New York, NY. Architecture and Best Practices Recommendations for PI Systems. Regional Seminar Series. 05 November 2010

Transcription

1 Regional Seminar Series New York, NY Architecture and Best Practices Recommendations for PI Systems 05 November 2010 Stephen Kwan Product Manager OSIsoft, LLC Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

2 Areas of Discussion & Topics Outline Visualization Notifications Asset Framework Advanced Computing Engine PI Server Interfaces 2 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

5 Operating System Virtualization Why are OSIsoft customers using Virtualization? Server consolidation Improved availability and provisioning OSIsoft supports virtualization OSIsoft Knowledge Base article 3062OSI8 Consider shared resources implications 5 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

6 Virtualized PI PI Server Secondary PI Server Primary ACE Server Virtual Host A AF Server Virtual Host B Virtual Desktops (Clients) Interfaces VM Host Farm Virtual Host C 6 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

7 Operating System Virtualization* Best practices Treat virtual machines as if they were physical machines Invest in Enterprise-level hardware and software Do not mix virtual and physical on the same host Use qualified Virtualization support personnel Test on the target platform * OSIsoft Center of Excellence 7 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

8 Application Virtualization Overview Applications centrally installed and managed Users are remote OSIsoft customers are successfully using Microsoft and Citrix virtualization products 8 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

9 64 Operating Systems Overview Why 64-bit? Access to larger memory footprint Reduce limitation to applications PI ACE contexts was limited due to 32 bit 9 9 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

10 PI System 64 bit operating system support Several products support native 64-bit operation Examples: PI Server, PI Web Parts, Asset Framework Windows compatibility layer enables 32-bit programs to run on 64-bit Example: Interfaces, PI ACE Future product releases will support native 64 bit PI ACE, PI Notifications 10 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

11 64-bit Application Support - Exceptions Certain components work only with 32-bit versions of applications PI Add-ins for Microsoft Excel DataLink for Excel RDBMS interface and 64-bit drivers PI ActiveView & PI Graphic (SVG) require 32-bit Internet Explorer 11 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

12 PI System 64 bit operating system support Best practices Verify support Release Notes Technical support Scenarios to watch out for Applications that are plug-ins or run by another application Microsoft Internet Information Server Office 2010 Where 3 rd party libraries (dlls) need to run with another application RDBMS interface 12 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

14 Interface Buffering Overview Ability of interface node(s) to store data in the event of disconnection from PI Server(s) Goal: Minimize data loss Two flavors PI Server PI Buffer Subsystem PI Bufserv PI Buffer Subsystem PI interface(s) Interface Node 14 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

15 Interface Failover Overview Support failure of data collection Goal: Minimize data loss Synchronization is with the data source or Synchronization is between the interfaces PI Buffer Subsystem PI interface Failover mechanism PI Buffer Subsystem PI interface 15 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

16 Interface Failover Interfaces watch each other s Heartbeat and Status Failover Types Hot = No data loss Warm = Maybe data loss Cold = Some data lost (Hint: minimize data loss by using disconnected startup) 16 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

17 Interface failover - Hot Send data to PI Primary Interface Heartbeat: Device Status: File Heartbeat: Device Status: Send data to PI from the last 2 intervals (4 & 5) and this one (6) Backup Interface 0 Failure Data in the communication Collection layer Data Source Data Collection Timeline : (interval) Possible overlap of data during intervals 4 and 5 17 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

18 OPC Server Failover and Interface Failover PI SDK, PI API PI SDK, PI API PRIMARY INTERFACE Interface Buffer Interface Buffer BACKUP INTERFACE PRIMARY DATA SOURCE (e.g. OPC SERVER) BACKUP DATA SOURCE (e.g. OPC SERVER) PLC / INSTRUMENT SYSTEMS 18 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

19 PI Interfaces Best practices Configure Buffering PI Buffer Subsystem Consider implementing failover support Disconnected start-up Create interface health points Do not authenticate to PI using piadmin 19 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

21 PI Server High Availability (PI HA) Overview Redundancy with multiple PI Servers as one collective Goal: Maximize data access for clients 21 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

22 PI Server High Availability Architecture System Management Tools Thin clients: PI WebParts Smart clients: ProcessBook, DataLink, Custom applications PI-SDK PI server collective Secondary PI server Configuration changes Primary PI server Secondary PI server(s) Identical time series data PI Buffer Subsystem Failover mechanism PI Buffer Subsystem PI interface PI interface Copyright 2010 OSIsoft, LLC 22

