Building Automation Knowledge Base

Issue When trying to change the Debug Mode from False to True for enhanced Troubleshooting the setting is returning back to False and no extra Debug Data is generated. Product Line EcoStruxure Building Operation, Other. Environment Web Services Cause For troubleshooting of the Web Service Handler application, a Debug Mode can be enabled by editing the settings.xml file in the installation directory and changing the Debug Option from False to True.  The Service needs to also be stopped before the change is made and saved.     However, users can find that even when the Service is stopped and the Debug Option is changed and saved,  as soon as the Service is restarted the Debug setting reverts back to False and no Debug Data is generated.  Resolution If users are using the Configuration Dialogue to Stop the Service and then leave that Dialogue open it locks the settings.xml file and the change to Debug Mode cannot be saved.     If all Dialogues are closed before the settings.xml file is changed/saved, the Debug Mode change to True is successful and a new debug.log file is generated in the installation directory as soon as the Service is started.

Issue The connection to the MQTT broker is not working and the MQTT client in the ES is offline following an upgrade from EBO 2022 to EBO 2023. The following error message can be seen in the ES trace.log: nsp.csc.mqtt.MqttNetwork Connection failed: TCP/TLS connect failure  Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Building Operation Enterprise Central MQTT integration Cause The reason for the connection issue is that the client certificate that is used is (self-signed) signed using SHA1. Since OpenSSL 3.0 this is forbidden at the default security level (which EBO is using) due to it having less then 80 security bits. See text in picture below taken from https://www.openssl.org/docs/man3.0/man3/SSL_CTX_set_security_level.html The default level is 1 and that is the setting EBO is using. Resolution Change the client certificate to one not using signing signature MD5 or SHA1. The certificate signature can be checked using the following OpenSSL command: openssl x509 -in cert.pem -noout -text Below is an example of how to use OpenSSL to check the certificate signing signature on the client certificate:

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue Seeing multiple losses of functionality starting to occur, such as controllers going offline, browsing with the client being slow, reports failing to run and events not being logged. Product Line EcoStruxure Security Expert Environment Security Expert SQL Server Cause In SQL Server the SecurityExpertEvents database has a very large LOG file ( hundreds of gigabytes) resulting in degraded performance in SQL and Security Expert.   The Recovery model of the SecurityExpertEvents database is set to FULL and the database has not been maintained. When using the Full recovery model, regular backups of the transaction log should be performed to prevent the transaction log file size from growing out of proportion to the database size. Recovery model full New user databases are created with the same recovery model as the model database. The default recovery model for the model database depends on the edition of SQL Server you have installed. Editions targeted at test and development environments (SQL Server Express) set the recovery model of the model database to SIMPLE. Other editions set the recovery model of the model database to FULL. Resolution Reduce the size of the log file and prevent it from getting too large again by changing the recovery model of the database from FULL to SIMPLE. The databases are then shrunk to free up drive space.   Refer to the following steps: Take a backup of both the SecurityExpert and SecurityExpertEvents databases and store them in a safe location Change the Recovery Model of the SecurityExpertEvents database from Full to Simple in SQL Server Management Studio. To do this, right-click on the SecurityExpertEvents database and go to its properties. Select 'Options'. Change the Recovery Model setting to Simple. Recovery model simple Right-click on the SecurityExpertEvents database and select Tasks > Shrink > Files Shrink files In the Shrink File - SecurityExpertEvents window, change the File type to Log. Shrink log file Click OK Repeat steps 2-5 for the SecurityExpert database   It is recommended that regular scheduled backups be configured when using the SIMPLE recovery model. In SIMPLE recovery mode, changes since the most recent backup are unprotected.

Issue After configuring a fire alarm using the Emergency Egress programming in AN 208 Security Expert - Emergency Egress - Integration Guide, doors that have a Bond sense input configured do not show the same status as a door without a Bond sense input when there is a fire alarm. Door input options settings Instead of showing the expected "Unlocked By Fire Alarm" status the doors with Door sense inputs show "Not Locked". Product Line EcoStruxure Security Expert Environment Security Expert SP-C SP-C-IP SP-ACX SP-AC1 Cause The Bond sense input was not wired up and did not show the actual lock output status. This input is used to detect the position of the door lock. When it is opened the door status will change to "Not Locked", this was overriding the "Unlocked By Fire Alarm Status". Resolution Check the wiring of the Bond sense input and ensure it correctly indicates the position of the door lock.

