TwinCAT

What is TwinCAT?

TwinCAT (The Windows Control and Automation Technology) is the automation software from Beckhoff that turns a standard industrial PC with a real-time kernel into a PLC, motion controller and HMI platform in one. Instead of running on a dedicated PLC processor, the control logic shares the hardware with the operating system while executing in its own deterministic real-time environment. The current generation, TwinCAT 3, is integrated into Microsoft Visual Studio and combines IEC 61131-3 with C/C++ and MATLAB/Simulink. That makes TwinCAT one of the best-known examples of a Soft PLC in machine building.

🕰️ How did TwinCAT come about?

Beckhoff, founded in 1980 in Verl, Germany, introduced TwinCAT in 1996. It was one of the first systems to use a Windows PC as a fully fledged machine controller while keeping control deterministic. The generation that grew out of that first release is now known as TwinCAT 2 and is still maintained today.

In 2026 Beckhoff marks thirty years of TwinCAT. Over that period the number of axes a single TwinCAT controller can drive has grown from ten to well over a thousand, and the range of add-on functions to well over a hundred.

🔧 How is TwinCAT 3 structured?

TwinCAT 3 consists of two separate parts:

• XAE (eXtended Automation Engineering) — the development environment inside Visual Studio, or in the bundled TwinCAT XAE Shell. This is where you configure I/O, write and debug code, and download the project to the target. Product code TE1000.
• XAR (eXtended Automation Runtime) — the runtime on the industrial PC or embedded PC. XAR executes PLC, motion and C++ modules in real-time tasks.

The real-time kernel runs alongside the operating system. On multi-core PCs you can reserve isolated cores: processor cores that belong entirely to TwinCAT and that Windows no longer schedules. A Windows update or a heavy HMI client therefore cannot disturb control. On fast systems the base time of the real-time scheduler can be set as low as 50 µs; no task can cycle faster than the base time. Supported operating systems are Windows (including Windows 10/11 IoT Enterprise), TwinCAT/BSD and, more recently, Beckhoff RT Linux with the TwinCAT Runtime for Linux.

Engineering, runtime and external applications communicate through ADS (Automation Device Specification), Beckhoff’s own protocol. For integration with other systems, TwinCAT also offers OPC UA, MQTT and Modbus, among others.

🧠 Which programming languages does TwinCAT support?

TwinCAT 3 supports all five languages of IEC 61131-3: Structured Text, Ladder Diagram, Function Block Diagram, Sequential Function Chart and Instruction List (the last one deprecated in the third edition of the standard). On top of that you get:

• Object-oriented extensions — methods, properties, interfaces and inheritance in function blocks, in line with the third edition of IEC 61131-3
• C/C++ — real-time modules for computation-heavy tasks or for reusing existing algorithms
• MATLAB/Simulink — models are generated into TwinCAT modules (TcCOM) and run in the same real-time tasks as the PLC code
• Continuous Function Chart (CFC) — a free-form graphical variant of the Function Block Diagram

Because the PLC editor was historically built on CODESYS technology, TwinCAT feels familiar to CODESYS programmers. With TwinCAT PLC++, Beckhoff has introduced a completely redesigned PLC generation: according to Beckhoff, the same code runs up to 1.5 times faster, and up to a factor of three faster with compiler optimisation. PLC++ almost fully complies with the fourth edition of IEC 61131-3, can run in parallel with the existing TwinCAT PLC and includes a converter for existing projects.

🏭 Which modules does TwinCAT offer?

Beckhoff sells additional functionality as TwinCAT 3 Functions (TFxxxx), now numbering more than a hundred. The most important ones:

Everything runs on one PC and exchanges data through shared memory rather than over a network. That shortens response times and reduces the number of devices in the machine.

🔌 What role does EtherCAT play in TwinCAT?

TwinCAT is the natural master for EtherCAT. The PC’s standard Ethernet port acts as the EtherCAT master, so no dedicated interface card is required. XAE scans the I/O system automatically, after which the variables of terminals and drives are linked directly to PLC variables. Distributed clocks synchronise servo axes and I/O to well under one microsecond, which, combined with short TwinCAT cycles, enables very fast machines. Through additional interfaces TwinCAT can also handle PROFINET, EtherNet/IP and other networks.

🔄 How does TwinCAT compare with TIA Portal, CODESYS and Studio 5000?

TwinCAT stands out mainly for combining IT tooling (Visual Studio, Git integration, C++) with real-time control. Classic hardware PLCs, by contrast, offer a closed platform without a general-purpose operating system, long product life cycles and familiarity among maintenance technicians.

💶 How does TwinCAT licensing work?

The core of TwinCAT 3 Engineering, PLC programming, is free and may be installed on any number of development PCs. Runtime licences and additional functions are paid for. The price depends on the platform level of the hardware: a small Arm-based embedded PC sits in a lower level than a many-core server-class IPC. For testing you can activate a 7-day trial licence that can be renewed indefinitely. On industrial PCs from other manufacturers (platform level 90 and above), runtime licences always require a TwinCAT licence dongle.

