Building Automation Knowledge Base

Issue Are the trendlogs in the Xenta deleted when downloading a Menta application? Environment Vista 5.1.7 Menta 5.1.7 Xenta programmable controllers Cause When performing system updates to the either the logic of a Xenta programmable controller, or the firmware, it is important to know which of these actions will affect the stored Xenta trend log information inside the controller. Resolution Downloading a Menta application to a Xenta does not affect the trendlogs. They are saved in the Xenta. Downloading a Xenta firmware revision will delete all trend log data.  

Issue Unable to log into the Controllers web page. How do I reset the Password on  a ACX5740 from the Continuum front end? Environment Continuum  1.8X Continuum 1.9X ACx57XX Cause Password Unknown Resolution Open Continuum Explorer Expand the Network Select the ACX 57XX Select the Controller User folder Edit the ACC user and reset the password. 

Issue What voltage should be seen across conductors on an Infinet bus? Environment Infinet RS-485 Cause Communication issues on RS-485 bus. Resolution  Measuring Ground Potential Signal Potential refers to the horizontal plane along which signals are sent and received with respect to ground.  RS-485 requires that all devices communicating with each other be at a reasonable ground potential. Measuring the ground potential of any Infinet controller Use a voltmeter to measure between the earth ground connection (for power) and the Infinet shield connection.   Measuring the ground difference between the Infinet controller and the ground at the InfiLink or CX/NetController (shield grounding point). Set the multi meter to measure AC voltage; measure and record the AC voltage (ACV) between + and -. A reading higher than 2-3 volts indicates a grounding problem. Set the multi meter to measure DC voltage; measure and record the DC voltage (DCV) between +and -. A reading higher than 2 to 3V on either voltage indicates a grounding problem. Calculate the combined voltage using the following formula. (1.4 X ACV) + DCV = Combined Voltage. If the combined voltage is greater than 7 a grounding problem exists

Issue BACnet requires applications to listen on the same port across the IP subnet to receive BACnet discovery broadcasts. Two applications running on the same machine can not use the same port as the Listening Port. Product Line EcoStruxure Building Operation, Continuum, TAC I/A Series Environment Building Operation Enterprise Server I/A Series WorkPlace Tech Continuum Cyberstation Cause The site can not provide a separate machine or VM for each BACnet application, which is recommended for independent operation. Resolution With this configuration, one application will act as BBMD to receive and distribute BACnet Broadcast Messages. The other application will act as a Foreign Device, relying on BBMD to relay BACnet Broadcast messages. Once BACnet devices and the Application, configured as Foreign Device, have shared their IP and Port, messages between them will be unicast and will not pass through the BBMD. Ensure one application can be configured as a BACnet BBMD and the other as a Foreign Device. Configure one as BBMD, usually EBO Enterprise Server Configure the other application as a Foreign Device referencing the BBMD IP and Port

Issue Downloads to some, or all, controllers are not working. Controllers are online to Security Expert but do not receive updates to Users or other changes and forcing a download does not work. Product Line EcoStruxure Security Expert Environment Security Expert Cause One of the Controllers download files has become corrupt. Resolution On the Security Expert Server browse to ..\ProgramData\Schneider Electric\SecurityExpert\Download. Review the Controller .dat files, there is one file for each Controller Id in the Database. Check if any of these files have a 0 bytes file size. Shut down Security Expert. Shut down the Security Expert Download Service. Delete each of the .dat files that does have a 0 bytes file size. These will be automatically recreated from the data in the Database. Start the Security Expert Download Service. Start up and login to Security Expert. Attempt to perform a forced download to the controllers and review the Download Server Diagnostics Window to confirm the controller has been downloaded and .dat file created.

Issue When a Reader Expander is offline from the controller, users with Credential Type-based access are unable to be authenticated. Product Line EcoStruxure Security Expert Environment Security Expert SP-C, SP-AC1, SP-ACX SP-RDM2, SP-MRDM2 Cause Reader Expanders store a limited number of user card records locally, depending on the Offline Operation setting. However, user credentials (such as credential types, biometric or PIN-based data) are stored only in the controller, not in the Reader Expander. It’s important to note that the term "card" in the Offline Operation feature (as described in the online help and the SX-SRVR Security Expert - Operator Reference Guide) refers specifically to the Card Numbers section [1] of a user record, not the Credentials section [2]. User record Resolution The Offline Operation functionality of Reader Expanders supports authentication using Card Numbers only. It does not support authentication using Credential Types when the expander is offline.  