Issue The System License Information screen has a lot of useful data on the status of licenses in the EBO system. Is there a way to export or screenshot the entire System License Information page? Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Central Building Operation Enterprise Server Building Operation Automation Server Cause Unable to save or export the System License Information screen Resolution There is no option to print or export the Control Panel System license Information screen. It is possible to get a reasonably close facsimile by viewing the LicenseStatus item in System>LicenseManager and adding columns for Required Licenses, Checked Out Licenses, Installed Licenses, Available Licenses, and License Violation.   This can then be Exported in XLSX format for future reference or if required by Product Support  

Issue Controllers are online but events are not being logged. No live event updates are showing in the All Events Status Page or being logged to the SecurityExpertEvents database. Product Line EcoStruxure Security Expert Environment Security Expert Client Cause Below is a list of the current causes that may contribute to the issues described: The Event Server settings are not configured correctly. The Firewall is blocking required communications ports. The default Save Events action has been removed. The All Events event filter has an Event Type or Record Filter attached to it which is filtering out events. Resolution For Cause 1 Confirm that the Download Server, Event Server, and Controllers are configured correctly. Check all of the items in this Troubleshoot Security Expert Controllers showing offline article. For Cause 2 Check that any Firewalls are disabled or setup to allow all required ports through. See SX-SRVR Networking Guide for Administrators for further details. Also, confirm that any Anti Virus software is also not blocking required ports or Security Expert applications. For Cause 3 In Security Expert go to Events > Actions and confirm that there is a Save Events action configured for the Site. The action will look like what is shown below and can be manually created if it is not present. Figure 1 - Save Events Action For Cause 4 Ensure that the Status Page view being used is able to see those events and is not filtered in any way. Under Events > Event Filters check that the All Events Event Filter is not filtered and it is set to show all events and records. By default, this is not filtered and not able to be changed. On the Event Types tab ensure "Include All Event Types" is selected. Figure 2 - Event Filter Event Types On the Records tab ensure there is no record filter attached. Figure 3 - Event Filter - Records Then check that the All Events event report is using the All Events filter for All Record Groups.  Figure 5 - Event Reports All Events Note that a fix for the database is available.  Please contact your local support to verify and provide a fix for this issue.

Issue TAC Webstation is very slow open graphics and browsing folders. Especially if the graphics and folders are located on other TAC Vista servers than where the Webstation server is installed. Product Line TAC Vista Environment TAC Vista 5.1.5 TAC Vista Webstation 5.1.5 Cause The problem is the red icon which looks like an exclamation sign placed to the far right in the bar above the graphic or the folder page. If the mouse is placed on the icon, you will see the amount of alarms and disabled alarms in the system. To gather this information, the alarms, and disabled alarms in the system is what takes time. Resolution This problem is fixed in Hotfix 83 for Vista 5.1.5 and fixed in the Vista 5.1.7 release.

