How a PLC Works in 2026: Scan Cycle, Multi-Tasking & IEC 61131-3
Share
AI Summary
- A 2026 PLC runs an event-driven multi-task scheduler on top of the legacy read-run-write loop, not a single cyclic scan.
- IEC 61131-3 still defines five core languages, but ladder is now one of several mixed in real projects.
- Safety, OPC UA over TSN, CIP Security, and signed firmware are now baseline on mid/high-end CPUs.
- For sourcing, the new variables are firmware revision, OPC UA license, and TSN switch compatibility.
Quick read on how a 2026 PLC scans, executes, and reports — written for engineers who spec, commission, or maintain industrial controllers.
PLC Fundamentals · Engineering Notes · 2026 Update
By KOEED Engineering Team · 2026-07-02 · 8 min read · Engineering Notes
Every factory floor still has a Programmable Logic Controller (PLC) humming inside a panel somewhere — but the way that controller runs code in 2026 is no longer the single "read inputs, execute ladder, write outputs" loop that a 1980s Allen-Bradley SLC 150 was designed around. Modern controllers from Allen-Bradley, Siemens, Mitsubishi, and Schneider blend a deterministic scan cycle with multiple tasks, event-driven interrupts, integrated safety, and OPC UA over TSN. Here is how the box on the wall actually works today.
What a PLC Still Is in 2026
A PLC is an industrial-rated, deterministic computer made of a CPU, retentive and volatile memory, discrete and analog I/O modules, communication interfaces, and a real-time operating system. It is built to survive dust, heat, vibration, electrical noise, and a 20-year service life. The headline changes since the 2024 version of this article are not in the box itself but in how the firmware schedules the program inside it.
| Building block | What it does | 2026 example |
|---|---|---|
| CPU module | Runs the IEC 61131-3 program on a deterministic RTOS. | 1756-L82E, 6ES7 516-3AN02, R08CPU, BMEP586040 |
| Process image | Mirror of all I/O read at the start of each scan; updated at output. | Tag-based in Logix; symbol-based in S7-1500 |
| I/O modules | DI / DO / AI / AO, plus IO-Link and safety on the same rack. | 1756-IB16IF, 6ES7 321-1BL00, RX40C7 |
| Communication | EtherNet/IP, PROFINET, Modbus TCP, plus OPC UA over TSN. | 1756-EN4TR, 6GK7 243-1CX30, CC-Link IE TSN |
| Power supply / chassis | Backplane power, hot-swap, secure-boot validation on 2026 CPUs. | 1756-PB75R, 6ES7 507-0RA00, R61P |
The 2026 Scan Cycle: Read, Run, Write, Then Re-Prioritize
The textbook 3-stage cycle — input scan → program execution → output update — is still correct for low-end CPUs (MicroLogix 1100, Siemens LOGO! 8.4, Omron CP1E, KEYENCE KV-8000). It is also still what happens on every scan inside any larger controller. What changed is that mid- and high-end CPUs now run several periodic tasks plus event tasks in parallel, with a scheduler that prioritizes fast and safety tasks above the rest.
| Stage | What happens | Typical 2026 time |
|---|---|---|
| Input scan | Read DI/AI into the process image (PI) and refresh incoming fieldbus data. | 0.5 – 2 ms per chassis |
| Program execution | Resolve ladder / FBD / ST / SFC top-down, in priority order. | 5 – 50 ms |
| Output update | Push PI to physical DO/AO modules and downstream fieldbus devices. | 0.5 – 2 ms |
| Housekeeping | Comms stack, retentive tag save, OPC UA publish, diagnostic counters. | Background |
Inside a Logix 5380, an S7-1500 V2.9+, an iQ-R, or an M580 BMEH586040, the same three stages repeat — but the scheduler interleaves multiple task instances. A fast task (0.5 – 2 ms) handles registration and CIP Motion. A normal task (10 – 20 ms) runs the main ladder. A slow task (100 – 500 ms) batches OPC UA publish. An event task (< 100 µs latency) handles safety stops and register-match triggers. Every task still gets a watchdog; firmware v36 on Studio 5000 and TIA Portal V19 now give each task its own independent watchdog, which is great for diagnostics but means a 2024 .ACD file may need task-config migration to load cleanly on a 2026 CPU.
