AVEVA System Platform 2023 R2 SP1 Patch 04: The Full Breakdown

Patch 04 landed in January 2026, and it’s a big one. With 114 fixes spread across every major component, three new OMI features, and the opening salvo of the manual credential deprecation, this is the most substantial release since the SP1 base. If P03 was AVEVA tightening the security bolts, P04 is them sweeping the house — fixing a lot of accumulated pain around WAN resilience, migration compatibility, and deployment performance.

The Big Picture

What’s new:

• Bit State Animations in OMI — configure conditions based on individual bit values, up to 32 bits per condition

• Extended Truth Table Animations — Blink, Disable, Value Display, and Visibility animations now support truth table conditions

• OMI Web load balancing — the web client can now sit behind a load balancer (F5, etc.) with VIP access

What’s changing (deprecation):

• Manual username/password entry enters Phase 1 — deprecation warnings appear in TrendClient, SQLDataGrid, Alarm DB controls, and others. Not broken yet, but the clock is ticking.

• StringCompareEncrypted() now logs warnings in the Operations Control Logger. Still works, but won’t in the next major release.

What’s fixed (highlights):

• 35 Application Server issues — heavy on WAN disconnect recovery, migration bugs, and deployment performance

• 20 OMI issues (17 desktop + 3 web) — ViewApp stability, popup crashes, and the load balancing fix

• 36 InTouch HMI issues — Web Client permission bugs, OPC UA batch write errors, WindowMaker multi-monitor quirks

• 8 Historian issues — TCP port exhaustion causing license loss, double license allocation in Web Client

• 4 Historian Client issues

• 11 Communication Drivers Pack issues — SuiteLink encryption, memory leaks, and WEBSVC OAuth fixes

What’s Included

P04 is cumulative. It installs on any node running SP1, P01, P02, or P03 and includes everything from all prior patches. Component versions follow the .104 pattern: Application Server & OMI at 23.1.104, Communication Drivers Pack at 23.02.104, Historian at 23.1.104, InTouch HMI at 23.1.104, OMI Web at 1.0.500.0.

New Features

Bit State Animations

A welcome addition for anyone working with device status words or alarm bitmasks. You can now add animation conditions based on individual bit values — select any pattern of bits up to 32 bits per condition, and stack multiple conditions. If you’ve been building workarounds with script-driven visibility toggles for bit-level status indication, this replaces them with native animation support.

Extended Truth Table Animations

Four animation types — Blink, Disable, Value Display, and Visibility — now accept truth table conditions. Previously these animations were limited to simple comparison expressions. The truth table approach lets you define complex multi-condition logic without scripting.

OMI Web Client Load Balancing

The web client now works properly behind load balancers. This fixes IMS 4281400, where F5 VIP access was unavailable. If you’ve been running OMI Web without a load balancer because of this limitation, that’s no longer an excuse.

The Credential Deprecation Clock Starts Ticking

This is the strategic change in P04. AVEVA is moving everyone away from manual username/password entry toward Named Credentials, in three phases:

Phase 1 (this patch): Warnings appear in all manual credential entry interfaces. The Operations Control Logger records informational messages. Everything still works.

Phase 2 (next major release): You can no longer add or edit manual credentials. Existing ones keep working but can’t be modified. New and updated applications must use Named Credentials.

Phase 3 (the release after that): Complete removal. Existing credentials auto-convert during upgrade, and the system generates a migration report.

Affected controls: TrendClient, SQLDataGrid, Embedded Alarm Control, Alarm Pareto, Alarm DB View Control, Alarm DB Logger Manager, Alarm DB Restore, Alarm DB Purge-Archive, Distributed name manager history provider.

Why this matters: If your project has manual credentials scattered across a dozen Alarm DB controls and Trend Clients, you want to start the migration now — not when Phase 2 drops and you’re forced to do it under time pressure.

Application Server Fixes (35 Issues)

The Application Server fixes in P04 have a clear theme: resilience. A disproportionate number address what happens when things go wrong — WAN links drop, failovers trigger, migrations go sideways.

