Building Automation Knowledge Base

  Issue Is it possible to host the same third party BACnet device on the AS-P private networks on multiple automation servers, which are all connected on the same network? Product Line EcoStruxure Building Operation. Environment Building Operation Automation Server Premium Cause The design in question is a 3-storey accommodation building which includes 1 x BMS panel/AS-P per level. However, only 1 x Mitsubishi EW-50E BACnet gateway is being provided for the building. Resolution It is possible to host the same 3rd party BACnet device in multiple AS-Ps. Some caution is required, however, because if the user makes changes to an object in that device through one AS-P, that change may not be reflected in other AS-Ps. When viewing runtime variables, such as 'Value' and 'Status Flags', this is not a problem because the EBO server will always get new values from the wire. Where the problem can present itself, is when changes are made to configuration values because these are only updated in an EBO server during an upload operation. For example, if you set the hi-limit and low-limit values in an analog-value object from one AS-P, those values will not be updated in other AS-Ps until you do an upload of that object.   The other place where this problem may present itself is in schedules. An EBO schedule only writes values to a device when that value changes. For example, if you have a schedule configured to change the setpoint to 65 degrees at 5pm, EBO will only write a value of 65 if the current 'local' value is not 65. If this schedule only writes 1 time per day and someone has set the value to 70 from another AS-P, the first AS-P does not realize the value has changed so that schedule will not generate a write request to set the value to 65 (it will stay at 70). However, if you have a program or trend-log monitoring the value, the AS-P will be tracking that value and realize it is not 65 so you will see a write request at the scheduled time.   The system works this way because reading all values of all devices and all objects all the time is simply not practical. As long as the user is aware of how the system is designed, they can avoid these potential issues.   Make sure to use Static IP, so IP do not change, or you get multiple DHCP servers on the same network.   Another alternative is to host the BACnet device in one AS-P only, then using internal bindings to share the data with other AS-Ps.

Issue What is the maximum size Card Number and Facility Code Number supported by Security Expert? Product Line EcoStruxure Security Expert Environment Security Expert Controller Security Expert Smartcard Reader Cause Adding a card to one of the Card number slots on the General tab of a User page allows for a maximum of a ten-digit facility code and ten-digit card number. Resolution The currently supported size of the Facility/Card number allows a maximum of a ten-digit facility code and ten-digit card number as can be seen below.  Facility/Card Number This Facility/Card number is entered when adding a credential to a User on the General tab of the User page. The size of the allowable facility code and card number can be increased beyond ten-digits by using Credential Types instead. Once the Credential Type has been created, it can then be used in the CREDENTIALS section for those users. For additional details on Credential Types see the AN 276 Security Expert - Configuring Credential Types - Integration Guide.

Issue Information is not clear on what the available intercom parts are and what each looks like. Product Line EcoStruxure Security Expert Environment SX-IPI SX-IPI-C SX-IPI-C-ES SX-IPI-C-EF Cause Old product announcements contain misleading information. Details are missing from current documentation. Resolution There are only three possible intercom part numbers that can be ordered. SX-IPI: This is the part code for the regular intercom with no camera SX-IPI SX-IPI-C: This is the part code for the regular intercom with camera SX-IPI-C SX-IPI-C-EF: This is the part code for the Flush Mount Kit for the SX-IPI-C intercom SX-IPI-C-EF front SX-IPI-C-EF back Note: There is no surface-mount kit (SX-IPI-C-ES) for either intercom, and the non-camera intercom (SX-IPI) does not have the option of a flush mount kit.

Issue Is it possible to setup more than one custom card format in Security Expert? Product Line EcoStruxure Security Expert Environment Security Expert Custom Card Formats Cause Have a requirement for two or more custom card formats. Resolution Currently, only one Custom Format can be configured.   It is possible to add a Secondary Format to a Reader port in Reader Expanders, but only one port can be setup with a Custom Format.    However, Credential Types have now been introduced with the release of Security Expert 4.3, which largely supersedes Custom Formats going forward and allows multiple custom card formats and even QR codes where required.  Please see AN 276 Security Expert - Configuring Credential Types - Integration Guide for more information on setting up Credential Types and Maximum number of Credential Types for more info on how many can be used.