23 PI HA and security architecture NERC CIP-002 Critical Cyber Assets Electronic Security Perimeter Business User Domain PI Interface Node Protected User Domain PI Server (HA) Data Only Conduit DMZ PI Server (HA) Desktops and Data Access Servers Configuration Data Time Series Data Application Data

24 PI deployment across security zones CIP-002 Critical Cyber Assets Electronic Security Perimeter Business User Domain PI Interface Node or OEM with PI-to-PI Data Only Conduit DMZ PI Server Desktops and Data Access Servers Originator Time Series Data Application Data

25 Replication of PI data CIP-002 Critical Cyber Assets Electronic Security Perimeter Business User Domain Protected User Domain DMZ PI SCADA Interface PI Server PI-to-PI PI Server Originator Time Series Data

26 PI Server High Availability Benefits Maintain availability during scheduled maintenance Redundancy of data Locate PI Server member close to consumers of the data Best practices Implement PI Server High Availability 26 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

28 PI Server Security Overview PI Server (2009) introduced support for Windows Integrated Security Microsoft Active Directory (AD) integration Map AD users to PI Identities PI Identities are roles on the PI Server PIOperators, PIEngineers, PISupervisor 28 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

31 Automatic Backward Compatibility Tag dataaccess datagroup dataowner sinusoid o:rw g:rw w:r pi_users bob Tag sinusoid datasecurity pi_users:a(r,w) bob:a(r,w) PIWorld:A(r) 31 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

32 Active Directory Integration PI Server must be a member of a domain to leverage Kerberos authentication Multiple AD domains must have trusts established or users and groups from other domain cannot be used One-way trusts are supported: the server domain must trust the client domain For non-domain accounts, you can use Windows Local Groups from the PI Server machine Passwords have to match for NTLM authentication 32 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

33 PI Identity Planning Best practices Develop a PI Identity Scheme for your Organization Protect your data Ease of maintenance Organizational separation Standardize Consider Kerberos Map AD principals directly Map AD principals to local groups 33 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

34 How to Tighten Security Best practices 1. Use the new Security Tool to help secure your PI Server 2. Disable or protect the PIADMIN account 3. Disable PI password authentication (Explicit Logins) 4. Secure piconfig by forcing login 5. Retire PI SDK-based Trusts 6. Use Windows Integrated Security 34 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

37 PI Advanced Computing Engine Overview Develop calculations in Microsoft Visual Studio Wizards assist configuration High availability ACE PI-SDK PI Server Best practices Data Buffering Services Configure buffering Error handling Performance Counters 37 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

38 Module database and Asset Framework ACE PI Server uses 2010 the Module enables Database MDB to AF (MDB) link and for configuration and synchronization calculation metadata PI ACE MDB MDB PI SERVER COLLECTIVE AF Link Subsystem AF SERVER 38 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

40 PI AF Overview An asset model to organize and structure all your data with context Build hierarchy, categories and connectivity models Data references to time series (PI Points) and other data Search across multiple PI Servers to find information Leverage PI Notifications Asset Information / Metadata PI Notifications Relational / Non Time Series Data PI Server PI Server Collective Time Series Data Time Series Data 40 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

41 PI Asset Framework Components Two key components AF Server SQL Server database SQL Server Express, Standard Cluster or Mirror AF Server Behind a load balancer AFSDK Collective 41 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

44 PI Asset Framework Best practices Backups! Monitor SQL Server with MCN Health Monitor Do not run the SQL Server database engine as LOCALSYSTEM, admin, or domain admin. DO NOT RUN the AF Server with SysAdmin privilege (don t use SA account, LOCALSYSTEM, or admin) Minor: for AF Table, disable AF2.0 compatibility, enable impersonation 44 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.

45 PI Notifications Architecture Overview PI Servers PI ProcessBook PI DataLink Other Data Sources Delivery channels: Web service Office Communication Server (OCS) Custom developed (OSIsoft vcampus) 45 Value Now Fast, Simple, Sustainable 2010 OSIsoft, LLC. All rights reserved.

47 More Information Whitepapers and Tech Support bulletins on OSIsoft web site User Manuals PI Server 2010 Configuring Security Asset Framework 2010 User's Guide OSIsoft vcampus Online community Forums, Whitepapers, Webinars 47 Empowering Business in Real Time. Copyright 2010, OSIsoft, LLC. All rights Reserved.