> Tip
In Studio 5000 v36+ or TIA Portal V19, set each task's period to a multiple of the slowest task period. Avoid 17 ms on a 10/20 ms schedule — drift shows up first as sporadic watchdog trips on the safety task.
How the Program Actually Runs: IEC 61131-3 in 2026
The IEC 61131-3 standard has defined five programming languages since 1993, and the 4th edition (2024) clarified how they coexist with object-oriented extensions. In 2026, a typical project mixes them based on what each part of the machine actually does:
- Ladder (LD) — discrete I/O mapping, hand-off-auto stations, E-stop chains, motor starters. Still dominant at the wiring boundary.
- Function Block Diagram (FBD) — PID loops, motion primitives, valve manifolds.
- Structured Text (ST) — batch recipes, string parsing, MQTT payload assembly, recipe download from MES.
- Sequential Function Chart (SFC) — machine modes (manual / semi-auto / auto / clean-out / CIP).
- C/C++ user libraries — OEM-specific math, vision coordinate transforms, custom cam profiles.
For a hands-on example of the IEC languages side by side, see Introduction to the six programming languages of PLC. For ladder-to-FBD conversion technique, see commonly used methods for PLC ladder diagram programming conversion.
What Changed Since 2024
If you read the 2024 version of this article, here is what is materially different on the floor today:
| Area | 2024 baseline | 2026 update |
|---|---|---|
| Scheduler | Single cyclic scan, ~10 – 50 ms | Multi-task + event interrupts; sub-ms motion windows |
| Languages | LD + FBD mostly | LD + FBD + ST + SFC + C/C++ all routine |
| Fieldbus | Profibus / EtherNet/IP / Modbus TCP | + OPC UA over TSN, CIP Security, MQTT publish |
| Safety | External safety relay | Integrated SIL 3 / PLe on the same CPU (GuardLogix, F-CPU) |
| Diagnostics | LED + fault word | Predictive tags, secure-boot attestation, anomaly counters |
| Edge / cloud | Periodic push to SCADA | Native MQTT / OPC UA pub/sub to cloud historian |
| Cybersecurity | Optional password on CPU | Signed firmware, CIP Security / Security-by-Default mandatory on new CPUs |
! Warning
Hot-swapping a ControlLogix power supply or chassis module without a UPS can corrupt retentive program memory on 2026 firmware. The Logix 5380 platform added secure-boot validation — a half-written firmware image now bricks the CPU until re-flashed at the bench. Always back up the .ACD first, and confirm the replacement PSU firmware revision matches the chassis.
The Eight Control Tasks a 2026 PLC Must Complete
The body of this question has not changed since 2024, but the implementation of each task has. The 2026 list, with the part numbers we actually stock for replacement builds:
| # | Task | 2026 implementation |
|---|---|---|
| 1 | Input monitoring | DI/AI into PI, plus IO-Link masters and CIP Security on EtherNet/IP |
| 2 | Logic execution | LD + FBD + ST + SFC + C/C++ in user libraries |
| 3 | Output control | DO/AO + safety outputs on GuardLogix / SIMATIC F-CPU |
| 4 | Motion | CIP Motion over TSN, SERCOS III, MR-J5, Kinetix 5700 |
| 5 | Safety | Integrated SIL 3 / PLe on 1756-L82ES, 6ES7 516-3FN02, R08SFCPU-SET |
| 6 | Communications | OPC UA over TSN, MQTT publish, HTTPS REST, CIP Security |
| 7 | Data / historian | Built-in OPC UA server, MQTT publish to cloud historian |
| 8 | Diagnostics / self-test | Predictive anomaly tags, firmware health, secure-boot attestation |
Real-Time, Multitasking, Flexibility — The Three Reasons a PLC Beat the Relay
The PLC replaced the relay panel because it could do three things a relay ladder could not. None of those advantages have gone away — they have just been amplified:
- Deterministic real-time response. Every scan finishes within its declared period, every watchdog is enforced. On a 2026 mid-tier CPU the total system response (input change → logic → output) is sub-10 ms for safety-critical signals and well under 50 ms for process logic.