🔐 How do you secure a TwinCAT system?

Because TwinCAT runs on an ordinary PC, it also inherits the risks of that operating system. Key points to address:

• Unencrypted ADS — classic ADS uses TCP port 48898 and UDP 48899 for discovery, without encryption. Anyone who reaches the runtime through a valid ADS route can read and write variables. On TwinCAT/BSD, port 48898 is closed by default.
• Secure ADS — since TwinCAT 3.1 Build 4024, ADS can run over TLS on port 8016, authenticated with certificates or a pre-shared key. Secure ADS is part of the base installation at no extra licence cost. Use it for every connection between engineering and runtime.
• Known vulnerabilities — CVE-2014-5414 concerned the lack of a limit on ADS login attempts. In 2024, four vulnerabilities in TwinCAT/BSD (CVE-2024-41173 to 41176) and one in the TwinCAT Package Manager (CVE-2024-8934) were published.
• Hardening — disable unused Windows services, follow Beckhoff’s hardening guidelines and consider TwinCAT/BSD for a smaller attack surface.
• Network segmentation — place engineering PCs and controllers in separate zones; never let ADS reach the office network or the internet.

🛠️ How do you set up a first TwinCAT project?

1. Install XAE — download TwinCAT 3 Engineering (from Build 4026 onwards through the TwinCAT Package Manager) and choose between Visual Studio integration or the XAE Shell.
2. Create a project — select TwinCAT XAE Project and add a Standard PLC Project under PLC.
3. Choose the target — local (your own PC as runtime, handy for practice) or an IPC via Add Route, preferably with Secure ADS.
4. Scan the I/O — under I/O > Devices, scan the EtherCAT master and add terminals and drives.
5. Write code — for example a simple motor control routine in Structured Text in MAIN.
6. Link variables — connect AT %I* and AT %Q* variables to the terminal channels.
7. Activate and test — activate a trial licence, choose Activate Configuration, put the runtime in Run mode, log in and watch the values online.

🇪🇺 Why does TwinCAT matter in the Netherlands and Europe?

European machine building, from packaging and food processing to high-tech equipment, makes extensive use of PC-based control. Beckhoff controllers running TwinCAT are a common choice for many machine builders alongside Siemens, particularly where fast motion control and EtherCAT make the difference. For OT managers, this means machines often arrive with a Windows IPC and ADS access that the supplier uses for servicing. Agree at procurement how updates, backups, Secure ADS and remote maintenance will be handled.

❓ Frequently asked questions

Is TwinCAT free?

The core of TwinCAT 3 Engineering is free and may be installed on an unlimited number of PCs. Production use of the TwinCAT runtime and additional functions such as motion control or HMI require a paid licence. For testing, you can activate a 7-day TwinCAT trial licence that can be renewed indefinitely.

Is TwinCAT based on CODESYS?

The PLC development environment of TwinCAT 2 and TwinCAT 3 was historically built on CODESYS technology, which is why the editors and languages look very similar. TwinCAT adds its own real-time kernel, Visual Studio integration, C++ and EtherCAT configuration. With TwinCAT PLC++, Beckhoff has introduced its own completely redesigned PLC generation.

Which operating system does TwinCAT run on?

TwinCAT 3 runs on Windows, including Windows 10/11 IoT Enterprise, and on TwinCAT/BSD, a FreeBSD-based operating system from Beckhoff. Beckhoff RT Linux is supported as well. In every case, TwinCAT real-time control runs in its own kernel, separate from the operating system.

What is the difference between TwinCAT 2 and TwinCAT 3?

TwinCAT 2, the generation that goes back to the 1996 launch, uses a separate PLC editor (PLC Control) and System Manager, whereas TwinCAT 3, available since 2010, brings everything together in one Visual Studio project. TwinCAT 3 adds C/C++, MATLAB/Simulink, object-oriented programming and multi-core support. Existing TwinCAT 2 projects can be migrated with a converter.

How secure is TwinCAT?

TwinCAT is only as secure as its configuration: classic ADS on port 48898 is unencrypted, and the underlying Windows installation must be hardened and patched. Use Secure ADS with TLS, network segmentation and Beckhoff’s hardening guidelines. Also follow the security advisories from Beckhoff and CERT@VDE for TwinCAT.

What is TwinCAT PLC++?

TwinCAT PLC++ is Beckhoff’s new generation of PLC technology, unveiled at the SPS trade fair in 2024. According to Beckhoff, TwinCAT PLC++ executes the same code up to 1.5 times faster, and up to three times faster with compiler optimisation. TwinCAT PLC++ remains based on IEC 61131-3, can run alongside the existing TwinCAT PLC and includes a converter for existing projects.

📌 In summary

TwinCAT turns an industrial PC into a complete machine controller: PLC, motion, HMI, vision and machine learning in one real-time environment, programmed in Visual Studio and connected via EtherCAT. That IT-style power calls for IT-style security: harden the operating system, use Secure ADS and keep ADS traffic inside a protected OT zone.