PLC Program / Project Export File

Machine-format PLC program and project exports: Rockwell Studio 5000 / RSLogix 5000 L5X (RSLogix5000Content XML) and L5K (IE_VER text) files, Siemens TIA Portal Openness block XML (Document / Engineering version / SW.Blocks), and Schneider Control Expert / Unity Pro XEF exchange files (FEFExchangeFile). A populated export carries the controller model, network addresses, I/O modules, tags and control logic of a production control system.

Type: regex
Engine: boost_regex
Confidence: high
Confidence justification: High: every enforce tier needs vendor-specific export markup (RSLogix5000Content root with a Controller ProcessorType, IE_VER plus CONTROLLER ProcessorType, SW.Blocks plus the Openness namespace, FEFExchangeFile plus the Schneider fileHeader) that does not occur in ordinary prose. Residual false positives are parser-library fixtures, Add-On Instruction library exports and blog posts quoting exports. 85/75 are heuristic evidence tiers, not measured accuracy; test values are synthetic fragments shaped like published sample exports.
Jurisdictions: global
Regulations: Security of Critical Infrastructure Act 2018 (Cth), Directive (EU) 2022/2555 (NIS2)
Frameworks: IEC 62443, NIST CSF, AESCSF, ISO 27001
Data categories: infrastructure, technology, intellectual-property
Scope: narrow
Risk rating: 9
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Unsupported

Pattern

<RSLogix5000Content\s+SchemaRevision="\d{1,2}\.\d{1,2}"|\bIE_VER\s*:=\s*\d{1,2}\.\d{1,2}\s*;|<FEFExchangeFile>|<SW\.Blocks\.(?:FB|FC|OB|DB)\s+ID="\d{1,6}"|<Engineering\s+version="V\d{2}(?:\.\d)?"

Corroborative evidence keywords

ProcessorType, CatalogNumber, RLLContent, Rung, CompileUnit, ProgrammingLanguage, IOConf, partNumber, commParameters

Proximity: 1000 characters

Should match

<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <RSLogix5000Content SchemaRevision="1.0" SoftwareRevision="33.01" TargetName="WTP_FILTER_PLC01" TargetType="Controller" ContainsContext="false" ExportDate="Tue Mar 03 09:12:40 2026" ExportOptions="NoRawData L5KData DecoratedData ForceProtectedEncoding AllProjDocTrans"> <Controller Use="Target" Name="WTP_FILTER_PLC01" ProcessorType="1756-L83E" MajorRev="33" MinorRev="11" ProjectSN="16#0000_0000"> <Modules> <Module Name="ENET_A" CatalogNumber="1756-EN2T" Vendor="1" ProductType="12" Major="11" Minor="1" ParentModule="Local" ParentModPortId="1"> <Ports> <Port Id="2" Address="10.31.8.21" Type="Ethernet" Upstream="false"/> </Ports> </Module> — 85 - L5X controller export with ProcessorType, Ethernet module and Port IP address
<RSLogix5000Content SchemaRevision="1.0" SoftwareRevision="35.00" TargetName="PS07_BOOSTER" TargetType="Controller" ContainsContext="false" ExportDate="Wed Apr 08 14:02:11 2026"> <Controller Use="Target" Name="PS07_BOOSTER" ProcessorType="5069-L320ER" MajorRev="35" MinorRev="11"> <RedundancyInfo Enabled="false" KeepTestEditsOnSwitchOver="false"/> <Security Code="0" ChangesToDetect="16#ffff_ffff_ffff_ffff"/> — 75 - L5X root plus Controller ProcessorType only
<Routine Name="MainRoutine" Type="RLL"> <RLLContent> <Rung Number="0" Type="N"> <Text><![CDATA[XIC(Pump1_Run_Cmd)XIO(Pump1_Fault)OTE(Pump1_Start);]]></Text> </Rung> <Rung Number="1" Type="N"> <Text><![CDATA[XIC(Wet_Well_High)TON(Pump2_Delay,?,?)OTL(Pump2_Start);]]></Text> </Rung> — 75 - L5X routine export with rungs and ladder instruction text (no controller context)
IE_VER := 2.25; CONTROLLER RES04_OUTLET (ProcessorType := "1769-L33ER", Major := 32, TimeSlice := 20) DATATYPE ValveStatus (FamilyType := NoFamily) BOOL Open; BOOL Closed; END_DATATYPE — 85 - L5K text export with IE_VER, CONTROLLER ProcessorType and a DATATYPE block
<SW.Blocks.FB ID="0"> <AttributeList> <Interface> <Sections xmlns="http://www.siemens.com/automation/Openness/SW/Interface/v4"> <Section Name="Input"><Member Name="Level_PV" Datatype="Real" /></Section> <Section Name="Static"><Member Name="Dosing_Pump" Datatype=""PumpCtrl"" /></Section> </Sections> </Interface> <Name>ChlorineDosing</Name> <Number>12</Number> <ProgrammingLanguage>LAD</ProgrammingLanguage> </AttributeList> — 85 - TIA Portal Openness FB export with Interface namespace and ProgrammingLanguage
<?xml version="1.0" encoding="utf-8"?> <Document> <Engineering version="V17" /> <DocumentInfo> <Created>2026-02-11T03:14:22.1180440Z</Created> <ExportSetting>WithDefaults</ExportSetting> <InstalledProducts> <Product> <DisplayName>Totally Integrated Automation Portal</DisplayName> <DisplayVersion>V17 Update 6</DisplayVersion> — 75 - TIA Openness document header with Engineering version and Created timestamp
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <FEFExchangeFile> <fileHeader company="Schneider Automation" product="Control Expert XL V15.3 - 230620" dateTime="date_and_time#2026-5-14-10:02:31" content="Project source file" DTDVersion="41"></fileHeader> <contentHeader name="STP_INLET_WORKS" version="1.4.2" dateTime="date_and_time#2026-5-14-10:01:55"></contentHeader> <commParameters> <PLCAddress address="192.168.60.10" media="TCPIP" nbTries="3" timeout="3000"></PLCAddress> </commParameters> <IOConf> <PLC autoRun="false"> <partItem family="Modicon M580" partNumber="BMEP582040" vendorName="Schneider Automation" version="03.10"></partItem> — 85 - Schneider XEF with fileHeader, PLCAddress and IOConf partItem