Issue What Port numbers are used by the Sigma system? Product Line Satchwell Sigma Environment Ethernet communications Ports Port TCP UDP Cause Known port numbers should be set as exemptions in the system firewall. Resolution Sigma server to Sigma NNN / controller communications - User Datagram Protocol (UDP) uses port 49152. Sigma server to Sigma client communications - Transmission Control Protocol (TCP) uses ports 3614 and 8080. Sigma Web client communications - Transmission Control Protocol (TCP) uses ports 80 and 8080, but also uses port 3614.

Issue What is the password policy for Security Expert operators, and how can it be configured to meet specific cybersecurity requirements? Product Line EcoStruxure Security Expert Environment Security Expert Server Security Expert Client Cause Some sites require customized password policies to comply with cybersecurity standards. These may include requirements such as: Enforcing regular password changes Preventing the reuse of previous passwords Setting minimum password length Requiring strong password complexity Resolution   Default Password Policy in Security Expert By default, Security Expert enforces the following password policy for operator accounts: Minimum password length: 8 characters Password change required: On first login For more information on Security Expert’s cybersecurity practices, refer to the SX-SRVR Security Expert System Hardening Reference Guide. Custom Password Policies via Active Directory Integration Security Expert does not support advanced password policy configuration directly within the client interface. However, enhanced password policies can be enforced by integrating Security Expert with Windows Active Directory. To implement this: Integrate Security Expert with Active Directory Follow the steps outlined in Option 1 of the How to Integrate Active Directory with Security Expert article or Option 2 for full Active Directory integration. See AN 288 Security Expert - Using Active Directory - Integration Guide for additional details. Configure Password Policies in Windows Domain Once integration is complete, operator accounts managed through Active Directory will adhere to the domain’s password policy. This allows you to enforce: Password expiration intervals Password history restrictions Minimum and maximum password lengths Complexity requirements (uppercase, lowercase, numbers, symbols)

Issue BBMD and BBDT Enterprise Server or Automation Server Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server and Automation Server BBMD (BACnet Broadcast Management Device) IP subnet, IP router  Cause Clarification for both BACnet Broadcast Management Device (BBMD) and BACnet Broadcast Device Table (BBDT) when used within Building Operation servers. Resolution A BBMD is needed when communicating to BACnet devices on another IP segment/subnet (across IP routers). One BBMD is required per subnet; this is because IP routers block broadcast packets and BACnet uses broadcast packets to initiate and maintain communications.  Continuum CyberStation (below) or bCX4 can act as a BBMD.     A BBMD can be created in a Building Operation Enterprise Server or Automation Server.    The BBMD on the other subnet should be as below   Now all the BACnet devices should be visible on both subnets Notes No more than a single BBMD should be created on each subnet for each IP port used. Additional information about BBMDs is available on WebHelp The Teach and Learn commands are useful for larger networks with multiple BBMDs  

Issue This issue is described in Tridium's internal case NCCB-71360. Users will notice that the default Nrio Device Manager view (Ux/web media) of the NrioNetwork driver in N4.14 looks identical to the previously existing workbench AX view; however, due to this defect, devices discovered and added through the web view will not function as expected.  Product Line TAC IA Series Environment I/A Series N4 Jace 9000 I/A Series N4.14 Framework Version Cause With the release of the Jace 9000, users may notice that the IO-R-16 and IO-R-34 devices will not function properly when discovery and configuration are performed through the web views. Resolution To tell if the device was added through the correct view, there are a few indicators. Malfunctioning devices will not show up with an Installed Version or a Sec version in either view: Working devices will display these values with no issue in either view: The malfunctioning devices' health section will read 'fail' even with a status of ok: Users in N4.14 should only use the Workbench AX Nrio Device Manager view to discover and add devices to a station. This use case is currently not supported in the browser for N4.14. All other use cases function in the UX Web Views, such as viewing devices, adding points, and commanding points.  

