Building Automation Knowledge Base

Issue How to be redundant with your intelligent Building Management System (iBMS) Product Line Andover Continuum, EcoStruxure Building Operation, Field Devices, Satchwell Sigma, Security Expert, TAC INET Environment Existing intelligent Building Management System Open Mind High Availability Solutions (Deprecated by manufacturer) everRun MX ztC Edge Cause In engineering, redundancy is the duplication of critical components of a system with the intention of increasing the system's reliability. To be redundant with an intelligent Building Management System (iBMS) would take on two possibilities. Have an alarm on critical points alerting personnel who move into action quickly replacing control boards or devices in the event of failure. Have secondary backup controllers which upon failure, which are used to control devices resuming functionality. This is accomplished through programming the BAS with event sequences triggered from alarms or flags noting the failure. Redundancy capabilities and feasibility are site specific. Ascertaining failure in boards, points, or devices is crucial to creating secondary measures to keep seamless processes going and resume with functions.   Error detection and correction with maintenance is often the best practice for preventing failure. Worn components are the leading cause of failure, followed by a lack of planning and consideration in the protection of electrical components through power surges or failures.   For the database, backups including automated backups for MSDE, SQL Express, and Full SQL are available. For further information on database backups and options, take a look at Microsoft SQL Management Studio. For Host Computer backups, look at adding a secondary computer which replicates the database and can capture transactions and messages should a failure with the primary host computer take place. Also work with the local IT department to keep machines up to date, safe, and clean of 3rd party applications which may interfere with integrity. Schneider Electric’s building management systems are designed such that building control continues even when controller to server communication is disrupted. The BMS server is home to a database of alarm and historical data, as well as system parameters and programs. When a server or its network connection fails, the collection of data from building controllers halts until the problem is resolved. For data critical applications, this solution provides an environment capable of preventing the data loss that results from these types of failures.  Although we do support its use with EcoStruxure Building Operation, Security Expert, Continuum, I/NET, Vista, Sigma, and I/A Series as a disaster recovery solution, we do not provide direct support for EverRun. Resolution For Open Mind High Availability Solutions guide please look at the following link; Open Mind High Availability Solution guide For everRun MX solution guide please look at the following link; everRun MX guide For ztC Edge solution guide please look at the following link; ztC Edge guide   

  Issue Identifying table sizes is useful when managing Security Expert databases Product Line EcoStruxure Security Expert Environment EcoStruxure Security Expert Microsoft SQL Server Cause Managing the size of a SQL database is crucial to system performance and archiving so understanding which tables are the largest provides needed data Resolution A report can be run from SQL Server Management Studio(SMSS) on the Security Expert and Security Expert Events databases to provide table sizes. Open SMSS Right-click on the database the report is needed (i.e. Security Expert or Security Expert Events) Select Reports> Standard Reports> Disk Usage by Table Scroll through and observe which tables contain the most data Examples: Security Expert DB Security Expert Events DB Print or Export the report to a file if necessary Print Export to Excel, PDF or Word Right-click on the data results and select Export Note: The disk usage built-in report was implemented in SQL 2008 and above. 

Issue What is the maximum size Card Number and Facility Code Number supported by Security Expert? Product Line EcoStruxure Security Expert Environment Security Expert Controller Security Expert Smartcard Reader Cause Adding a card to one of the Card number slots on the General tab of a User page allows for a maximum of a ten-digit facility code and ten-digit card number. Resolution The currently supported size of the Facility/Card number allows a maximum of a ten-digit facility code and ten-digit card number as can be seen below.  Facility/Card Number This Facility/Card number is entered when adding a credential to a User on the General tab of the User page. The size of the allowable facility code and card number can be increased beyond ten-digits by using Credential Types instead. Once the Credential Type has been created, it can then be used in the CREDENTIALS section for those users. For additional details on Credential Types see the AN 276 Security Expert - Configuring Credential Types - Integration Guide.

