A protocol gateway is a translation appliance that maps one industrial communications protocol to another, most commonly PROFIBUS↔PROFINET, Modbus RTU/TCP↔EtherNet/IP, BACnet↔Modbus, or OPC UA/MQTT↔legacy fieldbus, with a deterministic cycle time of 1–10 ms for the hard-realtime side [S1].
Selection in 2026 is dominated by three pressures: brownfield PROFIBUS-PA segments that must surface as MQTT-Sparkplug B payloads, ATEX/IECEx Zone 1 cabinets where the gateway itself is the only allowable active device, and the OT/IT security boundary where the gateway now carries the firewall, TLS termination, and device-authentication load that previously sat in a separate appliance [S2].
Five Spec Gates That Decide the Shortlist
The five gates a buyer should score before looking at brand are, in order of failure frequency: (1) protocol-pair coverage including all four layers (physical, data link, application, security), (2) hazardous-area zone rating matched to the cabinet, (3) maximum segment/device count and concurrent connections, (4) measured cycle-time latency under full load, and (5) hardening level for the OT/IT boundary [S1][S2]. A unit that fails gate 1 or 2 is a non-starter; a unit that only fails gate 5 is usually salvageable with an external firewall, so weight accordingly.
For each candidate, demand the manufacturer's datasheet line that names both ends of every supported pair, the exact ATEX/IECEx certificate number with the equipment protection level (EPL Ga/Gb/Gc or Da/Db/Dc), and the maximum number of devices per master segment. The fieldbus gateway cousin shares most of these gates but adds segment count as the dominant constraint; treat them as adjacent rather than identical in your criteria matrix.
Protocol-Pair Matrix: PROFIBUS, PROFINET, EtherNet/IP, Modbus, BACnet, MQTT
Reference open implementations such as the Azure IoT protocol-gateway framework demonstrate the canonical MQTT v3.1.1 adapter model, which is a pass-through component that bridges device traffic to a cloud broker and is built on .NET with Visual Studio 2013 or later as the documented toolchain [S1]. The same architectural pattern (custom adapter + pluggable transport) is what commercial PROFIBUS↔MQTT or Modbus↔OPC UA boxes expose, and it explains why most units are advertised by pair rather than by raw throughput [S1].
When comparing protocol-pair coverage, use the following four-criterion grid for the realistic options in 2026: (a) PROFIBUS-DP master/slave with PROFINET IO device; (b) Modbus RTU/TCP with EtherNet/IP scanner/adapter; (c) BACnet/IP with Modbus TCP for HVAC retrofit; (d) OPC UA/MQTT with PROFIBUS-PA for process IIoT. Demand that every claimed pair includes both directions of conversion, not just read-only, and confirm the maximum number of cyclic I/O bytes the gateway can sustain at the published cycle time. A unit rated for 244 bytes of PROFINET input at 1 ms is not the same product as one rated for 244 bytes at 4 ms; treat the cycle-time spec as a hard number, not a marketing line [S1].
Hazardous-Area Rating: ATEX, IECEx, UL Class I Div 2
European chemical-plant builds in 2026 routinely spec ATEX category 3 (Zone 2) gateways as a minimum, and Zone 1 (category 2, EPL Gb) where the cabinet sits inside the classified area rather than in a purged enclosure. The certificate number must match the equipment protection level printed on the label, and the ambient range on the certificate should bracket your worst-case cabinet temperature, typically 0–55 °C for uncooled field cabinets and −20 to +70 °C where solar gain is expected [S2].
North American sites usually accept UL Class I Division 2 (Groups A–D) as equivalent to Zone 2, but it is not equivalent to ATEX category 2; a gateway certified for Division 2 is not automatically Zone 1-legal in the EU, and vice versa. For greenfield projects, standardise on IECEx where the cabinet crosses regions, because IECEx is accepted in both the EU and North America and avoids duplicate certification cost. Plan a 4–8 week certification review if a custom variant is needed; off-the-shelf Zone 1 gateways from major automation vendors ship in 2–4 weeks ex-stock.
