When something stops running, the controls engineer opens three windows: the MES event log, the historian view, and last night's shift handover note. They run the same query they ran the last six times, in the same order, looking for the same shape. The first hour of every incident is reconstruction work that should have been automated five years ago.
Hypotheses are tested serially because the engineer can only be reading one window at a time. By the time the third one comes back inconclusive, the line has been down for forty minutes and someone has decided to 'just restart it' to see what happens. The post-mortem records 'unknown cause, recurrent' — which is the same thing it recorded last time.
The audit trail is whatever someone remembered to type into the incident ticket on the way out. Six months later, when the OEM asks why a similar defect appeared on a similar press, nobody can reconstruct what was looked at and what was ruled out — only what was eventually fixed.