Issue How to Prepare a Server for Access Expert Premise Software Product Line Access Expert V2 On-Premise ONLY Environment Windows Server 2012 and above Cause There is no documentation on how to prepare a server for a Premise Install. Resolution In order to do this there are several pieces that needs to be followed on how to configure it correctly. First step is to install the server software, in this case Windows Server 2012: Configure the local server Add Roles and Features, Click Next Server Selection, select a server (should be the local machine) Click Next a few times, to complete this part Scroll down to the bottom and select WebServer IIS and add all features Click Next to complete this part Click on .net Framework 4.5 Features Check the box for ASP.net 4.5 Expand WCF Services Click on HTTP Activation, Add Features Scroll down to Message Queuing Expand and scroll down to SMTP Server - Add Feature, Click next a couple of times to install Once completed, Close and Exit Installing SQL Server Open media where software is located and launch the installer Select the option to Install a new instance and click Next Select Install DB Engine and Mgmt Tools, click Next Select Default instance, click Next Use same service accounts, click on Server Configuration Tab Add - License Administration as a Group Select the Data Directories Tab, change where the data files are stored by default Create new Folders for SQL Data, SQL Logs Change Directory Paths as well for Temp Create new folder for Backup Click on next and Install Once finished, close out to complete the install. Enable sysadmin in SQL for NTAuthority Installing Keep Here is a link of a video that goes through this process as well. Premise Installation of Keep for Access Expert Download Keep By Feenics software from the Software Downloads Tab on the Feenics training site http://www.feenics.com/training/courses/technical-certification/ Browse to the location and launch Keep Installer, click on Next When complete, Test Db Connection, once it passes, click on Next Make sure all elements are selected, click on Next to install Launch the Keep Instance Management, click on Connect Connect to the local Host Give the site a name that will used for the instance (if this name is changed, it would require a new instance license key to be generated) Give a url to the name db name with username and password (admin/admin) Change the path for file location and DB Log location from earlier steps Save configuration and Close On the Web Browser, Go to Tools - IIS Manager Add a new Binding, check the Box for "Do not show messages" Delete the default website Click on created website and select Bindings Click on Add - use same name in original browser Start IE Browser (url) created earlier Load license from Activation Code and Activate Log in to the system. Host File If the browser does not start and fails to open the page, then modify the Host File to contain the IP address of the server as well as the URL of the instance Go to C:\Windows\System32\drivers\etc hosts Modify the file by entering the IP address of the server as well as the URL Save and close. Open up the page again and it should allow the application to be started. For V3 On-Premise Installation Instructions, see the following link: https://ecoxpert.se.com/search?documentUUID=846b8347-4412-42ad-a983-53ef97bb5cc4&title=AccessXpert%20On%20Premise%20Deployment%20Walkthrough%20v3.pdf  

Issue The duplex mode is not specifically mentioned in the controller documentation. Product Line EcoStruxure Security Expert Environment Security Expert Ethernet TCP-IP SP-C, SP-ACX, SP-ACX-V2, SP-AC1, SP-C-WEB Cause The documentation describes the type of ethernet supported by the controller but not specifically the duplex modes supported. The communication between the Security Expert system and the controller uses a 10/100 ethernet network operating the TCP/IP protocol suite. Resolution The controllers support 10/100 Full Duplex, Half Duplex and Auto-Negotiation ethernet modes.

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support Services for assistance. Issue AS status LED solid red for a few seconds followed by a quick blink. Device administrator and/or event log shows system alarm ..."Error - Upgrade using DFU mode"  Product Line EcoStruxure Building Operation Environment Building Operation Automation Server, AS, ASP, ASB Building Operation Device Administrator Building Operation WorkStation Cause The indication of "Error – Upgrade using DFU mode" occurs due to the fact that a possible problem with writing to the file system has been detected when booting the system. This error can be seen in WorkStation as an Alarm Event, in the Server Logs, or in Device Administrator. Nosync errors are usually seen in the system log. The configuration of the system could have been compromised as a result, although the issue is not necessarily fatal and therefore the AS is allowed to run and the situation is indicated via the red status light. A system alarm is also generated as a warning as seen in the screenshot above. Resolution Since the AS file system could have been compromised, it must be re-initialized from scratch. To clear the red light: Make sure a backup of the AS is available. Attach the Device Administrator to the AS via USB and put the AS in DFU mode (press the reset button 3 times in rapid succession) Install a new database Once the AS has had its FW and database reinstalled, restore the backup using Workstation. NOTES See Error – Upgrade Using DFU Mode  If this error occurs, especially if it occurs multiple times on the same server, check the site installation include Grounding/Earthing and power supplies and for possible EMC issues (Electromagnetic Compatibility)

Issue There is mention of the Modbus integration service in Security Expert manuals and release notes but no application note explaining what features are supported or how to configure the integration. Product Line EcoStruxure Security Expert Environment Security Expert controller Modbus integration Cause The Modbus integration in Security Expert is currently not supported by the Offer. The current Modbus integration has known issues and is being rewritten. There is no further information on when this will be completed or what devices this will be supported in. Resolution If the Modbus integration is required, the local solution category management team should be contacted to have this requirement properly prioritized and to get updates on any new Modbus integration work.

