PLC Working Principle 2026: Scan Cycle, IEC 61131-3 & Edge I/O Notes

Engineering Notes · PLC Fundamentals · Updated 2026-06-30

By KOEED Engineering Desk · 2026-06-30 · 9 min read · Engineering Notes

The basic working principle of a Programmable Logic Controller (PLC) is the same in 2026 as it was twenty years ago — a deterministic scan cycle that reads inputs, executes logic, writes outputs — but the controllers, languages, and field wiring around that cycle have changed. This Engineering Notes article walks through the core loop, the CPU and memory model, IEC 61131-3 languages in current use, and what maintenance engineers should update in their mental model since the 2024 revision.

> AI Summary

• A PLC executes a deterministic scan cycle: input scan → program execution → output scan → housekeeping.
• CPU, ROM, RAM, and NVRAM retain setpoints and logic across power cycles; modern controllers add MRAM and ECC-protected DDR.
• IEC 61131-3 (2024 update) lists five languages — Ladder Diagram, Function Block Diagram, Structured Text, Instruction List, Sequential Function Chart.
• 2026 changes: PROFINET over TSN, OPC UA over MQTT, IO-Link Wireless on the sensor edge, and AI co-processor modules.
• For legacy installed bases (SLC 500, S7-300, MELSEC-Q), sourcing EOL spares is now the bigger engineering problem than the scan cycle itself.

A PLC reads field inputs, executes user logic under a deterministic scan, writes outputs, then loops. In 2026, the loop is the same — the hardware, languages, and edge wiring around it have evolved.

1. What “working principle” actually means

Strip away the vendor branding, the catalog numbers, and the marketing copy, and every PLC on a factory floor does the same five things, in the same order, in a loop:

1. Read inputs from the field (limit switches, sensors, push-buttons, encoder counters, network nodes).
2. Hold a process image of those inputs in memory — a snapshot, not a live wire.
3. Execute user logic against that process image, rung by rung or function by function.
4. Write outputs based on the logic results.
5. Run housekeeping (communication, diagnostics, retentive memory, watchdog) — then loop.

That loop is the “scan cycle.” It is the basic working principle of the PLC, and it has not changed since Dick Morley’s Modicon 084 in 1969. What has changed is everything around the cycle — CPU speed, scan times, memory type, network protocols, programming languages, and the way discrete wiring is being replaced by industrial Ethernet and IO-Link. If you are new to the topic, our brief introduction to PLCs covers the same five steps from a higher level.

2. The scan cycle in 2026 hardware

On a modern controller — for example the Allen-Bradley 1756-L73 ControlLogix, the Siemens SIMATIC S7-1500 CPU 1515, or a Mitsubishi MELSEC iQ-R R08CPU — the scan cycle still reduces to the four phases below, with deterministic timing the engineer must budget for.

Phase	What happens	2026 typical timing
Input scan	Read all discrete and analog I/O into the process image table.	1–5 ms per 32-point module
Program execution	Sweep user program once, top-to-bottom.	0.5–10 ms / 1k instructions
Output scan	Write process image out to physical outputs.	1–3 ms per 32-point module
Housekeeping	Comm tasks, retentive sync, diagnostics, MRAM flush.	2–20 ms (task-dependent)

Total scan budget on a mid-size line with a 1756-L73 and a fully populated chassis typically lands between 8 and 30 ms. For motion loops you do not rely on this cycle at all — you map drives onto deterministic networks like PROFINET over TSN or EtherNet/IP, where the cycle is bound by the network scheduler, not the PLC program sweep. Our dedicated scan cycle article goes deeper into minimum, maximum, and watch-dog scan.

3. CPU and memory model

The CPU is the brain. It runs a real-time operating system (RTOS) under the user logic, manages the process image, services fieldbus interrupts, and copies retentive data to non-volatile storage on each power-down transition. Three memory classes are still taught in vendor school, and you will see the exact same vocabulary in 2026 firmware manuals:

Memory type	Role	2026 implementation note
ROM / Flash	Holds firmware and system runtime; not user-writable.	Often secured boot + signed firmware.
RAM (DDR3/4 with ECC)	Process image, current tag values, stack, scratch.	Battery-backed or supercap-backed for short outages.
NVRAM / MRAM	Retentive tags, recipe setpoints, fault logs.	Magnetoresistive MRAM replacing battery-backed SRAM on new SKUs.

The single most common 2026 field issue is still “the battery died and the program was lost.” For OEM and system-integration work, prefer controllers with MRAM or signed retentive flash (e.g. the Schneider Modicon M580 BMEP586040, or the ControlLogix 1756-L7x with firmware v33+). For a deeper dive on memory layout, see Core Components of a PLC — CPU and Memory.

4. IEC 61131-3 programming languages

The basic working principle of the program (as opposed to the controller itself) is governed by IEC 61131-3. The third edition (2013) and the latest amendment (2024) standardize five languages; every major brand supplies at least three of them:

Language	Where you still see it	2026 trajectory
LD Ladder Diagram	Discrete logic, field I/O mapping, North-American OEM lines.	Default for AB / Rockwell, still dominant.
FBD Function Block Diagram	Process loops, drives, safety logic.	Strong in Siemens / Schneider codebases.
ST Structured Text	Complex math, recipes, batch, data handling.	Preferred for IIoT / SQL / OPC UA integration.
IL Instruction List	Legacy service work on S7-300 / SLC 500 / MELSEC FX.	Deprecated in 61131-3:2024; kept for maintenance only.
SFC Sequential Function Chart	Batch, step-by-step machines, traffic, packaging.	Stable; widely used in Omron and Mitsubishi.

