Issue Metasys® N2 Integration to SBO Product Line EcoStruxure Building Operation Environment Struxureware Building Operation Metasys N2 Cause This Quick Start Guide will assist the Schneider Electric branch or dealer installation team with the basic steps to bring the virtual BACnet devices emulated by the S4 Open: BACnet-N2 Router into the SmartStruxure environment as part of a Johnson Controls Metasys® N2 integration into SBO. This document is not intended to be a full tutorial or user manual for either the S4 Open: BACnet N2 Router or the SmartStruxure system. Refer to the manufacturer’s documentation for each of these systems for detailed information. S4 documentation, the complete Device Template library, and support utilities can be found on the support CD delivered with your S4 Open appliance. Please contact the S4 group for any questions on this process.  Resolution Step 1:   Follow the installation instructions provided with the S4 Open: BACnet-N2 Router to discover and publish the N2 devices in the Metasys® installation to BACnet IP. All operations in SmartStruxure will be against these emulated BACnet IP devices each representing the underlying N2 device. Investigate before you integrate! Validate the N2 bus to make sure that it is electrically in spec and that all N2 devices are working properly before starting the integration process. Assign a unique BACnet virtual network number to each S4 Open: BACnet-N2 Router. N2 devices connected to this S4 Open appliance are published as emulated BACnet IP devices under that network. The Configure Wizard in the S4 Open Management Console will assist you with generating a unique BACnet Device ID for each N2 device. Point instance numbers are included as attributes in our Device Templates for all application-specific controllers. Either of these can be manually overridden in the S4 Open Management Console to meet unique requirements. The S4 Metasys® Configuration File Conversion Utility can be downloaded from the S4 Group web site and will assist you in creating custom Device Templates for DX-9100 devices or application-specific controllers. You will need the corresponding .DMO or .PRN files as input to this utility. A detailed understanding of Metasys® N2 devices, the Metasys® system, and the associated configuration and commissioning utilities are necessary to support successful integrations. If you don’t have this expertise in-house, The S4 Group can recommend a consultant to assist you. NOTE: We highly recommend that you attend a two-day S4 Boot Camp to make sure that you have all the skills necessary to install and configure the S4 Open: BACnet-N2 Router. Step 2: Bring up the SmartStruxure BACnet discovery tab and select BACnet devices. In this example, you can see that the S4 Open BACnet-N2 Router was defined in Network 1 and the N2 devices are in Network 122. The other device in Network 1 in this example is a JCI NAE. The best practice is to assign the S4 Open: BACnet-N2 Router to the BACnet network that you are using as your BACnet backbone. As with any BACnet device, the BACnet-N2 Router must be assigned a unique BACnet device ID. Step 3: Expand the navigation pane to expose the BACnet Interface / IP Network folder. Then select and drag the N2 devices from the Device Discovery tab to the IP Network folder. SmartStruxure will tell you that an Upload is required. Respond OK. Step 4: Navigate to the IP Network folder, select the properties page for each device, and request an Upload operation. This will bring the device properties and point list for each N2 device into SmartStruxure. SmartStruxure will respond with the following confirmation as each upload is completed. Step 5: When the Upload process is completed for all N2 devices and the S4 Open: BACnet-N2 Router, you can continue your SmartStruxure installation process as you would for any BACnet device. Note that there will be no points published under the S4 Open: BACnet-N2 Router itself but you will be able to confirm the Operational Status of the system from SmartStruxure. The Schneider Electric support organization will supply pre-sales engineering support and first-level technical support for the Metasys® N2 to SBO integration solution. The S4 Group will be available to provide 2nd level support to these integration projects.  

