Issue When adjusting the Elevator Relay Time in the elevator reader, the option to save appears, but the setting does not persist. Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Mercury MP1502 controller (version 08-2.4.0.653) OSDP Reader Cause The Access Expert Client has an issue with saving individual elevator relay time settings. Resolution Workaround: Navigate to Instance Settings and set the relay time globally. This applies the same relay time to all readers; individual reader settings cannot be saved until the underlying issue is resolved. Additional Notes: Client version: 25.9.26 Controller version: 08-2.4.0.653 A permanent fix will be provided in a future release.

Issue SAFR Face Scan successfully detects faces but does not authenticate users or grant access.        Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 SAFR Scan Reader using OSDP Cause The default SAFR Scanner Access Feedback Timeout is set to 300 ms, which is too short for proper authentication. In some cases, physical impact during transit may also require light sensor recalibration. Resolution   Access the SAFR Scanner configuration web page and log in. Navigate to System > OSDP settings. Change the Access Feedback Timeout from 300 ms to 1000 ms and click Apply. Test authentication. If issues persist: Perform light sensor calibration (refer to SAFR documentation). SAFR portal: https://safr.com/safr-portal/ (login required)

Issue After installing and configuring the LP4502 (online) and downstream devices per the Installation instructions, KGC devices remain offline. (See highlighted snapshot below) Link to Kone Integration Instructions: Access Expert Kone Elevator Integration  Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Kone Elevator Integration LP4502 Comm2 with Micro-B USB adapter (Pluggable USB2-OTGE100) Cause Using the LP4502 comm2 port with a Micro-B USB adapter for elevator communication on a separate subnet is NOT supported. Note: Other Elevator integrations (Thyssen Krupp, Otis) support this setup, which can cause confusion. Resolution 1. Use Comm1 for LP4502 to connect to the internet and site instance. 2. Ensure LP4502 and Kone elevator equipment are on the same subnet. 3. Configure site IT switch: Block internet-to-Kone communication. Allow local traffic on port 2005. KGC downstream IPs must communicate with the LP4502 primary NIC IP. Once completed, the LP4502 and the KGC downstreams will come online and will communicate with the Kone Elevator equipment. Summary KGC downstream devices fail to come online when LP4502 is configured using Comm2 with a Micro-B USB adapter. This setup is not supported for Kone Elevator integration.  

