Building Automation Knowledge Base

Issue  Interstation links between UNC and Enterprise Server are not functioning. Product Line TAC IA Series Environment Windows 7 Windows Vista Windows XP Niagara R2 Cause Windows Firewall is enabled by default on desktop operating systems post Windows XP SP1. The Windows Firewall must be configured to allow unsolicited messages such as alarms and inter-station links from UNC's to be received by the Enterprise Server. Resolution WINDOWS FIREWALL OVERVIEW Windows Firewall is a “state-full packet filter” firewall by default. This means that all TCP packets trying to enter a system with the Windows Firewall enabled will be discarded unless those packets are responses to queries from that system, or if the packet is destined for a port that has an exception create for it. In other words, unless an exception is created, or the Windows Firewall is disabled a valid message such as an alarm or an inter-station link from a UNC will be blocked by the Windows Firewall and won’t be received by the Enterprise Server. Windows Firewall allows for exceptions to be created for particular ports and from particular ranges of IP addresses. For example, one could create a rule that accepts unsolicited packets on port 25, but only from the range of addresses from 192.168.0.1 through 192.168.0.254. There are two kinds of exceptions: program exceptions and port exceptions. A program exception is where the Windows Firewall is instructed to open ports that a certain program needs for unsolicited communications. This is the preferred method since Windows Firewall is only open while the program is waiting to receive the connection. In contrast, a port exception is the Windows Firewalls' way of acting like a port-filtering router. In other words, Windows Firewall can be configured to let in any traffic on a particular port whether it's solicited or not. Creating a Program Exception Windows XP Open Windows Firewall from the Control Panel and from the exceptions tab click "Add Program..." Click the browse button Navigate to the c:\Niagara\Version\Nre\Bin folder. Select the file “nre.exe” adding it to the list of programs. To specify which TCP/IP devices can use the port, click Change Scope and select one of the following To allow connections from any device, including those on the Internet, select “Any computer (including those on the Internet)”, and then click OK. (This is the default and least secure option) To allow connections from your local subnet only, select “My network (subnet) only”, and then click OK. (This is more secure than the previous option but will still allow a malicious attack from a PC on the network) To define a custom list, select “Custom list”, and then type a list of IP addresses separated by commas. (This is the most secure option) Click OK. The program will appear selected on the Exceptions tab under Programs and Services. Click OK to finish. Windows 7 Open Windows Firewall from the Control panel then select Advanced Settings: Right click Inbound Rules and select New Rule Select program and click Next. Click the Browse button Navigate to the c:\Niagara\Version\Nre\Bin folder. Select the file “nre.exe” and click Open to add it to the list of programs. Click next. Select Allow the connection and click next Select the Network profiles that the rule applies to and click next Domain The domain profile applies to a network when a domain controller is detected for the domain to which the local computer is joined. If you select this box, then the rule applies to network traffic passing through a network adapter connected to this network. Private The private profile applies to a network when it is marked private by the computer administrator and it is not a domain network. Newly detected networks are not marked private by default. A network should be marked private only when there is some kind of security device, such as a network address translator or perimeter firewall, between the computer and the Internet. The private profile settings should be more restrictive than the domain profile settings. Public The public profile applies to a network when the computer is connected directly to a public network, such as one available in airports and coffee shops. The public profile settings should be the most restrictive because the computer is connected to a public network where the security cannot be as tightly controlled as it is in an IT environment. Name the exception and click Finish Creating a Port Exception Windows XP Open Windows Firewall from the Control Panel and from the exceptions tab click "Add Port..." In the Port number field type 80 Select TCP. Type a short name for the port To specify which TCP/IP devices can use the port, click Change Scope and select one of the following. To allow connections from any device, including those on the Internet, select “Any computer (including those on the Internet)”, and then click OK. (This is the default and least secure option) To allow connections from your local subnet only, select “My network (subnet) only”, and then click OK. (This is more secure than the previous option but will still allow a malicious attack from a PC on the network) To define a custom list, select “Custom list”, and then type a list of IP addresses separated by commas. (This is the most secure option) Click OK twice. The Port will appear, selected, on the Exceptions tab, under Programs and Services. Repeat the procedure to add an exception for port 3011 Click OK to finish. Windows 7 Open Windows Firewall from the Control panel then select Advanced Settings: Select  Connection Security Rules: From right side menu, select “New  Rule” Select Rule Type then select Custom then click Next: Select “Protocol and Ports” then select the TCP protocol type, specify required ports, then click Next. This screen capture     shows the configuration for the I/A Series (Niagara) R2 required ports: On the “When does this rule apply screen, click Next, leaving all three areas checked. On the next screen, name the rule “Niagara 80, 3011 TCP” and click “Finish”. Repeat steps 3 through 7, above, selecting UDP instead of TCP.  All other entries are the same except in step 7 the rule name will be UDP instead of TCP. After completing step 8, the Connection Security Rules will be displayed in the center section of the program window.  You should see the following two rules:  

