The report you receive, in full.

Observation. A gateway timer script executes at hourly intervals and issues INSERT statements against the database connection CRF_LEGACY. That connection has reported a Faulted state continuously since 2023-11-02. Store-and-forward is not enabled on the connection, so write operations are discarded at the point of failure rather than queued for later delivery.

Impact. Approximately 12,200 hourly summary records have not been persisted. Any report or query drawing on the destination table returns a dataset that has not advanced in fourteen months. The condition produces no operator-visible indication: the script catches its own exception and logs at DEBUG severity, which is below the default gateway log threshold.

Recommendation. Establish whether the legacy destination table remains required. If it is required, redirect the script to CRF_PROD and enable store-and-forward on the connection. If it is not required, remove the script. In either case, raise the exception handler to ERROR severity so that subsequent failures are surfaced.

Estimated remediation effort: 1–2 hours

Observation. In project PackagingHMI, the Designer access permission grants the Operators role the same project modification rights as the Engineering role. Separately, the default admin account remains present in the default user source with its original credentials unchanged.

Impact. Any account holding the Operators role and access to a Designer installation is able to modify the running production HMI. Modifications made under a shared role cannot be attributed to an individual in the audit log, which materially reduces the value of that log during incident investigation.

Recommendation. Restrict project modification rights to the Engineering role. Disable or rename the default admin account. Issue named accounts to the individuals who require Designer access so that configuration changes are attributable.

Estimated remediation effort: 2 hours

Observation. The gateway holds 118 configured alarms across all tag providers. Of these, 41 have no notification pipeline assigned. The unassigned set includes six alarms on the ammonia refrigeration tag group and four on the clean-in-place skid.

Impact. The affected alarms are recorded in the alarm journal and displayed on HMI screens, but no outbound notification is generated when they become active. Alarms occurring outside staffed hours therefore remain unacknowledged until a screen is observed. The configuration is indistinguishable, from an operator's perspective, from an alarm that does notify.

Recommendation. Classify the 41 alarms into three categories: requiring immediate pipeline assignment, informational and to be documented as such, or obsolete and to be removed. The complete list, ordered by process area, is provided in Appendix B. Assign pipelines to the first category and verify by forcing a test condition on a non-production tag.

Estimated remediation effort: 3–4 hours, exclusive of classification decisions

Observation. The connections PLC_OLD_03, PLC_TEST, and PLC_PACK_02_OLD are configured and enabled, and each is in a Faulted state. Reported fault durations are 14, 9, and 6 months respectively. All three continue to attempt reconnection on a two-second interval.

Impact. The three connections generate an estimated 1.3 million failed connection entries per month. The resulting log volume substantially reduces the diagnostic value of the gateway logs. A persistent faulted state also normalises the fault indication itself, reducing the likelihood that a new fault is noticed.

Recommendation. Confirm decommissioned status with the controls group. Disable rather than delete the three connections and observe one full production cycle. If no dependency is identified, delete the connections together with the 214 tags that reference them.

Estimated remediation effort: 1 hour, plus one production cycle of observation

Observation. The tag provider default contains two UDT definitions, Motor_v2 (156 instances) and Motor_v2_NEW (58 instances). The definitions differ in two member names and in one member data type: RunHours is declared Float in the former and Int in the latter.

Impact. Any script, report, or binding authored against one definition will fail or return an incorrect value when applied to an instance of the other. The Float-to-Int difference produces silent truncation rather than an error, which is the more difficult failure mode to detect. Remediation cost increases with each additional instance created.

Recommendation. Adopt Motor_v2_NEW as the single definition; the supporting rationale is given in Appendix C. Migrate the 156 remaining instances as a single planned change rather than incrementally. A member-level migration checklist is provided in the same appendix.

Estimated remediation effort: 6–8 hours, performed in one window

Observation. Named query getBatchHistory filters batch_log on the column start_ts. No index exists on that column. Measured median execution time is 4.2 seconds. The query is bound to a Perspective table component configured with a five-second polling rate, open on two operator terminals for the majority of each shift.

Impact. Execution time is approaching the polling interval. The table is growing at approximately 340,000 rows per month; on the current trajectory, query duration will exceed the polling interval and produce overlapping executions. Sustained overlap is capable of exhausting the database connection pool.

Recommendation. Create a non-clustered index on start_ts; this is projected to reduce median execution time below 100 ms. Change the component binding from a polled refresh to an on-demand refresh. The index statement, projected build duration, and lock behaviour are provided in Appendix D.

Estimated remediation effort: 1 hour, plus an index build during a maintenance window

Observation. The function util.logChange() opens a database connection, executes a single statement, and closes the connection on every invocation. The function is called from valueChanged scripts on 1,140 tags in the default provider.

Impact. Under steady-state production the pattern is inefficient but tolerable. During gateway startup or a mass tag update, concurrent invocation produces a connection burst. This behaviour is consistent with the two gateway performance events reported by site personnel in March and June.

Recommendation. Revise the function to use the gateway-managed connection pool, or to queue and batch write operations. The change is confined to a single function but affects 1,140 tags; verify on a non-production provider before deployment.

Estimated remediation effort: 3–4 hours including verification

Observation. Sixty-two tags in the Legacy tag provider are not referenced by any binding, script, alarm, or report in any project on the gateway.

Impact. No operational impact is identified. The tags represent a documentation cost: each subsequent engineer examining this system must determine whether they are significant.

Recommendation. Export the provider as a backup, delete the 62 tags, and retain the export for twelve months.

Estimated remediation effort: 30 minutes

Observation. The gateway is running version 8.1.24. The current release at the time of analysis is 8.1.44. Nine intervening releases contain security fixes, two of which apply to gateways exposing Perspective on a plant network.

Impact. No finding in this set is remotely exploitable under the network configuration observed in the backup, which is the basis for the Low severity rating. The exposure gap nevertheless widens with each release cycle.

Recommendation. Schedule an upgrade to the current 8.1 release. No configuration element examined blocks the upgrade. Four bindings require post-upgrade verification; these are identified in Appendix F.

Estimated remediation effort: 4 hours including regression verification

Observation. The gateway backup schedule is unset. Backups have been taken manually. The most recent backup preceding the file supplied for this analysis was dated 2024-08-19.

Impact. In the event of hardware failure, recovery would require manual reconstruction of 20,518 tags and three projects. This is the lowest-cost finding in this report to remediate and the highest-cost finding to leave unremediated.

Recommendation. Enable a nightly scheduled backup targeting a share that is itself included in the site backup regime.

Estimated remediation effort: 15 minutes