ThingWorx Platform 8.

5
Deployment Architecture Guide
Document Version 1.6
November 2020
Copyright © 2020 PTC Inc. and/or Its Subsidiary Companies. All Rights Reserved.

User and training guides and related documentation from PTC Inc. and its subsidiary companies
(collectively “PTC”) are subject to the copyright laws of the United States and other countries and
are provided under a license agreement that restricts copying, disclosure, and use of such
documentation. PTC hereby grants to the licensed software user the right to make copies in printed
form of this documentation if provided on software media, but only for internal/personal use and in
accordance with the license agreement under which the applicable software is licensed. Any copy
made shall include the PTC copyright notice and any other proprietary notice provided by PTC.
Training materials may not be copied without the express written consent of PTC. This documentation
may not be disclosed, transferred, modified, or reduced to any form, including electronic media, or
transmitted or made publicly available by any means without the prior written consent of PTC and
no authorization is granted to make copies for such purposes.

Information described herein is furnished for general information only, is subject to change without
notice, and should not be construed as a warranty or commitment by PTC. PTC assumes no
responsibility or liability for any errors or inaccuracies that may appear in this document.

The software described in this document is provided under written license agreement, contains
valuable trade secrets and proprietary information, and is protected by the copyright laws of the
United States and other countries. It may not be copied or distributed in any form or medium,
disclosed to third parties, or used in any manner not provided for in the software licenses agreement
except with written prior approval from PTC.

UNAUTHORIZED USE OF SOFTWARE OR ITS DOCUMENTATION CAN RESULT IN CIVIL DAMAGES AND
CRIMINAL PROSECUTION. PTC regards software piracy as the crime it is, and we view offenders
accordingly. We do not tolerate the piracy of PTC software products, and we pursue (both civilly
and criminally) those who do so using all legal means available, including public and private
surveillance resources. As part of these efforts, PTC uses data monitoring and scouring technologies
to obtain and transmit data on users of illegal copies of our software. This data collection is not
performed on users of legally licensed software from PTC and its authorized distributors. If you are
using an illegal copy of our software and do not consent to the collection and transmission of such
data (including to the United States), cease using the illegal version, and contact PTC to obtain a
legally licensed copy.

Important Copyright, Trademark, Patent, and Licensing Information: See the About Box, or copyright
notice, of your PTC software.

United States Governments Rights

PTC software products and software documentation are “commercial items” as that term is defined
at 48 C.F.R. 2.101. Pursuant to Federal Acquisition Regulation (FAR) 12.212 (a)-(b) (Computer
Software) (MAY 2014) for civilian agencies or the Defense Federal Acquisition Regulation Supplement
(DFARS) at 227.7202-1 (a) (Policy) and 227.7202-3 (a) (Rights in commercial computer software or
commercial computer software documentation) (FEB 2014) for the Department of Defense, PTC
software products and software documentation are provided to the U.S. Government under the PTC
commercial license agreement. Use, duplication or disclosure by the U.S. Government is subject
solely to the terms and conditions set forth in the applicable PTC software license agreement.

PTC Inc., 121 Seaport Boulevard, Boston, MA 02210 USA

1
Table of Contents
Document Revision History .................................................................................................. 3
Introduction .......................................................................................................................... 4
Challenges .................................................................................................................... 4
Deploying ThingWorx to Your Specifications .............................................................. 5
ThingWorx Foundation Deployment Components ........................................................... 6
User/Client Components .............................................................................................. 7
Thing/Device Components .......................................................................................... 7
Platform Components .................................................................................................. 8
Database Components ............................................................................................... 9
High-Availability Components ................................................................................... 12
ThingWorx Deployment Architectures.............................................................................. 13
Deployment Options .................................................................................................. 13
ThingWorx Foundation Basic System ......................................................................... 14
ThingWorx Foundation Basic Production System ...................................................... 15
ThingWorx Foundation Large Production System (non-HA) .................................... 16
ThingWorx Active-Passive High-Availability System .................................................. 17
Standard Deployment: ThingWorx Foundation on Azure ........................................ 20
Other Deployments: ThingWorx Foundation on AWS............................................... 28
ThingWorx Authentication Deployment .................................................................... 33
ThingWorx Analytics Deployment .............................................................................. 36
Vuforia Studio Deployment ........................................................................................ 38
ThingWorx Navigate Deployment ............................................................................. 43
Distributed ThingWorx Deployment ........................................................................... 47

2
Document Revision History
Revision Date Version Description of Change
May 2018 1.0 Initial document version
Added section about deploying ThingWorx
Foundation on Azure.
July 2018 1.1 Updated deployment architecture images to
distinctly show the data and application
layers.

Updated for ThingWorx 8.5:

- Formatting and wording changes
- Updated high scale references and
diagrams for InfluxDB
(replacing DataStax Enterprise)
May 2020 1.5
- Updated Azure deployment diagrams to
depict Azure SQL Database
- Removed AWS IOT Connector
deployment diagram
(end of life)
November 2020 1.6 Removed support for
AWS RDS and Azure DB
for PostgreSQL.

3
Introduction
This guide introduces the components and practices that make up ThingWorx
deployments. It describes the basic components found in every ThingWorx
environment and discusses common deployment concerns and challenges.

The guide also provides common ThingWorx reference architectures to consider

when planning a ThingWorx deployment.

Challenges
Platforms for IoT (Internet of Things) applications must meet the following
challenging requirements:
• Manage content throughput from thousands of devices at a rapid
pace.
• Provide real-time visibility into the performance of the assets, which can
be anything from production lines to smart-connected products.
• Provide remote monitoring and diagnostic services to end users,
including remote troubleshooting and automatic creation of alerts or
trouble tickets
• Predict failures before they occur, integrate with knowledge systems,
and integrate augmented-reality technology into the field service
processes.
A poor architecture can result in a difficult deployment, costly integration
between components with each upgrade, and mixed technologies that
limit future flexibility and introduce multiple points of failure. Instead, a
connected and distributed architecture is required.
• Connected: A good connection with assets enables the platform to
coordinate data monitoring, health monitoring, proactive
maintenance, software management, and remote service.
• Distributed: A distributed architecture allows for global management
where consolidated statistics and KPIs across all locations are desired
and provides local managers with focused and real-time information.