Issue Information is needed about the Access Expert Kone Elevator Integration Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Cause Kona Elevator integration information  Resolution Overview: Destination Dispatch is a licensed feature for Access Expert and used when customers are modernizing their elevator systems or deploying newer ones which do not utilize the relay-based approach for floor control and selection. Within Access Expert, 3 different elevator platforms are supported which include Otis, Kone and ThyssenKrupp. For this document, we will focus on a KONE deployment. It is important to note that a single Access Expert can support multiple integrations at the same time. The KONE integration supports up to 128 total floors of control. When using front and rear entry points within the elevator cabs), each entry point is considered a separate destination. This means a 32- story building using front and rear entry points will result in 64 individual destinations.   A KONE protocol was created so that the LP controllers can manage access for the KONE Elevator Group Controller. Mercury will support configuration for Destination Operation Panels (DOPs), Car Operation Panels (COPs), and turnstiles. This feature is supported on the LP4502, and EP4502. The support for KONE Elevators was added in firmware 1.25.5.   Prerequisites: 1. Access Expert System 2. KONE Destination Dispatch License - FN-DEST-KONERS 3. Appropriate Reader Licenses 4. AX-LP4502 5. Coordination with the Elevator Contractor A KONE Elevator Destination Dispatching System mode was created within Access Expert so that the LP4502 intelligent controller can inform a KONE DEC (Destination Entry Computer, E.g. touch screen or keypad) allowed and authorized floors for a cardholder. This feature is only supported on the LP4502. Note: Other Elevator Destination Dispatch integrations i.e. Thyssen Krupp and Otis use the 2 nd port on the LP4502 controller to communicate with the elevator equipment on a separate subnet. ** The Kone Destination Dispatch integration does NOT support using the 2 nd comm port on the LP4502 to communicate with the Kone elevator equipment. If you attempt to do this, you will be unable to connect to the KGCs, and they will not come online. If you use the Kone elevator simulator for testing, there will not be any response from the KGCs even though you can ping the IP addresses.   Controller Page 1. On the LP4502 controller page, navigate to the "Destination Dispatch" Tab. 2. Select Kone. 3. Enable "Has front and rear floors" if your Kone setup has front and rear floors. Make sure to take into consideration this flag when assigning elevator floors access. It is also recommended to consider the door when creating names. Examples like 2F or 2R are beneficial to system operators. 4. Set the Maximum Cabin Configurations. This is the number of Kone Cabin Access configurations that can be stored on the controller. 5. Press Save. 6. From the "Add Downstream" dropdown, select Kone KGC under the network port. 7. Enter the Display Name to be applied to be used.  8. Enter the KONE primary KGC IP address and Port. 9. Leave 2005 as the default port number. Press Save 10. Repeat steps 6 to 8 for the Backup KGC. 11. Issue a "Push Controller Database" command.   Reader Page Once the Interface Controller has been saved, add/Navigate to a reader attached to the Controller, and move to the elevator tab. The Reader does not reside on the KONE KGC downstream. The KGC downstream is only used to configure the controller with the Primary/Backup KGCs. The readers must be on the regular Mercury downstream modules or attached to the LP4502. Because of this, the actual reader setup is similar to a regular door/elevator deployment with the addition of new settings on the Elevator Tab. Once the Elevator Type is set to Destination Dispatch, a series of settings will be enabled and displayed. You will be presented with a WARNING Message when the Elevator Type is selected. This message is normal and you should select YES. 1. On the reader page, navigate to the "Elevator" tab. 2. Select "Kone Destination Dispatching" as the Elevator Type. 3. Select the Kone Operation Type. Please note that Kone does not support mixing Remote Call Giving Interface (RCGIF or turnstiles) with Destination Operation Panel (DOP) and/or Car Operation Panel (COP). Only one is supported at a time. 4. Depending on the Operation Type, specify the fields. 5. If desired, select an Override Elevator Access Level. This will allow a set of floors to be public during defined schedules. 6. Press Save. Kone Cabin Access Page 1. Navigate to "Access Configuration" on the Main Ribbon bar. 2. Go to "Kone Cabin Access". 3. Click on "Add Kone Cabin Access". 4. Enter a Display Name. 5. Enter the allowed cabins (up to 255). You can use the following formats to enter values: 1-10,15,16. 6. Press Save. Person Page Once the reader has been saved navigate to the person(s) who you want to grant access to the destination dispatch and select the new destination dispatch tab at the bottom of the page this will take you to a new Destination dispatch tab. To add an Elevator user setting, simply select the elevator type you wish to grant access to and click the add button. You will be prompted to select a controller. If there are no active LP4502 elevator controllers, then the dropdown will be empty meaning the user needs to add a valid controller. 1. On the person page, navigate to the "Destination Dispatch Settings" tab. 2. On the "Kone Settings" tab, click on "Add Kone Setting". 3. Select the Kone controller and press OK. 4. Enter the Default Floor. 5. Enter the Default Floor Side. 6. Select a Cabin Access 7. Select the Kone Elevator flags to be applied to the person. 8. Press Save.  *Users must configure the Instance Settings to reflect the correct number of floors. The Cab used will be sent by the Kone system to Keep on an 'Access Granted' and displayed in event data. Masks Kone has Global and Specific Masks that are used when setting schedules. These can be set and cleared by right-clicking on the controller and selecting the appropriate option. Setting the Global Mask opens the Global Mask Configuration window. To add a floor configuration, click the "Add Floor Configuration" button, then select the desired floors. From there the options for each floor can be selected by setting the appropriate flags for the floor. Click "OK" to save the changes. Other Information: Each Elevator Manufacturer has specific settings, commands or fields when deploying the Destination Dispatch integration. The following are specific to KONE: Supported Reader Types: 1. Destination Operation Panel (DOP) – Destination operation panels are located outside of the elevator car. Each of these will be configured as a separate reader. 2. Car Operation Panel (COP) – Destination operation panels are located inside the elevator cab. Each of these will be configured as a separate reader. 3. Turnstile (RCGIF) – Turnstiles are half-height sensor barrier solutions designed for public and commercial buildings and airports. Each turnstile will be configured as a reader and must use a Mercury reader port.