Issue An error is generated when trying to delete an unused Service in the SP-C-Web. Product Line EcoStruxure Security Expert Environment SP-C-Web Services Cause When using the Security Expert Client/Server and an SP-C it is possible to delete an unused/unwanted Service quite easily.       However when trying to do the same in an SP-C-Web via its web browser the following error is generated.           Resolution The SP-C-Web is fundamentally different to an SP-C with a Client/Server system.   As such deletion of Services from an SP-C-Web is not supported.  It is instead recommended to either stop the unwanted Service entirely or leave it running but without association to any Areas.

Issue Where do I find the cable specifications for Wiegand and RS485 connections to the Smart Card Reader? Product Line EcoStruxure Security Expert Environment Security Expert Smart Card Readers SX-DRD-SB SX-RD-MB Cause The sample cable specification links and CAT5e / CAT6 support is missing from the Card Reader With BLE Security Expert - Installation Guide. Resolution Smart Card Reader Wiegand Cable The cable specifications are: 22 AWG alpha 5196 or 5198 18 AWG alpha 5386 or 5388 Maximum cable distance of 150m (492ft) Smart Card Reader RS-485 Cable The cable specification for RS-485 connections (including when those connections are encrypted) are: Belden 9842 or equivalent 24 AWG twisted pair with characteristic impedance of 120ohm Maximum total length of cable is max 900m (3000ft) CAT5e / CAT6 are also supported for data transmission when using ground in the same cable (to a maximum length 100m (328ft))

Issue What is the procedure on transferring Continuum from one PC to another PC? Product Line Andover Continuum Environment CyberStation SQL Cause Workstation hardware needs to be upgraded or replaced altogether Resolution Collect information from the existing machine Collect all IP address, DNS server and Windows Server IP information from the existing workstation. Run Continuum Database Initialization on the existing machine. Select Workstation and record the following information. Workstation Name Folder Name Device Node ID Network ID Data Source Name Database Name User Login ID Server Name. Verify that correct Database Passwords are known for both Andover97 user and sa accounts Start Continuum and run PinPoint. From the View menu select Options Record the folder path indicated under Graphics (Pin Files) and archive these files.  Record the folder path indicated under Background and archive these files.  If any customization has been done to the menu pages (i.e. hot spot) then the User Profile folder( C:\Program File\Continuum\UserProfile) should also be archived. Backup the Continuum Database Move the database backup and the contents of the archived folders described above to a secure external drive or a network folder (not on the workstation itself). Install CyberStation on the new machine Before removing the existing machine from the network, start the new Workstation without connecting it to the network. Configure the IP Address, DNS server and Windows Server IP address collected from the existing machine. Install CyberStation on the new Workstation PC Note: Do not forget to disable all Virus Protection and Firewalls.  When prompted run Database Initialization Use the information collected on the existing machine to initialize the StandAlone Database. Use the information collected on the existing machine to initialize the WorkStation. Start Continuum and verify that the CyberStation operates normally. Copy data collected from the existing workstation onto the new workstation. Copy Database backup file to the Backup folder under C:\Program Files\Microsoft SQL Server\ Copy contents of the archived Graphics folder to the same folder on the new workstation PC. Copy contents of the archived Background folder to the same folder on the new workstation PC. Copy contents of the archived User Profile folder to the same folder on the new workstation PC. Run PinPoint From the View Menu select Options Under Graphics (Pin Files) enter the folder path to where the Graphics files have just been copied (see above). Under Background enter the folder path to where the background image files (see above). Select the Check button and verify that a failure notice (a red "X") does not appear beside any item. Close PinPoint Restore the Continuum Database. On the new workstation, run SQL Server Management Studio Express. Navigate to the Continuum Database. Right click on the Continuum Database, select Restore Browse to the folder where the existing Database backup file was copied to.  When the restore has completed successfully. Change the DB Owner: Right clicking on the Continuum database Selecting new query. In the query window type SP_ChangeDBOwner Andover97 From the tool bar select Execute. The result window should return............Command(s) completed successfully Reset the passwords for Andover97 and SA Open Security from the main tree, Select Logins. Right click on Andover97 and select properties enter and retype new strong password password, retype the correct password. Repeat for SA password. Now restart the PC. Run Database Initialization Under StandAlone, update the database. Re-Launch Continuum CyberStation and verify that CyberStation is working properly. Shut down the new workstation. Swap the workstations Shutdown the existing workstation and remove it from the network. Connect the new workstation to the network Start the computer. Launch Continuum and verify all functions are operating as expected.

