Building Automation Knowledge Base

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue Bringing a MicroNet LON controller/network into EcoStruxure Building Operation Product Line Satchwell MicroNet Environment Satchwell MicroNet MNN-30-100 Satchwell MicroNet MNN-44-100 Satchwell MicroNet MNN-50-100 Satchwell MicroNet MNN-62-100 Satchwell MicroNet MNL-C Cause Satchwell MicroNet 100 series LON networks are not supported in EcoStruxure Building Operation as a MicroNet LON network Resolution From the introduction of the MicroNet 50 series range in 2008, the MicroNet 100 series controllers with LON cards has no longer been supported and the MicroNet LON network is not supported in EcoStruxure Building Operation. Workaround: The MicroNet 100 series LON controllers can be bound to a standard LON network, using a third party network management tool such as LonMaker®  for Windows®  from Echelon. The complete MicroNet LON network could then be brought into an AS-P as a standard LON network. If this is not possible, the supported option to bring the MicroNet 100 series controllers into an AS-P or Enterprise server (ES) would be to remove the LON cards, from the MicroNet 100 series controllers and convert them to use an NCP network. The top two pairs of pins of the auxiliary card plug, would need the jumpers restored. The LON network cabling may need to be changed for a RS 484 compatible type, such as Belden 8762 or equivalent. The controller’s program would need to be re-configured for NCP using VisiSat. Then the MicroNet controller network can be imported into the AS-P, under a MicroNet NCP interface. If the LON network contains MicroNet LON touchscreens, these cannot be converted to NCP and would need to be removed from the NCP network.   The MicroNet 100 series data sheets are available here https://community.se.com/t5/Building-Automation-Knowledge/MicroNet-100-series-controller-MLi-s-and-Data-sheets/ta-p/6784   VisiSat 2.1 Build 196 – Software is available here https://ecoxpert.se.com/search?documentUUID=c93346a7-9d82-48e7-9b54-a866ac75bb71&title=VisiSat%202.1%20Build%20196%20-%20Software   VisiSat Release 2.1.196 Service Pack 1 https://ecoxpert.se.com/search?documentUUID=fd2e9849-1ffe-4c10-b3a6-5f27bac91870&title=VisiSat%20Release%202.1.196%20Service%20Pack%201%20(2.1.200)%20-%20Software   VisiSat Release 2.1.196 Service Pack 2 https://ecoxpert.se.com/search?documentUUID=839c09d2-400d-4434-8b1e-97f339545034&title=VisiSat%20Release%202.1.196%20Service%20Pack%202%20(2.1.201)%20-%20Software

Warning Hazard of Electric Shock: Remove all power from all devices before removing any covers or doors of the system. Disconnect power at the device and at the power source. Issue Need to replace an AVUE, AVUX or AVUM Mark 5 Actuator Product Line Field Devices Environment AVUE5305 AVUE5355 AVUE5304 AVUE5354 AVUX5202 AVUM5601 Cause Need to find a replacement for the obsolete AVUE, AVUX or AVUM Mark 5 actuator, that will allow the valve to be retained. Resolution The AVU* Mark 5 range of actuators can be replaced from the MZ300S range. AVUE5305 replace with MZ300S-24M AVUE5355 replace with MZ300S-24M AVUE5304 replace with MZ300S-24M AVUE5354 replace with MZ300S-24M AVUX5202 replace with MZ300S-24F AVUM5601 replace with MZ300S-230F The AVUE, AVUX, AVUM Mk 5 Datasheet is attached   MZ300S Specification sheet   MZ300S-24M Installation Instructions MZ300S-24F Installation Instructions   MZ300S-230F Installation Instructions

