What is an RTOS?
An RTOS (Real-time Operating System) is an operating system that executes tasks predictably and within a guaranteed, bounded time, so that a system meets every deadline, even under maximum load. Where Windows or a standard Linux installation optimises for average speed and throughput, an RTOS optimises for the worst case: the longest response time must be known and small. This is called deterministic behaviour. RTOSs run inside embedded devices such as PLCs, servo drives, field devices and safety controllers, and so form an invisible but crucial layer in industrial automation.
🧠 What does an RTOS actually do?
An RTOS manages tasks (threads), memory, interrupts and hardware with one goal: running every task on time, every time. Speed alone is not the point. A system that usually responds in 1 ms but occasionally needs 50 ms is unsuitable; a system that always responds within 2 ms is real-time.
An example: a PLC that reads a sensor value, executes its logic and drives a motor every 5 ms must meet that cycle consistently. The RTOS in the CPU module makes sure the cyclic task takes precedence over communication, diagnostics or web server tasks running on the same processor. A watchdog monitors the cycle time and puts the PLC into a defined stop state if it is exceeded.
Three grades are usually distinguished:
- Hard real-time - a missed deadline is a system failure, for example in motion control or a safety function
- Firm real-time - a late result is worthless, but the system does not fail immediately
- Soft real-time - late is merely worse, as with a stuttering video stream
⚙️ What are the characteristics of an RTOS?
| Characteristic | Explanation |
|---|---|
| Pre-emptive, priority-based scheduler | The highest-priority task that is ready always runs; a more important task immediately interrupts a less important one |
| Bounded interrupt latency | The time between a hardware event and the start of its handling is known, usually in microseconds |
| Low jitter | A 1 ms cyclic task starts almost exactly every 1 ms |
| Priority inheritance | Prevents a low-priority task from indirectly blocking a high-priority task (priority inversion) |
| Small footprint | A microcontroller kernel fits in a few kilobytes of memory and boots in milliseconds |
| Static configuration | Tasks, stacks and buffers are often fixed in advance, so no unpredictable memory allocation is needed during operation |
The Mars Pathfinder showed in 1997 how much priority inheritance matters. Shortly after landing, its computer, which ran VxWorks, reset repeatedly. The cause was priority inversion: a low-priority task held a shared resource while a high-priority task was waiting for it. NASA fixed it by uploading a patch from Earth that enabled priority inheritance.
🔄 How does an RTOS differ from a general-purpose operating system?
| Property | RTOS | General-purpose OS (Windows, standard Linux) |
|---|---|---|
| Design goal | Predictability, bounded worst case | Average performance and throughput |
| Scheduling | Strictly by priority, pre-emptive | Fair sharing across processes |
| Response time | Microseconds, guaranteed | Usually fast, but without a guarantee |
| Footprint | Kilobytes to a few megabytes | Hundreds of megabytes to gigabytes |
| Typical hardware | Microcontroller, PLC CPU, drive | PC, server, HMI panel |
| Updates | Rare, controlled via firmware | Frequent, often automatic |
The boundary is blurring. Since Linux kernel 6.12 (November 2024), the PREEMPT_RT real-time extension, after almost twenty years as a separate patch set, has been part of the mainline kernel. That makes Linux usable for many applications with response times in the order of tens of microseconds. Soft PLCs such as CODESYS on Linux or TwinCAT alongside Windows use exactly such a real-time core, sometimes via a hypervisor that runs an RTOS and a general-purpose OS separately on the same hardware.
🔧 Which RTOSs do you find in industry?
| RTOS | Origin and licence | Typical use |
|---|---|---|
| FreeRTOS | Richard Barry, around 2003; stewarded by AWS since 2017, MIT licence | Microcontrollers, IoT sensors, small controllers |
| VxWorks | Wind River, commercial | Aviation, space, defence, PLCs and network equipment |
| QNX | BlackBerry, commercial, microkernel | Automotive, medical devices, industrial systems |
| Zephyr | Linux Foundation project since 2016, Apache 2.0 | IoT devices, sensor networks, Bluetooth devices |
| RTEMS | Open source, POSIX interfaces | Space missions and scientific instruments |
| SAFERTOS | WITTENSTEIN, based on the FreeRTOS functional model | Safety-critical applications with certification |
Industrial manufacturers often build their controllers on such a commercial RTOS or on an in-house kernel, and rarely mention it in their documentation. For the user, the RTOS is therefore invisible, until a vulnerability turns up in it.
🏭 Where does an RTOS sit in an OT environment?
