Building Automation Knowledge Base

Issue Resistance against temperature Product Line Field Devices Environment TC300 thermostat range TC900 thermostat range RS-03 remote sensor Cause Remote sensor compatibility Resolution The TC thermostat range use a 10K type 3 (3950) Negative Temperature Coefficient (NTC) thermistor. Whilst this is similar to the 10K type 3 thermistor used in the other BMS field device sensors such as the SpaceLogic SLA range, it has a different resistance curve and the temperature read will be different.   The table below shows that at typical room temperatures the error is 0.6°C or less. T(°C) RS-03 R(KΩ) SPA R(KΩ) Error % Error °C 0 31.77 29.575 6.91% 1.736 5 24.94 23.504 5.76% 1.366 10 19.68 18.809 4.43% 1.052 15 15.62 15.146 3.03% 0.812 20 12.47 12.271 1.60% 0.63 25 10 10 0.00% 0 30 8.064 8.195 -1.62% 0.3872 35 6.538 6.752 -3.27% 0.3052 40 5.327 5.592 -4.97% 0.2422 45 4.363 4.655 -6.69% 0.1928 50 3.592 3.893 -8.38% 0.1542   Click here to view the TC thermostat's RS-03 remote temperature against resistance chart. Click here to download the chart that provides the temperature against resistance reading for the TC thermostat's RS-03 remote temperature sensors.

Issue Newly enrolled users biometrics are not working at Suprema readers while existing users are functioning normally. New user updates appear to be working, the Download Server is online, with changes being made to the controller .dat and suprema reader .dat files in the Security Expert Servers ProgramData folder as users are updated. Controller .dat files Product Line EcoStruxure Security Expert Environment Security Expert Suprema Integration Cause The Suprema BioStar services are running on the Security Expert server which conflicts with the operation of the Security Expert Download service. Both the BioStar software and Security Expert Download service use the same port (51211) to communicate with the biometric readers. Resolution The Suprema BioStar software is only used during commissioning and configuration of the biometric readers and does not need to be permanently running. Due to the port conflict, the Suprema services cannot be run on the Security Expert server with the Security Expert Download service active. Stop all of the BioStar services running on the Security Expert server and set the startup type to manual. Suprema services Restart the Security Expert download service. Download service New user updates will now be downloaded to the Security Expert controllers and Suprema readers.

Issue The RUSKeyUtility.exe displays a “Vendor lib cannot be found” error when applying license a V2C file to Cyberstation. Product Line Andover Continuum Environment Andover Continuum Cyberstation Software License Cause There are three main reasons for the error : The “C:\Program Files (x86)\Common Files\Aladdin Shared\HASP” folder path is not added to the Windows Path system variable. The folder path is added to the Windows Path system variable, but the “haspvlib_84344.dll” file does not exist in the “C:\Program Files (x86)\Common Files\Aladdin Shared\HASP” folder. The folder path is added to the Windows Path system variable, and the “haspvlib_84344.dll” file exists in the “C:\Program Files (x86)\Common Files\Aladdin Shared\HASP” folder, but the “haspvlib_84344.dll” file is damaged. Resolution Add the path to the  Windows Path system variable. Select the Advanced tab from Control Panel -> System -> Advanced system settings Click the Environment Variables button Highlight the Path Click the Edit button and add the C:\Program Files (x86)\Common Files\Aladdin Shared\HASP path Request the latest “haspvlib_84344.dll” file from Product Support and copy it to the folder. Request the latest “haspvlib_84344.dll” file from Product Support and copy it to the folder to replace the damaged one.  

