Obsolescence: planning for the system you cannot buy any more
A control system becomes unsupportable years before it stops working, and the warning signs are all commercial rather than technical.
Read the guideSection · 8 guides
Running the system
Obsolescence, spares, backups, network segmentation, remote access, patching and the human side of running a control room.
Home/Running the system
A control system spends a few months being installed and then twenty years being run. Almost all of the cost, and all of the risk, is in the second part.
The problems are consistent across industries: hardware that can no longer be bought, a backup nobody has tested, a network that was flat when it was built, remote access arranged in a hurry during an outage, and an operating system that cannot be patched because a vendor validated one version in 2013.
This section deals with those, and with the operational practices — training, shift handover, documentation — that determine whether the people running the system can recover from the day it misbehaves.
Presence indicators in collaboration tools should not be treated as complete evidence of productive work. Further details are available in this guide.
Security decisions should also be checked against NIST guidance on operational technology security.
Alarm-system governance is further addressed by ISA-18.
Spares for a system that is no longer manufactured
The spare you need is the one that has been sitting untested in a cupboard since 2011.
Read the guideBackups you have actually restored
Most sites have control system backups. Considerably fewer have ever performed a restore, and the difference only becomes apparent once.
Read the guideSeparating the control network from everything else
Most control networks were flat when they were built and have been connected to progressively more things since, one reasonable request at a time.
Read the guideRemote access that does not become a permanent open door
Almost every remote access arrangement was set up quickly during an outage and never revisited.
Read the guidePatching a system that cannot be taken down
The advice to patch promptly assumes a system that can be restarted. Control systems frequently cannot, and the resulting position needs managing rather than ignoring.
Read the guideTraining operators for the situations that are rare
Operators become expert at normal running through daily practice. The abnormal situations are the ones they encounter least and need most.
Read the guideShift handover in a control room
The five minutes at the start of a shift determine what the next twelve hours are working from.
Read the guide