Issue System memory usage stays high after exporting projects in PCT (Project configuration tool) Product Line EcoStruxure Building Operation Environment Project Configuration Tool Cause The exporting process increases memory usage but is still withheld by the project after the process finishes.   Resolution Close the project exported.

Issue NC2 and ACX57xx controllers with network security applied will no longer respond to a ping command after upgrading to newest firmware. Product Line Andover Continuum Environment Network Security ACX5740 ACX5720 NC2 CX9680 Cause The ping command was used to monitor controllers offline/online status.  CX9680 and ACX57xx controllers (with network security applied) stopped responding to  a ping command after respective firmware versions  v2.100048 and v1.100052 were applied. Resolution This is functioning as designed due to the hardening of the controller's firmware for security reasons when network security has been applied.

Issue As of Continuum version 1.82 the standalone Database Engine is SQL Express, which offers inbuilt backup and restore functionality via Microsoft SQL Server Management Studio (SSMS). What is the process for backing up and restoring Databases prior to 1.82? Product Line Andover Continuum Environment Standalone CyberStation v1.81 and below. Backup/Restore  Cause As of Continuum version 1.82 the standalone Database Engine is SQL Express. Prior to that it was MSDE. What is the procedure to backup/restore an MSDE database? Resolution Visit the Download Center for MSDE Database Utilities:  MSDE Database Utilities Move SQL DB to a different hard drive

  Issue For an AS-P running on EBO 4.0.3.176, in Device Administrator, it is showing the State-Ready (Device crash logs available). When trying to download the debug info, it populates the below error and does not get rid of the logs.   ERROR: Failed to run devadmin3 command cmd with arguments -u -m devadmin3 --sa -v cmd 172.20.214.78 -b *** "rm -f /var/sbo/log/crash/coredump_SM222432005_nsp_servers_2022-09-03_110836.tgz" :rm: can't remove '/var/sbo/log/crash/coredump_SM222432005_nsp_servers_2022-09-03_110836.tgz': Permission denied   Product Line EcoStruxure Building Operation Environment • Building Operation Workstation • Building Operation Automation Server Cause Not running Device Administrator correctly Resolution When opening Device Administrator, ensure to run as administrator as below. This will clear device logs.  

Issue Enterprise Server is taking a very long time to run after restoring the database. Example: in EBO 3.2.3, It would start after 2.24 hours with about 20,000 trend logs, and with 10,000 it would take about an hour. Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Cause When restoring the configuration only of a Database, specifically one that has a lot of Trend logs configured, EBO initializes the Trend DB before starting the ES. Resolution Select to restore ALL DATA of the database, thus the Trend Database has already been initialized and the Enterprise Server will Run.  