Issue Does the Automation Server support network authentication via Radius Server (IEEE 802.1X)? Product Line EcoStruxure Building Operation Environment Building Operation Automation Server Cause AS supports network authentication via Radius Server (IEEE 802.1X)? Resolution RADIUS and IEEE 802.1X are not the same thing, although they can be used together. Remote Authentication Dial In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) management for computers to connect and use a network service. RADIUS is a client/server protocol that runs in the application layer, using UDP as transport.   The RADIUS server is usually a background process running on a UNIX or Microsoft Windows server. RADIUS serves three functions: to authenticate users or devices before granting them access to a network, to authorize those users or devices for certain network services and to account for usage of those services.  IEEE 802.1X is an IEEE Standard for port-based Network Access Control (PNAC). It is part of the IEEE 802.1 group of networking protocols. It provides an authentication mechanism to devices wishing to attach to a LAN or WLAN. It is a mechanism used in (mostly) switches and wireless access-points to allow or block devices to access the network (or granularly allow access to parts of it).   For example, if you have a network port in a meeting room, you can enable 802.1x on the switch port and configure it in such a way that when an employee connects they have access to the entire network, but if a guest connects (with a temporary password) they can only reach the Internet and if a passer-by is tempted to try his luck, they cannot access anything at all. Does IEEE 802.1X also use RADIUS as it's underlying authentication mechanism? Yes and no. IEEE 802.1x uses Extensible Authentication Protocol (EAP), the drawing below shows that for wired 802.1x: EAP over LAN (EAPoL) is used between the Supplicant (software on a computer) and the Authenticator (switch). EAP is then usually tunneled over Radius between the Authenticator and the Authentication Server, but it can also be done over Diameter (the successor to Radius). For wireless, it is similar in the sense that there is also no Radius between the supplicant and the authenticator, only between the authenticator and the Authentication Server (to tunnel the EAP). From EBO 2022 the AS-P and AS-B can be configured as supplicants on a network protected by IEEE 802.1X security. See the IEEE 802.1X Security Webhelp topic for further details.   Note: MPx/RPx do not support 802.1x network authentication, see the SpaceLogic controllers MPx/RPx do not support 802.1x network authentication Knowledge Base article  for further details.    

Issue Getting the connection error below when using Microsoft SQL server as External Log Storage for EBO. Error: [Microsoft][ODBC SQL Server Driver][TCP/IP Sockets] SSL Security error [Microsoft][ODBC SQL Server Driver][TCP/IP Sockets] ConnectionOpen (SECDoClientHandshake()). [Microsoft][ODBC Driver Manage     Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server (ES) Building Operation Enterprise Central (EC)   Cause When EBO connects to the Microsoft SQL server it uses the ODBC installed on the computer. It will use the ODBC version which comes with the OS and not the newest one installed on the computer. In this case that was too old to work with the Microsoft SQL server Resolution It is possible to specify what ODBC version EBO should use. First check what ODBC version is installed on the computer. Enter ODBC in the search bar on the computer Open ODBC Data sources and select the Drivers tab. Open EBO and navigate to the properties /External Log Storage/Microsoft SQL Server in the system tree. In the Database name field it is possible to specify which ODBC version EBO should use, see picture below

Issue SOAP service can't be reached at http://localhost:8030/SecurityExpertSOAPService/service.svc.  HTTP Error 404 error seen when attempting to browse. Product Line EcoStruxure Security Expert Environment Security Expert Server Cause Confusion related to the indicator Windows uses to denote when features have been enabled. Instructions in the Security Expert SOAP service installation manual not sufficiently clear. For instance, the documentation shows a checkmark in the .NET framework feature but it does not show the sub-items, a checkmark here means all of the sub-items are also enabled but this is not necessarily intuitive.  When not all of the sub-items are enabled, Windows shows the check box filled with a black square but many users are interpreting this as meaning the same as a checkmark. Resolution When a feature check box shows a checkmark in the documentation, make sure to expand the feature and enable ALL of its sub-items. 

