Change Detection
On the Security tab of the controller properties, the Change Detection feature tracks changes to a controller and generates an audit value when a monitored change occurs.
For more information about change detection, see the Logix 5000 Controller Information and Status Programming Manual, publication 1756-PM015.
Change Detection

Changes to Detect
Click Configure to open the Configure Changes to Detect dialog box. We recommend tracking the following changes for a standard controller. By default, all event types can cause the audit value to change, resulting in a default value of 0xFFFFFFFFFFFFFFFF.
- Project stored to removable media
- Online edits modified controller program
- Transaction committed
- SFC forces enabled
- SFC forces disabled
- SFS forces removed
- SFC element force value changed
- I/O forces enabled
- I/O forces disabled
- I/O forces removed
- I/O forces modified
- Firmware update attempted
- Firmware update from removable media attempted
- Remote mode change
- Controller switch mode change
- A major fault occurred
- All major faults cleared
- All major faults cleared through controller switch
- Task properties modified
- Program properties modified
- Removable media removed
- Removable media inserted
- Constant Tag value changed
- Multiple constant Tag values changed
- Constant Tag attribute cleared
- Constant Tag attribute set
- Custom Log Entry Added
- Correlation affected
- Alarm Log values cleared
- Parameter Connection has been modified
- Port configuration has been changed
By default, all event types can cause the audit value to change, resulting in a default value of 0xFFFFFFFFFFFFFFFF.
Audit Value
A unique value that is generated when a project is downloaded to the controller or loaded from a storage device. This value is updated when a change to an event occurs. Some events always cause an Audit Value change, while others are selectable in the Configure Changes to Detect dialog box. When the controller is offline, the Audit Value box is blank.
Provide Feedback