The Working Process of PLC and the Operation Mode of PLC (2026 Update)
Share
PLC Engineering Notes · 2026 Refresh
By KOEED Engineering · 2026-06-30 · 9 min read · Engineering Notes
The PLC's working process has not changed in 30 years — but the way we run, stop, debug, and program it has. This 2026 refresh walks through the input / processing / output scan, the RUN / STOP / PROGRAM / MONITOR modes, and what IEC 61131-3 plus modern vendor stacks (Studio 5000, TIA Portal, GX Works3, Sysmac Studio, EcoStruxure) actually do to that scan cycle today.
AI Summary
- The PLC scan cycle is still Input → Process → Output, but most 2026-era CPUs (Logix, S7-1500, iQ-R, CP1L, M580) run it as a multi-task scheduler with deterministic time slices per task.
- RUN, STOP, PROGRAM, MONITOR, and REMOTE modes still exist; PROGRAM mode now often requires signed firmware keys and role-based authentication.
- IEC 61131-3 (third edition, 2013, with amendments through 2024) defines five programming languages; most vendors add vendor-specific extensions for motion, safety, and analytics.
- Scan time is no longer the bottleneck — modern CPUs complete a 1k-instruction program in < 1 ms; the real limit is now I/O module backplane update and bus cycle time.
- What changed since 2024: OPC UA Pub/Sub, MQTT-bridged edge gateways, cybersecurity hardening (IEC 62443-4-2), and runtime containers on high-end PLCs.
A 2026 PLC still loops input / process / output, but now runs as a multi-task kernel with OPC UA, IEC 62443 security, and event-driven scan under IEC 61131-3.
The PLC working process, still defined in three stages
Every modern PLC, whether it is an Allen-Bradley ControlLogix 1756-L8x, a Siemens SIMATIC S7-1500, or a Mitsubishi MELSEC iQ-R, executes the same three-stage working process defined in every control textbook since 1968.
Stage 1 — Input scan
The CPU reads the state of every physical input module on the local chassis (and over the backplane / network for remote I/O), stores a snapshot in the input process image, and then proceeds. This snapshot is what the user program sees — not the raw terminal voltage at the millisecond the instruction executes. This is the single most important concept to understand when troubleshooting a stuck input.
Stage 2 — Program processing
The CPU executes the user program, rung by rung, function block by function block, top to bottom. Logic results are written to the output process image, not to the physical output terminals. Tasks, periodic and event-driven, are scheduled here. On a ControlLogix L8x, the default is a single continuous task; on an S7-1500, you typically configure OB1 (cyclic) plus OB35 (cyclic interrupt) and hardware OBs.
Stage 3 — Output scan
The CPU writes the output process image to the physical output modules. Outputs stay latched between scans. Communications housekeeping — Ethernet/IP, Profinet, CC-Link IE, EtherCAT — and diagnostics usually run at the tail of the cycle, after outputs.
> Tip
If an output behaves one scan "late" relative to an input change, you are looking at the input-to-output delay through the process image, not a programming error. With Siemens S7-1500 you can use PIO (process image of outputs) and PIP (process image of inputs) addresses to bypass the scan if you need sub-millisecond response.
Operation modes of a PLC in 2026
The original three or four modes (RUN / STOP / PROGRAM / MONITOR / REMOTE) are still present, but vendors now layer security, role authentication, and remote runtime management on top.
| Mode | Outputs | Inputs scanned | Program edits | Typical use (2026) |
|---|---|---|---|---|
| RUN | Energized, controlled | Yes, full cycle | Online edits only (logged) | Normal production |
| STOP | De-energized (depends on wiring) | Often yes, no execution | Limited / firmware-dependent | Safe state, maintenance handover |
| PROGRAM | Off | Yes, no execution | Full offline / upload | Firmware update, project upload/download |
| MONITOR | Energized, controlled | Yes, full cycle | Live watch, force / unforce (audited) | Commissioning, troubleshooting |
| REMOTE | Inherits RUN / PROGRAM key | Inherits | Inherits + role-based | SCADA / engineering station control |
Scan cycle mode (the production default)
This is the heart of every PLC. In RUN, the CPU repeats the input → process → output cycle continuously. Modern scan times are stunningly fast: a Siemens S7-1516 with a typical 1k-instruction program runs a 0.5 ms cycle; an Allen-Bradley 1756-L85E with the same scale of code is in the same neighborhood. The bottleneck has shifted from "CPU speed" to "I/O backplane update" and "fieldbus cycle".
