Issue An Engineering License expired before it was renewed, and Software Companion reported that the license could not be extended. The Extend option was unavailable to project administrators, preventing the project from continuing under the existing Engineering License. The license had never been previously extended. Product Line EcoStruxure Building Operation, Software Companion Environment Software Companion EcoStruxure Building Operation Engineering License Cause Engineering Licenses have a fixed six-month validity period with one single extension permitted. Once an Engineering License has expired, the self-service extension option is no longer available. See Manage Existing Licenses Resolution An expired Engineering License cannot be extended using the self-service Extend option in Software Companion. Contact Schneider Electric Support, providing the Entitlement ID, to request an extension of the expired license. When the extension is applied by Schneider Electric Support, the new expiration date will be six months from the date the extension is processed.

Issue EBO system was in sync with Building Advisor Portal and is now not. Product Line EcoStruxure Building Operation, EcoStruxure Building Advisor Environment Building Operation Building Advisor Portal Building Operation Enterprise Server Building Operation Automation Server Cause System ID changed and no longer matches in Building Advisor Portal. There are several causes for this: A backup restored on different hardware Migrated to a new VM VM was upgraded Windows update on the VM Resolution Check EBO Server Trace Log for nsp.pin.Cloud records and there should be one that shows "SystemId". Here is an example: 2023-11-19 12:37:30.437 [320] nsp.pin.Cloud.DspInterface Sending notification {"ProtocolVersion": "1.0", "NotificationType": "TimeSeries", "IotDeviceId": "urn:dev:ops:sebms-sbo-es-fb6b2834ba4749d89cdad333c12704a3", "SystemId": "4ba3db45-0235-7146-981a-c81dc08e39bf", "GeneratedAt": "2023-11-19T12:37:30.0437Z", "GeneratedBy": "SBO 3.2.4.22","Operation": "Update","TimeSeries": [{"TimeSeriesId": "d8e6b6fc-a472-4285-a56d-2d3e4a6915e1","Samples": [{"Timestamp": "2023-11-19T12:37:30.0437Z","Value": "Unknown [null]","Unit": "0x10001","Status": 20}]}]} 2023-11-19 12:37:30.437 [320] nsp.pin.Cloud.DspInterfaceReal edgeAgent_sendMessage: {"ProtocolVersion": "1.0", "NotificationType": "TimeSeries", "IotDeviceId": "urn:dev:ops:sebms-sbo-es-fb6b2834ba4749d89cdad333c12704a3", "SystemId": "4ba3db45-0235-7146-981a-c81dc08e39bf", "GeneratedAt": "2023-11-19T12:37:30.0437Z", "GeneratedBy": "SBO 3.2.4.22","Operation": "Update","TimeSeries": [{"TimeSeriesId": "d8e6b6fc-a472-4285-a56d-2d3e4a6915e1","Samples": [{"Timestamp": "2023-11-19T12:37:30.0437Z","Value": "Unknown [null]","Unit": "0x10001","Status": 20}]}]} (retCode = 0) In Building Advisor Portal, check the BMS System Identifier to ensure it is the same and update as needed. In this case, d057cfba-9fc0-11e4-a62a-3417ebbed129 needed to be updated to 4ba3db45-0235-7146-981a-c81dc08e39bf

Issue Understanding how to check the firmware version of the USB-485-I/NET adapter and upgrade it to the latest version. Product Line TAC I/NET, EcoStruxure Building Operation Environment Building Operation I/NET USB-485 I/F Building Operation Automation Server Building Operation Automation Server Premium Cause If the firmware version of an I/Net USB interface is at an older firmware version then it may need to be updated. Please check the Exchange website for the latest firmware version Note: If the USB adapter is not at least at firmware version 1.02 then the system may experience communication issues in which I/Net values are not updating in EcoStruxure Building Operation or Automation Servers may be dropping offline.  In some cases, the Enterprise Server can lock up due to the older firmware in the I/Net USB adapter. Resolution To download the latest "USB-485-Inet Firmware Update Utility" click here. To Verify the Current Adapter Firmware Version in EBO 2.0 and Higher Right click the I/Net Interface is the System Tree of WorkStation and choose Properties. Down towards the bottom of the Basic tab you will find the Firmware Version.   To Verify the Current Adapter Firmware Version in SBO 1.9 and Lower Connect the USB Interface to a laptop with the USB cable that is attached to the AS-P. Do not hold the pushbutton in on the USB Interface. Run the firmware executable. Press Enter. It will display: "Found USB Device on COMX" and will display the hardware version, software version, and the firmware date. It will then say, "Press Enter to begin the upgrade.  Note: Pressing Enter here will only repeat the hardware and firmware versions. The process to Upgrade the Adapter Firmware Note: If the I/Net USB adapter is already plugged into the laptop from checking the firmware version as described above, then to start the upgrade process USB cable will need to be unplugged from the laptop. Then follow the steps below. While holding down the pushbutton of the I/Net USB adapter, unplug the adapter's USB cable from the AS/AS-P and plug it into your laptop. After it is plugged into the laptop, release the pushbutton.  You will see that the LEDs on the interface are not flashing. On the laptop, run the firmware executable. After the command window opens, press Enter to start the update process. It should display "Unprogrammed device located" followed by "Device programmed successfully". Next, it will say "Found USB Device on COMX" and show the hardware version, firmware version, and the firmware date. Press Esc to close the command window.  The firmware upgrade is now complete. Note: Some laptops will not recognize the USB Interface and will not assign it a Com port.  If this is the case you will still be able to upgrade the firmware.  But instead of giving the Com port the and the firmware version after the upgrade is complete, it will show "Unable to find USB Device".   Also, you would not be able to check the firmware version prior to upgrading as mentioned above.  To correct this you must install the 7801 Tap.inf driver.  Click here to download the 7801 Tap.inf drivers. To install the 7801 Tap.inf drivers: Connect the USB Interface to a laptop with the USB cable that is attached to the AS-P. Go into Device Manager and find the I/Net USB Interface.  It will have an error because of no driver. Right-click on it and choose to Update Driver Software... Select Browse my computer for driver software and browse to the 7801 Tap.inf file. Then follow the instructions above.

