Building Automation Knowledge Base

Issue Is it possible to setup more than one custom card format in Security Expert? Product Line EcoStruxure Security Expert Environment Security Expert Custom Card Formats Cause Have a requirement for two or more custom card formats. Resolution Currently, only one Custom Format can be configured.   It is possible to add a Secondary Format to a Reader port in Reader Expanders, but only one port can be setup with a Custom Format.    However, Credential Types have now been introduced with the release of Security Expert 4.3, which largely supersedes Custom Formats going forward and allows multiple custom card formats and even QR codes where required.  Please see AN 276 Security Expert - Configuring Credential Types - Integration Guide for more information on setting up Credential Types and Maximum number of Credential Types for more info on how many can be used.

Issue System changes made to a Security Expert server can cause the license to fail. Product Line EcoStruxure Security Expert Environment Security Expert licensing Cause When the SSN license is activated on the Security Expert server a hardware footprint of the server system is created and stored with the license activation. This ties the license to that specific machine, if the hardware footprint changes in the future this will break the license activation.   There may be additional system changes that trigger this but the ones we are aware of that will break the licensed hardware footprint are the following: A change of the Security Expert servers computer name. Normally when we see this the installer is attempting to activate/update the license from a Security Expert client machine instead of the Security Expert server machine. A change in the Network Interface Cards. Changing from a wired to wifi connection can potentially do this. If the server is installed on a virtual machine ensure that the Network Interface Card is assigned a static MAC address. Other hardware changes such as changing Hard Drives, CPU, Memory, Operating System or Motherboards. Resolution If the hardware footprint has changed, breaking the license activation, the SSN will need to be reset and an activation added. Contact your local support to add a registration to the license and clear the hardware profile. The installer will then do a License Update from the Security Expert server to re-activate the SSN.

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue A large number of alarms have accumulated and need to be acknowledged at one time. Product Line EcoStruxure Security Expert Environment Security Expert Client Cause A large number of unacknowledged alarms have been allowed to build up until the number is too large to acknowledge them manually one at a time. Resolution To acknowledge the alarms all at once, please raise a Support Case with your local Customer Care Centre and Product Support can assist with a remote session to apply a 'one time' SQL Query direct to the Security Expert Database. See Browsing slow in Security Expert Client for some methods to minimize unacknowledged alarms accumulating so rapidly in the database.

Issue What SQL collation does Security Expert use? Product Line EcoStruxure Security Expert Environment Security Expert server Microsoft SQL Server Cause Need to know the SQL collation used in Security Expert databases. Resolution The default collation is SQL_Latin1_General_CP1_CI_AS. This is the only supported collation and is set by default during installation and creation of the Security Expert databases.   Changing the collation can have serious ramifications to the stability and operation of Security Expert and is not supported.

Issue National Weather Service Data Showing Stale Product Line TAC IA Series Environment I/A Series N4 Enterprise Server I/A Series N4 Jace 8000 / 9000 Cause Due to recent changes with the National Weather Service, the current weather information displayed through Niagara is showing as “Stale” when using the NWS Weather Provider in the Niagara Weather Service. Resolution The Current Conditions “Last Update” time may be null or a current date, and the “Observed” time may be null or a date in the past. Current Weather View: Property Sheet:   This issue is being addressed in future releases. In the meantime to manually correct this behavior, make the below manual updates to the BNwsWeatherProvider components in the station: 1. Go to the Property Sheet view on the BNwsWeatherProvider component, click the ‘Slot Details’ button, then click the ‘Hidden Slots’ button to display the hidden slots. 2. Click the Flags for the “Conditions Server” slot which opens the “Configure slot flags” dialog.  Clear the checkbox for the Hidden slot flag, then click the OK button to clear the Hidden slot flag.  3. The “Conditions Server” slot should now display “(none)” in the Flags column.  4. Click the “Slot Details" button to toggle back to the default Property Sheet View.  The “Conditions Server” property is configured with the default value of “www.weather.gov”. 5. Update the “Conditions Server” property to “forecast.weather.gov” and save the change. 6. Invoke the “Update Weather Report” action on the Weather Report component and verify the Current data updates and no longer indicates a Stale status.              

