What is a Soft PLC?
A Soft PLC is a software implementation of a PLC that executes control logic on generic hardware, such as an industrial PC (IPC), server, hypervisor or edge platform, instead of on a dedicated controller. The runtime runs alongside or on top of an operating system such as Windows or Linux and uses a real-time kernel or RTOS to execute PLC tasks predictably. Well-known examples are TwinCAT from Beckhoff, CODESYS Control and the S7-1500 Software Controller from Siemens.
Soft PLCs play a growing role in Industry 4.0, edge computing, the Industrial Internet of Things and OT convergence. They combine classic industrial control with practices from the IT world, such as virtualisation, containers and central lifecycle management. That gain in flexibility shapes the architecture and brings extra demands on real-time behaviour, availability and cybersecurity.
🧠 How does a Soft PLC work?
Functionally, a Soft PLC does the same job as a hardware PLC. The runtime executes a program according to IEC 61131-3 (or IEC 61499 on some platforms) in a fixed cycle:
- Read inputs - the runtime reads the process image from sensors and other IO, usually over a real-time fieldbus.
- Execute the program - logic, timers, counters, control loops and motion control.
- Write outputs - the results go to actuators and drives.
- Diagnostics and communication - alarms, watchdog, and data exchange with SCADA, MES and historians.
The difference lies in the platform underneath. A hardware PLC has its own processor and firmware that do nothing but control. A Soft PLC shares the PC with other software, so the runtime must shield control tasks from Windows updates, an HMI client or a virus scanner. Three common architectures exist for this:
| Architecture | How it works | Examples |
|---|---|---|
| Real-time kernel alongside the OS | Own kernel on reserved CPU cores; the OS runs as a low-priority task | TwinCAT (isolated cores), Siemens S7-1500 Software Controller (Siemens hypervisor alongside Windows) |
| Real-time Linux | Linux with PREEMPT_RT, part of the mainline kernel since 6.12 (2024) | CODESYS Control for Linux, Virtual Control SL, Virtual PLCnext Control |
| Real-time extension for Windows | Separate real-time subsystem within Windows | IntervalZero RTX64, the older Siemens WinAC RTX |
Because the runtime shares resources, the deterministic behaviour of a Soft PLC depends more on configuration than that of a hardware PLC. With the S7-1500 Software Controller, Windows can even reboot while control keeps running, because both run separately on the hypervisor.
🔄 What is the difference between a Soft PLC, a hardware PLC and a virtual PLC?
A virtual PLC is a Soft PLC that is not tied to one physical PC but runs as a virtual machine or container on shared infrastructure, for example an edge server or a cluster in the data centre. Every virtual PLC is therefore a Soft PLC, but not every Soft PLC is virtualised.
| Property | Hardware PLC | Soft PLC on IPC | Virtual PLC (VM/container) |
|---|---|---|---|
| Hardware | Dedicated controller | Industrial PC | Shared server or edge node |
| Real-time performance | Highly predictable | Good, given a real-time kernel and isolated cores | Depends on host, network and tuning |
| Computing power | Limited | High, scales with the PC | Scalable through infrastructure |
| Maintenance | Vendor firmware | OS and runtime | OS, hypervisor/container platform and runtime |
| Attack surface | Small OS, but its own vulnerabilities | General-purpose OS with network services | Plus hypervisor and orchestration |
| IT integration and data | Limited, via gateways | Strong | Very strong |
| Typical use | Machines, critical processes | Machine building, motion, vision | Edge, test environments, central control |
A hardware PLC is not secure by definition: PLC firmware has vulnerabilities too. The difference is that a Soft PLC adds all the risks of a general-purpose operating system on top.
🏭 Which Soft PLC platforms are available?
| Platform | Vendor | Characteristics |
|---|---|---|
| TwinCAT 3 | Beckhoff | Since 1996 (TwinCAT 3 since 2010), Windows, TwinCAT/BSD and RT Linux; base tick down to 50 µs; closely tied to EtherCAT |
| CODESYS Control / Virtual Control SL | CODESYS | Runtime for Windows and Linux, plus a container image for Docker and Podman; Virtual Safe Control SL certified for SIL 3 since January 2025 |
| S7-1500 Software Controller (CPU 1507S) | Siemens | Successor to WinAC RTX; runs on Siemens IPCs alongside Windows; also as fail-safe CPU 1507S F |
| SIMATIC S7-1500V | Siemens | Fully virtual PLC via Industrial Edge, engineered in TIA Portal; the fail-safe S7-1500V F is TÜV-certified; Audi uses it in the body shop at Böllinger Höfe in Neckarsulm, with a wider rollout from 2025 |
| Virtual PLCnext Control | Phoenix Contact | Software version of PLCnext as an OCI container on x86 (2025); IEC 61131-3 plus C++, C# and Python |
| SoftLogix 5800 | Rockwell Automation | PC-based Logix controller with a virtual chassis; Active Mature status: still supported, but without new features or OS updates |
| Automation Runtime | B&R | Real-time operating system that can also run alongside Windows or Linux on a hypervisor |
| EcoStruxure Automation Expert | Schneider Electric | Software-defined control based on IEC 61499 |
Many hardware PLCs from other brands use the same CODESYS runtime internally. The boundary between hardware and software is therefore blurrier than the product names suggest.