Program mode
In PROGRAM mode the CPU halts execution. Outputs go to their off / fail-safe state as defined by the wiring and the module configuration. In 2026, switching to PROGRAM on a modern controller requires a physical key, a signed engineer credential, and an audit log entry under IEC 62443-4-2 zone and conduit requirements. This is a meaningful change from the 2000s, when PROGRAM mode was often just a toggle on the engineering workstation.
Test / Monitor mode
Often called MONITOR on Mitsubishi MELSEC and Omron SYSMAC, and Debug / Run-Test on Siemens. The program executes against live I/O, but force / unforce and online edits are allowed. The audit trail (who forced what, when) is now mandatory for most regulated environments under IEC 62443.
Remote mode
Remote mode is not a separate scan behavior — it is a key-switch permission. With the key in REMOTE, the mode (RUN / STOP / PROGRAM) is controlled by the engineering station or SCADA, subject to role-based authentication. This matters for IIoT gateways: an MQTT broker or OPC UA server can request a state change only if the controller is in REMOTE.
Programming under IEC 61131-3 (third edition, with 2024 amendments)
IEC 61131-3 defines five programming languages for PLCs: Ladder Diagram (LD), Function Block Diagram (FBD), Structured Text (ST), Instruction List (IL — deprecated in the 3rd edition), and Sequential Function Chart (SFC). The third edition (2013) and its amendments (through 2024) extended the standard to cover object-oriented features, namespaces, and interfaces.
| Brand | IDE | IEC 61131-3 coverage | Notable 2024–2026 extensions |
|---|---|---|---|
| Allen-Bradley | Studio 5000 Logix Designer | LD, FBD, ST, SFC | AOI, Add-On Profiles, PlantPAx 5.0 |
| Siemens | TIA Portal (V20, 2026) | LD, FBD, ST, SFC, GRAPH | PLCSIM Advanced, ODK for runtime containers |
| Mitsubishi | GX Works3 | LD, FBD, ST, SFC | FB library, iQ-R safety extension |
| Omron | Sysmac Studio | LD, FBD, ST, SFC | CamelBot AI function blocks, NA HMI tags |
| Schneider | EcoStruxure Control Expert | LD, FBD, ST, SFC, IL | M580 safety, EBO edge orchestration |
In 2026, every vendor still uses ladder as the dominant maintenance language for brownfield work, but new code is being written in Structured Text, especially for motion, complex math, and IIoT data preparation.
What changed since 2024 (the real refresh content)
A reader who last read this topic in 2024 should focus on five concrete shifts.
1. Event-driven scan and multi-task kernels
In 2024, most PLCs ran a single cyclic task at 10–50 ms. In 2026, the default on high-end controllers is a multi-task scheduler: a fast periodic task at 1 ms for motion and safety, a cyclic task at 10 ms for I/O, and an event-driven task triggered by Ethernet/IP or Profinet events. The conceptual Input / Process / Output stages are still there, but they no longer all run in lockstep on a single scan.
! Warning
When you migrate from a 2020-era S7-300 program to an S7-1500, expect to reorganize OB1 (cyclic), OB35 (cyclic interrupt), and OB82 / OB83 (diagnostic) — failing to map tasks 1:1 is the single most common cause of "the migration ran for two hours and then tripped".
2. Cybersecurity hardening under IEC 62443-4-2
Mode changes (RUN ↔ STOP ↔ PROGRAM) on a 2026 controller are logged to a tamper-evident audit trail, require role-based authentication, and are subject to zone-and-conduit enforcement. PLC programmers should treat PROGRAM mode as a privileged operation, not a routine state.
