Soft PLC in 2026: Architecture, IEC 61131-3 Runtimes & Sourcing Notes
Share
Engineering Notes · Soft PLC · 2026 Update
By KOEED Engineering Desk · 2026-06-30 · 7 min read · Category: Engineering Notes
In 2026, a soft PLC — also called a virtual PLC or PC-based controller — is no longer a niche experiment. It runs an IEC 61131-3 runtime (CODESYS, PLCnext, Beckhoff TwinCAT, or Siemens S7-1500 Virtual Controller) on an industrial PC and exchanges real-time I/O over EtherCAT, PROFINET, or EtherNet/IP. This refresh of our 2024 primer walks engineers through what changed, how to size the host IPC, and which KOEED hardware keeps a soft-PLC cell alive in a brownfield line.
AI Summary
Key Takeaways
- A soft PLC is an IEC 61131-3 runtime hosted on an industrial PC, not a dedicated processor module.
- In 2026, leading stacks are CODESYS 3.5, Beckhoff TwinCAT 4, Phoenix Contact PLCnext, and Siemens S7-1500V.
- Real-time I/O is carried by EtherCAT, PROFINET IRT, or EtherNet/IP — the host IPC must be deterministic.
- Sizing rules: x86 quad-core, ECC RAM, SSD with power-loss protection, and a UPS-backed 24 V supply.
- Brownfield retrofits pair a soft PLC with a legacy Allen-Bradley or Siemens rack via fieldbus gateways.
A soft PLC replaces a hardware CPU with an IEC 61131-3 runtime on an industrial PC, trading fixed-scan silicon for flexible, software-defined control — ideal when you need open languages, PC visualization, or a quick brownfield gateway.
What is a soft PLC in 2026?
A soft PLC (also called a PC-based controller or virtual PLC) is the program-execution layer of a traditional controller, lifted off its proprietary processor and run as software on a commercial or industrial PC. The IEC 61131-3 languages (Ladder Diagram, Function Block Diagram, Structured Text, Instruction List, and Sequential Function Chart) and the scan-cycle semantics are preserved — only the host changes.
Modern stacks pair that runtime with a real-time operating system (RTOS) or a real-time hypervisor so the control loop is not starved by Windows updates or antivirus scans. The runtime owns the deterministic core; the host OS owns the HMI, the database, and the OPC UA server. That split is the heart of every 2026 architecture we deploy at KOEED customer sites.
How a soft PLC works — the 2026 stack
The execution chain is short and predictable:
- Field I/O — distributed terminals, drives, and valves — talk EtherCAT, PROFINET IRT, or EtherNet/IP.
- Real-time NIC / EtherCAT slave controller buffers the process image with microsecond timestamps.
- IEC 61131-3 runtime (CODESYS 3.5, TwinCAT 4, PLCnext, or S7-1500V) reads the process image, runs the user program on a deterministic core, and writes results back.
- Host OS layer (Windows 11 IoT, Linux RT, or hypervisor) hosts the HMI, the OPC UA server, and the database.
- Cloud / SCADA layer consumes data via MQTT or OPC UA.
> Tip
When you see a TwinCAT 3 or TwinCAT 4 license sold as “TC3 PLC” per runtime, you are looking at a soft PLC with a per-core or per-target license. In 2026 Beckhoff bundles many of these into the TF7000 system & TF6300 OPC UA modules, which is why retrofitters with one IPC often run two or three virtual PLCs side by side.
Soft PLC vs traditional PLC — a 2026 ledger view
| Dimension | Traditional PLC (e.g. Allen-Bradley 1756-L73) | Soft PLC (CODESYS / TwinCAT / PLCnext on IPC) |
|---|---|---|
| Hardware | Proprietary CPU module in a chassis | Industrial PC (x86 or ARM) |
| Languages | IEC 61131-3, vendor dialects | IEC 61131-3 + open C/C++, Python, MATLAB/Simulink |
| Determinism | Vendor-guaranteed scan jitter < 1 ms | RTOS / real-time NIC, jitter 10–100 µs typical |
| Lifecycle | Tied to vendor EOL — e.g. SLC 500 / 1747 EOL | Decoupled — runtime is portable; IPC can be replaced |
| Sourcing | One part number, one vendor | Runtime license + IPC + I/O terminals (multi-vendor) |
| Failure mode | Hot-spare chassis / redundant CPU | Dual IPC + real-time redundancy (e.g. Beckhoff TC3 redundancy) |
What changed since 2024
- Real-time Ethernet got cheaper. Multi-protocol NICs (EtherCAT + PROFINET IRT + EtherNet/IP) now ship on sub-$200 cards from Hilscher, KEYENCE-class gateways, and HMS Anybus. A 2024 retrofit that needed a $1,200 slave controller can now use the IPC's on-board Intel i226 NIC with a software stack.
- Virtual controllers from traditional vendors. Siemens released S7-1500 Virtual Controller (S7-1500V) with TIA Portal V20 in late 2025 — the first time a major PLC vendor shipped a true soft PLC as a first-class product, not a developer toy.
- Containerised runtimes. CODESYS 3.5.20 and PLCnext can run inside Docker / Balena containers on Linux RT hosts, so MES and ERP teams can co-deploy the same way they deploy any other microservice.
- Cybersecurity baseline. IEC 62443-3-3 SL2 is now expected for any cell shipped to a U.S. or EU automotive or pharma line. Soft PLCs make this easier (signed runtime, signed IPC firmware) but also make the attack surface bigger — treat the host OS as part of the safety case.
- AI co-processors on the IPC. An edge AI accelerator (Hailo-8, Coral, or iGPU) now sits next to the soft PLC runtime. Vision-guided quality checks run in the same box, talking OPC UA to the controller. See our AI Diagnostic Tool for a fault-code workflow that hooks this loop.
