Legacy Controls Migration at Ridgeway Extrusion
Ridgeway Extrusion operates a 24/5 sheet line controlled by a 1998 PLC and a Windows XP HMI. In the past 14 months the line had three unplanned stoppages, the longest 9 hours; contribution margin is $7,500 per hour, and broker-sourced spares now cost $40,000 a year. The OEM will stop supporting the controller in 10 months. The capital budget is $650,000. A systems integrator quotes $520,000 for a big-bang replacement with a 48-hour cutover, or $575,000 for a phased migration over 12 months using four planned 8-hour outages; a $60,000 bridge support contract covers the 2-month gap. The IT director wants a cloud-hosted SCADA layer added now; operations wants no production risk; the audit flagged unpatched HMI software and shared local-admin passwords. Demand is stable and the line runs at 88% utilization.
1. Quantify the two migration options and recommend one. Show your assumptions, including the support gap and the capital constraint.
Read the worked answer
Failure exposure: 3 failures in 14 months annualizes to about 2.57 per year; 2.57 × 9 hours × $7,500 = $173,600, plus $40,000 spares = $213,600 per year. Big-bang: $520,000 capex + 48 hours × $7,500 = $360,000 production loss = $880,000 economic cost; capex alone fits the budget. Phased: $575,000 + four 8-hour outages × $7,500 = $240,000 + $60,000 bridge = $875,000; capex is $635,000, within $650,000. The totals are close, but phased has four bounded 8-hour outages instead of one 48-hour cutover, so it caps catastrophic schedule risk and provides fallback points. The support gap is real: support ends in month 10 but phased migration ends in month 12, so the bridge contract must be signed before month 9. Recommend phased, with outages scheduled in low-demand windows, pre-staged hardware, and a tested rollback to the legacy PLC at each step. Reject big-bang because the single-event $360,000 exposure is not credible to absorb through contingency and the line has no redundant capacity.
2. What stage gates, performance metrics, and rollback conditions should govern each planned outage?
Read the worked answer
Gate 0 before any outage: design freeze, factory acceptance test of the new PLC and HMI, full I/O checkout, cyber hardening, and a rehearsed rollback. Cyber items are not optional: segment the control network, remove shared local-admin accounts, patch or replace the XP HMI, and prohibit direct internet access to the PLC. Each outage gate should require 100% of tags mapped and simulated, spare parts on site, operations sign-off, and a communication plan. Metrics: actual cutover duration versus the 8-hour window, unplanned downtime, startup rate versus plan, alarm flood count, mean time to recover, and closure of cyber findings. Rollback triggers: line not at 90% of rated rate within 2 hours of restart, any safety interlock failure, or more than two critical I/O faults. The integrator should carry schedule risk through a milestone payment held until 72 hours of stable production.
3. How should the cloud SCADA proposal be handled in the context of this migration?
Read the worked answer
Separate the cloud SCADA request from the migration. Adding a cloud layer now expands scope, creates OT/IT security exposure, and cannot be validated within the outage windows. Require a vendor-neutral architecture: control stays on-premise, data is published read-only through a DMZ or historian, PLCs have no direct internet path, and access uses MFA and least privilege. Defer funding until the migration has run stable for 90 days; then run a small proof of value with explicit cyber acceptance criteria. If IT insists on proceeding now, it should be a separate business case with its own risk acceptance, not a change order on a risk-critical migration. This preserves the IT director's objective without letting a nice-to-have capability jeopardize the line.