Page 2 of 28
Table of Contents
FactoryTalk VantagePoint Design Considerations ............................................................................................. 1 Introduction ............................................................................................................................................................... 5 Using this Document ............................................................................................................................................ 5 Product Version Information ............................................................................................................................... 5 Document Naming Conventions/Abbreviations................................................................................................. 5 Prerequisite Reading............................................................................................................................................. 6 Document Revision History................................................................................................................................. 6 Whats New in FactoryTalk VantagePoint V3.1? .............................................................................................. 6 Known Issues ........................................................................................................................................................ 6 Introduction to FactoryTalk VantagePoint.............................................................................................................. 7 Architectural Considerations.................................................................................................................................... 7 Selecting the Correct VantagePoint Version ...................................................................................................... 8 FactoryTalk VantagePoint Licensing .................................................................................................................. 8 FactoryTalk VantagePoint Secuirty .................................................................................................................. 11 Reference Architectures ..................................................................................................................................... 12 Reference Station Architectures ........................................................................................................................ 15 Recommended Platform Requirements................................................................................................................. 16 Installing a New Operating System on Computers .......................................................................................... 16 Operating System Tips ....................................................................................................................................... 16 Windows Error Reporting .................................................................................................................................. 17 Internet Information Server (IIS) ....................................................................................................................... 17 Network Configuration........................................................................................................................................... 17 WAN/Wireless Communications ...................................................................................................................... 17 Firewall Communications .................................................................................................................................. 17 Workgroup vs. Domain .......................................................................................................................................... 17 Domain Best Practices............................................................................................................................................ 18 Windows Support Tools..................................................................................................................................... 19 Upgrading from Incuity EMI ................................................................................................................................. 19 Software Installation ............................................................................................................................................... 20 Installation on Drives Other Than C: ................................................................................................................ 20 FactoryTalk Directory ........................................................................................................................................ 20 Default File Locations for FactoryTalk VantagePoint ..................................................................................... 21 Post Installation Activities ..................................................................................................................................... 21 Post Release Patches .......................................................................................................................................... 21 Licensing ............................................................................................................................................................. 21 MSSQL Server Licensing .................................................................................................................................. 22 Installing FactoryTalk VantagePoint Clients .................................................................................................... 22 Backing up and Restoring FactoryTalk VantagePoint ......................................................................................... 23 Maintaining FactoryTalk VantagePoint Log Files ............................................................................................... 23 Using FactoryTalk VantagePoint Sample Content............................................................................................... 23 VantagePoint Compatibility ................................................................................................................................... 23 Controller Compatibility .................................................................................................................................... 23 Excel Compatibility ............................................................................................................................................ 23 FactoryTalk Historian SE Redundancy Support .............................................................................................. 24
Page 3 of 28
FACTORYTALK V ANTAGEPOINT DESIGN CONSIDERATIONS Using FactoryTalk VantagePoint to Store Tags ................................................................................................... 24 System Redundancy ............................................................................................................................................... 24 System Security ...................................................................................................................................................... 24 Windows Terminal Services .................................................................................................................................. 25 Time Synchronization ............................................................................................................................................ 25 Troubleshooting ...................................................................................................................................................... 26 Tools and Utilities................................................................................................................................................... 26 Additional Reference Links ................................................................................................................................... 27 General ................................................................................................................................................................ 27 Communications ................................................................................................................................................. 27 Design Considerations and Best Practices ........................................................................................................ 27 Microsoft ............................................................................................................................................................. 27
Page 4 of 28
Introduction
This document is a supplement to the FactoryTalk VantagePoint documentation that is installed with the software. It is designed to make system developers aware of the fundamental best-practice guidelines for designing and implementing a FactoryTalk VantagePoint application. If you are unfamiliar with the Integrated Architecture, FactoryTalk Services Platform, or FactoryTalk VantagePoint, reference the following Product Profiles and websites prior to reading this document: FactoryTalk Services Platform and Integrated Architecture: FactoryTalk Services Platform Product Profile http://www.rockwellautomation.com/rockwellsoftware/factorytalk/integrated.html FactoryTalk VantagePoint: FactoryTalk VantagePoint Product Profile http://www.rockwellautomation.com/rockwellsoftware/performance/vantagepoint/ (Includes ordering information) Answer ID 61808 - FactoryTalk VantagePoint Frequently Asked Questions
Page 5 of 28
Prerequisite Reading
The following VantagePoint related document is included with the product and should be considered prerequisite reading for this document: The FactoryTalk VantagePoint Getting Results Guide provided with the VantagePoint installation materials. See www.Incuity.com for updated information.
