PLC Scan Cycle & Basic Working Methods: A 2026 Engineering Guide
Share
PLC · Engineering Notes · Updated 2026-06-30
By KOEED Engineering Team · 2026-06-30 · 9 min read · Engineering Notes
AI Summary — Key Takeaways
- A PLC scan cycle in 2026 still runs in three phases — input scan, program execution, output refresh — now with optional task classes and event-triggered interrupt routines.
- IEC 61131-3 4th edition (IS 2025) keeps ladder as the lingua franca and adds object-oriented extensions; Instruction List is officially deprecated.
- Modern controllers expose the scan via OPC UA, MQTT, and EtherNet/IP DLR, so the cycle is no longer a black box.
- The cycle time of a 2026 controller ranges from sub-millisecond (safety tasks) to 50 ms (process tasks); deterministic behavior is what makes a PLC different from a PC.
- Field-proven practice: simulate, observe the scan, document, then deploy — same recipe as 2024, but with sharper OT-security edges.
A 2026 refresh of the classic PLC working-method article: scan cycle, languages, I/O handling, and OT security, mapped to ControlLogix 5580, S7-1500, and iQ-R.
Programmable Logic Controllers have not changed the fundamentals in forty years — they still read inputs, run a program, and write outputs — but the surrounding ecosystem in 2026 looks different from the 2024 vintage. This illustrated Engineering Note walks through the basic working method of a PLC (input processing → program execution → output refresh), updates each step for the IEC 61131-3 4th edition, the rise of OPC UA-native controllers, and the practical reality of OT security on the plant floor. Use it as a teaching aid, a refresher before a commissioning trip, or a sanity check before recommending a cross-brand replacement to a maintenance team.
What changed since 2024
Three shifts matter to engineers re-reading this topic in 2026:
- The IEC 61131-3 4th edition (published as an International Standard in 2025) formally deprecated Instruction List (IL) and added tighter alignment with the OPC UA companion specification. New code should target Structured Text or Ladder Diagram; legacy IL is read-only for maintenance.
- Controllers in the 2026 mainstream — Allen-Bradley ControlLogix 5580 (1756-L8x), SIMATIC S7-1500, Mitsubishi MELSEC iQ-R, Modicon M580 ePAC — expose the scan cycle as a structured object. You can read scan time, task period, and event-triggered interrupts through OPC UA, MQTT, or the engineering tool without ever opening the cabinet.
- OT cybersecurity is now part of the working method. Default passwords, open HTTP ports, and unsigned firmware belong to a bygone era; treat every scan cycle as a network transaction and follow IEC 62443-3-3 SL 2 as a baseline.
The PLC scan cycle in one diagram
Every PLC — from a Mitsubishi FX5 to a rack-mounted ControlLogix 5580 — executes the same three-phase pattern. The names vary by vendor (Allen-Bradley: "pre-scan / program scan / post-scan"; Siemens: "process image update / OB1 / process image update"; Mitsubishi: "link refresh / program execution / link refresh"), but the logic is identical:
- Input processing — copy the state of every physical input (sensors, switches, analog levels) into the input process image.
- Program execution — run the user's program top-to-bottom (or by task) using the input image and any internal tags.
- Output refresh — write the resulting output image to the physical outputs (valves, drives, lamps).
The whole loop repeats at a fixed cadence called the scan time. In a 2026 machine controller the scan is typically 5–50 ms; safety tasks run as fast as 500 µs on a GuardLogix or SIMATIC F-CPU. Determinism — not raw speed — is the design goal.
Step 1 — Input processing
The input modules sit between the field wiring and the CPU. When the scan begins, the firmware reads every input point in a deterministic order, applies any configured debounce or inversion, and lays the results into a memory area called the input process image. From that moment on, the user program sees a stable snapshot, not a moving target.
In 2026 this matters more than ever. With EtherNet/IP DLR, PROFINET MRP, and CC-Link IE TSN rings carrying the I/O, the input image is replicated as a deterministic broadcast on a schedule. The standard read happens on the local backplane; the remote read is delivered on the network layer. The program is unaware of the difference, which is exactly the point.