Issue System changes made to a Security Expert server can cause the license to fail. Product Line EcoStruxure Security Expert Environment Security Expert licensing Cause When the SSN license is activated on the Security Expert server a hardware footprint of the server system is created and stored with the license activation. This ties the license to that specific machine, if the hardware footprint changes in the future this will break the license activation.   There may be additional system changes that trigger this but the ones we are aware of that will break the licensed hardware footprint are the following: A change of the Security Expert servers computer name. Normally when we see this the installer is attempting to activate/update the license from a Security Expert client machine instead of the Security Expert server machine. A change in the Network Interface Cards. Changing from a wired to wifi connection can potentially do this. If the server is installed on a virtual machine ensure that the Network Interface Card is assigned a static MAC address. Other hardware changes such as changing Hard Drives, CPU, Memory, Operating System or Motherboards. Resolution If the hardware footprint has changed, breaking the license activation, the SSN will need to be reset and an activation added. Contact your local support to add a registration to the license and clear the hardware profile. The installer will then do a License Update from the Security Expert server to re-activate the SSN.

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue A large number of alarms have accumulated and need to be acknowledged at one time. Product Line EcoStruxure Security Expert Environment Security Expert Client Cause A large number of unacknowledged alarms have been allowed to build up until the number is too large to acknowledge them manually one at a time. Resolution To acknowledge the alarms all at once, please raise a Support Case with your local Customer Care Centre and Product Support can assist with a remote session to apply a 'one time' SQL Query direct to the Security Expert Database. See Browsing slow in Security Expert Client for some methods to minimize unacknowledged alarms accumulating so rapidly in the database.

Issue What SQL collation does Security Expert use? Product Line EcoStruxure Security Expert Environment Security Expert server Microsoft SQL Server Cause Need to know the SQL collation used in Security Expert databases. Resolution The default collation is SQL_Latin1_General_CP1_CI_AS. This is the only supported collation and is set by default during installation and creation of the Security Expert databases.   Changing the collation can have serious ramifications to the stability and operation of Security Expert and is not supported.

Issue National Weather Service Data Showing Stale Product Line TAC IA Series Environment I/A Series N4 Enterprise Server I/A Series N4 Jace 8000 / 9000 Cause Due to recent changes with the National Weather Service, the current weather information displayed through Niagara is showing as “Stale” when using the NWS Weather Provider in the Niagara Weather Service. Resolution The Current Conditions “Last Update” time may be null or a current date, and the “Observed” time may be null or a date in the past. Current Weather View: Property Sheet:   This issue is being addressed in future releases. In the meantime to manually correct this behavior, make the below manual updates to the BNwsWeatherProvider components in the station: 1. Go to the Property Sheet view on the BNwsWeatherProvider component, click the ‘Slot Details’ button, then click the ‘Hidden Slots’ button to display the hidden slots. 2. Click the Flags for the “Conditions Server” slot which opens the “Configure slot flags” dialog.  Clear the checkbox for the Hidden slot flag, then click the OK button to clear the Hidden slot flag.  3. The “Conditions Server” slot should now display “(none)” in the Flags column.  4. Click the “Slot Details" button to toggle back to the default Property Sheet View.  The “Conditions Server” property is configured with the default value of “www.weather.gov”. 5. Update the “Conditions Server” property to “forecast.weather.gov” and save the change. 6. Invoke the “Update Weather Report” action on the Weather Report component and verify the Current data updates and no longer indicates a Stale status.              

Issue When trying to run webLauncher.exe, an unknown error occurs. An error popup with a red X appears, and the Application will fail afterwards.   Product Line TAC IA Series Environment I/A Series N4 Enterprise Server I/A Series N4 Jace 8000 / 9000 Cause With a recent migration to Web Launcher in 4.14 (launcher version 24.14.0.2), a bug has been reported in new installations. Any computer that is missing a folder named niagara storing the launcher's configuration info will encounter this issue. The folder is located, by default, in the following spot: C:\Users\<Windows username>\AppData\Local\niagara Resolution Go to the location of the launcher executable, and there will be a file named webLauncher_debug.exe. Running this once will create the necessary directory and the Web Launcher will be able to function normally. The default location of the executable is: C:\Program Files\Niagara Web Launcher This issue is known internally at Tridium as defect NCCB-68211, and it will be resolved with the release of Web Launcher 24.14.0.3 and later releases.