Issue Information is not clear on what the available intercom parts are and what each looks like. Product Line EcoStruxure Security Expert Environment SX-IPI SX-IPI-C SX-IPI-C-ES SX-IPI-C-EF Cause Old product announcements contain misleading information. Details are missing from current documentation. Resolution There are only three possible intercom part numbers that can be ordered. SX-IPI: This is the part code for the regular intercom with no camera SX-IPI SX-IPI-C: This is the part code for the regular intercom with camera SX-IPI-C SX-IPI-C-EF: This is the part code for the Flush Mount Kit for the SX-IPI-C intercom SX-IPI-C-EF front SX-IPI-C-EF back Note: There is no surface-mount kit (SX-IPI-C-ES) for either intercom, and the non-camera intercom (SX-IPI) does not have the option of a flush mount kit.

Issue Is it possible to setup more than one custom card format in Security Expert? Product Line EcoStruxure Security Expert Environment Security Expert Custom Card Formats Cause Have a requirement for two or more custom card formats. Resolution Currently, only one Custom Format can be configured.   It is possible to add a Secondary Format to a Reader port in Reader Expanders, but only one port can be setup with a Custom Format.    However, Credential Types have now been introduced with the release of Security Expert 4.3, which largely supersedes Custom Formats going forward and allows multiple custom card formats and even QR codes where required.  Please see AN 276 Security Expert - Configuring Credential Types - Integration Guide for more information on setting up Credential Types and Maximum number of Credential Types for more info on how many can be used.

Issue System changes made to a Security Expert server can cause the license to fail. Product Line EcoStruxure Security Expert Environment Security Expert licensing Cause When the SSN license is activated on the Security Expert server a hardware footprint of the server system is created and stored with the license activation. This ties the license to that specific machine, if the hardware footprint changes in the future this will break the license activation.   There may be additional system changes that trigger this but the ones we are aware of that will break the licensed hardware footprint are the following: A change of the Security Expert servers computer name. Normally when we see this the installer is attempting to activate/update the license from a Security Expert client machine instead of the Security Expert server machine. A change in the Network Interface Cards. Changing from a wired to wifi connection can potentially do this. If the server is installed on a virtual machine ensure that the Network Interface Card is assigned a static MAC address. Other hardware changes such as changing Hard Drives, CPU, Memory, Operating System or Motherboards. Resolution If the hardware footprint has changed, breaking the license activation, the SSN will need to be reset and an activation added. Contact your local support to add a registration to the license and clear the hardware profile. The installer will then do a License Update from the Security Expert server to re-activate the SSN.

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue A large number of alarms have accumulated and need to be acknowledged at one time. Product Line EcoStruxure Security Expert Environment Security Expert Client Cause A large number of unacknowledged alarms have been allowed to build up until the number is too large to acknowledge them manually one at a time. Resolution To acknowledge the alarms all at once, please raise a Support Case with your local Customer Care Centre and Product Support can assist with a remote session to apply a 'one time' SQL Query direct to the Security Expert Database. See Browsing slow in Security Expert Client for some methods to minimize unacknowledged alarms accumulating so rapidly in the database.

Issue What SQL collation does Security Expert use? Product Line EcoStruxure Security Expert Environment Security Expert server Microsoft SQL Server Cause Need to know the SQL collation used in Security Expert databases. Resolution The default collation is SQL_Latin1_General_CP1_CI_AS. This is the only supported collation and is set by default during installation and creation of the Security Expert databases.   Changing the collation can have serious ramifications to the stability and operation of Security Expert and is not supported.

Issue After configuration, Suprema readers are showing as offline in the Security Expert client. There are Security Expert Download Service events logged in the windows application event log. Cannot load DLL - LoadLibrary() Failed. Cannot load DLL event mesage Product Line EcoStruxure Security Expert Environment Security Expert Suprema biometric readers Cause Required DLL SecurityExpertSV2.ThirdParty.dll is missing from the installation folder. Some versions of Security Expert installer will not install this required DLL and the file need to be manually added. Resolution Check the Security Expert install folder, typically C:\Program Files (x86)\Schneider Electric\Security Expert, to confirm if the file SecurityExpertSV2.ThirdParty.dll is present. SecurityExpertSV2.ThirdParty.dll   If the file is not in the installation folder then it can be sourced from the integration guide ZIP package. AN 264 Security Expert - Suprema Biometric - Integration Guide contains the three DLL's required for the integration. Install the file by copying it into the installation folder, then restart all of the Security Expert services or restart the Security Expert server.

