What is Version Control?
Version control is the systematic recording, comparison and reversal of every change to code, configurations and documents, with each version showing who changed what, when and why. In IT it has been standard practice in software development for decades. In industrial automation and IT/OT environments it covers PLC programs, SCADA projects, HMI screens, firmware, robot programs and network configurations. These files drive an installation directly, so an unknown change can mean a production stop or a safety risk.
🎯 Why is version control important in OT?
In many plants the “real” version of a PLC program exists only in the controller itself, alongside a few copies on the laptops of engineers and suppliers. Version control solves a number of concrete problems:
- Which version is running right now? Without central storage nobody knows for sure whether the copy on a laptop matches what is in the controller.
- Fast return to a working version after a fault caused by a change, in minutes instead of hours of searching.
- Visible differences (diff): which networks, blocks or parameters changed between two versions.
- Audit trail and compliance: proof of who made a change and why, with automatic logging, for example in GxP environments.
- Collaboration: several engineers, a system integrator and a maintenance crew work on the same installation without overwriting each other’s work.
- Detecting unauthorised changes, whether accidental or malicious.
🧱 What types of version control exist?
| Type | How it works | Examples | Suitable for |
|---|---|---|---|
| Manual | Copies named V1, V2_final, V2_final_really | Network share, USB stick | Nothing; error-prone and not traceable |
| Centralised | One central server holds the only official history; users check in and out | Subversion (SVN, since 2000), CVS | Teams that want strict locking of binary files |
| Distributed | Every working copy is a full repository; changes are exchanged between copies | Git (2005, Linus Torvalds) | Text-based code, scripts, infrastructure as code, IEC 61131-3 in text form |
| Industrial (OT-specific) | Central server that uploads, versions and compares PLC, HMI, robot and drive projects with what is running online | octoplant from AMDT (formerly versiondog and MDT AutoSave), FactoryTalk AssetCentre from Rockwell Automation | Mixed OT environments with many brands and controllers |
Version control has existed since SCCS in the early 1970s, followed by RCS (1982) and CVS (1986). Git was created in 2005 when the Linux kernel community lost its free licence for the commercial BitKeeper tool. It was designed for speed and for many parallel lines of development (branches).
🛠 What can you put under version control?
- PLC code - ladder diagram, Structured Text, function blocks according to IEC 61131
- SCADA and HMI projects - screens, alarm definitions, tags and recipes
- Firmware versions and settings of controllers, drives and field devices
- Network configurations - switch and firewall configurations, VLAN and fieldbus settings
- Scripts and automation code - Python, PowerShell, Ansible
- Documentation - functional specifications, I/O lists, test protocols for FAT and SAT
🔧 How does version control work with PLC and SCADA projects?
Git and SVN are built for text files. Many engineering tools, however, store projects as binary or compressed files. Git can store those, but it cannot show what changed inside the project. Vendors and users solve this in different ways:
| Platform | Approach to version control |
|---|---|
| Siemens TIA Portal | Multiuser Engineering for collaboration; Version Control Interface to export blocks as text/XML to an external tool such as Git |
| Rockwell Studio 5000 | Export to L5X (XML), comparison with the Compare tool; central management via FactoryTalk AssetCentre |
| Beckhoff TwinCAT 3 | Runs inside Visual Studio; project files are XML and can be managed directly in Git |
| CODESYS | Add-ons for Git and SVN inside the engineering environment |
| Vendor-neutral | PLCopen XML, standardised as IEC 61131-10, for exchange and comparison |
A second difference from IT: in OT someone can change a program directly in the controller, for example through online editing during a fault. Industrial version control tools therefore periodically upload the program from the controller automatically and compare it with the last released version. Any deviation triggers an alert.
🔐 What role does version control play in security and compliance?
Version control does not make you compliant on its own, but it provides evidence for requirements in several standards:
| Standard or regulation | Relevant requirement |
|---|---|
| ISO 9001:2015 | Clause 7.5.3.2 requires control of changes to documented information, citing version control as an example |
| ISO 27001:2022 | Annex A 8.4 (access to source code), 8.9 (configuration management) and 8.32 (change management) |
| IEC 62443-3-3 | SR 3.4 (software and information integrity), SR 7.3 (control system backup) and SR 7.6 (network and security configuration settings) |
| IEC 61511 | Changes to a SIS only through a planned and authorised management of change process |
| 21 CFR Part 11 (FDA) | §11.10(e): secure, computer-generated, time-stamped audit trails; a change must not obscure previously recorded information |
| EU GMP Annex 11 / GAMP 5 | Change and configuration management for validated systems; GAMP 5 Second Edition was published in July 2022 |
For security, version control is also a detection tool. Stuxnet, discovered in 2010, modified code on Siemens S7-315 and S7-417 controllers and hid those changes from the engineering station that read the code back. That is why a comparison that does not rely solely on a possibly compromised engineering station is valuable. After ransomware or a compromised supplier laptop, too, a trusted released version is the basis for disaster recovery and fast recovery. You therefore combine version control with backups, preferably stored as immutable backups.
📋 How do you set up version control in an OT environment?
- Inventory all controllers, HMIs, drives and network devices with their project files; use the asset inventory as the basis.
- Choose a central repository: Git for text-based code, an industrial tool for mixed brands and automatic comparison.
- Record a baseline: upload the current version from every controller and mark it as the starting point.
- Link it to change management: every check-in refers to a change request or work order.
- Schedule automatic comparisons: daily or weekly online versus released, and immediately after maintenance shutdowns.
- Restrict rights with RBAC: not everyone may release a version or download it to production.
- Test the restore: periodically load a version from the repository into a test controller or simulation.
For Dutch organisations covered by NIS2 (implemented in the Netherlands as the Cyberbeveiligingswet, in force since 15 August 2026), this supports the duty of care for security in the acquisition, development and maintenance of systems.
❓ Frequently asked questions
Can I use Git for PLC programs?
Yes, Git can store PLC programs, but with binary project files you only see that something changed, not what changed. Export the code to text or XML (such as L5X, PLCopen XML or TwinCAT XML) or use the version control interface of the engineering tool. Git’s comparison then works as intended.
What is the difference between version control and a backup?
A backup is a copy for restoring after loss or damage. Version control keeps the full history of who changed what, when and why, and shows the differences between versions. In OT you need both: version control for controlled changes and backups for recovery after an incident.
How do I detect changes made directly in the PLC?
You find changes made online in a PLC by periodically uploading the program from the controller and comparing it with the last released version. Industrial version control tools do this automatically on a schedule and report deviations. Some controllers also keep a change counter or checksum that you can monitor.
Is version control mandatory for GMP or FDA systems?
Regulations such as 21 CFR Part 11 and EU GMP Annex 11 do not prescribe a specific version control system. They do require demonstrable change and configuration management and reliable audit trails. In practice, version control is the usual way to provide that evidence for validated systems.
Who should have access to the repository?
Define repository access based on roles. Engineers can usually check in changes, but only designated people release a version for production. Suppliers should preferably get access only to their own project, through a controlled route.
📌 In summary
Version control records every change to PLC, SCADA, HMI and network configurations, makes differences visible and enables fast recovery. In OT that takes more than Git alone. You need tools that can handle vendors’ project files and that regularly compare what is actually running in the controller.
In OT, version control gives you demonstrable insight into which code drives your installation, who changed it and how to return quickly to a working version.