Issue How to show raw card data of a badged card in Security Expert. Product Line EcoStruxure Security Expert Environment Security Expert Custom Card Format Cause Need to configure a custom card format and need to see the raw bit string to determine this. Resolution Displaying a cards raw data is a function that can be set in the Reader expander. 1. Confirm that the Display Card Data When Invalid option is enabled on the Reader tab under Misc Options. Misc options Display Card Detail When Invalid: When enabled, the reader expander will display the actual card data received from the reader when the card number is not known. This can be used to interface with custom third party applications that require their own processing of card information. This option is enabled by default and can be used to add card data to a user when operating Security Expert. When disabled the reader will display the card number not found message. 2. Next, set the Reader format on the Reader tab under Configuration to Any bit (raw). any bit raw 3. Now when badging a card at this reader port it should populate two events. One for the Card Number Raw Data and another for the Facility Code Raw Data.   Example: Read Card Number Raw Data: 46160846 Read Facility Code Raw Data: 436207616 Put the facility code into a Programmer Calculator to convert from Decimal to Binary. This is a 32-bit number. 00011010000000000000000000000000 Of the 32 bit number take the first 8 Binary digits (in the example this is 0001 1010) and convert this back to decimal. 00011010 bin = 26 dec What you should see in the decimal field is the bit length the card uses. Now in the Reader Format, it’s an experiment to find out which of the Bit options would correspond to the cards. (In the example above you would need to look through the 26 bit options.)

Issue When browsing the IP network using the WorkPlace Commissioning Tool, third party devices are displayed in addition to the I/A Series BACnet devices but no information is known about those devices. Product Line TAC I/A Series Environment WorkPlaceTech Commissioning Tool 3rd party BACnet IP & MS/TP devices Cause 3rd party BACnet devices are sometimes connected to the IP network without the knowledge of the engineer  programming the I/A Series system. Resolution When performing a global browse of the IP network, unknown devices are sometimes displayed in the WorkPlaceTech Commissioning Tool device list display.  Since all data columns are not necessarily displayed, some of the device information may not be able to be directly determined. Right-click in the column headers and a menu of available data columns will be displayed. The following columns may be displayed at a minimum to allow identification of the devices on the network as well as the BACnet routing path to those devices:     Instance     Vendor     Model     Router     Network     Address   If the device is a BACnet IP device, the "Address" will be displayed as an IP Address and Port.  For example the address of a BACnet IP device communicating via port 47821 at IP 10.159.34.238 Address   =  10.159.34.238 : 47821   If the device is a BACnet MS/TP device under a BACnet IP device, the address is the MAC address of the device on the MSTP bus and the Router is the address of the BACnet IP router to that device in Hexadecimal numbers.  For example, for MSTP device #4 under BACnet IP Router address, 10.159.34.238 : 47821 10 = 0A, 159 = 9F, 34 = 22, 236 = EC and 47821 = BA CD  Address   =   4 Router      =   0A-9F-22-EC-BA-CD   If the device provides vendor and model information, that information will be displayed in the appropriate columns.

Issue When trying to use WriteProperty to a 3rd Party BACnet device the following error is generated : "An attempt has been made to write to a property defined as inaccessible through the BACnet protocol write service" Product Line Andover Continuum Environment BACnet  Cause The error can be seen when using WriteProperty OR when attempting to Manually Command a BACnet Point on a 3rd Party Device Resolution The property that is being commanded, is not available to be written to in the 3rd party device. Many properties and object classes cannot be written to on BACnet devices, this is often defined in the devices PIC Statement which has hopefully also been BTL Tested. Some BACnet devices allow writing to be enabled/ disabled, but this must be set up on the 3rd Party device itself depending on the site requirements.  An example of this is in the Jace unit where there is a regular BACnet user that has no write capabilities from 3rd party devices, so to allow this requires a tick a box for "Super user".