Issue The site has a program that writes to a Value where the value is bound to Priority 16. The graphic maps to that same point at Priority 16. Previously they were able to click on the point on the graphic and edit the value, and the program could still count it down or clear it out. But they cannot do that anymore. Product Line EcoStruxure Building Operation Environment • Building Operation Workstation • Building Operation Automation Server Cause Prior EBO versions allowed to modify the value property of the BACnet object bound to priority 16 and vice versa, however as of 3.1 the system now makes each property read-only. Resolution There are a couple of options : It is recommended to use Numeric Public in the script Program. It will allow the modification without having to Force the value. There is also a feature in EBO 4.0 that will allow the change of the value without having to force it

  Issue EBO 4.0.3.176 When trying to import anything (Custom type, Script Program, etc.), Workstation will crash immediately with an error stating "The path is not a legal form.". You cannot navigate to the location that the file will be imported from. It will generate a Workstation error after clicking import. The issue only occurs on Windows 11 machines.     Product Line EcoStruxure Building Operation Environment Building Operation WorkStation Cause The wrong file format might have been used Resolution When you select "import", WorkStation looks in the bin file for the last path used. If it finds a path entry it tries to use that path. If it can't find that path, it defaults to the users' Documents folder. In this case, there was no entry in the bin file, which means WorkStation defaulted to MyDocuments. For some reason, the MyDocuments path on that PC could not be parsed, and WorkStation crashed.   The resolution is to manually add an entry in the bin file (you can get the file from support), pointing to the user's desktop. That means, that when the user selects "import", it first tries to open the user's desktop, and when it succeeds, it never falls back to the MyDocuments folder.

Issue How many concurrent users can connect to the system Product Line EcoStruxure Building Operation Environment EcoStruxure Building Operation Cause In the datasheet it is unclear how many concurrent users can connect to an AS without affecting performance Resolution The intent in the guidelines is to provide the concurrent user connections given that the clients are not all accessing data through the same Automation Server to the same Field Controller.  Therefore, if the load is distributed –  ES Clients viewing data from the ES (or a scattered variety of Automation Servers and below) AS Clients viewing data from that AS  Then it should be safe to add the client totals for all AS and ES clients together. The local AS connections are intended to help with scaled use of clients at a site-wide or multi-site system. The typical use case is for operators within a building, floor or tenant to connect locally to the AS, while central operators connect to the ES without impacting each other.  If all ES Clients and all clients on a single AS are all accessing data from that AS and below then the performance could drop below acceptable levels.

Issue Binding to a Graphic, what is the correct method? Product Line EcoStruxure Building Operation Environment Bindings Graphics Cause In the chapter "Binding Templates - Binding Values Using a Binding Template" in the "EcoStruxure Building Operation - Technical Reference Guide" it states "When creating bindings, follow the recommended general guidelines: create binding between Inputs and Outputs only, and do not create binding to Public Signals". Does that mean that you should not bind constants used in e.g. curve block or time delays or outputs from expression blocks to a graphic? Does that mean that you should not bind constants used in e.g. curve block or time delays or outputs from expression blocks to a graphic? Resolution Bindings from public signals to graphics is appropriate. When dealing with directional bindings (i.e. in from a schedule, out to an alarm, in from or out to another program, etc.), it's best to bind to input blocks or output blocks.  Graphics bindings are a different animal, though.  Among other things, they are bi-directional and only affect the system when the graphic is displayed.  They also exist to give the user access and control to values throughout the system (rather than to control routine data flow). Our primary reason for communicating this best practice is to help with the binding process.  Programs will operate with un-bound points, but we're encouraging users to simplify the binding process by relying on just inputs and outputs to interconnect a program with other logic and alarms.  In this way, you can visually scan the list of inputs and outputs to see which points still need to be bound. Since most programs typically have a much longer list of public signals, it's easier to overlook a missed public signal binding. Missed graphics bindings should be easier to catch but bindings to another program or alarm may be difficult to identify.

Issue Memory and System Memory in the AS Product Line EcoStruxure Building Operation Environment Building Operation Automation Server Building Operation Automation Server Premium Building Operation Automation Server Bundled Cause What is the definition of the two different memory types shown in the AS? It is not clearly defined in the documentation. In various places, one can see Memory and System Memory, or even add a column to show.  Resolution For the AS, System Memory is the RAM used by the AS Linux OS. The rest of the memory is what is being used for the processes, such as programs, trends, etc. Memory is the amount of memory consumed by the AS (nsp_servers application), system memory is that used by the Linux OS, however there is much debate about how this is calculated and allocated, so too much should not be read into this, it is there primarily for developers.

