Open PLC Architecture in 2026: CODESYS, PLCnext, OPC UA & Sourcing
Share
Engineering Notes · Open PLC · 2026 Update
By KOEED Engineering Desk · 2026-06-30 · 8 min read · Category: Engineering Notes
An open PLC in 2026 is no longer a thought experiment. It is an IEC 61131-3 controller whose firmware, runtime, and fieldbus stack come from a vendor-neutral ecosystem — CODESYS 3.5, Phoenix Contact PLCnext, or the open-source Beremiz / OpenPLC projects — and which speaks OPC UA, PROFINET, EtherNet/IP, and EtherCAT on the same CPU. This refresh of our 2024 primer walks engineers through the design pillars, what changed since the first wave of open controllers, and how to source the hardware that holds an open-PLC cell together.
AI Summary
Key Takeaways
- An open PLC is an IEC 61131-3 controller with a vendor-neutral runtime, hardware spec, and fieldbus stack.
- In 2026, the leading open ecosystems are CODESYS 3.5, Phoenix Contact PLCnext, Siemens SIMATIC AX, and OpenPLC / Beremiz.
- OPC UA over TSN is the backbone for interoperability with Siemens, Allen-Bradley, and Mitsubishi racks.
- Cybersecurity moved from optional to mandatory — IEC 62443-3-3 SL2 is the 2026 baseline for OT cells.
- KOEED keeps multi-brand PLC parts in stock so open-PLC retrofits never stall on a missing module.
An open PLC decouples the IEC 61131-3 runtime from a single vendor, giving engineers freedom of language, fieldbus, and lifecycle — at the cost of designing the integration themselves.
What is an open PLC in 2026?
An open PLC is a programmable logic controller whose firmware, runtime, programming toolchain, and fieldbus stacks are built on publicly documented interfaces. The same IEC 61131-3 program (Ladder Diagram, Function Block Diagram, Structured Text) runs on hardware from multiple vendors, often with a community- supported or commercially licensed runtime that can be ported to a new CPU in a single build cycle.
The 2026 definition has tightened around three pillars:
- Open runtime — CODESYS 3.5, PLCnext, or OpenPLC / Beremiz execute the IEC 61131-3 program.
- Open fieldbus — OPC UA, PROFINET, EtherNet/IP, EtherCAT, MQTT, and Modbus TCP are first-class citizens, not vendor-locked add-ons.
- Open lifecycle — firmware, schematics, and BOM are documented, so the controller is not orphaned when the original vendor exits the market.
Compare that to a 2010-era proprietary PLC: locked firmware, single-vendor programming tool, paid software upgrades every three years, and a five-year EOL notice. The shift is not philosophical — it is a procurement and lifecycle decision, and KOEED sees more open-PLC retrofits in customer BOMs every quarter.
Design pillars of an open PLC
A serious 2026 open-PLC design rests on four engineering pillars. None of them is novel on its own, but the combination is what makes a controller defensible in a brownfield retrofit.
| Pillar | What it delivers | 2026 implementation |
|---|---|---|
| IEC 61131-3 runtime | LD / FBD / ST / IL / SFC, multi-vendor portability | CODESYS 3.5.20, PLCnext 2025.x, OpenPLC v3 |
| Vendor-neutral fieldbus | PROFINET, EtherNet/IP, EtherCAT, Modbus TCP | OPC UA over TSN as the interoperability backbone |
| Cybersecurity | Signed firmware, role-based access, audit trail | IEC 62443-3-3 SL2 baseline, TLS 1.3 on every UA endpoint |
| Open hardware spec | Schematics, BOM, firmware source | PLCnext AXC, Wago PFC200, Revolution Pi, BeagleBone AI-64 |
> Tip
When you compare a CODESYS-based PLC to a proprietary Siemens S7-1500, the IEC 61131-3 program moves between them with minimal rework. The cost is that you give up the vendor's diagnostics ecosystem — invest in a fault-code workflow of your own.
What changed since 2024
- OPC UA over TSN became the interoperability backbone. In 2024 most cells still used fieldbus gateways. In 2026 a single TSN-converged switch carries PROFINET, EtherNet/IP, and OPC UA on the same wire, and an open PLC sits next to an Allen-Bradley ControlLogix or SIMATIC rack without protocol translation.
- Containerised IEC 61131-3 runtimes. CODESYS 3.5.20 and PLCnext now ship as Docker images, so an open PLC can run side-by-side with a vision pipeline or an MQTT broker on the same industrial PC.
- OpenPLC and Beremiz matured for industrial use. OpenPLC v3 (released 2025) added deterministic task scheduling, and Beremiz gained a maintained HMI toolchain — both remain free for evaluation, with commercial support contracts for production cells.
- Cybersecurity went from optional to mandatory. IEC 62443-3-3 SL2 is now the procurement baseline for any U.S. or EU automotive, pharma, or food line. Open PLCs need signed firmware, role-based access, and a documented patch cadence — the same paperwork a vendor PLC ships with.
- AI co-processors on the same board. The Revolution Pi and BeagleBone AI-64 generations integrate a NPU on the PLC carrier. Vision-guided quality checks now run in the same enclosure as the IEC 61131-3 program and publish to KOEED's AI Diagnostic Tool workflow.
