PLC Software Composition: 2026 Engineering Notes on Firmware, OS, Runtime
Share
> AI Summary
- PLC software composition has three layers in 2026: firmware/runtime, operating system (RTOS or hypervisor), and user program authored in IEC 61131-3.
- Modern runtimes bundle OPC UA FX, TLS 1.3, signed firmware, and optional container sidecars alongside the IEC engine.
- Since 2024 the runtime layer has absorbed edge analytics, security stacks, and partial safety logic — user programs now ride a much richer OS than the bare scheduler of the 2010s.
- Picking firmware/hardware that match your existing user program is the single biggest factor in avoiding downtime during repairs and EOL migrations.
- KOEED keeps matched firmware revisions, CPUs, and I/O in stock across Allen-Bradley, Siemens, Mitsubishi, Omron and the rest of the nine-brand matrix.
A PLC's software stack is firmware plus RTOS plus your IEC 61131-3 user program. In 2026 the runtime carries OPC UA FX, security, and edge containers.
Engineering Notes · Firmware · Runtime · IEC 61131-3 · 2026
By KOEED Engineering Team · 2026-07-02 · 9 min read · Engineering Notes
Every modern controller ships with three software layers: the firmware/runtime, the operating system underneath it, and the user program you author in an IEC 61131-3 language. This 2026 engineering note rewrites the original 2024 article with the new runtime stack — OPC UA FX, signed firmware, container sidecars, and partial safety integration — and explains how to keep them aligned during repairs and migrations.
1. The three layers of PLC software composition
PLCs are deterministic controllers, but the software that runs them is no longer a single monolithic firmware blob. A 2026 controller stacks three distinct layers, each owned by a different team:
- Firmware / runtime — the vendor-shipped IEC 61131-3 execution engine, communication stacks (EtherNet/IP, PROFINET, Modbus TCP, OPC UA, OPC UA FX), web server, and security stack.
- Operating system — a real-time OS or hypervisor (vendor-tuned RTOS, Linux RT, or VxWorks) that schedules tasks, manages memory, and isolates the runtime from optional sidecar containers.
- User program — the application logic you write in an IEC 61131-3 language (LD, FBD, ST, SFC), compiled and downloaded to the controller.
This split is the modern definition of PLC software composition. The original 2024 article described a simpler model: operating system, programming software, and application software. That model still applies for narrative purposes, but the runtime layer in 2026 carries far more responsibility than a 2024 controller did.
> Tip
When you cross-reference a replacement CPU, always match the firmware major revision. A 1756-L73 running firmware v33 is not bit-identical to one running v34; OPC UA server behavior, scan jitter, and tag import latency all change.
2. What the firmware / runtime layer actually does
The runtime is the part engineers interact with most often without realizing it. It owns the IEC 61131-3 execution engine, the I/O scan, the deterministic task scheduler, and every communication server exposed by the controller. Vendor firmware updates in 2026 are cryptographically signed; unsigned firmware is rejected, so plan rollouts through vendor utilities rather than raw SD card copies.
On a 2026 premium CPU — for example a ControlLogix 1756-L8x, a SIMATIC S7-1500 with TIA Portal V19+, or a Mitsubishi iQ-R with the OPC UA server option — the runtime layer also boots an OCI container runtime so signed sidecars can run edge analytics, ML inference, or protocol translation alongside the IEC engine. This is the practical difference between a 2024 runtime and a 2026 runtime: the runtime has absorbed IIoT duties that used to live on a separate gateway PC.
3. What the operating system layer actually does
The OS layer is invisible to most application engineers, but it is what guarantees determinism. Modern PLCs run one of three OS architectures:
| OS architecture | Used by | 2026 implication |
|---|---|---|
| Vendor-tuned RTOS | CompactLogix, MicroLogix, Omron CP1/CJ2, Panasonic FP7 | Smallest footprint, no container sidecars, deterministic scan. |
| Linux RT (PREEMPT_RT) | SIMATIC S7-1500, KEYENCE CV-5000 vision controllers, Schneider M580 | Supports container sidecars and OPC UA FX publish/subscribe. |
| RT hypervisor | ControlLogix 1756-L8x, Yaskawa MP3300, Fanuc Series 31i-B | Runs IEC engine and a Linux guest for containers side by side. |
| VxWorks / proprietary RTOS | Mitsubishi MELSEC iQ-R, Fanuc CNC | Tightest determinism; sidecars limited to vendor-approved libraries. |
Knowing the OS architecture matters when you swap a CPU. A hypervisor-class replacement can run your existing user program unchanged but introduces new attack surface and a new update cadence. A vendor RTOS replacement is bit-for-bit compatible but offers no path to container analytics.
4. What the user program layer actually does
The user program is the application logic you author. It is project-based: a collection of programs (POUs), tags, tasks, I/O mappings, and HMI screens that perform the actual machine or process control. You can modify the user program at any time without touching firmware or the OS layer.
Most brands compile the user program into vendor bytecode or native code at download time. The runtime then executes it inside the IEC 61131-3 engine of the firmware layer. This is why a firmware update can change user-program behavior: the underlying task scheduler, memory model, or optimizer inside the runtime has changed. Pin the firmware revision in your project notes, export source under version control, and re-validate after every major firmware bump.