In operational technology, the RTOS lives mainly in the layers below SCADA:
- PLC CPUs - execute cyclic and event-driven tasks according to the IEC 61131-3 task model, with cycle times of typically 1 to 20 ms
- Motion control and drives - position and speed control loops with cycles of 31.25 µs to 1 ms, synchronised via EtherCAT, ProfiNET IRT or TSN
- Safety PLCs and SIS - safety functions with a guaranteed maximum response time
- Smart field devices - sensors, transmitters and I/O modules with a small RTOS kernel
- Some HMIs - compact operator panels, although larger panels usually run Windows or Linux
SCADA servers and clients themselves normally run on Windows or Linux: soft real-time is sufficient there, because hard timing is guaranteed in the controllers below.
🔐 What about safety and security of an RTOS?
Functional safety. For safety applications, the operating system itself must also be demonstrably reliable. Certified variants exist: SAFERTOS is pre-certified to IEC 61508 SIL 3 and ISO 26262 ASIL D, and QNX OS for Safety holds certificates for IEC 61508 SIL 3, ISO 26262 ASIL D and IEC 62304 Class C for medical software. Such a certificate covers only the kernel; the manufacturer still has to justify the complete application according to functional safety principles.
Cybersecurity. An RTOS often contains its own network stack, and that is where the biggest risks lie. In July 2019, Armis published URGENT/11: eleven vulnerabilities in IPnet, the TCP/IP stack of VxWorks, six of them critical with the possibility of remote code execution. Affected products included PLCs and communication modules from Rockwell Automation and Schneider Electric, and protection relays and power meters from Siemens. In 2020 came Ripple20, a series of vulnerabilities in the widely used Treck TCP/IP library. Flaws like these hit products from dozens of manufacturers at once, while the end user does not know which RTOS sits inside the equipment.
🛠️ How do you tackle RTOS risks in practice?
- Take inventory - ask suppliers which RTOS and which network stack each controller contains; an SBOM makes this visible.
- Follow advisories - link that inventory to CVEs and advisories from CISA and the manufacturer, so a new RTOS vulnerability can be traced straight to your installations.
- Segment - restrict network access to controllers with network segmentation in line with IEC 62443; many RTOS flaws can only be reached over the network.
- Plan updates - firmware updates on PLCs require downtime; include them in patch management and maintenance windows.
- Require secure development - ask suppliers about IEC 62443-4-1 and secure boot for new equipment.
In the EU that last point is becoming mandatory: the Cyber Resilience Act requires manufacturers of products with digital elements to manage vulnerabilities in their software, including the underlying RTOS, and to report actively exploited flaws from 11 September 2026; the full obligations apply from 11 December 2027.
❓ Frequently asked questions
Does every PLC have an RTOS?
Virtually every modern PLC runs on an RTOS or a comparable real-time kernel, because cyclic execution requires a bounded response time. Manufacturers rarely disclose which RTOS it is. A soft PLC instead uses a real-time extension of Windows or Linux.
Is Linux an RTOS?
Standard Linux is not an RTOS, because it optimises for throughput and does not guarantee hard deadlines. With PREEMPT_RT, part of the mainline kernel since version 6.12, Linux achieves predictable response times for many industrial applications. For the strictest requirements, such as certified safety, engineers still choose a true RTOS.
What is the difference between hard and soft real-time?
In hard real-time, a missed deadline means the system fails, as in a servo control loop or an emergency stop function. In soft real-time, a late result only reduces quality, as with a delayed trend on a screen. An RTOS is needed above all for hard real-time applications.
Why is FreeRTOS so popular?
FreeRTOS is free under the MIT licence, has a very small footprint and supports dozens of microcontroller families. Since AWS took over the project in 2017, libraries for cloud connectivity and secure updates have been added. For safety applications there is the certified derivative SAFERTOS.
How do I know whether my equipment is vulnerable to RTOS flaws?
Whether your equipment is vulnerable to an RTOS flaw shows in the manufacturer’s advisories and in an SBOM that lists the RTOS and network stack. For URGENT/11, vendors such as Rockwell Automation, Schneider Electric and Siemens published their own advisories listing affected products and firmware versions. Without such an inventory you cannot determine which controllers need an update.
Can an RTOS run alongside Windows on one PC?
Yes, an RTOS can run alongside Windows or Linux on a single industrial PC via a hypervisor or a real-time extension that reserves its own processor cores. The RTOS then handles time-critical control, while the general-purpose operating system takes care of visualisation and IT connections. Many soft PLCs work this way.
📌 In summary
An RTOS is an operating system that guarantees time-critical tasks always complete within their deadline, making it the invisible foundation beneath PLCs, drives and safety controllers.
An RTOS trades average speed for predictability: pre-emptive priorities, bounded interrupt latency and low jitter make real-time control possible. FreeRTOS, VxWorks, QNX and Zephyr are the best-known examples, and with PREEMPT_RT Linux is moving towards real-time too. For industrial automation, that means reliability and control over time, but also a hidden attack surface: know which RTOS sits inside your equipment and keep it up to date.