Issue Access Expert Integration Setup with Microsoft Active directory Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Microsoft Active Directory Resolution Overview The Feenics Appliance by Feenics runs the Feenics Active Directory Service. This service allows for secure communication between Active Directory Servers and Access Expert. The service is installed on the appliance by Feenics and is ready to use upon arrival.">The Feenics Appliance by Feenics runs the Feenics Active Directory Service. This service allows for secure communication between Active Directory Servers and Access Expert. The service is installed on the appliance by Feenics and is ready to use upon arrival. How to set up the Appliance The appliance is ready to use out of the box. Feenics will supply the password to log onto your appliance once you receive it. The appliance will need to communicate outbound over port 443 to https://api.Feenics.com  in order for the service to reach your instance in Keep by Feenics. The appliance will also need to have inbound and outbound communication to your Active Directory Server. The default ports used for this communication are either port 389 or 636 depending on if SSL is used. Why an Appliance The nature of Active Directory requires Access Expert to access the Domain Controller for Access Directory. For security purposes, Feenics has created an appliance that communicates via the LDAP protocol on the internal network and then makes outbound calls to the Feenics API server in AWS. What is on my Appliance Feenics installs 2 things on your Windows 10 appliance, the Active Directory Service and the logging software for the appliance: Active Directory Service SEQ Logs The LDAP Service is installed on the C:\\ drive of the appliance. The files will reside within the C:\Program Files (x86)\Feenics\Active Directory Service folder. It is important to not modify or alter this folder in any way. If you open your 'Services' from the windows key you will see the status of the Feenics Active Directory Service. The Active Directory service is designed to interface with 1 (one) Keep Instance. We install SEQ logs to allow the collection of a structured log of all events from the service. In most cases, these events are not needed or reviewed, however, in the case of an issue these logs provide critical information for Feenics to diagnose the problem. To access your SEQ logs, open Internet Explorer and enter the web address HTTP://localhost:5341    Active Directory Requirements Active Directory user that has appropriate read permissions on the sections you wish to pull data from. The local network must allow the Active Directory to connect to the appliance. The Active Directory Appliance must be able to connect to "https://api.Feenics.com" on port 443. Active Directory Service The Active Directory Service has the last ping associated with the Keep by Feenics UI. Open the LDAP Agent to see the most recent ping to confirm that the Active Directory Appliance is talking to the Keep Server. To check the Active Directory Service, Navigate to the General Configuration tab, select LDAP Agents Service, open one of the LDAP Agents, and view the Last Ping at the top of the page next to the user drop-down menu. This last ping shows the last communication between the Active Directory service and Keep by Feenics. Active Directory Agent The Active Directory Service will need to talk to the appliance.  When adding the LDAP Query, the IP address of the Domain Controller, the password for the panel, and port for communication will need to be specified. No two installations of the LDAP module will be the same, so it is important to work with the customer IT support team. Adding an LDAP Agent Navigate to the General Configuration tab and select LDAP Agents from the sub-menu. This will open a new tab with the LDAP Agents window. From the top left of the page, you can select the 'Add LDAP Agent’. Give the Agent a Display name. Assign an LDAP User. Click ‘OK’. This will add the Agent to the list of LDAP Agents. Double click to open the Agent and to add a query. The new LDAP Agent will need to have all the information filled out. See the above section for detailed information on each section. LDAP Query Once the LDAP Agent is created, the LDAP Query will need to be created to indicate the AD being connected to, the authentication, and the mapping required. The minimum required fields are: Display Name of LDAP Query. Person Mapping Display Name. First Name. Last Name. The LDAP Query is composed of Instance: This is the instance that the Query will reside it. This is used in enterprise instances where the query may populate a shared instance. Display Name: The name of the Query that is used throughout the instance. Username: The username that will authenticate to the AD domain controller. Password: The password associated with the username to authenticate to the AD domain controller. Host Name: The hostname or IP address of the AD domain controller. Bind Path: This is a path that limits the search within AD. This is not required but can be used to limit the query to only search a certain subset of data. Port: The port that connection will be made (selecting SSL will change the port). Query: The specific requirements that a record must meet in order to be returned. Frequency: The time in seconds between syncs. Disable: Turns off the Query. Directory Sync: Changes the Sync type to Directory Synchronization. Use SSL: Turns on or off SSL. Preserve Cards: By default, Keep turns off all assigned cards to a cardholder if they are disabled in AD. This can be overridden by checking this box. Person Mapping & Common AD References used by Keep. Note: All AD installations are different, and these examples may not accurately represent your mapping requirements. Display Name: cn First Name: givenname Last Name: sn Email: mail Home Address: true Home Phone: homephone Work Phone: telephonenumber Mobile: mobile Identification Photo: thumbnailphoto Badge Type: title Mapping Custom Forms Create a custom form. Add a new field which matches the fieldname from Active Directory. Within the AD Person mapping, add custom form. (OPTIONAL) If you are querying based on this information, ensure the field names match exactly within the query. **If your custom form was created using Pascal Case (default) then your query fieldname requires an uppercase leading character. i.e. if the AD field is ’employeeID’ the custom form field should read ‘EmployeeID’. USNChanged When a domain controller modifies an object, it sets that object's uSNChanged attribute to a value that is larger than the previous value of the uSNChanged attribute for that object and larger than the current value of the uSNChanged attribute for all other objects held on that domain controller. An application can find the most recently changed object on a domain controller by finding the object with the largest uSNChanged value. The second most recently changed object on a domain controller will have the second-largest uSNChanged value and so on. Our LDAP service keeps track of the most recent uSNChanged attribute that it has assessed and compares that when it runs its query to check if there is anything new or changed that it must import. However, the uSNChanged attribute is not replicated, therefore reading an object's uSNChanged attribute at two different domain controllers will typically give different values. Therefore, to use this method effectively we must bind to a controller to ensure we are not missing anything. If there is a load balancing operation that prevents binding to a controller then it would be better to set up the service to use Directory Synchronization. Directory Synchronization (DirSync) When you perform a DirSync search, you pass in a provider-specific data element (cookie) that identifies the directory state at the time of the previous DirSync search. For the first search, you pass in a null/blank cookie and the search returns all objects that match the filter. The search also returns a valid cookie and stores the cookie in the same storage that you are synchronizing with the Active Directory server. On subsequent searches, the cookie will be retrieved from storage and passed with the search request. The search results should now include only the objects and attributes that have changed since the previous state identified by the cookie. The search always returns a new cookie to store for the next search. Our LDAP service, when using DirSync, stores the cookie in the LDAP Query as Metadata. It is a good idea to initialize the DirSync with a very general query as the more the initialization finds the more items will be tracked moving forward. The way we have set up the LDAP DirSync is to find all the interesting objects rebind to them and ensure all the needed information is caught (we do not want to think a security roll has been removed which is our default if we can not find one in the changeset) and that it is a valid item we are searching for (initialized generally). The DirSync control is powerful, but has two significant limitations: Only for highly privileged applications: To use the DirSync control, an application must run under an account that has the SE_SYNC_AGENT_NAME privilege on the domain controller (Domain Administrator and higher). Few accounts are so highly privileged, so an application that uses the DirSync control cannot be run by ordinary users. No subtree scoping: The DirSync control returns all changes that occur within a naming context. An application interested only in changes that occur in a small subtree of a naming context must wade through many irrelevant changes, which is inefficient both for the application and for the domain controller. Example Queries objectClass=user – This query looks for all users within Active Directory. (&(ObjectClass=Person)(employeeID=ps*)) – This query looks for all Persons in Active Directory with an employee ID that starts with “ps”. (&(ObjectClass=Person)(givenname=A*)) – This query returns all Persons in Active Directory with a first name that starts with “A” (&(ObjectClass=Person)(givenname=A*)(|(department=Engineering)(department=Sales))) – This query returns all Persons in Active Directory with a first name that starts with “A” and is in either the Sales or Engineering departments. (objectClass=user)( mail=*@mail.gov)(userAccountControl=512) – This query returns all users in AD with an email at the ‘mail.gov’ domain and whose account status is normal. (&(objectClass=User)(employeeID=*)(displayName=*)(division=*)(!(principalAccount=*))(userAccountControl=512)) – This query returns all users with an employee ID, display name and division who are not a principal account and whose account is normal. (&(ObjectClass=Person)(|(company=CompanyA)(company=CompanyB)) – This query returns all people in Active Directory that work for Company A or Company B. (objectClass=user)(mail=*@mail.com) – This query returns all users in Active Directory that have an email at the ‘mail.com’ domain. (&(&(&(objectCategory=person)(objectClass=user)(employeeID=*)(| (division=1)(division=2)(division=3)(division=4) )))) ))) – This query returns all Persons in Active Directory with a user account, an assigned employee ID and are in division 1, 2, 3, or 4. Common Issues Issue Fix My LDAP Sync is pulling in people with no information Confirm you have completed the person mapping from within the LDAP Query window. If the person mapping is blank, the information has not been assigned a field within Keep. My LDAP Agent ping is recent but my last sync time on the query is not. Check your query frequency and confirm that the frequency is set to the expected value and that the last sync is within that time frame. Note: The frequency is in seconds. My query is returning zero results. Check your query spelling and formatting. A single parenthesis can change the query. Check to make sure the user given in the query that is logging into Active Directory has the proper permissions to read the information being queried. I am having trouble and have checked everything else. Check the SEQ logs at HTTP://localhost:5341  to see if any errors are being reported. For help writing a query see SEQ help site at HTTP://docs.getseq.net/docs  My query was working but stopped recently. Check to make sure no users have modified the query accidentally via the Audit Logs. Check with IT to make sure no network changes have been made recently. Even small changes can have big impacts.  