Issue Guidance is needed to enable reading of PIV (FIPS-201) cards using the AX-SSC controller and AC1 downstream devices within EcoStruxure Access Expert. Product Line EcoStruxure Access Expert Environment AX-SSC Cause Sites migrating from Continuum systems require a clear, step-by-step process to ensure PIV cards are properly enrolled and recognized in Access Expert. Resolution What is FASC-N? FASC-N stands for Federal Agency Smart Credential Number. It is a 25-byte (200-bit) identifier embedded in PIV cards, used to uniquely identify the cardholder across federal systems. It is composed of multiple fields, including: Agency Code System Code Credential Number Credential Series Credential Issue Person Identifier Organizational Category Organizational ID Person Org Association These fields are encoded using Packed Binary Coded Decimal (BCD) with odd parity, and together form a unique string used by access control systems to authenticate users. Understanding the FASC-N Structure In the Continuum Personnel object below, the fields highlighted are those that make up the FASC-N The PIV enrollment tool generates a character string when a card is presented. For example: 32013733334894141152472674132011 This string is composed of the following FASC-N fields: Field Value Agency Code 3201 System Code 3733 Credential Number 334894 Credential Series 1 Credential Issue 4 Person Identifier 1152472674 Organizational Category 1 Organizational ID 3201 Person Org Association 1 Note: If no enrollment tool is available, manually concatenate these fields in the order shown to create the FASC-N string. Configuration Steps 1. Card Format Setup Configure the card format in Access Expert as follows: Card Format Type: Standard Bit Length: 128 Large Encoded Card Number: ✅ Checked Convert 200 FASCN Bit to 128 Bit: ✅ Checked Card Number Starting Bit: 0 Card Number Bit Length: 128 2. AX-SSC Controller Configuration Ensure Enable Large Encoded Card Number is checked. Assign the card format created in Step 1 to the controller. 3. Person Object Configuration Navigate to Add Card Assignments. Paste the full FASC-N string into the Display Card Number field. This will auto-populate the Encoded Card Number field. Since the Encoded Card Number field is limited to 16 characters, truncate the string from the end until only 16 characters remain. Paste the full FASC-N string into the Hex Value field. ⚠️ Although labeled "Hex Value", enter the string as decimal digits. Save the Person object. Additional Notes Only the editors mentioned above require configuration for PIV card support. Editors such as Reader, Access Level, etc., do not need special configuration for PIV cards.

Issue How is a subnet defined, and what role does it play in IP networking? Product Line EcoStruxure Access Expert, EcoStruxure Building Operation, EcoStruxure Security Expert, TAC I/NET Environment This explanation is based on principles outlined in TCP/IP Network Administration by Craig Hunt, published by O’Reilly & Associates, Inc Cause Subnetting is a method used to divide a larger IP network into smaller, more manageable segments called subnets. This segmentation helps optimize IP address usage, improve routing efficiency, and enhance network security and organization. Resolution What Is a Subnet? A subnet (short for subnetwork) is a logical subdivision of an IP network. It is defined by applying a subnet mask to an IP address, which determines how the address is split into: Network portion – identifies the specific network. Host portion – identifies individual devices (hosts) within that network. How Subnet Masks Work A subnet mask is a 32-bit binary pattern that accompanies an IP address. It uses binary values to indicate which part of the IP address refers to the network and which part refers to the host: A bit set to 1 in the subnet mask means the corresponding bit in the IP address is part of the network. A bit set to 0 means the corresponding bit is part of the host. Example IP Address: 192.168.1.10 Subnet Mask: 255.255.255.0 (binary: 11111111.11111111.11111111.00000000 ) CIDR Notation: /24 This means: Network Address: 192.168.1.0 Broadcast Address: 192.168.1.255 Usable Host Range: 192.168.1.1 to 192.168.1.254 CIDR Notation Modern networks often use CIDR (Classless Inter-Domain Routing) notation to define subnets. CIDR expresses the subnet mask as a suffix (e.g., /24 ), indicating the number of bits used for the network portion. Common CIDR Blocks CIDR  Subnet Mask Hosts per Subnet /30 255.255.255.252 2 usable hosts /24 255.255.255.0 254 usable hosts /16 255.255.0.0 65,534 usable hosts Additional Notes Subnets are local constructs: They are meaningful within the internal network and typically not visible to external networks unless explicitly routed. Subnetting supports hierarchical addressing, which simplifies routing tables and improves scalability. Proper subnetting is essential for network performance, security segmentation, and efficient IP address management.

Issue Where to go to download the Access Expert Device Administrator application. Product Line Access Expert Environment Server 2012 SQL 2012 and above Premise Install V2 Hosted V2 Applet V3 Cause There is no documentation on where to go to download the Device Administrator and how to program the SSC to communicate with the selected application. Resolution The following steps describe where to go and download the software and how to use it to program an SSC: Go to the EcoBuilding Exchange In the search field type Device Administrator Select the Access Expert Device Administrator and download to any location Browse to location and double click execute to run and install the program Accept Agreement and click next to continue installation Click Next to start installing the software Select the location where the file will be installed Successfully loaded software To complete installation, click on Finish Connect the device to a network switch that is open to the internet and launch the application by opening Access Expert device Administrator from the Schneider Electric group in All Programs Launch the application  Right click on the usb line or click on the green arrow to the top left to upgrade the software Once upgraded successfully, Right click again on the line and select properties then select the Ethernet 1 ConfigurationTab Select applicable choice whether it is DHCP or Static addressing being used and click on OK. Once the device comes back Online, select the DIP Switches Tab and check the box for Default User Using the IP address given from step number 13, open up IE and browse to that address Once opened, configure the SSC per Setting up an SSC (System Security Controller), EP1501 and EP1502 Mercury Controllers.

