PLC Work Process: The Four Stages of a 2026 Scan Cycle

PLC Fundamentals · Engineering Notes · 2026 Update

By KOEED Engineering Team · 2026-07-06 · 7 min read · Engineering Notes

A Programmable Logic Controller (PLC) is sometimes described as a relay panel you can edit with a laptop. Mechanically that is still close to the truth, but the way the box runs code in 2026 is no longer the simple "read inputs, run ladder, write outputs, loop forever" picture that a 1980s PLC scan cycle textbook drew. The four parts of a PLC's work are the same — input sampling, program execution, output refresh, and housekeeping — but on a 2026 mid-tier CPU from Allen-Bradley, Siemens, Mitsubishi, or Schneider, the four parts repeat in parallel across multiple tasks. This engineering note rewrites the 2024 version of the article with a 2026 lens.

The four parts of a PLC's work, in one picture

The four-part model is not a 2026 invention — it is the same model Allen-Bradley documented for the PLC-2 in the 1970s. What 2026 firmware changed is that the four parts now run as scheduled tasks rather than as a single sequential loop. A periodic fast task, a periodic normal task, a periodic slow task, and an event task each get their own copy of the four parts, interleaved by a priority scheduler. Inside every one of those tasks, the four parts still occur in the same order.

Part	Stage name	What it does in 2026	Typical time on a 2026 mid-tier CPU
1	Input sampling	Read DI/AI into the process image, plus incoming CIP Security / OPC UA / PROFINET frames.	0.5 – 2 ms per chassis
2	Program execution	Resolve ladder / FBD / ST / SFC top-down, then run user C/C++ libraries.	5 – 50 ms
3	Output refresh	Push the process image to physical DO/AO and downstream fieldbus devices.	0.5 – 2 ms
4	Housekeeping	Comms stack, retentive tag save, OPC UA publish, watchdog service, diagnostics.	Background, slice-based

Part 1 — Input sampling: reading the field into a process image

Part 1 is the PLC's eyes. The CPU walks the input modules in its chassis and over its fieldbus networks and copies the state of every digital and analog channel into a region of memory called the process image (sometimes called the input image, or in Logix the "input tag table"). For the rest of the scan, program code reads the process image — it does not read the field directly. This is what makes the four-part cycle deterministic: the program sees a stable snapshot of the field, not a moving target.

In 2026, Part 1 also pulls in fieldbus data: PROFINET IO from a SIMATIC ET 200SP head, EtherNet/IP racks from a 1756-EN4TR module, CC-Link IE TSN from a MELSEC iQ-R station, and analog values from a Modicon BMXAMI0800. Each of those channels ends up in the same process image by the time Part 2 starts. The size of that image, and how it is mapped to symbolic tag names, is one of the variables that determines scan time.

Part 2 — Program execution: the brain of the four parts

Part 2 is the part engineers spend the most time thinking about, and the part most often confused with the entire four-part cycle. The CPU walks the user program from top to bottom (for ladder / FBD / ST) or step by step (for SFC) and resolves every instruction against the process image it built in Part 1. Outputs are not yet pushed to the field — they are written to a shadow process image in memory.

The 2026 model for Part 2 still maps to IEC 61131-3, now in its 4th edition (released 2024, in wide use 2025-2026). The 4th edition clarified how the five core languages — Ladder (LD), Function Block Diagram (FBD), Structured Text (ST), Instruction List (IL, deprecated), and Sequential Function Chart (SFC) — coexist with object-oriented extensions and C/C++ user libraries. A typical 2026 project mixes them by purpose:

• Ladder at the wiring boundary — discrete I/O, hand-off-auto, E-stop chains, motor starters. Still the dominant Part 2 language on a 1756-L82ES or 6ES7 516-3AN02.
• FBD for PID, motion primitives, and valve manifolds — common on a Schneider M580 or Mitsubishi iQ-R.
• ST for batch recipes, string parsing, MQTT payload assembly, and OPC UA method handlers.
• SFC for machine modes — manual / semi-auto / auto / clean-in-place.
• C/C++ user libraries for OEM-specific math, vision coordinate transforms, and custom cam profiles.

For a hands-on walk-through of the IEC languages side by side, see Introduction to the six programming languages of PLC. For how a four-part scan differs from a relay ladder in practice, see the difference between programmable controller and relay control.

Part 3 — Output refresh: writing the process image to the field

Part 3 is the part of the four-part cycle that actually moves contactors. After Part 2 finishes, the CPU copies the shadow process image — the values the program wrote — out to the physical modules and to downstream fieldbus devices. This is called the output update, the output refresh, or, on Siemens CPUs, the PAA (Process Image Output) write. It is a single, atomic, point-in-time write, which is why two contacts on the same scan never see an intermediate state.

In 2026, Part 3 also pushes data into the fieldbus: DO/AO modules over the backplane, EtherNet/IP assemblies to a PowerFlex 525, PROFINET slots to a SINAMICS drive, and CIP Safety frames to a GuardLogix safety partner. The 2024 baseline was "push the chassis DO/AO"; the 2026 baseline adds OPC UA over TSN publish for downstream analytics and MQTT publish for cloud historians. The four parts of PLC work still happen locally — but the field the PLC writes to in 2026 includes a cloud broker.

