5.3 KiB
PLC Runtime Landscape & Support
A soft PLC is a SoC + Linux + a software runtime + an IEC 61131-3 control app (see PLC / SPS Projects). The runtime is what defines the device — it provides the IEC engine, the Modbus / OPC UA / EtherNet/IP servers, and the WebVisu. This page tracks the runtime ecosystems Certifai may encounter.
We do not aim to support every runtime up front. Certifai supports the CODESYS family today; everything else is a watch-list — when a customer shows up using one, we add the parser/support for it then. The dynamic OT probe (Modbus / OPC UA / EtherNet/IP) is vendor-agnostic and works regardless of the runtime.
Support status
| Status | Meaning |
|---|---|
| ✅ Supported | Static analysis works today (control-logic SAST + library/runtime SBOM + CVE). |
| 🟡 Covered via CODESYS | A rebranded CODESYS runtime — our CODESYS parsing applies (may need minor per-vendor tweaks). |
| 🔭 Watch-list | Own project format — we add a format parser when a customer needs it. The dynamic OT probe already applies. |
| 🧪 Test-bench | A free runtime we use to reconstruct and dynamically test a device (see epic: provision-and-test). |
1. CODESYS and rebranded CODESYS (the largest slice)
Much of the market licenses the CODESYS runtime and rebrands the IDE. If a customer "doesn't use CODESYS", they often do — under another name.
| Product / vendor | Based on | Status |
|---|---|---|
| CODESYS (3S-Smart Software Solutions) | CODESYS | ✅ Supported |
| Schneider EcoStruxure Machine Expert (ex-SoMachine) | CODESYS | 🟡 Covered via CODESYS |
| WAGO e!COCKPIT / PFC controllers | CODESYS | 🟡 Covered via CODESYS |
| ABB AC500 / Automation Builder | CODESYS | 🟡 Covered via CODESYS |
| Bosch Rexroth ctrlX / IndraLogic | CODESYS | 🟡 Covered via CODESYS |
| Eaton XSoft-CODESYS, KEBA KeStudio, Berghof, Kontron, Festo (CPX-E), IFM, Turck, … | CODESYS | 🟡 Covered via CODESYS |
2. Other embeddable IEC 61131-3 runtime toolkits
Same model as CODESYS (an OEM licenses a runtime + IDE and bakes it into a device), but with different project formats and libraries.
| Toolkit | Vendor | Status |
|---|---|---|
| ProConOS / MULTIPROG | Phoenix Contact / KW-Software | 🔭 Watch-list |
| ISaGRAF (also does IEC 61499) | Rockwell | 🔭 Watch-list |
| straton | COPA-DATA | 🔭 Watch-list |
| logi.CAD | logi.cals | 🔭 Watch-list |
3. Fully proprietary ecosystems (own runtime + IDE + protocols)
Static analysis here needs a per-vendor project parser; the dynamic OT probe still works (they speak Modbus / OPC UA / EtherNet/IP, plus vendor protocols like S7comm / CIP).
| Ecosystem | Vendor | Notes | Status |
|---|---|---|---|
| TIA Portal / STEP 7 (S7-1200/1500), S7-1500 Software Controller, Virtual PLC | Siemens | Largest install base; the soft/virtual variants are Linux/container | 🔭 Watch-list |
| Studio 5000 (ControlLogix / CompactLogix) | Rockwell / Allen-Bradley | Strong in North America | 🔭 Watch-list |
| TwinCAT 3 | Beckhoff | Genuine PC-based control on Windows / TwinCAT-BSD; IEC 61131-3 + C++ + Simulink | 🔭 Watch-list |
| Automation Studio | B&R (ABB) | Own Automation Runtime | 🔭 Watch-list |
| GX Works (MELSEC) | Mitsubishi | 🔭 Watch-list | |
| Sysmac Studio (NX / NJ) | Omron | 🔭 Watch-list | |
| Proficy Machine Edition (PACSystems) | Emerson / GE | 🔭 Watch-list |
4. Linux-native / containerized soft-PLC (the direction of travel)
| Product | Vendor | Notes | Status |
|---|---|---|---|
| PLCnext | Phoenix Contact | Open, Linux-based; native runtime is eCLR (not CODESYS), but can also run CODESYS as an app | 🔭 Watch-list |
| ctrlX | Bosch Rexroth | Ubuntu-core, app-store model (CODESYS runtime inside) | 🟡 Covered via CODESYS |
| Virtual PLC / CODESYS Virtual Control | Siemens / CODESYS | Containerized PLCs (Docker / K8s) | 🟡 / 🔭 |
5. Open-source runtimes (free — our test-bench substrates)
Used to reconstruct and dynamically test a customer device without touching their network (provision-and-test).
| Runtime | Standard | Notes | Status |
|---|---|---|---|
| OpenPLC | IEC 61131-3 | Modbus-centric, education/small automation; uses MatIEC | 🧪 Test-bench (current) |
| Beremiz + MatIEC | IEC 61131-3 | Fuller open-source IDE; compiles ST/IL → C. Natural fidelity step-up from OpenPLC | 🧪 Test-bench (candidate) |
| Eclipse 4diac (FORTE) | IEC 61499 | Distributed, event-driven — a different paradigm from 61131-3's scan cycle | 🔭 Watch-list |
| ProView | — | Open-source process control + SCADA | 🔭 Watch-list |
How we add support for a new runtime
- Static (SAST / SBOM): needs a parser for that runtime's project format (and its library/package convention). This is the per-vendor work.
- Dynamic (ICS probe / DAST): already vendor-agnostic — it targets the device's OT ports and WebVisu, not the runtime's file format. So a brand-new ecosystem still gets dynamic coverage on day one.
::: tip Rule of thumb Confirm whether a "non-CODESYS" controller is actually a rebranded CODESYS runtime (Section 1) before assuming new work — most of the long tail is. :::