Issue A customer wants to deploy an Edge Server on ARM64-based hardware that supports Docker containers and is requesting an ARM64 container image. The available Edge Server container images appear to support AMD64 (x86-64) architecture only. Product Line EcoStruxure Building Operation Environment Building Operation Edge Server ARM64-based hardware Cause Edge Server supports AMD64 (x86-64) CPU architecture only. ARM64 container images are not available. Resolution Edge Server container images are currently available only for AMD64 (x86-64) CPU architecture. ARM64 container images are not supported or available for download. Customers wishing to deploy Edge Server should use supported AMD64 (x86-64) hardware platforms. If ARM64 support is required, submit an enhancement request through the appropriate Schneider Electric channel or engage the local sales representative for further guidance.   Note: Running AMD64 images through emulation on ARM64 hardware may impact performance and is not supported.

How to Obtain a Software Bill of Materials (SBOM) for EcoStruxure Building Operation Issue How can a Software Bill of Materials (SBOM) be obtained for an EcoStruxure Building Operation (EBO) release? Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Building Operation Enterprise Central Building Operation WorkStation Cause A Software Bill of Materials (SBOM) is a comprehensive inventory of software components used within a software product. It provides information such as component names, versions, libraries, modules, frameworks, and other software elements included in the final product. SBOMs provide transparency into the software supply chain and support: Security by helping identify and address software vulnerabilities. Compliance by assisting with software licensing and open-source usage requirements. Supply Chain Management by providing visibility into software dependencies and component origins. Support and Maintenance by identifying the software components and versions included in a release. An SBOM may include: Component inventory Licensing information Component version information Resolution Schneider Electric maintains and distributes SBOMs through a secure SBOM platform. Because software libraries and components can change between product releases, SBOMs are version-specific and may need to be generated upon request. To obtain an SBOM for a specific EcoStruxure Building Operation release: Contact your local Product Management or Account Management team and specify the exact EBO version required. Customer onboarding begins after verification of the requestor's identity and receipt of a Non-Disclosure Agreement (NDA). Access is provided through the Schneider Electric SBOM portal: https://sbom.se.comhttps://sbom.se.com After the initial sign-in, the SBOM Operations team assigns the required permissions before SBOMs can be viewed or downloaded. Additional Information If the requested SBOM is for a previous product version, generation may take up to four weeks after the request is submitted. Available download formats may include CycloneDX, SPDX, and PDF. For assistance with SBOM access or interpretation, contact sbom@se.com. Keywords SBOM, Software Bill of Materials, EcoStruxure Building Operation, EBO, software components, software supply chain, software compliance, software security, third-party components, open-source components, vulnerability management, CycloneDX, SPDX, Schneider Electric SBOM Portal

Issue Additional Certificate Authority (CA) certificates are required for certificate validation within an EBO container. Product Line EcoStruxure Building Operation Environment EcoStruxure Building Operation (EBO) Container Servers Enterprise Central for Linux Enterprise Server for Linux Edge Server Cause EBO containers ship with a default CA bundle that contains Mozilla root certificates. Additional CA certificates are not automatically included in the container and must be added to a custom CA bundle when required for the deployment. Resolution The supported method is to create a single PEM-formatted CA bundle that contains: The default Mozilla root certificates Any additional CA certificates required for the deployment The default CA bundle is located at: /opt/sbo/etc/ca-bundle.crt New Container Deployment Create a combined CA bundle containing the default Mozilla root certificates and the required additional CA certificates. Start the container using the --ca-bundle parameter. Existing Container Deployment Copy the default CA bundle from the container. Append the required CA certificate(s) to the bundle. Use the updated CA bundle as required by the deployment. Before deployment, verify that the updated CA bundle contains: The original Mozilla root certificates All additional CA certificates required for certificate validation Additional Reference: GitHub - SchneiderElectricBuildings/EBO-Servers: The official EcoStruxure™ Building Operation Servers page. · GitHub

