PLC Execution Program: 4-Phase Scan Cycle in 2026 (IEC 61131-3)
Share
Engineering Notes · PLC Fundamentals · 2026-06-30
By KOEED Engineering Team · 2026-06-30 · 9 min read · Engineering Notes
The four-phase scan cycle (input sampling, program execution, output refresh, housekeeping) still defines how every modern PLC runs in 2026, but IEC 61131-3 4th edition (2026 draft), OPC UA FX, and multi-core controllers have reshaped what "deterministic" means on the plant floor. This Engineering Note revisits the execution model with 2026 data and shows where Allen-Bradley, Siemens, Mitsubishi, Omron, Schneider, and Yaskawa CPUs diverge.
AI Summary — Key Takeaways
- The classic scan = input scan → program execution → output refresh still holds across every major PLC platform in 2026.
- IEC 61131-3 4th edition (2026 draft) and OPC UA FX formalise event-driven execution alongside cyclic scans.
- Typical scan times shrank to 0.5–2 ms on ControlLogix 5380, S7-1500, and iQ-R thanks to multi-core CPUs.
- Watchdog, retentive memory, and fault routines are the three resilience layers every integrator must validate.
- Cross-reference the scan budget to your I/O mix before sizing the chassis — cycle time governs throughput.
The PLC execution cycle (input scan, program execution, output refresh) remains the foundation of industrial control in 2026, now extended by IEC 61131-3 event tasks and multi-core scan budgets.
1. Why the execution model still matters in 2026
Two decades after the SLC 500 cemented ladder logic on the factory floor, the same four-phase execution cycle — input scan, program execution, output refresh, housekeeping — still governs how a ControlLogix 1756-L73 processor reads a discrete input and lights an output. What changed between 2024 and 2026 is the hardware underneath: multi-core ARM CPUs, deterministic industrial Ethernet, and the IEC 61131-3 fourth-edition draft (2026) which adds formal event tasks to the cyclic scan.
For maintenance engineers and system integrators, the execution cycle is not abstract theory. It decides how fast your line reacts, how much jitter your safety system tolerates, and whether a watchdog will trip when a single I/O point hangs. This note walks through the 2026 model and shows how it manifests on the nine platforms KOEED ships most often.
2. The four phases, 2026 edition
| Phase | What happens (2026) | Typical duration |
|---|---|---|
| 1. Input scan | Local and remote I/O are latched into the process image. EtherNet/IP / PROFINET / CC-Link IE frames update the image before the CPU reads it. | 0.05–0.5 ms |
| 2. Program execution | Cyclic task runs ladder, FBD, ST, or SFC. IEC 61131-3 ed.4 event tasks (2026) can interrupt on a tag edge. | 0.2–1.5 ms / 1k instructions |
| 3. Output refresh | Process image is written to physical outputs and to network adapters. Safety outputs go through a second, redundant path on GuardLogix / F-CPU. | 0.05–0.3 ms |
| 4. Housekeeping | Communication stacks, retentive tag commit, diagnostics, watchdog check. Multi-core controllers offload this to a dedicated core. | 0.1–0.4 ms |
Sum these four and you have the scan time. On a 2026-era ControlLogix 5380 (1756-L73ER), a typical mid-size program completes in 0.8–2.0 ms. A Siemens SIMATIC S7-1500 CPU 1515 lands in the same band, while a Mitsubishi MELSEC iQ-R R08ENCPU hits 0.5 ms with priority tasking enabled.
> Tip
Measure your real scan time before quoting throughput. Open Studio 5000 / TIA Portal / GX Works3 and read the Task Watchdog register; if the worst-case scan approaches 80% of the watchdog limit, split the program into a periodic fast task and a slower background task.
3. Characteristics that define a 2026-grade PLC execution program
The original 2024 article listed flexibility, reliability, and diagnostic depth as the three pillars. The 2026 list adds three more that matter to anyone sourcing a new chassis or migrating an EOL system:
- Deterministic cyclic scan — bounded by a configurable watchdog, not by "best effort."
- Multi-tasking — continuous (fast) task, periodic tasks (10 / 20 / 100 ms), and IEC 61131-3 ed.4 event tasks.
- Retentive memory — tags survive power loss through super-cap or battery-backed RAM.
- Built-in diagnostics — module status, I/O health, Ethernet port statistics exposed via the process image.
- Safety-aware execution — SIL2 / SIL3 capable CPUs run a second, time-diverse scan and reject any output that disagrees.
- Cyber-hardened boot — signed firmware, signed project files, role-based access — now table stakes for any OT/IT converged plant.
These characteristics are why a 30-year-old SLC 500 still runs bottling lines in 2026, and why a SIMATIC S7-1500 can do motion control, safety, and OPC UA publish in a single scan. The model is identical; the headroom is what you pay for.