Issue Access Expert Integration Setup with Microsoft Active directory Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Microsoft Active Directory Resolution Overview The Feenics Appliance by Feenics runs the Feenics Active Directory Service. This service allows for secure communication between Active Directory Servers and Access Expert. The service is installed on the appliance by Feenics and is ready to use upon arrival.">The Feenics Appliance by Feenics runs the Feenics Active Directory Service. This service allows for secure communication between Active Directory Servers and Access Expert. The service is installed on the appliance by Feenics and is ready to use upon arrival. How to set up the Appliance The appliance is ready to use out of the box. Feenics will supply the password to log onto your appliance once you receive it. The appliance will need to communicate outbound over port 443 to https://api.Feenics.com  in order for the service to reach your instance in Keep by Feenics. The appliance will also need to have inbound and outbound communication to your Active Directory Server. The default ports used for this communication are either port 389 or 636 depending on if SSL is used. Why an Appliance The nature of Active Directory requires Access Expert to access the Domain Controller for Access Directory. For security purposes, Feenics has created an appliance that communicates via the LDAP protocol on the internal network and then makes outbound calls to the Feenics API server in AWS. What is on my Appliance Feenics installs 2 things on your Windows 10 appliance, the Active Directory Service and the logging software for the appliance: Active Directory Service SEQ Logs The LDAP Service is installed on the C:\\ drive of the appliance. The files will reside within the C:\Program Files (x86)\Feenics\Active Directory Service folder. It is important to not modify or alter this folder in any way. If you open your 'Services' from the windows key you will see the status of the Feenics Active Directory Service. The Active Directory service is designed to interface with 1 (one) Keep Instance. We install SEQ logs to allow the collection of a structured log of all events from the service. In most cases, these events are not needed or reviewed, however, in the case of an issue these logs provide critical information for Feenics to diagnose the problem. To access your SEQ logs, open Internet Explorer and enter the web address HTTP://localhost:5341    Active Directory Requirements Active Directory user that has appropriate read permissions on the sections you wish to pull data from. The local network must allow the Active Directory to connect to the appliance. The Active Directory Appliance must be able to connect to "https://api.Feenics.com" on port 443. Active Directory Service The Active Directory Service has the last ping associated with the Keep by Feenics UI. Open the LDAP Agent to see the most recent ping to confirm that the Active Directory Appliance is talking to the Keep Server. To check the Active Directory Service, Navigate to the General Configuration tab, select LDAP Agents Service, open one of the LDAP Agents, and view the Last Ping at the top of the page next to the user drop-down menu. This last ping shows the last communication between the Active Directory service and Keep by Feenics. Active Directory Agent The Active Directory Service will need to talk to the appliance.  When adding the LDAP Query, the IP address of the Domain Controller, the password for the panel, and port for communication will need to be specified. No two installations of the LDAP module will be the same, so it is important to work with the customer IT support team. Adding an LDAP Agent Navigate to the General Configuration tab and select LDAP Agents from the sub-menu. This will open a new tab with the LDAP Agents window. From the top left of the page, you can select the 'Add LDAP Agent’. Give the Agent a Display name. Assign an LDAP User. Click ‘OK’. This will add the Agent to the list of LDAP Agents. Double click to open the Agent and to add a query. The new LDAP Agent will need to have all the information filled out. See the above section for detailed information on each section. LDAP Query Once the LDAP Agent is created, the LDAP Query will need to be created to indicate the AD being connected to, the authentication, and the mapping required. The minimum required fields are: Display Name of LDAP Query. Person Mapping Display Name. First Name. Last Name. The LDAP Query is composed of Instance: This is the instance that the Query will reside it. This is used in enterprise instances where the query may populate a shared instance. Display Name: The name of the Query that is used throughout the instance. Username: The username that will authenticate to the AD domain controller. Password: The password associated with the username to authenticate to the AD domain controller. Host Name: The hostname or IP address of the AD domain controller. Bind Path: This is a path that limits the search within AD. This is not required but can be used to limit the query to only search a certain subset of data. Port: The port that connection will be made (selecting SSL will change the port). Query: The specific requirements that a record must meet in order to be returned. Frequency: The time in seconds between syncs. Disable: Turns off the Query. Directory Sync: Changes the Sync type to Directory Synchronization. Use SSL: Turns on or off SSL. Preserve Cards: By default, Keep turns off all assigned cards to a cardholder if they are disabled in AD. This can be overridden by checking this box. Person Mapping & Common AD References used by Keep. Note: All AD installations are different, and these examples may not accurately represent your mapping requirements. Display Name: cn First Name: givenname Last Name: sn Email: mail Home Address: true Home Phone: homephone Work Phone: telephonenumber Mobile: mobile Identification Photo: thumbnailphoto Badge Type: title Mapping Custom Forms Create a custom form. Add a new field which matches the fieldname from Active Directory. Within the AD Person mapping, add custom form. (OPTIONAL) If you are querying based on this information, ensure the field names match exactly within the query. **If your custom form was created using Pascal Case (default) then your query fieldname requires an uppercase leading character. i.e. if the AD field is ’employeeID’ the custom form field should read ‘EmployeeID’. USNChanged When a domain controller modifies an object, it sets that object's uSNChanged attribute to a value that is larger than the previous value of the uSNChanged attribute for that object and larger than the current value of the uSNChanged attribute for all other objects held on that domain controller. An application can find the most recently changed object on a domain controller by finding the object with the largest uSNChanged value. The second most recently changed object on a domain controller will have the second-largest uSNChanged value and so on. Our LDAP service keeps track of the most recent uSNChanged attribute that it has assessed and compares that when it runs its query to check if there is anything new or changed that it must import. However, the uSNChanged attribute is not replicated, therefore reading an object's uSNChanged attribute at two different domain controllers will typically give different values. Therefore, to use this method effectively we must bind to a controller to ensure we are not missing anything. If there is a load balancing operation that prevents binding to a controller then it would be better to set up the service to use Directory Synchronization. Directory Synchronization (DirSync) When you perform a DirSync search, you pass in a provider-specific data element (cookie) that identifies the directory state at the time of the previous DirSync search. For the first search, you pass in a null/blank cookie and the search returns all objects that match the filter. The search also returns a valid cookie and stores the cookie in the same storage that you are synchronizing with the Active Directory server. On subsequent searches, the cookie will be retrieved from storage and passed with the search request. The search results should now include only the objects and attributes that have changed since the previous state identified by the cookie. The search always returns a new cookie to store for the next search. Our LDAP service, when using DirSync, stores the cookie in the LDAP Query as Metadata. It is a good idea to initialize the DirSync with a very general query as the more the initialization finds the more items will be tracked moving forward. The way we have set up the LDAP DirSync is to find all the interesting objects rebind to them and ensure all the needed information is caught (we do not want to think a security roll has been removed which is our default if we can not find one in the changeset) and that it is a valid item we are searching for (initialized generally). The DirSync control is powerful, but has two significant limitations: Only for highly privileged applications: To use the DirSync control, an application must run under an account that has the SE_SYNC_AGENT_NAME privilege on the domain controller (Domain Administrator and higher). Few accounts are so highly privileged, so an application that uses the DirSync control cannot be run by ordinary users. No subtree scoping: The DirSync control returns all changes that occur within a naming context. An application interested only in changes that occur in a small subtree of a naming context must wade through many irrelevant changes, which is inefficient both for the application and for the domain controller. Example Queries objectClass=user – This query looks for all users within Active Directory. (&(ObjectClass=Person)(employeeID=ps*)) – This query looks for all Persons in Active Directory with an employee ID that starts with “ps”. (&(ObjectClass=Person)(givenname=A*)) – This query returns all Persons in Active Directory with a first name that starts with “A” (&(ObjectClass=Person)(givenname=A*)(|(department=Engineering)(department=Sales))) – This query returns all Persons in Active Directory with a first name that starts with “A” and is in either the Sales or Engineering departments. (objectClass=user)( mail=*@mail.gov)(userAccountControl=512) – This query returns all users in AD with an email at the ‘mail.gov’ domain and whose account status is normal. (&(objectClass=User)(employeeID=*)(displayName=*)(division=*)(!(principalAccount=*))(userAccountControl=512)) – This query returns all users with an employee ID, display name and division who are not a principal account and whose account is normal. (&(ObjectClass=Person)(|(company=CompanyA)(company=CompanyB)) – This query returns all people in Active Directory that work for Company A or Company B. (objectClass=user)(mail=*@mail.com) – This query returns all users in Active Directory that have an email at the ‘mail.com’ domain. (&(&(&(objectCategory=person)(objectClass=user)(employeeID=*)(| (division=1)(division=2)(division=3)(division=4) )))) ))) – This query returns all Persons in Active Directory with a user account, an assigned employee ID and are in division 1, 2, 3, or 4. Common Issues Issue Fix My LDAP Sync is pulling in people with no information Confirm you have completed the person mapping from within the LDAP Query window. If the person mapping is blank, the information has not been assigned a field within Keep. My LDAP Agent ping is recent but my last sync time on the query is not. Check your query frequency and confirm that the frequency is set to the expected value and that the last sync is within that time frame. Note: The frequency is in seconds. My query is returning zero results. Check your query spelling and formatting. A single parenthesis can change the query. Check to make sure the user given in the query that is logging into Active Directory has the proper permissions to read the information being queried. I am having trouble and have checked everything else. Check the SEQ logs at HTTP://localhost:5341  to see if any errors are being reported. For help writing a query see SEQ help site at HTTP://docs.getseq.net/docs  My query was working but stopped recently. Check to make sure no users have modified the query accidentally via the Audit Logs. Check with IT to make sure no network changes have been made recently. Even small changes can have big impacts.  