Reference architectures we see in 2026
Three open-PLC patterns cover most of the BOMs our engineering desk quotes.
- Open PLC alongside a legacy rack. A CODESYS runtime on a PLCnext AXC or a Wago PFC200 talks OPC UA to a ControlLogix 1756 chassis or a SIMATIC S7-1500 CPU. The legacy program keeps running; the open PLC owns the new analytics, the AI inference, and the cloud uplink.
- Open PLC replacing an orphaned CPU. A Mitsubishi MELSEC-A or Omron C200H CPU is end-of-life, the field I/O is on a healthy remote-I/O head station, and the new controller is an open PLC. The IEC 61131-3 program is ported, the I/O mapping is rebuilt tag-by-tag, and the cell comes back online in a long weekend.
- Open PLC as the cell controller next to a CNC or robot. A Fanuc 0i-MD or Schneider Modicon M340 runs the workhorse, and an open PLC on a Revolution Pi owns the surrounding conveyor, vision, and safety logic. The CNC stays; the open PLC is the integrator.
Sourcing the open-PLC cell through KOEED
An open PLC is software-defined, but the cell around it is still 60% hardware. We keep stock of the pieces engineers ask for most often when they build or repair an open-PLC line:
- Allen-Bradley ControlLogix and CompactLogix chassis for the legacy side of the retrofit.
- Siemens SIMATIC S7-1200 / S7-1500 CPUs and IM modules (PROFINET partners).
- Mitsubishi MELSEC and Omron SYSMAC parts for older cells we still keep alive.
- Power supplies, fans, and UPS modules that the open-PLC host carrier relies on.
- KEYENCE vision systems for the "AI on the same carrier" pattern.
Send the BOM to Moritta@KOEED.COM and we will reply with stock, lead time, and a quote within 24 hours.
! Warning
"Open" does not mean "free of cybersecurity duty." An open-PLC retrofit still needs signed firmware, role-based access on the engineering workstation, and a documented patch cadence. Plan the security paperwork before the commissioning weekend, not after.
Spec'ing an open-PLC retrofit?
Send your BOM — open-PLC carrier, legacy rack, fieldbus gateways, UPS — and we will quote active stock, EOL stock, and cross-references in one email.
Send My BOM →Related on KOEED Blog
- Engineering Notes — weekly open-PLC, OPC UA, and PROFINET deep dives.
- Daily PLC News — vendor announcements and EOL alerts.
- PLC Error Code Database — Siemens / Mitsubishi / Omron fault lookup.
- Modbus CRC Calculator — validate open-PLC to fieldbus frames.
- PLC Hex to Float Converter — IEEE 754 / Endianness helper for OPC UA tags.
- Soft PLC in 2026 — sister primer on PC-based controllers.
KOEED Engineering Desk
Industrial automation editors at KOEED. We write about open PLCs, OPC UA over TSN, brownfield retrofits, and PLC cross-reference. Reach the team at Moritta@KOEED.COM .
Frequently asked questions
Is an open PLC as reliable as a vendor PLC?
In a redundant configuration (dual carrier + OPC UA redundancy), an open PLC meets the same availability targets as a high-end rack PLC, with MTBF figures in the 150,000-hour range. Single-carrier cells are not suitable for SIL2 / SIL3 paths — pair with a safety PLC or a safety I/O slice.
Which 2026 open-PLC runtime should I pick — CODESYS, PLCnext, or OpenPLC?
CODESYS 3.5 is the safe default for mixed-vendor cells and is widely supported on Phoenix Contact, Wago, and Beckhoff carriers. PLCnext is the right pick when you need open Linux and Python alongside IEC 61131-3. OpenPLC v3 suits low-cost retrofits and academic pilots — go commercial support for production cells.
Can an open PLC replace a bricked Allen-Bradley or Siemens CPU without rewiring?
Often yes, when the field I/O is on a PROFINET, EtherNet/IP, or remote-I/O head station. The open PLC takes the fieldbus role via OPC UA, the legacy program is ported to IEC 61131-3, and the I/O mapping is rebuilt tag-by-tag. Plan a 2–5 day commissioning window.
What is the cybersecurity baseline for an open PLC in 2026?
IEC 62443-3-3 SL2 is the procurement baseline for any U.S. or EU automotive, pharma, or food line. That means signed firmware, role-based access on the engineering workstation, TLS 1.3 on every OPC UA endpoint, and a documented patch cadence — the same paperwork a vendor PLC ships with.
Does KOEED stock open-PLC hardware and the legacy gear they replace?
Yes — power supplies, UPS modules, network cards, and the legacy Allen-Bradley, Siemens, Mitsubishi, Omron, Fanuc, Schneider, Yaskawa, Panasonic, and KEYENCE parts that show up in an open-PLC retrofit BOM. Send the list to Moritta@KOEED.COM for a 24-hour quote.
What is OPC UA over TSN and why does it matter for open PLCs?
OPC UA over TSN is a deterministic Ethernet backbone carrying information models and alarms. For open PLCs it is the interoperability layer that lets mixed-vendor controllers exchange structured data without protocol gateways.