Issue Building Operation Server backup set is incompatible for restore. "Importing Backup Set" "Backup set is of a different server type" Product Line EcoStruxure Building Operation Environment Automation server (AS) Enterprise server (ES)  Cause The backup set is for a different server type (version). Determine the server type from the .xbk file to determine which server version will allow a restore. Resolution The quickest method is to run the following tool SBO xbk Analyzer - Communities (se.com) and open the backup (xbk).  It will identify the  File name Controller Type Version / Serial Number Time and type of backup.  i.e., Contents. Config only, Events and Trends, etc. And much more.  See the link above or the Help topic on the tool for further information   Alternative methods are provided below:    The backup set contains information in the compressed .xbk file that can be retrieved this way ... Make a copy of the backup set as a precaution for safety reasons On the copy, for AS change the file extension from .xbk to .zip. For ES change to .tar Use a tool such as 7zip to decompress the file Look for a file by the name x.x.x.xxxx.serverrevision (i.e. 1.3.0.4602.serverrevision) This is the revision that the backup set was created at.    The Backup set can only be restored into a server running this revision.   Look for a file by the name xxxxxxxx-xxxxxx.backuptime This is the date/time when the backup set was created.   Look for a file by the name Automation/Enterprise.servertype This indicates whether the backup set is for AS or ES   Look for a file by the name xxxxxxxxxxxxx.servername This is the name of the server when the backup set was created     Version 1.5 and above There is a file by the name TDxxxxxxxxx.serverserialnr This is the Serial Number of the server.  

Issue The port range used by the Project Configuration Tool is unclear Product Line EcoStruxure Building Operation Environment Project Configuration Tool Cause The ports used by PCT are located in different documents Resolution • TCP on port 4444 (fixed) • HTTP on port 80 (default) • HTTPS on port 443 (default) • Server port 9091 (default) • Server port 9090 (default) • Engineering port 32768-61000

Issue Automation Server has license violation although correct embedded license is activated. ASBaseLicenseStatus has license violation status "inform"   Product Line EcoStruxure Building Operation Environment Building Operation Automation Server Building Operation Automation Server Premium Building Operation Automation Server Bundled Building Operation Edge Server - Standard Cause Adjusting the Automation Server time and date to an earlier time, ex. prior to license activation time, causes license violation. Resolution Make sure that Automation Server has correct date, time and timezone or configure the Automation Server to synchronize its clock with a network time server, refer to: Time and Time Zone Configuration in Automation Server.

Issue When trying to open WorkPlace Tech Editor the following error is shown in a pop-up window.   The following error occurred while trying to launch the WorkPlace Tech Ribbon Bar: The add-in could not be installed. Product Line EcoStruxure Building Operation, TAC IA Series Environment Building Operation Workstation (Workplace Tech Editor) I/A Series WorkPlace Tech Cause An installation of the Visio Ribbon has not closed correctly from previous use of WorkPlace Tech Editor or standalone WorkPlace Tech. Resolution Open the Add and Remove function in Windows Select "Program and Feature" Look for an instance of the SE.WorkStation.IA.VisioRibbon when no WorkPlace Tech Editor is running. Right-click and uninstall. Open Workstation and launch WorkPlace Tech Editor  There are other conditions that can cause the ribbon not to run as well.  They are detailed in other articles Similar Error Message Regarding Ribbon Bar  Unable to Load Ribbon 

Issue Getting "An unknown error occurred in the WP4NewProject add-on to Workplace Tech Tool" when trying to download to a device with WorkPlace Tech. Product Line TAC IA Series Environment I/A Series WorkPlace Tech Microsoft Visio (versions noted) Cause Need to enable automation events in Visio. Resolution Below are two options to enable the automation events in Vision 2007 and one option to enable the automation events in Visio 2010 and newer In WorkPlace Tech with Visio 2007: Go to File menu Select Options.  The Visio Options window appears Select Security tab Check the "Enable Automation Events" Click OK Inside Visio 2007: Select Tools and Options. Tools and Options window appears In the Options window, select the Security tab Check the "Enable Automation Events" Click OK In WorkPlace Tech with Visio 2010 through Visio 2021 Go to File menu Select Visio Options. Options window appears Select Advanced from the menu on the left side of the window In the main part of the window, scroll to the "General" section Check the "Enable Automation Events" Click OK   NOTE: This change does not take effect until the WorkPlace Tech Tool or Visio software has been closed and restarted.