  Issue Access Expert Information is needed for Elevator Access Levels Product Line EcoStruxure Access Expert Environment Access Expert V3 Hosted Cause Access Expert Elevator Access Level configuration information  Resolution Overview The Elevator Access Levels are used to determine when a person can access certain floors. Floors can be assigned scheduled access within the Elevator Access Level to determine what floors a person has permissions to gain access to.   Elevator Access Levels Elevator Access Levels use the same Schedules as other aspects of the Keep system. Floors can be added by individual numbers or by groups of numbers with a “-“ between them.  It is important to note that People are not added to the Elevator Access Level. People are added to the Access Level for either traditional reader-controlled points such as doors or gates while at the same time being granted access to the reader controlling elevator access. This approach means that management of where and when a person can go places can all be controlled from one page.   Creating Elevator Access Levels To create a new Elevator Access Level: Select the ‘Access Configuration’ tab. Choose the “Elevator Access” button From the menu. Click “Add Elevator Access Level”. Enter a Display Name. (OPTIONAL) Select a Default Reader Mapping. Select “Add Elevator Floor Entry”. Select a Schedule. Enter the desired Floor Numbers. Click “Save” or “Save & Close”.   The Default Reader Mapping will apply the floor names assigned at the Elevator Reading Page to all readers that use the Elevator Access Level. This also allows for the selection of floors for the Elevator Access Level based on the named floors.   To Assign an Elevator Access Level: Select the ‘Access Configuration’ tab. Select “Access Levels” from the Menu. Open the desired Access Level. Select “View Elevator Access”. Click “Add Elevator Access Level Entry”. Choose an Elevator Access Level & associated Elevator Reader.  Click “Save” or “Save & Close”.   It is important to note the flow of the different type of Access Levels: Elevator Access Levels are applied to Access Levels. Access Levels are applied to People.

Issue Port information is needed for Access Expert Visitor Management Integrations   Product Line EcoStruxure Access Expert   Environment Access Expert V3 Hosted   Cause LAN port requirements for each VMS integration   Resolution   Overview The VMS connection is an important step to the setup of your VMS. Below is a chart of supported VMS and required ports. This article is valid as of 15 November 2019. It should also be noted that many of the VMS allow for the customization of ports and that is not be accounted for in this article.    Ports OpenEye Port Usage  80 TCP 2000 TCP Center/Command Incoming Port 2002 TCP Video/Image Incoming Port 2003 TCP Search Incoming Port 9876 TCP Clip Backup Incoming Port 3100 TCP 4007 TCP Live Incoming port 80 TCP 443 TCP 3478 TCP 1024-655335 In/Out Range Outgoing Ports 3001 TCP 4006 TCP DVR Incoming Port ExacqVision Port Usage 80 excaqVision Web Service (customizable) 8082 excaqVision Web Service - Web Socket (customizable) 22609 exacqVision Client computers communicating with exacqVision servers. Default port 22609.   Milestone Milestone maintains its own knowledge base with an article on ports. Management Server service and related processes Port number Protocol Process Connections from... Purpose 80 HTTP IIS All XProtect components Main communication, for example, authentication and configurations. 443 HTTPS IIS XProtect Smart Client and Management Client Authentication of basic users. 6473 TCP Management Server service Management Server tray controller, local connection only Showing status and managing the service. 7475 TCP Management Server service Windows SNMP service Communication with the SNMP extension agent. Do not use the port for other purposes even if your system does not apply SNMP. In XProtect Advanced VMS 2014 systems and older, the port number was 6475. 8080 TCP Management Server Local connection only Communication between internal processes on the server. 8080 TCP Management Server Local connection only Communication between internal processes on the server. 9000(*) HTTP Management Server Recording Server Services Web service for internal communication between servers. 9993 TCP Management Server service Recording Server services Authentication, configuration, token exchange. 12345 TCP Management Server service XProtect Smart Client Communication between the system and Matrix recipients. You can change the port number in the Management Client.    Recording Server service Port number Protocol Process Connections from... Purpose 25 SMTP Recording Server service Cameras, encoders, and I/O devices Listening for event messages from devices. The port is disabled by default. 5210 TCP Recording Server service Failover Recording Servers Merging of databases after a Failover Recording Server has been running. 5432 TCP Recording Server service Cameras, encoders, and I/O devices Listening for event messages from devices. 7474 TCP Recording Server service Windows SNMP service Communication with the SNMP extension agent. Do not use the port for other purposes even if your system does not apply SNMP. In XProtect Advanced VMS 2014 systems and older, the port number was 6474. 7563 TCP Recording Server service XProtect Smart Client, Management Client Retrieving video and audio streams, PTZ commands. 8966 TCP Recording Server service Recording Server tray controller, the local connection only Showing status and managing the service. 9001(**) HTTP Recording Server service Management Server Web service for internal communication between servers. Note: Every Recording Server service needs a port. Additional ports will be 9002, 9003, and so on. 11000 TCP Recording Server service Failover Recording Servers Polling the state of the Recording Servers. 65101 UDP Recording Server service Local connection only Listening for event notifications from the drivers.   Client components (outbound connections) XProtect Smart Client, XProtect Management Client, Milestone Mobile server, Log Server Port number Protocol Connections to... Purpose 80 HTTP Management Server service Authentication 443 HTTPS Management Server service Authentication of basic users. 7563 TCP Recording Server service Retrieving video and audio streams, PTZ commands. 22331 TCP Event Server service Alarms. 22337 TCP Log Server Server Logs (System, Audit, Rule-triggered)   Web Client, Milestone Mobile client Port number Protocol Connections to... Purpose 8081 HTTP Milestone Mobile Server Retrieving video and audio streams. 8082 HTTPS Milestone Mobile Server Retrieving video and audio streams.   DataCollector Port number Protocol Connections to... Purpose 7609 TCP Recording Server Collecting data   Avigilon Port number Protocol Connections to... 50080 HTTPS Server 55080 HTTP Default Camera Device Port 80 HTTP Streaming / Configuration 443 HTTPS Streaming / Configuration   Salient CompleteView Port number Connections to... 80   6970-7225 Completeview Server for cameras using General RTSP/UDP 4242 Data 4243 Command 4250 Config Server 4255 Admin Service 4502-4534 Webserver (optional)   Wavestore The default connect port is 8601. This is configurable.