Additionally, the FactoryTalk VanagePoint Help content located by browsing to Start All Programs Rockwell Software FactoryTalk VantagePoint Help on the VantagePoint Server is a comprehensive resource for VantagePoint information and procedures.
Known Issues
Known issues in this release can be found in the document KnownIssues.htm provided with the FactoryTalk VantagePoint installation.
Page 6 of 28
Architectural Considerations
A typical FactoryTalk VantagePoint system consists of several Windows-based computers and various Programmable Automation Controllers interconnected via one or more networks. To insure proper operation for VantagePoint, these foundation components of the system must be operating properly: When using live data communication, the Programmable Automation Controllers must be properly programmed and configured for efficient communications. For example: the processors communications time slice may need to be increased. The network(s) must be robust and free of communications errors and bottlenecks. For example, the ports on switches and the network interface cards on computers should typically be changed from Auto Detect to a fixed setting.
Page 7 of 28
FACTORYTALK V ANTAGEPOINT DESIGN CONSIDERATIONS The computers must be configured appropriately for the application. For example, power saving features on servers should typically be disabled. Firewalls may need to be turned off, or configured with exceptions.
For additional information on these topics, refer to Ethernet Design Considerations for Control System Networks.
Page 8 of 28
FACTORYTALK V ANTAGEPOINT DESIGN CONSIDERATIONS Named Users: Named User Licenses are licenses which are explicitly assigned to a Windows User. Once assigned, the Windows user will own that license unless the named user is manually removed by a VantagePoint Administrator. A Named User will always be able to access the FactoryTalk VantagePoint system from a single client location. If Named Users attempt to login to multiple clients simultationsly they will be denied access to the system. If named user licenses are not assigned while setting up a VantagePoint system, the first time a user connects they will automatically be assigned a named user license. If all named user licenses are being used, that user will be unable to connect to VantagePoint. Once a named user is assigned, it does not expire and onlyVantagePoint administrators can add or remove named users. Concurrent Users: Concurrent User licensing allows users who are not Named Users to access the system. A Windows user who accesses the system and is not a Named User will automatically use a Concurrent User license (if all Named Users licenses are already taken). When the Windows user logs off the system, the Concurrent License will be released. If a Windows user is not a Named User and no Concurrent User licences are available, the user will not be able to log in to the system.
Named Users are typically used to ensure that an individual is able to access the system at any time. Setting up Named Users during initial system implementation is highly recommended. Licenses can be added together (i.e. (2) 5 named user licenses on the same server would allow 10 named users). For licensing information, see FactoryTalk VantagePoint Ordering Information.
No
Yes
No
Yes
Login to Portal
Page 9 of 28
No
Yes
No
Yes
No
No
No
Yes
No
Page 10 of 28
Page 11 of 28
Reference Architectures
The number of computers needed in a FactoryTalk VantagePoint system is dependent on the number of users that will be connecting to FactoryTalk VantagePoint. The following reference architectures provide examples of a small, medium, and large VantagePoint system. Additionally, an example architecture which incorporates FactoryTalk Historian SE and FactoryTalk View SE has also been provided.
For small systems it is permissible to co-locate FactoryTalk VantagePoint and the database server on the same computer A Windows Workgroup environment is supported for small configurations. For more information see Workgroup vs. Domain
Page 12 of 28
FactoryTalk VantagePoint should be installed on a server separate from the database server if there will be more than 10 users or more than 100 total tags
Page 13 of 28
FactoryTalk VantagePoint should be installed on a server separate from the FactoryTalk Data server if there will be more than 20 total users or more than 1000 total tags (VantagePoint EMI Only)
Page 14 of 28
Installing the FactoryTalk VantagePoint server on a dedicated server separate from other Rockwell Software Products is highly recommended.
Page 15 of 28
Page 16 of 28
Network Configuration
In depth network design is outside the scope of this document. For detailed information on configuring a network, refer to the Ethernet Design and Implementation Guide. Its important to note that any network hosting FactoryTalk applications should use only managed switches.
