Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Sharang ParnerkarandClaude Opus 4.8
|
c1e0a80f90 |
@@ -44,7 +44,6 @@ export default withMermaid(defineConfig({
|
||||
items: [
|
||||
{ text: 'Glossary', link: '/reference/glossary' },
|
||||
{ text: 'Tools & Scanners', link: '/reference/tools' },
|
||||
{ text: 'PLC Runtime Landscape', link: '/reference/plc-runtimes' },
|
||||
],
|
||||
},
|
||||
],
|
||||
|
||||
@@ -11,6 +11,72 @@ the control application *and* the device it runs on.
|
||||
| A device firmware image | Firmware SBOM / CVE (opt-in) |
|
||||
| A reachable endpoint (WebVisu, OPC UA) | DAST / pentest (opt-in) |
|
||||
|
||||
## Anatomy: a soft PLC is a SoC + Linux + runtime
|
||||
|
||||
A CODESYS controller is **not** a monolithic appliance like a classic Siemens
|
||||
S7. It is **PC-based ("soft") control** — commodity silicon running a
|
||||
general-purpose Linux, with a **software PLC runtime** as just another process:
|
||||
|
||||
| Classic PLC (e.g. Siemens S7) | Soft PLC (CODESYS-on-Yocto, OpenPLC-on-Raspbian) |
|
||||
| --- | --- |
|
||||
| Proprietary hardware + firmware | Commodity SoC (x86 / ARM) |
|
||||
| Proprietary OS | General-purpose Linux (a **Yocto** image, or Raspbian) |
|
||||
| Proprietary runtime | Software runtime (**CODESYS Control**, or OpenPLC) |
|
||||
| STEP7 / TIA project | IEC 61131-3 control app (ST / LD / FBD / SFC) |
|
||||
|
||||
Because of this, the device is built along **two independent tracks**, by
|
||||
different people, on different timelines, and shipped separately. It also
|
||||
inherits the **entire Linux / IT attack surface on top of** the OT / control
|
||||
one — which is exactly why a PLC/SPS target is treated as a **composite**:
|
||||
Certifai ingests one artifact per layer and scans each with the right pipeline.
|
||||
|
||||
```mermaid
|
||||
flowchart TB
|
||||
subgraph TA["Track A · Device platform — built by the hardware OEM / vendor"]
|
||||
direction LR
|
||||
A1["Yocto / OpenEmbedded<br/>BSP + RT kernel"] --> A2["Bake in the CODESYS<br/>Control for Linux runtime"] --> A3["bitbake → device image<br/>.wic / .tar + manifest"]
|
||||
end
|
||||
subgraph TB2["Track B · Control application — built by the machine builder / customer"]
|
||||
direction LR
|
||||
B1["CODESYS IDE<br/>ST / LD / FBD / SFC + WebVisu"] --> B2["Reference CODESYS +<br/>vendor libraries"] --> B3["Compile → download<br/>to device (gateway 11740)"]
|
||||
end
|
||||
|
||||
A3 --> DEV(["Running soft-PLC device<br/>SoC + Linux + runtime + control app<br/>Modbus · OPC UA · EtherNet/IP · WebVisu"])
|
||||
B3 --> DEV
|
||||
|
||||
subgraph CERT["What Certifai scans — one layer per artifact"]
|
||||
direction LR
|
||||
S1["Firmware layer<br/>FirmwareStatic · SBOM · CVE"]
|
||||
S2["Control-logic layer<br/>PLC SAST — ST + FBD/LD"]
|
||||
S3["Control-app SBOM<br/>libraries + runtime → CVE"]
|
||||
S4["Running layer<br/>ICS probe · DAST (WebVisu)"]
|
||||
end
|
||||
|
||||
A3 -. firmware image .-> S1
|
||||
B1 -. PLCopen XML / ST via git .-> S2
|
||||
B2 -. projectarchive (zip) .-> S3
|
||||
DEV -. live URL / provisioned .-> S4
|
||||
|
||||
classDef yocto fill:#fde68a,stroke:#b45309,color:#111
|
||||
classDef codesys fill:#bfdbfe,stroke:#1d4ed8,color:#111
|
||||
classDef dev fill:#e9d5ff,stroke:#7e22ce,color:#111
|
||||
classDef cert fill:#bbf7d0,stroke:#15803d,color:#111
|
||||
class A1,A2,A3 yocto
|
||||
class B1,B2,B3 codesys
|
||||
class DEV dev
|
||||
class S1,S2,S3,S4 cert
|
||||
```
|
||||
|
||||
::: tip Where Yocto fits
|
||||
Yocto is **Track A** — the *build system* for the device platform. It produces
|
||||
the Linux image and bakes in the CODESYS runtime, so it is the **firmware
|
||||
layer**, entirely separate from the control application. Hand it to Certifai as
|
||||
its own **firmware image** artifact (scanned by the firmware pipeline, not the
|
||||
PLC pipeline). The device OS need not be Yocto — Raspbian/Debian/Buildroot, or
|
||||
even an RTOS / bare-metal, are all possible — but Yocto is the common,
|
||||
product-grade industrial choice.