Issue   A site has multiple locations in its instance. The goal is to restrict objects for a User in other locations by using permissions and tags which allow certain objects only for the local instance. The User also requires access to Event History, Live Monitoring and Floor plans.   After setting User permissions for specific objects, the object permissions work as expected, however clicking on Event History, Live Monitoring or a Floor plan shows: 'An error has occurred in the Live monitoring document while trying to execute initialize' Or Access Expert will show one of the following errors depending on which event object was selected: 'An error has occurred in the Event History document while trying to execute initialize' 'An error has occurred in the Floor Plan document while trying to execute initialize'   Product Line EcoStruxure Access Expert Environment Access Expert V3 Hosted Cause Event-level permissions function differently than object-level permissions Resolution User permissions set up with tags to restrict access to other locations will work as expected with objects like hardware, but these restrictions will not work with event objects.   The options to accomplish this are: 1. Buy an enterprise license and divide up the sites with their own instance. Each location should be represented by a shared instance with its controllers configured. Those controllers will publish their event to only their instances which can be controlled using permissions. This is the preferred method.   2. Allow ALL Type permissions for the hardware and event objects to be accessed. Using this method allows the event objects to work, but allows Users from other locations to access the hardware.   Event-level objects use an entirely different mechanism than regular objects. The technology under the hood requires that an enterprise license be used to accomplish event-level permission restrictions.

Issue An unexpected database error occurred. "There can only be one LCA Object Server ActiveX control per process. Please make sure that you only have a single Object Server control in this process." "Could not listen on _poet/tcp: The address is already in use or another server already running. (-2532)" Environment LonMaker NL220 Vista LNS Cause Microsoft Exchange 2003 Server and other OEM software sometimes use TCP ports 6001 or 6002. This causes a conflict since the POET server (FastObjects DB) defaults to TCP ports 6001 and 6002. Resolution For an automated solution, refer to: https://community.se.com/t5/TAC-Vista-Forum/LonMaker-POET-Port-Changer/td-p/271427   For a full explanation from Dialog Semiconductor, refer to: https://edgesupport.diasemi.com/hc/en-us/articles/206494283   Further details   Check that the ports used by LNS are not being blocked (firewalled) or used by another application. To verify this, type in the following command from a DOS prompt: netstat -bn You should now get a list of in-use TCP ports. Look for an entry saying {your computer name}:6001 or 6002. If you find one, you have located a conflict and you will need to change the POET Port numbers. Check if you run a firewall on this PC. If yes, you need to find the list of Programs with their Internet Access level and make sure you have given access to the appropriate files. To run LonMaker/LNS , you need to give access to ptserv32.exe, LonMaker.exe, lonpoint.exe, visio.exe, lmwbrw32.exe and lsass.exe. You can modify the ports used by the POET server and clients by modifying the "Services" file (%WINDIR%\System32\Drivers\Etc\Services) using a text editor like Wordpad.exe or Notepad.exe. For example, to change the POET port numbers to 7001 and 7002, add/modify the following lines in the "Services" file. The  '#' in the example indicates that the following text is a comment. For Win XP: use "Windows\System32\Drivers\Etc\Services". If you see the "poet" and "_poet" entries, go ahead and change the port numbers from 6001 and 6002 to 7001 and 7002. If you don't see these entries, simply add the lines below. poet          7001/tcp    #FastObjects services _poet        7002/tcp    #FastObjects services https://echelon.force.com/support/s/search/All/Home/562?tabset-95728=2

Issue There is a need to know which card formats are supported by Continuum Product Line Andover Continuum Environment Access Control Continuum Cyberstation Cause There are many different card formats available from HID, so there is a need to know which formats that Continuum allows. Resolution Here are the formats that HID offers: 26-Bit Format: H10301 HID Proprietary 37-Bit Format: H10302 **** HID Proprietary 37-Bit Format with facility code: H10304 Corporate 1000 Formats HID Long Format Card Programming OEM Proprietary Formats (i.e. Continuum 37) 35-Bit Card Format Formats 1, 4, and 6 above are supported natively We support all the other formats (as custom cards) so long as the format does not exceed 64-bits and the format can be supplied or understood. (i.e. start/end bit of the site code, card number, etc.)   ****IMPORTANT Continuum supports a maximum of 32 bits for the Card Number field, any format above, such as the H10302, that defines more than 32 bits for Card Number field will only work if the card number range used at the site is between 1 and 4,294,967,295, any card number above 4,294,967,295 will NOT be read correctly by the controller. A possible solution for this limitation is to use the Extended Custom Cards feature supported ONLY in the ACX5720 and ACX5740 controllers.   More information about Extended Custom Cards https://community.se.com/t5/Building-Automation-Knowledge/Extended-Custom-Wiegand-features-available-for-ACX57xx/ta-p/1215 