Issue MQTT client from an AS-P cannot establish communication with the Mosquitto broker installed on the machine that hosts the Enterprise Server (ES). At the same time, the MQTT client from the ES was online with the Mosquitto broker. Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Building Operation Automation Server IoT messaging MQTT (Messaging Queuing Telemetry Transport) Cause In version 1.6.x and earlier from the Mosquitto broker, the option - allow_anonymous [ true | false ] from the configuration setup (e.g. mosquitto.conf — the configuration file for mosquitto) of the broker was defaulted to  true  unless there were other security options set.   In recent versions of the broker, the option allow_anonymous defaults to  false - Unless no listeners are defined in the configuration file, in which case it set to  true  - but connections are only allowed from the local machine if external connections are required; specific port listeners need to be set. Resolution To configure the MQTT Mosquitto broker for insecure communication with an EBO server, follow these steps.  Download the Mosquitto broker latest version from the Eclipse website and install it on the host machine. Locate the mosquitto.conf file in the  Mosquitto installation folder (Default: C:\Program Files\mosquitto). Edit the mosquitto.conf file with a text editor application (e.g. Notepad, Notepad++). Setting up the  allow_anonymous configuration as true and the listeners to the desired communication ports (e.g. 1883: This is the default MQTT port. 1883 is defined at IANA as MQTT over TCP. 8883: This is the default MQTT port for MQTT over TLS.)   Check the Video attached, which includes the basic configuration of the mosquitto.conf file.   

Warning Hazard of Electric Shock: Remove all power from all devices before removing any covers or doors of the system. Disconnect power at the device and at the power source. Electrostatic Discharge Required: Always discharge static electricity from your person by touching metal prior to handling any hardware. Failure to do so may result in damage to devices. Issue Page 1031 of the hardware reference guide only states wire cross-sectional area: 0.34 to 2.5 mm 2 (22 to 14 AWG) and not the number of wires allowed to terminate. Product Line EcoStruxure Building Operation Environment Building Operation Room Controller (RPC) 24V Building Operation Room Controller (RPC) 230V Cause Documentation clarification. Resolution It is OK to terminate up to 2 wires into each terminal as long as the total area of the wires does not exceed 2.5mm 2 .  

Issue Model and Device Name from SLP sensor via Modbus RTU Product Line EcoStruxure Building Operation Environment Automation Server AS, ASP, ASB SpaceLogic Sensor SLP Cause The Model, Device Name and Serial number are 64bit values and need to be collected with a single query to get the correct data. Script and Function Block programs can not manipulate 64 bit values - Model Register 9, 64bit, read only, Read Function Code 4 - Serial number Register 42, 64bit, read only, Read Function Code 4 - Device Name Register 7, 64bit, read/write, Read Function Code 3 (currently the documentation shows these as 32bit) Resolution A simple way to collect the Model and Serial Number is shown below This involves creating a Modbus Poll Group for the 4x 16bit parts of the 64bit Modbus Register. This will effectively query the 4 registers in a single packet, ensuring the correct data is collected. The same method can be used to collect the Device Name, but this value cannot be written using the same Group, as block/group write is not supported in EBO Create a Modbus Poll group containing the four 16bit registers, then create a String variable Then create a script to convert to ASCII characters

Issue Upgrading SQL Express to a paid Edition of SQL for EcoStruxure Reports Server Product Line EcoStruxure Building Operation Environment WebReports Reports Server SQL Express Cause SQL Express 2008 R2 (for example) is limited to 10 Gb of Storage and 1 Gb of Ram usage. Many sites need a larger, more robust database than this allows. Resolution NOTICE: Before beginning, it is important to understand the difference between the Instance name and the version of SQL running.  The default instance name used in the the SQL Express version of SQL is SQLEXPRESS. This can be changed to anything during installation, but cannot be changed later.  This means that when upgrading to SQL Enterprise edition, the SQL instance name will still need to be SQLEXPRESS. The instruction below assumes the instance name is SQLEXPRESS and will be typed in that manner.   Perform a full backup of the Enterprise Server and Reports Server before beginning any upgrade process. Save these files to an external drive. Purchase a supported edition of SQL for the revision of EcoStruxure Building Operation WebReports being used. Please check the data sheet for the release to obtain this information. Open the Command Prompt and Browse to the location of the installation files for SQL. This should be the folder containing the setup.exe file for the new version of SQL Enter the Command "setup /ACTION=editionupgrade /INSTANCENAME=SQLEXPRESS /PID=XXXXX-XXXXX-XXXXX-XXXXX" NOTE:If  not using the default instance name, enter the correct instance name in place of SQLEXPRESS. PID is the product ID that came with the installation media. In some cases, this will be left out of the command string and entered later. (setup /ACTION=editionupgrade /INSTANCENAME=SQLEXPRESS) The SQL Installer will open. After the Setup Support Rules operation runs, click OK Click Next Verify the Product Key and click Next. Accept the License Agreement and click Next Ensure that the correct instance of SQL is selected and click Next. After the Edition Upgrade Rules runs, click Next Review the Upgrade Summary and click Upgrade When Complete click Close Open the SQL Server Configuration Manager using the start menu and verify that the SQL Server (SQLEXPRESS) service is running and that the SQL Server Reporting Services service is running. If either are stopped, right click and select the start option. Verify the upgrade is successful by opening a Web Browser and entering the URL "http://localhost/Reports_SQLEXPRESS" It should now be possible to see the option to directly edit reports in Report Builder. Log into the WebReports Interface. Notice that the initial report showing Database usage no longer runs.

