CODESYS

What is CODESYS?

CODESYS (Controller Development System) is a vendor-independent software platform with which you develop, test and run PLC programs according to IEC 61131-3 on hardware from hundreds of different manufacturers. It consists of a free engineering environment and a runtime (CODESYS Control) that runs on controllers, industrial PCs, embedded systems and as a Soft PLC or container. More than 400 device manufacturers build their controllers on CODESYS, making it one of the largest ecosystems in industrial automation.

CODESYS is used in machine building, the process industry, building automation, water and energy, and IIoT environments. Because the platform combines classic control with motion control, visualisation, OPC UA, MQTT and edge computing, it plays a key role in the shift towards software-defined automation and OT convergence.

🧠 Who develops CODESYS and how did it start?

CODESYS was developed by the German company 3S-Smart Software Solutions, founded in July 1994 by Dieter Hess and Manfred Werner in Kempten. Version 1.0 appeared that same year. Since June 2020 the company has been called CODESYS GmbH, part of the CODESYS Group with more than 250 employees, mostly software engineers.

The business model is unusual: the controller manufacturer licenses the CODESYS runtime and ships its hardware with a matching device description. End users then program all those brands in the same environment.

🔧 What are the components of CODESYS?

The architecture is layered. The IDE runs on the engineering workstation and communicates with the runtime through the CODESYS Gateway. The runtime contains a task scheduler, memory manager, IO handling, protocol stacks, a watchdog and a debug engine for online diagnostics. Below it sit the fieldbuses to sensors, actuators and drives. Within a Soft PLC architecture, the runtime therefore acts as a software-based PLC.

💻 Which programming languages does CODESYS support?

Structured Text is gaining ground because of better scalability, reusability and the object-oriented extensions (classes, methods, interfaces) introduced in edition 3 of the standard. Motion control and IIoT integrations in particular are largely programmed in ST.

⏱️ How real-time is the CODESYS runtime?

The runtime executes tasks cyclically or on events. Its real-time behaviour depends on the host operating system, CPU priorities, hypervisor configuration, network load and the fieldbus used. For deterministic control, engineers use a Linux kernel with RT-Preempt or an RTOS, dedicated CPU cores, TSN or real-time Ethernet and hardware timestamping.

These are practical values; the achievable cycle time depends on CPU, program size and I/O volume.

🔌 Which industrial protocols does CODESYS support?

Fieldbus configurators are built into the IDE, but the controller manufacturer decides which protocols are available through licences and hardware. Besides EtherCAT, motion applications also use SERCOS III and Powerlink. This allows CODESYS to act as an integration platform between diverse OT systems.

⚡ What can CODESYS do for motion, visualisation and edge?

• Motion control - SoftMotion offers positioning, camming, gearing, interpolation, servo control and multi-axis synchronisation based on the PLCopen motion function blocks. Applications include packaging machines, robotics, CNC machines, AGV systems and conveyor systems.
• Visualisation - WebVisu delivers HTML5 screens with alarms, trending, user management and remote operation. This saves external software, but increases runtime load, enlarges the attack surface and scales poorly to large installations, where a full SCADA system is a better fit.
• Edge and IIoT - the runtime can convert protocols, buffer data and publish via MQTT or OPC UA to a Unified Namespace, historian, MES or cloud platform. The result is a hybrid OT/IT architecture.

🏭 Which manufacturers and sectors use CODESYS?

Many well-known PLC ranges run on CODESYS or are derived from it: the AC500 controllers from ABB (Automation Builder), EcoStruxure Machine Expert from Schneider Electric, TwinCAT from Beckhoff (historically built on CODESYS technology), and controllers from WAGO, Festo, Eaton and Bosch Rexroth. In total, more than 400 manufacturers and over 100,000 end users rely on it.

• Machine building - OEMs choose CODESYS for hardware independence, fast engineering and motion control: one code base for machines with controllers from different brands.
• Process industry - batch control, pump control, dosing systems and utilities, linked to SCADA, Historian and MES.
• Building automation - HVAC, lighting, access control and energy management via BACnet, KNX or MQTT.
• Water and energy - telemetry, pumping stations and substations, often with compact CODESYS controllers acting as RTU or data logger.

🔄 What is the difference between CODESYS, TIA Portal and Studio 5000?

A CODESYS project is therefore more portable than a brand-specific project, but not completely: I/O configuration and manufacturer libraries remain device-specific.

🧩 Can CODESYS run virtualised or in containers?

Yes. CODESYS Virtual Control SL ships the runtime as a container image based on an OSADL image, run with Docker or Podman on Debian, Red Hat Enterprise Linux or Yocto, on x86-64, ARM and ARM64. Real-time behaviour requires an RT-Preempt kernel (version 6.1 or later), suitable BIOS settings and a system without a graphical environment; licensing runs through a network licence server. CODESYS Control Win can also run in a classic virtual machine. This is part of virtualisation in OT.

Benefits are easy provisioning, snapshots, central rollout, scalability and fast recovery. Risks are real-time degradation, extra hypervisor latency, shared resources and a single host failure that takes down several controllers at once. For critical real-time applications, dedicated hardware often remains the best choice.