Issue When trying to run webLauncher.exe, an unknown error occurs. An error popup with a red X appears, and the Application will fail afterwards.   Product Line TAC IA Series Environment I/A Series N4 Enterprise Server I/A Series N4 Jace 8000 / 9000 Cause With a recent migration to Web Launcher in 4.14 (launcher version 24.14.0.2), a bug has been reported in new installations. Any computer that is missing a folder named niagara storing the launcher's configuration info will encounter this issue. The folder is located, by default, in the following spot: C:\Users\<Windows username>\AppData\Local\niagara Resolution Go to the location of the launcher executable, and there will be a file named webLauncher_debug.exe. Running this once will create the necessary directory and the Web Launcher will be able to function normally. The default location of the executable is: C:\Program Files\Niagara Web Launcher This issue is known internally at Tridium as defect NCCB-68211, and it will be resolved with the release of Web Launcher 24.14.0.3 and later releases.

Issue When attempting to save & deploy a function block program using Modernized Programming, the following errors are seen: EBO 2022 - Deploy program error: The program was not deployed! (Error Code - 1073740940) EBO 2024 - Deploy program error - Invalid data "Empty binary file' Invalid data  Product Line EcoStruxure Building Operation Environment EcoStruxure Building Operation WorkStation EBO 2022 EcoStruxure Building Operation WorkStation EBO 2024  Function Block Programs (Builder for Function Block) Cause Related to known issue Modernized Programming Builder program error during deploy This is when the TEMP / TMP User variable folder paths contain a space; this can be edited in the Environmental Variables.  Resolution Edit the TEMP and/or TMP paths so that they do not contain any spaces.  To edit the Environmental Variables, follow these steps:  1. Click on the Start Menu button located at the bottom-left corner of your screen. In the search bar, type "environment variables" and press Enter.  Click on the "Edit the system environment variables" option from the search results. This action will open the System Properties window, which contains various tabs and settings for your computer. In the System Properties window, click the "Environment Variables" button located at the bottom right. Clicking this button will open another window specifically for managing environment variables.  In the Environment Variables window, under the "User variables" section, "Edit" the path that contains any "spaces".  These paths can be located anywhere on this PC.  User variables apply only to your account, while system variables affect all users on the computer. Choose accordingly, and then add or edit variables as needed. Once you have completed these steps, your new or edited environment variables will take effect.  Restart WorkStation, and the program should now deploy successfully.   

Issue Some BACnet devices advertise support for services such as RPM, COV, etc but malfunction when the service is used. An example of such a device is the Johnson Controls TEC2627VVT which advertises support for RPM but fails to upload its objects when SBO uses RPM to get the object list. Product Line EcoStruxure Building Operation Environment BACnet Automation Server Enterprise Server Cause Some BACnet devices with inconsistent protocol implementation cannot process BACnet services such as RPM, COV, etc. Resolution Feature Supported in Version <no-rpm/> 1.8.1 and higher <no-cov/> 1.8.1.23701 and higher <ignore-unhosted-devices/> 3.2.3.9005 and higher (*)   Users can create a rule under the BACnet interface to configure SBO not to use the service. Some rules are global, while others can be for specific BACnet devices. For particular BACnet devices, they are specified by 'Vendor Identifier' and 'Model Name,' which need to match exactly as shown in that device's Properties - Advanced Tab.   Ensure you have installed the version that supports the feature you want to change. Setup file using the no-rpm rule. Use a text editor like 'Notepad' to create a text file or download the same file below. Enter the device's vendor ID (5)  and model name (TEC2627VVT) followed by the rule (no-rpm) using the format seen in the screenshot below. Save the file to the desired location on the PC with a name aiding later identification. Under the BACnet interface, create a new 'Document' object in the 'Application' folder. NOTE: The object MUST be named 'service_blacklist' in all lowercase. Click 'Next,' import the text file created in step 1, and save the 'Document' object. Restart the Server  Once the device is on the block list, SBO will not send 'readPropertyMultiple' requests to the device using only individual 'readProperty' requests. Add the service_blacklist to the EBO Server. Add the no-cov tag if you would like to block that service for this device:  Extended for multiple devices from different vendors simultaneously using this example for reference.   One can add a global rule using this syntax to ignore unhosted devices. * NOTE: It is recommended to remove <ignore-unhosted-devices/> after upgrading to EBO 4.0/2022 and higher because this feature is supported in the BACnet Interface Properties and BACnet Device Discovery view. Device Discovery for BACnet Controllers and IO Modules (se.com)  Once the Server has restarted, check the trace.log file and search for service_blacklist, there should be entries similar to this. 