Issue The "Display on alarm" feature for the Alarm view object does not display when the Alarm is triggered. This occurs even though the checkbox is checked, as shown below.    Product Line EcoStruxure Building Operation Environment Building Operation Workstation Cause When the user is logged in with a Workspace view that does not show any Alarm viewers, no alarms are presented to the Workspace; hence the "Display on alarm" function does not load.  This is as intended. An example of this type of Workspace would be the Administration Workspace which presents no alarms to the user while they are using this Workspace. Resolution For the Alarm view to "Display on alarm", it is necessary to add the Alarm Pane to the Workspace (as shown below) or use a Workspace view with the Alarm Pane included.  

Issue Which Continuum controllers support a terminal RS-232 interface using a terminal emulation application such as Hyper Terminal? Product Line Andover Continuum Environment HyperTerminal CX9900 CX9940 CX9200 CX9400 Cause Documentation Resolution ONLY the following range of controllers support a terminal interface. CX99xx CX92xx CX94xx Please consult Logging into CX9900 controller using HyperTerminal for additional information.

Issue When swiping / presenting a card to a Wiegand card reader in Continuum it does not open the door..  When opening a Listview of Events the log shows "Card Bad Parity" or it reads an incorrect card number using Custom Wiegand. Product Line Andover Continuum Environment CyberStation all versions, with any of the Access Controllers - ACX700, ACX780, ACX57xx, NetControllers with any of the AC1 module range. Cause This fault is caused by incorrect wiring to the reader or choice of a 3rd party reader that is not compatible with Continuum. Resolution When wiring between a controller and a Wiegand card reader, all wires must be connected straight through to the corresponding terminal. Data1 to Data1 Data0 to Data0, Gnd to Gnd ..............etc. See relevant controller installation guide for further details on reader wiring and cable types. On HID readers be sure to wire between the two Data 1 terminals and the two Data 0 terminals. Do not refer to the Clock and Data legend that is also on the controllers and many readers, as this is only used for ABA data connections. When using a separate Power supply for the reader, the 0V (Ground) terminal must still be connected back to the controller GND terminal to ensure both devices are working from a common ground potential. When testing out cards and readers always use a Listview showing a relevant Event log, as this will provide more information than the event view from the Door editor itself. To assist with troubleshooting data reads by the controller especially when using Custom Wiegand for non standard Continuum formats: Select only Custom Wiegand in the Door configuration. Rename the "AccessFormat" array if one has been created. Present a card to the reader. Check the Listview for Events as this will show the raw binary data string the controller is receiving. Compare raw binary data against the expected data from the reader used.

Issue During communication issues with a Continuum BACnet controller, a large amount of the following error messages are seen in the controllers' error log. 0x8000001e 0x00236400 0x08023a50 0x4c000000 0x00000000 BACnet request timeout 0x00001408 0x0023a600 0x080af632 0x000000bc 0x00000284 Not enough memory Product Line Andover Continuum Environment BACnet Controllers Cause Most likely due to incorrect configuration or excessive BACnet traffic..... or both. Resolution Check the following: What is the version of Controller Firmware being used in each controller? This needs to be checked against the Continuum Compatibility Matrix to ensure that it is compliant with the version of Continuum being used on the SQL Server Are BBMDs configured on this site? If so, where are they located and how are they configured? Confirm the "maxinfoframes" value currently set for all controllers. By default, a bCX for example should be set to 8 By default, b3 controller should be set to 2. If these are different from the default then why this has been changed? Confirm the BACtMaxMaster value in each is set to the maximum b3 NodeID + 1. This defaults to 127 but can cause comms delays on a smaller network. Confirm that all controllers on the MSTP are configured for the same Baud Rate. Any talking at a different baud rate would seem like noise on the network and disrupt communications, resulting in many 1408 error messages. Check the COV increment on points. The default of 0 can cause too much traffic on the bus and should never be left at Zero