PLC logic programs

Detects printed or prose PLC logic programs and program listings: ladder or rung listings with instruction text such as XIC(...)OTE(...), structured-text logic, program/routine/controller names and controller tags. Complements global-plc-project-export, which covers native L5X/L5K/TIA Openness/XEF export files; this pattern does not use those export-file anchors. Topic wording alone is discovery-only.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (concrete logic (Rockwell rung instructions such as XIC(tag)/OTE(tag)/TON(timer), or IEC structured-text IF ... THEN / tag := value; lines) or program structure (labelled program/routine/task/controller/processor/slot/tag/I/O address, printed Rung numbers, 1756-L / 6ES7 controller catalogue numbers)), and 85 needs two distinct structures plus independent process-control (interlock, permissive, e-stop, motor, conveyor, pump, valve, setpoint) evidence, so policies, blank forms and training text stay below 75.
Detection quality: Not detected
Jurisdictions: global
Regulations: Security of Critical Infrastructure Act 2018 (Cth)
Frameworks: IEC 62443, ISO 27001, NIST CSF
Data categories: security
Scope: wide
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:programmable\s+logic\s+controller|PLC\s+(?:logic|program(?:me)?|code|ladder|routine)s?|ladder\s+(?:logic|diagram|program|listing)|rung\s+(?:logic|listing|comments?)|(?:program|routine)\s+listing|structured\s+text\s+(?:program|routine)|MainProgram|MainRoutine|(?:RSLogix|Studio\s+5000|TIA\s+Portal|Control\s+Expert|Unity\s+Pro|CODESYS|GX\s+Works)\s+(?:program|project|report|printout|listing))\b

Corroborative evidence keywords

interlock, permissive, e-stop, emergency stop, motor starter, conveyor, pump, valve, setpoint, seal-in, SCADA, [object Object], [object Object], [object Object], Modbus, Modbus TCP, Modbus RTU, DNP3, OPC-UA, OPC Classic (+12 more)

Proximity: 300 characters

Should match

The PLC program for the lift station is backed up on the engineering laptop. — Discovery probe (65) - wording only
Ladder logic listing XIC(Start_PB)XIO(Stop_PB)OTE(P101_Run); — Medium-tier probe (75) - rung instruction text without program structure
RSLogix 5000 report - Controller: WTP_North_PLC1 (1756-L83E, slot 0) Program: MainProgram Routine: MainRoutine Rung 0003: XIC(Start_PB)XIO(EStop_OK)OTE(P101_Run); Rung 0004: XIC(P101_Run)TON(P101_Delay,5000,0); Rung 0005: XIC(LT201_HiHi)OTU(P101_Run); high-high level interlock stops pump P-101 (seal-in released). — High-tier probe (85) - several rung lines, controller/program structure and interlock context
PLC program listing - dosing skid Routine: Dose_Control IF FIT301_Flow > 0.5 AND NOT EStop THEN P301_Run := TRUE; END_IF; DoseSetpoint := 12; Permissive: dosing pump runs only when the inlet valve is open. — High-tier probe (85) - structured-text lines, routine field and permissive context

Should not match

unrelated generic text — No relevant phrase context
placeholder value 12345 — Random text should not match
Policy statement: PLC programs must be backed up after every change and stored in the OT repository. — Policy text
PLC program listing blank template Controller: ________ Rung 0000: [insert] — Blank template
Course module 2: ladder logic basics - XIC(Start_PB)OTE(Motor) latches a motor starter. — Training framing with rung text
The IEC 61131 standard defines several PLC programming languages. — Standard discussion - discovery only at most

Known false positives

Rockwell/Siemens programming manuals and PLC courses print rung examples. Mitigation: Training/course framing is excluded; 85 needs two distinct logic lines plus program structure and process context.
Native L5X/L5K/TIA/XEF export files. Mitigation: Covered by global-plc-project-export; this pattern targets printed listings and prose and may also fire on an export that carries rung text.