|
||||
:::
|
||||
|
||||
## Two ways to deliver the project
|
||||
|
||||
You can either **upload** the project when onboarding, or point Certifai at a
|
||||
|
||||
@@ -1,97 +0,0 @@
|
||||
# PLC Runtime Landscape & Support
|
||||
|
||||
A soft PLC is a **SoC + Linux + a software runtime + an IEC 61131-3 control app**
|
||||
(see [PLC / SPS Projects](/guide/plc)).
|
||||
The **runtime** is what defines the device — it provides the IEC engine, the
|
||||
Modbus / OPC UA / EtherNet/IP servers, and the WebVisu. This page tracks the
|
||||
runtime ecosystems Certifai may encounter.
|
||||
|
||||
We do **not** aim to support every runtime up front. Certifai supports the
|
||||
**CODESYS family** today; everything else is a **watch-list** — when a customer
|
||||
shows up using one, we add the parser/support for it then. The dynamic OT probe
|
||||
(Modbus / OPC UA / EtherNet/IP) is **vendor-agnostic** and works regardless of
|
||||
the runtime.
|
||||
|
||||
## Support status
|
||||
|
||||
| Status | Meaning |
|
||||
| --- | --- |
|
||||
| ✅ **Supported** | Static analysis works today (control-logic SAST + library/runtime SBOM + CVE). |
|
||||
| 🟡 **Covered via CODESYS** | A rebranded CODESYS runtime — our CODESYS parsing applies (may need minor per-vendor tweaks). |
|
||||
| 🔭 **Watch-list** | Own project format — we add a format parser when a customer needs it. The dynamic OT probe already applies. |
|
||||
| 🧪 **Test-bench** | A free runtime we use to *reconstruct and dynamically test* a device (see epic: provision-and-test). |
|
||||
|
||||
## 1. CODESYS and rebranded CODESYS (the largest slice)
|
||||
|
||||
Much of the market licenses the CODESYS runtime and rebrands the IDE. If a
|
||||
customer "doesn't use CODESYS", they often do — under another name.
|
||||
|
||||
| Product / vendor | Based on | Status |
|
||||
| --- | --- | --- |
|
||||
| **CODESYS** (3S-Smart Software Solutions) | CODESYS | ✅ Supported |
|
||||
| Schneider **EcoStruxure Machine Expert** (ex-SoMachine) | CODESYS | 🟡 Covered via CODESYS |
|
||||
| **WAGO** e!COCKPIT / PFC controllers | CODESYS | 🟡 Covered via CODESYS |
|
||||
| **ABB** AC500 / Automation Builder | CODESYS | 🟡 Covered via CODESYS |
|
||||
| **Bosch Rexroth** ctrlX / IndraLogic | CODESYS | 🟡 Covered via CODESYS |
|
||||
| **Eaton** XSoft-CODESYS, **KEBA** KeStudio, Berghof, Kontron, Festo (CPX-E), IFM, Turck, … | CODESYS | 🟡 Covered via CODESYS |
|
||||
|
||||
## 2. Other embeddable IEC 61131-3 runtime toolkits
|
||||
|
||||
Same model as CODESYS (an OEM licenses a runtime + IDE and bakes it into a
|
||||
device), but with **different project formats and libraries**.