4
Deploying ThingWorx to Your Specifications
When you choose ThingWorx to support the IoT business processes of your
company, the deployment architecture must meet your company’s
requirements for security, scalability, performance, interoperability,
flexibility, and maintainability.

You might ask the following questions:

• What are the deployment options that can meet those requirements?
• How can you combine the necessary elements that address your
company’s requirements into a coherent system?
• How can you be sure that the architecture you deploy can be expanded
to support future needs?
The first critical step toward developing a ThingWorx deployment architecture is
to gain an understanding of the following points:

• The structural organization, the elements and their roles, and the interfaces
of the ThingWorx architecture.
• The configuration options that combine the necessary elements to support
your company’s requirements.
• Some ThingWorx configurations that have been proven to work.

5
ThingWorx Foundation Deployment Components

ThingWorx components can be thought about in three layers – Client,

Application, and Data. The following image shows a basic starting point for any
ThingWorx solution:

Things/Devices: This layer contains the

things, devices, agents, and other assets
that connect with, send data to, and
receive content from the ThingWorx
platform.

Users/Clients: This layer contains the

products (primarily Web browsers) that
people use to access the ThingWorx
platform.

Platform: The platform layer (or application

tier) is where ThingWorx Foundation resides,
serving as the hub of a ThingWorx system.
This layer provides connectivity to the client
layer, performs authentication and
authorization checks, ingests/processes/
analyzes content, and reacts to conditions
like sending alerts.

Database: The database layer maintains

ThingWorx runtime model metadata and
system data:

- Model metadata includes ThingWorx

entity definitions, Thing definitions and
their associated property definitions.

- Runtime data ingested against the

ThingWorx model. The data could be
either tabular or time-series data that is
persisted by the ThingWorx model as
rows of content in blogs, wikis, streams,
value streams, and data tables.

6
With the growth of the ThingWorx solution in capability and complexity, the
architectural needs within each tier grow.

The following sections introduce each component of a ThingWorx solution within

the tier or layer in which the component operates.

User/Client Components
The user or client accessing the ThingWorx platform through ThingWorx
Composer or through runtime mashups is required to have a modern browser
that supports HTML/HTML5 (examples: Microsoft Edge, Firefox, Safari, or Chrome).

Thing/Device Components
ThingWorx WebSocket-based Edge MicroServer
The ThingWorx WebSocket-based Edge MicroServer (or WS EMS) works with edge
devices or data stores that need to connect to the ThingWorx server over the
internet. It enables devices and data stores that are behind firewalls to securely
communicate with the ThingWorx server and be full participants in the solution
landscape. ThingWorx WS EMS is not a simple connector but allows intelligence
and pre-processing of data to be moved to the edge.

ThingWorx Edge SDKs

ThingWorx Edge SDKs are collections of classes, objects, functions, methods, and
variables that provide a framework for creating applications that can send data
securely from edge devices to the ThingWorx platform. ThingWorx Edge SDKs
provide tools for developers experienced in C, .NET, and Java programming
languages.
ThingWorx WS EMS and ThingWorx Edge SDKs support connections through
proxies. The process of managing the proxy configuration and associated
change management varies by customer and/or project. ThingWorx Edge SDKs
provide ultimate flexibility because the SDK libraries can be included or
referenced by any custom edge component—and therefore can be updated
based on the design of the solution.

7
Platform Components
ThingWorx Connection Server
The ThingWorx Connection Server is a server application that facilitates the
connection of remote devices and handles all message routing to and from the
devices. The ThingWorx Connection Server provides scalable connectivity over
WebSockets using the ThingWorx AlwaysOn communication protocol.

PTC recommends using connection servers when there are more than 25,000
assets to offload managing connections from the ThingWorx Foundation server.

PTC also recommends at least one connection server for every 100,000
simultaneous connections to the ThingWorx Foundation server. This ratio of
devices-to-connection server may change depending on many factors, such as
the following:
• The number of devices
• The frequency of write submissions from the devices

Tomcat
Apache Tomcat is an open-source servlet container developed by the Apache
Software Foundation (ASF). Tomcat implements the Java Servlet and Java Server
Pages (JSP) specifications from Oracle Corporation and provides a pure Java
HTTP Web server environment for Java code to run.

ThingWorx Foundation Server

ThingWorx Foundation provides a complete design, runtime, and intelligence
environment for Machine-to-Machine (M2M) and IoT applications. ThingWorx
Foundation is designed to efficiently build, run, and grow applications that
control and report data from remote assets, such as connected devices,
machines, sensors, and industrial equipment.
ThingWorx Foundation serves as the hub of your ThingWorx environment. It
includes tool sets that help you develop applications to define the behavior of
remote assets (or devices) deployed in your environment and relationships
between the assets.
Once the assets have been modelled, they can register and communicate with
ThingWorx Foundation, allowing you to monitor and manage the physical
devices and collect data from them.

8
PTC System Monitor
The PTC System Monitor is an independent application performance monitoring
system powered by the Production Edition of Dynatrace, providing useful
dashboards and instrumentation that allows monitoring while maintaining critical
performance requirements.
For more information about the PTC System Monitor, refer to the following links:

• PTC System Monitor Installation and Deployment Guide - ThingWorx

• PTC System Monitor Administration and Usage Guide - ThingWorx
• Using PSM Metrics to Monitor Memory Issues
• Using PSM to Monitor Database Performance
• Analyzing PSM PurePaths to Monitor Slow Execution of Services

Database Components
The ThingWorx platform offers a pluggable data store model which allows every
customer to choose the database that best suits their requirements - from small
implementations for demo or training environments to highly available, high
volume databases that support thousands of transactions per second.
Value streams, streams, data tables, blogs, and wikis are defined as data
providers for ThingWorx. Data providers are considered databases that store
runtime data. Runtime data is data that is persisted once the Things are
composed and are used by connected devices to store their data (such as
temperature, humidity, or position). Model providers are used to store metadata
about the Things.
Persistence providers can contain a data provider, a model provider, or both.
ThingWorx data providers have two primary functions:
1. To maintain the ThingWorx model. The following database systems are
supported to act as model providers:
- H2 and PostgreSQL are supported in all versions of ThingWorx 7.x and 8.x.
- SQL Server is supported in ThingWorx 7.4 and higher.
- Azure SQL is supported in ThingWorx 8.4 and higher.
2. To contain content written to the ThingWorx value stream.
- Any supported database can also contain value stream content.