Issue It is normal for a BACnet network port's Poll Service 'Busy Time' property to be greater than 100%? Eg: Product Line I/A Series Environment G3 BACnet Cause The Poll Service is a common component for typical field bus drivers including BACnet.  The Niagara Ax Drivers Guide defines the Poll Service's Busy Time property as: Displays a percentage of time spent by the poll thread actually polling points, across all poll buckets. Includes (in parentheses) a ratio of “(time spent polling/total time since statistics were restarted)”. Given a small amount of time is spent transitioning between poll buckets, and with the thread sleeping to evenly space out polling messages, it is unlikely to ever see Busy Time reach exactly 100%. However, any percentage above 95% indicates that the poll thread is basically spending all of its time actually polling.  Resolution In the case of the Poll Service for a BACnet network port, because two threads are used for polling, it is possible to see a Busy Time approaching 200%. In this case, divide the Busy Time in half to get an average busy time for each thread. In the case of the Poll Service for a Bacnet network port, because two threads are used for polling, it is possible to see a Busy Time approaching 200%. In this case, divide the Busy Time in half to get an average busy time for each thread. actually polling. However, any percentage above 95% indicates that the poll thread is basically spending all of its time actually polling. to evenly space out polling messages, it is unlikely to ever see Busy Time reach exactly 100%. However, any percentage above 95% indicates that the poll thread is basically spending all of its time actually polling to evenly space out polling messages, it is unlikely to ever see Busy Time reach exactly 100%. However, any percentage above 95% indicates that the poll thread is basically spending all of its time actually polling. Given a small amount of time is spent transitioning between poll buckets, and with the thread sleeping to evenly space out polling messages, it is unlikely to ever see Busy Time reach exactly 100%. However, any percentage above 95% indicates that the poll thread is basically spending all of its time actually polling. Includes (in parentheses) a ratio of “(time spent polling/total time since statistics were restarted)”. Given a small amount of time is spent transitioning between poll buckets, and with the thread sleeping to evenly space out polling messages, it is unlikely to ever see Busy Time reach exactly 100%. However, any percentage above 95% indicates that the poll thread is basically spending all of its time actually polling.

Issue Blank window while capturing a photo using "Logitech HD Pro Webcam C920". Product Line EcoStruxure Security Expert Environment Security Expert Cause While capturing a user photo using "Logitech HD Pro Webcam C920", it shows up as an image source (in the drop-down along with Topaz). When selected however, the screen is blank. Resolution With this webcam, you need LWS software by Logitech installed on your machine. G Hub has replaced LWS however it seems like G Hub is not currently functional with the integration. Find more information about the  "LWS280" driver HERE.  The driver can be downloaded from the attachment.

Issue When the EWS is installed on the same machine using the service then all packets will be going to the localhost and will not hit the NIC so will not be captured in a Wireshark packet capture. Product Line EcoStruxure Building Operation, EcoStruxure Security Expert Environment Security Expert Building Operation Enterprise Server Building Operation Automation Servers (AS-P, AS-B) Cause Packets sent between services on the same machine (like SOAP and EWS) do not hit the NIC and therefore cannot be captured with the default configuration of Wireshark using the WinPcap packet sniffing library.  Resolution Replace WinPcap with Npcap to emulate a loopback NIC for packet capture. Go to https://nmap.org/npcap/ for details on the library. Download the library installer from https://nmap.org/npcap/#download Uninstall WinPcap. Install Npcap. Npcap will then create an adapter named Npcap Loopback Adapter. In Wireshark choose this adapter to capture, loopback traffic will be the seen the same way as other non-loopback adapters. This can be tested by typing in commands like "ping 127.0.0.1" (IPv4)  or "ping ::1" (IPv6).