WAN/Wireless Communications
Communications across anything slower than a 100mpbs, wired LAN can present negative impact on overall system performance. Aside from the question of network security, which is outside the scope of the document, two key factors are the speed and stability of the network. To mitigate problems due to signal interference or timeouts, it is strongly recommended to use Terminal Services to bridge any WAN/Wireless communications. See the Terminal Services section of this document for more information on implementing Terminal Services.
Firewall Communications
As the purpose of any firewall is to restrict port usage, a firewall should always be located at the entry/exit point of a network. This will prevent outside access to the network, while allowing unimpeded internal network communications. If it is required to access a FactoryTalk system through a firewall, it is strongly recommended to use Terminal Services. Terminal Services will only require one port to be opened in the firewall, whereas FactoryTalk communications will require many more, including the entire dynamic range of DCOM ports. See the Terminal Services section of this document for more information on implementing Terminal Services, or see AID 29402 for a list of ports used by FactoryTalk.
Workgroup
Decentralized Administration Advantages: No Domain Controller (Windows Server OS) to purchase. One less computer in network to maintain. Recommended only for small applications where user accounts dont change often.
Page 17 of 28
FACTORYTALK V ANTAGEPOINT DESIGN CONSIDERATIONS Workgroup Rules: The system can consist of no more than 10 FactoryTalk computers. Name resolution must be configured using a DNS Server or by using Hosts files. All computers participating in a single FactoryTalk application must be members of the same Windows workgroup. All users participating in the workgroup must be members of the Administrators group. Create the same set of user accounts and passwords on every computer in a FactoryTalk application.
Domain
Centralized Administration Advantages: One place to manage Users, Groups and Security Automate IP addresses with Dynamic Host Configuration Protocol (DHCP), and Name Resolution and with Domain Name Service (DNS) and Windows Internet Name Service (WINS). Domain Rules: For applications consisting of more than 10 FactoryTalk computers, a domain controller is required. Rockwell Software components (including the FactoryTalk Services Platform) should not be installed on domain controllers.
Page 18 of 28
Windows 2000 Server & Windows Server 2003 Active Directory redundancy: It is recommended to implement at least 2 domain controllers, where both are configured with the Global Catalog (GC) role to provide high availability. By default, the GC role is only on the first domain controller in the forest, but it is possible to add the GC role on other domain controllers from the Active Directory Sites and Services console. Simply expand Sites > site name > Servers > server name, right-click NTDS Settings, and select Properties. The Global Catalog check box is on the General tab. Note: There are still a number of single instance domain controller roles that can result in a single point of failure. These 5 Flexible Single Master Operations (FSMO) roles are: 1. PDC Emulator (one per domain) 2. Infrastructure master (one per domain) 3. Relative ID (RID) master (one per domain) 4. Schema master (one per forest) 5. Domain naming master (one per forest) Time Synchronization should be configured throughout the domain. For additional information, refer to the section entitled Time Synchronization later in this document. Prior to deploying VantagePoint, both new and existing active directory domains should have their operation verified using Microsofts Domain Controller Diagnostics (Dcdiag.exe) utility. This utility is included with the Windows Support Tools located on the Operating System CD and also available via download from Microsoft. Rockwell Software does not support its software on computers configured as domain controllers. The following information comes from a Microsoft TechNet article posted at http://www.microsoft.com/technet/prodtechnol/windows2000serv/maintain/security/secdefs.mspx. The key sentence in this TechNote is "In general, Microsoft does not recommend running applications on computers configured as domain controllers, and certainly not applications that require more than Authenticated User privileges in order to run successfully." Installation of any application software on a domain controller can have adverse affects on the network and is the responsibility of the user to accept the risk.
Page 19 of 28
Software Installation
Refer to the FactoryTalk VantagePoint Getting Results Guide for installation instructions. A link to the most up to date version of this material can be found in Answer ID 61616 - Literature and links about FactoryTalk VantagePoint. Additional recommendations are included below: Establish a systems computer names prior to installing the VantagePoint server. If the FactoryTalk VantagePoint server name needs to be changed follow the procedure in Answer ID 61897 - How to Change the VantagePoint/Incuity EMI Server Name Check the time and the time zone on all computers prior to installing the VantagePoint server. To maintain accurate time on all computers, use the Windows Time Service.