Issue BACnet/IP controllers are not configured in RSTP Mode by default, therefore must be configured during installation. Having RSTP Mode disabled by default allows one to connect BACnet/IP controllers to any switch, even with port security configured to detect BPDU packets and disable the port. Product Line EcoStruxure Building Operation, TAC IA Series Environment Multi-purpose Controller (MP-C) Multi-purpose VAV (MP-V) Room Controller IP-IO I/A Series N4 Jace8000 SmartX IP Driver for Niagara Cause RSTP protocol requires that controllers, switches, and network architecture are configured to ensure the protocol will operate as expected.  Resolution Setting RSTP Mode for BACnet/IP Controllers ALL devices in the RSTP loop MUST BE IN RSTP MODE to function properly. This is not a huge issue because during startup you can unplug 2nd side of the loop and it will function properly in a daisy chain. Ensure the SmartX Controllers are configured correctly Configuring BACnet/IP Controller Device Settings A factory or network reset returns the RSTP setting to Disabled. Important: Whenever you change RSTP settings, the controller MUST be WARM START. If you fail to perform this restart, the BACnet/IP controller will continue communicating using its previous RSTP settings. 'Activate IP Changes' does not affect RSTP mode. Ensure the switch is configured correctly per Configuring RSTP on a Managed Switch for SmartX IP Controllers. If asked to review this for a case, please provide PSS screenshots from the switch configuration page(s).  Bridge Priority = 4096 Hello Time = 2 sec Max Age = 40  (40 is the maximum value allowed by the protocol. Default is 20) Forward Delay = 21 sec Bridge Priority Considerations Change Bridge Priority by adding 4096 as switches get further away from AS. (8192, 12288, 16384, 20480, 24576, 28672) DO NOT set the priority as 32768 or higher because that is the built-in Bridge Priority of BACnet/IP Controllers. First, configure the Root Bridge Switch (closest to the Automation Server) settings. Then, configure the additional Switches in order of increasing Bridge Priority. {OPTIONAL}: Troubleshooting RSTP with Wireshark Plug in 2nd side of the RSTP Loop If all devices stay online, then it is working properly. Now test line breaks or controllers that are powered off. If all devices go offline and/or the switch LED is flashing rapidly, then go to RSTP Troubleshooting. Managed Switch Troubleshooting Consult the documentation or contact the vendor or manufacturer to assist with configuration for the items below. Ensure the switch is IEEE 802.1D - 2004 capable. BACnet/IP Controller Networking Term Definitions RSTP Ring mentions the Rapid Spanning Tree Protocol is specified in IEEE 802.1D - 2004. Ensure the firmware is up-to-date by contacting the vendor or manufacturer or downloading it from its website. Ensure ports not participating in RSTP are configured as Edge Port, Admin port, or have STP disabled. Nomenclature for those settings on your specific managed switch may vary. Adding BACnet/IP controllers to site-managed switches, work with Local IT to add these devices to their network. They will need to work with their switch vendor/manufacturer/support group to ensure the configuration of those switches because it could be more complex than changing the minimum recommended four settings above. Also, since RSTP Protocol is limited to Max Age = 40 (hops including site switches and BACnet/IP controllers), each loop's size may be limited based on their site switch network configuration and architecture.  Determined the proper configuration (or disable) for the following features. DHCP snooping Dynamic ARP inspection Denial-of-service (DOS) mitigations BPDU Guard BPDU Filter Energy-saving settings. Similar to Wake-on-LAN: the switch had minimal traffic, so ports entered power-saving mode. When they reactivated, the AS-P had already timed out, triggering a comm loss alarm. RSTP Troubleshooting Check each BACnet/IP Controller -> Diagnostics -> Device Report to confirm in RSTP Mode MANUAL CHECKOUT Double-click MP - Diagnostics Files - Device Report It will open in the default text editor Review the Device Settings section near the bottom. In firmware 1.00.0x, the report should report RSTP Mode: Enable In firmware 2.00.0x or higher, RSTP: Enabled and RSTP Status: Operational If it reports disabled, then perform Setting RSTP Mode for BACnet IP Controllers Step 1 until RSTP is working properly. USE SEARCH & EVENTS EBO 2.x MP Device IP and Settings.xml for EBO 2.0 as it only includes MP controllers EBO 3.x SmartX Device IP and Settings.xml for EBO 3.x or higher Import attached search USE RSTP STATUS GRAPHIC IN WEBSTATION Run from web browser via WebStation because utilizes ClientAPI EBO 6.0 and higher: TGML HTML Version SpaceLogic RSTP Status Summary - Schneider Electric Community  EBO 3.1 and higher: TGML Script Version Frontline Fridays Episode 02 - Rapid Spanning Tree Protocol (RSTP) Date: 2022-11-11 Mike Botens posted the following in the thread: RSTP Status TGML dated 2022-11-09 PDF of the presentation Fusion Fridays - Session 07 ​​​​ Date: 2020-05-28 The start of the video shows the graphics page in use RSTP Status.zip is downloaded via the link below the video. Extract the TGML and drop it on the AS to import. The suggestion is to store TGML directly under the AS to help with navigation in Webstation. Bind the network to the BACnet/IP network with the BACnet/IP Controllers. (You may need a second TGML page if BACnet/IP controllers are on Primary and Secondary IP) Run from web browser via WebStation because utilizes ClientAPI KNOWN ISSUES Offline controllers that are scattered are NOT an RSTP issue. Check to see if there is a possible DHCP issue by verifying controllers are still at their AUTO-IP address (IP 169.254.nnn.nnnn Subnet Mask 255.255.0.0). RSTP communications issues affect the entire RSTP loop or one contiguous group of controllers. Factory Reset or controller replacement should leave one ethernet cable unplugged until configured for RSTP per these articles: Replace a BACnet/IP Controller in an RSTP Ring Network Workflow and MP Controller Reset Modes If BACnet/IP Controller Device Report OR RSTP Graphic reports RSTP Status: Changes Pending instead of RSTP Status: Operational, disable RSTP Mode, Warm Start, re-enable RSTP Mode, Warm Start, and check again. SmartX is now SpaceLogic. KNOWN ISSUES with Firmware affecting RSTP: If Firmware 3.02.01 is installed, please upgrade to 3.02.02. RSTP not performing as expected with Static IP addressing RSTP does not work well on RPC HW RPC-16-B HW revision 6