- For high rates of data ingestion, the InfluxDB time-series database is

recommended.

9
H2
H2 is an open-source relational database with a low-disk footprint. It is written in
Java and can be embedded in Java applications or run in the client-server
mode. H2 can fulfill both model and data provider requirements for ThingWorx
and is embedded within the ThingWorx installation.

Note: H2 is not recommended for production ThingWorx systems.

For more information on ThingWorx and H2 deployments, refer to Using H2 as the

Persistence Provider in the ThingWorx Help Center.
PostgreSQL
PostgreSQL is an open source object-relational database management system
(ORDBMS) with an emphasis on extensibility and compliance to standards. As a
database server, its primary function is to store data securely and allow for
retrieval at the request of other software applications. It can handle workloads
ranging from small single-machine applications to large Internet-facing
applications with many concurrent users.
PostgreSQL allows for high availability at the database level. It can be set up with
a master and multiple worker nodes in the same or different availability zones.

PostgreSQL, via its Persistence Provider can supports both model and data
providers. For more information on ThingWorx and PostgreSQL deployments, refer
to Using PostgreSQL as the Persistence Provider in the ThingWorx Help Center.
Microsoft SQL Server
SQL Server is a relational database management system from Microsoft. As a
database server, it is a software product with the primary function of storing and
retrieving data as requested by other software applications, which may run on
the same computer or on another computer across a network (including the
Internet). For more information on ThingWorx and Microsoft SQL Server
deployments, refer to using Microsoft SQL Server as the Persistence Provider in
the ThingWorx Help Center.

10
InfluxDB
InfluxDB is a high-performance data store written specifically for time series data.
It allows for high throughput ingest, compression, and real-time querying of that
same data. InfluxDB is used as a data store for any use case involving large
amounts of time-stamped data, including DevOps monitoring, log data,
application metrics, IoT sensor data, and real-time analytics. It also provides
other capabilities, including Data Retention Policies (RP). InfluxDB Enterprise offers
high availability and highly scalable clustering solution for time series data needs.
For more information on ThingWorx and Microsoft SQL Server deployments, refer
to Using InfluxDB as the Persistence Provider in the ThingWorx Help Center.
Azure SQL
Azure SQL Database is a general-purpose relational database, based on the
latest stable build of the Microsoft SQL Server database engine and provided as
a managed service. With it, you can create a highly available and high-
performance data storage layer for the applications and solutions in Azure.
For more information on ThingWorx and Azure SQL deployments, refer to Using
Azure SQL Database as the Persistence Provider in the ThingWorx Help Center.

SAP HANA
SAP HANA is no longer a supported ThingWorx data provider as of the 8.5
release. Details and migration approaches can be found in these articles:
• https://www.ptc.com/en/support/article/CS292187
• https://www.ptc.com/en/support/article/CS310972
• https://www.ptc.com/en/support/article/CS310232

DataStax Enterprise (DSE)

DataStax Enterprise is no longer being recommended as a ThingWorx data
provider as of the 8.5 release. Details can be found in the following article:
• https://www.ptc.com/en/support/article/CS313939

11
High-Availability Components
High availability is a critical consideration for business continuity. High-availability
components must be applied at both the application and database layers to be
effective. The ThingWorx application layer requires Apache ZooKeeper as an
additional component. The database layer requirements depend on the needs
of the selected data provider(s).

Note: High Availability will have considerations beyond the software stack
to be truly effective. Redundant infrastructure such as power supplies,
hard disks, and network infrastructure (routers, load balancers, firewalls
etc.) should also be evaluated.

ZooKeeper
Apache ZooKeeper is a centralized service for maintaining configuration
information, naming, providing distributed synchronization, and providing group
services. It is a coordination service for distributed application that enables
synchronization across a cluster. Specific to ThingWorx, ZooKeeper is used to
coordinate the shift from the active ThingWorx platform to the passive platform. It
monitors the active server availability and elects a new ThingWorx Foundation
leader during a system failure.

12
Database HA features
• PostgreSQL: ThingWorx supports use of PostgreSQL high availability as the
data solution. High availability offers the option to set up separate servers to
capture reads and writes for data if a failure occurs on the primary server. For
more information, refer to PostgreSQL High Availability in the Help Center.
• SQL Server: Generally, SQL Standard Edition is suitable for production use as it
supports most of the features required. For production settings that require
high-availability features, In-Memory OLTP, or table and index partitioning,
SQL Enterprise Edition is recommended. For more information, refer to
Microsoft SQL Server High Availability in the Help Center.
• InfluxDB Enterprise: Provides a clustered version of the InfluxDB database.
Clustering enables data to be sharded across nodes to support both high
availability and horizontal scale, allowing reads and queries to run through
different servers to increase scalability of the entire system. The number of
data nodes can easily be expanded to support new workloads. For more
information, refer to Using InfluxDB as the Persistence Provider in the Help
Center.

ThingWorx Deployment Architectures

The following sections include diagrams that depict typical ThingWorx
deployments. The architectures range from simple development systems to
global federated production systems. For information about ThingWorx
components, see ThingWorx Foundation Deployment Components above.
Note: To deploy ThingWorx in hybrid and multi-site deployments, refer to
Distributed ThingWorx Deployment near the end of this guide.

Deployment Options
PTC Cloud Services
In a managed-services deployment, the ThingWorx application is deployed,
hosted, and managed on a third-party server - often in a private cloud. An outside
organization is responsible for managing the necessary infrastructure and ensuring
application performance.
For companies concerned with the IT burden and expertise required to manage
ThingWorx, PTC provides a managed-services deployment option. With PTC Cloud
Services, companies purchasing ThingWorx can accelerate deployment, minimize
IT cost and requirements, and ensure ongoing performance. PTC Cloud Services
hosts your ThingWorx solution in a secure environment within commercial cloud
services that has ongoing application management, performance tuning, and
updates. For more information, see www.ptc.com/services/cloud.