Issue When following the Enabling Transparent Data Encryption configuration steps in the SX-SRVR Security Expert - Client Server - Installation Guide, an error is seen running the supplied script to backup the certificate and encryption key.   Cannot find the certificate ‘TDECertificate’, because it does not exist or you do not have permission. Product Line EcoStruxure Security Expert Environment Security Expert Server Microsoft SQL Server Cause When copying the text from the SX-SRVR Security Expert - Client Server - Installation Guide the formatting contains a carriage return that stops the script from being able to be run in SQL. Resolution 1. Ensure the correct database is being run against by selecting it from the drop down in the SQL Server Management Studio menu bar or by adding "use master" as the first line in the script. 2. Create folders "c:\storedcerts" and "c:\storedkeys". 3. Fix the script by removing the carriage return breaking up the "TDE Certificate" file name.   The following script was successfully used to backup one file in each directory. use master; go BACKUP CERTIFICATE TDECertificate TO FILE = 'c:\storedcerts\TDE Certificate' WITH PRIVATE KEY ( FILE = 'c:\storedkeys\TDE Key' , ENCRYPTION BY PASSWORD = 'Hard_drive' ); GO  

Issue Schedules are not unlocking or locking doors according to the dates and times specified by the scheduled events Product Line EcoStruxure Security Expert Environment EcoStruxure Security Expert Cause The Security Expert system has a number of variables that schedules take into consideration when determining control of doors and if one of these isn't configured correctly, it will affect proper schedule function and control. Resolution 1. Verify that the schedule has the appropriate dates and times set 2. Check Holiday Groups and ensure that any calendar actions created to repeat each year have the same start and end date. Having different start and end dates with a repeat can cause the action to span long periods which can affect scheduled operations. 3.   

Issue When attempting to update the firmware on the SP-MRDM module, the update process fails, and the module appears offline with the fault LED activated. A "Module not responding" error message is displayed that indicates the module should be disconnected, and a utility used to restore the firmware.   Product Line EcoStruxure Security Expert Environment SP-MRDM SP-MRDM2 Cause The module has lost its firmware during a failed firmware update attempt, leading to the offline status and fault LED activation. Resolution To resolve this issue, follow these steps: Establish a connection to the SP-C controller using a web browser. Force a module update operation from the Application Software tab. Note that it may be necessary to check the "Skip Verification" checkbox during the update process.

Issue All Facility/Card Number fields are blank in Users that were transitioned into Security Expert from Continuum Product Line EcoStruxure Security Expert Environment Security Expert Server Continuum Database Transition Tool Cause Expected site code and card numbers from transitioned Continuum personnel objects to populate in the Facility/Card Number fields of the user objects in Security Expert but find all those fields are blank Resolution The site code and card number of personnel objects transitioned from Continuum using the Continuum Transition Tool will show up as credentials on the Security Expert side, this is by design. There is no need for any further changes, the credentials will work when presented to the reader.