WAN Disconnect & Failover Recovery

If you run a multi-node architecture with remote GR connections, this section is your biggest win:

• IMS 4062344 — OMI nodes had data acquisition issues (slow updates, freezes) when the GR node was unavailable

• IMS 4325079 — Remote Object Viewer failed after GR WAN disconnect

• IMS 4327477 — Reference caching got stuck for too long after WAN disconnect

• IMS 4331217 — Platform Manager took forever to load after WAN disconnect

• IMS 4368826 — OMI graphics showed configuration errors after failover; Platform Manager displayed wrong platform status

• IMS 4372944 — Trend Tail sources were unreliable during WAN disconnections

Migration Compatibility

AVEVA clearly received a lot of migration-related support cases. If you’re coming from 2017 or 2020:

• IMS 4111218 — Discrete message labels went missing after migrating from System Platform 2020

• IMS 4319322 — Migration failed with “there is already an object named ‘deployed_objects'” error

• IMS 4327600 — Errors and warnings during migration from 2017 U3 SP1

• IMS 4381159 — After migrating from 2017, some Description attributes silently changed type to InternationalString, breaking scripts and flooding the log with warnings

Deployment Performance

• IMS 4342614 — aaPkg imports took hours

• IMS 4347128 — InTouch deployments took over 30 minutes

• IMS 4354942 — Security access was painfully slow

• IMS 4368785 — IDE became sluggish after installing hotfixes, couldn’t check in objects

• IMS 4329368 — internal_get_io_point_count stored procedure was extremely slow

Templates, Instances & Runtime

• IMS 4073595 — Instances created via Galaxy dump/load reverted to template values after template changes (when parent had an object wizard)

• IMS 4081194 — Instances lost EngUnit values after modifying templates with object wizards

• IMS 4215957 — CSV-imported templates had .Hist.DescAttrName replaced with me.ShortDesc

• IMS 4315268 — Template imports failed; tempdb ballooned

• IMS 4066664 — Attribute data stuck in “Initializing” after primary AppEngine stopped

• IMS 4090654 — “Graphic Not Available” after removing an embedded graphic from an object-owned graphic

• IMS 4105563 — Redundant DI object returned invalid connection status during deployment

• IMS 4110012 — Object went offscan after forced failover

• IMS 4230175 — Graphics appeared “invisible” in WindowMaker

• IMS 4262563 — Changing object association lost attribute I/O source

• IMS 4267886 — Alarm translations stopped working

• IMS 4290709 — BigString I/O primitives didn’t work inside virtual primitive compositions

• IMS 4318000 — Script didn’t execute after forced failover

• IMS 4346243 — HistoricalTrendApp Y-axis limits displayed incorrectly after translation

• IMS 4351819 — Unexpected AppEngine terminations

• IMS 4361536 — IDE disconnected from GR on template check-in followed by validation

• IMS 4370129 — OMI ViewApp values didn’t match Object Viewer values

• IMS 4405343 — Writes to UDO.Dest[] failed

• IMS 4426837 — Redundant AOS node logged repeated serialization warnings

The takeaway: The WAN disconnect cluster alone justifies this patch for distributed architectures. And the migration fixes suggest AVEVA has been paying attention to the support case backlog from teams moving off 2017/2020.

AVEVA OMI Fixes (20 Issues)

Desktop (17 Issues)

OMI desktop fixes focus on ViewApp stability — particularly around popups, delta deployments, and post-upgrade performance regressions:

• IMS 3412300 — DataGrid Widget filter issues in both default and checklist modes

• IMS 3874937 — OMI client couldn’t connect to data provider (port 808 unreachable)

• IMS 4062344 — Slow updates and freezes on GR disconnect

• IMS 4069064 — Phantom scrollbars in blank pane sections

• IMS 4078285 — Latency issues after applying HotFix 3940646; Embed function failed at runtime

• IMS 4098470 — HotFix 3940646 didn’t improve latency for non-embedded symbols

• IMS 4053611 — Web client showed file download count instead of progress indicator

• IMS 4100285 — NavBreadCrumb Root Path intermittently not applied at startup

• IMS 4103780 — ViewApp stopped responding after opening/closing popups

• IMS 4111272 — ViewApp briefly froze during operations after upgrading from 2020 R2

• IMS 4218557 — Arrow key navigation between clickable fields caused .NET error and view.exe crash

• IMS 4230949 — Delta deployment didn’t show changes in ViewApp

• IMS 4266940 — User input animation with identical Min/Max values caused stuck warning popup

• IMS 4278159 — ViewApp object loading significantly slower after P01→P02 upgrade

• IMS 4297697 — OMI application randomly stopped responding

• IMS 4332940 — ViewApp crashed on LogOff() due to duplicate LogOff calls

• IMS 4355443 — Read failures when entering playback mode

Web Client (3 Issues)

• IMS 4053611 — File download count shown instead of progress indicator

• IMS 4073783 — Web client showed bad quality with no warning (desktop showed data fine)

• IMS 4281400 — F5 Load Balancer access not available

What stands out: The popup crash fix (IMS 4103780) and the random freeze fix (IMS 4297697) are the kind of stability improvements that don’t make headlines but make daily operations significantly less frustrating. The load balancing fix (IMS 4281400) is the feature-class item here.

InTouch HMI Fixes (36 Issues)

InTouch’s 36 fixes cover an unusually wide surface area. I’ve grouped them by the kind of pain they address.