Issue Using CARD + BIOMETRIC credentials at an integrated Suprema reader for user access. Product Line EcoStruxure Security Expert Environment Security Expert Suprema Biometric Reader Cause Security Expert does not support CARD + BIOMETRIC credentials being read at the integrated Suprema reader. Only BIOMETRIC credentials are supported to be read at the Suprema reader. Resolution For situations where CARD and BIOMETRIC credentials are required to authenticate users a supported solution is to install a Security Expert reader in conjunction with a Suprema reader at the door. The Security Expert reader will read the Security Expert Mifare/DESFire tags, compare this to the credentials configured in Security Expert user and then wait for the proper biometric to be provided before allowing access through the door.

Issue The Continuum BACNet MSTP devices (b3 controllers) are created and do not appear in the BACNet View of the Continuum Explorer when the "Find New BACNet Devices" is performed.  In rare cases, they are all showing online in Infinity View and stay stable but some of them are not showing in BACNet View at all.  Product Line Andover Continuum Environment Continuum Explorer BACNet MSTP devices (b3 controllers) Cause Most of this issue happens when these BACNet objects are left over in the Continuum database due to an incomplete/unsuccessful delete operation on the BACnet devices that previously existed in the database.  Resolution When this happens, deleting all the objects from BACNet view from Continuum Explorer and redo the "Find New BACNet Devices" will fix it most of the time.  If the issue persists, it is necessary to run the "ACCTrace.exe" utility located in the Continuum directory of the workstation to start a capture.  Wireshark will also need to be run at the same time whilst completing a  "Find New BACNet Devices" again.  Wait for about 5 minutes then stop the ACCTrace and Wireshark captures and save the log files.  Send the log files to Product Support with a Continuum Analyzer log file and the names of the issued MSTP devices which are not showing in the BACNet View. SQL Enterprise Manager will need to be available to fix the issue in the database.

Issue Understanding and configuring controllers for Access Control using SystemStatus and AccessServer system variables. Product Line Andover Continuum Environment Access Control CX9702 ACX57xx Netcontroller Netcontroller II Cause Operators can be unsure what the various values for SystemStatus and AccessServer are and what they need to be set to for successful access control. Resolution 1. SystemStatus The first thing to realize is that there are four different modes that an Access controller can be set to, the SystemStatus indicates the mode controller is currently in. This is an Access-only system variable and will default to NoDatabase if left unconfigured. These four values are as follows: Normal — The controller is working normally. NoComm — Local controller has lost communications to the Workstations configured as Primary and Secondary Access Servers. NoDatabase — The Access server and the local controller have been reset or have otherwise lost connection to the database to check access card numbers and personal identification numbers (PINs). Can also indicate that the local controller has lost comms to the Access Server and has no local personnel database to authenticate to. ColdStart — Indicates the Access Controller SystemStatus initial value, before any door has been configured. The sequence for how SystemStatus gets set is as follows: On a ColdStart if the AccessServer = 1-190 it is set to NoDatabase when the first door is configured. When CyberStation finishes the personnel distribution, it explicitly sets the value to Normal.  On a ColdStart if the AccessServer  > 190 it is set to Normal when the first door is configured and the controller is communicating with the Primary and/or Secondary Access Server workstations. Note: Upon initial configuration, or a restart, the CyberStation can fail to set the SystemStatus to Normal; leaving the controller in NoDatabase mode. If this occurs, the value can be manually set to Normal to "kick start" the controller. 2. AccessServer The second thing to look at is that the value of the AccessServer SystemVariable has been set. This should be set to the ACC Net Id of the Workstation configured as the Primary Access Server (> 190) for local then remote validation or set to the controllers ACC Net Id for local validation only. 3. Door Object Additionally Door objects need to be configured to handle the above conditions, there are a number of ways they can require authentication when a card is presented, these are listed in the Entry Reader and Exit Reader tabs of the Door object in the form of check boxes. The main ones being validate site, validate card, valid pin, and Door Forced Lock Schedule. Tick whatever options are required.