Part 4 — Housekeeping: the part that keeps the four-part cycle alive

Part 4 is the most often omitted from textbook diagrams, and on a 2026 CPU it is also the most expensive. Housekeeping is everything the CPU does that is not Parts 1, 2, or 3: the comms stack (EtherNet/IP, PROFINET, Modbus TCP, OPC UA over TSN), retentive tag save to non-volatile memory, the OPC UA server, MQTT publish, diagnostic counters, secure-boot attestation, and watchdog service. It runs in slice time between the periodic tasks, and it is what determines whether a CPU can hit its declared scan period on a fully loaded chassis.

On a ControlLogix 5380 (1756-L82E / L82ES / L84ES), an S7-1500 V2.9, a Modicon M580 BMEH586040 with firmware V3.50, and a MELSEC iQ-R R08CPU / R16CPU, Part 4 is the place where the 2026 cybersecurity features live. CIP Security, Security-by-Default, signed firmware, and the per-task independent watchdog are all Part 4 services. If a 2024 .ACD file is loaded onto a 2026 CPU without re-confirming the task table, Part 4 will throw a watchdog fault on the first heavy comms cycle.

What changed since 2024

The four parts of a PLC's work are unchanged. What changed is the runtime, the I/O, the comms, and the security stack underneath them. If you read the 2024 version of this article, here is the deltas worth tracking on a 2026 build:

Part of the work	2024 baseline	2026 update
Part 1 — Input sampling	Local DI/AI only	+ IO-Link, CIP Security on EtherNet/IP, OPC UA subscriptions
Part 2 — Program execution	Ladder + FBD on a single task	Multi-task scheduler, LD + FBD + ST + SFC + C/C++ libraries
Part 3 — Output refresh	Chassis DO/AO only	+ CIP Safety, OPC UA over TSN publish, MQTT publish
Part 4 — Housekeeping	LED + fault word	Signed firmware, secure-boot attestation, per-task watchdog, anomaly counters
Cybersecurity	Optional password on CPU	CIP Security / Security-by-Default mandatory on new mid/high-end CPUs
Tooling	Studio 5000 v34, TIA V17	Studio 5000 v36+, TIA Portal V19, GX Works3 1.100+, EcoStruxure Control Expert 16

How to validate the four-part cycle on a 2026 PLC (10-minute checklist)

1. In the IDE, open the task list and confirm each periodic task has a watchdog that matches its priority and declared period.
2. Watch Part 1 — input sampling — finish before Part 2 begins. If an event task is preempting, set the event task priority below the safety task.
3. Watch Part 3 — output refresh — finish before the next Part 1. A growing gap here is the first sign that Part 4 housekeeping is starving.
4. Confirm CIP Security or Security-by-Default is enabled on every Ethernet port that touches the plant network.
5. Confirm OPC UA server is licensed — a 1756-L82E ships with a 1-year trial; an S7-1500 needs a runtime license; a Modicon M580 OPC UA server is standard from firmware V3.50.
6. Cross-reference any 2024-vintage project file (.ACD / .ZAP / .GXP) against the firmware revision on the new CPU before download.
7. For EOL CPUs still in service (PLC-5, SLC 500, S7-300, MELSEC-Q), keep a known-good program image and an offline backup on the engineering workstation.

Internal links & related reading

• How a PLC works in 2026: scan cycle, multi-tasking, IEC 61131-3
• PLC scan cycle
• Two basic working modes of PLC and scanning process
• Introduction to the six programming languages of PLC
• The difference between programmable controller and relay control
• PLC error code lookup (Siemens / Mitsubishi / Omron)
• KOEED AI diagnostic tool — 24/7 fault troubleshooting

Frequently Asked Questions

What are the four parts of a PLC's work?

Input sampling, program execution, output refresh, and housekeeping. On a 2026 mid-tier CPU the four parts run inside a multi-task scheduler in that order on every periodic task.

What is a process image in Part 1 input sampling?

A memory region holding the latest state of every input. Part 1 copies the field into it; Part 2 reads from it (not the field directly), so the program sees a stable snapshot.

Why is output refresh a separate step from program execution?

Part 2 writes program results to a shadow process image. Part 3 copies that image to the field in one atomic step, so two outputs on the same scan never see an intermediate state.

What does housekeeping cover on a 2026 PLC?

Comms stack, retentive tag save, OPC UA publish, MQTT publish, watchdog service, secure-boot attestation, and predictive diagnostics. It runs in slice time between the periodic tasks.

How long does one four-part cycle take on a 2026 mid-tier CPU?

On a 1756-L82E, 6ES7 516-3AN02, R08CPU, or M580 BMEH586040, the periodic normal task lands between 10 and 50 ms, fast tasks under 2 ms, and event tasks under 100 µs of latency.

Do you stock the part numbers referenced in this article?

Yes. Active and EOL stock for Allen-Bradley, Siemens, Mitsubishi, Omron, Fanuc, Schneider, Yaskawa, Panasonic, and KEYENCE. Email Moritta@KOEED.COM for a 24h quote.