Issue When attempting to save & deploy a function block program using Modernized Programming, the following errors are seen: EBO 2022 - Deploy program error: The program was not deployed! (Error Code - 1073740940) EBO 2024 - Deploy program error - Invalid data "Empty binary file' Invalid data  Product Line EcoStruxure Building Operation Environment EcoStruxure Building Operation WorkStation EBO 2022 EcoStruxure Building Operation WorkStation EBO 2024  Function Block Programs (Builder for Function Block) Cause Related to known issue Modernized Programming Builder program error during deploy This is when the TEMP / TMP User variable folder paths contain a space; this can be edited in the Environmental Variables.  Resolution Edit the TEMP and/or TMP paths so that they do not contain any spaces.  To edit the Environmental Variables, follow these steps:  1. Click on the Start Menu button located at the bottom-left corner of your screen. In the search bar, type "environment variables" and press Enter.  Click on the "Edit the system environment variables" option from the search results. This action will open the System Properties window, which contains various tabs and settings for your computer. In the System Properties window, click the "Environment Variables" button located at the bottom right. Clicking this button will open another window specifically for managing environment variables.  In the Environment Variables window, under the "User variables" section, "Edit" the path that contains any "spaces".  These paths can be located anywhere on this PC.  User variables apply only to your account, while system variables affect all users on the computer. Choose accordingly, and then add or edit variables as needed. Once you have completed these steps, your new or edited environment variables will take effect.  Restart WorkStation, and the program should now deploy successfully.   

Issue Some BACnet devices advertise support for services such as RPM, COV, etc but malfunction when the service is used. An example of such a device is the Johnson Controls TEC2627VVT which advertises support for RPM but fails to upload its objects when SBO uses RPM to get the object list. Product Line EcoStruxure Building Operation Environment BACnet Automation Server Enterprise Server Cause Some BACnet devices with inconsistent protocol implementation cannot process BACnet services such as RPM, COV, etc. Resolution Feature Supported in Version <no-rpm/> 1.8.1 and higher <no-cov/> 1.8.1.23701 and higher <ignore-unhosted-devices/> 3.2.3.9005 and higher (*)   Users can create a rule under the BACnet interface to configure SBO not to use the service. Some rules are global, while others can be for specific BACnet devices. For particular BACnet devices, they are specified by 'Vendor Identifier' and 'Model Name,' which need to match exactly as shown in that device's Properties - Advanced Tab.   Ensure you have installed the version that supports the feature you want to change. Setup file using the no-rpm rule. Use a text editor like 'Notepad' to create a text file or download the same file below. Enter the device's vendor ID (5)  and model name (TEC2627VVT) followed by the rule (no-rpm) using the format seen in the screenshot below. Save the file to the desired location on the PC with a name aiding later identification. Under the BACnet interface, create a new 'Document' object in the 'Application' folder. NOTE: The object MUST be named 'service_blacklist' in all lowercase. Click 'Next,' import the text file created in step 1, and save the 'Document' object. Restart the Server  Once the device is on the block list, SBO will not send 'readPropertyMultiple' requests to the device using only individual 'readProperty' requests. Add the service_blacklist to the EBO Server. Add the no-cov tag if you would like to block that service for this device:  Extended for multiple devices from different vendors simultaneously using this example for reference.   One can add a global rule using this syntax to ignore unhosted devices. * NOTE: It is recommended to remove <ignore-unhosted-devices/> after upgrading to EBO 4.0/2022 and higher because this feature is supported in the BACnet Interface Properties and BACnet Device Discovery view. Device Discovery for BACnet Controllers and IO Modules (se.com)  Once the Server has restarted, check the trace.log file and search for service_blacklist, there should be entries similar to this. 

Issue After configuration, Suprema readers are showing as offline in the Security Expert client. There are Security Expert Download Service events logged in the windows application event log. Cannot load DLL - LoadLibrary() Failed. Cannot load DLL event mesage Product Line EcoStruxure Security Expert Environment Security Expert Suprema biometric readers Cause Required DLL SecurityExpertSV2.ThirdParty.dll is missing from the installation folder. Some versions of Security Expert installer will not install this required DLL and the file need to be manually added. Resolution Check the Security Expert install folder, typically C:\Program Files (x86)\Schneider Electric\Security Expert, to confirm if the file SecurityExpertSV2.ThirdParty.dll is present. SecurityExpertSV2.ThirdParty.dll   If the file is not in the installation folder then it can be sourced from the integration guide ZIP package. AN 264 Security Expert - Suprema Biometric - Integration Guide contains the three DLL's required for the integration. Install the file by copying it into the installation folder, then restart all of the Security Expert services or restart the Security Expert server.

