Ignition Logix Status Word: Catch PLC Program Downloads

The Status tag under the Allen-Bradley Logix driver's device diagnostics is a packed 16-bit CIP status word. It is not a list of event codes. On a 1756-L71 the values 12640, 12656 and 12400 decode to key switch position, processor mode and fault flags. None of them means "download in progress." To catch an off-shift download, combine the mode bits with the controller's audit value or its internal controller log. The status word by itself is not enough.

Read the Status Word Bit by Bit

Start here. Convert each value you observed to hex before you interpret it. The decimal numbers hide the structure.

12400 and 12656 differ by one bit, bit 8. Both values report Program mode. 12400 only means the controller was in Program mode while the bit-8 flag was clear. That condition happens during a download, but it does not identify one.

Key switch field (bits 12-13) values:

• 0 Undefined
• 1 Run
• 2 Program
• 3 Remote

Understand What the Word Encodes

The driver reads the Status attribute of the controller's CIP Identity Object. The layout is defined in the CIP specification, Volume 3, tables 5A-2.3 and 5A-2.4. Vendors that use the reserved or vendor-specific bits must declare them in the device's EDS file.

• Bit 0, Owned. This bit is aimed at I/O adapters and means little for a processor.
• Bit 1: reserved.
• Bit 2, Configured. In general this bit stays true unless the device is at factory default. It read 0 in all three captured values, so do not use it as a health bit on this controller.
• Bit 3: reserved.
• Bits 4-7: a 4-bit extended status code. The generic CIP meanings start at 0 = self test/unknown, 1 = firmware updating, and 2 = faulted I/O connection. Rockwell maps this field to processor mode on Logix controllers. On this L71, 6 tracked Run and 7 tracked Program.
• Bits 8-11: fault flags. In the generic CIP Identity definition, bit 8 is the minor recoverable fault. Confirm this against the spec table, then compare it with the Minor Faults tab in Controller Properties. A download clears the controller's fault state, and a recurring minor fault sets the bit again once logic runs. That behavior matches the 12400 → 12656 sequence.
• Bits 12-13: key switch position.

So a download looks like this in the Status tag: the mode goes to 7, the fault flags reset, and the connection may drop. A remote mode change from Studio 5000 looks almost the same. An operator turning the key to Program looks almost the same too. The status word cannot tell these apart.

Decode the Word with Expression Tags

Do not alarm on raw decimal values. Any change in an unrelated bit, such as a new minor fault, changes the number and breaks your logic. Mask and shift instead.

1. Find the device's diagnostic Status tag in the OPC browser and drag it into the tag provider next to the expression tags below. The expressions reference it relatively as {[.]Status}.
2. Create an Integer expression tag for the key switch:

   // Bits 12-13: 0 Undefined, 1 Run, 2 Program, 3 Remote
   ({[.]Status} & 12288) >> 12

3. Create an Integer expression tag for processor mode:

   // Bits 4-7: 6 = Run, 7 = Program (observed on 1756-L71)
   ({[.]Status} & 240) >> 4

4. Create a Boolean expression tag for the bit-8 fault flag:

   getBit({[.]Status}, 8)

5. Enable tag history on the mode and key switch tags. Use on-change sampling so every transition is stored with a timestamp.
6. Set the tag group rate on the source Status tag faster than the shortest Program-mode window you need to catch. A slow group can miss a brief remote Program/Run toggle entirely.

Add the Controller Audit Value

The mode bits tell you when the controller left Run. They do not tell you whether the project changed. For that, capture the controller's audit value, a hash that changes when the project changes.

1. Add a GSV instruction to a continuous or periodic task. It should read the controller's audit value into a controller-scoped tag. Take the exact class and attribute names, and the minimum firmware revision for your L71, from Rockwell publication 1756-PM015.
2. Bring that tag into Ignition as a normal OPC tag and historize it on change.
3. Correlate the two signals:
   • Mode goes to 7, returns to 6, and the audit value has changed a few seconds after returning: treat it as a download.
   • Audit value changes while mode stays 6: an online edit.
   • Mode goes to 7 and back with the audit value unchanged: a mode change only.

Know the limitation. A GSV executes only while logic scans. In Program mode the stored value freezes, and after a download it updates only once the controller is back in Run. Compare values on either side of the Program window, not during it.

Third-party Ignition driver modules can read arbitrary CIP class/instance/attribute values directly. Those modules poll regardless of PLC mode and need no ladder change. The stock Logix driver exposes the Status word but not the audit attribute.

Pull the Controller Log for Who and When

The Status word and audit hash tell you that something happened. The controller log tells you who did it and what they did.

• Depending on controller firmware, the Logix controller keeps an internal audit log. It records nearly every action taken from Logix software: going online, saving the project, going offline, rung changes, comment changes, and tag value changes, each with user and time.
• The Controller Logging section of Rockwell publication 1756-PM015 describes the feature and the firmware that supports it. Check your L71 revision against it before you build anything.
• Do not write the log to the SD card on a schedule. Read or write the card only when you need to, because scheduled card writes add wear for no benefit.

Use PlantPAx Change Detection or AssetCentre Instead

If you want a supported product rather than your own correlation logic, two options exist.

Verify the Detection Logic

Test every path during a scheduled window before you trust the night-shift report.

1. Mode toggle: with the key in Remote, go Program then Run from Studio 5000. Confirm the mode tag reads 7 then 6 and the audit value does not change. Your logic must not flag a download.
2. Online edit: make a harmless rung comment or edit in Run. Confirm the audit value changes, the mode stays 6, and the event is classified as an edit.
3. Download: download the unchanged project. Confirm the mode goes to 7 and the bit-8 flag clears (Status reads 12400 if the minor fault recurs). Confirm the device connection may drop in Ignition, the audit value changes after return to Run, and the event is classified as a download.
4. Key switch: turn the key to Run and confirm the key switch tag reads 1. Turn it back to Remote and confirm it reads 3.
5. Open tag history and confirm each transition is stored with the correct timestamp. Also confirm that gaps during a connection loss are visible rather than silently interpolated.

Avoid These Recurring Mistakes

• Treating 12400 as a download code. That is not the fault. It is Program mode with bit 8 clear. A different minor-fault state or key position gives a different number for the same event.
• Ignoring quality. During a download the controller drops CIP connections, and Ignition may show the device disconnected with the Status tag holding its last value. Log quality transitions on the Status tag as events too. A disconnect followed by Program mode is a strong download indicator.
• Building detection when you could block the change. On a ControlLogix, the key switch in RUN blocks downloads and remote mode changes. If third-shift downloads are not allowed, set the key to RUN and remove it. Your key switch tag will then show 1 all shift.
• Losing default values on download. A download writes the offline project's tag values into the controller. If report baselines live in PLC tags, historize them in Ignition. Alarm when they change outside an expected window so the first shift sees the overwrite before the report runs.
• Relying on the audit hash alone. It also changes on legitimate online edits. Pair it with the mode bits or you will flag every edit as a download.

FAQ