⏱️ How real-time is a Soft PLC?
In OT, what matters is not speed but predictability. The key parameters are:
| Parameter | Meaning | Common order of magnitude |
|---|---|---|
| Cycle Time | Scan interval of a task | 1-10 ms for machine control, 50-500 µs for fast motion, 100 ms or more for process control |
| Jitter | Variation in execution timing | A few to tens of µs on well-tuned real-time systems |
| Latency | Time between event and response | Determined by cycle time plus fieldbus |
| Priority | Order of tasks on the scheduler | Control tasks above OS and HMI tasks |
A Soft PLC achieves these values with isolated cores (CPU cores used only by the runtime), a real-time kernel, power saving disabled in the BIOS, a network card with a suitable chipset and a deterministic real-time Ethernet protocol such as EtherCAT, ProfiNET IRT, Powerlink, SERCOS III or TSN. Applications where this matters include robotics, packaging machines, vision systems, high-speed conveyors and turbine control.
🔌 Which protocols does a Soft PLC support?
| Direction | Purpose | Protocols |
|---|---|---|
| North-south | Connection to SCADA, MES, ERP and cloud | OPC UA, MQTT, HTTP, HTTPS, SNMP, Modbus TCP |
| East-west | Machine-to-machine and field level | ProfiNET, Ethernet IP, EtherCAT, S7 Comm, Modbus, DNP3 |
| Energy | Substations and grid operation | IEC 61850 with GOOSE to IEDs |
| Buildings | Building automation and BMS | BACnet, KNX, DALI |
| Legacy | Older installations | RS-232, RS-485, Profibus, Modbus RTU |
This broad protocol support makes a Soft PLC well suited as a bridge between legacy systems and modern IIoT platforms. An edge node then often combines PLC logic with telemetry, an OPC UA server, an MQTT client, local storage and a link to the cloud.
🖥️ Can a Soft PLC run virtualised or in containers?
Yes, but not every Soft PLC is designed for it. Platforms such as CODESYS Virtual Control SL, Virtual PLCnext Control and the S7-1500V are built for VMs or containers on VMware, Hyper-V, KVM, Docker or Kubernetes edge clusters. Older products are not: for SoftLogix 5800, Rockwell advises against installing virtualisation software on the same PC because it affects timing.
Benefits are faster deployment, scalability, restore from snapshots (recovery), less hardware and central management. Drawbacks are extra latency from the virtualisation layer, interference from other workloads on the same host, more complex troubleshooting and a larger attack surface. A failed host can also stop several PLCs at once, so host-level redundancy is mandatory design work.
For a long time, SIL applications were assumed to require physical hardware. Since 2025, certified virtual safety controllers exist (CODESYS Virtual Safe Control SL, S7-1500V F), but in most installations a separate Safety PLC according to IEC 61508 and IEC 61511 remains the norm.
🔐 What cybersecurity risks does a Soft PLC bring?
A Soft PLC runs on a standard IT platform with network services, user accounts, drivers and remote management access. Typical threats are malware, ransomware on the host, privilege escalation, hypervisor or container escape, credential theft and lateral movement from the office network. Because hundreds of brands share the same runtime, one vulnerability affects many installations at once: in 2023 Microsoft published a series of severe vulnerabilities in the CODESYS V3 runtime.
Key security measures:
- Hardening - only necessary services, no browser or email on the control PC, Secure Boot.
- Application Whitelisting - instead of a virus scanner that disrupts real-time behaviour.
- Network Segmentation - the Soft PLC in its own zone and VLAN, protected by an industrial firewall and a DMZ towards IT.
- Access - MFA for remote management and RBAC in the engineering environment.
- Patch Management - track OS, hypervisor and runtime separately and validate in a test environment first.
- Logging and Security Monitoring - make changes to PLC logic and login attempts visible.
IEC 62443 (formerly ISA-99) provides the framework for zones, conduits and security levels, and NIST SP 800-82 gives additional guidance for ICS. Manufacturers of Soft PLC software fall under the Cyber Resilience Act: reporting of actively exploited vulnerabilities applies from 11 September 2026 and all requirements from 11 December 2027. Dutch users within the scope of the Cybersecurity Act (Cyberbeveiligingswet, in force since 15 August 2026) must be able to demonstrate how they manage these systems.
