Module Status (MS) and Network Status (NS) LEDs on a 1769-L35E already classify many EtherNet/IP faults, yet plants still rebuild switches before anyone photographs the pattern. Worse, engineers often assume a GSV of the MODULE object will yield the same colors the faceplate shows. It will not. LED state is computed inside module firmware from identity, TCP/IP, and connection-manager status, and it is not mirrored into a taggable MODULE[slot].MS field. Replicating the indicators in logic requires a CIP Get_Attribute_Single to the LED Indicator Object (Class 0x0047).

MS and NS bi-color patterns are the fastest EtherNet/IP triage tool on CompactLogix—if you record them before cycling power.

Canonical MS/NS meanings

Class 0x47 object map

ODVA defines the LED Indicator Object with instances for each physical indicator. On CompactLogix embedded ports:

• Instance 1 — Module Status (MS)
• Instance 2 — Network Status (NS)
• Attribute 3 — LED State (USINT enum; verify against the module EDS)

Typical Attribute 3 enums resemble: 0 Off, 1 solid red, 2 flashing red, 3 solid green, 4 flashing green, 5 solid red/green, 6 flashing red/green. Firmware revisions differ—always confirm against the EDS before writing HMI faceplates that claim “duplicate IP” from a raw integer.

MSG configuration

Message Type: CIP Generic
Service: Get Attribute Single (0x0E)
Class: 0x47
Instance: 1 (MS) or 2 (NS)
Attribute: 3
Destination: 1-byte SINT/USINT tag
Path: backplane to embedded port (e.g., 1,0) — not an IP loopback
Pace: 500 ms to 1 s per pair of MSGs

Each open CIP Generic message consumes connection resources on the same port you may already be budgeting for I/O and HMI. Do not poll at 10 ms “just to be responsive.”

Decode LED enums into STRING descriptions for HMI banners—operators should not memorize CIP integers.

Structured text decode sketch

IF MSG_LED_NS.DN THEN
  ModuleDiag.NS_State := ModuleDiag.NS_Raw;
  CASE ModuleDiag.NS_State OF
    0: ModuleDiag.NS_Description := 'Off - No IP/power';
    3: ModuleDiag.NS_Description := 'Solid Green - Connected';
    4: ModuleDiag.NS_Description := 'Flash Green - Idle';
    1: ModuleDiag.NS_Description := 'Solid Red - Duplicate IP';
    2: ModuleDiag.NS_Description := 'Flash Red - Conn timeout';
  END_CASE;
END_IF;

Bench verification

1. Photograph faceplate MS/NS, then compare to decoded tags online
2. Disconnect the Ethernet cable: NS should leave steady green
3. Temporarily duplicate the IP on a laptop: NS solid red is the expected ACD indication
4. Inhibit a Class 1 connection and confirm flashing green or timeout patterns match the table
5. Confirm MSG .ER remains clear; path errors usually mean backplane syntax mistakes

Use these tags for first-fault capture in the alarm system rather than relying on an operator to notice a flashing LED behind a locked door. Aging L35E cells that chronically sit at connection limits still need a migration conversation under the plant’s PLC/PAC roadmap—not another unmanaged switch.