Issue Removing software from a PC may leave behind unused / old registry entries and folders from the removed software, this in some cases may prevent software re-installation Product Line Andover Continuum,EcoStruxure Building Operation,Satchwell BAS & Sigma,Satchwell MicroNet,TAC INET,TAC Vista Environment All supported Operating Systems Cause This is due to the windows uninstall program not fully removing all elements for the software. Some of this is due to windows thinking the the software may have been removed unintentionally and therefor all the previous settings will still be saved in case of  re-installation. For example, when SQL is uninstalled the program folders that contain the database will remain intact. This may be an issue if, for example, the software is removed due to a problem with the original installation. This is when a complete removal off all components and registry entries may be needed. Resolution The best solution for removing all the unused registry entries is to use a program designed to remove obsolete registry entries and temporary files. Some examples of these are: CCleaner, which will allow you to clean up your PC by removing past installation components. Revo Uninstaller  which is useful for removing redundant folders / files / Registry entries.   It may be useful to use both of these programs to ensure a complete cleanup. Revo Uninstaller can be used to remove unused software and then CCleaner to get rid of all the Temp files etc.  Finally remove the relevant folders from within the windows explorer, Example: C:\Program Files (x86)\Continuum Once done you should then be able to install a fresh clean copy of the application software. This solution is current in all versions of Windows including windows 10  

Issue Thread size/standard. Product Line Field Devices Environment Pocket Well Pocket STP 50mm Brass  9121040000    Pocket STP 100mm Brass  9121041000    Pocket STP 150mm Brass  9121042000    Pocket STP 200mm Brass  9121043000    Pocket STP 250mm Brass  9121044000    Pocket STP 300mm Brass  9121045000    Pocket STP 400mm Brass  9121046000   Pocket STP 50mm Stainl.steel 9121050000    Pocket STP 100mm Stainl.steel 9121051000 Pocket STP 150mm Stainl.steel 9121052000    Pocket STP 200mm Stainl.steel 9121053000    Pocket STP 250mm Stainl.steel 9121054000    Pocket STP 300mm Stainl.steel 9121055000    Pocket STP 400mm Stainl.steel 9121056000 Cause This information is necessary if an adaptor or similar is required for installation. Resolution The thread is of cylindrical type, and follows DIN 228 and BSP (British Standard Pipe) which both are identical. Size of thread is G1/2. For additional information on Pocket materials, please see Sensor pockets material specification Stainless steel and Sensor pockets material specification nickel plated brass.

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue It is sometimes necessary to move a previously configured Infinet i2 device from one Infinet network to another in the same parent Automation Server. EcoStruxure Building Operation does not provide an automatic way to move an i2 device; it must be done manually. Product Line  EcoStruxure Building Operation Environment Building Operation Automation Server Cause Guidance on steps to move Infinet i2 device from one Infinet network to another in the same host Automation Server Resolution In this example, we are going to move multiple Infinet i2 devices from the Infinet network on COM-A to the Infinet network on COM-B.   Backup Make sure to make a backup of the Automation Server before attempting the steps below. This is in case there is a need to revert the changes for whatever reasons. Export Devices from COM-A From COM-A Infinet network, display a List View of the devices, making sure to have columns displaying the Infinet ID and Serial Number. Write down the Infinet IDs and Serial Numbers of the devices to be moved. In the List View, multi-select the devices to be moved, right click and perform an 'Export', leave the Export Reference Filter at default (Export). After successful export, right click on the selected devices again and delete them from COM-A Infinet network. Prepare COM-B for Import From COM-B Infinet network, display a List View of the devices, making sure to have columns for Infinet ID and Serial Number. Observe the Infinet ID column, and compare with the notes taken above of the moving devices' Infinet ID, for IDs that are already in use in COM-B, you will need to assign a new ID to the device moving from COM-A Infinet network to COM-B, update your notes to include an available ID on COM-B. (see example below of what the notes might look like)   Import Devices to COM-B ***  In the System Tree, select the COM-B Infinet network and perform an import of the XML file created via export above. Physically move the devices from COM-A Infinet to COM-B Infinet. When doing so, avoid introducing duplicated Infinet IDs into COM-B Infinet. Make sure to power down the devices you are moving, connect them to COM-B Infinet, and only then power up the devices. On power up, the devices perform an ID check and stay off the bus if they detect their IDs are already in use. Configure Devices in COM-B From COM-B Infinet network, display a List View of the devices making sure to have columns for Infinet ID and Serial Number. Right click each device moved from COM-A Infinet to COM-B Infinet, and select "Properties", in the "Advanced" tab, enter the appropriate Infinet ID and Serial Number for the device then click "OK". In the List View, right click the device from previous step again, select "Device->Commission", after successful commission the device should go ONLINE Final Steps After all the moved devices are online, you should download ALL (whether moved or not) the devices to have their programs recompile and rebuild their Import/Export tables. Fix any references that were lost due to devices changing Infinet network and Infinet ID *** NOTE Due to an issue that was corrected in EBO 6.x, import may fail with error "Invalid InfinetId", the workaround for this problem is to manually create the Infinet devices on the destination port using the appropriate name, serial number and Infinet ID, then do the import selecting the option to merge on conflict.

