two-way transactions (request/response) to verify the channel status. This mechanism doubles the transmission delay per cycle, making the safety function sensitive to the physical layer’s one-way delay. At the same time, it slightly reduces the protocol overhead from 132 B to 128 B due to the changed communication pattern. Second, the addition of backbone transport security has a minimal impact. Comparing SRSL 0 to SRSL 3, the latency remains almost identical on Ethernet and Wi-Fi 6, and only increases by +3.86 ms on the 5G network, which is well within the 5G jitter profile. This negligible timing impact is observed despite the backbone packet overhead increasing from 128 B in SRSL 0 to 155 B in SRSL 3 (Table 3). Finally, comparing Wi-Fi 6 and the private 5G network highlights a clear trade-off. Wi-Fi 6 achieves lower average latency (5.45 ms at SRSL 3) but suffers from outliers exceeding 50 ms. In contrast, the private 5G network exhibits higher average latency (30.88 ms) but provides a predictable, bounded latency distribution without high-latency spikes (maximum latency of 59.44 ms). For safety communication, 5G’s bounded worst-case latency allows engineers to configure a tighter and more reliable watchdog time, preventing spurious shutdowns.
6
Conclusion
This paper presented an empirical evaluation of safety-security convergence in wireless automation networks, measuring the impact of different SRSLs applying prEN 50742. The experimental results show that the main impact of cryptographic security is not the computational processing delay, which is negligible, but rather the expansion of the frame payload size. For fieldbus protocols such as IOLW, this payload inflation directly restricts device capacity per track, reducing the maximum supportable devices from 8 to 4, and ultimately to 2 devices for the short 5 ms cycle time. Furthermore, a private 5G network might be preferable to Wi-Fi 6 for safety functions because, despite Wi-Fi 6’s lower average latency, 5G provides the physical-layer determinism and 5
Converging Safety and Security
bounded worst-case latency necessary to prevent safety watchdog violations and avoid unnecessary system shutdowns in noisy industrial environments. Future work will focus on testing the timing resilience of this converged architecture under high network loads, background traffic and multiple devices. Additionally, we plan to evaluate different OPC UA security configurations and the latency behavior of OPC UA PubSub implementations over wireless links, as well as to analyze different 5G network slice configurations.
Acknowledgment The authors would like to thank Telekom Deutschland GmbH and Ericsson GmbH for their continuous support and valuable cooperation throughout this work.
Funding This research paper out of the project “Digital Sensor-2-Cloud Campus Platform” (DS2CCP, https://dtecbw.de/home/forschung/hsu/projekt-ds2ccp)) is funded by dtec.bw – Digitalization and Technology Research Center of the Bundeswehr. dtec.bw is funded by the European Union – NextGenerationEU.
References [1] Safety of machinery – protection against corruption. Standard prEN 50742:2025, CENELEC, 2025. [2] Martin Wollschlaeger, Thilo Sauter, and Juergen Jasperneite. The future of industrial communication: Automation networks in the era of the internet of things and industry 4.0. IEEE Industrial Electronics Magazine, 11(1):17–27, 2017. [3] Industrial networks – Single-drop digital communication interface – Part 3: Wireless extensions. Standard 61139–3:2023, IEC, 2023. [4] Thomas Robert Doebbert, Christoph Cammin, Gerd Scholl, and Bernd Kärcher. Study of a safe and secure ecosystem based on io-link wireless and a 5g campus network. In 2021 26th IEEE International Conference on Emerging Technologies and Factory Automation (ETFA ), pages 01–04, 2021. [5] Thomas Robert Doebbert. Contribution to IO-Link Wireless SafetyArchitecture and System Extensions. PhD thesis, Elect.Meas.Eng., Helmut-Schmidt-Univ., Hamburg, Germany, 2024. [6] Henry Beuster, Thomas Doebbert, Christoph Cammin, Dmytro Krush, and Gerd Scholl. Design and Development of a Roaming Wireless Safety Emergency Stop. In Safety of Industrial Automated Systems – SIAS 2024 Proc., page Paper 32. Suomen Automaatioseura ry (SAS) - Finnish Society of Automation (FSA), 2024. [7] Roberto Maldonado, Anders Karstensen, Guillermo Pocovi, Ali A. Esswie, Claudio Rosa, Olli Alanen, Mika Kasslin, and Troels Kolding. Comparing wi-fi 6 and 5g downlink performance for industrial iot. IEEE Access, 9:86928–86937, 2021. [8] David Segura, Sebastian Bro Damsgaard, Akif Kabaci, Preben Mogensen, Emil J. Khatib, and Raquel Barco. An empirical study of 5g, wi-fi 6, and multi-connectivity scalability in an indoor industrial scenario. IEEE Access, 12:74406–74416, 2024. [9] Opc unified architecture - part 15: Safety. Standard 62541-15:2025, IEC, 2025. [10] Julius Pfrommer, Andreas Ebner, Siddharth Ravikumar, and Bhagath Karunakaran. Open source opc ua pubsub over tsn for realtime industrial communication. In 2018 IEEE 23rd International Conference on Emerging Technologies and Factory Automation (ETFA), volume 1, pages 1087–1090, 2018. [11] Henry Beuster, Kevin Tebbe, Thomas Robert Doebbert, and Gerd Scholl. Measurements of the safety function response time on a private 5g and io-link wireless testbed. In 2024 IEEE 29th International Conference on Emerging Technologies and Factory Automation (ETFA), pages 1–4, 2024. [12] Felix Wieczorek and Frank Schiller. Safety-Analyse für Security-geschützte Kommunikation. atp magazin, 62:86, 04 2020.
6