🏭 Where are Soft PLCs used?
- Discrete manufacturing - assembly lines, robot cells, vision integration, AGV control and traceability, with direct links to MES and historian.
- Energy - substation automation, energy management and load balancing, often with IEC 61850 alongside SCADA.
- Buildings - HVAC control, lighting and energy management in smart buildings.
- Water and process - pumping stations, dosing, filtration and batch control, where availability comes first.
- Simulation and testing - virtual FAT, software- and hardware-in-the-loop, operator training and cyber ranges. Linked to a digital twin, you can test logic before the machine exists, which shortens commissioning.
In the Purdue Model, a Soft PLC sits at level 1, the control network, between the field devices and the supervisory network. An edge variant often also spans levels 2 and 3, and via ISA-95 even the link to MES and ERP, which calls for extra attention to segmentation.
🔧 How do you select and implement a Soft PLC?
- Define the real-time requirement - what cycle time and jitter does the process need, and is there fast motion? This determines whether an IPC is sufficient or a VM is acceptable.
- Choose the platform - check supported hardware (some runtimes only work on validated IPCs), fieldbuses, licensing model and product lifetime.
- Design the host - isolated cores, BIOS settings, suitable network cards and a redundant host or failover for critical processes.
- Set up lifecycle management - version control, configuration management, CI/CD and a development-test-acceptance-production pipeline, with OT validation before every rollout.
- Secure according to IEC 62443 - zoning, hardening and vulnerability management for OS, hypervisor and runtime.
- Test failure scenarios - what happens on an OS crash, a full disk or a host failure?
Typical failure scenarios and mitigations:
| Issue | Impact | Mitigation |
|---|---|---|
| OS crash | Production stop | Runtime separated from the OS, watchdog with safe outputs |
| Host failure | Loss of several PLCs | Redundant hosts and failover |
| CPU starvation | Higher jitter | Isolated cores, fixed priorities |
| Virus scan or update | Disrupted cycle | Whitelisting, maintenance windows |
| Network congestion | Timing issues | Separate fieldbus network, TSN |
For safety functions, a fail-safe design always applies: if the Soft PLC fails, the installation must move to a safe state on its own.
❓ Frequently asked questions
Is a Soft PLC the same as a virtual PLC?
Not quite. A Soft PLC is any PLC runtime that runs as software on generic hardware, for example TwinCAT on an industrial PC. A virtual PLC is a Soft PLC that runs as a virtual machine or container on shared infrastructure, such as the Siemens S7-1500V or Virtual PLCnext Control.
Is a Soft PLC fast enough for motion control?
Yes, provided the platform is set up for it. Soft PLCs such as TwinCAT control dozens of axes with cycle times below one millisecond using isolated cores and EtherCAT. In a shared VM without real-time tuning, however, hard motion control is not responsible practice.
Can a Soft PLC be used for safety applications?
Only with a runtime certified for that purpose. Since 2025, certified virtual safety controllers exist, such as CODESYS Virtual Safe Control SL (SIL 3) and the TÜV-certified Siemens S7-1500V F. In practice, most installations still use a separate safety PLC next to the Soft PLC.
Is a Soft PLC less secure than a hardware PLC?
A Soft PLC has a larger attack surface because it runs on a general-purpose operating system with network services. With hardening, application whitelisting, network segmentation and strict patch management according to IEC 62443, the risk can be managed well. A hardware PLC is not free of vulnerabilities either.
Which Soft PLC software is most widely used?
In machine building, Beckhoff TwinCAT and CODESYS are the best-known Soft PLC platforms; CODESYS also runs internally on controllers from hundreds of manufacturers. Siemens offers the S7-1500 Software Controller and the virtual S7-1500V. Phoenix Contact, Rockwell, B&R and Schneider Electric have their own software-based or virtual controllers.
What are the disadvantages of a Soft PLC?
The main disadvantages of a Soft PLC are its dependence on a general-purpose operating system, extra maintenance of the OS and hypervisor, and a higher cyber risk. Real-time behaviour also requires careful configuration, and a single failed host can affect several controllers at once.
📌 In summary
A Soft PLC moves control from a dedicated controller to software on an industrial PC, server or edge platform. This brings computing power, flexibility and direct IT integration, and makes virtual PLCs in VMs and containers possible. In return, it demands careful real-time configuration, redundancy, lifecycle management and cybersecurity according to IEC 62443.
A Soft PLC is only as reliable as the platform beneath it: with a real-time kernel, reserved cores, segmentation and strict patch management it is a full-fledged PLC, without those measures it is a vulnerable PC.