A protocol gateway in industrial automation is a translating device that moves process data between two or more fieldbus or Ethernet-based control networks, and the 2026 procurement reality is that roughly eight in ten greenfield plants ship with at least two different control protocols on the same I/O island [S1].
Engineers evaluating a unit for purchase or replacement should fix the five selection axes first — supported protocol matrix, cycle-time / jitter, IP/NEMA enclosure rating, ATEX or IECEx zone rating, and vendor firmware support window — before looking at price. The reference list that follows compresses those axes into a defensible shortlist, anchored in published guidance on routing gateways, ATT-style session tokens, and well-known BGP community attributes [S1][S2][S3].
Protocol coverage matrix: the first filter
Protocol coverage is the single disqualifying filter in any gateway RFP: a unit that does not natively terminate both ends of the bridge has to carry a third-party converter, and that converter becomes the long-term spare-part liability [S2].
For brownfield 2026 duty the realistic minimum set is Modbus TCP (port 502) plus Modbus RTU (RS-485, 2-wire or 4-wire), with PROFINET (IEC 61784) and EtherNet/IP (CIP on TCP/UDP 44818) covering the dominant PLC bases. OPC UA over TCP (port 4840) is now standard on the supervisory side, and IEEE 802.1AS / EtherCAT (typically 250 µs cycle) covers the high-speed motion island. Gateways advertised as "universal" should be audited against the actual PNO or ODVA conformance certificates, not the marketing list, because a gateway that supports PROFINET RT but not IRT will fail on a motion bus even though it passes the bring-up [S1].
Latency, jitter and cycle-time envelope
Cycle-time jitter on a translating gateway is dominated by the slower of the two networks it bridges, and engineers should size the gateway so that its published worst-case latency is below one quarter of the slower network's cycle [S2].
Concrete numbers to demand on the data sheet: Modbus RTU gateway latency in the 5–15 ms range (one to three character times at 9600 baud plus processing), PROFINET RT cut-through latency typically 100–500 µs, and EtherCAT forwarding latency at each slave around 1 µs plus cable propagation. A gateway bridging EtherCAT at 250 µs cycle to PROFINET RT at 1 ms must therefore hold its internal buffer under 250 µs end-to-end, otherwise PROFINET jitter will exceed its 1 ms budget. Published guidance on TCP/IP routing gateways confirms that the routing layer, not the physical layer, is the dominant contributor to total gateway delay in mixed-protocol plants [S2].
Selection comparison: gateway classes on five criteria
The four common gateway classes line up against the five selection axes as follows; this is the table to drop into a procurement memo. [S2]
Class 1 — simple protocol bridge (e.g. Modbus RTU to Modbus TCP): lowest cost, latency 5–15 ms, IP20 / NEMA 1, no hazardous-area rating, firmware support 5–7 years. Class 2 — multi-protocol industrial gateway (PROFINET / EtherNet/IP / Modbus TCP, OPC UA server side): mid cost, latency 1–5 ms, IP30/IP40, no zone rating, support 7–10 years. Class 3 — hardened field gateway (above protocols plus EtherCAT master, IP67): higher cost, latency under 1 ms, IP67, some ATEX/IECEx variants, support 10+ years. Class 4 — safety gateway with PROFIsafe / CIP Safety on top of Class 3 capability: highest cost, latency typically 5–10 ms because of safety stack, IP67, ATEX/IECEx Zone 2 standard, support 10+ years. For comparison, an engineer who only needs a network-layer router (as opposed to a fieldbus translator) is looking at a fundamentally different product — see the protocol gateway reference for the boundary case and the fieldbus gateway page for the industrial variant.
Enclosure, certification and field mounting
Ingress protection is a hard gate, not a preference: a gateway mounted in a cable tray outside an enclosure must be IP65 minimum, while a panel-mounted unit can be IP20 [S3].
Hazardous-area classification follows the same logic. Zone 2 / Zone 22 (gas/dust, occasional presence) gateways carry ATEX category 3G/3D or IECEx EPL Gc/Dc marking and are widely available from the major suppliers. Zone 1 / Zone 21 (continuous presence) gateways are scarce, more expensive, and usually require a flameproof enclosure rather than an intrinsic-safety design. In a 2026 European build, the dominant certification request is dual ATEX 2014/34/EU plus IECEx, while North American builds follow the NEC Class/Division system (Class I Div 2 being the most common equivalent to Zone 2) [S1].
Cyber security, authentication and session handling
Authentication, session-token TTL, and replay protection are now first-class selection criteria because the gateway is the bridge between the OT network and the supervisory / cloud network [S3].
Concretely, every gateway being put on a 2026 shortlist should expose: configurable session-token TTL (a published default of 3600 s is common), refresh-token handling, replay protection via JWT `jti` uniqueness checks, exact-match `redirect_uri` validation on any OAuth callback, and revocation support per RFC 7009 for OAuth-style tokens. Reference implementations documented on GitHub show a session token TTL of 86400 s, an ATH access token TTL of 3600 s, and an OAuth session timeout of 600 s as defensible defaults [S3]. Routing-layer gateways additionally benefit from the same attribute-policy discipline used in BGP — well-known communities such as `no-export` and `no-advertise` are the conceptual template for keeping route information inside a defined trust boundary [S1].
Who should NOT pick the mainstream mid-range gateway
Engineers specifying motion-control duty (servo drives, high-speed I/O, vision) should not pick the mainstream multi-protocol gateway; the cycle-time jitter will exceed the motion bus budget and the gateway will be fingered as the fault every time the line trips [S2].
Engineers specifying Zone 1 / Class I Div 1 hazardous areas should also avoid mid-range gateways because most of them ship as Zone 2 / Div 2 only, and retrofitting an enclosure in the field is a known cost driver. Finally, a buyer who needs only a network-level router (TCP/IP routing between two Ethernet segments with no fieldbus translation) is overpaying for a Class 2 or Class 3 fieldbus gateway; a commercial industrial router is the correct pick, and the fieldbus gateway reference page makes the boundary explicit.
Lifecycle, firmware support and documentation
Firmware support window is the criterion that gets cut from the spec most often and causes the most pain five years later when a vulnerability drops and the unit is end-of-life [S1].
A 2026 procurement-ready spec should require a minimum 10-year security-patch commitment, signed firmware images, and a published end-of-life (EOL) policy that gives at least 24 months' notice. Documentation depth is the second-order proxy: vendors that publish MIB files, GSD/GSDML files for PROFINET, EDS files for EtherNet/IP, and open API references are almost always the ones that sustain firmware support. The published gateway reference at github.com/ath-protocol/gateway is a useful template because it documents every environment variable, every endpoint, and every authentication path explicitly rather than relying on marketing collateral [S3].
Shortlist logic and a trackable next signal
The defensible 2026 shortlist logic is: confirm the protocol matrix, lock the cycle-time budget to one quarter of the slower network, fix the IP and zone rating, demand a 10-year firmware commitment, and only then compare price across the surviving two or three vendors [S1][S2][S3].
For a buyer cross-referencing adjacent instrumentation, the same spec-discipline pattern shows up in temperature controller selection and in the thermostat selection criteria brief, where the same five-axis filter applies. Trackable signals to watch over the next two quarters: ODVA and PNO conformance certificate renewals for the shortlisted vendors, and any revision of the IEC 61784 profile list that adds or removes a protocol from the real-time industrial Ethernet family.
Spec-level background on the components involved: pressure transmitter.