Control systems
Obsolete PLC and SCADA: repair, partial replacement or migration?
Decide on spare parts, vendor support, security risk and downtime cost, not age. Lifecycle stages, four options compared and how to migrate in phases.
- Topic
- Control systems
- Updated
- 13 November 2026
- Reading time
- 6 min
- Sections
- 7
A control system migration decision should rest on spare part availability, vendor support, security risk and the cost of downtime, not on the age of the equipment alone.
A twenty-year-old PLC with stocked spares and a skilled team can be a smaller risk than a five-year-old SCADA server running an unsupported operating system. This guide explains what obsolete means, compares the four options from repair to full migration, and shows how plants migrate without stopping. It builds on the SCADA architecture guide, because obsolescence usually hits one layer of that chain at a time.
Lifecycle
What obsolete means for a PLC or SCADA
A product becomes obsolete in stages, not overnight. The vendor first stops promoting it, then stops making it, and finally stops supporting it.
Siemens publishes one of the clearest schemes. In its product lifecycle states document (status 29 December 2009), a phase-out declaration (PM400) means the product is no longer actively marketed but remains orderable, and the 10-year spare parts obligation begins. After the discontinuation declaration (PM410), the product is available only as a spare part, made mainly by repairing defective units. When it is totally discontinued (PM490), production ceases and technical support and consultation end.
Other vendors publish their own lifecycle status for each product. Check the current notice for every CPU, I/O family, HMI and software package on site, because the dates differ by product.
Siemens product lifecycle states
- PM400
Phase-out declared
Still orderable, no longer marketed; 10-year spare parts obligation starts.
- PM410, normally 1 year later
Discontinued
Spare parts only, mainly from repaired units.
- 10 years (5 for PC products)
Spare parts period
Counted from the phase-out declaration.
- PM490
Totally discontinued
Removed from catalogue; production and technical support end.
- PM500
End of product life cycle
About 1 year after PM490 in the published scheme.
Options
Four options compared
Faced with ageing controls, a plant has four realistic options. They differ in how much changes, how much downtime they need and how long they buy.
Repair keeps the existing hardware alive at component level. At Redeco in Cilegon, for example, an Endress+Hauser ATG power supply that died after a lightning strike was brought back by replacing the blown fuse and the damaged varistor, then testing and reinstalling it. See the Redeco ATG power supply repair.
Module replacement swaps a failed card or gateway for a compatible one. Phased migration moves one area or function at a time to a new platform. Full migration replaces the control system in one project, usually during a planned shutdown.
| Criterion | Repair | Module replacement | Phased migration | Full migration |
|---|---|---|---|---|
| What changes | Components inside a unit | One card, gateway or device | One area or function at a time | The whole control system |
| Downtime | Short, per unit | Short, per module | Short windows per step | One longer planned shutdown |
| Fits when | Platform still supported, fault is local | Compatible spares exist | Plant must keep running | Shutdown is available anyway |
| Main risk | Next failure elsewhere | Revision or firmware mismatch | Interfaces between old and new | Schedule and commissioning load |
| Time bought | Until the next fault | Until spares run out | Long, step by step | Long, all at once |
Decision
What should drive the decision
The right option comes from a few questions about risk and money, asked for each part of the system separately. Age is only a hint.
Start with spare parts: count what is in stock, confirm the revisions, and find out whether more can be bought new or only as repaired units. Then check vendor support, meaning firmware fixes, software updates and technical help. Security comes next, because an operating system or SCADA package without patches cannot be fixed when a weakness is found.
Weigh those against the cost of downtime, which for a fuel terminal means lost dispatch and for a plant means lost production. Add the skills question: if only one engineer can still program the old controller, the risk is higher than the hardware suggests. Finally, look for process changes, such as new tanks or interfaces, that would require reprogramming anyway.
Spare parts
Stock, revision, new or repaired only.
Vendor support
Firmware, software and technical help.
Security
Patches for OS and SCADA software.
Downtime cost
Lost dispatch or production per hour.
Spares
The risk of used and repaired spare parts
When new spares stop, plants turn to repaired, surplus or used parts. That can buy useful time, but each part needs checking before it goes on the shelf.
Repaired spares are a normal part of the late lifecycle: in the Siemens scheme, discontinued products are supplied mainly by repairing defective units. Surplus and used parts from other sources carry more risk. Their history is unknown, they may be counterfeit, and their hardware revision or firmware may not match the program.
Test every spare on a bench or test rack before stocking it, record its revision and firmware in the asset register, and keep at least one tested unit for each critical module. A spare that fails on the day it is needed is worse than none, because it costs the time you were counting on.
Gateways and converters age too. At the Jambi fuel terminal, Citia replaced an Advantech ECU-1051 ATG gateway with a spare, reconfigured it and added surge protection on the RS-485 Modbus and Ethernet lines so the replacement would not fail the same way. See the Jambi ATG gateway replacement.
Phased migration
Migrating without stopping the plant
Most terminals and plants cannot stop for weeks, so migration is usually done in steps. Each step moves one area or function and leaves a way back if the cutover fails.
On a distribution pump system, Citia separated pump and VSD logic from a central Allen-Bradley PLC into a new Siemens S7-1200 panel without disturbing the functions that stayed on the old PLC, then reconfigured tags and graphics in Vijeo Citect v7 so the mixed system worked as one. See the VSD system optimization.
At the Pertamina Bitung integrated terminal, failed VSD units and a pressure transmitter were replaced and fibre optic was pulled through an operating area to the control room, with risk mitigation so other systems were not disturbed. The pump system now reports to an AVEVA InTouch HMI. See the Bitung pump restoration.
Even with phasing, some steps need a shutdown window. On the Balongan EWTP project, commissioning time was limited to the shutdown or maintenance window, so the plan was built with the operations and maintenance teams in advance.
Baseline the installed base
Asset register with lifecycle status, topology, I/O list and interfaces.
Secure backups and documents
Tested backups of every program and configuration before anything changes.
Split the work into areas
Order steps by risk and by shutdown windows.
Build and test offline
Program, graphics and interfaces tested before site work, with a fallback plan.
Cut over and verify
Loop checks, function tests and a site acceptance test for each step.
Retire the old part
Update documents and backups, and release freed spares to other areas.
Security
Security of unsupported systems
An unsupported operating system or SCADA package will not receive security fixes. The weakness stays open for as long as the system runs.
Where migration has to wait, compensating controls reduce the exposure. The primary mitigations that CISA and its partners published in May 2025 are a practical starting set: keep OT off the public internet, change default passwords, secure remote access, segment IT from OT, and keep the ability to operate manually. NIST SP 800-82 Rev. 3 gives the wider guidance for OT security, and the ISA/IEC 62443 series sets requirements for asset owners' security programmes.
Compensating controls buy time; they do not remove the need for a plan. Record each unsupported system, its exposure and the controls in place, and review the list whenever the network or the business systems around it change.
Planning
Building the case and the plan
A migration plan starts with a list, not a quotation. Management can approve a budget it understands; it cannot approve a feeling that the system is old.
List every controller, I/O family, HMI, SCADA server, gateway and software package with its lifecycle status, spare stock and support situation. Rank them by the risk they carry and the cost of failure. The result usually shows a few urgent items, several that can wait with good spares and backups, and a migration path that can be spread across budget years.
Citia's Condition Monitoring and Maintenance service includes an obsolescence and lifecycle review alongside health checks and backup tests. Long-term service agreements, such as the Padalarang TAS lifecycle support, keep an installed base running while that plan is carried out. Before any step, make sure the backups can actually be restored, and use the safe troubleshooting order for faults that appear along the way.
Terms to know
- Obsolete
- No longer made or supported by the vendor, or about to be.
- Phase-out
- The stage when a vendor stops marketing a product but still sells and supports it.
- Discontinued
- Sold only as a spare part, often from repaired units.
- Phased migration
- Moving a control system to a new platform one area or function at a time.
- Cutover
- The moment control of an area switches from the old system to the new one.
- Installed base
- All control equipment and software already in service at a site.
- Compensating control
- A security measure that reduces risk when the system itself cannot be patched.
Frequently asked questions
How do I know if my PLC is obsolete?
A PLC is obsolete when the vendor has announced phase-out or discontinuation, or no longer offers support. Check the vendor's lifecycle status for the exact catalogue number of each CPU and module, not only the product family.
Can a control system be migrated without stopping operations?
Yes, most of it can, by migrating one area or function at a time with offline testing and a fallback plan. Some steps, such as final cutover of shared equipment, still need short planned shutdown windows.
What are the risks of used PLC spare parts?
Used PLC spare parts can have an unknown history, be counterfeit, or carry a hardware revision or firmware that does not match the program. Test each one on a bench and record its revision before relying on it.
How long are spare parts available after a PLC is phased out?
It depends on the vendor and the product. In Siemens' published lifecycle scheme, the phase-out declaration starts a 10-year spare parts obligation, or 5 years for PC products; other vendors set their own terms.
Should PLC and SCADA be migrated together?
Not necessarily; they often age at different rates. SCADA servers and operating systems usually leave support sooner than PLC hardware, so many plants upgrade SCADA first and move controllers in later phases.
What does a DCS migration involve?
A DCS migration involves converting control strategies, graphics, alarms and the database to the new platform, reconnecting field I/O and testing every loop. Many vendors offer paths that keep field wiring in place to shorten the cutover.
Sources and further reading
- Product Lifecycle States (opens in a new tab)
- ISA/IEC 62443 Series of Standards (opens in a new tab)
- NIST SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security (opens in a new tab)
- Primary Mitigations to Reduce Cyber Threats to Operational Technology (opens in a new tab)
- VSD system optimization (opens in a new tab)
- Pertamina Bitung integrated terminal: pump PLC restoration (opens in a new tab)
- Condition Monitoring & Maintenance (opens in a new tab)
- Cover photo by Elmschrat Coaching-Blog, CC BY-SA 3.0 (cropped and colour graded) (opens in a new tab)
Next step
Prepare the technical discussion for your facility.
Bring the equipment list, diagrams and symptoms you have. The Citia team helps map the next step.
Related products and solutions
- KnowledgePLC and SCADA backups you can actually restoreA backup counts only if it matches the running system, includes configs, licences and software versions, and has passed a restore test. Checklist and schedule.
- KnowledgeLTSA and control-system maintenance for terminals: what the contract should coverLTSA is a multi-year service contract for a terminal control system. See what the scope, service levels, backups, reports and security clauses should say, and how to judge a provider.
- KnowledgeOPC UA vs Modbus vs MQTT: which protocol for which jobOPC UA carries values with structure and built-in security, Modbus carries raw registers, and MQTT publishes data to a broker. When to use each one.
- ProjectVSD system optimizationCitia restored distribution pump and VSD operation in 2022 by moving their control from a central Allen-Bradley PLC to a dedicated Siemens S7-1200 panel.
- ProjectPertamina Bitung integrated terminal: pump VSD and SCADA restorationRestoration of the field VSD pump system at the Bitung integrated terminal: new VSD units and pressure transmitter, fiber optic cable and AVEVA InTouch SCADA.
- ProjectABB DCS programming at Lomanis fuel terminalTroubleshooting and recovery of the ABB System 800xA DCS at the Lomanis fuel terminal.
- ProjectPadalarang TAS lifecycle supportDistribution TAS maintenance and troubleshooting
- ProductCondition Monitoring & MaintenanceKeeps TAS, PLC, SCADA, servers, gateways and networks healthy, with backups you can restore.
- KnowledgePLC/SCADA assessment: start with symptoms, topology and backupsSeparate equipment, communications, applications and operating processes before deciding on replacement.