Sizing the industrial PC (2026 rules of thumb)
We keep a small reference list on the engineering desk — copy it into your spec sheet and you are 80% of the way to a working cell.
| Workload | CPU | RAM | Storage | RT NIC |
|---|---|---|---|---|
| Small machine (< 256 I/O) | Atom x6425E / Ryzen Embedded R1305G | 8 GB ECC | 128 GB industrial SSD | Intel i226 on-board |
| Mid cell (256–2,000 I/O) | Core i5 / i7 (13th gen) or Ryzen 7 | 16–32 GB ECC | 256 GB SSD + 1 TB mirrored | Hilscher cifX or Beckhoff FC1100 |
| Vision + control (AI on the same box) | Core i9 / Xeon + Hailo-8 or RTX A1000 | 32–64 GB ECC | 512 GB NVMe + 2 TB RAID1 | Dedicated EtherCAT master + GbE for vision |
! Warning
A consumer-grade SSD loses data on power dip. Specify a UPS (Phoenix Contact QUINT or Siemens SITOP UPS1600)
and an SSD with power-loss protection
(PLP). A corrupted project file on a brownfield restart is the single most common soft-PLC postmortem
we see at KOEED.
Brownfield patterns we see in 2026
Three patterns cover almost every soft-PLC retrofit our engineering desk quotes.
- Gateway in front of a legacy rack. A Beckhoff CX or a generic IPC running TwinCAT 3 talks PROFINET to a Siemens S7-300 IM, or EtherNet/IP to a ControlLogix 1756 chassis, and exposes the data to a modern SCADA via OPC UA. Zero rewiring, ten-year runway.
- Soft PLC replacing a bricked CPU. A Mitsubishi MELSEC-A or Omron C200H CPU died, the OEM is out of business, and the field I/O is intact. A CODESYS runtime on an industrial PC with a remote-I/O head station (e.g. Wago 750 series or Beckhoff EK1100) swaps in within a long weekend.
- Cell controller next to a CNC. A Fanuc 0i-MD or Schneider Modicon M340 is the workhorse, and a soft PLC on a panel-mounted IPC owns the surrounding robotics, vision, and conveyor logic. The CNC stays; the soft PLC is the integrator.
Sourcing the soft-PLC cell through KOEED
The runtime is software, but the cell is still 60% hardware. We keep stock of the pieces engineers ask for most often when they build or repair a soft-PLC line:
- Allen-Bradley ControlLogix and CompactLogix chassis for the legacy side of the retrofit.
- Siemens SIMATIC S7-1200 / S7-1500 CPUs and IM modules (PROFINET IRT partners).
- Mitsubishi MELSEC and Omron SYSMAC parts for older cells we still keep alive.
- Power supplies, fans, and UPS modules that the soft-PLC host IPC relies on.
- KEYENCE vision systems for the “AI on the same box” pattern.
Send the BOM to Moritta@KOEED.COM and we will reply with stock, lead time, and a quote within 24 hours.
Spec'ing a soft-PLC retrofit?
Send your BOM — soft-PLC host IPC, legacy rack, fieldbus gateways, UPS — and we will quote active stock, EOL stock, and cross-references in one email.
Send My BOM →Related on KOEED Blog
- Engineering Notes — weekly soft-PLC, EtherCAT, and PROFINET deep dives.
- Daily PLC News — vendor announcements and EOL alerts.
- PLC Error Code Database — Siemens / Mitsubishi / Omron fault lookup.
- Modbus CRC Calculator — validate soft-PLC to fieldbus frames.
- PLC Hex to Float Converter — IEEE 754 / Endianness helper for OPC UA tags.
KOEED Engineering Desk
Industrial automation editors at KOEED. We write about soft PLCs, EtherCAT, PROFINET, brownfield retrofits, and PLC cross-reference. Reach the team at Moritta@KOEED.COM .
Frequently asked questions
Is a soft PLC as reliable as a traditional PLC?
In a redundant configuration (dual IPC + real-time redundancy), a soft PLC meets the same availability targets as a high-end rack PLC, with MTBF figures in the 200,000-hour range. Single-IPC cells are not suitable for SIL2 / SIL3 paths — pair with a safety PLC or a safety I/O slice.
Which 2026 runtime should I pick — CODESYS, TwinCAT, PLCnext, or S7-1500V?
CODESYS 3.5 is the safe default for mixed-vendor cells. TwinCAT 4 is the right pick when you need ultra-low EtherCAT jitter and Beckhoff terminals. PLCnext suits Phoenix Contact ecosystems and open Linux deployments. S7-1500V is the path of least resistance for Siemens-only sites.
Can a soft PLC replace a bricked Allen-Bradley or Siemens CPU without rewiring?
Often yes, when the field I/O is on a PROFINET, EtherNet/IP, or DeviceNet head station. The soft PLC takes the fieldbus role, the legacy program is ported to IEC 61131-3, and the I/O mapping is rebuilt tag-by-tag. Plan a 2–5 day commissioning window.
What is the typical scan jitter for a 2026 soft PLC?
On a properly sized IPC with a dedicated EtherCAT master, jitter sits in the 10–50 microsecond band. Add Windows-side HMI and you may see occasional >100 µs spikes — isolate the HMI in a hypervisor guest if your application cannot tolerate them.
Does KOEED stock soft-PLC hardware and the legacy gear they replace?
Yes — industrial PCs, UPS modules, network cards, and the legacy Allen-Bradley, Siemens, Mitsubishi, Omron, Fanuc, Schneider, Yaskawa, Panasonic, and KEYENCE parts that show up in a soft-PLC retrofit BOM. Send the list to Moritta@KOEED.COM for a 24-hour quote.