Issue Customers may encounter one or more of the following symptoms: Automation Server (AS) reports a communication alarm for the Enterprise Server (ES). Server-to-server bindings remain unresolved. ES displays an AS as online, while the AS reports communication issues with the ES. Communication issues occur after firewall changes, network segmentation, NAT implementation, cellular router deployment, or system upgrades. Communication problems are observed despite successful ping tests or apparent server connectivity. Product Line EcoStruxure Building Operation Environment EcoStruxure Building Operation Enterprise Server (ES) Automation Server Premium (AS-P) Automation Server Bundled (AS-B) HTTPS server communications TCP server communications Cause A common misconception is that server communications are functioning correctly if the Enterprise Server can communicate with an Automation Server and reports it as online.   In EcoStruxure Building Operation, server-to-server communication is inherently bidirectional. Both servers must be capable of exchanging information as part of the server communication relationship.   When firewall rules, routing policies, NAT configurations, or network infrastructure prevent one server from communicating with the other, communication alarms, unresolved bindings, and other synchronization issues may occur even while the servers appear online.   The exact communication behavior depends on the EBO version and communication protocol being used. Refer to the EBO EcoStruxure BMS Server Communication Webhelp topic for guidance on the recommended protocols for each EBO version. Resolution EBO 5.x and Earlier Prior to EBO 6.0, server communications used traditional CSP, HTTP, or HTTPS transport methods. In these versions: Enterprise Servers initiate communications to Automation Servers. Automation Servers initiate communications to Enterprise Servers. Each server acts as both a client and a server. Both servers must be directly reachable across the network. The following communication models require bidirectional network connectivity: Protocol Default Port Connectivity Requirement TCP TCP 4444 Bidirectional HTTP TCP 80 Bidirectional HTTPS TCP 443 Bidirectional Because both servers actively establish connections, firewall rules and routing policies must allow communication in both directions. EBO 6.0 and Later Beginning with EBO 6.0, server communications over HTTPS were enhanced through the introduction of WebSocket technology. This change was designed to improve communication efficiency and support architectures where direct inbound communication between servers may not be practical, including: Cloud-hosted Enterprise Servers NAT environments Segmented enterprise networks With WebSocket communication enabled through HTTPS: One EBO server establishes a WebSocket connection to the other server. The WebSocket connection remains active as a long-lived TCP session. Both servers exchange information through the established session. Application-level communication remains fully bidirectional.   Although only one TCP session may be visible, communication continues to occur in both directions through the established WebSocket connection. This allows server communications to function in network architectures where traditional bidirectional connection establishment would otherwise be difficult. Important Notes HTTPS (TCP 443) When HTTPS communication is configured, EBO uses a WebSocket-based communication model. Characteristics include: Persistent long-lived connection Bidirectional application communication Reduced connection establishment overhead Improved performance compared to repeatedly creating and closing sessions Better support for NAT and cloud-connected deployments TCP(TCP 4444) Traditional TCP communication on TCP 4444 remains available. Characteristics include: Traditional connection model Requires bidirectional reachability Both servers must be capable of establishing communication with each other Does not use WebSocket transport Organizations upgrading older systems may still have servers communicating over TCP 4444 even after upgrading EBO versions. Multi-version systems In Multi-version systems, it recommended to: use HTTPS for EBO 6.x or later servers and TCP for servers on older versions. set the protocol to HTTPS for child servers after upgrading them to EBO 6.x or later not before the upgrade, refer to Automation Servers Running EBO 3.2.4 Go Offline After Enterprise Server 7.1.2 Upgrade When Using HTTPS  Troubleshooting Guidance When investigating unresolved bindings or ES/AS communication alarms: Identify which protocol is being used between servers. Verify whether communication is configured for TCP 4444 or HTTPS 443. Confirm that firewall policies permit the required traffic. Verify routing paths between all EBO servers. Review NAT rules that may affect server communications. Check for network devices that terminate or time out long-lived connections. Perform Repair Server Communications after resolving network issues. Verify communication alarms clear and bindings return to a resolved state. You can check for possible server to server communication issues in WorkStation by  creating an Alarm view with system alarm IDs filter “Communication failed” and “Server offline”. In WebStation V5 or later, you can use Diagnostics Server Communication List in WebStation Additional Information An Automation Server communication alarm referencing the Enterprise Server is a particularly important diagnostic indicator. This alarm originates from the Automation Server and indicates that the Automation Server is experiencing difficulty communicating with the Enterprise Server. The Enterprise Server may still show the Automation Server as online because communication in one direction continues to function. This asymmetric communication condition is frequently associated with: Firewall restrictions NAT translation issues Incomplete routing Network segmentation Cellular network deployments Improperly configured server communication protocols Network design guidance Understanding the underlying server communication model is often the key to diagnosing unresolved bindings and server communication alarms in complex network environments. For recommendations on EBO network design and best practices refer to the following documents: Information Technology System Planning Guide  Guidance on Implementing a Cybersecure BMS Architecture with EcoStruxure Building Operation

Issue There are a number of ways to disable a User, a card, or access levels, depending on what is needed at the site.  Product Line EcoStruxure Security Expert Environment Security Expert Data Sync  Active Directory Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Cause There are a number of options described in documents and Security Expert's help, but the options are not consolidated in one place for comparison. Resolution Here are the options in no particular order. Some of these options can be affected when using the Data Sync Service and Active directory or they can be set manually in Security Expert.   1. Setting User Start and Expiry Dates Each user can be assigned access for a defined period by checking the Start and/or End options (in the General tab) and setting a date and time. This allows you to issue and send out cards prior to access being enabled, such as for employees who have not started yet. You can also set credentials to automatically expire, for example when a contractor is due to finish on a set date.   2. Disabling Users or using the Delete option     a. The Disable User setting (found under the Options tab) removes access immediately while still retaining the user record and its details. This is ideal for removing access temporarily, such as when staff are away on extended leave, or removing access while still retaining the user information. This gets distributed to the controllers with priority.      b. User Disable or Delete         1. Disable period: When this option is enabled you can set an inactivity period in days, hours or minutes. If there is no user activity during this period (i.e. they do not access any doors or keypads), the user record will be disabled (using the Disable user option in the Options tab).         2. Delete period: When this option is enabled you can set an inactivity period in days, hours or minutes. If there is no user activity during this period (i.e. they do not access any doors or keypads), the user record will be deleted from the database.     User last active: Shows the date and time the user was last granted access to a door or keypad within the system (read only). This field is not updated when the user accesses a door record which represents a COP or DOP in an HLI elevator integration. See related article Users accessing elevator doors are being disabled due to inactivity for more details on this.   3. Card Disable From Security Expert Help Card disabled: This setting allows a credential to be disabled without deleting the details. The credential can be re-enabled by unchecking the box. If a user has multiple credentials, the setting may be enabled or disabled where appropriate for each credential. Inactivity period: When this option is enabled you can set an inactivity period in days, hours or minutes. If the card is not used within this set period it will automatically be disabled. When this option is enabled you can set an inactivity period in days, hours or minutes. If the credential is not used within this period it will automatically be disabled. The maximum inactivity period is 365 days. If you enter a longer period the field will reset to the default period of 30 days.   4. Credentials This section allows you to assign custom credentials to users. When a credential type has been created in Sites | Credential types it will be automatically added, or you can use the Add and Delete buttons to manage the user's available credentials. Credential type: The custom credential type that the credential is associated with (e.g. license plate, custom card format, compliance type, etc.). Disabled: Check this box to disable the credential without deleting it. Credential: The specific credential data for the user (e.g. their license plate). Start: Only applicable to compliance types. When this option is enabled the user will not be able to gain access using this compliance before the date specified. End: Only applicable to compliance types. When this option is enabled the compliance will expire after the time and date specified and the user will not be able to use it to gain access. Inactivity period: When this option is enabled you can set an inactivity period in days, hours or minutes. If the credential is not used within this period it will automatically be disabled. The maximum inactivity period is 365 days. If you enter a longer period the field will reset.   5. Access Level Expires When this option is enabled the access level will expire based on the defined start and end dates.

