The PLC that is only software: what a SoftPLC or virtual controller changes on a validated line

The design review for a new granulation suite is going well until the controller slide. The integrator proposes no PLC rack in the main panel. The control logic will run as a software runtime on a pair of industrial servers in the technical room, next to the SCADA, with remote I/O in the field cabinets. Cheaper hardware, one platform for three lines, and the same programming tool the automation team already knows.

The validation lead asks a simple question: what goes into the IQ as the controller? The automation engineer says the PLC project. The IT infrastructure manager says the virtual machine. The integrator says the runtime licence. Then somebody asks who will install the monthly operating system patches on those servers, and the room goes quiet for a while.

That silence is the subject of this article. A software or virtual controller is a sound technology, and in some plants a better one. But it moves the line between automation, IT and quality, and a GMP site has to redraw that line on paper before the purchase order, not after the first patch.

Three things that are all called a SoftPLC

The term has meant different things to different people for a long time, which is part of the confusion. A 2022 InTech feature by Steve Mustard and Pascal Girerd made a point worth keeping: once IEC 61131 separated the programming of a controller from the hardware it runs on, the runtime became a product of its own. The authors also noted that many controllers users think of as conventional PLCs are built on a SoftPLC runtime ported by the manufacturer. One of them works for a SoftPLC vendor, so the benefits they list (time to market, portability, easier upgrades) are best read as the vendor side of the argument.

On a site today, three different set-ups hide behind the word:

• A runtime inside a box. The controller looks and is bought like any PLC; the fact that its firmware is a ported runtime changes nothing for you. Qualification works as it always has.
• A runtime on an industrial PC. One dedicated PC, often with a real-time extension next to a general-purpose operating system, running the logic and sometimes the HMI. This is the classic SoftPLC, common on packaging and assembly machines.
• A virtual controller on shared infrastructure. The runtime is delivered as an application or a container and deployed onto generic servers or edge devices, several instances side by side. Siemens describes its SIMATIC S7-1500V as a hardware-independent controller “provided and deployed entirely via Industrial Edge”. CODESYS sells Virtual Control SL as a container image for x86 or ARM Linux devices, with any number of instances.

The 2022 article could not yet describe the third case, and it is the one that raises the real GMP questions.

The language standard moved on as well

The programming side is the stable part, though not unchanged. IEC 61131-3 reached its fourth edition on 22 May 2025. Its abstract covers structured text, ladder diagram and function block diagram, plus sequential function chart elements for structuring programs. The 2013 edition also listed Instruction List as one of its two textual languages; the 2025 one no longer does. If an old machine still carries IL code, that is now a migration item, not a style preference.

A shared language does not make a project portable. Libraries are vendor-specific, the I/O mapping is rebuilt, cycle times change and the communication blocks rarely survive the trip. Conformance helps the programmer read the code; it does not spare the site a test campaign.

Where the qualification boundary now sits

EU GMP Annex 11 already has the right sentence, in its principle: “The application should be validated; IT infrastructure should be qualified.” Its glossary defines IT infrastructure as the hardware and software, “such as networking software and operation systems”, that make it possible for the application to function. With a hardware PLC, nobody needed to think about that split: the vendor’s firmware and the rack were the infrastructure, and they rarely changed.

With a virtual controller, the infrastructure becomes a stack that changes on its own schedule, owned by people who may never have seen the process. The useful exercise is to name every layer, give it an owner and decide what evidence keeps it in a qualified state.

Determinism is something you build and then prove

The old objection to SoftPLCs was that a PC is not deterministic. The 2022 feature answered that real-time operating systems solve it, and they can, under conditions. The CODESYS Virtual Control SL datasheet lists them for real-time behaviour: the hardware, the BIOS settings, a real-time (RT-Preempt) Linux kernel and no graphical interface. Determinism is not shipped with the licence. It is a property of the whole stack your site assembles.

That turns it into an OQ question. A useful protocol does not stop at “the logic does what the specification says”. It measures the cycle time and its jitter under realistic load: other instances running, the historian polling, a backup job on the host, a burst of network traffic. It forces the watchdog to trip and records what the outputs do. Annex 11 asks for test scenarios that consider “error handling” (§4.7); on a virtual controller, losing the CPU time slot is an error to handle.

On a filling line the usual pattern is that nobody notices jitter until a reject gate fires a few milliseconds late on a fast conveyor, once in ten thousand containers. A hardware PLC on its own backplane rarely shows that. A virtual one on a busy host can, and the PQ is a poor place to find out.

The patch question nobody wants

Annex 11 §10 is short: “Any changes to a computerised system including system configurations should only be made in a controlled manner in accordance with a defined procedure.” It makes no exception for the operating system under a controller. So yes, a kernel patch on the host of a qualified virtual controller is a change to a GMP computerised system. The question is how heavy that change control has to be.