FactoryTalk Directory
FactoryTalk VantagePoint makes use of a Network FactoryTalk Directory. VantagePoint uses the FactoryTalk directory to connect to FactoryTalk Live Data through Live Data servers. Connections to FactoryTalk Historian SE can be made using either the FactoryTalk Directory connection or a direct connection. For more information see the topic Add a FactoryTalk Historian Connector in the VantagePoint help documentation. The VantagePoint server must be part of the same FactoryTalk Directory as the Live Data servers in order to function correctly.
Page 20 of 28
FACTORYTALK V ANTAGEPOINT DESIGN CONSIDERATIONS It is strongly recommended that all versions of the FactoryTalk Services Platform be consistent over the entire Network FactoryTalk Directory. See AID 58803 Network FactoryTalk Directory Best Practices for more information on setting up a FactoryTalk Directory.
Licensing
VantagePoint only supports FactoryTalk Activation; Rockwell Softwares legacy (EvRSI) activation is not supported. Only the VantagePoint server needs to be licensed. For more information see:
Page 21 of 28
Answer ID 61745 - FactoryTalk VantagePoint Remote Activation the FactoryTalk Activation On-line Help Answer ID 35251 - FactoryTalk Activation Frequently Asked Questions Answer ID 44623 - What are FactoryTalk Activations and How Do They Work?
During the VantagePoint server installation the FactoryTalk Activation Server software is automatically installed, however VantagePoint is capable of using a Remote Activation server as well. If planning to use the VantagePoint Server as the system FactoryTalk Activation Server, refer to: Answer ID 35376 - FactoryTalk Activation Server User Management Answer ID 41573 - FactoryTalk Activation End User Options File to Include/Exclude Borrowing Activations Answer ID 35708 - How to support FactoryTalk Activations in a LAN/WAN Environment Answer ID 35717 - How to make communication available between the FactoryTalk Activation Server and Client FactoryTalk VantagePoint Security and Licensing
Page 22 of 28
VantagePoint Compatibility
Information on FactoryTalk VantagePoint compatibility with other hardware or software products can be found in AID 59149- FactoryTalk VantagePoint Tips and Best Practices TOC under Compatibility.
Controller Compatibility
The current release of FactoryTalk VantagePoint fully supports automated tag imports from the ControlLogix Platform. In addition to ControlLogix, the AddItems operation of the OPCDA connector in VantagePoint can also be used to import FactoryTalk Live Data tags from other controller platforms (e.g., SLC, PLC5, etc.) When utilizing this functionality, users should be aware that data type issues may occur during imports from non-ControlLogix controller platforms. For more information see AID 61744FactoryTalk VantagePoint Controller Platform Compatibility.
Excel Compatibility
Microsoft Office Add-in Wizards make it easy to bring data from multiple control and business systems (via VantagePoint) into the familiar but powerful environment of Excel. Here, users can use Excel's analysis capabilities, or use the VantagePoint Add-in wizards that make it easy to manipulate and present the data. Users can publish content directly to the web, and collaborate by fetching and building upon existing published reports. Real time reports are automatically refreshed in Excel, and in the end users browser after publishing See AID 60409- FactoryTalk VantagePoint Microsoft Excel Compatibility for more information.
Page 23 of 28
System Redundancy
The current release of VantagePoint does not provide redundancy. VantagePoint is used to provide access to existing manufacturing and plant data sources and does not typically act as a data source itself. The VantagePoint configuration and VantagePoint tags are stored in a SQL database. Regularly backing up the following VantagePoint components is recommended: VantagePoint Microsoft SQL databases (IncuityStore and IncuityHistory) Web Site and Supporting Files: o C:\inetpub\wwwroot\IncuityPortal\ o C:\inetpub\wwwroot\Incuity\ o C:\inetpub\wwwroot\IncuityOffice\ All scripts and utilities used during configuration. Be aware that System Integrators may add scripts and utilities to the VantagePoint System. These files may include server-side scripts, instance and type packages. These files are usually placed on the VantagePoint machine in the folder o C:\Inetpub\wwwroot\Incuity\Import\
System Security
Security threats generally fall into 4 categories: external, internal, intentional and accidental. Detailed security recommendations against external threats are beyond the scope of this document. However, there are some basic measures that should be taken to protect against the most common threat the day-to-day users of the system. Recommendations in this area include: Password protect the computers BIOS: to prevent booting from anything other than the local hard drive, configure the computer to boot only from the hard drive, and then configure a BIOS password so that mischievous users cannot change the boot device. Password protect the local Administrator account; this often overlooked task is critical. Configure the Windows environment so that it is strictly business for the operators: restrict access to required applications only using Group Policy (in a domain) or Local Policy (on an individual machine or workgroup).