Issue Raw card data events displayed unexpected facility code and card number values when credentials were presented to OSDP readers. A custom credential format had been configured; however, the card data shown in Security Expert did not match the expected values programmed on the card. Read Raw Data (9999:99999) At Entry Reader On Door 'door name' (DR1) (RD 1 Port 1) Product Line EcoStruxure Security Expert Environment Security Expert OSDP readers Custom credential format Cause Third party OSDP readers require a bit more configuration than native Security Expert readers. The custom credential format was configured on the Reader Expander but was not configured on the Smart Reader. As a result, the Smart Reader continued to interpret the credential using its existing format and transmitted data that did not match the expected credential definition. Resolution Verify that the custom credential format is configured on the Smart Reader. The reader expander will need to be set to OSDP and the associated Smart reader records set with the format settings. See detailed configuration details starting at the Security Expert Programming section in the AN-254 Security Expert - Configuring OSDP Readers - Application Note.   After applying the correct custom credential configuration to the Smart Reader and downloading the updated configuration, present the credential again and review the raw card data events. The facility code and card number should then be interpreted using the intended credential format.

Issue How to get answers for project specification responses or how to get a product enhancement implemented. Product Line EcoStruxure Security Expert, EcoStruxure Building Operation Environment Security Expert EcoStruxure Building Operation Cause Unsure who to go to for help with specification replies or how to get a potential product enhancement added to the offer. Resolution Create an idea on the EBO Idea Exchange community for your specific Offer. The more Likes an idea floated on the Community receives, the more attention it is given by offer management for that associated product line. Even if you do not yourself have an Enhancement Request, help raise the profile of others by Liking theirs Contact your local solution category manager for the Offer as they will be able to point you in the right direction for answers to specification questions and can help escalate enhancement requests to Product Management. Americas: Americas.EcoStruxureBuilding@schneider-electric.com EMEA: EMEA.EcoStruxureBuilding@schneider-electric.com Asia Pacific & India: AsiaPac.EcoStruxureBuilding@schneider-electric.com When providing your feature request make sure to include as much detail as possible about the feature as well as any specifics that might help justify the need for the new feature.

Issue The system was reported as hanging and running slowly for a period of time. Users experienced slow response, including door unlock commands taking around 30 seconds to respond. The condition self-recovered without intervention and the system remained stable afterward. Product Line EcoStruxure Security Expert Environment Security Expert Client Server Microsoft SQL Server Cause Analysis of the SQL Server Application Log, SQL ERRORLOG, and Windows System Log identified multiple storage-related warnings during the reported outage window. The following events were recorded during the period when users experienced system hangs and slow response times: Event SQL Event 833 - Long I/O detected on SecurityExpert transaction log file (SecurityExpert.ldf) SQL Event 833 - Long I/O detected on SecurityExpertEvents database file (SecurityExpertEvents.mdf) SQL Event 833 - Long I/O detected on SecurityExpert database file (SecurityExpert.mdf) SQL Event 833 - Long I/O detected on SecurityExpertEvents transaction log file (SecurityExpertEvents.ldf) SQL Event 833 - Long I/O detected on SecurityExpertEvents database file (SecurityExpertEvents.mdf) ESENT Event 508 - Storage latency warning   These events indicated that database and transaction log I/O requests for the SecurityExpert and SecurityExpertEvents databases were taking up to 30 seconds to complete. The ESENT Event 508 warning further showed that the latency was observable outside SQL Server and also affected the Windows ESENT subsystem. Review of historical SQL ERRORLOG files showed similar long-I/O warnings occurring repeatedly over several weeks. Based on the available log evidence, underlying storage latency was identified as the most probable cause of the application slowdown and system hang behavior. Resolution Review of the SQL Server Application Log, SQL ERRORLOG files, and Windows System Log confirmed that SQL Server remained online throughout the incident and did not experience a service crash, restart, database recovery, or corruption event. Long I/O warnings affecting the SecurityExpert and SecurityExpertEvents databases were identified during the outage window. Historical review of the SQL ERRORLOG showed similar long-I/O warnings occurring repeatedly over several weeks, indicating an ongoing storage performance issue rather than an isolated application fault. The findings were provided for further investigation of the SQL Server infrastructure and storage performance.