13
On-Premises Deployment
Using an on-premises deployment means installing and running the ThingWorx
software on your servers. You are responsible for procuring, installing &
maintaining the infrastructure and software applications as well as their on-going
support in terms of health, availability and performance.
With an on-premises deployment, you can perform the deployment yourself or
engage PTC Professional Services (or a PTC-certified partner) to manage the
deployment on company servers. This option is suitable for companies with a
robust IT organization and a strong desire to maintain in-house control.

References
Refer to the following sections in the ThingWorx Help Center for additional details:
• Installing ThingWorx
• System Requirements
• Using ThingWorx Docker
• Persistence Providers
• Overview of ThingWorx High Availability

ThingWorx Foundation Basic System

The diagram on the left shows a typical

local system for development, training,
proof-of-concept, functional QA testing, or
sandbox purposes. All components are
deployed on a single server.
While this deployment option is acceptable
for simple scenarios, it should not be
considered for most production systems.
This installation does not support high
availability in either application layer or the
database layer.

The provided H2 database does not scale

beyond small systems - the system is at risk
of performance issues when all components compete for the same resources.

List of Components Number of Components

ThingWorx Foundation Server 1 (using H2 embedded database)

14
ThingWorx Foundation Basic Production System

For a basic production system, a separate server recommended to operate the

database on a separate server. This is a good small-to-medium-sized enterprise
system, or a medium-to-large manufacturing system.

List of Components Number of Components

Load Balancer 1
ThingWorx Connection Server 1
ThingWorx Foundation Server 1
PTC System Monitor (PSM) 1
Attached or NAS File Storage 1
Database 1

15
ThingWorx Foundation Large Production System (non-HA)

A large production system incorporates

additional components to support higher
numbers of connected devices and high
data ingestion rates.
In addition to the platform components, a
large production system may include
ThingWorx Connection Servers and an
InfluxDB time-series database.
The InfluxDB system ingests data coming
from the assets, which ThingWorx manages
as logged value stream content.

A relational database is still required to

maintain the ThingWorx model.

InfluxDB can be deployed in either single-

node (Standard) or multi-node (Enterprise)
configurations based on ingestion and high-
availability requirements. Please refer to
the following section of the ThingWorx Help
Center for additional details:

• Using InfluxDB as the Persistence Provider

List of Components Number of Components

1 (distributes device traffic to
Load Balancer
connection servers)
ThingWorx Connection Server 2..n (depends on number of devices)
ThingWorx Foundation Server 1
Relational Database 1
InfluxDB Standard 1

16
 ThingWorx Active-Passive High-Availability System
For a high-availability (HA) deployment, additional components are added to
remove single points of failure in the Application and Data layers.

The following components are required for the ThingWorx platform:

• A high-availability load balancer to direct traffic to the active ThingWorx
platform.
• A lead (active) ThingWorx platform as the primary server - would only be offline
for maintenance windows and unplanned downtime.
• A standby (passive) ThingWorx platform as the secondary server - ready to take
over the ThingWorx-based load when the lead platform is offline.
• ThingWorxStorage is on-disk storage that is equally accessible by lead and
standby platforms.
• Three Apache ZooKeeper nodes. These nodes monitor the active ThingWorx
platform and constantly check and decide whether it is responsive and
functioning as expected. The ZooKeeper nodes form a quorum and decide
when the active ThingWorx platform is offline and then activate the switch to
the standby system. If the active ThingWorx platform goes offline, the
ZooKeeper nodes performs two tasks:

- Activate the standby ThingWorx server to become the active instance.

- Reconfigure the ThingWorx load balancer to direct traffic to the now

active platform.

The following components are required for the PostgreSQL database:

• PostgreSQL server nodes - a minimum of two nodes, ideally three, are used.
All nodes are online and able to perform queries and replication tasks.
• pgpool-II nodes - a minimum of two, ideally three nodes, that perform failover
and recovery tasks in the event of a PostgreSQL server failure. These nodes
maintain connections between client (ThingWorx) and servers (PostgreSQL)
and manage replication of content among PostgreSQL server nodes.
The following components are required for the InfluxDB Enterprise system:
• Meta nodes – A three nodes setup is strongly recommended, so that a
quorum can be reached, and so that the cluster can still operate if one fails.
• Data nodes – Can scale up from one, but a minimum of two is advised.
Generally, a node count that is evenly divisible by your replication factor is
recommended.

17
Application Layer

user traffic

Zoo
Zoo Repository
Zoo

Data Layer

pgpool pgpool

InfluxDB
Data Nodes

InfluxDB
Meta Nodes

18
 List of Components Number of Components
ThingWorx Connection Server 2 (depends on number of devices)
Load Balancer 3:
- One to route device traffic to
connection servers
- One to route to active ThingWorx
Foundation server
- One to route traffic between
InfluxDB Enterprise data nodes
ThingWorx Foundation Server Minimum of 2:
- One active (in green)
- One or more passive (in yellow).
Networked/Enterprise Storage Disk space for ThingWorx storage
repositories shared with all ThingWorx
Foundation servers.
ZooKeeper Minimum of 3. Should be in odd-
numbered allotments.
Database Depends on database:
- PostgreSQL: 3 nodes.
- MS SQL Server (not pictured):
minimum of 2 as part of an MS
failover configuration.

pgpool-II 2 (for PostgreSQL only).

InfluxDB Enterprise 5 (or more):
- 3 Meta nodes
- 2 or more Data Nodes, with total
count evenly divisible by replication
factor

Note: The load balancers and the ThingWorxStorage also should have redundant
instances for this deployment to be completely HA.

For additional details about deploying ThingWorx in a high-availability

environment, see ThingWorx High Availability Administrator’s Guide.

19
Standard Deployment: ThingWorx Foundation on Azure
ThingWorx can be deployed in cloud platforms, such as Microsoft Azure. Many
Azure services are available to help with deploying ThingWorx and managing it
over time.