Page 24 of 28
Time Synchronization
The Windows Time service (W32tm.exe) uses the Network Time Protocol (NTP) to synchronize computer clocks on the network. Time synchronization is critical for the proper operation of many Windows services and to ensure the security of Kerberos authentication within an Active Directory environment. In a FactoryTalk VantagePoint system, time synchronization ensures accurate time stamps on all VantagePoint content. Therefore, configuring time synchronization is highly recommended. For more information see Answer ID 62618 - FactoryTalk VantagePoint and Time Synchronization. In workgroup environments, configure Windows Time to synchronize all the SE computer clocks to an authoritative time server (e.g. the FactoryTalk Directory). In domain environments, Windows Time should be automatically configured on each computer (when they join the domain) for the appropriate authoritative time server (i.e., the domain controller that is also the PDC emulator). In either environment, the authoritative time server should then be synched to: o a reliable time server on the Internet o a locally-connected hardware time source such as an atomic clock Check the Event Windows Time Service Tools and Settings http://technet2.microsoft.com/windowsserver/en/library/b43a025f-cce2-4c82-b3ea3b95d482db3a1033.mspx?mfr=true Administering the Windows Time Service http://technet2.microsoft.com/WindowsServer/en/library/ac86e77c-0be3-430a-ba0bc2225506fc4f1033.mspx?mfr=true
Page 25 of 28
FACTORYTALK V ANTAGEPOINT DESIGN CONSIDERATIONS How to configure an authoritative time server in Windows Server 2003 http://support.microsoft.com/kb/816042 How to configure an authoritative time server in Windows XP http://support.microsoft.com/kb/314054/ How to configure an authoritative time server in Windows 2000 http://support.microsoft.com/kb/216734/
Troubleshooting
Troubleshooting information for VantagePoint issues can be found by searching the KnowledgeBase. For information on additional support see AID 59444- How to Receive Support for FactoryTalk VantagePoint. A common issue is when problems with the IIS configuration translate into errors within FactoryTalk VantagePoint. A useful tool in diagnosing IIS problems can be found free from Microsoft in the IIS Diagnostics tool. This installation is a compiled set of tools to help diagnose IIS settings, including anonymous access. The tool can be found from Microsofts downloads site here (IIS Diagnostics Toolkit x86). While FactoryTalk VantagePoint does not use IIS in the same fashion as FactoryTalk View SE, the FactoryTalk View Site Edition IIS Handbook has helpful sections on troubleshooting anonymous access and general virtual directory difficulties. This handbook is located on the Rockwell Automation knowledgebase under AID 39618 (FactoryTalk View Site Edition IIS Handbook.) Below is a list of errors that are commonly seen due to IIS configuration problems. HTTP Status 401: Unauthorized: 401 errors are a good indicator of anonymous access being broken. Ensure that the Virtual Directory has anonymous access enabled, that a valid user is configured as the anonymous user, and that the configured user has valid file permissions access to the virtual directory. HTTP Status 403: Forbidden: 403 errors usually indicate that the virtual directorys configuration is incorrect. The most common cause of a 403 error is the Execute Permissions settings from within the virtual directorys properties. This setting should be set to allow Scripts only. HTTP Error 404: File Not Found: See AID 60244 for information on troubleshooting this error.
Page 26 of 28
Communications
Answer ID 37285 - RSLinx Enterprise 5.00.00 Patch TOC Answer ID 26464 - RSLinx Internals: OPC/DCOM timeouts when a remote client is disconnected
Microsoft
Microsoft TechNet article on Domain Controllers http://www.microsoft.com/technet/prodtechnol/windows2000serv/maintain/security/secdefs.mspx Maximize Data Throughput Setting for Performance Microsofts Description of Performance Options in Windows Log Parser
Page 27 of 28