MES Software: Vendors, Features & Costs Compared 2026
MES software compared: vendors, functions per VDI 5600, costs (cloud vs. on-premise) and implementation. Honest market overview 2026.
A Programmable Logic Controller (PLC) — in German Speicherprogrammierbare Steuerung (SPS) — is an industrial computer that executes deterministic control logic in real time to drive sensors, actuators and machine sequences. PLCs sit at ISA-95 Level 1/2, run cyclic scan programs written in IEC 61131-3 languages, and form the control layer beneath SCADA (Level 2) and MES (Level 3).
PLCs are the reason a press stamps on time, a filler doses the right volume and a conveyor stops when a light barrier is broken. Across 15,000+ machines connected to the SYMESTIC Cloud MES in 18 countries, we see every generation of PLC in production — from Simatic S5 units installed in 1992 that still run a glass line, to brand-new S7-1500 controllers with native OPC UA servers. The control task has not changed. The way we get data out of them has.
PLCs are the most misunderstood layer of the ISA-95 stack because SCADA and MES often touch the same signals. The distinction is about scope, time horizon and responsibility.
| Dimension | PLC (L1/L2) | SCADA (L2) |
|---|---|---|
| Primary job | Execute deterministic control logic on I/O | Visualise and supervise plant-wide process state |
| Time horizon | Milliseconds, cyclic scan | Seconds, operator-facing |
| Data retention | Volatile — a handful of cycles | Hours to weeks in the historian |
| Who programs it | Automation engineer (IEC 61131-3) | Control system integrator |
| MES relationship | Data source for cycles, states, alarms | Parallel consumer, rarely the MES data path |
An MES (Level 3) sits above both. It takes the machine data the PLC produces, ties it to orders, materials, shifts and KPIs, and hands aggregated results to ERP at Level 4. A PLC will never calculate OEE correctly on its own because it has no concept of a production order.
Every PLC runs a cyclic scan: read all inputs, execute the user program, write all outputs, handle communication, repeat. A modern S7-1500 finishes that cycle in 1–10 ms. Cycle time determinism is what separates a PLC from a PC — the scan has to finish on time, every time, or the machine stops.
The user program is written in one of five IEC 61131-3 languages: Ladder Diagram (LD) for relay-replacement logic, Function Block Diagram (FBD) for graphical composition, Structured Text (ST) for anything with maths, Instruction List (IL, deprecated in the 2013 edition), and Sequential Function Chart (SFC) for step-based sequences. In a real plant you will see all of them mixed — often in the same project, because different generations of engineers added their parts over twenty years.
Safety-critical functions run on a separate fail-safe CPU or F-part of the same CPU, certified to IEC 61508 / IEC 61511. You do not mix normal logic with safety logic in the same block.
Three paths, in descending order of elegance. OPC UA is the modern default: every new Siemens, Beckhoff, Rockwell and Mitsubishi controller ships with an OPC UA server, and the MES client subscribes to tags. No PLC code change required, secure by default, and companion specifications like OPC UA for Machinery provide standardised models for OEE-relevant state.
Digital I/O gateways are the pragmatic answer for machines without network interfaces — a small device reads counter and state signals from the terminal strip or auxiliary contacts of a contactor. No PLC programming, no production stop. We use this pattern heavily on Simatic S5 equipment from the early 1990s that will never get an OPC UA server but still produces parts every three seconds.
Direct protocol access (S7 PUT/GET, Ethernet/IP, Modbus) is a last resort. It works, but it ties the MES to a vendor-specific stack and usually requires a developer to touch the PLC program.
Hard-earned lesson from a Simatic S5 line that outlived three IT managers: a customer with a 1993-vintage filling line told us connection was impossible — no Ethernet, no OPC server, no PLC engineer left who understood the code. We connected 22 digital signals from the existing terminal rail to a gateway: cycle pulse, emergency stop, three fault outputs, six product-type bits. No change to the S5 program, no downtime, two hours of wiring per machine. Within a week the customer had real cycle counts and stop reasons for a line they had treated as a black box for fifteen years. The principle: if the machine can light a lamp when something happens, the MES can read it. You almost never need to touch the PLC.
Across 15,000+ connected machines in 18 countries, roughly 60% of the PLC fleet speaks OPC UA natively, about 30% is reached via digital I/O gateways, and the remainder uses vendor-specific protocols. At Meleghy Automotive (6 plants, automotive forming and joining) the presses and joining cells expose order-relevant cycles via OPC UA and SPS alarm tags; the MES correlates them with SAP R3 orders via ABAP IDoc. At Carcoustics (500+ machines across 7 countries) the mixed injection-moulding, stamping and foaming fleet is connected through IXON IoT gateways speaking MQTT into Azure — a direct consequence of brownfield PLC diversity. At Klocke (pharma packaging, Weingarten), where a LAN retrofit was impossible, the entire site scaled in three weeks using digital I/O gateways straight off the terminal strips. In every case the PLC program stayed untouched.
What does PLC stand for?
PLC stands for Programmable Logic Controller. In German-speaking countries the same device is called an SPS — Speicherprogrammierbare Steuerung. The two terms are fully interchangeable and both refer to the ruggedised industrial computer that executes IEC 61131-3 control logic on a deterministic scan cycle.
Is a PLC the same as an industrial PC (IPC)?
No. A PLC is a deterministic real-time controller certified for continuous industrial duty, with hardened I/O, fail-safe variants and a guaranteed scan cycle. An IPC is a general-purpose PC in an industrial housing. Soft-PLCs (CODESYS, TwinCAT) blur the line, but even they rely on a real-time kernel to behave like a PLC.
PLC vs. DCS — what's the difference?
A DCS (Distributed Control System) is built for continuous process control across hundreds of analog loops, typically in chemical or power plants, with operator graphics and historian tightly integrated. A PLC is built for discrete, sequential and fast logic. Modern PACs (Programmable Automation Controllers) have erased much of the gap, but the use cases still differ.
Why doesn't the PLC just calculate OEE directly?
Because a PLC has no order context. It sees cycles and states, not what the line is producing or planned to produce. OEE needs ideal cycle time per SKU, good/bad counts, order boundaries and planned production time — all of which live in the MES layer above the PLC, not inside it.
Do I need to modify the PLC program to connect a new MES?
In 90% of the cases we implement, no. OPC UA servers read existing symbols without PLC code changes, and digital I/O gateways read physical signals from the terminal rail. Touching the PLC program is reserved for edge cases — usually when a customer wants to write data back to influence the sequence.
How long does a PLC typically stay in production?
Longer than most IT systems. Simatic S5 controllers from 1990 are still running. We see 20–30 year lifecycles routinely, which is exactly why brownfield connectivity matters more than greenfield standards. A retrofit strategy that depends on replacing the PLC fails before it starts.
How does SYMESTIC connect to a PLC?
By default via OPC UA for any controller that ships with a server (S7-1200/1500, Beckhoff, Rockwell with OPC UA, Mitsubishi MELSEC). For older equipment we deploy digital I/O gateways that read directly from terminal strips — no PLC code change, no production stop. Both paths feed the same cloud data model and the same production-metrics module.
MES software compared: vendors, functions per VDI 5600, costs (cloud vs. on-premise) and implementation. Honest market overview 2026.
OEE software captures availability, performance & quality automatically in real time. Vendor comparison, costs & case studies. 30-day free trial.
MES (Manufacturing Execution System): Functions per VDI 5600, architectures, costs and real-world results. With implementation data from 15,000+ machines.