Issue How to find the IP address information on a PC? Product Line EcoStruxure Building Operation Environment Windows Operating Systems Cause Need to identify the IP address of the workstation (PC). Resolution For a Windows 95/98 PC, go to a DOS screen and run WINIPCFG. For a Windows including and after Windows7 run a COMMAND window and run IPCONFIG.  

Issue Sometimes as an administrator, you may need to kill a service which is stuck at starting or stopping in order to avoid having to reboot a server in the middle of the day. Or even after the reboot, the service will not start. Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Building Operation Enterprise Central Building Operation Licensing Server Security Expert Windows Services Access Expert Windows Services (on-premise only) Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Cause Sometimes the service times out and gets stuck in a loop due to fallback protocols within the service Resolution Find out the name of the service To do this, go into services and double click on the service which has stuck.   Make a note of the “Service Name”. Find out the PID of the service Open an elevated command prompt and type in: "sc queryex servicename" (where servicename is the name of the service you obtained from Step 1). Make note of the PID Kill the PID From the same command prompt type in: "taskkill /f /pid [PID]" (Where [PID] is the service number).   If it is successful you should receive the following message: "SUCCESS: The process with PID XXXX has been terminated."     Be careful of what you are killing though. If you kill a critical windows service you may end up forcing the machine to reboot on it own.   If the service returns back into this state you may need to increase the time allotment for the service to start.   Global (entire system): Open Windows Registry: Start -> Run -> regedit.exe File --> Export --> make a backup of the current registry Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ Right click on the right page ---> New ---> DWORD call the new DWORD "AutoStartDelay" Set AutoStartDelay in milliseconds (decimal). E.G. 240000 is 240 seconds. Per-service: Open Windows Registry: Start -> Run -> regedit.exe File --> Export --> make a backup of the current registry Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<servicename> To increase the default delay of 120 seconds, right click the registry key and add new key AutoStartDelay (DWORD (32-bit)) Set AutoStartDelay in milliseconds (decimal). E.G. 240000 is 240 seconds.

Issue When transitioning Continuum access control to Security Expert or Access Expert the Continuum power supply may need to be configured for auxiliary IO power mode.  Product Line Security Expert Access Expert Environment Continuum AC-1 IO Module Security Expert Controller Access Expert Controller Warning Hazard of Electric Shock: Remove all power from all devices before removing any covers or doors of the system. Disconnect power at the device and at the power source. Electrostatic Discharge Required: Always discharge static electricity from your person by touching metal prior to handling any hardware. Failure to do so may result in damage to devices. Cause The UPS versions of the 120/240 AC Continuum power supply include two status signals that are meant for use by a CPU module. When connecting directly to an I/O module you must disable these signals. If signals are left enabled they will cause communication issues between the AC-1 IO modules and the Security Expert or Access Expert controller. Resolution This applies  ONLY to the UPS models of the Continuum power supplies (PS 120/240 AC 50-U, AC 65-U and AC 85-U)   Remove power from the unit. On the Continuum power supply, press both cover removal tabs inward simultaneously and pull up. Locate the Mode switch using the diagram below. *** With the tip of a small screwdriver, carefully slide the switch to the AUX position. Replace the cover.   NOTE: On older versions of the power supply, instead of a switch, two jumper components must be removed from the printed circuit board.  

Issue Introducing a previously commissioned Continuum IOU module such as an AC-1 to an Access Expert or Security Expert site can cause communication issues in the LON bus due to duplicated node id. Product Line Andover Continuum, EcoStruxure Security Expert, EcoStruxure Access Expert Environment Continuum AC-1 Continuum Net Controller Continuum Net Controller II Access Expert Controller Security Expert Controller Warning Electrostatic Discharge Required: Always discharge static electricity from your person by touching metal prior to handling any hardware. Failure to do so may result in damage to devices. Cause When IOU modules are commissioned in a Continuum system, the Net Controller assigns each module a Node ID, this is in addition to the LON Module ID that is unique to each module hardware, the purpose of the Node ID, is to decouple the identifier used by Continuum for communication from the specific piece of hardware, this in order to facilitate the replacement of a failed module without the need to change its Continuum identifier. The module stores the Node ID in nonvolatile memory so that it persists across power loss. If a Continuum IOU module is introduced to a LON network (Security Expert SP-AC1 or Access Expert AX-SSC) without clearing its Node ID, there is a risk of creating a duplicate Node ID condition that will prevent the LON network from operating properly. IMPORTANT This should not be an issue during the normal transition of Continuum site to Security Expert or Access Expert, as all the modules on the running LON bus should have unique Node IDs, this is only a problem when adding a module, or replacing a module with one that has been used before. Resolution In order to signal its presence on the LON network, each module will transmit on resetting its status network variable. If upon receiving this message, the Net Controller determines that the module is NOT in its local database, the controller will decommission the module by setting its Node ID to zero. Before introducing a Continuum IOU module that has been previously commissioned to the LON network of an SP-AC1 or SX-SSC controller, decommission the IOU module using the steps below: Attach the module to an empty Net Controller that is powered down with its battery removed. For a Net Controller II, in order to be absolutely sure that the Net Controller has an empty database, you may need to clear its backup in flash from a browser or by the use of the reset IP switch. See LL on how to use the controller's reset IP switch to clear its flash backup https://community.se.com/t5/Building-Automation-Knowledge/How-to-clear-the-controller-flash-backup-from-the-hardware-using/ta-p/5877 Power up the Net Controller Once the CPU led on the Net Controller starts blinking, press the 'Reset' button on the IOU module. Wait 30 seconds to make sure the decommissioning process has completed. Power down the Net Controller Remove the IOU module