Issue What is the difference between an EBO SmartDriver and Smart Connector? Product Line EcoStruxure Building Operation Environment Building Operation SmartDriver Cause SmartDriver and Smart Connector enhance the openness for the EcoStruxure Building Operation, EBO, BMS system. They enable integration between EBO and 3rd party systems, even via not supported or nonstandard protocols. Resolution SmartDriver: SmartDriver enables you to create a customized interface to monitor and control 3rd party devices from the EBO server. The following block diagram shows a SmartDriver Interface and a SmartDriver Driver. The SmartDriver Interface (similar in concept to other protocol interfaces such as Modbus and BACnet) is part of EcoStruxure Building Operation software and enables you to create SmartDriver objects in the System Tree pane. The SmartDriver Driver is installed on the server drive and provides the network communications control. More information at Web Help SmartDriver Overview. Smart Connector: A development framework that simplifies and accelerates integrations with third-party systems or other data sources. It is an open, extensible and configurable application framework that allows developers to create innovative new capabilities, applications, and solutions that extend and enhance EcoStruxure Building solutions. The Smart Connector itself runs outside the EBO server and consume or server data to EBO server via the EcoStruxure web services "EWS". Watch short explainer video for more information: https://www.youtube.com/embed/DXHvRRL4ycY   For more information, visit the Smart Connector Developer Community on the Exchange: https://community.se.com/t5/SmartConnector/ct-p/smart-connector   For developers wanting to get started using the Smart Connector framework visit: https://www.smartconnectorserver.com   Smart Connector shop at Exchange:  https://shop.exchange.se.com/en-US/home 

Issue Need to upgrade V3 Access Expert On Premise software to the most current version in order to gain additional functionality. Product Line Access Expert Environment Access Expert Premise Software V3  Cause It is unclear how to upgrade the Premise V3 software to the most current version of V3. Resolution Access Expert Premise Upgrades now require an SLA to obtain the actual software. Please contact your Sales and/or Security Contact for more details. Both the Access Expert (AX) Premise Server and Client Software need to be upgraded in order for additional features to work. Please note that you will experience issues if your AX clients do not match the AX server version. Take a backup of Mongo database (See MongoDB Backup section located here: https://community.se.com/t5/Building-Automation-Knowledge/Backup-and-Restore-MongoDB-for-Windows-for-Access-Expert-On/ta-p/583) Ensure ALL Windows Updates are completed. Capture screenshots of software installed on server. This can be done by navigating to Control Panel > Add/Remove Programs. It is imperative that you capture the following software and their versions: Access Expert Keep MongoDB SEQ At the writing of this, AX 20.3.1 is the latest. Please check this link to see if there is a new release. Once you have the software downloaded, there will be seven (7) files in the folder: Right-click on “Feenics.Keep.Installer.exe” From there, follow the steps from the Keep by Feenics On Premise Deployment Walkthrough starting from page 8 through page 18.  Note: You must be logged into the Feenics website to access the link in this step.  Navigate to https://www.feenics.com/training/ to login and then click the link above in this step. After a successful installation, click on the “Setup_AX.msi” or “Setup_AX.exe” file to install the latest On Premise client for customer machines. If you run into any issues, please contact Product Support and Services by submitting a case here: https://www.nampss.com/ If you require assistance or would like Schneider Electric to perform this upgrade for you, you can submit a request for that here: https://www.nampss.com/apps_request.php

Issue When running VisiSat 2.1 build 196 (200 or 201) a message is displayed - “Unable to Load the Schneider Electric CET Style DLL” and VisiSat fails to launch. Product Line Satchwell MicroNet Environment Windows (Windows, XP Professional, Windows 7, Windows Vista Ultimate) Microsoft Visio Cause .NET Framework 2.0 is not installed. Resolution Check that the version of VisiSat installed is either v2.1 196 or for SP1 build 200 or for SP2 build 201 on a computer running with a supported operating system and Microsoft’s Visio version.   MicroNet Software Datasheet   The suggested procedure to correct the “Unable to Load the Schneider Electric CET Style DLL” issue as follows: - Uninstall VisiSat Install .NET Framework 2.0 Install VisiSat 2.1 196, add service packs 1 and 2 files as required. Re-boot computer Run VisiSat. Links to VisiSat software and information:   The VisiSat main software can be downloaded from the link below: https://ecoxpert.se.com/search?documentUUID=c93346a7-9d82-48e7-9b54-a866ac75bb71&title=VisiSat%202.1%20Build%20196%20-%20Software   VisiSat service pack 1 can be downloaded from the link below: https://ecoxpert.se.com/search?documentUUID=fd2e9849-1ffe-4c10-b3a6-5f27bac91870&title=VisiSat%20Release%202.1.196%20Service%20Pack%201%20(2.1.200)%20-%20Software   VisiSat service pack 2 can be downloaded from the link below: https://ecoxpert.se.com/search?documentUUID=839c09d2-400d-4434-8b1e-97f339545034&title=VisiSat%20Release%202.1.196%20Service%20Pack%202%20(2.1.201)%20-%20Software   VisiSat documentation can be downloaded from the link below: https://community.se.com/t5/Building-Automation-Knowledge/Download-latest-VisiSat-Data-Sheets-Engineering-Guides/ta-p/6110