WindowMaker & WindowViewer Behavior

• 3932260 — WindowMaker didn’t fully maximize on multi-monitor setups

• 4059759 — Overlay/Replace FrameWindows shrank or expanded at runtime even when resolution matched

• 4072376 — Search box behavior inconsistent with SP1/P01 versions

• 4079800 — view.exe process persisted after closing InTouch View on Windows 11 Pro 24H2

• 4306500 — Select All / Unselect All didn’t work in WindowMaker

• 4314197 — Keyboard shortcuts for rounded rectangle radius (Shift +/-) stopped working

• 4319442 — Resize cursor position was wrong

• 4319931 — Symbol search took much longer than other searches, freezing WindowMaker

• 4320023 — New app from aaPKG had empty SmartSymbol folder

• 4329822 — Single click in properties window auto-selected first list item (Window Type, Frame Style)

• 4354184 — Windows with ShowGraphic-animated symbols couldn’t be resized

Alarms & Trends

• 4032011 — Column header sorting didn’t work for Limit, CurrentValue, etc.

• 4078066 — Alarm acknowledgement showed comment instead of message

• 4101810 — AlarmApp timestamps reverted to local timezone when Like/Not Like filters were applied

• 4099184 — Changing start time caused long delays drawing trend pen data

• 4290104 — OMI AlarmApp filter needed to be toggled off/on to work after opening

• 4296775 — $HistoricalLogging = 0 in startup script didn’t prevent Historian logging

Graphics & Controls

• 4048432 — German InTouch: float values in ShowGraphic() caused conversion error

• 4068358 — OnMouseOver action script triggered on click instead

• 4100289 — “Load changes into WindowViewer” deployment failed after graphics modification

• 4122984 — Same issue persisted after hotfix 4100289

• 4221165 — Owning Object/Me. references didn’t propagate to popups

• 4225534 — Map App Widget with Google Maps didn’t load at runtime

• 4228998 — Combo box displayed no items even with bound tag

• 4319443 — Tag names with ‘e-acute’ showed as question marks in Model-Tagname view

• 4319495 — Graphic element halo showed wrong color through ShowGraphic() in frame windows

Migration & Upgrade

• 4264031 — Batch tag writes via script gave all tags the same value (OPC UA)

• 4269024 — Upgrading from InTouch 2014 caused IDE errors when opening/closing graphics

• 4316716 — Couldn’t add tags to Watch List in Tag Viewer after migrating to P03

• 4352602 — Migrating from InTouch 2017 U2/U3 SP1 left WindowMaker window list empty

Web Client & Other

• 4094432 — Loopback tag Quality dotfield started at 32

• 4250740 — Web Client showed access level -1 for all users after several days

• 4373052 — Hotfix 4250740 didn’t fully resolve the access level -1 issue (intermittent)

• 4401329 — NAD update message appeared even when only tag data changed

Why it matters: The Web Client access level bug (4250740/4373052) is particularly nasty — users running fine for days, then suddenly everyone has -1 access. The OPC UA batch write bug (4264031) is a data integrity issue that could cause real confusion on the operations floor. And the migration fixes (4352602 especially — empty window list!) will save a lot of panic for teams moving off 2017.

Historian Fixes (8 Issues)

• IMS-4230460 — Historian Client Web reserved two licenses per session

• IMS-4287281 — Saved contents disappeared after clicking Show Contents in Web Client

• IMS-3999081 — Historian lost its license due to TCP port exhaustion

• IMS-4290926 — Inalarm displayed 0NaN:0NaN:0NaN.:NAON in Web Client

• IMS-3626641 — Expressions behaved incorrectly in various ways

• IMS-4326426 — After upgrading from 2017 U2, aahmetadataserver flooded the logger with errors

• IMS-4369854 — Web Client wouldn’t save content with specific tags

• IMS-4377885 — aahClientCommon warning: “Tag name() failed to add to Historian after 3 attempts, error(success)”

The TCP port exhaustion fix (IMS-3999081) is the quiet heavyweight here. It won’t show up in testing — it manifests only under sustained load when ports run out and the Historian suddenly loses its license. If you’ve ever had unexplained Historian licensing failures in production, this might be your culprit.