Issue Server data may be combined in Building Advisor if a server connected to Building Advisor is cloned or detached without first disabling Cloud Connectivity (Cloud Plugin) and resetting its System ID. This can result in duplicate System IDs and incorrect data associations between servers. Product Line EcoStruxure Building Advisor, EcoStruxure Building Operation Environment EcoStruxure Building Operation Enterprise Server (ES) Enterprise Central (EC) EcoStruxure Building Advisor Cloud Connectivity (Cloud Plugin) Cause Cloud Connectivity (Cloud Plugin) was not disabled, and the System ID was not reset before the server was cloned or detached. As a result, the new server retained the original server's identification, which can lead to duplicate System IDs and combined server data in Building Advisor.   Resolution   Identifier terminology: In EcoStruxure Building Operation, the identifier is displayed as Server Id. In the tracelog, the same identifier is shown as sysID. Because the tracelog provides the most accurate and current value, this article refers to it as the System ID. The System identifier field shown in EcoStruxure Building Operation is a different value. Although it may be used when connecting a server to the Building Advisor Portal, it is not used in this cloning or detaching procedure. Do not reset or modify the System identifier field for this process. Before adding a new top server, cloning a server, or detaching a server connected to Building Advisor:   If Cloud Agent is installed on the server, review the referenced article and complete the Cloud Agent removal procedure before continuing with the server modification activities How to remove Cloud Agent Components Before Performing Server Changes  Disable Cloud Connectivity (Cloud Plugin) Reset the Server Id shown in EcoStruxure Building Operation. This is the value identified as sysID in the tracelog and is referred to as the System ID in this article. Figure 1. Reset the value labeled Server Id. Do not modify the System identifier field for this procedure. Perform the server architecture change, such as adding a new top server, cloning the server, or detaching the server.   Resetting the Server Id/System ID allows the new server to generate a unique identifier and establish its own Building Advisor registration. The System identifier field is not part of this procedure. Following this procedure helps prevent duplicate System IDs and prevents data from multiple servers from being combined in Building Advisor. This is especially important when the servers belong to different customers. If a server was cloned, detached, or a new top server was added before Cloud Connectivity was disabled and the System ID was reset, open a PSS ticket for assistance with separating the server data.

Issue Server modifications such as adding a new top server, cloning a server, or detaching a server in a Building Advisor-connected environment may require removal of existing Cloud Agent components before proceeding. Product Line EcoStruxure Building Advisor, EcoStruxure Building Operation Environment EcoStruxure Building Operation EcoStruxure Building Advisor Cloud Agent Cloud Connectivity (Cloud Plugin) Cause Cloud Agent applications and related files remain installed on the system prior to performing server changes. Resolution Before adding a new top server, cloning a server, or detaching a server connected to Building Advisor, disable Cloud Connectivity (Cloud Plugin). Verify that Cloud Agent is not installed before proceeding. If Cloud Agent is installed, perform a complete removal of all Cloud Agent-related applications and directories. Open Add or Remove Programs. Search for Agent and uninstall the following applications if present: Schneider Electric EcoStruxure Building Operation Cloud Agent Schneider Electric EcoStruxure Building Operation Certificate Agent Schneider Electric EcoStruxure Building Operation Update Agent EcoStruxure Foresight Operation Cloud Agent Software Administrator       3. Navigate to the C:\ProgramData\Schneider Electric EcoStruxure directory and delete the  following directories: Building Operation CDA Agent Building Operation Cloud Agent Building Operation Cloud Certificate Agent Building Operation Update Agent      4. Clear the Recycle Bin.  

Issue Alarm events were visible in Security Expert Workstation and areas entered alarm state correctly, but intrusion alarm reports were not received by the monitoring station through the Contact ID service. Area arm and disarm events were received successfully. Product Line EcoStruxure Security Expert Environment Security Expert Contact ID Service Cause Alarm reporting flags are disabled for the Input Type assigned to the affected inputs. The Input Types had the relevant reporting flags, including alarm reporting, disabled. Disabled reporting options As a result, inputs could generate local alarms and place areas into alarm but Contact ID alarm reporting was not generated for those inputs. Resolution Verify the Input Types assigned to the alarm points and confirm the reporting settings under Input Type → Options (1) → Reporting Options. Enable the required alarm reporting options for the affected Input Types. Enabled reporting options Validation can be performed by confirming that intrusion alarm events are received by the monitoring station after the reporting options are enabled.

Issue Need to perform a diagnostic verification as a preventative measure during routine maintenance or reactively in response to cabling that is causing RSTP issues. Product Line EcoStruxure Building Operation Environment Multi-purpose Controller (MP-C) Multi-purpose VAV (MP-V) Room Controller (RPC) IP-IO Cause Cabling or cabling terminations between controllers in the RSTP loop can cause issues. Resolution Reference RSTP Troubleshooting for BACnet/IP Controllers - Schneider Electric Community to ensure that: the managed switch is appropriately configured for RSTP all SpaceLogic controllers, on the RSTP loop, report RSTP Status = Operational Leave one side connected to the managed switch, plug the free end into the laptop running Wireshark, and take a capture. Ensure both ends are unplugged Plug the other side into the managed switch, plug the free end into the laptop running Wireshark, and take a capture.  Evaluate based on the information below If either evaluation fails, check the cables based on Message Age using a cable tester. It is optional but highly recommended to use a cable tester that displays cable length, as it tends to be more accurate and can point out failures that other testers may report as passing. If it passes the evaluation on both ends, then one can plug both ends into the managed switch Evaluation This capture shows a topology change (TC + Root) in RSTP, then settles out to a consistent Root Bridge Priority and Message Age. Your capture should only show a topology change when Wireshark is capturing on one end and the other end is connecting/disconnecting from the managed switch. Review the following fields: Root Bridge Priority - should be consistent and show the Priority of the Root Bridge. The root bridge can be the switch to which the RSTP loop is connected or a managed switch upstream. If it shows 32768, then another SpaceLogic controller assumed the root because it is not communicating properly back to the root bridge. (See Message Age Note) Message Age - should be consistent and show the expected number of controllers away from the root bridge. When Root Bridge Priority is 32768, you can use Message Age to determine how many controllers away the issue is occurring, and check the cabling connected to or near that controller.