Issue Is it possible to print alarms automatically with SBO Workstation in matrix printer whenever there is an alarm? Product Line EcoStruxure Building Operation Environment Building Operation Workstation Cause A number of sites still prefer to directly connect a Dot Matrix Printer to their BMS to automatically print off incoming alarms rather than using more modern emailing of alarms available from EBO. Resolution The following File2Printer software has been made freely available on the EcoStruxure Building Operation Community for exactly this purpose. https://community.se.com/t5/EcoStruxure-Building-Operation/File2Printer/m-p/351127#M71948

Issue 37-bit cards not working correctly even though a Credential Type has been configured correctly for Infinity37 cards (as seen below), the site code and/or card number read does not match what is printed on the card or the expected value. Parity errors could also be seen if the card is not truly of the Infinity37 format. Product Line Security Expert Environment Security Expert Server Security Expert Controller Cause Various cards have 37-bit data lengths but different formats; some guidance is needed on how to differentiate the ACC Infinity37 cards.  Resolution There are two pieces of data that can be used to verify if a 37-bit card is ACC Infinity27 format.   ACC Infinity 37 card format includes a Manufacturer's Code field; the field is 4 bits long, starting on the second bit and ending on the fifth bit. The Manufacturer's Code field always has a value of 4, the first bit of the card is used for the ODD parity, so the first 5 bits of ALL ACC Infinity37 cards ALWAYS look like P0100.... If we see a raw bitstream of a 37-bit card like the one in the screen capture below, we can immediately determine that even though the card has 37 bits, it is NOT an Infinity37 card since bits 2,3,4 and 5 do not add up to a value of 4 See https://community.se.com/t5/Building-Automation-Knowledge/How-to-display-RAW-bit-data-stream-of-Wiegand-card-in-Security/ta-p/390720  We can not assume that because a 37-bit card has  0100 on bits 2-5 it is 100% evidence that the card is indeed an Infinity37 card since that pattern (0100) could be present on the card as part of a different field (i.e., Site Code) on a different 37-bit card format. The second piece of data that could help determine if the card is true of the Infinity37 format is the parity bits, Infinity37 card format has a somewhat unique interlaced parity scheme. If parity errors are seen when cards are presented to the reader, this should be taken as an indication that the 37-bit card might not be Infinity37 card format. The attached zip file contains an Excel sheet that can be used to calculate the parity bits of an ACC Infinity37 card by entering the raw bitstream of the card; if the calculated values for both parity bits (bits 1 and 37) do not match what the card has, then the card is NOT an Infinity37 card format.    

Issue Are there any Example Reports for the new native Notification Reports which came out in EBO 3.2 to replace the now deprecated WebReports and Report Server? Product Line EcoStruxure Building Operation Environment Building Operation Workstation Cause As of EBO 2022 (4.0) WebReports and the Report Server have now been deprecated and replaced by External Log Storage using Postgres SQL and Timescale DB, plus the new native Notification Reports which are now built into EBO 3.2 and above, but there are no examples to help new starters to get going. Resolution A Schneider-Electric Community page has been set up specifically for Notification Report users so that they can share their Reports and collaborate on Reporting ideas: https://community.se.com/t5/EcoStruxure-Building-Operation/Reports-showcase-share-your-reports/m-p/388619#M75732

Issue PT1000 temperature sensors RTD Input Product Line EcoStruxure Building Operation Environment AS Classic, ASP  UI16, RTD-DI-16 - Central IO Module ASB, RPC, MPC Need for temperature to be extremely accurate PT1000 platinum resistance thermometer, RTD Resistance Temperature Detector Cause The AS Central IO Module Universal Inputs (UI16) were designed to interface to various thermistors that can have resistance values that are usually much higher than 1000 ohms. They were not designed to interface directly to a PT1000 RTD, and will not provide good accuracy when measuring these lower resistance sensors. The resistance input type was intended to allow for measuring the position of a 10K potentiometer that is used on some wall sensors. The accuracy specification for a resistance input is: +/-(7+0.004*R) ohms. This would result in an error of +/-11 ohms at 1000ohms – therefore a temperature measurement error approaching +/-3.0C. Resolution AS, ASP For RTD PT1000 (Pt100, Pt1000, Ni1000, LG-Ni1000, JCI-Ni1000) use RTD-DI-16 - Central IO Module, then choose 2 or 3 wire RTD Temperature Input ASB Choose 2-wire RTD Temperature Input (Pt1000, Ni1000, LG-Ni1000, JCI-Ni1000) RPC, MPC, MPV Choose RTD Temperature Input (Pt1000, Ni1000, LG-Ni1000)   For more details see SpaceLogic Hardware Reference Guide