Issue When transitioning users from Continuum to Security Expert, only about half of the user db is transferred. Product Line EcoStruxure Security Expert Environment Security Expert Controller Continuum Database Transition Tool Security Expert Data Sync Service Cause Continuum Database Transition Tool and Security Expert client must BOTH have the same configuration for "Allow Pin duplication". It could be either both unchecked or both checked Export history must be deleted when Continuum Transition Tool and Security Expert Data Sync services have stopped Resolution After a fresh transition and proper configuration ("Allow Pin duplication" in both CTT and SX client):   In the Continuum Database Transition Tool: Stop both Continuum Database Transition and Security Expert Data Sync services Delete export history Start both services again

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue In some recent versions of Security Expert there is unexpectedly high data usage on controllers connected by 4G modems.  Product Line Security Expert Environment Security Expert Server SP-C 4G Modem Cause This can be caused by the Security Expert regularly contacting all controllers to improve status reporting from the event service. Resolution If you are experiencing high data usage on metered (low data) connections, you can turn off these regular "check-ins". Be aware that this may increase the chance of controllers dropping offline.   Stop the Security Expert services.   In the File Explorer, navigate to the installation directory: ..\Program Files (x86)\Schneider Electric\Security Expert  Open SecurityExpertSV.exe.config. Files in this directory require administrator permissions to edit. You may need to open the file as an administrator using an application like Notepad++, or make a copy in a different directory to edit and replace the original.   Add the following code under the <configuration> node, between </configSections> and <microsoft.scripting>:  <appSettings>     <add key="gx:EnableUnknownStatusMitigation" value="false" /> </appSettings> Save the file.  Open SecurityExpertEvtSvr.exe.config.   Under the <appSettings> node, add the following code:  <add key="EnableControllerConnectionWatchdog" value="0" /> Save the file.  Restart the Security Expert services.  

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue SP-C has a valid gateway specified and it's not receiving communications Product Line EcoStruxure Security Expert Environment Security Expert Controller firmware .1248 (or higher) Security Expert 4.0.128 (or higher) Security Expert Controller w/ USB port 2.08.582 (or higher) SX-ELV-HLI-TK license to enable the integration USB to Ethernet adaptor dongle TKE Controller (American) v2r0 (only supported version) Cause It is a known issue. SP-C sends a heartbeat message to TKE but it is not being sent/received as a broadcast message. The controller still sends a heartbeat message to TKE but it is not sending it as a broadcast message with a destination of FF:FF:FF:FF:FF:FF. The gateway being valid causes it to send a Unicast message to the gateway itself (eg router) which does not pass it on to the rest of the network. (This is a known issue and has been logged with engineers). Resolution The workaround is to enable the USB Eth NIC on the SP-C and use: - The onboard NIC to connect to the Security Expert Server that requires a valid gateway to be set - The USB to ethernet adaptor (USB NIC) to connect to the TKE Network where we would set any gateway to avoid this bug Note: The USB NIC can only be configured when using OTIS elevator HLI type. The USB NIC hardcodes the required OTIS IP info to the Onboard NIC for connection to Security Expert. To enable Web UI: 1. In Security Expert, Go to Sites|Controllers|Configuration Tab. 2. Scroll down and expand the Elevator HLI section. Set Elevator HLI type to choose OTIS 3. Return to the General Tab, Scroll down and expand the Commands section and enter OTISUseUSBForMainComms = true 4. Save changes and wait for the programming to be downloaded. 5. Power cycle the SP-C. 6. Go to SP-C Web UI. The USB Eth adaptor will have the original IP. Configure both IP adresses 7. Once The NICs are configured, change the Elevator HLI type back to Thyssen Krupp, choose Cable Network type 8. Click Save and restart the SP-C.

Issue Scheduled event reports exported to PDF are using the US date time format not the local systems date time format. Report settings   In the below example the Windows system, and Security Expert, were both setup for Australia regional settings with a date format of dd/mm/yyyy. The automatic scheduled reports exported to PDF were showing the US date format mm/dd/yyyy. Report export before   Product Line EcoStruxure Security Expert Environment Security Expert event reports Cause The local Windows system date settings for Welcome screen and New user accounts are incorrect. Resolution In Windows navigate to Control Panel\Region Click on Change date, time, or number formats. A new window (Region) will pop up. Click the Administrative tab Click Copy settings... Enable the following options if not enabled already. Under Copy your current settings to tick Welcome screen and system accounts and New user accounts as shown in the image below. This will copy the Current users format over to the Welcome screen and New user accounts sections. Date format settings After making the above changes the PDF reports generated now show the correct date format of dd/mm/yyyy. Report export after