Azure Components and Services

Regions
Geographic areas where Azure resources are physically located.

Availability Zones
Isolated locations within a region. Each region contains multiple availability zones
to support high availability deployments.

Availability Sets
Separated (but not isolated) resources within an availability zone.

Virtual Network
Used for configuring logical network topology, defining sub networks, configuring
routing tables, and assigning private IP ranges.

VM instances
Virtual machines used within Azure. They host key software components of the
ThingWorx platform, such as ThingWorx Connection Server (if needed), ThingWorx
platform (main application), and ZooKeeper.

Application Gateways
Distribute incoming application traffic across multiple VM instances. It enables
you to achieve fault tolerance in your applications, providing the required
amount of load balancing capacity needed to route application traffic.

Azure Databases
The PaaS database offerings within Azure. It offers single instances as well as
highly available and fault-tolerant deployments. Azure SQL Database is the
recommended option for ThingWorx.

Azure Files
Provides file storage systems that can be shared and accessed by multiple virtual
machines.

20
Reference Architectures
Production Deployment

Microsoft
Azure

List of Number of
Components Components
Azure Region 1
Azure Virtual Network 1
Azure Application Availability
1
Gateway
ThingWorx
1
Connection Server
ThingWorx
1
Foundation Server
PTC System Monitor 1
Azure File Storage 1
PSM
Azure SQL Database 1

Azure SQL

21
Large Production Deployment (non-HA)

Azure

Availability List of Number of

zone Components Components
Azure Region 1
Azure Virtual 1
Network
Azure Availability 1
Zones
Application 1
Gateway
ThingWorx 2
Connection Server
ThingWorx 1
InfluxDB Standard
Foundation Server
Azure SQL 1
InfluxDB Standard 1

Azure SQL

22
Active-Passive High-Availability Deployment

Microsoft
Azure

Virtual Device / User

Network App Gateway

Availability Availability
zone zone
user traffic

Active-Passive
ThingWorx
App Gateway

ThingWorx
Repository
log/archive Availability log/archive
zone

ZooKeeper ZooKeeper ZooKeeper

InfluxDB Meta InfluxDB Meta InfluxDB Meta

InfluxDB Data InfluxDB Data

InfluxDB
App Gateway

Azure SQL

23
 List of Components Number of Components
Azure Region 1
Azure Virtual Network 1
Azure Availability Zones 3
Azure Application Gateway 3:
- One to route device traffic to
connection servers
- One to route to active ThingWorx
Foundation server
- One to route traffic between
InfluxDB Enterprise data nodes
ThingWorx Connection Server 2
ThingWorx Foundation Server Minimum of 2:
- One active (in green)
- One or more passive (in yellow).
Azure Files 3:
- One for each Foundation server
to store and archive logs.
- One to share ThingWorx Storage
repositories to all Foundation
servers.
ZooKeeper Minimum of 3. Should be in odd-
numbered allotments spread across
3 availability zones.
InfluxDB Enterprise 5 (or more):
- 3 Meta nodes
- 2 or more Data Nodes, with total
count evenly divisible by
replication factor
Azure SQL Database 1

ThingWorx Azure IoT Connector Deployment

The ThingWorx Azure IoT Hub Connector consists of a connection server, the
Azure IoT Hub Adapter, and an Azure IoT Hub Adapter Extension. This package
enables remote devices that are running an application developed using a
Microsoft Azure SDK to connect to the ThingWorx platform. The Azure IoT Hub
Connector handles message routing for the devices that communicate through
the Azure system. It also handles message routing from ThingWorx to devices.

24
Components
Azure IoT Components
• Azure IoT Hub - A fully managed service that enables reliable and secure
bidirectional communications between millions of IoT devices and a back-
end solution, such as ThingWorx.

ThingWorx Azure IoT Hub Connector

The ThingWorx Azure IoT Hub Connector integrates devices that use a Microsoft
Azure IoT SDK with ThingWorx Foundation. An installation of the ThingWorx Azure
IoT Hub Connector consists of the following components:
• The ThingWorx Connection Server with its Azure IoT Hub Adapter, which
handles translation of messages and communication with an Azure IoT
Hub and ThingWorx Foundation.
• An Azure IoT Hub Adapter Extension to support entities in ThingWorx.
• The ThingWorx Connection Services Extension, which provides the
Connection Services Hub.
Once you have installed, configured, and started the Azure IoT Hub Connector,
you can add Azure IoT entities using ThingWorx Composer to represent your
devices. Alternatively, you can import device data into ThingWorx from IoT Hub.
Once you configure devices to connect with the Azure IoT Hub, the Azure IoT
Hub Connector detects the data and pushes it to the ThingWorx Foundation. By
pushing data to ThingWorx, you can take advantage of its features for
developing applications quickly and easily.
Deployment Considerations
An Azure IoT Hub and Azure Blob Storage account and a Blob Storage Container
should be established before configuring the ThingWorx Azure IoT Connector.
Production deployments should have a minimum of two ThingWorx Azure IoT Hub
Connectors to support high availability. More Connectors may be required,
depending on the device load and partition count within your Azure IoT hub
account.
References
• Connect your device to your IoT hub using Java
• ThingWorx Azure IoT Hub Connector Installation and Operations Guide
• ThingWorx Connection Services Help Center

25
Reference Architecture
The following diagram shows a high-availability deployment of ThingWorx
Foundation that utilizes ThingWorx Azure IoT Connectors to access an Azure IoT
Hub. This deployment has the following features:

Microsoft
Azure Devices are sending
content to Azure IoT Hub.
The ThingWorx Azure IoT
Hub Connectors
Virtual Network
communicate with the
Availability zone Availability zone
Azure IoT Hub to read
user traffic
messages from the
devices and store the
Azure IoT Hub Azure IoT Hub message content in
Connector Connector
ThingWorx.
The ThingWorx Azure IoT
Connectors submit
Azure IoT Azure IoT content to the active
Extension Extension
ThingWorx server through
the Azure Application
Gateway.
User interactions access
ThingWorx
Repository
log/archive
Availability
log/archive
ThingWorx through the
zone
Azure Application
Gateway.

