Can I connect my phone directly to a PLC?

Over Wi-Fi, yes — via a small AP bridged into the machine switch, since PLCs themselves don't speak Wi-Fi. Once the phone is on the machine subnet, the free LK Go app reads EtherNet/IP (automatic Logix tag lists), Siemens S7 and Modbus TCP directly. Wired works too: a USB-C-to-Ethernet adapter into a spare switch port needs no drivers on modern iPhones and iPads.

Is Wi-Fi on a machine network safe?

Done the boring way, yes: a machine-local SSID with WPA2/WPA3 and a strong password, serving only the machine subnet, bridged to nothing else. The incidents come from shortcuts — bridging to guest Wi-Fi, default passwords, or port-forwarding a PLC to the internet. Never do those; for remote access, the answer is a VPN set up with IT.

Can I control the machine over Wi-Fi?

Operator actions — setpoints, start/stop with guarded writes — are reasonable over Wi-Fi. Control traffic is not: cyclic I/O, safety and motion stay on copper, because a dropped wireless packet must never be able to matter. Treat the wireless screen as a window with buttons, not as the control system.

Which router should I use as the bridge?

Any travel-router-class device that does AP/client modes with WPA2+ works — the GL.iNet Opal in the gear list is the cheap default; industrial APs (Scalance, Stratix, Moxa) buy DIN mounting and temperature range, not different functionality. Configure it as a local AP for the machine subnet only, and label it.

Connect to a PLC via Wi-Fi: bridges, phones and the safe way to do it

Connect to a PLC over Wi-Fi: the safe, boring way

How-to guide

PLCs don't speak Wi-Fi, and that's fine — a small access point in client or AP mode, plugged into a spare port on the machine switch, gives your phone or tablet the machine network in ten minutes. The hardware is trivial; what matters is doing it without creating next year's security incident. Here's the boring, safe version.

The ten-minute setup

Hardware: a travel-router-class device in AP mode (the GL.iNet Opal in the gear list below is the usual suspect) or an industrial AP if the budget allows. Plug its LAN side into a spare port on the machine's switch.
SSID: machine-local, WPA2/WPA3, a real password — not the machine name, not 12345678.
Addresses: give the AP a static IP in the machine subnet and let the phone get one via the AP's DHCP inside that subnet — or set it manually. Now the phone sees the PLC like any other node.
Label it. The next engineer should find "MACHINE-7 Wi-Fi, local only, no internet" on the AP, not a mystery antenna in the cabinet.

The security lines you don't cross

Never bridge the machine network to plant/guest Wi-Fi or the office LAN "just for convenience" — that's how a phone-charging visitor ends up on the same subnet as your PLC. The AP serves its own local SSID and routes nowhere.
Never port-forward a PLC to the internet. Internet-exposed PLCs are enumerated by search engines within days. Remote access is a VPN set up with IT — that's the whole answer, there is no safe shortcut.
Wi-Fi is for eyes and setpoints, not control loops. Cyclic I/O and motion stay on copper; a roaming phone that drops for two seconds must never matter to the machine.

What you can do once you're on

With the phone on the machine subnet, the free LineKeeper Go reads the PLC directly: EtherNet/IP Logix controllers hand over their whole tag list automatically (no Studio 5000 needed), Siemens S7 and Modbus TCP devices connect with the addresses you care about. That covers commissioning walks (watch the sensor while standing at the sensor), isolation tests ("can anything see the PLC?"), and the temporary-operator-screen role when a panel dies. Writes are a one-time unlock with range checks and confirmation on every value.

Tag browser in LK Go: every tag of a ControlLogix or CompactLogix controller with live values and search, read straight from the PLC — The Logix controller hands over its whole tag list — live, searchable

Temporary operator panel in LK Go reading PLC tags over the machine's Wi-Fi bridge: start and stop push buttons, hold-to-run jog, speed setpoint and status lamps — The temporary panel: start/stop, jog, setpoints, status lamps

Guarded setpoint write in LK Go: allowed range shown and confirmation required before the value reaches the ControlLogix PLC — Writes are range-checked and confirmed before they reach the PLC

A temporary screen in minutes

Free app · iPhone & iPad

Zero-config tag browser for Logix, drag-and-drop dashboard, operator panel, alarms — no changes to the PLC logic.

Download on theApp Store

On a desktop? Scan with your iPhone or iPad to get the free app.

See the app tour →

For the machine itself: LineKeeper On is a self-contained 7″ or 10″ touchscreen built to stand on the machine while the replacement panel is repaired or shipped — the same drag-and-drop screens, plus what a phone shouldn't carry:

Live view of every mapped tag, refreshed twice a second — plus per-tag unlocked writes, confirmed and audit-logged
Operator panel: start/stop, indicators, setpoints — hold-to-run releases when your finger lifts (not a safety function)
Stays useful after the repair: data logging, dashboards, machine diagnostics

Small hardware that helps while the panel is out: a Wi-Fi bridge or a USB-C Ethernet adapter to get the phone onto the machine network, a pole-mount arm for the temporary screen, an IP67 box for the bridge. What each one is for, and when you don't need it, is on the gear list.

LineKeeper On, the same idea on a 7″ or 10″ touchscreen that stays on the machine and logs 24/7, is on preorder: 7″ $800, 10″ $900, one-time, no subscriptions. Ships within 8 weeks of order; full refund any time before your unit ships; 30-day money-back after delivery. Keeping the repair history too? LK Up is a free maintenance system that runs on your own PC (early access).