Issue Understanding how to decode BACnet error values found in EBO Trace/System Logs, Controllers, and Continuum devices when documentation for the error message is not readily available. Product Line EcoStruxure Building Operation, Andover Continuum, TAC IA Series Environment EBO Error Log Tool Continuum bCX4040 (BACnet) Continuum b3s Building Operation Multi-purpose Controller (MPC/V) Building Operation Room Controller (RPC/V) Building Operation IP-IO EBO Trace and System logs Cause BACnet error messages in logs use a combined 32‑bit value that includes: BACnetErrorClass (BEC) in the high 16 bits BACnetErrorCode (BE) in the low 16 bits Values often appear with 0x800 prefix indicating hexadecimal formatting. Without decoding, the error meaning is unclear. Example: 0x8001001F 0x10000 → Error Class = Object 0x001F → Error Code = Unknown Object Resolution Understanding the Error Structure A BACnet error value is formed as: 0x8 0 0 [ErrorClassHex] [ErrorCodeHex] High 16 bits Low 16 bits Remove the 0x800 prefix, if present. Convert high 16 bits to identify Error Class. Convert low 16 bits to identify Error Code. Common Interpretation Example Error: 0x8001001F Error Class: 1 → Object Error Code: 1F (31 decimal) → Unknown Object Meaning: Device does not recognize the object. Possible reasons include: Expected program/database not loaded Object deleted or missing b3 device memory wiped after power failure Error Classes (High 16 Bits) (From BACnet Specification Clause 18) May not include 0x8000. (Example: could be 0x5002B instead of 0x8005002B for COV subscription failed) Error Class Hex(0x800) Dec Notes device 0 0   object 1 1   property 2 2   resources 3 3   security 4 4   services 5 5   vt 6 6   proprietary     64 is the first available code for proprietary error classes client 7FFD   0x7FFD0000 Reject 7FFE   0x7FFE0000 (error code is BACnetReject) Abort 7FFF   0x7FFF0000 (error code is BACnetAbort)   Error Codes (Low 16 Bits) A subset of codes from BACnet Clause 18: Error Code Hex (0x) Dec other 0 0 authentication_failed 1 1 configuration_in_progress 2 2 device_busy 3 3 dynamic_creation_not_supported 4 4 file_access_denied 5 5 incompatible_security_levels 6 6 inconsistent_parameters 7 7 inconsistent_selection_criterion 8 8 invalid_data_type 9 9 invalid_file_access_method A 10 invalid_file_start_position B 11 invalid_operator_name C 12 invalid_parameter_data_type D 13 invalid_time_stamp E 14 key_generation_error F 15 missing_required_parameter 10 16 no_objects_of_specified_type 11 17 no_space_for_object 12 18 no_space_to_add_list_element 13 19 no_space_to_write_property 14 20 no_vt_sessions_available 15 21 property_is_not_a_list 16 22 object_deletion_not_permitted 17 23 object_identifier_already_exists 18 24 operational_problem 19 25 password_failure 1A 26 read_access_denied 1B 27 security_not_supported 1C 28 service_request_denied 1D 29 timeout 1E 30 unknown_object 1F 31 unknown_property 20 32 removed 21 33 unknown_vt_class 22 34 unknown_vt_session 23 35 unsupported_object_type 24 36 value_out_of_range 25 37 vt_session_already_closed 26 38 vt_session_termination_failure 27 39 write_access_denied 28 40 character_set_not_supported 29 41 invalid_array_index 2A 42 cov_subscription_failed 2B 43 not_cov_property 2C 44 optional_functionality_not_supported 2D 45 invalid_configuration_data 2E 46 datatype_not_supported 2F 47 duplicate_name 30 48 duplicate_object_id 31 49 property_is_not_an_array 32 50   Frequently Encountered Errors Hex Value Decoded Meaning Notes 0x8000001E Device + timeout Device offline or non‑responsive 0x8001001F Object + unknown object b3/AS memory wipe, missing database 0x80020020 Property + unknown property Invalid property reference 0x80020025** Property + value out of range Writing 0 to multi‑state object 0x80020028 Property + write access denied Permission issue 0x8002002C Property + not COV property Subscription attempted on non‑COV property 0x8002002E Property + invalid configuration data Often caused by invalid COV alarm config 0x80030000 Resources + out of memory Device resource exhaustion 0x80050007 Services + inconsistent parameters Parameter mismatch 0x80050019 Services + operational problem General service failure 0x8005001D Services + service request denied Device rejected request 0x8005002B / 0x5002B Services + COV subscription failed May appear without 0x800 prefix   **Note: This error is not limited to writing an out-of-range value to a BACnet object. It may also occur when a configuration object is incomplete or incorrectly bound. For example, a Floating Limit Alarm with no Setpoint Reference bound may repeatedly generate BACnet error 0x80020025 ("Property + value out of range"). If this error is recurring, review alarm configurations, bindings, and referenced objects in addition to checking for illegal BACnet writes. Wireshark Tip Use the filter: bacapp.type == 5 This displays APDU error packets with decoded Class and Error fields in decimal. In this example, the BACnet device returns an error for Device (0) and operational problem (25) when responding to a readPropertyMultiple.