Issue Proper configuration of supervised inputs, Mercury IO modules (i.e MR52) versus Continuum IO modules (AC1/AC1Plus) for transitioned Continuum sites. Product Line EcoStruxure Access Expert Environment Access Expert Controller Access Expert Reader Interface Access Expert Premise Software Access Expert Hosted Software Continuum AC-1 IO Module Warning Electrostatic Discharge Required: Always discharge static electricity from your person by touching metal prior to handling any hardware. Failure to do so may result in damage to devices. Cause Guidance is needed on the proper configuration of Access Expert custom EOL resistor tables in order to achieve full supervision of inputs associated with readers/doors. Full supervision in this context means not only being able to detect normal input operation (activation/deactivation) but also detection of attempts to tamper with the input's circuit (short circuit, open circuit, grounding, the introduction of foreign voltages, etc.) Please note that not all resistor configurations can detect all the various circuit issues, for example, a NO Series resistor configuration can't detect a cut in the wire given that the open circuit is the normal state for the Deactivated value of the input. The resistor configuration that provides the most supervision is the Series/Parallel configuration, using 2 resistors is possible to detect both short and open circuits. Resolution Continuum supported a fixed 10K Ohms resistance for supervised inputs, furthermore, Continuum IO modules (AC1/AC1Plus) transitioned to Access Expert under an AX-SSC controller continue to operate with Continuum firmware, this means that they do not support the custom EOL tables in Access Expert, the only configuration that is possible for AC1/AC1Plus modules is the mode of connection of the resistor (parallel, series or both).   Also, when using 2 resistor configuration, the placement of the resistor is different in Continuum compared to Mercury hardware   CONTINUUM When the switch is open only the resistor on the left is seen by the input. When the switch is closed, the two resistors are presented to the input in parallel with each other resulting in the input reading half the sum of the total resistance value.   SECURITY EXPERT       When the switch is open, the two resistors will be presented to the input in series with each other resulting in the input reading the sum of the two resistors value.  When the switch is closed only one resistor is presented to the input   For the above reasons, Continuum transitions sites where the AC1/AC1Plus has been replaced with Mercury hardware like the MR52 for example, need to configure one or more custom EOL table(s) for 10K resistors.   *** The sample tables provided below contain resistance values calculated to take into account wide variations in total supervised loop resistance due to wire distance, gauge etc., supervised loops should be installed in accordance to distance and gauge guidelines for wires as well as recommended resistor tolerance. It may be necessary to make adjustments to the resistance values in the tables on a site by site basis.   See below sample tables for all six possible 10K resistor configurations   Normally Open Parallel (10K-NO-P) Normally Closed Parallel (10K-NC-P) Normally Open Series (10K-NO-S) Normally Closed Series (10K-NC-S) Normally Open Series/Parallel (10K-NO-SP) Normally Closed Series/Parallel (10K-NC-SP)+ 1. Normally Open Parallel (10K-NO-P) 2. Normally Closed Parallel (10K-NC-P) 3. Normally Open Series (10K-NO-S) 4. Normally Closed Series (10K-NC-S) 5. Normally Open Series/Parallel (10K-NO-SP) 6. Normally Closed Series/Parallel (10K-NC-SP)+