Issue After configuration, Suprema readers are showing as offline in the Security Expert client. There are Security Expert Download Service events logged in the windows application event log. Cannot load DLL - LoadLibrary() Failed. Cannot load DLL event mesage Product Line EcoStruxure Security Expert Environment Security Expert Suprema biometric readers Cause Required DLL SecurityExpertSV2.ThirdParty.dll is missing from the installation folder. Some versions of Security Expert installer will not install this required DLL and the file need to be manually added. Resolution Check the Security Expert install folder, typically C:\Program Files (x86)\Schneider Electric\Security Expert, to confirm if the file SecurityExpertSV2.ThirdParty.dll is present. SecurityExpertSV2.ThirdParty.dll   If the file is not in the installation folder then it can be sourced from the integration guide ZIP package. AN 264 Security Expert - Suprema Biometric - Integration Guide contains the three DLL's required for the integration. Install the file by copying it into the installation folder, then restart all of the Security Expert services or restart the Security Expert server.

Issue When a very long path is included in a request to the SmartConnector RESTful EWS gateway, such as when attempting to acknowledge an alarm with a long path, the gateway returns the error "HTTP Error 400: The request URL is invalid."   <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"> <HTML><HEAD><TITLE>Bad Request</TITLE> <META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD> <BODY><h2>Bad Request - Invalid URL</h2> <hr><p>HTTP Error 400. The request URL is invalid.</p> </BODY></HTML> Product Line EcoStruxure Building Operation Environment SmartConnector Cause In Windows, the default maximum number of characters in a URL path segment (the area between the slashes in the URL) is 260 characters. When the object path, after double URL encoding, exceeds 260 characters, it triggers error 400. Resolution To resolve this issue, follow these steps: Add a registry key "UrlSegmentMaxLength" to the following path in the SmartConnector PC registry: Path: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters Name: UrlSegmentMaxLength Type: DWORD Value: 0 - 32,766 (e.g., set the value to 1000) After adding the registry key, restart the HTTP services or restart the PC. Detailed instructions for this process can be found in the "Http.sys registry settings for Windows" guide on the Microsoft Learn website. Http.sys registry settings for Windows - Internet Information Services | Microsoft Learn

Issue When following the Enabling Transparent Data Encryption configuration steps in the SX-SRVR Security Expert - Client Server - Installation Guide, an error is seen running the supplied script to backup the certificate and encryption key.   Cannot find the certificate ‘TDECertificate’, because it does not exist or you do not have permission. Product Line EcoStruxure Security Expert Environment Security Expert Server Microsoft SQL Server Cause When copying the text from the SX-SRVR Security Expert - Client Server - Installation Guide the formatting contains a carriage return that stops the script from being able to be run in SQL. Resolution 1. Ensure the correct database is being run against by selecting it from the drop down in the SQL Server Management Studio menu bar or by adding "use master" as the first line in the script. 2. Create folders "c:\storedcerts" and "c:\storedkeys". 3. Fix the script by removing the carriage return breaking up the "TDE Certificate" file name.   The following script was successfully used to backup one file in each directory. use master; go BACKUP CERTIFICATE TDECertificate TO FILE = 'c:\storedcerts\TDE Certificate' WITH PRIVATE KEY ( FILE = 'c:\storedkeys\TDE Key' , ENCRYPTION BY PASSWORD = 'Hard_drive' ); GO  

   