5. What changed since 2024
The original article published in March 2024 described PLC software composition as operating system + programming software + application software. In the 24 months since, the runtime layer has absorbed five new responsibilities:
- OPC UA FX as the default field-to-cloud bus. Where 2024 designs still leaned on MQTT brokers and proprietary protocols, 2026 reference architectures use OPC UA FX with publish/subscribe for PLC-to-PLC and PLC-to-cloud traffic. Most new CPUs from Siemens, Allen-Bradley, and Mitsubishi ship with OPC UA FX server licenses.
- TLS 1.3 and signed firmware. Vendor firmware updates in 2025-2026 are cryptographically signed; controllers reject unsigned images. Rollouts now go through vendor utilities (ControlFLASH, TIA Portal, GX Works) rather than raw SD card copies.
- Container sidecars on premium CPUs. Hypervisor-class controllers run signed OCI containers next to the IEC engine for analytics, ML inference, and protocol translation. CompactLogix and MicroLogix remain too small for sidecars; that line stays deterministic-only.
- Partial safety absorbed into the runtime. IEC 61508 SIL 2/3 safety logic used to demand a separate safety CPU. In 2026, several vendors integrate SIL-rated function blocks directly into the standard runtime with separate task scheduling, reducing hardware cost at the expense of clearer separation of concerns.
- PLCopen vendor-neutral POUs. PLCopen now publishes reusable function blocks for OPC UA, motion, and safety that compile across brands. Cross-brand reuse is finally practical at the POU level, not just at the wiring level.
! Warning
Hot-swapping a 1756 power supply without a UPS can corrupt the user program memory on the CPU. Always back up the .ACD project, verify the firmware revision on the side label, and confirm the replacement CPU is on the same major firmware as the failed one before bringing the chassis back online.
6. Composing the stack during a repair or migration
A software composition only works when all three layers agree. The most common cause of unplanned downtime in 2026 is mismatched firmware — a fresh CPU arrives with a newer firmware revision than the rest of the chassis, and the user program behaves subtly differently until the engineer notices scan jitter or a stale OPC UA tag.
Use the PLC Error Code Database to interpret faults after a firmware update, and the PLC Hex to Float Converter when scaling 4-20 mA loops during commissioning. For matched firmware / hardware bundles across Omron, Schneider, and the rest of the nine-brand matrix, KOEED keeps active and EOL stock side by side so you can replace in place without rewriting the user program.
Replacing a CPU, a chassis, or chasing an EOL firmware revision?
Send your BOM (CPU, I/O, firmware revision, OS expectations) to Moritta@KOEED.COM. Active stock, EOL stock, and matched firmware — one quote within 24 hours.
Create a Quote →Related on the KOEED blog
- Daily PLC News — firmware releases and restock alerts across Allen-Bradley, Siemens, Mitsubishi, Omron.
- Allen-Bradley collection — ControlLogix, CompactLogix, SLC 500 modules with matched firmware revisions.
- Siemens SIMATIC S7-1500 collection — TIA Portal V19+ CPUs that pair with OPC UA FX firmware.
- PLC Error Code Database — diagnose faults after a firmware update across nine brands.
- AI Diagnostic Tool — identify a CPU by nameplate photo and get a cross-reference within seconds.
- Contact KOEED — WhatsApp, email, and RFQ form, all in one place.
Frequently asked questions
What are the three layers of modern PLC software composition?
Firmware/runtime, OS (RTOS or hypervisor), and user program. The runtime carries OPC UA FX and the IEC engine; the OS guarantees determinism; the user program is your application.
How is a 2026 PLC runtime different from a 2024 PLC runtime?
It bundles OPC UA FX, TLS 1.3, signed firmware validation, and optional container sidecars for edge analytics. The IEC engine itself is largely unchanged; the surrounding services are much richer.
Why does the operating system layer matter when I replace a CPU?
A hypervisor-class replacement can run container sidecars; a vendor RTOS replacement cannot. Mixing OS classes changes attack surface, update cadence, and sidecar availability.
Does KOEED supply PLC firmware or runtime modules?
KOEED does not supply firmware, but we stock new, refurbished, and EOL CPUs across nine PLC brands for in-place repair and forward migration. Send BOM to Moritta@KOEED.COM for a quote.
What is the most common cause of downtime after a CPU swap in 2026?
Mismatched firmware. A fresh CPU often ships a newer revision than the chassis; the user program runs but scan jitter, OPC UA behavior, or tag import latency shift. Pin firmware in notes.
Are OPC UA FX and TLS 1.3 mandatory in 2026 reference designs?
OPC UA FX is the default field-to-cloud bus on most new Siemens, Allen-Bradley, and Mitsubishi CPUs. TLS 1.3 is mandatory for vendor firmware validation but optional for legacy traffic.
KOEED Engineering Team
Industrial automation editors at KOEED. Writes about PLC software composition, firmware lifecycle, cross-reference, and legacy system support. Reach the team at Moritta@KOEED.COM .