  Issue Access Expert Information is needed for Elevator Access Levels Product Line EcoStruxure Access Expert Environment Access Expert V3 Hosted Cause Access Expert Elevator Access Level configuration information  Resolution Overview The Elevator Access Levels are used to determine when a person can access certain floors. Floors can be assigned scheduled access within the Elevator Access Level to determine what floors a person has permissions to gain access to.   Elevator Access Levels Elevator Access Levels use the same Schedules as other aspects of the Keep system. Floors can be added by individual numbers or by groups of numbers with a “-“ between them.  It is important to note that People are not added to the Elevator Access Level. People are added to the Access Level for either traditional reader-controlled points such as doors or gates while at the same time being granted access to the reader controlling elevator access. This approach means that management of where and when a person can go places can all be controlled from one page.   Creating Elevator Access Levels To create a new Elevator Access Level: Select the ‘Access Configuration’ tab. Choose the “Elevator Access” button From the menu. Click “Add Elevator Access Level”. Enter a Display Name. (OPTIONAL) Select a Default Reader Mapping. Select “Add Elevator Floor Entry”. Select a Schedule. Enter the desired Floor Numbers. Click “Save” or “Save & Close”.   The Default Reader Mapping will apply the floor names assigned at the Elevator Reading Page to all readers that use the Elevator Access Level. This also allows for the selection of floors for the Elevator Access Level based on the named floors.   To Assign an Elevator Access Level: Select the ‘Access Configuration’ tab. Select “Access Levels” from the Menu. Open the desired Access Level. Select “View Elevator Access”. Click “Add Elevator Access Level Entry”. Choose an Elevator Access Level & associated Elevator Reader.  Click “Save” or “Save & Close”.   It is important to note the flow of the different type of Access Levels: Elevator Access Levels are applied to Access Levels. Access Levels are applied to People.

