# PLC Runtime Landscape & Support

A soft PLC is a **SoC + Linux + a software runtime + an IEC 61131-3 control app**
(see [PLC / SPS Projects](/guide/plc)).
The **runtime** is what defines the device — it provides the IEC engine, the
Modbus / OPC UA / EtherNet/IP servers, and the WebVisu. This page tracks the
runtime ecosystems Certifai may encounter.

We do **not** aim to support every runtime up front. Certifai supports the
**CODESYS family** today; everything else is a **watch-list** — when a customer
shows up using one, we add the parser/support for it then. The dynamic OT probe
(Modbus / OPC UA / EtherNet/IP) is **vendor-agnostic** and works regardless of
the runtime.

## Support status

| Status | Meaning |
| --- | --- |
| ✅ **Supported** | Static analysis works today (control-logic SAST + library/runtime SBOM + CVE). |
| 🟡 **Covered via CODESYS** | A rebranded CODESYS runtime — our CODESYS parsing applies (may need minor per-vendor tweaks). |
| 🔭 **Watch-list** | Own project format — we add a format parser when a customer needs it. The dynamic OT probe already applies. |
| 🧪 **Test-bench** | A free runtime we use to *reconstruct and dynamically test* a device (see epic: provision-and-test). |

## 1. CODESYS and rebranded CODESYS (the largest slice)

Much of the market licenses the CODESYS runtime and rebrands the IDE. If a
customer "doesn't use CODESYS", they often do — under another name.

| Product / vendor | Based on | Status |
| --- | --- | --- |
| **CODESYS** (3S-Smart Software Solutions) | CODESYS | ✅ Supported |
| Schneider **EcoStruxure Machine Expert** (ex-SoMachine) | CODESYS | 🟡 Covered via CODESYS |
| **WAGO** e!COCKPIT / PFC controllers | CODESYS | 🟡 Covered via CODESYS |
| **ABB** AC500 / Automation Builder | CODESYS | 🟡 Covered via CODESYS |
| **Bosch Rexroth** ctrlX / IndraLogic | CODESYS | 🟡 Covered via CODESYS |
| **Eaton** XSoft-CODESYS, **KEBA** KeStudio, Berghof, Kontron, Festo (CPX-E), IFM, Turck, … | CODESYS | 🟡 Covered via CODESYS |

## 2. Other embeddable IEC 61131-3 runtime toolkits

Same model as CODESYS (an OEM licenses a runtime + IDE and bakes it into a
device), but with **different project formats and libraries**.

| Toolkit | Vendor | Status |
| --- | --- | --- |
| **ProConOS / MULTIPROG** | Phoenix Contact / KW-Software | 🔭 Watch-list |
| **ISaGRAF** (also does IEC 61499) | Rockwell | 🔭 Watch-list |
| **straton** | COPA-DATA | 🔭 Watch-list |
| **logi.CAD** | logi.cals | 🔭 Watch-list |

## 3. Fully proprietary ecosystems (own runtime + IDE + protocols)

Static analysis here needs a **per-vendor project parser**; the **dynamic OT
probe still works** (they speak Modbus / OPC UA / EtherNet/IP, plus vendor
protocols like S7comm / CIP).

| Ecosystem | Vendor | Notes | Status |
| --- | --- | --- | --- |
| **TIA Portal / STEP 7** (S7-1200/1500), S7-1500 **Software Controller**, **Virtual PLC** | Siemens | Largest install base; the soft/virtual variants are Linux/container | 🔭 Watch-list |
| **Studio 5000** (ControlLogix / CompactLogix) | Rockwell / Allen-Bradley | Strong in North America | 🔭 Watch-list |
| **TwinCAT 3** | Beckhoff | Genuine PC-based control on Windows / TwinCAT-BSD; IEC 61131-3 **+ C++ + Simulink** | 🔭 Watch-list |
| **Automation Studio** | B&R (ABB) | Own Automation Runtime | 🔭 Watch-list |
| **GX Works** (MELSEC) | Mitsubishi | | 🔭 Watch-list |
| **Sysmac Studio** (NX / NJ) | Omron | | 🔭 Watch-list |
| **Proficy Machine Edition** (PACSystems) | Emerson / GE | | 🔭 Watch-list |

## 4. Linux-native / containerized soft-PLC (the direction of travel)

| Product | Vendor | Notes | Status |
| --- | --- | --- | --- |
| **PLCnext** | Phoenix Contact | Open, Linux-based; native runtime is eCLR (not CODESYS), but can also run CODESYS as an app | 🔭 Watch-list |
| **ctrlX** | Bosch Rexroth | Ubuntu-core, app-store model (CODESYS runtime inside) | 🟡 Covered via CODESYS |
| **Virtual PLC** / **CODESYS Virtual Control** | Siemens / CODESYS | Containerized PLCs (Docker / K8s) | 🟡 / 🔭 |

## 5. Open-source runtimes (free — our test-bench substrates)

Used to **reconstruct and dynamically test** a customer device without touching
their network (provision-and-test).

| Runtime | Standard | Notes | Status |
| --- | --- | --- | --- |
| **OpenPLC** | IEC 61131-3 | Modbus-centric, education/small automation; uses MatIEC | 🧪 Test-bench (current) |
| **Beremiz + MatIEC** | IEC 61131-3 | Fuller open-source IDE; compiles ST/IL → C. Natural fidelity step-up from OpenPLC | 🧪 Test-bench (candidate) |
| **Eclipse 4diac (FORTE)** | IEC **61499** | Distributed, event-driven — a *different paradigm* from 61131-3's scan cycle | 🔭 Watch-list |
| **ProView** | — | Open-source process control + SCADA | 🔭 Watch-list |

## How we add support for a new runtime

- **Static (SAST / SBOM):** needs a parser for that runtime's **project format**
  (and its library/package convention). This is the per-vendor work.
- **Dynamic (ICS probe / DAST):** already **vendor-agnostic** — it targets the
  device's OT ports and WebVisu, not the runtime's file format. So a brand-new
  ecosystem still gets dynamic coverage on day one.

::: tip Rule of thumb
Confirm whether a "non-CODESYS" controller is actually a **rebranded CODESYS**
runtime (Section 1) before assuming new work — most of the long tail is.
:::