Issue Clarification is required regarding whether Cross Controller Groups can be used in Security Expert systems that use the standard Download Server, or only in systems that use the Enterprise Download Server (EDS). Additional questions were raised regarding cross-controller functionality for alarm transmission, fire door control, and communication between controllers. Product Line EcoStruxure Security Expert Environment Security Expert Security Expert standard Download Server Security Expert Enterprise Download Server (EDS) Security Expert version 4.3.393.3 and later Cause Changes introduced in Security Expert version 4.3.393.18 modified how controller relationships are managed, resulting in different Cross Controller Group requirements for EDS and non-EDS deployments. Resolution Cross Controller Groups can be used without EDS. Beginning with Security Expert version 4.3.393.18, Cross Controller Groups are mandatory when using EDS and optional when not using EDS. For Security Expert versions 4.3.393.3 through versions earlier than 4.3.393.18, Cross Controller Groups needed to be created for both EDS and non-EDS sites. Cross Controller Group functionality can be used to reduce communication and .dat file size in non-EDS systems by grouping controllers, for example creating one Cross Controller Group per building. This limits .dat files to include only controllers within the same group. However, communication between controllers in different groups is blocked. The commands described in AN 180 Security Expert - Cross Controller Operations - Integration Guide (LocalIP = *,#) are only required in specific network configurations where NAT or port forwarding is used and controllers must communicate directly with each other. When controllers and the Security Expert server can reach each other through normal IP routing, the commands outlined in AN 180 Security Expert - Cross Controller Operations - Integration Guide are not required. For fire door control, a controller-level design using dedicated relay outputs connected directly to inputs on each SP-C controller is recommended to avoid dependence on network communication between controllers. Where a cross-controller solution is required, maintaining separate local door groups per controller is preferred over creating large door groups spanning multiple controllers.

Issue The Calendar Actions page can become slow to load and manage when a large number of historical Calendar Actions exist. Customers may also want clarification how Calendar Actions are retained in the controller and Security Expert database. Product Line EcoStruxure Security Expert Environment Security Expert Cause Historical Calendar Actions are not automatically deleted from the database and must be removed manually. A large number of accumulated Calendar Actions may negatively affect Calendar Actions page performance. Resolution 1. Hide old calendar actions setting Enabling this option will not remove old calendar actions, it will "hide" them from the operator when viewing the calendar actions page. If the option is then disabled, the old calendar actions will be seen again. The point of enabling the option is to hide actions that have already passed, so Security Expert will not load them when the Calendar actions page is opened. This reduces the amount of information the Calendar action needs to load when be viewed and will help it load faster.   The description in the documentation and the online help is wrong. Hide old calendar actions: Select this option to automatically clear calendar actions from the system once they become invalid (Sites | Calendar actions). This should read: Hide old calendar actions: Select this option to automatically hide calendar actions from the list once they have passed their activation time.   2. Calendar action retention in the controller Old actions are not retained in the controller. When a controller downloads the day after a Calendar Acton has expired, it will remove this Calendar action from the controller.   3. Calendar action retention in the Security Expert database Calendar Actions are not removed from the database and will need to be removed manually, as there is currently no supported mass-deletion method available. An internal tool, Calendar Cleaner utility, can help assist cleaning up old Calendar actions in the database. This can be supplied on an as needed basis by raising a case with Product Support. A product enhancement addressing Calendar Action cleanup behavior has been identified by Engineering. A permanent implementation is planned for Security Expert, although no release timeframe is currently available.

Issue Can the Power Supply (PS), Automation Server (AS/AS-P), and I/O module backplane assembly be installed vertically instead of horizontally when cabinet space is limited? Product Line EcoStruxure Building Operation Environment Power Supply (PS-24V) Automation Server (AS-B, AS-P, AS-P-3) Central I/O Modules Hardware installation in control cabinets Cause Customers may prefer a vertical installation due to cabinet layout constraints or conduit routing. Questions may also arise regarding whether more than one Automation Server can be connected to a single Power Supply. Resolution The system is designed, tested, and supported for horizontal mounting only. Vertical installation is not a supported mounting method because it reduces the effectiveness of the modules' natural convective air cooling. Reduced ventilation can increase the internal operating temperature of the modules, which negatively impacts component lifetime. Key considerations: The system is specified to operate at temperatures up to 50°C (122°F) when mounted horizontally. Increased internal temperature can significantly reduce the lifetime of electrical components. The Automation Server (AS) is considered particularly sensitive because: The CPU generates heat. Critical power-retention components used during shutdown and restart are affected by elevated temperatures. During normal operation, no immediate symptoms may be visible. Long-term exposure to elevated temperatures can result in hardware reliability issues, including failure to restart after a power cycle. Vertical Installation Considerations Ambient temperature should not exceed 35°C (95°F). Power supply loading should be reduced from 30 W to 25 W. Convective air cooling relies on warm air rising through the module enclosure and being replaced by cooler air from below. Horizontal installation supports this airflow pattern and is therefore preferred. Risk Mitigation To minimize risk when cabinet constraints exist: Always mount the Power Supply (PS) and Automation Server (AS) horizontally whenever possible. I/O modules may be mounted separately and connected using an S-Cable. If operating temperatures are near the maximum rated temperature, provide cabinet ventilation or external cooling in addition to mounting the PS and AS horizontally. I/O Bus Backplane Requirements More than one Automation Server cannot be connected to the same backplane because the backplane provides a communication path between connected units and Automation Servers cannot communicate on the backplane. The I/O Bus supports 32 slots, including the Power Supply and Automation Server. Empty backplane positions still consume a slot. Additional Information Refer to the SpaceLogic and EasyLogic Hardware Installation System Guide for complete installation, power budget, cooling, I/O bus, and wiring requirements. Important installation requirements include: Install the Power Supply, Automation Server, and Central I/O modules horizontally with the device label upright and reading left to right. Install devices on a horizontal DIN rail to ensure proper airflow and cooling. Vertical installation may exceed thermal specifications and reduce product lifespan. The I/O bus supports a maximum of one Automation Server per I/O bus. I/O bus device order must be maintained: Position 1: Power Supply Position 2: Automation Server Position 3-32: Central I/O modules and additional power supplies as required The I/O bus supports a maximum of 32 positions. S-cables may be used to connect multiple DIN rail sections while maintaining I/O bus continuity. Conclusion: Horizontal mounting is the only supported installation method. If vertical mounting is used, it is not a supported installation method and is performed at the installer's risk. Maintaining operating temperatures well below the maximum rated value is critical to reducing the risk of reduced product life and long-term reliability issues.