The 2024 amendment of IEC 61131-3 adds clearer object-oriented extensions (classes, methods, interfaces) and tightens the definition of safety-related POUs — relevant for anyone doing GuardLogix or SIMATIC F-CPU work. The basic principle is unchanged: the program is still scanned top-down once per cycle, then looped.

5. What changed since 2024

The original 2024 version of this article covered input/output modules and ladder logic basics. Three things have shifted materially in the 24 months since, and any maintenance engineer working on installed bases should know them.

5.1 The field wiring has moved to the network edge

Point-to-point wiring to discrete 24 V modules is still the default, but new installations ship with IO-Link Wireless, PROFINET over TSN, and EtherCAT masters that push the same input/output principle into a single Ethernet cable per station. The PLC program no longer cares whether the input is on a wire or over the air — it only sees the process image. Sourcing bills of materials now look very different; see PLC Input/Output Modules and Their Role in Control for the core principle and the new variants.

5.2 OPC UA over MQTT — the default northbound interface

Where the 2024 article talked about HMIs and proprietary fieldbuses, 2026 platforms expose tags natively as OPC UA over MQTT pub/sub. A SIMATIC S7-1500, a ControlLogix 1756-L73, and a SYSMAC NJ/NX can each publish the same boolean tag into the same broker without an OPC server in the middle.

5.3 AI co-processor modules

Several vendors now ship a CPU with a built-in AI inference accelerator, or an in-chassis module (e.g. 1756-AI in the 2026 ControlLogix catalog, or the Mitsubishi MELSEC iQ-R AI module) that consumes the process image for vibration, vision, or anomaly detection. The basic working principle of the PLC scan cycle is preserved — the inference runs as a separate scheduled task and writes results back to standard tags.

6. Hardware map across 9 brands

Same scan cycle, different catalog numbers. Engineers juggling multi-brand service contracts keep this mental map:

Brand	Current mid-range CPU	Still-supported classic	Collection page
Allen-Bradley	1756-L73 / L74	SLC 500 (1746 / 1747)	AB / Rockwell
Siemens	S7-1500 CPU 1515 / 1516	S7-300 (6ES7 315 / 317)	SIMATIC
Mitsubishi	MELSEC iQ-R R08CPU	MELSEC-Q (Q02H / Q06UD)	MELSEC
Omron	SYSMAC NX / NJ	CP1E / CP1H / CJ2	SYSMAC
Schneider	Modicon M580 BMEP586040	Quantum / Premium	Modicon
Yaskawa	MP3300iec	MP2300 + Σ-V / Σ-7	Yaskawa
Panasonic	FP7 CPS31	FP0R / FP-X	Panasonic PLC
Fanuc	Series 30i / 31i-MB5	Series 0i-MD / 21i	Fanuc CNC
KEYENCE	KV-8000 / XG-8000 vision	KV-5500 / CV-5000	KEYENCE

7. Troubleshooting the basic principle, in 2026

Most field faults trace to one of three layers. Before swapping modules, work the layers from top to bottom:

1. Process image truth — is the input the PLC believes it is seeing actually the state on the wire? A failed sensor or a wet connector is more common than a CPU fault.
2. Logic integrity — is the program what you think it is? A recent change, a forgotten JSR, a broken seal-in rung. Compare the loaded project to the last known good.
3. Output path — is the module driving the load correctly? Fuses, blown output transistors, or a missing interposing relay.

For shutdowns caused by EOL modules (1746-OB16, 6ES7 312, Q02HCPU), the engineering problem is rarely the scan cycle anymore — it is finding a serviceable spare. Our BOM quote page and the AI Diagnostic Tool cover that side.

Related on KOEED Blog

• A Brief Introduction to PLCs
• PLC Scan Cycle: How a Single Loop Drives the Whole Controller
• Core Components of a PLC — CPU and Memory
• PLC Input/Output Modules and Their Role in Control
• The Structure of a PLC and the Functions of Each Part

Frequently asked questions

What is the basic working principle of a PLC?

A PLC performs a deterministic scan cycle in four steps: read all input signals into a process image table, execute the user program once against that snapshot, write the resulting states to the output modules, then run housekeeping and loop. That cycle is the same on every vendor platform.

How long is a typical PLC scan cycle in 2026?

For a mid-size line running an Allen-Bradley ControlLogix 1756-L73 or a Siemens S7-1500 CPU 1515, expect 8–30 ms total. High-speed motion is not driven by the PLC scan at all but by PROFINET over TSN or EtherNet/IP scheduled tasks.

Which memory type holds the program if power fails?

Modern controllers store retentive tags and recipes in NVRAM or MRAM, which is unaffected by power loss. Battery-backed SRAM is still common on installed bases; if the battery dies and the controller loses power, the user program and retentive data are lost.

Is ladder logic still the standard in 2026?

Yes. Ladder Diagram (LD) remains the dominant language under IEC 61131-3, especially for North-American OEM and field-IO work. Structured Text (ST) and Function Block Diagram (FBD) are now co-equal for batch, drives, and IIoT integration.

What changed between the 2024 and 2026 versions of this article?

Three things: field wiring moved to the network edge (IO-Link Wireless, PROFINET over TSN), the default northbound interface is OPC UA over MQTT, and AI co-processor modules now consume the process image for vibration, vision, and anomaly detection. The scan cycle itself did not change.

Can you help me cross-reference an EOL PLC module?

Yes. Send the original part number, the chassis, and the program backup to Moritta@KOEED.COM with the subject line BOM — EOL cross-reference. We respond with active-stock cross-references across 9 brands within 24 hours.