Issue What is the correct procedure for replacing a Continuum bCX 4040 controller Product Line Andover Continuum Environment CyberStation bCX 4040 Cause Considering both Continuum and BACnet 'sides' replacing a bCX4040 can seem a complicated process. Resolution Commission new/replacement bCX through its default webpage just as the as old bCX except for the BACnet Configurable Properties section. Set the BACnet Device ID = The same ID in the old bCX (serial number of controller by default) Set the BACnet Port Number UDP = same as old bCX (BAC0 by default) Set the BACnet Network ID UDP = same as old bCX (1 by default) Set the BACnet Network ID Comm2 = same as old bCX (2765 by default) Set the BACnet MAC ID Comm2 = Same as old bCX (0 by default) Set the BACnet MS/TP Enhanced Mode = Same as old bCX (TRUE by default) Set BACnet BBMD Enabled/Disabled = Same as old bCX (False by default) Bring the bCX online in Continuum Explorer, Select menu item Options | Send to Controller options Select "Reload attached objects, but not attached controllers" - select ok Verify the bCX Comm2 settings and baud rate speeds. In Continuum Explorer, right click on the bCX and perform a "send to controller" Verify points and communications.

Issue Getting error "Communications failure due to routing device not available" when reloading BACnet Controller Product Line Andover Continuum Environment CyberStation 1.74 above b3 controllers BACnet bCX1 Cause Anti-virus applications can prevent the BACnet objects from saving into the Continuum Database (BACnet objects may also not appear on the BACnet side).   When you reload the BACnet controller which contains these objects, they are 'inaccessible' and the error is generated in the distribution property window Resolution Close Continuum CyberStation Disable all the Anti-Virus applications then restart Continuum CyberStation From the BACnet Device side, Right click the Controller you want to reload then select SendToDatabase, all the BACnet objects will appear under the controller. Reload the controller again.

Issue Device Administrator is not able to load new database version into AS-P. Error message “New database failed” Product Line EcoStruxure Building Operation Environment Building Operation Workstation Building Operation Automation Server Cause The new McAfee firewall policy where Local the firewall is blocking ICMP6 to the PC. The device needs to be able to "call back" to the PC. If that doesn't happen, the upgrade will not continue and stop at exactly 70%. This is seen in 3.x, EBO 2.0 does not exhibit this issue The device may be defective due to software or hardware error. Resolution   The McAfee firewall issue can be resolved by:  Temporarily disabling the local firewall Trying another PC since McAfee policy or some restriction might have caused installing 3.2 to fail. Another possible solution for this issue which we have seen working is to first install version 3.1 using DFU mode and create a new database and then upgrade to version 3.2 using IP connection.   How to cross-testing and identify if the device is defective? Use the same PC and Device Administrator to install a new DB on a different AS-Ps.  If the same PC can install a new DB on a different AS-P then the issue is not on the PC. Use another PC with the same version of Device Administrator to install a new DB on the suspecting device. If it fails to install a new DB then RMA is needed. Remember to DFU the device before installing a new DB.