Issue Port information is needed for Access Expert Visitor Management Integrations   Product Line EcoStruxure Access Expert   Environment Access Expert V3 Hosted   Cause LAN port requirements for each VMS integration   Resolution   Overview The VMS connection is an important step to the setup of your VMS. Below is a chart of supported VMS and required ports. This article is valid as of 15 November 2019. It should also be noted that many of the VMS allow for the customization of ports and that is not be accounted for in this article.    Ports OpenEye Port Usage  80 TCP 2000 TCP Center/Command Incoming Port 2002 TCP Video/Image Incoming Port 2003 TCP Search Incoming Port 9876 TCP Clip Backup Incoming Port 3100 TCP 4007 TCP Live Incoming port 80 TCP 443 TCP 3478 TCP 1024-655335 In/Out Range Outgoing Ports 3001 TCP 4006 TCP DVR Incoming Port ExacqVision Port Usage 80 excaqVision Web Service (customizable) 8082 excaqVision Web Service - Web Socket (customizable) 22609 exacqVision Client computers communicating with exacqVision servers. Default port 22609.   Milestone Milestone maintains its own knowledge base with an article on ports. Management Server service and related processes Port number Protocol Process Connections from... Purpose 80 HTTP IIS All XProtect components Main communication, for example, authentication and configurations. 443 HTTPS IIS XProtect Smart Client and Management Client Authentication of basic users. 6473 TCP Management Server service Management Server tray controller, local connection only Showing status and managing the service. 7475 TCP Management Server service Windows SNMP service Communication with the SNMP extension agent. Do not use the port for other purposes even if your system does not apply SNMP. In XProtect Advanced VMS 2014 systems and older, the port number was 6475. 8080 TCP Management Server Local connection only Communication between internal processes on the server. 8080 TCP Management Server Local connection only Communication between internal processes on the server. 9000(*) HTTP Management Server Recording Server Services Web service for internal communication between servers. 9993 TCP Management Server service Recording Server services Authentication, configuration, token exchange. 12345 TCP Management Server service XProtect Smart Client Communication between the system and Matrix recipients. You can change the port number in the Management Client.    Recording Server service Port number Protocol Process Connections from... Purpose 25 SMTP Recording Server service Cameras, encoders, and I/O devices Listening for event messages from devices. The port is disabled by default. 5210 TCP Recording Server service Failover Recording Servers Merging of databases after a Failover Recording Server has been running. 5432 TCP Recording Server service Cameras, encoders, and I/O devices Listening for event messages from devices. 7474 TCP Recording Server service Windows SNMP service Communication with the SNMP extension agent. Do not use the port for other purposes even if your system does not apply SNMP. In XProtect Advanced VMS 2014 systems and older, the port number was 6474. 7563 TCP Recording Server service XProtect Smart Client, Management Client Retrieving video and audio streams, PTZ commands. 8966 TCP Recording Server service Recording Server tray controller, the local connection only Showing status and managing the service. 9001(**) HTTP Recording Server service Management Server Web service for internal communication between servers. Note: Every Recording Server service needs a port. Additional ports will be 9002, 9003, and so on. 11000 TCP Recording Server service Failover Recording Servers Polling the state of the Recording Servers. 65101 UDP Recording Server service Local connection only Listening for event notifications from the drivers.   Client components (outbound connections) XProtect Smart Client, XProtect Management Client, Milestone Mobile server, Log Server Port number Protocol Connections to... Purpose 80 HTTP Management Server service Authentication 443 HTTPS Management Server service Authentication of basic users. 7563 TCP Recording Server service Retrieving video and audio streams, PTZ commands. 22331 TCP Event Server service Alarms. 22337 TCP Log Server Server Logs (System, Audit, Rule-triggered)   Web Client, Milestone Mobile client Port number Protocol Connections to... Purpose 8081 HTTP Milestone Mobile Server Retrieving video and audio streams. 8082 HTTPS Milestone Mobile Server Retrieving video and audio streams.   DataCollector Port number Protocol Connections to... Purpose 7609 TCP Recording Server Collecting data   Avigilon Port number Protocol Connections to... 50080 HTTPS Server 55080 HTTP Default Camera Device Port 80 HTTP Streaming / Configuration 443 HTTPS Streaming / Configuration   Salient CompleteView Port number Connections to... 80   6970-7225 Completeview Server for cameras using General RTSP/UDP 4242 Data 4243 Command 4250 Config Server 4255 Admin Service 4502-4534 Webserver (optional)   Wavestore The default connect port is 8601. This is configurable.

Issue   A site has multiple locations in its instance. The goal is to restrict objects for a User in other locations by using permissions and tags which allow certain objects only for the local instance. The User also requires access to Event History, Live Monitoring and Floor plans.   After setting User permissions for specific objects, the object permissions work as expected, however clicking on Event History, Live Monitoring or a Floor plan shows: 'An error has occurred in the Live monitoring document while trying to execute initialize' Or Access Expert will show one of the following errors depending on which event object was selected: 'An error has occurred in the Event History document while trying to execute initialize' 'An error has occurred in the Floor Plan document while trying to execute initialize'   Product Line EcoStruxure Access Expert Environment Access Expert V3 Hosted Cause Event-level permissions function differently than object-level permissions Resolution User permissions set up with tags to restrict access to other locations will work as expected with objects like hardware, but these restrictions will not work with event objects.   The options to accomplish this are: 1. Buy an enterprise license and divide up the sites with their own instance. Each location should be represented by a shared instance with its controllers configured. Those controllers will publish their event to only their instances which can be controlled using permissions. This is the preferred method.   2. Allow ALL Type permissions for the hardware and event objects to be accessed. Using this method allows the event objects to work, but allows Users from other locations to access the hardware.   Event-level objects use an entirely different mechanism than regular objects. The technology under the hood requires that an enterprise license be used to accomplish event-level permission restrictions.

Issue This tool will help calculate the required M&B conversion coefficient for a given analog value in I/NET. Product Line TAC INET Environment All I/NET Controllers I/NET Resident Point Editor Cause Need to calculate an I/NET Conversion Coefficient (M&B) for a special sensor Resolution Click here to download an Excel spreadsheet that has several functions for calculating the correct M&B.