> Tip
If you see flicker on a digital input or oscillation on an analog, check the filter constant first — not the program. On a 1756-IB16IF or a SIMATIC SM 131 the input filter is configured per channel in the hardware configuration; a 10 ms filter cleans 60 Hz contact chatter without slowing the scan cycle.
Step 2 — Program execution
The CPU now executes the user program in scan order. In a standard PLC program the entire logic runs once per scan: read the input image, work the logic, write the output image, repeat. In modern systems the work is split into tasks: a fast periodic task, an event-triggered task, and a continuous background task — the structure introduced by IEC 61131-3 and now standard on Siemens S7-1500, Omron NX/NJ, and Schneider M580.
Languages matter here. Even in 2026, Ladder Diagram (LD) remains the most readable form for relay-style sequencing and is the visual default on every training screen. Structured Text (ST) handles math, data, string manipulation, recipes, and the modern migration target for any legacy Instruction List code. Function Block Diagram (FBD) is preferred for closed-loop control and reusable processes, and Sequential Function Chart (SFC) structures batch and step-driven machines. The IEC 61131-3 4th edition (2025) keeps all five but deprecates IL — any new subroutine should be authored in ST or LD.
Step 3 — Output refresh
When the program reaches its end, the output process image is locked and copied to the physical output modules in a single deterministic pass. That copy is what actuates the world — a contactor closes, a valve opens, a variable-frequency drive receives a new speed reference. Holding the outputs steady for the entire scan is what prevents intermediate "glitch" states from ever reaching the actuators.
The same principle holds for remote I/O. On a PROFINET IRT segment, the output image is broadcast at the start of each cycle window with sub-millisecond jitter. On EtherNet/IP DLR, the supervisor node publishes the scheduled output at the start of the interval. The 2026-era controller does all of this for you; understanding the principle still matters when a network cable is broken at 11 p.m. on a Tuesday and you need to know why a remote output "stuck at last value".
! Warning
Never rely on a single scan to drive a safety function. All safety-rated work (E-stops, light curtains, guard interlocks) belongs on a dedicated safety PLC — GuardLogix, SIMATIC F-CPU, MELSEC-QS, or M580 Safety — with its own certified processor, its own scan, and its own wiring. The standard scan cycle on a machine controller is not a safety instrumented system, no matter how fast it runs.
Beyond the scan — monitoring, troubleshooting, and what the 2026 controller adds
The classic PLC scan is still the heartbeat, but the surrounding instrumentation is richer than it was two years ago. Studio 5000 for ControlLogix, TIA Portal V20 for SIMATIC, GX Works3 for MELSEC, and EcoStruxure Control Expert for M580 all expose a live scan-time chart, a task-status dashboard, and a watchdog history. Use them on day one of commissioning.
An OPC UA server is now built into most flagship CPUs, which means an MES or a digital twin can subscribe to "ScanTimeMax", "ScanTimeJitter", and "TaskLastDuration" without a custom script. MQTT publishers on the same controllers push event-driven alarms to a broker in the control room. The PLC Error Code Database at KOEED is a useful cross-vendor reference when a fault code is anything other than obvious.
A reference table for the 2026 PLC line-up
The platforms most engineers encounter in the field today, mapped to how each implements the scan cycle. Source: vendor manuals plus field experience, refreshed 2026-06.