ZooKeeper ZooKeeper ZooKeeper - The ThingWorx

Azure IoT Connectors are
established in different
Availability Zones as part
Azure SQL
of a high-availability
deployment.

26
List of Components Number of Components
Azure Region 1
Azure IoT Hub 1
Azure Virtual Network 1
ThingWorx Azure IoT Connectors Minimum of 2
Azure Application Gateway 1
Routes user traffic and ThingWorx
IoT Connector traffic to the active
ThingWorx Foundation server.
ThingWorx Foundation Server (with Minimum of 2: one active and one
Azure IoT Extension) standby. There may be additional
ThingWorx Foundation servers on
standby.
File Storage For each ThingWorx Foundation
server, to store and archive log
files.
Azure Files 3
One for each Foundation server to
store and archive logs. One to
share ThingWorx Storage
repositories to all Foundation
servers.
ZooKeeper Minimum of 3, spread among 3
Availability Zones
Azure SQL Database 1

27
Other Deployments: ThingWorx Foundation on AWS
ThingWorx can be deployed in cloud platforms, such as Amazon Web Services
(AWS). Many AWS services are available to help with deploying ThingWorx and
managing it over time.

Regions
Geographic areas where AWS resources are physically located.

Availability Zones (AZ)

Isolated locations within a region. Each region contains multiple availability zones
to support high availability deployments.

Virtual Private Cloud (VPC)

Used for configuring logical network topology, defining sub networks, configuring
routing tables, and assigning private IP ranges. Additionally, VPC allows for
defining hardware VPNs between AWS VPC and on-premise IT infrastructure.

EC2 Computing instances

Virtual machines used to host key software components of the ThingWorx
platform: ThingWorx Connection Server (if needed) and ThingWorx platform
(main application).

Application Load Balancing (ALB)

Automatically distributes incoming application traffic across multiple Amazon
EC2 instances. It enables you to achieve fault tolerance in your applications,
providing the required amount of load balancing capacity needed to route
application traffic.

Elastic File System (EFS)

Provides file storage systems that can be shared and accessed by multiple EC2
instances.

28
Reference Architectures
Production Deployment

List of Number of
Components Components
AWS region 1
AWS VPC 1
AWS Application 1 (if using a
Load Balancer Connection Server)
ThingWorx
1 (optional)
Connection Server
ThingWorx
1
Foundation Server
PSM 1
1 (to maintain
AWS EFS
ThingWorx logs)
PostgreSQL 1

29
Large Production Deployment (non-HA)

List of Number of
Components Components
AWS Region 1
AWS VPC 1
AWS Availability 1
Zones
Application Load 1
Balancer
ThingWorx 2
Connection Server
ThingWorx 1
Foundation Server
PostgreSQL 1

InfluxDB Standard 1

30
Active-Passive High-Availability Deployment

31
 List of Components Number of Components
AWS Region 1
AWS VPC 1
AWS Availability Zones 3
Application Load Balancer (ALB) 2
When Connection Servers are part
of the deployment, one ALB is
needed to distribute device loads
to Connection Servers and direct
user traffic to ThingWorx
Foundation Server. The second ALB
is required to direct Connection
Server traffic to the active
ThingWorx Foundation Server.
ThingWorx Connection Servers 2
ThingWorx Foundation Server Minimum of 2: one active (in
green), one passive (in yellow).
There can be additional passive
Foundation servers.
AWS EFS Disk space to contain ThingWorx
Storage repositories, accessed by
all ThingWorx Foundation servers.
ZooKeeper Minimum of 3. Should be in odd-
numbered allotments spread
across 3 availability zones.
PG pool II 2

PostgreSQL 3

ThingWorx AWS IoT Connector (End of Life)

The ThingWorx AWS IoT Connector has been moved to End of Life (EOL) with the
8.5.0 release of ThingWorx, as documented in the ThingWorx Connection Services
Help Center.

Please consult prior versions of this document if working with older ThingWorx
releases.

32
ThingWorx Authentication Deployment
In this section, we review authentication solutions available to ThingWorx
implementations.

The solutions include out-of-the-box authentication, authentication through

corporate LDAP (Lightweight Directory Access Protocol) or Active Directory, and
authentication through an SSO (Single Sign-On) configuration.

Components
Directory Service
Maintains a company's list of users and their authentication and authorization
credentials. Microsoft's Active Directory, OpenLDAP, and Apache Directory
Server are common implementations of directory services.

Central Authentication Server (CAS)

A third-party tool that manages the authentication of users across a federation
to allow users to access data from multiple applications by signing in only once.
PTC supports a configuration of PingFederate in this role.
PingFederate is a third-party product provided by PTC as part of its SSO solution.
PingFederate acts as an authorization server that facilitates the exchange of
SAML assertions and OAuth access tokens.

Identity Provider (IdP)

A third-party tool that manages user identity data and supplies user information.
An IdP can be a user-management system or an active directory that stores user
names, passwords, and other credentials. The CAS references the IdP when
authenticating a user.

Service Provider
The application through which the protected information is requested. Typically
this would be the Thingworx server.

Resource Provider
The application where the protected information is maintained. This could be
Thingworx itself or another application like Windchill.

33
References
PTC Documents
• PTC Single Sign-On Architecture and Configuration Overview

ThingWorx Help Center Links

• Authenticators — Authentication mechanisms within ThingWorx
• Directory Services Authentication — Configure ThingWorx to authenticate
through a directory service
• Single Sign-On Authentication — Configure ThingWorx to use SAML
authentication and OAuth delegated authorization.

Basic Authentication Architecture

Basic Authentication for ThingWorx uses the
standard HTTP Basic Authentication methodology
implemented by the Tomcat Servlet Container.
From a deployment perspective, there are no
additional requirements for hardware or software
components. However, this is the least secure
form of authentication supported.
List of Number of
Components Components
ThingWorx 1
Foundation Server
Database 1

34
Architecture for Authentication Through LDAP
Another common authentication
deployment is to use a company's
corporate LDAP server as the
authentication source.
In this case, ThingWorx is configured to
connect to the LDAP server for
authorization and authentication
tasks.