Issue What 10k Thermistor sensors are compatible with the I/A Series MNL and MNB families of controllers? Product Line TAC IA Series, Andover Continuum Environment I/A Series LON Controllers (MNL-xxxxx) I/A Series BACnet Controllers (MNB-xxxxx) Continuum 10K T3 Sensors Cause Specification information Job spec requires a specific family of sensors.  Need to know how to compare the TC curves. Resolution Compatible sensors that have a built-in 11k shunt resistor include the TS-5711-850, TS-57011-850, TS-57031-850, and TSMN-90110-850 Series.  NOTE: These sensors are no longer available for purchase. The TW2XAXK is the replacement Any sensor that matches resistance to temperature curve for a 10K Thermistor Type G (U.S.Sensor), Type 9 (Dale/Vishay) or Type III (ACI Series AH) can be used with the I/A Series MNL and I/A Series MNB series controllers, provided that a 11k ± 0.1% 1/8 watt resistor is wired in parallel with the sensor. The input has a range of -10 to 135 °F (-23.3 to 57.2 °C) with an accuracy of ±1% of span.   This includes the Continuum 10K T3 sensors.  The table below shows that the resistance in its normal operating range is within a few ohms of the TSMN non 11K shunted sensors.  The Continuum sensor can be used with a parallel 11K ohm resistor. The full temperature / resistance table for the US Sensor 10K Thermistor R-T Curve Type G sensor can be found here.  Please note that the controller may not be able to use the full temperature range shown in the table.    

  Issue Packets from the EBO onboard packet capture utility are not ordered correctly. In the example below it can be seen that the sequence number of the ACK comes before the REQ despite the timestamp for the ACK being later than the REQ.   Product Line EcoStruxure Building Operation Environment Building Operation Workstation SpaceLogic Server   Cause Out-of-order packets are quite normal on a TCP level. Earlier packets can arrive later due to buffering and other reasons. Applications are able to buffer these messages and rearrange them before they are written to the application.   Since the standard Wireshark pcap utility that EBO uses to capture packets does not sort packets in a batch by time stamp before delivering them to the capture file it is subject to the same irregularities that we would see on any OS.   Resolution This is a common enough issue that Wireshark includes a command line utility named reordercap that can fix packets that can't have been on the network in that order (like an answer being sent before you see the request for it).   In the example below the utility has run through a capture and reordered items and saved the file as a new file.     See the Wireshark reordercap help topic for further information on this utility.

Issue Any third party BACnet client can initiate an EBO backup. Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Building Operation Automation Server Cause As of EBO 2023 (5.0.2.109), EBO's BACnet backup operation requires no password which means any BACnet client with the EBO server BACnet interface's device ID can initiate an EBO backup without any restrictions. Any such backup can be identified by looking at the backup description in EBO, the backup will explicitly indicate that it was generated by third party BACnet Workstation.   Resolution EBO 2024 (V6.0.1) or higher: In BACnet Interface basic tab, "Restrict backup and restore service" can be set to Yes to ensure that third-party BACnet clients cannot perform a BACnet backup or restore on the EcoStruxure BMS server. Refer to: BACnet Interface for an Automation Server – Basic Tab and BACnet Interface for an Enterprise Server – Basic Tab   EBO 2022 (4.0.4CP2 or higher) and EBO 2024 (V5.0.3 or higher): A rule can be added to the BACnet service_blacklist to disable BACnet backup service. See https://community.se.com/t5/Building-Automation-Knowledge/BACnet-RULES-implementation-to-disable-features-such-as/ta-p/839 for details on how to create service_black list.   Use the following syntax to create a rule that restricts BACnet back up initiated by 3rd party BACnet client on the EBO server.   <blacklist> <global> <restrict-backup-service/> </global> </blacklist>   Any BACnet client requesting backup from EBO server configured with the above rule will be presented with error similar to screenshot below.