Issue Access Expert SSC and Mercury controllers require firmware updates Product Line EcoStruxure Access Expert Environment Access Expert V3 Hosted Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Cause SSC and Mercury controller firmware needs to be updated for a fix or feature change Resolution Overview Mercury Controllers operate based on their firmware version and programmed configuration within Keep. It is necessary to update the Mercury firmware on occasion to ensure the most recent features, bug fixes and security upgrades are on the Mercury panel.    Updating Firmware Mercury controllers can be updated using the Keep by Feenics software. Before updating the controller, confirm the controller is powered on and connected to a Keep by Feenics instance. It is important to have a stable internet connection throughout the entire firmware update process. The duration of the firmware update will depend on the network bandwidth but typically will take between 5 to 10 minutes for a complete update. Users can issue multiple firmware updates to different intelligent controllers at the same time, but not downstream devices.   Updating the Firmware on a Controller To update the firmware on a controller: Open the controller page.  Beside the Version field, click on the "Update Firmware" button. Open the Live Monitoring window and set the priority to 0. In the Live Monitor, you will see the "Downloading Firmware Event". Once the controller has completed the firmware update, it will reboot.  After, close and re-open the controller page to see the updated firmware version. EP Controller Firmware The EP Series controller's current version is 1.29.1.633 and was released on 2020/01/31. Due to the controllers being End of Life, no new versions of firmware will be released for the EP series controllers.   On-Premise Deployments Note: On-Premise Deployments are no longer supported. All sites will convert to hosted. The previous process to upgrade firmware for On-premise deployments (servers managed on-site): They can have their firmware updated out of band by placing the latest Mercury CRC files in the appropriate directory. Once the files are in place users can proceed with the update steps outlined in this article. The default directory for firmware files can be found at C:\Program Files (x86)\Feenics\Mercury Service\MercuryFirmware. 

Issue Instructions needed to perform a Factory Reset for Upstream Mercury Controllers Product Line EcoStruxure Access Expert Environment Access Expert software Hosted V3 Warning Hazard of Electric Shock: Remove all power from all devices before removing any covers or doors of the system. Disconnect power at the device and at the power source. Electrostatic Discharge Required: Always discharge static electricity from your person by touching metal prior to handling any hardware. Failure to do so may result in damage to devices. Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Cause Instruction steps are needed to reset Upstream Mercury controllers to Factory Default settings Resolution Bulk Erase Configuration Memory: The bulk erase function can be used for the following purposes: Erase all configuration and cardholder database (sanitize board) Update OEM default parameters after OEM code has been changed Recover from database corruption causing the board to continuously reboot   Bulk Erase Steps (Factory Reset): Do not remove power during steps 1-8   Set S1 DIP switches to: 1 & 2 "ON", 3 & 4 "OFF" (see DIP switch location and diagram below) Apply power to the board Watch for LEDs 1 & 2 and 3 & 4 to alternately flash at a 0.5 second rate Within 10 seconds of powering up, change switches 1 or 2 to "OFF". If these switches are not changed, the board will power up using the OEM default communication parameters LED 2 will flash indicating that the configuration memory is being erased Full memory erase takes up to 60 seconds When complete, only LEDs 1 & 4 will flash for 8 seconds The board will reboot 8 seconds after LEDs 1 & 4 stop flashing (no LEDs are on during this time)  All other switch settings are unassigned and reserved for future use. Factory Default Communication Parameters: Network: static IP address: 192.168.0.251 Subnet Mask: 255.255.0.0 Default Gateway: 192.168.0.1 DNS Server: 192.168.0.1 Host port: IP server, no encryption, port 3001, communication address: 0

Issue Instructions needed for batch importing Users into Access Expert Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Cause Steps are needed to import Users from another system Resolution Batch Import   When converting a site, all user records and information needs to be imported into the new system. For Access Expert here are the steps in order to accomplish this:   Log on to the instance Once it opens up select the Access Control Tab and choose the Batch icon When this editor opens up select the Download Default Example file This will give a sample of the format that is expected when the Upload CSV is needed From the original application, if there is a dump file (Continuum) or an existing csv, copy and paste into an excel file or use the template and rename it accordingly. Choose the relevant columns to match from the list. Once satisfied with all the entries and fields, save the file then return to AccessXpert and select the Upload CSV as mentioned in Step 3. Select the file to open and once completed, all the users will then be displayed.