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue Validation of SSL Certificate does not work Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Building Operation Enterprise Central Building Operation Space-Logic Server (AS-X) Cause Cloud Connectivity makes use of the Baltimore CyberTrust Root Certificate for communication to the cloud, and often this certificate is not updated due to lack of maintenance routines on the Windows Server. Resolution Run Windows Update: On the server running the ES/EC, run Windows Update and make sure the Operating System is updated to the latest maintenance version available. Manually update certificate:  On the server running the ES/EC, go to https://curl.se/docs/caextract.html using a web browser and follow the instructions to download a collection of the most commonly used certificates on the web that are up to date. Click on the start-menu, type in ”certmgr” and press enter. Navigate to Trusted Root Certification Authorities/Certificates Under Trusted Root Certification Authorities, right-click the Certificates folder and select ”All Tasks > Import…” Follow the guide, click ”Next” and then locate the file you downloaded in Step 2a (make sure you filter to All Files). Click ”Next” on all steps and then click ”Finish”.

Issue Unable to assign output channels on a some b3/i2 series controller under an AS. CCT(Continuum Conversion Tool) unable to assign channel with error "Could not find channel" in the conversion report. When creating an output channel, that is out of range, the workstation error is "Could not find channel" eg. if output channels 15 or 16 (on b3810) are assigned Product Line EcoStruxure Building Operation Environment AS ES b3, i2 Expansion Module xPD04, XPD02, xPA04, xPA02 Cause b3/i2 series expansion channels are software limited in line with the maximum xP module capacity The maximum b3/i2 expansion current available is 180mA, so some combinations of 2 xP modules are not supported, see below   Resolution Both input and output channels are limited in line with the allowable xP expansion units that can be added. For example a maximum of 6 xP output channels can be added to b3/i2920, b3/i2810, b3/i2814, b3/i2850, b3/i2851 & b3/i2853 controllers, (2 xPD/A04 Output modules is above the maximum power supply to xP units from the b3/i2 series controllers)                                   Output Channels               On board                               xP Modules    b3920     1 to 16                                   18 to 22 b3810     1 to 8                                      9 to 14 b3814     1 to 8                                      9 to 14 b3850     1 to 4 (5 reserved)                  6 to 11 b3851     1 to 4 (5 reserved)                  6 to 11 b3853     1 to 4 (5 reserved)                  6 to 11 NOTE Continuum did not limit the channel numbers, thus unsupported configuration could be installed and in some cases these may work. This can cause an issue during an upgrade/conversion.

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue Bog File Encryption Changes in 4.15 Product Line TAC IA Series Environment I/A Series N4 Enterprise Server I/A Series N4 Jace 9000  Cause In Niagara 4.15, to continue to provide the best security practices, the user password hashes are now included in the encryption by the system passphrase. Resolution The system passphrase was introduced in Niagara 4 to provide additional protection to sensitive data from the Niagara system. Prior to Niagara 4.15, this included all reservable passwords (such as Niagara Network, database connection passwords, etc.), excluding the user's passwords as those are protected by being hashed. If you do not have the system passphrase for a station and need to unlock it through Workbench, both the user and encrypted data such as passwords will be removed where prior to Niagara 4.15 the user were left untouched as they are hashed. If you are copying a station from a remote host which you do not have the system passphrase for, you will need to reset the passphrase to successfully copy the station onto a new remote host. You will be required to enter the passphrase to edit or modify users or encrypted properties such as password fields for email, Niagara Network, etc. Prior to Niagara 4.15, you could edit and modify users without the passphrase, in Niagara 4.15 this will require the passphrase to decrypt the users.   Operation Niagara 4.14 Niagara 4.15 Modifying users in offline station bog file Users can be modified without entering the station bog file passphrase Station bog file passphrase is required to modify users Reset station bog file passphrase Removes reversable client passwords such as email, Niagara Network, etc. Hashed user passwords are not impacted Removes both reversable client passwords and hashed user passwords Understanding the System Passphrase in 4.15 Workbench or Supervisor When Niagara is installed on the engineering or supervisor device for the first time, the user will set the passphrase for that device. NOTE: When setting system passphrases, make sure that you take note of what they are. These should be shared with the owner of the building/site as the passphrase is owned by the device. You can change the system passphrase in the Platform Administration screen. You will be required to enter the current passphrase in order to successfully change it to a new passphrase, highlighting the importance of providing it to the owner of the building/site. JACEs & Remote Niagara Devices The passphrase is set during the commissioning process of the remote device. The remote device's passphrase can also be changed through the Platform Administration view with the same requirements as changing the Supervisor/device's passphrase.   Station Bog File Passphrases In 4.15, you will have the option to encrypt the new station with either the local system passphrase or a custom passphrase in the New Station Wizard. This passphrase is required to unlock the bog file in the user home when configuring encrypted properties as well as when copying this station onto a remote host. New Station Wizard: Note: When selecting the "Use the system passphrase" option, this is the passphrase for the local host (Workbench) Unlocking the station in the User Home: Copying the Station to a remote host with a different passphrase: Understanding how the station passphrase changes when using the Station Copier When a station from a remote host to your local host, the passphrase which is encrypting the data will be the system passphrase of the remote host. Copying a station from your local host to a remote host: For a station that originated on your local host with a passphrase encrypting its sensitive data, once you enter the current station bog file passphrase and successfully copy the station onto the remote device, it will utilize the system passphrase of the remote device when copying from the remote device back to your local host. Copying a station from a remote host to your local host: When a station is copied from the remote host, it will automatically be encrypted with the system passphrase of that remote host.   What do I do if I do not know the system passphrase of the remote host I copied the station from? In the user home,  you are able to reset the passphrase of the station, however, you will lose the encrypted sensitive data including system and user passwords. In this workflow, you have the option to remove all users except for one new super user which you provide the new username and password in the Bog File Passphrase dialog:  