  Issue Instructions needed to configure the Card Format for 75-bit Wiegand PIV  Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Cause Steps needed to configure 75-bit Wiegand PIV Class card format Resolution A site may have converted from Continuum or is a greenfield site needing to configure 75-bit PIV Smart cards. Below are the card format instructions: Access Expert Card Format snapshot Additional configuration tips: Keep Live monitoring open while configuring this format. Present a User's (Cardholder's) card and you'll see an "access denied entry". While setting this format, a "-1 as a facility code" will show when expanding access denied events while presenting a card in Live Monitoring. This is expected. In Live monitoring the encoded card number is shown. Type the card number into Notepad Copy the card number into the User's Card Assignments> Encoded Card Number field and Save.  Repeat for each cardholder and Test

Issue ACX5720 or ACX5740 backup to flash renders error message: "Unable to backup objects to flash for controllername_\XKD06.51_MCD.  Backup to flash failed.,WS3,conrollername_\XKD06.51_MCD" Product Line Andover Continuum Environment Flash Backup AXC5720 ACX5740 Cause Failure to backup to Flash Resolution Before claiming a faulty controller, it could be a corrupted point or program. Disable all the programs, and try backing up the controller. Disconnect everything except communication and power, and try to backup to flash again. If you have tried to re-flash and it still is giving this error, the controller might be the issue.   Email support with the results if this controller still will not backup to flash: product.support@buildings.schneider-electric.com For configuration and operation program write operations to flash, a counter is incremented for each save and you need to create the numeric INFFlashDisabled to monitor the number of write operations. When the 2000 limit is reached, INFFlashDisabled is set to a non-zero value and logs an error. Using CyberStation, reset this value to 0 and reboot the controller to enable write operations.

Issue What is the recommended process for Database and Workstation Initialization Product Line Andover Continuum Environment Database Initialization Workstation Initialization Cause Sometimes it is necessary to do Workstation and/or Database Initialization eg. following a Continuum service pack install Resolution Database initialization LAN systems (SQL is on a separate SQL server PC) Close all connections to the database (all cyberstations, webclient servers etc.) Open "Database Initialization" from Start/All Programs/Continuum Select "Server" Select "Update Existing Database", ensure Database Information is correct, fill in User Login Password Usually Enhanced Alarm Logging and Enhanced Alarm Delivery are ticked. Then select Continue Database initialization Stand Alone (Single User) systems (SQL is on a CyberStation PC) Close all connections to the database (all cyberstations, webclient servers etc.) Open "Database Initialization" from Start/All Programs/Continuum Select "Stand Alone" Select "Update Existing Database", ensure Database Information is correct, fill in User Login Password Usually Enhanced Alarm Logging and Enhanced Alarm Delivery are ticked. Then select Continue WorkStation Initialization Close the CyberStation on the PC being initialized (other CyberStation can be running) Open "Database Initialization" from Start/All Programs/Continuum Select "Workstation" Check both tabs and fill in the User Password Then select Continue See the Continuum Installation manual for further information   NOTE 1 With the some domains the following has been found - XP - "Right click" on the "Database Initialization shortcut" and “Run As” use local admin - Windows 7 - "Shift" & "Right click" on the "Database Initialization shortcut" and “Run as a different user”, use local admin To log on use the workstation name followed by user eg. WSUK1AB123ABC\dave   NOTE 2 Long CyberStation names can result in the error "Workstation name with invalid characters. Please enter it again" In this case use a shorter name, below 16 characters is best. This can occur even with an existing longer CyberStation name.

Issue How to configure the Security Expert system to use multiple Custom Credentials on the same door Product Line EcoStruxure Security Expert Environment Custom Credentials Cause The older inbuilt Card Formats used Primary and Secondary Reader Formats to allow two Card Formats to be used on the same Door.  But how is this functionality achieved with Custom Credentials? Resolution It is possible to add two or more Custom Credentials to a single Door.  However, when you do this it is instructing the system to request the First Credential AND the Second Credential before granting access to that Door (perhaps even in sequence) If in fact the system is required to request EITHER the First Credential OR the Second Credential before granting access, then the Fallback Credential feature is used. This allows for as many Custom Credentials on a single door as needed.   Please see demo video below: