Most IT-caused downtime on a Fort Worth plant floor starts in 1 of 5 places, a power blip, a single-path network, a dead ERP or MES server, a bad change window, or ransomware. Only 1 of those is a cyberattack, and in the one survey I found that sized them, it was the smallest slice.
This guide sits under our manufacturing IT services in Fort Worth page, and it covers causes only. Our cost of IT downtime guide covers the dollar side. Here I’m asking a plainer question. When the line stops and the reason is on the IT side, where did it start? Fair warning. It isn’t glamorous.
I went looking for numbers and found fewer than I expected. Most downtime research counts worn bearings and jammed conveyors, and the IT share hides inside a bucket called “other.” So I pieced this together from Oncor’s reliability report, NIST’s manufacturing profile, Dragos threat research, and two surveys. Each source answers one piece. None answers all of it, and that gap is the reason plants end up guessing.
A plant stops for IT reasons through 5 chains. A power sag under 1 minute resets controllers, and Oncor’s reliability figures don’t count it. A network with 1 path takes out a whole cell. A dead ERP or MES server freezes scanners and labels. In 1 survey, planned maintenance gone wrong caused 18% of downtime and network failures caused 16%. Cyberattacks caused 5%. Ransomware still halts lines through the business network.
What IT failures actually stop a plant floor?
Plant-floor downtime from IT means the line stops because a computer, a network link, or a power dependency failed, not because a machine wore out. The machine is fine. What tells it what to run, where to send data, or whether it may start isn’t.
| Failure chain | What the floor sees | First thing to check | Who usually owns the fix |
|---|---|---|---|
| Power sag or blip | Drives, controllers, or screens reset while the lights stay on | Whether control power rides through on its own backup | Electrician and IT, both |
| Single-path network | A cell or a whole shift loses screens and data at once | The one switch or cable that every path crosses | IT or the integrator |
| ERP or MES outage | Scanners, labels, and work orders stop while machines still run | The server, its disk space, and its license and certificate dates | IT |
| Change gone wrong | Trouble starts right after a patch, swap, or upgrade | What changed in the last 24 hours, and the saved config to roll back to | IT and the line lead |
| Ransomware on the business network | MES and ERP are encrypted while the PLCs are untouched | Where the business network meets the plant network | IT and security |
Look at the last column. Several chains have 2 owners, and that’s the real defect. The electrician says it’s IT. IT says the power was clean. Nobody drew the chain, so nobody owns the gap between them.
Why does a power blip stop a line that never lost power?
Because the utility’s own number doesn’t count it. Oncor’s 2024 sustainability report lists a non-storm SAIDI of 74.7 minutes and a SAIFI of 1.1, and it says those results reflect interruptions of 1 minute or more. A quarter-second dip isn’t in there, and neither is a recloser clearing a fault a few poles down the feeder, even though your drives, your PLC power supplies, and every 24V control circuit on the floor feel both of them. Same grid. Different clock.
A voltage sag is a short drop in supply voltage that lasts from half a cycle to a few seconds. The lights flicker. A servo drive or a 24V control supply with no backup drops out, and the cell faults. Then the restart takes as long as your restart procedure takes, which is the part no utility can fix for you.
Plenty of plants put a UPS in the server closet and call it done. Closets don’t stop lines. Control cabinets do. NIST’s draft manufacturing profile lists redundant power supplies in the High tier of its resilience controls, and that language is about controllers and sensors, not the IT room. I can’t tell you how many Fort Worth plants have a UPS in the closet and none at the controls. Nobody tracks it.
How does a single-path network take down a whole cell?
Everything crosses one point. In the survey I cover below, network failures were the primary cause of 16% of downtime. In a plant that’s usually a dull failure. One unmanaged switch under a bench. A patch cable somebody kicked loose. A core switch with one uplink and no spare is the classic version, and it can sit unnoticed for 10 years because the day it fails is the first day anybody asks what’s behind it. Nothing about the fault is exotic. The blast radius is.
NIST’s CSF 2.0 Manufacturing Profile, still an initial public draft as of its September 2025 release, tells plants to identify and mitigate single points of failure in the systems and networks that support manufacturing. That’s a polite way of saying draw the map.
Size matters here. In 2025, the BLS Quarterly Census of Employment and Wages counted 1,951 private manufacturing establishments in Tarrant County, employing 93,180 people, or 47.8 per plant. QCEW doesn’t report staffing, but a dedicated network engineer is rare at that size. Usually the map lives in one person’s head. When that person is out, so is the map.
What happens when the ERP or MES server stops?
Machines keep running until they run out of instructions. Then they stop. It looks like a machine problem, and it isn’t.
| Step in the chain | What it depends on | How it quietly fails | What the floor sees |
|---|---|---|---|
| Scanner or terminal | A wired or Wi-Fi link and a working login | An access point drops or an account locks | Operators can’t clock into a job |
| MES or work-order screen | An app server and its database | A disk fills or a service stops | Nobody knows what to run next |
| ERP | A database, a license, a certificate | A certificate or license date passes | Orders, inventory, and labels freeze |
| Label and shipping printer | A print server, a driver, a network path | A patch breaks the driver | Finished parts can’t ship |
Every row above is boring, and that’s the point. None of them needs an attacker, and a certificate that expired over a weekend can freeze the same floor that ransomware would, just with a shorter and far less embarrassing incident report.
Here’s the test I’d run first. Ask each shift lead how long their line can run on paper. An hour? A full shift? Write the answer down, because it’s your real recovery target, it’s rarely the number in the IT plan, and it’s the figure your plant manager will end up quoting to a customer at 6 AM on the day it matters. If the answer is “I don’t know,” you’ve learned something worth more than a quote.
Why do planned changes cause more downtime than attacks?
They do in the one survey I could find that sorted causes by type. Macrium commissioned Newton X to poll 100 IT and OT decision-makers at manufacturers with at least 2,500 employees across the US, Canada, and the UK, and IT Brief reported the results in March 2026.
| Primary cause of downtime | Share of respondents | The plant-floor version |
|---|---|---|
| Planned maintenance that goes wrong | 18% | A switch swap or patch that runs past the shift change |
| Configuration loss or change | 16% | A replaced switch or controller with no saved config |
| Network failures | 16% | A dead uplink or a single switch nobody backed up |
| Cyberattacks | 5% | Ransomware on the MES or ERP side |
Read that with care. It’s 100 people, the plants are far bigger than a typical Fort Worth shop, and a backup vendor paid for it. So I wouldn’t treat the shares as a benchmark. I’d keep the order. What we do to our own systems costs more hours than what criminals do to them.
Beyond that, the picture is fuzzier. L2L surveyed more than 600 US manufacturing leaders and found facilities lose about 30 hours of production a month to downtime, with most of it unplanned. It doesn’t split out IT. Nobody does. That’s why plants guess.
Three habits cut the change-gone-wrong slice, and none of them costs more than the hour it takes to write the rule down and tape it above the switch. Save the config before every change. Name a rollback time that falls before the next shift starts. Run the window with the line lead on the phone, so the person who’ll live with the result is in the room. Boring habits. They work.
Does ransomware stop the line without touching the PLCs?
Often it does. Dragos counted 1,171 ransomware attacks on manufacturers in 2024 and describes the path plainly. An attacker gets into the business network through phishing or a vulnerable remote access appliance, moves with everyday tools like RDP and PsExec, finds the MES and scheduling servers, and encrypts them. Production halts “despite no direct attack on PLCs or controllers.” Norsk Hydro’s 2019 attack followed that shape, with encrypted MES and ERP systems pushing plants onto manual fallback procedures.
Dragos’s 2026 year in review puts the count of industrial organizations hit by ransomware at about 3,300. That’s the volume. Same mechanism, bigger numbers, and it’s always a business system the floor can’t run without.