3. OPC UA Pub/Sub over TSN as the default northbound protocol
Classic OPC UA client-server is being replaced by OPC UA Pub/Sub over Time-Sensitive Networking (TSN) on the factory floor. For PLCs, this means the "process" stage increasingly publishes data to an MQTT broker or a TSN switch, not just to local I/O. Schneider M580, Siemens S7-1500, and Allen-Bradley GuardLogix 5380 all ship with native OPC UA Pub/Sub servers as of firmware 2024.
4. Containerized runtime (high-end PLCs and IPCs)
Siemens ODK, Schneider EBO, and Codesys-based edge controllers now run Linux containers alongside the IEC 61131-3 runtime. This is a real operating model change: an analytics container can subscribe to process variables without any custom C++ on the PLC. For a maintenance engineer, this means you may need to look at a docker-compose file as part of a PLC commissioning.
5. Deterministic Ethernet replaced fieldbus on the field
CC-Link IE, Profinet, EtherNet/IP, and EtherCAT all converged on single-pair Ethernet variants (APL, SPE) by 2026. The "scan cycle" now includes time-aware scheduling on the wire, not just on the CPU.
Practical engineering takeaways
- The three-stage working process (input / process / output) is not obsolete — it is the substrate that every other 2026 feature sits on top of.
- Mode-switch discipline matters more in 2026 than it did in 2014: enforce key + role + audit for every STOP / PROGRAM transition.
- Scan-time benchmarking should now also include I/O backplane update, network cycle, and OPC UA publish latency, not just CPU cycle.
- If you are sourcing a replacement controller for an EOL system (SLC 500, S7-300, MELSEC-Q), the working process is the easy part — the multi-task mapping and the cybersecurity posture are where the project time goes.
Cross-Reference
Working process and mode semantics are tightly coupled to hardware choice. For cross-reference tables on common replacements, see the KOEED Engineering Notes series for the full migration playbooks.
Migration difficulty: low for scan logic, medium for task reorganization, high for cybersecurity re-baselining.
When you need to source a current or EOL PLC to apply the patterns in this article, browse the KOEED collection or send your BOM — current, EOL, or obsolete — to Moritta@KOEED.COM.
Working on a PLC replacement or migration?
Send your BOM — current, EOL, or obsolete — to Moritta@KOEED.COM. Active stock, EOL stock, and cross-references — all in one quote within 24 hours.
Send My BOM →Related on KOEED Blog
- PLC Scan Cycle — how the Input / Process / Output stages actually time out on a 2026 controller
- Two basic working modes of PLC and the scanning process
- How does PLC work and what control tasks must be completed
- Core components of PLC — introduction to CPU and memory
- Workflow of PLC in CNC machine tools
KOEED Engineering
Industrial automation editors at KOEED. We write about PLC sourcing, cross-reference, and legacy system support for Allen-Bradley, Siemens, Mitsubishi, Omron, Fanuc, Schneider, Yaskawa, Panasonic, and KEYENCE. Reach the team at Moritta@KOEED.COM.
Frequently asked questions
What is the PLC working process in 2026?
The 2026 PLC working process still loops Input / Process / Output, now with multi-task scheduling, OPC UA Pub/Sub, and event-driven interrupts under IEC 61131-3 and IEC 62443-4-2.
What are the operation modes of a modern PLC?
A modern PLC supports RUN, STOP, PROGRAM, MONITOR, and REMOTE. The mode is gated by a physical key, role-based authentication, and an audit log. REMOTE is permission to change modes from the network.
How long is a typical PLC scan cycle today?
On a 2026 mid-range CPU (AB 1756-L8x, Siemens S7-1516, Mitsubishi R08CPU), the cyclic scan for a 1k-instruction program is 0.5–2 ms. The bottleneck is now I/O backplane update and fieldbus cycle.
What is the difference between PROGRAM mode and STOP mode?
STOP halts execution and drives outputs to their fail-safe state, with the program still loaded. PROGRAM also halts outputs but allows upload, download, or wipe of the project.
Is IEC 61131-3 still relevant in 2026?
Yes. IEC 61131-3 third edition (2013) plus amendments through 2024 define the five languages (LD, FBD, ST, SFC, deprecated IL) and the runtime model. Every vendor adds extensions.