Sites that make this work decide it in advance. They define classes of infrastructure change, each with a pre-approved regression test run on a test host that mirrors production: the cycle-time and jitter measurement, the watchdog test, a restart, a check of the communication to the I/O and the SCADA. A routine security patch then follows a known, short path with recorded evidence. A kernel upgrade or a new hypervisor version takes the longer one. The logic behind deciding when a repair becomes a requalification is the same as for mechanical equipment, discussed in change control on qualified equipment.

The operating system’s lifecycle now belongs to the controller’s. The 2022 article listed Windows CE among the real-time platforms for SoftPLCs; Microsoft’s extended support for Windows Embedded Compact 2013, the last version, ended in October 2023. The same check applies to any Linux distribution or hypervisor: write its end-of-support date into the system description and the asset register on day one.

When the host fails

A hardware PLC fails rarely, alone, and is replaced by a spare from the stores. A virtual host that fails can take several controllers down at once, and the recovery depends on people and procedures outside the automation team. Annex 11 §16 expects provisions for continuity when a system supporting a critical process breaks down, with the time to bring them into use based on risk, “adequately documented and tested”.

For a virtual controller that means three things to specify and to test. What the remote I/O does when it loses its controller: hold last value, go to a defined safe state, or something set per channel. How long the failover to a second host really takes, measured, not read from a brochure. And what the operator sees and does in the meantime. These are degraded-mode tests in the same family as losing power or compressed air, covered in designing the degraded-mode tests of an OQ.

Safety functions need their own decision. CODESYS states that its Virtual Safe Control SL carries a SIL 3 certificate to IEC 61508 issued by TÜV Süd, purely in software. That may suit some machines. On most process plants the safety instrumented functions will stay on dedicated, separately qualified hardware for a long time, and nothing in a virtual project should quietly move them.

The attack surface comes with the convenience

The 2022 feature argued that choosing hardware and operating system independently lets a site choose them for security. True, and the controller also inherits every weakness of a general-purpose operating system: accounts, services, management interfaces. Whoever administers the hypervisor can stop, copy or replace the controller, and on many sites that team has never been trained on the process.

Siemens’ product page puts the convenience plainly: “With the virtual PLC, you can easily get your plant running again from anywhere.” Read by a GMP site, that sentence describes a remote access path into a controller, and it deserves the same scrutiny as any vendor connection. In practice:

• The host belongs to the control zone. The hypervisor management network is a conduit with its own rules, not a port on the office network.
• Administrator accounts on the host are controller accounts. Named, few, reviewed, and listed in the access procedure for the line.
• The management plane is logged and reviewed. Starting, stopping or migrating an instance is a GMP-relevant event and should leave a record someone reads.

Where to start: what to write into the URS

Most of the trouble disappears if the user requirements say it before the supplier answers. Lines worth having, each one testable:

1. The configuration items. The URS names the five layers and asks the supplier to state the version of each at delivery and how each is identified on site.
2. Real-time performance. A maximum cycle time and jitter for each task, measured under a defined load, with the measurement method agreed in advance.
3. Resource isolation. Reserved CPU cores and memory for each controller instance, and a rule that nothing else is added to the host without change control.
4. Behaviour on loss. The state of every output when the controller or the network to the I/O is lost, and the measured failover time where a second host exists.
5. Patching. Who supplies patches for each layer, within what time after release, with what regression evidence from the supplier, and who installs them.
6. Lifecycle and access. End-of-support dates of runtime, operating system and hypervisor; named accounts on every layer; remote access only through the site’s approved route.

When the box is still the right answer

A virtual controller makes sense where several lines share a platform, where the IT infrastructure team already runs qualified servers with a mature change process, and where the control is not millisecond-critical. Where none of that holds, a hardware PLC remains the better choice: a stand-alone skid, a machine bought in with its own controller, a fast motion or reject function, a site without round-the-clock infrastructure support. The cheapest hardware can turn into the most expensive qualification.

The decision is rarely technical in the end. It is about whether the site is organised to own a controller whose layers belong to three teams, and whether those teams will sit in the same change advisory board.

A virtual controller is still a controller. Name its layers, give each one an owner and a test, and it can be qualified like anything else.

References

• S. Mustard and P. Girerd, What You May Not Know About SoftPLCs, Automation Basics, ISA InTech, February 2022: isa.org (the feature this article starts from).
• IEC, IEC 61131-3:2025, Programmable controllers, Part 3: Programming languages, edition 4.0, 22 May 2025: webstore.iec.ch; previous edition (2013): webstore.iec.ch.
• European Commission, EudraLex Volume 4, Annex 11: Computerised Systems (2011), principle, §4.7, §10, §16 and glossary: health.ec.europa.eu.
• Siemens, SIMATIC S7-1500V, product page: siemens.com.
• CODESYS, CODESYS Virtual Control SL, product data sheet (2024): codesys.com; CODESYS Virtual Safe Control SL, data sheet: store.codesys.com.
• Microsoft, Windows Embedded Compact 2013, lifecycle: learn.microsoft.com.