Dragos’s fixes read like plant plumbing, not security theater. Segment MES and ERP from the rest of the network. Lock remote access behind MFA. Write fallback procedures for an MES outage. Then rehearse them. How audits test those controls is a separate story, and our OT cybersecurity audit guide owns it. This post stops at what takes the line down.
What does Fort Worth add to the picture?
Concentration. Tarrant County’s aircraft and parts plants employ 22,742 people across 56 establishments, about 406 each, according to the same QCEW data. Those are the plants where a late part from 1 supplier stops someone else’s line, so a few hours of downtime travels up the chain faster than it would in a stand-alone shop.
Most of the county’s plants are small, with no night IT staff and a single generalist wearing every hat. Different problem, same chain. For both groups, the cost of covering nights is its own question, and our guide to 24/7 plant IT support costs in Fort Worth prices it by shift. How the night line works is on our 24/7 IT support in Fort Worth page.
I’ll say this plainly. Uprite has no Fort Worth office. We cover Tarrant and Parker counties from Dallas, about 35 miles away, so most fixes start remotely and a technician drives out when the fault is physical. Our average response is 5 minutes. Get any provider’s in writing.
How do you map your plant’s downtime chains in an afternoon?
- Pick the last 3 line stops that nobody could explain.
- For each one, trace the chain from the machine back through its power, its network path, its server, and its login.
- Print the network map and circle every switch, uplink, or power supply whose loss would stop more than 1 cell.
- Ask each shift lead how long the line runs on paper, and write the answer beside the chain.
- Find where the last saved config for each switch and controller lives, and when it was saved.
- Give every chain 1 owner. One name, not 2.
You’ll finish with a short list of circles, and that list is your downtime in advance, written down while it still costs an afternoon instead of a shift, a ship date, and an awkward call to a customer. That’s the whole exercise. If you’d rather work through it with someone, contact us and bring the 3 stops.
Questions Fort Worth plant managers ask about IT downtime
What causes IT-related downtime in a manufacturing plant?
Power sags that reset controllers, single-path networks, ERP or MES outages, failed changes, and ransomware on the business network cause most of it. Each one stops the line without breaking a machine, which is why the first call often goes to maintenance instead of IT, and why the real cause can take a while to surface.
Can a power flicker stop a production line?
A sag lasting well under a second can reset drives and unbacked 24V control supplies, so yes. Oncor’s reliability figures only count interruptions of 1 minute or more, so these events never show up in the utility’s numbers.
How much manufacturing downtime comes from cyberattacks?
In 1 survey of 100 large manufacturers, cyberattacks were the primary cause of 5% of downtime, while planned maintenance gone wrong caused 18%. It’s a small, vendor-funded sample, so treat the order as the lesson and ignore the exact percentages.
Can ransomware stop a plant without infecting the PLCs?
Ransomware can halt production without touching a PLC. Dragos describes it encrypting MES and ERP servers so the line stops with no direct attack on controllers. Norsk Hydro’s 2019 incident pushed plants onto manual fallback procedures in the same way.
What is a single point of failure in a plant network?
It’s any switch, uplink, server, or power supply whose loss takes down more than 1 cell. NIST’s draft manufacturing profile asks plants to identify and reduce them, and a printed network map, circled in pen by someone who knows the building, is the cheapest way to find them. Start there.
How long should a plant be able to run without its ERP?
There’s no standard number. Honestly, it’s however long your shift leads can run on paper, tested at least once, and plenty of plants have never tested it. Set your recovery target to that figure, not to a number from a template. Then test it.
Does Uprite cover Fort Worth plants at night?
Every Uprite plan except IT Essentials includes 24/7 support, delivered remotely first from our Dallas office, with on-site dispatch to Tarrant and Parker counties. We have no Fort Worth office, so fixes start remotely and a technician drives out only when the fault is physical.
Send me the last 3 times your line stopped and nobody could say why. I’ll draw the chain behind each one and tell you which single point shows up twice.
Get a Free Downtime Chain Review