List of Number of
Components Components
ThingWorx
1
Foundation Server
Database 1
LDAP server 1

Architecture for SSO Authentication using PingFederate

ThingWorx 8.5 provides an

integration with PingFederate,
which can then be configured
to provide a Single Sign-On
authentication scheme across
multiple software systems.

The diagram to the right

describes a PingFederate system
in high availability configuration:

List of Components Number of Components

ThingWorx Foundation Server 1
ThingWorx Database 1
PingFederate server 1
Identity Provider service (IdP) 1
Directory Server (LDAP) 1

35
ThingWorx Analytics Deployment
As a part of the ThingWorx IoT technology platform, ThingWorx Analytics provides
tools for embedding advanced analytics capabilities into smart, connected
solutions. These tools can help analyze and understand the data collected from
connected devices. They can analyze what is happening right now and why,
what might happen next, and what can be done to change the outcomes.

Components
ThingWorx Analytics Server
The ThingWorx Analytics Server is an application that provides the analytic
capabilities to understand the collected data and offer predictions.

ThingWorx Analytics Extension

The ThingWorx Analytics Extension contains a zipped archive of software,
extension, and documentation files. This ZIP file must be downloaded and
extracted before the extension can be imported into ThingWorx Foundation.

Deployment Considerations
ThingWorx Analytics 8.0 is offered as a standalone server through a set of Docker
images that contain all necessary ThingWorx Analytics Server libraries and
settings. This offering provides a simple installation process, low maintenance
requirements, and is easy to scale by adding CPU and memory as needed.
However, this configuration cannot be scaled by adding additional servers.
ThingWorx Analytics 8.0 can also be deployed in a distributed environment. This
deployment model (with a minimum of six servers) provides greater capacity but
is more complex to configure and maintain.
For either deployment choice, a separate PostgreSQL database should be used
to avoid performance lags for both ThingWorx Foundation and ThingWorx
Analytics.

Hard drive space for Analytics data should be maintained on external volumes
for ease of backup and recovery as well as ease of upgrading to a new version
of ThingWorx Analytics.
Once the ThingWorx Analytics server is established, the ThingWorx Analytics
Extension should be deployed onto the ThingWorx Foundation server to
complete the configuration.

36
References
• ThingWorx Analytics Deployment Mode Decision
• ThingWorx Analytics Docker Installation Guide
• ThingWorx Analytics Extension Installation Guide

Reference Architecture
The following diagram depicts a basic ThingWorx Analytics production
deployment:

You can use any ThingWorx Foundation reference architecture in this guide for
ThingWorx Analytics Server deployment.

List of Components Number of Components

ThingWorx Foundation Server 1 (with Analytics Extension)
ThingWorx Foundation Database 1
ThingWorx Analytics Server 1
ThingWorx Analytics Database 1

37
Vuforia Studio Deployment
The deployments discussed here are focused on the server-side aspects of
Vuforia Experience Service, the components that store and distribute Vuforia
Studio experiences.

Components
Vuforia View
Delivers experiences rich with 2D and 3D graphics, augmented reality (AR), and
real-time product data. Experiences augment the view of your immediate
surroundings with context-sensitive information and graphics, enabling you to
interact directly with the things around you.

Vuforia Studio
A web-native, easy-to-use tool for authoring domain and tasks-specific
experiences that provide an integrated view of digital and physical product
data, dashboards, and alerts with 2D, 3D, and augmented reality. When
creating experiences in Vuforia Studio, you can choose from various tracking
methods:

• Spatial tracking
• Model targets
• Image tracking
• ThingMarks

Vuforia Experience Service

An enterprise-class, secure, and scalable server that publishes, updates, and
deletes experience content generated through Vuforia Studio. It also identifies
and delivers Experience content requested through Vuforia View.

Vuforia Global Experience Index (GXI)

Allows for multiple Vuforia Experience Services to be queried by the Vuforia View
application. The GXI creates and maintains an index of all Experiences that are
maintained within the associated Vuforia Experience Service.
When the GXI receives a ThingMark query, it identifies the Vuforia Experience
Service that hosts the desired Experience and redirects the query to that specific
Vuforia Experience Service. By default, Vuforia View uses the GXI, but it can also
be manually configured to reference a different Vuforia Experience Service.

38
Deployment Considerations
• ThingWorx Foundation must be installed and established before installing the
Vuforia Experience Service.
• For production systems, it is recommended to run ThingWorx Foundation and
Vuforia Experience Services on separate servers.
• For production systems, it is recommended to use PostgreSQL as the
database associated to the Vuforia Experience Service.
• To avoid performance lag, it is recommended to have separate PostgreSQL
servers for ThingWorx Foundation and Vuforia Experience Service.

References
• Getting Started with Vuforia Studio
• Installing and Deploying Vuforia Studio Experience Service

39
Reference Architectures
The following diagrams focus on Vuforia Experience Service, and only depict a
simplified reference to ThingWorx Foundation. However, any ThingWorx
Foundation architecture shown in this guide may be used instead.

Production Deployment
The following diagram depicts a production deployment of the Vuforia
Experience Service. It includes the following features:
• One Vuforia Experience Service
• Hard disk space to store Experiences
• PostgreSQL database to maintain Experience metadata
• Access to ThingWorx Foundation Server to manage authentication and
authorization

List of Number of
Components Components
Vuforia Studio
1
Experience Service
ThingWorx
1
Foundation Server
Enterprise NFS
1
Repository
Vuforia Experience
1
Service Database

40
Cloud Deployment
Vuforia Experience Service can be deployed in cloud services such as Azure and
AWS.

Azure Deployment

List of Components Number of Components

Azure Region 1
Azure Virtual Network 1
Vuforia Experience Service 1 Virtual Machine
Azure Files 1 storage repository attached to
the Vuforia Experience Service
virtual machine
ThingWorx Foundation Server 1 Virtual Machine
PostgreSQL 1

41
AWS Deployment

List of Components Number of Components

AWS Region 1
AWS VPC 1
Vuforia Experience Service 1 EC2 instance
AWS EFS 1 storage repository attached to
the Vuforia Experience Service EC2
ThingWorx Foundation Server 1
PostgreSQL 1

42
ThingWorx Navigate Deployment
The ThingWorx Navigate product family combines a ThingWorx Platform server
with one or more resource providers to provide simplified, role-based
applications. Within this product family, the ThingWorx Navigate View PLM App
Extension offers several applications for viewing PLM (Product Lifecycle
Management) data from Windchill. The applications are simpler to use than
Windchill alone and are expected to be adopted by a larger number of users
with less training required.