Issue When a very long path is included in a request to the SmartConnector RESTful EWS gateway, such as when attempting to acknowledge an alarm with a long path, the gateway returns the error "HTTP Error 400: The request URL is invalid."   <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"> <HTML><HEAD><TITLE>Bad Request</TITLE> <META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD> <BODY><h2>Bad Request - Invalid URL</h2> <hr><p>HTTP Error 400. The request URL is invalid.</p> </BODY></HTML> Product Line EcoStruxure Building Operation Environment SmartConnector Cause In Windows, the default maximum number of characters in a URL path segment (the area between the slashes in the URL) is 260 characters. When the object path, after double URL encoding, exceeds 260 characters, it triggers error 400. Resolution To resolve this issue, follow these steps: Add a registry key "UrlSegmentMaxLength" to the following path in the SmartConnector PC registry: Path: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters Name: UrlSegmentMaxLength Type: DWORD Value: 0 - 32,766 (e.g., set the value to 1000) After adding the registry key, restart the HTTP services or restart the PC. Detailed instructions for this process can be found in the "Http.sys registry settings for Windows" guide on the Microsoft Learn website. Http.sys registry settings for Windows - Internet Information Services | Microsoft Learn

Issue When following the Enabling Transparent Data Encryption configuration steps in the SX-SRVR Security Expert - Client Server - Installation Guide, an error is seen running the supplied script to backup the certificate and encryption key.   Cannot find the certificate ‘TDECertificate’, because it does not exist or you do not have permission. Product Line EcoStruxure Security Expert Environment Security Expert Server Microsoft SQL Server Cause When copying the text from the SX-SRVR Security Expert - Client Server - Installation Guide the formatting contains a carriage return that stops the script from being able to be run in SQL. Resolution 1. Ensure the correct database is being run against by selecting it from the drop down in the SQL Server Management Studio menu bar or by adding "use master" as the first line in the script. 2. Create folders "c:\storedcerts" and "c:\storedkeys". 3. Fix the script by removing the carriage return breaking up the "TDE Certificate" file name.   The following script was successfully used to backup one file in each directory. use master; go BACKUP CERTIFICATE TDECertificate TO FILE = 'c:\storedcerts\TDE Certificate' WITH PRIVATE KEY ( FILE = 'c:\storedkeys\TDE Key' , ENCRYPTION BY PASSWORD = 'Hard_drive' ); GO  

   

Issue What 10k Thermistor sensors are compatible with the I/A Series MNL and MNB families of controllers? Product Line TAC IA Series, Andover Continuum Environment I/A Series LON Controllers (MNL-xxxxx) I/A Series BACnet Controllers (MNB-xxxxx) Continuum 10K T3 Sensors Cause Specification information Job spec requires a specific family of sensors.  Need to know how to compare the TC curves. Resolution Compatible sensors that have a built-in 11k shunt resistor include the TS-5711-850, TS-57011-850, TS-57031-850, and TSMN-90110-850 Series.  NOTE: These sensors are no longer available for purchase. The TW2XAXK is the replacement Any sensor that matches resistance to temperature curve for a 10K Thermistor Type G (U.S.Sensor), Type 9 (Dale/Vishay) or Type III (ACI Series AH) can be used with the I/A Series MNL and I/A Series MNB series controllers, provided that a 11k ± 0.1% 1/8 watt resistor is wired in parallel with the sensor. The input has a range of -10 to 135 °F (-23.3 to 57.2 °C) with an accuracy of ±1% of span.   This includes the Continuum 10K T3 sensors.  The table below shows that the resistance in its normal operating range is within a few ohms of the TSMN non 11K shunted sensors.  The Continuum sensor can be used with a parallel 11K ohm resistor. The full temperature / resistance table for the US Sensor 10K Thermistor R-T Curve Type G sensor can be found here.  Please note that the controller may not be able to use the full temperature range shown in the table.    

  Issue Packets from the EBO onboard packet capture utility are not ordered correctly. In the example below it can be seen that the sequence number of the ACK comes before the REQ despite the timestamp for the ACK being later than the REQ.   Product Line EcoStruxure Building Operation Environment Building Operation Workstation SpaceLogic Server   Cause Out-of-order packets are quite normal on a TCP level. Earlier packets can arrive later due to buffering and other reasons. Applications are able to buffer these messages and rearrange them before they are written to the application.   Since the standard Wireshark pcap utility that EBO uses to capture packets does not sort packets in a batch by time stamp before delivering them to the capture file it is subject to the same irregularities that we would see on any OS.   Resolution This is a common enough issue that Wireshark includes a command line utility named reordercap that can fix packets that can't have been on the network in that order (like an answer being sent before you see the request for it).   In the example below the utility has run through a capture and reordered items and saved the file as a new file.     See the Wireshark reordercap help topic for further information on this utility.