Issue Need to disable HTTP access for both SOAP web service and Web Client to allow HTTPS access only. Product Line EcoStruxure Security Expert Environment Security Expert Server Security Expert SOAP Web Service Security Expert Web Client Cause Need to disable HTTP access for enhanced cybersecurity Resolution Disable HTTP access for SOAP: Navigate to the SOAP IIS Directory, by default this is "C:\inetpub\wwwroot\SecurityExpertSOAPService" and open the "Web.config" file using a text editor such as Notepad or Notepad++. Scroll down to the <services> section and comment out the following two lines: <endpoint address="" binding="basicHttpBinding" bindingConfiguration="basicHttpEndpointBinding" contract="GXWCF2.IService1" /> <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />   To confirm that the HTTPS version of the service is accessible, paste the following link into the URL bar and replace the placeholders with the relevant values: https://<pcname>.<domainname>:<portnumber>/SecurityExpertSOAPService/service.svc. A web page will open with a message saying that the service has been created, this confirms SOAP is working correctly. Disable HTTP access for Web Client: Open Internet Information Server (IIS) manager.  Right click on the SecurityExpertWeb site and select "Edit Bindings".   Remove the HTTP site binding. Configure Web Client to connect to SOAP via HTTPs: Navigate to the IIS directory for the Web Client, by default this is "C:\inetpub\wwwroot\SecurityExpertWebClient". Go to the 'include' directory and open the file 'soap.connect.php" Modify the address on the $wsdl = to the HTTPS SOAP address, and change the port number as well. Additionally, 'localhost' does not work, and it must be changed to hostname with qualified domain name. See below image for reference: Once this change is made it should now be possible to browse to the web client over HTTPS.

Issue When attempting a login from a Security Expert client PC, it generates a "Network SSPI error" when using Windows Authentication and the machine name. Product Line EcoStruxure Security Expert Environment Security Expert 4.3.285.21 Multiple PC Security Expert Installation using Windows Authentication Cause The Network SSPI error is generated at the Client PC Login because of how Security Expert implements RFC1034 which stipulates how machine names are used for DNS. Resolution 1. Place a period at the end of the Security Expert Server machine while logging into the client only Security Expert PC Example: Using "WIN-B0DOGEHESMN" as the server name will not work Using "WIN-B0DOGEHESMN." will work Notice this works because of the "." at the end Here is a graphical example of logging in with the correct server name by adding the "." 2. The other workaround would be to use the IP address of the server instead of the fully qualified domain name (FQDN). *Note* IT departments typically prefer the use of the FQDN name

Issue The network card is not working on the PC.  Product Line Andover Continuum, EcoStruxure Access Expert, EcoStruxure Building Expert, EcoStruxure Building Operation, EcoStruxure Security Expert, Satchwell BAS & Sigma, Satchwell MicroNet, TAC IA Series TAC I/NET, TAC Vista Environment PC Network Interface Card Cause Require a method to test the network card. Resolution Assuming you have the correct protocols loaded:- Open up a command prompt and type ‘ipconfig’(1) then press enter to get a list of the available network cards. Find the specific network card by name (2) Record the IP Address (3) assigned to the card, e.g. 192.168.5.90 If the card is unplugged (4) connect a network cable and start back at step 1 If the network card does not appear in Device Manager check the drivers are correctly installed for the card and when installed correctly start back at step 1. If the network card still does not appear it could be disabled.  In Network Connections right click the adaptor and select Enable (5) and start back at step 1. After these steps if the network card still does not appear when running ipconfig it is most likely damaged. If/when an IP Address is successfully obtained open a Command Prompt and type ping followed by the IP Address of the card, for example ping 192.168.5.90 (1). A functioning card will respond with 4 successfully replies (2) and the associated statistics (3) As additional information a good first step would be to "ping 127.0.0.1". This will not test a network card but indicates that the TCP/IP protocol is installed and functioning on the host PC.