|
||||
|
||||
| Toolkit | Vendor | Status |
|
||||
| --- | --- | --- |
|
||||
| **ProConOS / MULTIPROG** | Phoenix Contact / KW-Software | 🔭 Watch-list |
|
||||
| **ISaGRAF** (also does IEC 61499) | Rockwell | 🔭 Watch-list |
|
||||
| **straton** | COPA-DATA | 🔭 Watch-list |
|
||||
| **logi.CAD** | logi.cals | 🔭 Watch-list |
|
||||
|
||||
## 3. Fully proprietary ecosystems (own runtime + IDE + protocols)
|
||||
|
||||
Static analysis here needs a **per-vendor project parser**; the **dynamic OT
|
||||
probe still works** (they speak Modbus / OPC UA / EtherNet/IP, plus vendor
|
||||
protocols like S7comm / CIP).
|
||||
|
||||
| Ecosystem | Vendor | Notes | Status |
|
||||
| --- | --- | --- | --- |
|
||||
| **TIA Portal / STEP 7** (S7-1200/1500), S7-1500 **Software Controller**, **Virtual PLC** | Siemens | Largest install base; the soft/virtual variants are Linux/container | 🔭 Watch-list |
|
||||
| **Studio 5000** (ControlLogix / CompactLogix) | Rockwell / Allen-Bradley | Strong in North America | 🔭 Watch-list |
|
||||
| **TwinCAT 3** | Beckhoff | Genuine PC-based control on Windows / TwinCAT-BSD; IEC 61131-3 **+ C++ + Simulink** | 🔭 Watch-list |
|
||||
| **Automation Studio** | B&R (ABB) | Own Automation Runtime | 🔭 Watch-list |
|
||||
| **GX Works** (MELSEC) | Mitsubishi | | 🔭 Watch-list |
|
||||
| **Sysmac Studio** (NX / NJ) | Omron | | 🔭 Watch-list |
|
||||
| **Proficy Machine Edition** (PACSystems) | Emerson / GE | | 🔭 Watch-list |
|
||||
|
||||
## 4. Linux-native / containerized soft-PLC (the direction of travel)
|
||||
|
||||
| Product | Vendor | Notes | Status |
|
||||
| --- | --- | --- | --- |
|
||||
| **PLCnext** | Phoenix Contact | Open, Linux-based; native runtime is eCLR (not CODESYS), but can also run CODESYS as an app | 🔭 Watch-list |
|
||||
| **ctrlX** | Bosch Rexroth | Ubuntu-core, app-store model (CODESYS runtime inside) | 🟡 Covered via CODESYS |
|
||||
| **Virtual PLC** / **CODESYS Virtual Control** | Siemens / CODESYS | Containerized PLCs (Docker / K8s) | 🟡 / 🔭 |
|
||||
|
||||
## 5. Open-source runtimes (free — our test-bench substrates)
|
||||
|
||||
Used to **reconstruct and dynamically test** a customer device without touching
|
||||
their network (provision-and-test).
|
||||
|
||||
| Runtime | Standard | Notes | Status |
|
||||
| --- | --- | --- | --- |
|
||||
| **OpenPLC** | IEC 61131-3 | Modbus-centric, education/small automation; uses MatIEC | 🧪 Test-bench (current) |
|
||||
| **Beremiz + MatIEC** | IEC 61131-3 | Fuller open-source IDE; compiles ST/IL → C. Natural fidelity step-up from OpenPLC | 🧪 Test-bench (candidate) |
|
||||
| **Eclipse 4diac (FORTE)** | IEC **61499** | Distributed, event-driven — a *different paradigm* from 61131-3's scan cycle | 🔭 Watch-list |
|
||||
| **ProView** | — | Open-source process control + SCADA | 🔭 Watch-list |
|
||||
|
||||
## How we add support for a new runtime
|
||||
|
||||
- **Static (SAST / SBOM):** needs a parser for that runtime's **project format**
|
||||
(and its library/package convention). This is the per-vendor work.
|
||||
- **Dynamic (ICS probe / DAST):** already **vendor-agnostic** — it targets the
|
||||
device's OT ports and WebVisu, not the runtime's file format. So a brand-new
|
||||
ecosystem still gets dynamic coverage on day one.
|
||||
|
||||
::: tip Rule of thumb
|
||||
Confirm whether a "non-CODESYS" controller is actually a **rebranded CODESYS**
|
||||
runtime (Section 1) before assuming new work — most of the long tail is.
|
||||
:::
|
||||
Reference in New Issue
Block a user