| Brand & Platform | Scan Cycle Phases (vendor terms) | Typical Scan Time | Primary Engineering Tool (2026) | KOEED Collection |
|---|---|---|---|---|
| Allen-Bradley ControlLogix 5580 (1756-L8x) | Pre-scan → program tasks → post-scan → motion plan | 5–20 ms per task | Studio 5000 Logix Designer v36+ / Logix Emulate | Allen-Bradley |
| Siemens SIMATIC S7-1500 | Process image update → OB1 / cyclic / interrupt OB → process image update | 1–10 ms (OB1) · 500 µs (OB82 interrupt) | TIA Portal V20 / S7-PLCSIM | Siemens |
| Mitsubishi MELSEC iQ-R | Link refresh (fixed / random) → program execution → link refresh (output) | 3–50 ms | GX Works3 / GX Simulator3 | Mitsubishi |
| Schneider Modicon M580 ePAC | MAST task (read / process / write) with FAST / AUX event tasks | 10–40 ms MAST · 1–5 ms FAST | EcoStruxure Control Expert | Schneider |
| Omron NX/NJ Machine Automation Controllers | Primary periodic task → priority-5 periodic → event task (interrupt) | 0.5–2 ms fast tasks; 4–32 ms primary | Sysmac Studio | Omron |
Use this table as a starting point, then read the vendor manual. Every controller exposes the same three phases under a different vocabulary, and understanding that vocabulary is what allows a cross-brand team to migrate a working program from a 2005-era platform to a 2026 platform without surprises.
How to keep the scan healthy in 2026
- Watch the worst-case scan, not the average. The audit you care about is the 99th percentile, which catches the array sorts, recipe loads, and unexpected interrupts that an average scan hides.
- Split work into tasks by deadline. Motion and safety on fast periodic; analog scaling on the standard cycle; reporting and trending on a slow background task.
- Use symbolic tags. Hard-coded I/O addresses belong in the input-image assignment, never inside a routine body.
- Backup, version, restrict. Password-protect routines, restrict tag access, version the project, and store signed backups off the controller.
- Patch on the manufacturer's schedule — firmware advisories (IEC 62443-3-3 SL 2 baseline) belong on your maintenance calendar alongside vibration analysis and grease changes.
Five habits. None of them are new; all of them are easier in 2026 because the engineering tools tell you what the scan did. Closing the gap between "code that compiles" and "code that runs deterministically every cycle for ten years" is what the working method of a PLC is really about.
Specifying a PLC build, a migration, or a hard-to-find replacement in 2026?
Send your BOM to Moritta@KOEED.COM. Active stock, EOL stock, and cross-references — all in one quote within 24 hours.
Send My BOM →Frequently asked questions
What are the three phases of a PLC scan cycle in 2026?
Input processing reads physical inputs into the process image; program execution runs the logic; output refresh writes the result. Every vendor names them differently; the principle is identical.
Does the IEC 61131-3 4th edition still require ladder logic?
No. The standard defines five languages (LD, ST, FBD, SFC, IL) and lets programmers mix them. The 4th edition (IS 2025) deprecates IL; ST is preferred for data while Ladder stays the default.
How fast is a modern PLC scan cycle?
A typical 2026 machine controller runs the standard task in 5 to 50 ms; safety tasks on GuardLogix or SIMATIC F-CPU finish in 500 to 2,000 microseconds. Watch worst-case scans, not averages.
Can a PC replace the PLC scan cycle?
A soft-PLC on industrial PC hardware can mimic a scan but loses determinism: OS work, garbage collection, and firmware updates add jitter. Safety-rated I/O still belongs on a real PLC.
How does OT security change the PLC working method?
OT security adds four habits: authenticate engineering connections, enable signed firmware, restrict unused network and USB ports, and log config changes. Follow IEC 62443-3-3 SL 2 as a baseline.
Where can I source a replacement PLC or module with the same scan behavior?
Email your BOM or failing-module photo to Moritta@KOEED.COM. KOEED keeps current and obsolete stock side by side across nine PLC brands and replies within 24 hours.
Related on KOEED
- Engineering Notes — long-form technical deep dives
- How-to articles and PLC tutorials
- Migration guides for obsolete and EOL PLC families
- Daily PLC News — firmware updates and EOL announcements
- PLC Error Code Database — cross-vendor fault reference
- All product collections — nine PLC brands and KLUBER lubricants
KOEED Engineering Team
Industrial automation editors at KOEED. Writing about PLC scan cycles, cross-reference, and legacy system support. Reach the team at Moritta@KOEED.COM .