Issue Continuum NetController fails when a port scanning tool runs a network port scan on the ethernet network where the controller is connected. Some of the controller failures that have been reported to Product Support Services include controller scan locked, controller resetting, hanged, stuck in bootloader etc. In some cases the controller may be running but exhibiting very strange symptoms due to its tasks scheduling being disturbed by the scanning traffic and/or due to memory corruption. Product Line  Andover Continuum   Environment Continuum CX Gen 1 Continuum Net Controller II Continuum ACX 2 Controller Continuum ACX 4 Controller Continuum bCX4040 (BACnet) Continuum bCX4000 (Router) Continuum bCX9640 (Infinet)   Cause The legacy Continuum controller's network stack is not able to handle some of the packets generated by network scanning tools, most such tools explicitly point out that older internal systems may not be able to handle the port scanning traffic and may fail during the process.  The controller error log may show some variation of the following errors...   219 I 08/10/2024 13:14:53.35 0xbadd0018 0x00002500 0x001783f0 0x40602004 0x0017eeb4 Reset (Spurious interrupt)   4914 I 09/14/2022 09:00:54.00 0xbadd0002 0x00002600 0x02001bd4 0x48082600 0x020ffbb8 Reset (access error) Resolution The Continuum NetControllers are now legacy systems no longer in active development, therefore, the only known solution is to add  the controller's IP address to the tools white list so that no port scanning packets are directed to the controller.   It is important to note that NONE of the Continuum NetControllers listed above use Windows or Linux based OS, this makes them less vulnerable to the typical hacker attacks.    Andover Continuum is a legacy Schneider Electric product. We strongly encourage upgrading your system to the more secure and feature-rich platform, EcoStruxure Building Operation. 

Issue WorkStation can't connect via secure communication (HTTPS) to EBO server, although it can connect via non-secure communication (HTTP). Cloud connectivity also fails. WebStation can still connect via HTTPS. Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Building Operation Enterprise Central Building Operation WorkStation Cause TLS V1.3 is supported in Windows 11 and Windows Server 2022 or later. Enabling it in earlier Windows versions is not support it can lead to problems, as explained in Protocols in TLS/SSL (Schannel SSP) - Win32 apps | Microsoft Learn Resolution Do not enable TLS V1.3, If the installed Windows version doesn't support it (Windows 10 and Windows Server 2019 or earlier), or disable it if it is already enabled by following the below steps:  Open Windows Registry Editor, by writing "regedit" in Start menu.  Goto registry path "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client" Make sure that "Enabled" is set 0, and "DisabledByDefault" is set to 1, this will disable TLS V1.3 for clients.  Restart WorkStation.   For more information, refer to: Transport Layer Security (TLS) registry settings | Microsoft Learn Warning! Improper use of regedit may damage PC’s operation.

Issue Define I/A Series AX/G3/N4 software compatible with a specific version of Windows Product Line TAC IA Series Environment I/A Series (Niagara) AX/G3/N4 software Windows 32-bit and 64-bit operating systems Cause Only specific releases of the I/A Series AX/G3/N4 software have been certified compliant with specific versions of the Microsoft Windows software.  Resolution The following chart details the version compatibility between the releases of the I/A Series G3/N4 software and various versions of the Microsoft Windows Operating System software.   Refer to Supported Operating Systems for Niagara 3.7 and earlier (June 2016) Refer to Supported Operating Systems for Niagara 3.8 (July 2020) Refer to Supported Operating Systems for Niagara 4.1, 4.2, and 4.3 (September 2019) Refer to  Supported Operating Systems for Niagara 4.4 and higher (September 2024)   For the larger Schneider Electric BMS offering please refer to Software and Firmware compatibility matrix for older versions of I/NET, Vista, Andover Continuum, Satchwell Sigma, I/A Series, and StruxureWare Building Operation