Historian Client Fixes (4 Issues)

• IMS-4268049 — Data Log only showed changes, not same values

• IMS-4333574 — aaHistClientTrend ActiveX control was missing the GridColor property

• IMS-4346243 — HistoricalTrendApp Y-axis limits displayed incorrectly after translation

• IMS-4378032 — Trend Client in a popup caused InTouch to hang when Historian was unavailable

Communication Drivers Pack Fixes (11 Issues)

Drivers Core (3)

• 4111871 — [SuiteLink] Encrypted connections wouldn’t establish or had extreme delays

• 4289134 — [SuiteLink] TCP and Non-Page Pool memory leak on invalid topics/hosts, eventually crashing the system

• 4374522 — Multiple drivers (ABCIP, ABTCP, SIM, MQTT, Gateway) crashed in Desktop mode due to CLSID mismatch

Gateway (2)

• 4113913 — Gateway driver threw exceptions during server redundancy failover

• 4124805 — MQTT Publisher couldn’t publish data (no option to configure its own client ID)

GESRTP (1)

• 4084545 — GESRTP driver crashed every few days after upgrade

MBTCP (1)

• 4320949 — MBTCP didn’t restore PLC connections after PLC came back online

SNMP (1)

• 3812206 — SNMP logon failed with devices requiring tokens that include UDP source port numbers

WEBSVC (3)

• 3684136 — OAuth 2.0 access tokens weren’t generated

• 4245168 — Couldn’t obtain tokens when response was nested JSON with token in “token” node

• 4287646 — After upgrading to CDP P03, Log Viewer filled with “request body and JSON/XML format body from configuration are empty” messages

The pattern: SuiteLink gets two fixes — one for encrypted connections and one for a memory leak that can crash the system. If you’re using SuiteLink with encryption, both are important. The WEBSVC trio suggests AVEVA has been working through OAuth integration edge cases.

Known Issues

ForceFailoverCmd Warnings (IMS 4249870)

After patching and running ForceFailoverCmd, the GR node reports “unexpected packet from AOS node” warnings.

Workaround: Create DWORD AlarmDispatchDuration = 120000 under HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\ArchestrA\Framework\Platform on all nodes, then restart all platforms.

Web OMI Cascade Deploy Fails Without SMS (IMS 4416834)

If Web OMI is deployed but SMS isn’t configured, cascade deployment fails after P04.

Workaround: Set “On failure, mark as undeployed” → unassign WebViewEngine and WebViewApp → redeploy. The vcp.services warnings during patching are informational — services recover automatically.

Historian Trust Requirement (IMS 4482903)

Historian requires a trusted connection since 2023 R2. Without SMS, historization and playback may fail.

Workaround: Configure SMS, install a CA certificate, or copy the Historian self-signed certificate to all client nodes.

Carried Forward

The usual suspects remain: Historian “Add External Groups” greyed out (relaunch Configurator), Workflow Gateway DLL copy workaround (still needed after four patches — really, AVEVA?), InTouch Carousel Widget limitations, MapApp widget requiring dbghelp.dll, and the OPC UA multi-client logging warnings.

Should You Upgrade?

Upgrade now if:

• You run a distributed architecture with WAN links — the disconnect recovery fixes are significant

• You’re migrating from 2017 or 2020 — the migration compatibility fixes address real blockers

• SuiteLink encrypted connections are failing or you suspect memory leaks

• InTouch Web Client users are hitting the access level -1 bug

• Deployments are taking unreasonably long (30+ minutes for InTouch, hours for aaPkg)

• You want Bit State animations or OMI Web load balancing

• You need to start testing the credential deprecation impact in a controlled environment

You can wait if:

• You’re on P03 with a stable system and none of the P04 fixes match your pain points

• You’re in a tight change window and the issues above don’t apply

• You don’t use WAN-connected nodes, OPC UA, or the specific affected drivers

Upgrade checklist:

1. Back up Galaxy and Historian databases

2. Prepare the Workflow Gateway DLL workaround if applicable (yes, still)

3. Redeploy managed InTouch applications running as a service

4. Test restricted DLL loading in a non-production environment

5. Audit your manual username/password usage — start planning the Named Credentials migration

6. If using ForceFailoverCmd, prepare the AlarmDispatchDuration registry key

The Bottom Line

Patch 04 is the “clean up the backlog” release. The WAN resilience fixes, the migration compatibility work, the deployment performance improvements — these are the unglamorous but essential fixes that make the platform actually work in production environments with imperfect network conditions and legacy migration paths.

The credential deprecation announcement is the forward-looking piece. It’s Phase 1, so there’s no immediate action required, but if you’ve built a habit of dropping manual credentials into Trend Clients and Alarm DB controls, you should start the transition to Named Credentials now. Phase 2 won’t wait for you.

The 114-fix count is impressive on paper, and the breadth is what matters more than the depth — nearly every component got meaningful attention. The Communication Drivers Pack fixes alone address issues that have been causing headaches for anyone using SuiteLink encryption, WEBSVC OAuth, or Gateway redundancy.

If I had to characterize the patch chain so far: P01 was the foundation, P02 was the memory leak cleanup, P03 was the security tightening, and P04 is the reliability pass. Each one has been purposeful. If you’re still on the SP1 base without any patches, you’re missing a lot.