Issue What steps are needed to configure and add Mercury Intelligent IP Controllers to Access Expert Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Warning Hazard of Electric Shock: Remove all power from all devices before removing any covers or doors of the system. Disconnect power at the device and at the power source. Electrostatic Discharge Required: Always discharge static electricity from your person by touching metal prior to handling any hardware. Failure to do so may result in damage to devices. Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Cause Instruction steps are needed to configure and add Mercury Intelligent IP Controllers to Access Expert Resolution Overview Intelligent Controllers synchronize with Access Expert in real time, but all access decisions are made locally and independently from the server. This means that the processing of events, actions, and alarms remains local and functional even if network connectivity is lost. Configuring a Controller for IP Client Power the controller with an external power supply or by PoE and connect the controller via Ethernet cable to the network. Make sure all DIP switches are set to the off position. Enter the IP address of the controller in the web address bar of Microsoft Edge or Internet Explorer. Set DIP switch 1 to the ON position to leverage the default username and password. Log into the controller within 5 minutes of setting DIP switch 1 to the ON position with these default credentials. Username: admin Password: password From the menu located at the left of the configuration manager page, click on the ‘Network’ button to visit the network settings page Ensure ‘Use the following DNS server address is checked and enter 8.8.8.8. This is a Google DNS server. We recommend utilizing this to maintain the best operation. Click on the Accept button in the ‘Network Settings’ page to save changes. Navigate to the menu and select the ‘Host Comm’ to open the page. Ensure the Primary Host Port is configured as follows. It should be noted the Alternate Host Port must be disabled: Communication Address: 0. Use IPv6: Unchecked. Connection Type: IP Client. Data Security: TLS if Available. Host IP/Host Name: connect.feenics.com. Port Number: 3001. Connection Mode: Continuous. Retry Interval: 20sec Click on the ‘Accept’ button in the ‘Host communication’ page to save changes. Navigate once again to the menu and select ‘Apply Settings’ to open the page. Click ‘Apply setting, Reboot’ (located at the top of the page). If a warning page appears, check both the ‘I understand' and 'wish to proceed’ boxes. Click 'Yes' to apply the changes and allow the controller to reboot. Adding Controllers to Access Expert Controllers are added to Feenics from the Hardware Provisioning tab. When adding a controller, you will need to select the controller type from the drop-down list. If the controller you are trying to add does not match one of the types listed, Access Expert does not support it. When adding a controller, a name must be given to identify the controller and the UNIQUE MAC address of the controller. The MAC address is used to identify the controller within the Feenics system. Duplicate MAC addresses will not be allowed.   When adding a controller, the MAC address is optional. If no MAC address is provided, the controller will be marked as disabled upon save. The controller can only be enabled by providing a valid MAC address.    Steps to add an IP Controller to Access Expert Select the ‘Hardware Provisioning’ Tab Click “Add Controller” and select your device type Enter a Display Name Enter the MAC Address in the correct format: “XX:XX:XX:XX:XX:XX” Select the time zone (This sets the Controller Time) (OPTIONAL) Assign Card Formats as needed (Can be added later) (OPTIONAL) Add Custom EOL Tables 8. Click “Save” or “Save & Close” The Port configurations will be grayed out initially until you commission Interfaces and Downstream Devices. At that point, the port configuration section will automatically be configured. Baud Rate is configurable but all devices on the bus must share a baud rate. ***Important Note: It is important to choose the correct controller type when adding a new controller.  

Issue There is an alarm showing after adding a downstream controller Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Warning Hazard of Electric Shock: Remove all power from all devices before removing any covers or doors of the system. Disconnect power at the device and at the power source. Electrostatic Discharge Required: Always discharge static electricity from your person by touching metal prior to handling any hardware. Failure to do so may result in damage to devices. Cause Instructions needed to eliminate the power failure and  tamper alarms showing on newly added downstream devices Resolution When adding downstream devices, for example, An MR50, MR52 or MR16In/Out to an SSC, EP1501 or EP1502 controller, an alarm may show in the hardware tree. To get the controller out of this state, the following steps need to be taken: a. Locate the terminal block(TB) on the panel which contains the connections for CT (Cabinet Tamper) and BA (Power Fault) Note: You may need to consult the specific controller documentation since the TB#  with these connections are different on each board. It will look similar to the following: b. Remove the connector Cut two small pieces of wire, one for each Alarm Use the 2 wires to jumper each connection (CT and BA) to create a closed circuit. This assumes these contacts are not being used for their usual purpose. No resistors are required Place the connector back on the board The downstream devices no longer show alarms for the respective addresses.

