PLC Scan Cycle & Execution: A 2026 Engineer's Experimental Design Guide
Share
AI Summary
- The scan cycle has not changed in principle since 2024 — input, program, output — but 2026 controllers add deterministic event tasks and OPC UA Pub/Sub side-channels.
- IEC 61131-3:2025 tightens the definition of "task" and clarifies how multi-tasking affects the cycle budget.
- Experimental design in 2026 is less about one-variable-at-a-time and more about Design of Experiments (DoE) profiling of cycle jitter.
- Modern debuggers (Studio 5000 v36, TIA Portal V19, GX Works3 1.100) now expose per-rung timing, making variable sweeps far easier than in 2024.
A 2026 refresh of the 2024 scan-cycle guide — what changed, how to run a defensible experimental design, and how to debug deterministic latency on nine major PLC brands.
Allen-Bradley · Siemens · Mitsubishi · Engineering Notes · 2026
By KOEED Engineering Team · 2026-07-03 · 8 min read · Engineering Notes
The 2024 walk-through of the PLC program execution process still holds up — input scan, program scan, output scan — but the controllers sitting on the bench in 2026 have moved on. This Engineering Notes refreshes the original article for the IEC 61131-3:2025 era, ties scan-cycle intuition to a modern experimental-design workflow, and links to the latest KOEED cross-references for the nine brands we ship daily.
TL;DR
- The three-stage scan is still the model; everything else (event tasks, jitter budgets, OPC UA Pub/Sub) layers on top.
- Run a 2-level fractional-factorial DoE on rung count, MSG frequency, and task priority before declaring a scan budget "good enough".
- 2026 debuggers (Studio 5000 v36, TIA Portal V19, GX Works3 1.100, Sysmac Studio 1.62) all expose per-task timing — use it, do not estimate.
What changed since 2024
When the original 2024 article was published, the default mental model was a single periodic task running the classic three-stage scan. In 2026, four things have shifted:
- IEC 61131-3:2025 — released in late 2025 — formalises multiple task types (periodic, event, freewheeling) and adds a deterministic-jitter annex that the 2013 edition did not have.
- OPC UA Pub/Sub over TSN is now standard on most new ControlLogix, S7-1500, and iQ-R CPUs, so the scan-time budget must reserve a deterministic window for the publish side-channel.
- AI-assisted tuning is built into Studio 5000 Logix Designer v36 and TIA Portal V19: the IDE now flags rungs that contributed more than a threshold percentage of the worst-case scan.
- Edge controllers (Allen-Bradley Edge IO, Siemens ET 200SP MP, Mitsubishi MES3) co-host a containerised workload on the same physical CPU — meaning scan jitter can be polluted by a Linux process, not just by your ladder logic.
None of this invalidates the 2024 fundamentals. It does, however, change what "experimental design" means when you sit down to measure it.
The scan cycle, revisited for 2026
A PLC still does three things, in order, every cycle: it reads inputs, executes logic, then writes outputs. The 2026 wrinkle is that "execute logic" now spans multiple tasks and may interrupt itself.
Stage 1 — Input scan
The CPU latches the state of every input module at the start of the cycle. On a ControlLogix 1756-L73 chassis this still happens synchronously over the backplane, but with parallel I/O the input scan can finish in under 0.2 ms per module. Edge I/O over TSN can pre-latch inputs and publish them as a buffered OPC UA dataset, which means the input scan window is now sometimes measured in microseconds rather than milliseconds.
Stage 2 — Program scan
All enabled periodic tasks are queued and run in priority order. On a Siemens S7-1200 CPU with a 10 ms OB1, the program scan typically completes inside 3–6 ms; on a high-end S7-1500 with motion and safety tasks, the OB1 may share the cycle with OB91 (motion) and OB82 (fault). The 2026 controllers expose per-task timing in the IDE, so the "program scan" is no longer a single number — it is a histogram.
Stage 3 — Output scan
Outputs are latched back to the modules. In 2026, the output side also pushes a deterministic OPC UA Pub/Sub frame if the controller is configured as a publisher. That publish slot is now part of the worst-case scan budget, and the IEC 61131-3:2025 annex calls this out explicitly.
> Tip
When you measure the scan cycle, capture the worst-case across at least 10,000 cycles. On modern CPUs the average may sit at 4 ms while the 99.99th percentile runs at 22 ms — that tail is what trips safety logic and motion interlocks, not the average.
Experimental design in 2026: from variable tuning to DoE profiling
The 2024 article described "change one variable at a time and watch the scan". That works for a single ramp; it does not scale to controllers with multiple tasks, OPC UA traffic, and a containerised edge workload. In 2026 we recommend a lightweight Design of Experiments (DoE) approach:
- Pick three controllable factors — rung count, MSG instruction frequency, and event-task priority.
