From the PLC state diagnostic OPC item. Or just use a flag that the PLC sets on first scan.
I am assuming the wall clock resets on mode change?
In our case, mode change is not the only thing that indicates a "PLC screw up". So getting an unexpected counter value might have to be the screw up indicator for me.
Use either a counter or a UTC timestamp as a trigger.
If the latter, no need to write to the PLC for screw-ups. Just ignore timestamps that are more than a few minutes old.