4. What changed since 2024
Between the original article (March 2024) and this June 2026 refresh, four shifts have redefined what "PLC execution" means on a working line:
| Shift | 2024 baseline | 2026 state |
|---|---|---|
| IEC 61131-3 edition | 3rd edition (2013), cyclic-only | 4th-edition draft 2026, adds event tasks and OO extensions |
| Typical CPU | Single-core ARM Cortex-A9 | Dual / quad-core with dedicated comms core |
| Network layer | EtherNet/IP, PROFINET, CC-Link IE | Same, plus OPC UA FX (field-level exchange) publish from the process image |
| Safety execution | Add-on safety module pair | Integrated SIL3 core in GuardLogix / F-CPU / FX5-SF |
| Cyber posture | Password + project file lock | Signed firmware, role-based access, signed ACD / TIA Portal project, CIP Security |
The most operationally important change for a maintenance engineer is OPC UA FX. Where 2024-era PLCs published only tags via OPC UA on a separate server, 2026-era controllers — ControlLogix 5380, S7-1500, iQ-R, CJ2, and Modicon M580 — can publish the process image directly to MES / cloud without a middle box. That shifts the scan budget: housekeeping now includes the OPC UA publish step.
! Warning
Enabling OPC UA publish on a tight scan (sub-1 ms) without measuring the overhead can push you past the watchdog. Always bench-test with a representative tag set before commissioning.
5. Cross-platform snapshot: scan budget on 9 PLC brands (June 2026)
| Brand / Family | Typical mid-size CPU | Typical scan (2026) | Programming environment |
|---|---|---|---|
| Allen-Bradley ControlLogix 5380 | 1756-L73ER | 0.8–2.0 ms | Studio 5000 Logix Designer v36 |
| Siemens SIMATIC S7-1500 | CPU 1515-2 PN | 1.0–2.0 ms | TIA Portal V20 |
| Mitsubishi MELSEC iQ-R | R08ENCPU | 0.5–1.5 ms | GX Works3 |
| Omron SYSMAC NX/NJ | NX502-1400 | 0.5–1.0 ms | Sysmac Studio v1.60 |
| Schneider Modicon M580 | BMEP582040 | 1.0–2.5 ms | EcoStruxure Control Expert |
| Yaskawa MP3300 | MP3300 + motion | 0.25–0.5 ms (high-speed task) | MPE720 v7 |
| Panasonic FP7 | AFP7CPS41E | 0.5–1.5 ms | FPWIN Pro 7 |
| Fanuc Series 0i-MD (CNC side) | A02B-0321-Bxxx | PMC: 8 ms ladder block | FANUC LADDER-III |
| KEYENCE KV-8000 | KV-8000 + vision | 0.2–0.5 ms | KV STUDIO v11 |
Use this table as a first-order sizing reference only — your actual scan depends on program size, comms load, and whether safety / motion tasks are enabled. For project-specific sizing, share your I/O list with us at Moritta@KOEED.COM and we will cross-reference the closest equivalent CPU in stock.
6. Common pitfalls when sizing a scan in 2026
- Forgetting retentive tags. A 10k-tag commit at power-on adds 50–150 ms to the first scan. Allow for it.
- MSG / PUT-GET inside the fast task. Move peer-to-peer messages into a periodic 50 ms task so they never block the main scan.
- One big routine vs. many small ones. Multi-routine programs let the compiler parallelise; monolithic routines do not.
- Safety task priority. Safety tasks run at a fixed rate independent of the cyclic scan. Do not assume the safety cycle and the main cycle align.
- OPC UA publish + alarm events. Both add housekeeping overhead; budget 0.2–0.4 ms combined on a 1k-tag publish set.
7. Internal references
- Allen-Bradley ControlLogix & CompactLogix modules in stock
- Siemens SIMATIC S7-1500 / S7-1200 modules
- Mitsubishi MELSEC iQ-R and FX series
- PLC Error Code Database — look up CPU and module fault codes by platform.
- AI Diagnostic Tool — scan a nameplate and get a sourcing path within seconds.
Need a CPU, replacement module, or full BOM?
Send your instrument list or BOM to Moritta@KOEED.COM. Active stock, EOL stock, and cross-references — one quote within 24 hours.
Send My BOM →Frequently asked questions
What is the PLC scan cycle in simple terms?
It is the four-step loop the CPU runs forever: read inputs, execute your program, write outputs, then do housekeeping. On a 2026-era controller the whole loop takes 0.5 to 2 milliseconds for a mid-size program.
How is the IEC 61131-3 4th edition (2026) different from the 2013 version?
The 2026 draft adds formal event tasks (trigger a routine on a tag edge or alarm) and stronger object-oriented extensions. The cyclic scan is unchanged — it just gained an interrupt-style sibling.
Does scan time matter for a slow process like a water-treatment plant?
Less than for high-speed packaging, but it still affects how fast the controller reacts to alarms and how much peer-to-peer traffic it can absorb. A 5–10 ms scan is a reasonable target for slow processes.
Can I run a 2026 program on an EOL PLC like the SLC 500?
The SLC 500 still executes the same four-phase scan, so a working program keeps working. New features — OPC UA FX, signed firmware, event tasks — are not back-ported. KOEED keeps SLC 500 stock for in-place repair.
Where can I get a cross-reference for an obsolete CPU?
Email the original part number to Moritta@KOEED.COM. Our team cross-references to a current equivalent within one business day and quotes from active stock.
KOEED Engineering Team
Industrial automation editors at KOEED. We write about PLC sourcing, cross-reference, and legacy system support. Reach the team at Moritta@KOEED.COM .