Issue NiagaraNetwork point subscriptions get stuck constantly reporting 'Pending Subscribe' or are 'unsubscribed'. Product Line TAC IA Series Environment I/A Series Jace (N4/AX) I/A Series Enterprise Server (Niagara Framework N4/AX) Cause Various configuration issues between the Jace and Enterprise sever. Resolution Troubleshooting 'Pending Subscribe' or 'Unsubscribed' (N4 or AX): Performing 'Manual Disconnect' on the Niagara Station 'Client connection' may clear this state. Perform 'Manual Disconnect' on each side of the Niagara Network connection between the two stations having issues. It is possible that one side of the Fox connection might show connected on the 'Client Connection' and the other side shows disconnected for the associated 'Server Connection'. The manual disconnect clears this state. Check for multiple FOX services. Typically there is only one service, though there are use cases for more than one. Sometimes the FOX service is mistakenly duplicated and both services then have the same ports, which is incorrect and causes problems. Use the ProgramService (Batch Editor) to look for 'custom object', 'fox', 'foxService'. Either delete the extra service(s) or edit the ports so to remove any conflicts. Duplicate station names can cause fox problems. Look at station 'Spy', 'fox', 'log index' to see all the fox connections. Look for duplicate station names that have different IP addresses. Duplicate station names can cause stations to keep getting disconnected as each station fights to be connected. Duplicate stations can be caused when an integrator connects their engineering laptop to a network and they have stations running on the laptop that were engineered for that job, thus resulting in more than one instance of a station running at once. In rare instances stations were installed multiple times at a site and not renamed before installation into the next platform. Fox connection getting dropped. Either network issues on the LAN or duplicate stations. Or denial of service attack on the Supervisor. Wireshark can help diagnose LAN problems or have the IT person on site look at your station IP addresses.  Try increasing the Request Timeout and the Socket Option Timeout in the Fox Service. Make Fox wait longer before timing out on messages. It is not typically needed to modify these defaults.  Regarding AX and N4 mix, make sure when an AX is connecting to an N4, the user in the N4 station, being used by the AX, must have the AXDigestScheme for the authentication scheme.  The Cipher Suite Group setting in the Fox Service must be set to 'Supported' when connecting any AX version prior to 3.8u3 (3.8.311) to an N4 station via NiagaraNetwork. Make sure Provisioning is correctly configured. If not being used, remove it. This might be an N4 only problem, but there have been instances encountered where a station that was converted from AX to N4 was having the 'Pending Subscribe' issue due to NiagaraProvisioning being only partially configured. Provisioning not correctly configured will cause the 'Pending Subscribe' problem  

Issue When troubleshooting server issues, it can be helpful to look at the logs that are recorded within the Automation Server. Product Line EcoStruxure Building Operation Environment Building Operation Automation Server  Building Operation Automation Server Premium Building Operation Automation Server Bundled Cause Within the Automation Server logs are many records that are logged as a part of normal operations and unexpected events. Resolution Automation Server: Automation Server error logs can be retrieved using Workstation, Device Administrator, or WebStation. Device Administrator can be used in case of crash information is required, ex. dump files, or if the Automation Server is not accessible via WebStation or WorkStation. Workstation: Connect to EBO system with EBO WorkStation. Select the target Server  Expand the System folder Expand the Modules folder Expand the Trace folder and see Trace Settings For EBO 3.1 or higher, Double-click both Trace Log and System Log to open separately  For EBO 3.0 and lower, including SBO 1.x Right-click in Trace Settings Select Trace Settings in the menu Select Get System Log Repeat to select Get Trace Log  Device Administrator: Follow this WebHelp article: Getting Automation Server Debug Information If requested to retrieve a core dump, use this method to retrieve the Device Administrator Debug Information zip file. Then perform the following to make sure the zip file contains a core dump with a relevant timestamp for the event being investigated. Open Zip Open the folder containing the server name and IP address Open Server folder One should see file(s) with filename in this format core_dump_<Serial Number>_nsp_servers_<Timestamp>.tgz WebStation: NOTE: The steps below are no longer valid for EBO 2022 and above. See the Webhelp Topic on collecting these logs from Automation Servers: Viewing and Downloading Automation Server Log Files. This process is now similar to that described above for WorkStation.   Credentials used to log in must be a member of a group that allows the policy of Web Configuration: Allow members to access Automation Server Web Configuration. Launch a web browser that is compatible with the installed EBO version as mentioned Webstation Specification Sheet. Type the IP address of the automation server to open the Webstation. Log into the Automation Server.                   Once logged into the Automation server, go to the Settings menu in the top right corner and click on Device Configuration. Click on the Server Log tab to view the automation server's log files. To save a copy of the log to your PC, click on the Get all log files link. The log files are compressed into a zip file and exported to downloads folder. Enterprise Server and Enterprise Central: For more information, check this article: Error logs from the Enterprise Server and Enterprise Central - Communities