SCADA System is tweeting….

This can be easily achieved by connecting WinCC OA to NodeRed by MQTT. From Node Red it is possible to connect to Twitter and publish tweets. I installed a MQTT server Mosquitto on my SCADA server and connected WinCC OA to this MQTT broker, so that I can send a datapoint value from WinCC OA to MQTT. Node-Red can read this tag from MQTT and publish the message to Twitter…

WinCC OA TwitterNodeRed Twitter

Monitoring with Logstash and WinCC OA…

Monitoring-Concept

 

For example we do this with the Oracle Alert Log. Very often an Oracle Database is used with WinCC OA to store history values. But a lot of times no one takes care of the Oracle database. At least the Alert-Log file should be observed. With Logstash, Apache Kafka and the WinCC OA Apache Kafka Driver we can send alert log messages from the Oracle database(s) to a WinCC OA monitoring system.

Oracle-Alert-Log

Observing WinCC OA Logs with Elasticsearch and Logstash…

With Logstash we can collect the logs of WinCC OA systems and write it to Elasticsearch. Multiple WinCC OA system’s can be observed with a central log database…

With Kibana the logs can be easily discovered – I now see errors what i haven’t seen before in my system…

In parallel the log messages are written to Apache Kafka. With Apache Spark we can now observe the log streams and detect anomalies… a very simple observation could be to just simple count the amount of log messages per timeframe …

logstash

WinCC OA logstash configuration file: winccoa-logstash-conf

WinCC OA RDB-Manager with Oracle vs MongoDB

Keep in Mind: It is not a comparison of the databases only. With Oracle we used the WinCC OA RDB Manager with OA Query-RDB Direct option, and the RDB-Manager has lot of more functionalities than the NoSQL Prototyp! The other databases were tested with a NoSQL Logger Prototyp written in Java, and the implementations for writing and reading are different, because there are different interfaces for each database – for PostgreSQL we used the PostgreSQL JDBC driver, MongoDB has it’s own Java API and InfluxDB uses REST/HTTP. So, not only the speed of the database itself is compared – also the interfaces to WinCC OA and the implementations of reading are taken into account.

Oracle and OA RDB-Manager Results:
2016.07.29 09:09:03.302[“start…”]
2016.07.29 09:09:39.628[36.326][33669]
2016.07.29 09:11:22.051[“start…”]
2016.07.29 09:11:36.213[14.159][33669]

MongoDB Results:
2016.07.29 09:10:37.449[“start…”]
2016.07.29 09:10:53.171[15.72][33669]
2016.07.29 09:11:42.932[“start…”]
2016.07.29 09:11:52.918[9.986][33669]

InfluxDB Results:
WCCOAui1:2016.07.29 09:47:33.441[“start…”]
WCCOAui1:2016.07.29 09:47:42.477[9.035][33668]
WCCOAui1:2016.07.29 09:48:12.733[“start…”]
WCCOAui1:2016.07.29 09:48:18.745[6.011][33668]

it is faster than MongoDB. And our InfluxDB is running on a MacMini (Hyper-V) and the data is stored on a shared Synology NAS for home usage (DS414 slim) – much less power for InfluxDB compared to the four 7.2k disks and to the i7 where the Oracle DB and MonogDB is running on.

PostgreSQL Results:
WCCOAui1:2016.07.29 09:56:55.062[“start…”]
WCCOAui1:2016.07.29 09:57:03.475[8.41][33669]
WCCOAui1:2016.07.29 09:57:14.767[“start…”]
WCCOAui1:2016.07.29 09:57:20.196[5.427][33669]

PostgreSQL is running on the same machine and disks as Oracle and MongoDB.

Streaming & Complex Event Processing (CEP) & EPL/CQL with WinCC OA…

Complex Event Processing (CEP) and event series analysis are used for detecting situations among events. EsperTech provides the Event Processing Language (EPL) designed for concisely expressing situations and fast execution against both historical and currently-arriving events (Espertech.com).

The Esper EPL is quite powerful – details can be found in the Esper documentation. Found also some slides about Esper. The EPL is a CQL (continuous query language), after a statement is created it is running coninously and results are streamed to listeners – in this prototype a listener is sending the results back to WinCC OA datapoints.

A WinCCOA API-Frontend-Manager gathers all value changes from WinCC OA and publishes it by ZeroMQ. The WinCC OA CEP Manager, with the open source Esper-Engine, subscribes to the Frontend-Manager to get the value changes. The advantage is that many subscribers can be connected to the Frontend-Manager, without increasing the load on the WinCC OA system (based on the ideas from CERN).

With the WinCC OA CEP Manager we can define EPL / CQL statements in WinCC OA and the result streams are passed back to WinCC OA on datapoints, where the results can be processed further.

Some simple EPL examples:

Calculate 5 minute average values with intermediate results every 1 minute:

select avg(value), min(value), max(value) 
from event(tag='System1:Meter_Input.Watt').win:time(5 min) 
output snapshot at (*/1, *, *, *, *)

With pattern matching complex event sequences can be observed with EPL. A simple example is: detect if datapoint B is set after datapoint A (A->B), and its value is higher than the value of A.

select a.value, b.value
from pattern [a=Event(tag='System1:Analog1.Input') -> every b=Event(tag='System1:ExampleDP_Trend1.' and b.value>a.value)]

Get a notification when a datapoint is changing more than 100 times within 10 seconds:

select tag, count(value) 
from Event.win:time_batch(10 sec) 
group by tag having count(*) > 100

Get a notification when a datapoint changes and there is no following value change within the next 10 seconds. For example: if meters are normally changing every 5 seconds, possible broken meters/interfaces can be detected with EPL:

select a.tag, count(*) from pattern 
[every a=Event -> (timer:interval(10 sec) and not Event(tag=a.tag))] 
group by a.tag

Other examples can be found here.

Attached is a screenshot of a simple panel where EPL statements can be defined and observed.

WinCCOA CEP Panel

Other examples for CEP with Esper: http://www.adrianmilne.com/complex-event-processing-made-easy/

IoT with WinCC OA and Raspberry Pi (Demo at Cern)…

I had the opportunity to demonstrate an IoT prototype based on WinCC OA on a Raspberry Pi at Cern.

WinCC OA is running on the Raspberry Pi and it is sending values of a temperature sensor to my WinCC OA server at home over MQTT (Thanks to HiveMQ).

In that case just a simple average calculation is done with WinCC OA on the Raspberry, but many other things can be done with WinCC OA on the Raspberry – Edge Computing.

Additionally the server can send an action to the Raspberry to turn on/off a simple LED on the Raspberry. The Raspberry with WinCC OA is a tiny Cyber Physical System (CPS)…

Cern is using WinCC OA since 2000!

IoT with WinCC OA and Raspberry

Slides can be download from Cern: https://indico.cern.ch/event/524996/timetable/#20160609.detailed

SmartHome Presentation Cern

Streaming WinCC OA Events to Apache Kafka and Spark…

We connected a Event Data Logger, written in Java and connected to WinCC OA by JNI, to Apache Kafka, a A high-throughput distributed messaging system.

Apache Spark can read data from Apache Kafka streams. Apache Spark is a fast and general engine for large-scale data processing. Combine SQL, streaming, and complex analytics. Spark powers a stack of libraries including SQL and DataFrames, MLlib for machine learning, GraphX, and Spark Streaming. You can combine these libraries seamlessly in the same application.

WinCCOA-Kafka-Spark