Brownfield and Greenfield

What is brownfield and greenfield?

Brownfield and greenfield are the two starting points of an automation or IT/OT project: brownfield means working within an existing installation with an installed base of machines, controllers and networks, while greenfield means designing and building a new plant or production line from scratch. The terms come from land-use planning, where a greenfield is undeveloped land and a brownfield is a previously used industrial site. In industrial automation, the starting point determines which technology, which level of security and which pace of change are realistic.

🧠 What is the difference between brownfield and greenfield in OT?

In practice almost every project is a hybrid: a new production line (greenfield) still has to talk to the existing MES, the utilities and the office network (brownfield).

🏭 Why is most industry brownfield?

Industrial installations last for decades. A PLC often runs for 15 to 20 years, a DCS for 15 to 25 years, and the plant itself much longer. ARC Advisory Group estimates that the installed base of automation systems reaching the end of its useful life is worth 65 to 70 billion US dollars, and that most automation systems in plants are twenty years old or more.

The Netherlands and the wider EU are no exception. The Dutch process industry in the Port of Rotterdam and at Chemelot was largely built in the second half of the twentieth century and has been extended step by step ever since. In discrete manufacturing, small and medium-sized firms run machines that work perfectly well mechanically but are digitally outdated; the Dutch Smart Industry programme therefore promotes retrofitting as a bridge to smart production. Genuine greenfield plants are the exception: even a new unit is usually built on or next to an existing industrial site.

⚠️ What challenges does a brownfield environment pose?

• Legacy systems — controllers and HMIs for which the vendor no longer supplies spare parts or updates
• Unsupported operating systems — operator stations on Windows XP (support ended on 8 April 2014) or Windows 7 (14 January 2020) that no longer receive security updates and often cannot be upgraded without vendor recertification
• Flat networks — one large network without segmentation, allowing malware to spread freely
• Undocumented assets — drawings and asset inventories are missing or out of date
• Availability constraints — a continuous process cannot stop, so changes are only possible during a turnaround or maintenance shutdown
• Mixed protocols — Profibus, Modbus RTU, HART and proprietary buses alongside Industrial Ethernet
• Loss of knowledge — the engineers who built the system have moved on or retired

🔧 How do you modernise a brownfield installation?

Several techniques are available, and you will usually combine them:

Passive monitoring is often the first step, because it requires no action on the control system at all and immediately produces an up-to-date asset list. A digital twin of a brownfield plant is built from laser scans, existing P&IDs and process data, and allows a migration to be tested before the first cable is disconnected.

For the process industry, the NAMUR Open Architecture (NOA) offers a standardised route. NAMUR recommendation NE 175 (July 2020) describes a second channel alongside the classic automation pyramid, through which data flows via OPC UA and a “NOA diode” to monitoring and optimisation applications without affecting the control system.

🚀 What advantages does greenfield offer?

• Security by design — zones, conduits and target security levels under IEC 62443 (risk assessment in part 3-2) are fixed in the design rather than added later
• Ethernet-APL — Ethernet down to the field based on IEEE 802.3cg-2019 (10BASE-T1L): 10 Mbit/s over a single twisted pair, trunks up to 1,000 m and spurs up to 200 m, with power and intrinsic safety on the same cable; launched in 2021 and backed by FieldComm Group, ODVA, the OPC Foundation and PI
• Module Type Package (MTP, VDI/VDE/NAMUR 2658) — a vendor-independent description of process modules, so that skids from different OEMs can be integrated into the process control system as plug-and-produce units
• Open Process Automation (O-PAS) — the open standard of The Open Group’s Open Process Automation Forum; version 2.1 appeared as a preliminary standard in 2021 and as a final standard in February 2023, with ExxonMobil as the driving end user
• Data architecture — a unified namespace and asset administration shells from day one, instead of point-to-point integrations

⚖️ Brownfield or greenfield: which should you choose?

🛠️ How do you tackle a brownfield project step by step?

1. Take stock — use passive monitoring and physical inspection to map all assets, firmware versions and connections
2. Assess the risks — carry out a risk assessment in line with IEC 62443-3-2 and set the target security level for each zone
3. Separate IT and OT — place a DMZ and firewalls between the office and production networks
4. Segment in phases — apply the zones and conduits model per line or unit, scheduled around maintenance shutdowns
5. Unlock data securely — use edge gateways or a NOA second channel rather than direct connections to the controllers
6. Plan the migration — record in your lifecycle management when each control system will be replaced
7. Mind the legislation — under the Machinery Regulation, which applies from 20 January 2027, anyone who substantially modifies a machine is treated as its manufacturer; NIS2 also places a duty of care on essential and important entities that covers their existing OT

❓ Frequently asked questions

What does brownfield mean in manufacturing?

Brownfield in manufacturing means a project takes place in an existing plant with machines, controllers and networks already installed. A brownfield project has to deal with legacy technology, limited documentation and production that must be interrupted as little as possible.

What is a greenfield project?

A greenfield project is the construction of a new plant, production line or installation without any existing automation. With greenfield you can design the architecture, networks and security from scratch, for example in line with IEC 62443 and with Ethernet-APL down to the field.

Is greenfield always better than brownfield?

Greenfield is not always better than brownfield, because a new plant requires a great deal of capital and years of lead time. A well-modernised brownfield installation often delivers a return sooner. The choice depends on the remaining life of the existing systems, the business objectives and the risk profile.

How do you make a brownfield plant ready for Industry 4.0?

A brownfield plant becomes ready for Industry 4.0 by retrofitting existing machines with sensors, unlocking data through edge gateways and protocol converters, and segmenting the network in phases. This creates a data flow to analytics and MES without replacing the existing control system.

Why are brownfield installations vulnerable to cyberattacks?

Brownfield installations are vulnerable because they often run unsupported operating systems, use flat networks and rely on protocols without authentication. A complete overview of the assets is frequently missing as well. Segmentation, passive monitoring and secure remote access reduce that risk.

How long does a DCS migration take in a brownfield plant?

A DCS migration in a brownfield plant takes anything from a few months for a single unit to several years for a complete site, because the conversion is planned unit by unit around scheduled maintenance shutdowns. By reusing field wiring and I/O and testing the new configuration in a digital twin beforehand, downtime per step stays limited.

📌 In summary

Brownfield means modernising around a running installation, greenfield means designing from scratch; most Dutch and European industry is brownfield. A brownfield project starts with an inventory, passive monitoring and phased segmentation, while greenfield offers the chance to build IEC 62443, Ethernet-APL and MTP into the design from the outset.