- Run a 2-level fractional factorial (8 runs, 1 replicate) and measure both the average scan and the 99.99th percentile jitter.
- Analyse with a Pareto chart: which factor explains the most jitter? That is the lever you actually need to pull.
This takes an afternoon, not a week, and it gives you a defensible answer when a maintenance manager asks why you are claiming a 12 ms budget instead of the legacy 25 ms.
Cross-reference: scan-cycle metrics across nine brands
| Brand & family | Typical OB / task | Avg scan (2026) | IDE & version |
|---|---|---|---|
| Allen-Bradley ControlLogix | Periodic task (default 10 ms) | 2–8 ms | Studio 5000 v36 |
| Siemens S7-1500 | OB1 cyclic + OB91 motion | 3–10 ms | TIA Portal V19 |
| Mitsubishi MELSEC iQ-R | Multiple fixed-cycle tasks | 1–5 ms | GX Works3 1.100 |
| Omron NX/NJ | Primary periodic task | 0.5–3 ms | Sysmac Studio 1.62 |
| Schneider Modicon M580 | MAST / FAST tasks | 2–7 ms | EcoStruxure Control Expert 16 |
Typical average only — your real number will depend on rung count, I/O density, and whether the controller is also hosting an edge workload. For Omron NJ and Yaskawa MPiec controllers, expect sub-millisecond averages because of the tighter architecture; for legacy Allen-Bradley PLC-5 and SLC 500, budget 20–40 ms and accept it.
Common pitfalls (and how to debug them)
! Warning
Hot-swapping a ControlLogix power supply without a UPS can corrupt program memory. Always back up the .ACD project offline before any chassis work, and capture a fresh scan-time histogram before and after the swap.
- "Average scan looks fine, but motion faults." — measure the 99.99th percentile, not the average. Motion interlocks trip on jitter, not on means.
- "Adding a MSG instruction doubled my scan." — MSG blocks on many 2026 CPUs wait on the OPC UA Pub/Sub path. Throttle the MSG frequency, not the rung count.
- "Edge container is stealing cycles." — pin the container to a non-real-time core on Allen-Bradley Edge IO or Siemens ET 200SP MP. Re-measure after.
Related on KOEED Blog
- PLC scan cycle — the 2024 walk-through this article refreshes
- Introduction to the PLC scan cycle
- Illustrated introduction to the basic working methods of PLC
- The process and characteristics of PLC execution program
- Two basic working modes of PLC and the scanning process
- Configuration and software debugging of PLC field hardware modules
KOEED Engineering Team
Industrial automation editors at KOEED. We write about PLC sourcing, scan-cycle tuning, cross-reference, and legacy system support. Reach the team at Moritta@KOEED.COM.
Tuning a scan budget on a live line?
Send your rung count, task list, and target cycle time to Moritta@KOEED.COM. Active stock of ControlLogix, S7-1500, and iQ-R CPUs — and the legacy PLC-5 / SLC 500 / S7-300 modules still on your line — all in one quote within 24 hours.
Send My Scan Profile →Frequently asked questions
Does the 2024 scan-cycle model still apply in 2026?
Yes. The three-stage model — input scan, program scan, output scan — is still the backbone of every periodic task in 2026. What has changed is that "program scan" now spans multiple tasks, event interrupts, and OPC UA Pub/Sub publish windows. Measure each task separately instead of treating scan as a single number.
What is new in IEC 61131-3:2025 for scan timing?
The 2025 edition adds an annex that defines deterministic jitter and clarifies how event tasks, freewheeling tasks, and periodic tasks share a CPU. It also standardises how vendors expose per-task timing in IDEs, which makes cross-brand profiling much easier than it was under the 2013 edition.
How do I run a DoE on a scan cycle in one afternoon?
Pick three factors — rung count, MSG frequency, and event-task priority — run a 2-level fractional factorial (eight runs), and measure the 99.99th percentile scan. Plot a Pareto chart: the tallest bar is the lever you actually need to pull. The full procedure takes a few hours once your histogram capture is wired.
Which 2026 IDE has the best scan-time profiler?
Studio 5000 Logix Designer v36 (Allen-Bradley) and TIA Portal V19 (Siemens) lead on automation: they auto-flag the worst-case contributors and suggest rung splits. GX Works3 1.100 (Mitsubishi) and Sysmac Studio 1.62 (Omron) are catching up and now export per-task CSV. Schneider EcoStruxure Control Expert 16 finally exposes per-rung timing for Modicon M580 as well.
Can I still buy PLC-5 and SLC 500 spares for an old line?
Yes. KOEED keeps active stock of Allen-Bradley PLC-5 and SLC 500 modules — including legacy 1771, 1746, and 1747 catalog numbers — alongside current ControlLogix stock. Send your BOM to Moritta@KOEED.COM for a 24-hour quote.