Issue Access Expert LDAP agent unable to connect to Instance Product Line EcoStruxure Access Expert Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Environment Access Expert V3 Hosted LDAP agent installed OnPrem on-site server (Not the appliance installed by Feenics) Cause LDAP agent cannot connect because the Username/PW may be stored in a registry that is no longer valid Resolution Double-check the site setup documentation records that the Username/PW combination is correct Run the SEQ Log and see if there's an entry that indicates that the 'Ldap agent is not able to connect to the instance' Note: Earlier versions of the LDAP on-site installer did not remove all registry entries including username/pw, so an older username/pw combination may be used instead of an updated combination.  If the username or password was changed at some point or if alternate combinations were used for troubleshooting then an incorrect combination could be used by the LDAP agent to connect to the instance and it cannot. Check the login to Access Expert with one of the LDAP username/password combinations and if there are 2 (Users) listed in Access Expert, delete the username/pw combination that does not work in Access Expert. Regedit Backup and old Username/PW deletion To obtain a registry backup just in case before deleting an entry: https://support.microsoft.com/en-au/topic/how-to-back-up-and-restore-the-registry-in-windows-855140ad-e318-2a13-2829-d428a2ab0692  It is suggested to back up the entire Feenics.Keep.ActiveDirectory.Service subkey Open regedit and delete the imagepath subkey Windows Start/Run> regedit Locate the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Feenics.Keep.ActiveDirectory.Service Right-click on the ImagePath subkey and select 'Delete' Only delete this subkey, not the other Reinstall the LDAP integration using the media received directly from Feenics or SE Product Support. i.e. Feenics.Keep.Installer.ActiveDirectory.msi The most recent version of the install can be found on Feenics site: Feenics Keep Active Directory LDAP Installation Media  During the installation ensure the tested username/pw combination is used Verify that the 'Feenics Keep Active Directory Service' starts successfully Go to Start>Run>Services.msc and click Ok Locate the 'Feenics Keep Active Directory Service' Right-click and select Start Open SEQ Log and verify that the Ldap agent is able to connect to the Instance. The SEQ entry at the top of this article 'Ldap agent is not able to connect to the instance.' should no longer appear in the SEQ log. The following entry should be there instead. Verify that the Access Expert Windows User(s) can now be used login to Access Expert

Issue An explanation of Hosted backup options is needed to understand which objects are backed up and which are not. Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Cause It's important to understand the backup options available for an instance. Resolution By default, each instance includes a one-year transactional history retention, giving one year of Event History backup. Additional event history retention time can be purchased if required, and such purchases will be visible under "Manage License." Example: Note: There are currently no configuration specific backups that are retained or that can be restored to reinstate deleted hardware or objects into an instance.    Recommendations: Exercise caution when deleting objects, especially controllers, from Access Expert. A prompt requests confirmation before deletion. Generate snapshots of controller configurations and other detailed objects. These snapshots serve as references in case of accidental object deletion, assisting the reconstruction of controllers or other objects with their original configurations. Summary reports can also be useful when trying to rebuild objects. For example: Inputs, Outputs, Readers, etc.

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue Access Expert uses Docker containers and images for the Bosch and Schindler integrations and at times the virtual machine image(s) need to be updated. Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Cause Feenics updates virtual machine images which requires an update Resolution Feenics may update a Docker image for one of their integrations.  Note: A Docker software update may be indicated in the bottom right of the Docker Window This is only a software update for Docker and will not update the container image. An image update requires a command to Pull the image down from Feenics. The Docker software update is not required to update the Docker Image. (see yellow highlight in the snapshot below)   Here are the instructions to update the Docker Container Image to the (latest) Open Docker Desktop for Windows 1. Under Containers, make note of the current bosch service name Ex. AX-bosch-service1 2. Stop the container/service using the stop button 3. Click the Red Delete button above the container Click Delete Forever No container after the delete Image still shows 4. Delete the Image by clicking on the Red Delete button under ImagesSelect Delete Forever (Image) Image deleted (See below)5. Click on the Blue button 'Search images to run' Type in the following to search for Imagesfeenics/keep-bosch:latest   6. Select the 'feenics/keep-bosch:latest' Image and Click PULL You will see the progress of the image downloading 7. Click on Containers on the top left - the container will not be there 8. Click on Images and then Click the Play button on the Feenics/bosch entry 9. On the next screen, after selecting Play, select the down arrow next to Optional settings Enter the original container name that was noted above i.e. AX-bosch-service1, Click Run You will see messages from the bosch service startup Although the image is updated and running, you will likely see an 81 exception error in the startup log (see highlight above). Here are some additional steps to finalize this process.   10. Check in Windows Services> Docker Desktop Service One of the updates along the way may have changed the startup type to Manual Double-click on the service and select Automatic for Startup type Click Start (to start the service) Click Ok.   11. Open Windows PowerShell in ADMIN mode (standard mode will not work) Run the following command   docker run -d --restart unless-stopped --name feenics-bosch-service --env-file C:\ENV\env-us.txt feenics/keep-bosch   If you try to run the command with the same name as the original service, you will receive the following message in PowerShell  Successful running of the Power Shell command This command ensures Docker runs with the parameters that are stored in c:\env-us.txt 12. Click on Containers, and there will be 2 Containers Select the one that is NOT running and click the Red Delete button The Delete Forever prompt comes up, select the Delete forever buttonOne container should remain and should be running The panel should be online and communicating 13. Test and verify everything is working with the Bosch integration