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue In Niagara Enterprise Server versions older than N4.9, the Niagara Service fails to start. Typically the service successfully starts when the 'plat installdaemon' is executed. Product Line TAC IA Series Environment I/A Series N4 Enterprise Server (earlier than N4.9) Cause The Niagara daemon fails to restart automatically after a server reboot Resolution For older Niagara versions, these are two workarounds that may work in some cases:   Option 1:  Go to Start > Run > and type regedit  Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control  With the control folder selected, right click in the pane on the right and select new DWORD Value  Name the new DWORD: ServicesPipeTimeout  Right-click ServicesPipeTimeout, and then click Modify  Click Decimal, type '180000', and then click OK  Restart the computer Option 2: Create a Task Scheduler task that calls the command "net", with the arguments "start niagara" five minutes after boot.   Alternative Solution (reported to work on Niagara older than 4.7): There are two solutions to implement in the Niagara Service. Before performing the settings below you must first have NiagaraD successfully installed. After the computer has rebooted, manually install NiagaraD using 'Plat installdaemon'. Once the service is installed implement the two configurations below. Open Windows 'Services' and then double-click the 'Niagara' service to open the Niagara Service Properties window . You can select to delay the start of the Niagara Service which helps give Windows time to initialize before the service attempts to start. Set the recovery options on the 'Recovery' tab. It is recommended to set all three 'failure' options to 'Restart the Service'

Issue PCT error 'Hardware virtualization is not enabled. Please enable in BIOS before continuing' Product Line EcoStruxure Building Operation Environment Building Operation Project Configuration Tool Windows 10 Cause Windows Hyper-V is enabled Resolution Firstly, in BIOS check and confirm the computer’s Hardware Virtualization is enabled.  See the following article which may provide assistance with this.  PCT Intel Processor Virtualization.   Once confirmed that this feature is enabled within the bios then, within Windows, open Control Panel\All Control Panel Items\Programs and Features, in the left pane select “Turn Windows features on or off” Check to see if Hyper-V is enabled: If it is, uncheck the checkbox next to Hyper-V. This change will require the computer to be restarted for the change to take effect.   If Hyper-V does not deactivate properly and gets launched automatically at startup, you can instead disable Hyper-V through an elevated command prompt with the following command: bcdedit /set hypervisorlaunchtype off  

Issue An unexpected database error occurred. "There can only be one LCA Object Server ActiveX control per process. Please make sure that you only have a single Object Server control in this process." "Could not listen on _poet/tcp: The address is already in use or another server already running. (-2532)" Environment LonMaker NL220 Vista LNS Cause Microsoft Exchange 2003 Server and other OEM software sometimes use TCP ports 6001 or 6002. This causes a conflict since the POET server (FastObjects DB) defaults to TCP ports 6001 and 6002. Resolution For an automated solution, refer to: https://community.se.com/t5/TAC-Vista-Forum/LonMaker-POET-Port-Changer/td-p/271427   For a full explanation from Dialog Semiconductor, refer to: https://edgesupport.diasemi.com/hc/en-us/articles/206494283   Further details   Check that the ports used by LNS are not being blocked (firewalled) or used by another application. To verify this, type in the following command from a DOS prompt: netstat -bn You should now get a list of in-use TCP ports. Look for an entry saying {your computer name}:6001 or 6002. If you find one, you have located a conflict and you will need to change the POET Port numbers. Check if you run a firewall on this PC. If yes, you need to find the list of Programs with their Internet Access level and make sure you have given access to the appropriate files. To run LonMaker/LNS , you need to give access to ptserv32.exe, LonMaker.exe, lonpoint.exe, visio.exe, lmwbrw32.exe and lsass.exe. You can modify the ports used by the POET server and clients by modifying the "Services" file (%WINDIR%\System32\Drivers\Etc\Services) using a text editor like Wordpad.exe or Notepad.exe. For example, to change the POET port numbers to 7001 and 7002, add/modify the following lines in the "Services" file. The  '#' in the example indicates that the following text is a comment. For Win XP: use "Windows\System32\Drivers\Etc\Services". If you see the "poet" and "_poet" entries, go ahead and change the port numbers from 6001 and 6002 to 7001 and 7002. If you don't see these entries, simply add the lines below. poet          7001/tcp    #FastObjects services _poet        7002/tcp    #FastObjects services https://echelon.force.com/support/s/search/All/Home/562?tabset-95728=2

Issue There is a need to know which card formats are supported by Continuum Product Line Andover Continuum Environment Access Control Continuum Cyberstation Cause There are many different card formats available from HID, so there is a need to know which formats that Continuum allows. Resolution Here are the formats that HID offers: 26-Bit Format: H10301 HID Proprietary 37-Bit Format: H10302 **** HID Proprietary 37-Bit Format with facility code: H10304 Corporate 1000 Formats HID Long Format Card Programming OEM Proprietary Formats (i.e. Continuum 37) 35-Bit Card Format Formats 1, 4, and 6 above are supported natively We support all the other formats (as custom cards) so long as the format does not exceed 64-bits and the format can be supplied or understood. (i.e. start/end bit of the site code, card number, etc.)   ****IMPORTANT Continuum supports a maximum of 32 bits for the Card Number field, any format above, such as the H10302, that defines more than 32 bits for Card Number field will only work if the card number range used at the site is between 1 and 4,294,967,295, any card number above 4,294,967,295 will NOT be read correctly by the controller. A possible solution for this limitation is to use the Extended Custom Cards feature supported ONLY in the ACX5720 and ACX5740 controllers.   More information about Extended Custom Cards https://community.se.com/t5/Building-Automation-Knowledge/Extended-Custom-Wiegand-features-available-for-ACX57xx/ta-p/1215 

