PLC logic programs

Identifies substantive programmable-logic-controller programs and logic records. Topic phrases are retained for discovery; enforcement requires program structure such as rungs, contacts, coils, timers, function blocks, variables, or I/O addresses, and high confidence also requires a controller, rack, slot, production asset, or deployable I/O reference.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence requires PLC program structure rather than a controller-product mention. High confidence adds deployable hardware, I/O, or production context, reducing matches on manuals and programming lessons.
Detection quality: Not detected
Jurisdictions: global
Regulations: GDPR, AML/CTF Act (Cth), HRIPA (Cth), IPA 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth), TIA Act 1979 (Cth)
Data categories: security
Scope: wide
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?is)\b(?:programmable\s+logic\s+controller|PLC\s+logic\s+program|ladder\s+logic|IEC\s*61131|rung\s+logic|(?:PLC|controller)[^.\n]{0,30}(?:structured\s+text|function\s+block|control\s+program))\b

Corroborative evidence keywords

plc logic programs, plc, logic, programs, critical, infrastructure, systems, SCADA, [object Object], [object Object], [object Object], Modbus, Modbus TCP, Modbus RTU, DNP3, OPC-UA, OPC Classic, IEC 61850, IEC 60870, IEC 60870-5-104 (+9 more)

Proximity: 300 characters

Should match

PLC logic program — Low-tier probe - controller-program topic without code structure
PLC logic program in ladder logic: rung 12 uses a contact, output coil, and TON timer — Medium-tier probe - substantive program structure without deployment context
PLC logic program for S7-1500 controller rack 1 slot 2: rung 12 drives output coil Q0.0 for the production line safety interlock — High-tier probe - program structure with controller, rack, I/O, and production context

Should not match

unrelated generic text without domain phrases — No relevant topic phrases present
placeholder value 12345 — Random text should not match topic-specific regex
plc function block — Generic word pair from old broad template should not match
The IEC 61131 standard defines several PLC programming languages. — Public standard discussion without controller program structure
Training example: PLC logic program rung 12 output coil Q0.0 for S7-1500 rack 1 — Explicit training content must not enforce

Known false positives

PLC standards, vendor manuals, and programming courses discuss ladder logic, function blocks, contacts, coils, and timers without exposing a deployable program. Mitigation: Keep topic-only matches discovery-only and require concrete program structure for enforcement.
Training labs can contain realistic rungs, I/O addresses, controller models, rack locations, and safety-interlock examples. Mitigation: Reject explicit template, demo, tutorial, sample-data, and training-example framing from enforcing tiers.

References

https://www.legislation.gov.au/C2018A00029/latest/text
https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism