Retentive data, startup behaviour and fault handling
What survives a power failure, what happens on warm and cold restart, first-scan initialization, startup in a safe state, PLC fault reactions and simulation for testing.
Retentive vs non-retentive
| Data | Should it be retentive? |
|---|---|
| Operating hours, start counters, totals | Yes |
| Setpoints entered by operators, recipes | Yes (or stored in HMI/SCADA) |
| Sequence states, run commands | Usually no — the plant must not restart by itself after power returns |
| Alarm latches of trips | Depends; safer to re-evaluate from the field |
IEC 61131-3 declares VAR RETAIN; TwinCAT and CODESYS also offer PERSISTENT (kept across a new download). Siemens S7-1500 marks retentivity per variable in data blocks.
Startup
Controllers distinguish warm restart (retentive data kept, non-retentive initialized) and cold restart / reset (everything initialized). Use a startup routine (Siemens startup OB 100, a FirstScan flag in CODESYS/TwinCAT) to:
- put sequences into an idle state;
- require a new operator command before equipment starts;
- check plausibility of retentive values;
- wait until communication and remote I/O are up before evaluating their signals.
Fault reactions
PLCs call error handlers or go to STOP on serious errors (cycle time exceeded, I/O access errors, division by zero in some systems). Decide deliberately: stopping the CPU sets outputs to their substitute values — is that the safe state of the plant? Remote I/O stations have their own output behaviour on communication loss (switch off, hold last value, substitute value) that must match the process.
Simulation
Build a simulation mode into equipment blocks (feedback follows command after a delay, analog values from a simple model). It allows testing sequences on PLCSIM, a soft PLC or a test bench before the plant exists — and must be impossible to activate unnoticed in production.
Connections
Open in Knowledge Graph →Loading the map…
Sources
Updated 2026-10-02