Issue Any third party BACnet client can initiate an EBO backup. Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Building Operation Automation Server Cause As of EBO 2023 (5.0.2.109), EBO's BACnet backup operation requires no password which means any BACnet client with the EBO server BACnet interface's device ID can initiate an EBO backup without any restrictions. Any such backup can be identified by looking at the backup description in EBO, the backup will explicitly indicate that it was generated by third party BACnet Workstation.   Resolution EBO 2024 (V6.0.1) or higher: In BACnet Interface basic tab, "Restrict backup and restore service" can be set to Yes to ensure that third-party BACnet clients cannot perform a BACnet backup or restore on the EcoStruxure BMS server. Refer to: BACnet Interface for an Automation Server – Basic Tab and BACnet Interface for an Enterprise Server – Basic Tab   EBO 2022 (4.0.4CP2 or higher) and EBO 2024 (V5.0.3 or higher): A rule can be added to the BACnet service_blacklist to disable BACnet backup service. See https://community.se.com/t5/Building-Automation-Knowledge/BACnet-RULES-implementation-to-disable-features-such-as/ta-p/839 for details on how to create service_black list.   Use the following syntax to create a rule that restricts BACnet back up initiated by 3rd party BACnet client on the EBO server.   <blacklist> <global> <restrict-backup-service/> </global> </blacklist>   Any BACnet client requesting backup from EBO server configured with the above rule will be presented with error similar to screenshot below.

Issue Continuum NetController fails when a port scanning tool runs a network port scan on the ethernet network where the controller is connected. Some of the controller failures that have been reported to Product Support Services include controller scan locked, controller resetting, hanged, stuck in bootloader etc. In some cases the controller may be running but exhibiting very strange symptoms due to its tasks scheduling being disturbed by the scanning traffic and/or due to memory corruption. Product Line  Andover Continuum   Environment Continuum CX Gen 1 Continuum Net Controller II Continuum ACX 2 Controller Continuum ACX 4 Controller Continuum bCX4040 (BACnet) Continuum bCX4000 (Router) Continuum bCX9640 (Infinet)   Cause The legacy Continuum controller's network stack is not able to handle some of the packets generated by network scanning tools, most such tools explicitly point out that older internal systems may not be able to handle the port scanning traffic and may fail during the process.  The controller error log may show some variation of the following errors...   219 I 08/10/2024 13:14:53.35 0xbadd0018 0x00002500 0x001783f0 0x40602004 0x0017eeb4 Reset (Spurious interrupt)   4914 I 09/14/2022 09:00:54.00 0xbadd0002 0x00002600 0x02001bd4 0x48082600 0x020ffbb8 Reset (access error) Resolution The Continuum NetControllers are now legacy systems no longer in active development, therefore, the only known solution is to add  the controller's IP address to the tools white list so that no port scanning packets are directed to the controller.   It is important to note that NONE of the Continuum NetControllers listed above use Windows or Linux based OS, this makes them less vulnerable to the typical hacker attacks.    Andover Continuum is a legacy Schneider Electric product. We strongly encourage upgrading your system to the more secure and feature-rich platform, EcoStruxure Building Operation. 

Issue WorkStation can't connect via secure communication (HTTPS) to EBO server, although it can connect via non-secure communication (HTTP). Cloud connectivity also fails. WebStation can still connect via HTTPS. Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Building Operation Enterprise Central Building Operation WorkStation Cause TLS V1.3 is supported in Windows 11 and Windows Server 2022 or later. Enabling it in earlier Windows versions is not support it can lead to problems, as explained in Protocols in TLS/SSL (Schannel SSP) - Win32 apps | Microsoft Learn Resolution Do not enable TLS V1.3, If the installed Windows version doesn't support it (Windows 10 and Windows Server 2019 or earlier), or disable it if it is already enabled by following the below steps:  Open Windows Registry Editor, by writing "regedit" in Start menu.  Goto registry path "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Client" Make sure that "Enabled" is set 0, and "DisabledByDefault" is set to 1, this will disable TLS V1.3 for clients.  Restart WorkStation.   For more information, refer to: Transport Layer Security (TLS) registry settings | Microsoft Learn Warning! Improper use of regedit may damage PC’s operation.