Should not match

Logix 5000 Controllers Import/Export Reference Manual (1756-RM014). The RSLogix5000Content element is the root of an L5X file; its TargetType attribute identifies the exported component, and the Controller element carries the ProcessorType attribute. — Rockwell import/export reference manual text (published specification)
// L5Sharp unit test var doc = new XDocument(new XElement("RSLogix5000Content", new XAttribute("SchemaRevision", "1.0"))); Assert.Equal("1756-L83E", controller.ProcessorType); — Parser library source code referencing the element names
<Document> <Engineering version="V18" /> <SW.Blocks.FC ID="0"> <AttributeList> <Interface><Sections xmlns="http://www.siemens.com/automation/Openness/SW/Interface/v5">{{INTERFACE}}</Sections></Interface> <Name>{{BLOCK_NAME}}</Name> <ProgrammingLanguage>SCL</ProgrammingLanguage> — Blank block template from an XML generator (template placeholders)
How to read an Openness XML file (blog post): after the header you will see <SW.Blocks.FB ID="0"> followed by <Sections xmlns="http://www.siemens.com/automation/Openness/SW/Interface/v2">, then <ProgrammingLanguage>LAD</ProgrammingLanguage>. — Blog / training walkthrough quoting Openness markup
Rockwell and Siemens both let engineers export PLC projects to XML (L5X, TIA Portal Openness) for version control, the vendor said in a press release announcing its new DevOps toolkit. — News / marketing text

Known false positives

Vendor reference manuals (1756-RM014) and parser libraries (L5Sharp, l5x) name the elements and attributes. Mitigation: Enforce tiers need populated export markup (root with SchemaRevision, Controller Use="Target" ProcessorType="...", SW.Blocks ID= plus the namespace); manual and library names are also excluded.
Add-On Instruction library exports (TargetType="AddOnInstructionDefinition") contain real routines and rungs but no controller or network data. Mitigation: They lack Controller Use="Target" with ProcessorType so cannot reach 85; the routine/rung route caps at 75.
XML generator templates and blog posts quoting Openness blocks. Mitigation: Mustache / ${} placeholders and template wording are excluded; "blog post", "code snippet" and "Openness XML file" framing are excluded.
Zipped project archives (ZEF, ACD, .ap17) are binary or compressed. Mitigation: Not detected unless the scanner extracts the XML/L5K text.