Issue  Is there a easy way to manage Vista user accounts in many TAC Vista servers at same time?   Environment TAC Vista 5.1.7 Cause A user is a global object so if the Vista servers is in the same Vista network they should all have the same users. If adding or deleting a user in one Vista server the user will be added or deleted in all Vista servers.   Resolution Connect the Vista servers in a Vista server network.

Issue When logging in to an AS or ES, WorkStation freezes or it takes a very long time (>30 minutes) before the login process finishes. Building Operation WorkStation hangs on "Reading data..." when trying to login to an AS or ES Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Building Operation Automation Server Premium Building Operation Automation Server Bundled Building Operation WorkStation Cause The problem is related to a delay when validating the license details. It only seems to happen when running a mixed EBO/SBO 1.9.3 system and after having EBO license administrator 2.0.1 previously installed. Resolution Run the SBO License Server Reset tool and perform Reset - Simple Log in to WorkStation, and if the hang or freezing is still present, then follow the next set of instructions. Run Diagnostics in the License Administrator and take note of all the ACT (Activation) and Entitlement IDs Return all the licenses Close all WorkStations and stop all SBO/EBO processes (whichever may be running) Uninstall all License Administrator and License Server Run the SBO License Server Reset tool and perform a Reset - Complete (you will get an output of the commands and result) Install the latest released version of License Administrator and License Server (the latest released version of License Administrator has fixes for virtual servers and some cyber security vulnerabilities, note that License Administrator is backward compatible with earlier SBO versions) Activate the licenses based on the info from step 3 Note: If running the demo license, steps 3 and 4 may be skipped. If problems continue to occur, then send the above details collated (in step 3) and email this/contact support.

Issue At start up, anything requiring the SOAP Service to function will fail to work properly. Logging in to Web Client fails with a "No License found for SOAP Interface" message. The Data Sync Service will generate incorrect username or password error messages. Product Line EcoStruxure Security Expert Environment Security Expert SX-SOAP SX-DB-SYNC Cause The SOAP Service fails to start up properly after a Windows restart under certain conditions. Resolution 1. Set the Security Expert Data and (if installed) the Security Expert Data Sync Services to Automatic (Delayed Start). 2. Restart the PC.

Issue Extended Jace 9000 Commissioning Time. Product Line TAC IA Series Environment I/A Series Jace 9000 Cause With the release of the Jace 9000 using Ubuntu Core 20 Linux as it’s operating system the commissioning/upgrade times increase as compared to the previous Jace 8000. Initial commissioning times can take longer then 15 minutes to finish. There are scenarios where multiple reboots are needed after the initial commissioning is completed. Once the commissioning has been completed for the Jace 9000, boot times should be significantly lower. Resolution Users will need to reboot their Jace at least twice and will need to set more time aside for commissioning of the new Jace 9000s. Please allow for a minimum of 15 minutes for commissioning. If you continue to experience issues with bootup or commissioning on the Jace 9000,  please contact your country level product support. Please note that the JACE-9000 does not print a lot of output on the debug port when you cycle power so give it time to fully bootup.