Issue Information for User Permissions using Access Expert is needed Product Line EcoStruxure Access Expert Environment Access Expert V3 Hosted Cause Access Expert User Permissions Overview  Resolution Overview User groups and permission are set by an Administrator to manage and control what aspects of the system an operator has. There are no default user login credentials. The user group (permissions) determines what areas of the software a user can access as well as what type of actions they can execute (i.e. update, delete, etc.).   User Groups A key aspect of the Keep permissions engine is the ability to explicitly Deny a trait or option for an operator. This Deny approach allows Administrators to quickly and easily create a new Permission group like an Administrative level operator but without a specific item.   User Group Lists From the General Configuration tab, click on the Groups icon in the Administrative section. This will open a list of all the Permissions currently available in your system. Every system comes with a single System Administrator permission level and there is no limit to the number of Permissions a single system can have.   Adding User Groups To add a new Permission: Click “Add Group”. Assign a Display Name. Assign a Description. The Description should be concise but also provide enough information about the functionality this role will have. Add desired Permissions. Click "Save" or "Save & Close". ***IMPORTANT: The minimum permissions to log in are read on the Instance.   Keep Objects Begin by adding rights to the new Permission Group. Note this process starts with the first available tab at the bottom of the screen which is the Objects.   Click Add Permission – This will start the process of building out the rights for this type of operator. A full list of Object Types will be provided at the bottom of this article with the associated Linking options. Key Terms: Object Type – the type of Keep object to be assigned. Object types follow the menu structure of the Keep system such as Access Levels, Badge Design and Controllers. Selecting the All Types option will provide full access to all aspects of the Keep system. Create – Allows the user to create new objects. Read – Allows the user to read the objects. Update – Allows the user to modify existing objects. Delete – Allows the user to delete the objects. Publish – Allows the user to publish events with the object type specified. Advanced Actions - Allows the user to enable advanced actions for integrations such as HID Origo and Single-Sign On. Linking – When an object type is selected the Linking column will become active. Each object type has a unique series of possible linking traits. When Linking traits are available, the Linking window will display “…”. By clicking the “…” the operator will be presented with the full list of possible traits that can be Added or Removed by checking the available boxes. Tags – A keyword applied to a series of objects within Keep to help provide additional separation of permissions. An example: an operator can be provided with Administrative level permission but only for items with a specific keyword. Applies To – Allows the administrator to limit controls to a specific device or series of devices. When being used simply click the “…” icon and the operator will be presented with the ability to choose the devices needed by clicking the Assign Object. Multiple objects can be added. Once the Assign Object icon is pushed simply start typing in the name of the device(s) needed. Type – Allows for Granting or Denying rights for the object type in that line. The second portion of setting up a new Permissions Group is to determine the Event Types that the operator will be able to interact with. Event Types is a very dynamic list because the available options will be determined based upon the integrations deployed on your system. The Event Types section is focused on the types of messages that an operator will be able to see as well as the type of commands the operator will be able to take. Key Terms: Application – the specific service associated with an application in the system such as Mercury Controllers, Allegion Locks, Video Expert, Mobile, and LDAP. Event Types – The specific traits associated with the Application. Each Event Type will be different and the options available will be determined by the integrations deployed on your system. Tags - a keyword applied to a series of objects within Keep to help provide additional separation of permissions. An example: an operator can be provided with Administrative level permission but only for items with a specific keyword. Type - Allows for Granting or Denying rights for the object type in that line. Object Types Each object type has a unique series of possible linking traits. When Linking traits are available, the Linking window will display “…”. By clicking the “…” the operator will be presented with the full list of possible traits that can be Added or Removed by checking the available boxes.

Issue Information is needed about the Access Expert Kone Elevator Integration Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Cause Kona Elevator integration information  Resolution Overview: Destination Dispatch is a licensed feature for Access Expert and used when customers are modernizing their elevator systems or deploying newer ones which do not utilize the relay-based approach for floor control and selection. Within Access Expert, 3 different elevator platforms are supported which include Otis, Kone and ThyssenKrupp. For this document, we will focus on a KONE deployment. It is important to note that a single Access Expert can support multiple integrations at the same time. The KONE integration supports up to 128 total floors of control. When using front and rear entry points within the elevator cabs), each entry point is considered to a separate destination. This means a 32- story building using front and rear entry points will result in 64 individual destinations.   A KONE protocol was created so that the LP controllers can manage access for the KONE Elevator Group Controller. Mercury will support configuration for Destination Operation Panels (DOPs), Car Operation Panels (COPs), and turnstiles. This feature is supported on the LP4502, and EP4502. The support for KONE Elevators was added in firmware 1.25.5.   Prerequisites: 1. Access Expert System 2. KONE Destination Dispatch License - FN-DEST-KONERS 3. Appropriate Reader Licenses 4. AX-LP4502 5. Coordination with the Elevator Contractor A KONE Elevator Destination Dispatching System mode was created within Access Expert so that the LP4502 intelligent controller can inform a KONE DEC (Destination Entry Computer, E.g. touch screen or keypad) allowed and authorized floors for a cardholder. This feature is only supported on the LP4502.   Controller Page 1. On the LP4502 controller page, navigate to the "Destination Dispatch" Tab. 2. Select Kone. 3. Enable "Has front and rear floors" if your Kone setup has front and rear floors. Make sure to take into consideration this flag when assigning elevator floors access. It is also recommended to consider the door when creating names. Examples like 2F or 2R are beneficial to system operators. 4. Set the Maximum Cabin Configurations. This is the number of Kone Cabin Access configurations that can be stored on the controller. 5. Press Save. 6. From the "Add Downstream" dropdown, select Kone KGC under the network port. 7. Enter the Display Name to be applied to be used.  8. Enter the KONE primary KGC IP address and Port. 9. Leave 2005 as the default port number. Press Save 10. Repeat steps 6 to 8 for the Backup KGC. 11. Issue a "Push Controller Database" command.   Reader Page Once the Interface Controller has been saved, add/Navigate to a reader attached to the Controller, and move to the elevator tab. The Reader does not reside on the KONE KGC downstream. The KGC downstream is only used to configure the controller with the Primary/Backup KGCs. The readers must be on the regular Mercury downstream modules or attached to the LP4502. Because of this, the actual reader setup is similar to a regular door/elevator deployment with the addition of new settings on the Elevator Tab. Once the Elevator Type is set to Destination Dispatch, a series of settings will be enabled and displayed. You will be presented with a WARNING Message when the Elevator Type is selected. This message is normal and you should select YES. 1. On the reader page, navigate to the "Elevator" tab. 2. Select "Kone Destination Dispatching" as the Elevator Type. 3. Select the Kone Operation Type. Please note that Kone does not support mixing Remote Call Giving Interface (RCGIF or turnstiles) with Destination Operation Panel (DOP) and/or Car Operation Panel (COP). Only one is supported at a time. 4. Depending on the Operation Type, specify the fields. 5. If desired, select an Override Elevator Access Level. This will allow a set of floors to be public during defined schedules. 6. Press Save. Kone Cabin Access Page 1. Navigate to "Access Configuration" on the Main Ribbon bar. 2. Go to "Kone Cabin Access". 3. Click on "Add Kone Cabin Access". 4. Enter a Display Name. 5. Enter the allowed cabins (up to 255). You can use the following formats to enter values: 1-10,15,16. 6. Press Save. Person Page Once the reader has been saved navigate to the person(s) who you want to grant access to the destination dispatch and select the new destination dispatch tab at the bottom of the page this will take you to a new Destination dispatch tab. To add an Elevator user setting, simply select the elevator type you wish to grant access to and click the add button. You will be prompted to select a controller. If there are no active LP4502 elevator controllers, then the dropdown will be empty meaning the user needs to add a valid controller. 1. On the person page, navigate to the "Destination Dispatch Settings" tab. 2. On the "Kone Settings" tab, click on "Add Kone Setting". 3. Select the Kone controller and press OK. 4. Enter the Default Floor. 5. Enter the Default Floor Side. 6. Select a Cabin Access 7. Select the Kone Elevator flags to be applied to the person. 8. Press Save.  *Users must configure the Instance Settings to reflect the correct number of floors. The Cab used will be sent by the Kone system to Keep on an 'Access Granted' and displayed in event data. Masks Kone has Global and Specific Masks that are used when setting schedules. These can be set and cleared by right-clicking on the controller and selecting the appropriate option. Setting the Global Mask opens the Global Mask Configuration window. To add a floor configuration, click the "Add Floor Configuration" button, then select the desired floors. From there the options for each floor can be selected by setting the appropriate flags for the floor. Click "OK" to save the changes. Other Information: Each Elevator Manufacturer has specific settings, commands or fields when deploying the Destination Dispatch integration. The following are specific to KONE: Supported Reader Types: 1. Destination Operation Panel (DOP) – Destination operation panels are located outside of the elevator car. Each of these will be configured as a separate reader. 2. Car Operation Panel (COP) – Destination operation panels are located inside the elevator cab. Each of these will be configured as a separate reader. 3. Turnstile (RCGIF) – Turnstiles are half-height sensor barrier solutions designed for public and commercial buildings and airports. Each turnstile will be configured as a reader and must use a Mercury reader port.

