"no matter what" is a pretty unforgiving request...
In my experience with PLC5 and SLCs:
The SLC will attempt to put output cards in their configured safe state when a fault occurs. I am not sure which cards are configurable, but I am pretty sure that they all have a published fault state. I believe the SLC handles this function, but it may actually be done by the card itself...
I have worked with dozens of both PLC5 and SLC systems and I can say with confidence, the SLC CPU will fail more often than a PLC5, and that anything can happen to the outputs.
Just last week we had a 5/04 on the fritz...each time it faulted, the symptoms changed, with the outputs in different states each time.
My partner handled the problem so I don't know how the I/O was configured, but overheard discussions about why outputs were still on during this fault condition, and that they seemed random each time the SLC faulted.
The first report was a CPU fault for a card removal under power. Then, an hour later, the power supply died. She thought we were done with it after replacing that, but, then another hour or two later, the CPU went blank (default state) and had to be replaced
Each time, different outputs were left in the on state.
My advice is that if it is mission or safety critical, provide a hardwire means of acheiving the safe state. Try to choose devices that will fail to the safe state when de-energized. Then it is easy to have both PLC and E-Stop control of the device and also not have to worry about what happens if a wire breaks.
EDIT: I think this is more what you were asking for:
S:1/13 Dynamic Config Major Error Halted Bit
This bit is set by the processor any time a major error is encountered. The processor enters a fault condition. Word S:6, Fault Code will contain a code which can be used to diagnose the fault condition. Any time bit S:1/13 is set, the processor: either:
a) places all outputs in a safe state and energizes the fault LED, or
b) enters the user fault routine with outputs active, allowing the fault routine ladder logic to attempt recovery from the fault condition. If your fault routine determines that recovery is required, clear S:1/13 using ladder logic prior to exiting the fault routine. If the fault routine ladder logic does not understand the fault code, or if the routine determines that it is not desirable to continue operation, exit the fault routine with bit S:1/13 set. The outputs will be placed in a safe state and the fault LED will be energized.