Components
ThingWorx Navigate View PLM App Extension
The ThingWorx Navigate View PLM App Extension uses a resource provider
(Windchill) for PLM information and an optional external identity provider (IdP) for
authentication. The identity provider can also be Windchill to consolidate user
maintenance.

Windchill Product Family

• Windchill: PTC's Product Lifecycle Management application.
• Windchill Directory Server: A directory server that is a required piece of the
Windchill deployment.
• Creo CAD Worker: An optional service for Windchill, which produces Creo
View content from recently added CAD content. The ability to utilize
viewables is included in most of the Navigate View PLM App mashups.

Deployment Considerations
The ThingWorx Navigate View PLM App Extension uses the ThingWorx platform as
a server. It can be deployed in the following ways:
• Monolithic deployment — Combines the Windchill application, the ThingWorx
platform, and the Navigate extension on one host. Databases for the
applications may still be on separate hosts. This deployment is recommended
for non-production environments.
• Distributed deployment — Uses separate hosts for the ThingWorx platform
(ThingWorx Navigate server) and the Windchill application, allowing
horizontal scaling of Windchill. Communication between the applications
uses either a certificate-based SSL connection or a trusted non-SSL
connection (non-production). This is the recommended deployment for
production systems.

43
References
• ThingWorx Navigate Platform Sizing Guide
• Windchill Architecture Overview
Reference Architectures
ThingWorx Navigate Production Deployment
The following diagram depicts a straightforward deployment of ThingWorx
Navigate, which includes the following features:
• The user accesses Windchill content through ThingWorx Navigate. In this
design, Windchill is not accessible outside the firewall.
• Windchill has access to additional tools it may need — Windchill Directory
Server (required) and a Creo View CAD worker (optional).

List of Components Number of Components

ThingWorx Foundation Server (with 1
Navigate Extension)
ThingWorx PostgreSQL Database 1
Windchill CAD Worker 1
Windchill Database 1
Windchill Directory Server 1 (installed on Windchill Server)
Windchill Server 1

44
ThingWorx Navigate High-Availability Deployment
The following diagram depicts a high-availability deployment for four combined
products: Windchill, ThingWorx Navigate, PostgreSQL (for the ThingWorx Navigate
solution), and PingFederate. It includes the following features:
• Load balancers to direct traffic to either the Windchill cluster, the ThingWorx
Navigate cluster, or the PingFederate cluster
• Multiple Windchill nodes for a Windchill cluster configuration
• Multiple CAD worker nodes
• Two ThingWorx Navigate servers—one as the primary server and the other in
standby
• Three ZooKeeper nodes to monitor the ThingWorx Navigate servers and select
a new active server as needed
• Two pgpool II nodes to manage the failover between PostgreSQL servers
• Three PostgreSQL servers — one actively writing new content, one serving
read requests, and one on standby. All three remain in sync.
• Two PingFederate runtime nodes to receive and respond to SSO requests
• PingFederate manages Windchill and ThingWorx Navigate's access to
Identity Providers

45
 List of Components Number of Components
Load Balancer 3 (1 for Windchill, 1 for ThingWorx
Navigate, 1 for PingFederate)
ThingWorx Foundation Server 2 (1 active, 1 passive)
Enterprise NFS Repository 1 (for ThingWorx Storage
repositories)
ZooKeeper Nodes Minimum of 3
pgpool II 2 nodes
ThingWorx PostgreSQL Database 3 nodes
Windchill Server Minimum of 2
Windchill Database 2 (HA for database not accurately
depicted)
Windchill CAD Worker 2
PingFederate Runtime 2
PingFederate Console 1
PingFederate Database 2 (HA for database not accurately
depicted)
IdP 1 + n (HA not depicted, depends
on IdP product and customer
deployment)
LDAP 1 + n (HA not depicted, depends
on LDAP product and customer
deployment)

46
Distributed ThingWorx Deployment
ThingWorx supports hub-and-spoke style federated deployments where the
components of an enterprise application can run where it is the most
appropriate for performance and autonomy. This design feature makes it easy to
provide a distributed and tiered data storage and analysis capability.
For example, a central ThingWorx server (Hub) can connect to each of the
plant-level ThingWorx servers (Spokes) to pull information together and
aggregate it for display of regional or corporate-level views. Then, as users drill
down into data, a plant-level server can propagate data to the central server.
There are multiple deployment scenarios supported by ThingWorx, including
cloud (PTC or third party) and on-premises (on-site or in a corporate data
center). If the customer solution is deployed globally, PTC recommends that
servers be geolocated for optimal performance.
Federation is composed of multiple elements:
• ThingWorx request servers — where all incoming requests are routed. A
request may be initiated by a user accessing a Mashup or devices
communicating with the Things. These servers scale based on number of
connections and volume of data requests.
• Thing servers — where the Things are running in memory and communicating
with the request servers. These are memory-intensive servers since the actual
logic is running on them. They can also be scaled horizontally based on
memory and CPU limitations.
• Data servers — where the actual application data is stored. These servers can
also be scaled based on the amount of storage access that is required.
These different capabilities can be rolled up into one server or delegated across
many servers to achieve the desired performance with the existing number of
devices.

47
ThingWorx Federated Example: Connected Factories

List of Components (Per Factory) Number of Components

ThingWorx Foundation Server 1
ThingWorx Database 1
List of Components (Corporate) Number of Components
ThingWorx Analytics Database 1
ThingWorx Analytics Server 1
ThingWorx Foundation Server (with 1
Analytics Extension)
ThingWorx Database 1

48