Issue When a value in one Automation Server is transferred to a value in another Automation Server what port is used? Product Line EcoStruxure Building Operation Environment EcoStruxure Building Operation Workstation EcoStruxure Building Operation Automation Server (ASP/ASB) Cause Documentation required on ports being used Resolution EcoStruxure Automation servers can use one of three different communication protocols: Transport Control Protocol - TCP Hypertext Transfer Protocol - HTTP Hypertext Transfer Protocol Secure- HTTPS   The communication protocol and ports are configured in the Server wizard when you add an EcoStruxure BMS server via the Enterprise Server   EcoStruxure Automation servers can listen on one of the three communication protocols from Version 1.3 upwards. The TCP port is fixed but please refer to Changing the Automation Server HTTP/HTTPS ports TCP on port 4444 (fixed) HTTP on port 80 (default) HTTPS on port 443 (default)   Each EcoStruxure Automation server maintains a list of all the other EcoStruxure servers in the system and the communication parameters of those EcoStruxure BMS servers. To see the list and which protocol/port is being used select the server (1), select the Communications tab (2) and view the list (3) or individual server settings (4). Note when selecting an Automation Server the individual server settings (4) of other Automation Servers will be greyed out.   When an automation server is added, its communication parameters are distributed by the Enterprise Server to all other EcoStruxure BMS servers in the system. For additional information please refer to EcoStruxure BMS Server Communication   If the IP address or protocol port number in an already commissioned EcoStruxure Automations server is changed, this information must be manually updated in the Enterprise Server Communication view. The Enterprise Server then distributes the new parameters to the other EcoStruxure Automation servers. Select the Enterprise Server (1), select the Communication tab (2), select the server to be changed (3), update the settings (4):   If there are problems with the communication parameters please refer to Inconsistent Communication Parameters

Issue Out of range alarm attached to i2 device does not work when point's value is out of the range. The 'Alarms' system variable in the controller shows 0 Product Line Andover Continuum Environment CyberStation All i2 devices All InfinityControllers Cause Out of Range alarm is a BACnet alarm and can not be used with Infinity points Resolution Use Expression or Infinity Low/High Limit alarm type.

Issue MSTP controllers go offline when changing the MaxMaster value in the Automation Server from it's default of 127 Product Line EcoStruxure Building Operation Environment Building Operation Workstation Building Operation Automation Server MSTP Master Controllers Cause The MaxMaster value is being set lower than some or all of the MSTP controllers on the network Resolution EcoStruxure Building Operation supports MSTP Master controllers in the address range 0-127 (often refered to as the node id). The MSTP network is a token passing network where the token is passed around the network, until a controller has the token it cannot 'talk' to other devices.   The MaxMaster value is defaulted to 127 to allow all devices on the network to receive the token and reply to online status requests, send values etc. If the MaxMaster value is less than any of the MSTP Master controller addresses then those controllers never receive the token and cannot respond to online status requests.   The value for the MaxMaster needs to be equal to or greater than the highest addressed MSTP controller node id.  For example, if the highest node id=54 then the MaxMaster will need to be set to 54 or higher. For maximum efficiency the MaxMaster should be set 1 or 2 greater than the highest controller address, this allows for adding future devices without needlessly polling for many non-existent devices.    Please refer to BACnet MS/TP Network Properties – Basic Tab or Configuring the MS/TP Network for b3 Communication 

Issue Alarm colors in Workstation Product Line EcoStruxure Building Operation Environment  Building Operation Workstation Cause The default color for active alarms is white font with a red background. Some customers may want this to be in a different color.  Resolution In Building Operation Workstation System tree, go to Alarm Control Panel > Alarm Styles.  From here, the font type, font color and background color of acknowledged, active, disabled, fault or reset alarm states can be changed.  Refer to: Styling the Alarm States in the Alarms Pane and Alarm Views   Also available from EcoStruxure Building Operation 1.9 and above is Alarm Decoration. This allows overriding an alarm configuration for a specific alarm or group of alarms and applying an alarm decoration rule.  An alarm decoration rule is similar to a filter and allows changing other properties in addition to the font type, font color and background color.