PLC Diagnostic and Status Bits: How to Use Them for Fault Detection

Share:
DCS and Automation
PLC Diagnostic and Status Bits: How to Use Them for Fault Detection

PLC diagnostic and status bits are internal flags set automatically by instructions and the processor. Reading them in ladder logic allows fault detection, instruction state monitoring, and alarm triggering without extra hardware.

EN DN TT bits CU CD OV UN bits System Status Bits Fault Detection Ladder Logic
Hello everyone, today we are going to learn about PLC diagnostic and status bits and how to use them for fault detection in ladder logic.

We will cover the status bits generated by timer, counter, and math instructions, and what each bit tells you about the instruction state.
We will also learn how the processor's own system status bits work, how to read them in ladder rungs, and how to build practical fault detection routines that use these bits to generate alarms and protect equipment.

Status bits are among the most underused tools in PLC programming. Every timer, counter, and math instruction generates them automatically. Using them reduces fault detection logic and makes programs easier to maintain.

PLC diagnostic

PLC Diagnostic and Status Bits: The Four Main Groups

Instruction Status Bits

Set by timer, counter, and move instructions. Examples: EN (enable), DN (done), TT (timer timing), CU (count up), CD (count down), OV (overflow), UN (underflow). Read directly as contacts in ladder rungs.

Math Status Bits

Set by the processor after any math instruction executes. Examples: Z (zero result), S (negative result), V (overflow), C (carry). Stored in the processor status word and read via status bit contacts.

I/O Module Status Bits

Set by the I/O chassis when a module has a fault, is missing, or has a blown fuse. Stored in the I/O fault table. Used to detect module failures without direct polling.

System / Processor Status Bits

Set by the processor itself. Examples: first scan bit (S2:1/15 in RSLogix 500), fault bits, run mode bit, math overflow enable bit. Used for startup initialisation, watchdog monitoring, and major fault detection.

Advertisement

Timer Status Bits: EN, DN, TT

Every TON, TOF, and RTO timer instruction generates three status bits. These bits change automatically as the timer runs and are the primary way to use a timer result in other rungs.

BitNameWhen it is ONCommon use in fault detection
ENEnable bitThe rung enabling the timer is true (timer is enabled)Confirm the timer rung condition is still present. Use XIC (EN) to seal in a fault latch when a timer starts.
TTTimer timing bitThe timer is actively counting (ACC is incrementing and has not yet reached PRE)Use XIC (TT) to trigger a warning before the DN bit fires. Signals that an operation is still in progress.
DNDone bitACC has reached PRE. The timer has timed out.The most used status bit. Use XIC (DN) to detect that a sequence step has not completed within the allowed time, triggering a fault alarm.
Fault Detection Pattern: Motor Did Not Start Within 5 Seconds
Rung 1: Start timer when motor output is ON but feedback is not received
[Motor_Output] [/Motor_Feedback] ----[TON T4:0 PRE=5000]----
 
Rung 2: Timer DN bit fires fault alarm if feedback not received within 5 s
[T4:0/DN] ----(OTL Motor_Start_Fault)----

The TON timer starts only when the motor output is ON but feedback is not yet received. If the motor starts normally, the feedback closes and the timer rung goes false.

If DN fires, the OTL latches the fault bit.

Counter Status Bits: CU, CD, DN, OV, UN

CTU and CTD counter instructions generate up to five status bits. These allow ladder logic to detect count events, detect overflow, and know when a preset has been reached.

BitNameWhen it is ONFault detection use
CUCount up enableThe CTU rung is true (count up input is enabled)Confirm the count up pulse is arriving as expected.
CDCount down enableThe CTD rung is true (count down input is enabled)Confirm the count down pulse is arriving as expected.
DNDone bitACC has reached PRETrigger an alarm or stop a process when the target count is reached.
OVOverflowACC has counted above the maximum positive value (32767 for INT)Detect a runaway counter a counter that keeps incrementing past preset due to a logic error or missing reset.
UNUnderflowACC has counted below the minimum value (minus 32768 for INT)Detect a runaway CTD counter decrementing past zero due to a missing stop condition.
Advertisement

Math Status Bits and I/O Fault Bits

Math instructions set status bits in the processor status word after every execution. The overflow bit (V) signals that a result exceeded the data type range and the stored value is incorrect.