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue Security Expert Installation steps for separate SQL, SX application Server, and Client for use with Windows Authentication and Active Directory Product Line Security Expert Environment Microsoft SQL Server Microsoft Windows10 Security Expert Server and Client  Cause Access Denied error appears when attempting to log into Security Expert with Windows Authentication with a multiple PC Security Expert Installation Resolution Important considerations when connecting Security Expert to an external SQL Server: Machines should be on the same network and Domain. When you install Security Expert, reference the SQL database in this form:  Machine Name\SQL Instance Name The Windows user account doing the installation must have admin rights on both machines. The windows login you're using to install on the Security Expert machine has to have admin privileges to alter the SQL Database on the remote machine. The easiest way to do this is to use the same account to set up all machines. Different accounts can be used, but the accounts have to have privileges added to the SQL Database manually. (Not covered in this document)   Assumptions: Active Directory server has a domain user that can be used to install the applications on all machines. Licenses cover all machines Security Expert users are set up to use Windows Authentication (snapshots at the end of the document) If the SQL server ever had Security Expert Installed on it, uninstall Security Expert and reboot. If the Security Expert application server had SQL on it, uninstall SQL, reboot and reinstall Security Expert without local SQL. If the Client PC had Server components installed, uninstall Security Expert, reboot and install the client only.   Perform the SQL Server Installation onto a separate Server per the Security Expert Installation Instructions Security Expert Application Server/Client installation (No SQL) If this box is selected, the install may fail because the service has not been installed yet. With this option selected, the install will finish and then the service can be configured later. 3. Change the database server to NOT be localhost\SecurityExpert Use machinenameofSQLServer\SecurityExpert (Ex. SECEXPERTVM\SecurityExpert) 4. Select Windows Authentication Complete the installation.   5. Open Windows Services on the Security Expert Application Server (Run> services.msc) Right-click on Security Expert Data Service> Properties Select the Log On tab Deselect Login As Local System Account Select This account and then click browse to search for the domain admin user   Start the service. Security Expert Data Service, Security Expert Event Service, and Security Expert Update should all start   Client only setup - Ensure the Server option is deselected In the following dialog select Custom   7. Select the drop-down next to Server> then select “This feature will not be available” Complete the installation   A successful login with the domain admin account using Windows Authentication from the Security Expert machine and also the client PC should work.   From the Client PC – Security Expert application server = 10.169.90.170 From the Security Expert Server/Client SecurityExpertSV.exe.config (Server) – This file did not have to be changed    SecurityExpert.exe.config (Client) - This file did not have to be changed   Note: There may be circumstances where these files do need to be configured. See LL https://community.se.com/t5/Knowledge-Base/Security-Expert-Error-Server-Has-Rejected-Client-Credentials/ta-p/698   Domain Tab example set up in Security Expert for Active Directory Windows Authentication   Operator Example setup in Security Expert for Windows Authentication   Global Support Lab Testing SX Application Server (Windows10 1803) SQL Server – Server 2012 R2 with SQL 2016 SP1 (VM) SX Client – Window 8.1 Pro

Issue What is the difference between an EBO SmartDriver and Smart Connector? Product Line EcoStruxure Building Operation Environment Building Operation SmartDriver Cause SmartDriver and Smart Connector enhance the openness for the EcoStruxure Building Operation, EBO, BMS system. They enable integration between EBO and 3rd party systems, even via not supported or nonstandard protocols. Resolution SmartDriver: SmartDriver enables you to create a customized interface to monitor and control 3rd party devices from the EBO server. The following block diagram shows a SmartDriver Interface and a SmartDriver Driver. The SmartDriver Interface (similar in concept to other protocol interfaces such as Modbus and BACnet) is part of EcoStruxure Building Operation software and enables you to create SmartDriver objects in the System Tree pane. The SmartDriver Driver is installed on the server drive and provides the network communications control. More information at Web Help SmartDriver Overview. Smart Connector: A development framework that simplifies and accelerates integrations with third-party systems or other data sources. It is an open, extensible and configurable application framework that allows developers to create innovative new capabilities, applications, and solutions that extend and enhance EcoStruxure Building solutions. The Smart Connector itself runs outside the EBO server and consume or server data to EBO server via the EcoStruxure web services "EWS". Watch short explainer video for more information: https://www.youtube.com/embed/DXHvRRL4ycY   For more information, visit the Smart Connector Developer Community on the Exchange: https://community.se.com/t5/SmartConnector/ct-p/smart-connector   For developers wanting to get started using the Smart Connector framework visit: https://www.smartconnectorserver.com   Smart Connector shop at Exchange:  https://shop.exchange.se.com/en-US/home 