- Multitasking across many I/O points. A single chassis may have hundreds of DI/DO/AI/AO points plus fieldbus slaves, all updated in lockstep. Modern CIP Motion over TSN drives dozens of axes with deterministic scheduling.
- Reprogrammable behavior. A model change is a project download, not a wire pull. New variants, A/B recipes, seasonal SKUs — all become software changes. The 2026 addition is that firmware updates can now be signed and validated, so you can do that without bricking the controller.
How to Validate a 2026 PLC Project (10-Minute Checklist)
- Open the task list in Studio 5000 / TIA Portal / GX Works3 / EcoStruxure. Confirm each task has a watchdog that matches its priority.
- Check that every periodic task period is a multiple of the slowest task period (avoid 17 ms on a 10/20 ms schedule).
- Verify CIP Security or Security-by-Default is enabled on every Ethernet port that touches the plant network.
- Confirm OPC UA server is licensed — 1756-L82E ships with a 1-year trial; S7-1500 needs a separate runtime license; Modicon M580 OPC UA is standard from firmware V3.50.
- Cross-reference any 2024-vintage .ACD / .ZAP / .GXP project file against the firmware revision on the new CPU before download.
- For EOL CPUs still in service (PLC-5, SLC 500, S7-300, MELSEC-Q), keep a known-good program image and an offline backup on the engineering workstation.
Note
All part numbers referenced in this article are stocked at KOEED with worldwide shipping. For a current cross-reference (e.g. 1747-ASB → 1756-DNB + 1734-ADN, or 6ES7 315-2EH14 → 6ES7 516-3AN02), send the original P/N to Moritta@KOEED.COM and we will respond with availability and lead time within 24 hours.
Internal links & related reading
- How does PLC work and what control tasks must be completed? (2026 update)
- A PLC host consists of three major components
- 10 essential basics every PLC programmer should know
- Analysis of three major development trends of PLC technology
- PLC scan cycle
- PLC error code lookup (Siemens / Mitsubishi / Omron)
- KOEED AI diagnostic tool — 24/7 fault troubleshooting
Specifying a 2026 PLC build?
Send your BOM (current CPUs, EOL spares, safety modules, motion) to Moritta@KOEED.COM. Active stock, EOL stock, and verified cross-references — one quote within 24 hours.
Send My BOM →Frequently Asked Questions
What is a PLC and how does it work in simple terms?
An industrial computer that reads inputs, runs an IEC 61131-3 program deterministically, and writes outputs. The classic 3-stage scan still exists on every 2026 controller.
What is a PLC scan cycle?
One pass through input scan, program execution, and output update. On a 2026 mid-tier CPU the total cycle is 10 to 50 ms, with sub-ms event tasks.
Is ladder logic still used on modern PLCs?
Yes. Ladder dominates the wiring boundary — discrete I/O, E-stops, motor starters. Modern projects also mix in FBD, ST, and SFC.
PLC vs PAC — what is the difference in 2026?
A PAC adds memory, languages, and PC-like connectivity. The line has blurred — ControlLogix 5380, S7-1500, and iQ-R are PACs but use the same IEC 61131-3 toolchain.
How do I migrate a 2024 program to 2026 firmware?
Open the .ACD / .ZAP / .GXP in the latest Studio 5000 / TIA Portal / GX Works3 and let the migration tool rebuild the task table. Re-confirm watchdog values.
Does KOEED stock the part numbers mentioned?
Yes. Active and EOL stock for AB, Siemens, Mitsubishi, Omron, Fanuc, Schneider, Yaskawa, Panasonic, KEYENCE. Email Moritta@KOEED.COM for a 24h quote.
KOEED Engineering Team
Industrial automation editors at KOEED. Writing about PLC scan cycles, multi-tasking firmware, OPC UA over TSN, and legacy EOL sourcing. Reach the team at Moritta@KOEED.COM.