OT/IT Security Boundary: TLS, Device Auth, Segmentation
The 2026 baseline for any gateway crossing the OT/IT boundary is TLS 1.2 minimum, with TLS 1.3 where the field device supports it, plus X.509 device certificates rather than shared-key SAS tokens, because shared keys are an audit finding waiting to happen on a process-control audit. Reference open-source adapters expose a pluggable custom-authentication component precisely because device identity is the layer most often customised [S1][S2].
Three further security gates should appear in the RFP: (a) the gateway must support VLAN tagging per downstream port so the SCADA and the engineering workstation cannot see each other; (b) the management plane must be on a separate IP interface with role-based access and brute-force lockout; (c) firmware must be signed and verifiable, with a documented rollback path. These three are no longer optional in 2026 plant builds; expect a vendor without them to be deselected in the first screen.
Deterministic Latency, Cycle Time, and Segment Count
Hard-realtime protocols (PROFINET IRT, EtherNet/IP with CIP Motion, EtherCAT) demand a published maximum cycle-time jitter, and the honest vendors quote jitter in microseconds, not milliseconds. A PROFIBUS-DP master gateway that is honest about its limits will state 1 ms cycle time with under 100 µs jitter at 244 bytes; anything looser than that should be treated as soft-realtime and is not suitable for motion loops. The same unit will also publish a maximum slave count per master segment, typically 32 for PROFIBUS-DP without repeaters and 126 with repeaters, and a maximum number of concurrent TCP connections on the Ethernet side, typically 64 to 256 [S1].
For process-IIoT use cases where the cycle-time requirement relaxes to 100 ms or 1 s, the dominant constraint is segment count rather than latency, and that is where a different class of gateway wins. Plan for one gateway per 20–40 PROFIBUS-PA segments, or per 500–1000 Modbus TCP tags, depending on scan rate; under-quoting segment count is the most common reason a 2025 install needs to be ripped out in 2026 [S2]. For a deeper criteria-based walkthrough of how segment count pairs with zone rating, the Fieldbus Gateway Spec-Map 2026 is a useful adjacent reference.
Who Should NOT Pick the Generic MQTT-to-Fieldbus Box
Three buyer profiles should explicitly avoid the off-the-shelf MQTT↔PROFIBUS box: (1) any site with a hard-realtime motion loop, where the 1 ms cycle-time and 100 µs jitter budget is non-negotiable; (2) any process plant with PROFIBUS-PA and a FISCO requirement, where the gateway must be FISCO-compliant and the off-the-shelf unit is not; (3) any regulated pharmaceutical or food site where the gateway must log all protocol-conversion events to a tamper-evident audit trail, which most generic boxes do not. For these three profiles, the right move is a vendor whose datasheet names the specific motion certification, FISCO certificate, or audit-trail feature in writing, not as a roadmap promise [S1][S2].
The same caution applies to the open-source route: a custom protocol-adapter build on a .NET reference framework gives you total control but also total responsibility for hardening, certificate management, and 24/7 support, and Microsoft has documented a 50-commit fork history across multiple community mirrors [S1][S2]. Choose the open path only when the application is non-realtime, the security boundary is well understood, and your team owns the lifecycle.
Sourcing, Lead Time, and 2026 Shortlist Logic
Lead time in 2026 has bifurcated: Zone 1/ATEX/IECEx-catalogued gateways from major automation brands ship in 2–4 weeks ex-stock in the EU, while Zone 2/Class I Div 2 generic units from Asian ODMs ship in 1–2 weeks at 30–50% of the catalogued price, but with a 6–12 week clock on the IECEx certificate for the specific configuration. Budget 8–12 weeks total for a greenfield Zone 1 build, including the certification review. [S1]
Shortlist logic: start with protocol-pair coverage, then Zone rating, then segment count, then latency, then security, in that order. A unit that wins gates 1–3 and is acceptable on 4–5 is a buy; a unit that wins 5 but fails 1 is a non-starter. For a cabinet build that also needs DIN-rail wiring ducting to match, the Wiring Duct 2026 PVC UL94 V-0 spec map lines up the same sourcing discipline for the mechanical side of the same cabinet. Track for the next buying cycle: IECEx certificate consolidation for Zone 1 gateways, and the move of the OT/IT security stack fully into the gateway as a default feature rather than an option.
Spec-level background on the components involved: linear guide.