Issue Need to upgrade V3 Access Expert On Premise software to the most current version in order to gain additional functionality. Product Line Access Expert Environment Access Expert Premise Software V3  Cause It is unclear how to upgrade the Premise V3 software to the most current version of V3. Resolution Access Expert Premise Upgrades now require an SLA to obtain the actual software. Please contact your Sales and/or Security Contact for more details. Both the Access Expert (AX) Premise Server and Client Software need to be upgraded in order for additional features to work. Please note that you will experience issues if your AX clients do not match the AX server version. Take a backup of Mongo database (See MongoDB Backup section located here: https://community.se.com/t5/Building-Automation-Knowledge/Backup-and-Restore-MongoDB-for-Windows-for-Access-Expert-On/ta-p/583) Ensure ALL Windows Updates are completed. Capture screenshots of software installed on server. This can be done by navigating to Control Panel > Add/Remove Programs. It is imperative that you capture the following software and their versions: Access Expert Keep MongoDB SEQ At the writing of this, AX 20.3.1 is the latest. Please check this link to see if there is a new release. Once you have the software downloaded, there will be seven (7) files in the folder: Right-click on “Feenics.Keep.Installer.exe” From there, follow the steps from the Keep by Feenics On Premise Deployment Walkthrough starting from page 8 through page 18.  Note: You must be logged into the Feenics website to access the link in this step.  Navigate to https://www.feenics.com/training/ to login and then click the link above in this step. After a successful installation, click on the “Setup_AX.msi” or “Setup_AX.exe” file to install the latest On Premise client for customer machines. If you run into any issues, please contact Product Support and Services by submitting a case here: https://www.nampss.com/ If you require assistance or would like Schneider Electric to perform this upgrade for you, you can submit a request for that here: https://www.nampss.com/apps_request.php

Warning Electrostatic Discharge Required: Always discharge static electricity from your person by touching metal prior to handling any hardware. Failure to do so may result in damage to devices. Issue Introducing a previously commissioned Continuum IOU module such as an AC-1 to an Access Expert or Security Expert site can cause communication issues in the LON bus due to duplicated node id. Product Line Andover Continuum, EcoStruxure Security Expert, EcoStruxure Access Expert Environment Continuum AC-1 Continuum Net Controller Continuum Net Controller II Access Expert Controller Security Expert Controller Cause When IOU modules are commissioned in a Continuum system, the Net Controller assigns each module a Node ID, this is in addition to the LON Module ID that is unique to each module hardware, the purpose of the Node ID, is to decouple the identifier used by Continuum for communication from the specific piece of hardware, this in order to facilitate the replacement of a failed module without the need to change its Continuum identifier. The module stores the Node ID in nonvolatile memory so that it persists across power loss. If a Continuum IOU module is introduced to a LON network (Security Expert SP-AC1 or Access Expert AX-SSC) without clearing its Node ID, there is a risk of creating a duplicate Node ID condition that will prevent the LON network from operating properly. IMPORTANT This should not be an issue during the normal transition of Continuum site to Security Expert or Access Expert, as all the modules on the running LON bus should have unique Node IDs, this is only a problem when adding a module, or replacing a module with one that has been used before. Resolution In order to signal its presence on the LON network, each module will transmit on resetting its status network variable. If upon receiving this message, the Net Controller determines that the module is NOT in its local database, the controller will decommission the module by setting its Node ID to zero. Before introducing a Continuum IOU module that has been previously commissioned to the LON network of an SP-AC1 or SX-SSC controller, decommission the IOU module using the steps below: Attach the module to an empty Net Controller that is powered down with its battery removed. For a Net Controller II, in order to be absolutely sure that the Net Controller has an empty database, you may need to clear its backup in flash from a browser or by the use of the reset IP switch. See LL on how to use the controller's reset IP switch to clear its flash backup https://community.se.com/t5/Building-Automation-Knowledge/How-to-clear-the-controller-flash-backup-from-the-hardware-using/ta-p/5877 Power up the Net Controller Once the CPU led on the Net Controller starts blinking, press the 'Reset' button on the IOU module. Wait 30 seconds to make sure the decommissioning process has completed. Power down the Net Controller Remove the IOU module

Issue When running VisiSat 2.1 build 196 (200 or 201) a message is displayed - “Unable to Load the Schneider Electric CET Style DLL” and VisiSat fails to launch. Product Line Satchwell MicroNet Environment Windows (Windows, XP Professional, Windows 7, Windows Vista Ultimate) Microsoft Visio Cause .NET Framework 2.0 is not installed. Resolution Check that the version of VisiSat installed is either v2.1 196 or for SP1 build 200 or for SP2 build 201 on a computer running with a supported operating system and Microsoft’s Visio version.   MicroNet Software Datasheet   The suggested procedure to correct the “Unable to Load the Schneider Electric CET Style DLL” issue as follows: - Uninstall VisiSat Install .NET Framework 2.0 Install VisiSat 2.1 196, add service packs 1 and 2 files as required. Re-boot computer Run VisiSat. Links to VisiSat software and information:   The VisiSat main software can be downloaded from the link below: https://ecoxpert.se.com/search?documentUUID=c93346a7-9d82-48e7-9b54-a866ac75bb71&title=VisiSat%202.1%20Build%20196%20-%20Software   VisiSat service pack 1 can be downloaded from the link below: https://ecoxpert.se.com/search?documentUUID=fd2e9849-1ffe-4c10-b3a6-5f27bac91870&title=VisiSat%20Release%202.1.196%20Service%20Pack%201%20(2.1.200)%20-%20Software   VisiSat service pack 2 can be downloaded from the link below: https://ecoxpert.se.com/search?documentUUID=839c09d2-400d-4434-8b1e-97f339545034&title=VisiSat%20Release%202.1.196%20Service%20Pack%202%20(2.1.201)%20-%20Software   VisiSat documentation can be downloaded from the link below: https://community.se.com/t5/Building-Automation-Knowledge/Download-latest-VisiSat-Data-Sheets-Engineering-Guides/ta-p/6110