S:V (Overflow)
Set when a math result exceeds the register range. A DINT overflow means the stored value is incorrect. Use XIC (S:V) to latch a calculation fault before the wrong value reaches a control output.
S:Z (Zero)
Set when a math result equals zero. Use XIC (S:Z) with a DIV instruction to detect a divide-by-zero condition before it causes a fault.
S:N (Negative)
Set when a math result is negative. Use XIC (S:N) to detect a negative flow rate, negative level, or other physically impossible result from a calculation.
I/O fault bits
Stored in the I/O fault table word for each slot. Use XIC of the slot fault bit to detect a missing module, blown fuse, or field wiring open circuit on any output channel, triggering an alarm without checking each channel individually.
Important: Math status bits (S:V, S:Z, S:N) in RSLogix 500 are sticky they stay set until the next math instruction clears them. Always read math status bits in the rung immediately after the instruction that sets them. If other math instructions execute between the setter and the reader rung, the bit may have been cleared or overwritten by the intermediate instruction.

System Status Bits for Startup and Watchdog Use

The PLC processor maintains a status file containing bits that reflect the processor's own operating state. These are read-only bits set by the firmware, not by ladder logic.

First scan bit
S2:1/15 (RSLogix 500) or a first-scan tag in Studio 5000. ON only during the very first scan after the PLC enters Run mode. Use it to initialise arrays, load default setpoints, and clear counters once at startup.
Major fault bit
S2:5 (RSLogix 500). Set when the processor has detected a major fault and halted. Used in a fault routine to capture and log the fault code before the processor stops scanning.
Minor fault bits
S5:0 to S5:n (RSLogix 500). Each bit corresponds to a different minor fault type. Read these in ladder to detect recoverable faults (communication timeout, math overflow interrupt) and take corrective action without stopping the scan.
Run mode bit
Set when the processor is in Run mode. Use XIO (run mode bit) to detect when the PLC has been placed in Program mode during normal operation, which is an unauthorised change worth alarming.
Watchdog overflow
Set when the scan time has exceeded the watchdog timeout. Use this in a fault routine to detect a runaway scan caused by a large indirect addressing loop or excessive subroutine depth.
Tip: Build a fault capture rung for every timed sequence step.

For every output that has a required response time (motor starts, valve moves, cylinder extends), add a TON timer with a preset equal to the maximum allowed response time. Wire the timer DN bit to an OTL coil that latches a named fault tag. This pattern uses only three rungs per supervised action, requires no additional field wiring, and gives the HMI operator a named fault rather than a generic PLC fault code.

Watch: PLC Status Bits in Ladder Logic Explained

Advertisement

PLC Status Bits Questions Engineers Ask

What is the DN bit in a PLC timer instruction?
The DN bit turns ON when the timer accumulated value reaches its preset. Use XIC (DN) in a fault rung to detect that a timed step did not complete in time.
What is the difference between TT and DN bits in a timer?
The TT bit is ON while the timer is counting before reaching the preset. The DN bit turns ON when the preset is reached. TT signals in-progress and DN signals completion.
What does the OV bit mean in a PLC counter?
The OV bit turns ON when a CTU counter accumulated value exceeds the maximum positive value. It indicates a runaway counter. Use XIC (OV) to latch a fault alarm.
What is the first scan bit used for in PLC programming?
The first scan bit is ON only during the very first scan after the PLC enters Run mode. It runs startup initialisation once, loading default setpoints and clearing arrays without a manual reset.
How do I detect an I/O module fault using ladder logic?
Use an XIC contact for the I/O fault bit of the suspect module slot. It is set when a module is missing or has a wiring fault. Wire it to an alarm coil.

Related Articles on This Site

External References

Advertisement

What We Learn Today

  • PLC diagnostic and status bits are automatic flags set by instructions and the processor. Timer bits EN, TT, and DN indicate whether a timer is enabled, timing, or done. Counter bits CU, CD, DN, OV, and UN indicate counting state, preset reached, overflow, and underflow. Reading these bits in ladder rungs is the simplest way to build fault detection without extra hardware.
  • Math status bits S:V, S:Z, and S:N are set by the processor after each math instruction. They detect overflow, zero results, and negative results. Always read math status bits in the rung immediately after the instruction that sets them, as the next math instruction will overwrite them.
  • The processor system status file contains bits for first scan, major fault, minor faults, run mode, and watchdog overflow. Use the first scan bit to run startup initialisation logic once. Use the major fault bit in a fault routine to capture and log the fault code before the processor halts.
I hope you like above blog. There is no cost associated in sharing the article in your social media. Thanks for reading!! Happy Learning!!

Leave a Reply

Your email address will not be published. Required fields are marked *