🔐 How do you secure a CODESYS system?

Because controllers from hundreds of manufacturers share the same runtime, one vulnerability in CODESYS immediately affects all those brands at once. In 2023 Microsoft disclosed more than a dozen high-severity vulnerabilities in the CODESYS V3 SDK (CVE-2022-47378 to CVE-2022-47393), reported in September 2022 and fixed in version 3.5.19.0 (April 2023). They enabled denial of service and in some cases remote code execution; the required authentication could be bypassed via the older CVE-2019-9013. Other threats include malware, ransomware, credential theft, supply-chain attacks and unauthorised changes to PLC logic.

A practical step-by-step approach:

1. Inventory all CODESYS devices and their runtime version; for branded controllers the controller manufacturer delivers the patch; only for soft PLCs such as Control Win or Control for Linux does the update come directly from CODESYS.
2. Patch through patch management to at least 3.5.19.0 and follow the security advisories from CODESYS and CERT@VDE.
3. Segment with network segmentation according to IEC 62443 and block the engineering ports (by default including TCP 1217 for the gateway and TCP 11740 for the runtime) from IT networks and the internet.
4. Enable user management on the runtime, encrypted communication (TLS) and a password on WebVisu.
5. Monitor engineering traffic and program changes.

This approach is in line with mitigating measures and fits within cybersecurity for OT. Manufacturers of CODESYS-based controllers fall under the Cyber Resilience Act: from 11 September 2026 actively exploited vulnerabilities must be reported, and from 11 December 2027 all requirements apply. Dutch users covered by the Cyberbeveiligingswet (in force since 15 August 2026) must be able to demonstrate how they patch and segment these controllers.

⚠️ What are the operational risks?

Typical engineering mistakes are wrong task priorities, blocking code in a fast task, watchdogs set too loosely or disabled, race conditions between tasks and missing error handling.

🛠️ How does CODESYS support lifecycle and safety?

For lifecycle management, CODESYS offers online change (modifying a program without stopping), versioned library management and, through the Professional Developer Edition, integration with Git or Subversion. This enables version control, configuration management, CI/CD pipelines and a DTAP street, just as in IT software development.

For safety, CODESYS provides certified components with which manufacturers build a safety PLC up to SIL 2 or SIL 3 according to IEC 61508, with fail-safe I/O via, for example, FSoE or PROFIsafe. For the process industry and machine building, IEC 61511 and ISO 13849 remain the application standards within functional safety. With the redundancy add-on, two controllers run as primary and standby runtime for redundancy. Validation and certification of the complete application always remain the responsibility of the machine builder or owner.

Key trends are virtual PLCs, containerised OT, TSN networks, OPC UA PubSub and cloud-based engineering. CODESYS thus plays a central role in the convergence of PLC, IPC, SCADA and edge within OT.

❓ Frequently asked questions

Is CODESYS free?

The CODESYS development environment is free to download and use. The runtime is not: with a branded controller the licence is usually included in the hardware price, while for a Soft PLC on an IPC or Raspberry Pi you buy a runtime licence in the CODESYS Store. Without a licence the runtime only runs temporarily in demo mode.

Is CODESYS a PLC?

CODESYS is not a physical PLC but software. It consists of a programming environment and a runtime that turns an industrial PC, embedded controller or container into a PLC. Many hardware PLCs from other brands use that runtime internally.

What is the difference between CODESYS V2 and V3?

CODESYS V3 is a completely new architecture with object-oriented programming, device descriptions, a plug-in system and the CODESYS Store. V2.3 projects must be converted and are not directly interchangeable. New projects use V3.5; V2 installations are legacy.

Which PLCs can you program with CODESYS?

With CODESYS you can program controllers from more than 400 manufacturers, including ABB AC500, Schneider Electric (Machine Expert), WAGO, Festo, Eaton and Bosch Rexroth. CODESYS also runs as a Soft PLC on Windows, Linux and Raspberry Pi. Siemens S7 and Allen-Bradley PLCs cannot be programmed with CODESYS.

Can CODESYS run in a container or virtual machine?

Yes, CODESYS Virtual Control SL runs as a Docker or Podman container on Linux with an RT-Preempt kernel, and CODESYS Control Win can run in a virtual machine. For hard real-time motion, dedicated hardware or carefully tuned virtualisation remains necessary.

Is CODESYS secure?

CODESYS includes security features such as user management and encrypted communication (TLS), but it has had serious vulnerabilities in the past, such as the series of V3 SDK vulnerabilities Microsoft published in 2023. The security of a CODESYS installation therefore depends on timely patching, network segmentation and never connecting the runtime directly to the internet.

📌 In summary

CODESYS is the vendor-independent IEC 61131-3 platform with which you program PLCs from hundreds of brands, Soft PLCs and container-based controllers in one environment. That broad adoption makes it powerful for machine building, edge and IT/OT convergence, but it demands strict patching and segmentation, because one vulnerability in CODESYS affects many brands at once.