A protocol gateway becomes mandatory the moment a replacement PLC drops native support for the bus the existing I/O, drives, or instrument network is wired to; the 2026 brownfield market treats the gateway as the lowest-risk insertion point between legacy serial/fieldbus and modern Ethernet-based control [S3][S8].
The 2026 selection process is no longer a single-product decision but a five-axis engineering exercise spanning legacy-protocol coverage, downstream translation targets, hardware sizing to the actual point count, the physical layer already in the conduit, and the time the operations team can absorb for commissioning [S2][S6].
When a gateway is mandatory versus optional
A gateway is required when the brownfield site mixes serial/RIO/Profibus/Modbus RTU devices with a new Ethernet-native PLC; engineers call this Tier 3 in integration maturity and quote 2-4 days of effort per machine, plus extra time when the existing program must be edited to expose the right signals [S8]. Gateways are optional only on Tier 1 sites where every device already speaks PROFINET, EtherNet/IP, or Modbus TCP at the I/O block level and the network was audited in advance [S2]. The most common planning failure is assuming the legacy network is "ready" for the new controller; cabling, switch count, and VLAN segmentation almost always need rework before the gateway is even powered up [S2].
Five-axis selection criteria used by 2026 brownfield projects
Engineering teams converge on a five-axis checklist: (1) device-count ceiling of the platform, (2) native legacy-protocol stack, (3) upstream translation to OPC UA or MQTT Sparkplug, (4) form factor that fits the existing cabinet, and (5) CPU/RAM headroom for protocol parsing [S1][S4][S6]. Siemens publishes tiered SIMATIC IPC references for the platform choice alone: a 427E box PC with Core i5-6442EQ, 8 GB RAM, 480 GB SSD covers up to 10 brownfield devices, the 427E Xeon E3-1505L variant scales to 30, and the 627E/647E Core i7-8700 or Xeon E-2176G with 32 GB RAM and 960 GB SSD is the reference for up to 60 devices [S1]. Choosing the wrong tier is the single most common reason brownfield gateways run out of memory after the first 18 months in service [S1].
Legacy-protocol coverage is the deal-breaker criterion
Coverage of Remote I/O, Profibus DP/PA, Modbus RTU/TCP, DH+, and serial DF1 is the first filter, because once a protocol is missing the gateway cannot be retrofitted in the field [S3]. Site surveys must list the actual bus, baud rate, and master/slave role for every device, not a generic "Profibus" label [S3]. For Tier 3 sites, the device list commonly includes Simatic S5, older Mitsubishi MELSEC, and Allen-Bradley PLC-5/SLC-500 families that predate industrial Ethernet as a standard [S8]. Vendors that publish explicit per-protocol firmware modules — and not a single "fieldbus" option — are the only credible shortlist candidates for these sites [S3][S6].
Comparison of gateway form factors against site constraints
Three form-factor classes dominate 2026 brownfield retrofits and each maps to a different site constraint set. DIN-rail edge gateways (e.g. IoT edge node converters) fit when the cabinet has spare rail space and the data flow is one-way from the PLC to an external Industrial IoT gateway, and they minimize wiring change [S7]. Industrial PCs in box-PC format (SIMATIC IPC 427E/627E) fit when more than 30 devices must be aggregated or when soft-PLC plus gateway run side-by-side on the same CPU [S1]. 19-inch rack PCs (SIMATIC IPC 647E, 2U) fit when the gateway doubles as a virtualization host for SCADA, historian, and edge analytics [S1]. The decision criteria pair cleanly: device count under 30 favors DIN-rail, 30-60 favors box PC, and over 60 or any virtualization requirement forces rack mounting [S1][S7].
Upstream translation: OPC UA, MQTT Sparkplug, or both
North-American chemical and water sites now specify OPC UA server-side on the gateway, while European brownfield pilots add MQTT Sparkplug B bindings so data can bypass the new PLC entirely and land directly in the cloud historian [S4]. Soft-gateway software running on the industrial PC lets integrators swap protocol stacks without swapping hardware, an approach documented in the fortiss brownfield white paper as the most flexible long-term path [S4]. For sites with hundreds of pressure transmitters and flow meters, the gateway becomes the consolidation point that fans the HART/Profibus PA traffic up into a single OPC UA namespace the MES layer can subscribe to [S6].
Network readiness is the under-planned axis
Assuming the existing Ethernet segment is "good enough" is the second-most-common brownfield integration mistake and is documented as the root cause of late-stage commissioning overruns [S2]. A gateway that translates Profibus to PROFINET still needs managed switches, deterministic QoS, and segmentation from the office VLAN, none of which are guaranteed in a 15-year-old cabinet [S2]. Site risk assessments that include network simulation cut this failure mode by catching duplex mismatches, broadcast storms, and bandwidth headroom issues before the gateway goes live [S2]. For non-invasive retrofits, the gateway can sit on the field side and forward data to an external IIoT gateway over wireless, which limits the conduit work to a single tap on the existing PLC backplane [S7].
Commissioning time, failure modes, and risk signals
Tier 3 commissioning is realistically 2-4 days per machine when only the cabling and gateway configuration are touched, and it stretches when the PLC program itself must be edited to expose the right signal tags [S8]. Three verifiable risk signals predict a budget overrun: an undocumented bus on the site survey, a device count above the gateway's published ceiling, and a request to translate to a protocol the gateway does not natively list in its datasheet [S3][S6]. Tracking these three signals during the RFP phase is the cheapest mitigation; a pilot on one machine before bulk rollout is the second [S2][S8].
The next trackable signals to watch are the 2026 H2 firmware releases from the major gateway vendors that bundle MQTT Sparkplug B and OPC UA Pub/Sub on the same device, and any new IEC 62443-4-2 certification announcements for edge gateways that ship in the same cabinets as the new PLC.