Issue Is it possible to print alarms automatically with SBO Workstation in matrix printer whenever there is an alarm? Product Line EcoStruxure Building Operation Environment Building Operation Workstation Cause A number of sites still prefer to directly connect a Dot Matrix Printer to their BMS to automatically print off incoming alarms rather than using more modern emailing of alarms available from EBO. Resolution The following File2Printer software has been made freely available on the EcoStruxure Building Operation Community for exactly this purpose. https://community.se.com/t5/EcoStruxure-Building-Operation/File2Printer/m-p/351127#M71948

Issue 37-bit cards not working correctly even though a Credential Type has been configured correctly for Infinity37 cards (as seen below), the site code and/or card number read does not match what is printed on the card or the expected value. Parity errors could also be seen if the card is not truly of the Infinity37 format. Product Line Security Expert Environment Security Expert Server Security Expert Controller Cause Various cards have 37-bit data lengths but different formats; some guidance is needed on how to differentiate the ACC Infinity37 cards.  Resolution There are two pieces of data that can be used to verify if a 37-bit card is ACC Infinity27 format.   ACC Infinity 37 card format includes a Manufacturer's Code field; the field is 4 bits long, starting on the second bit and ending on the fifth bit. The Manufacturer's Code field always has a value of 4, the first bit of the card is used for the ODD parity, so the first 5 bits of ALL ACC Infinity37 cards ALWAYS look like P0100.... If we see a raw bitstream of a 37-bit card like the one in the screen capture below, we can immediately determine that even though the card has 37 bits, it is NOT an Infinity37 card since bits 2,3,4 and 5 do not add up to a value of 4 See https://community.se.com/t5/Building-Automation-Knowledge/How-to-display-RAW-bit-data-stream-of-Wiegand-card-in-Security/ta-p/390720  We can not assume that because a 37-bit card has  0100 on bits 2-5 it is 100% evidence that the card is indeed an Infinity37 card since that pattern (0100) could be present on the card as part of a different field (i.e., Site Code) on a different 37-bit card format. The second piece of data that could help determine if the card is true of the Infinity37 format is the parity bits, Infinity37 card format has a somewhat unique interlaced parity scheme. If parity errors are seen when cards are presented to the reader, this should be taken as an indication that the 37-bit card might not be Infinity37 card format. The attached zip file contains an Excel sheet that can be used to calculate the parity bits of an ACC Infinity37 card by entering the raw bitstream of the card; if the calculated values for both parity bits (bits 1 and 37) do not match what the card has, then the card is NOT an Infinity37 card format.    

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue There is a limit of around 200 user-created objects in b3/i2 devices, once that limit is reached, an attempt to create a new object of any type in the device will result in  "Invalid Handle" error. See https://community.se.com/t5/Building-Automation-Knowledge/Creating-an-object-in-a-BACnet-B3-or-Infinet-controller-results/ta-p/9490 for more info.   Product Line Andover Continuum, EcoStruxure Building Operation Environment Continuum b3920 Controller Continuum i2920 Controller Cause Each Continuum object is represented in the system by a "Handle Id", in b3/i2 devices, the handle ID is stored in the controller as a byte value which allows for a maximum of 255 handles, the system objects (System Variables etc.) use around 55 of the handles leaving around 200 for user-created objects.  CX controllers store handle IDs using a 2 bytes value, which allows for 65535 handles, CX controllers rarely run out of handle IDs. Resolution One way to deal with this limitation in the Continuum field devices is to combine InfinityNumeric, InfinityDateTime objects (when possible) into one object configured as an array (manual log).   EXAMPLE: The screen capture below shows 10 InfinityNumeric objects in an i2920 device that are used in the control application of a room named "MainLab"     Let's say for the purpose of this illustration that the following is the control program for MainLab     Since InfinityNumeric objects MainLab.a thru MainLab.j are used exclusivity to store values *** (i.e Setpoint etc), we can configure one of the objects as an array and have it hold all 10 values, thus allowing us to delete 9 InfinityNumeric objects and free 9 handle ids       Before deleting MainLab.b thru MainLab.j we need to modify ALL references to those objects, instead of referencing MainLab.b - MainLab.j we need to reference MainLab.a[1] - MainLab.a[9], note that MainLab.a holds its value (70) normally (not as part of the array), so in this case, we are only using 9 of the 10 array elements.     ***IMPORTANT Only InfinityNumeric and InfinityDateTime objects that are used exclusively to hold a value should be combined, if the object is being used for any of the following operations then it should be left as its own object.   Object triggers one or more programs Object is configured as a log Object is Occupancy flag of a schedule Object has alarms associated with it or is alarm point Object is a setpoint

Issue Are there any Example Reports for the new native Notification Reports which came out in EBO 3.2 to replace the now deprecated WebReports and Report Server? Product Line EcoStruxure Building Operation Environment Building Operation Workstation Cause As of EBO 2022 (4.0) WebReports and the Report Server have now been deprecated and replaced by External Log Storage using Postgres SQL and Timescale DB, plus the new native Notification Reports which are now built into EBO 3.2 and above, but there are no examples to help new starters to get going. Resolution A Schneider-Electric Community page has been set up specifically for Notification Report users so that they can share their Reports and collaborate on Reporting ideas: https://community.se.com/t5/EcoStruxure-Building-Operation/Reports-showcase-share-your-reports/m-p/388619#M75732