Building Automation Knowledge Base

Issue For EBO Active Directory (Windows Domain) integration, do EBO support usage of "nested groups"?. Product Line EcoStruxure Building Operation Environment Building Operation Workstation Cause EBO are using Windows API and ask if the user is a member of a certain group.  Resolution Windows API should respond “yes” if the user is part of a group that is part of another group, which is configured in EBO. So this is up to how the Windows AD responds to the Windows API and not on the EBO side.   For more information, please see Integrating Windows Active Directory user accounts with EcoStruxure

Issue Changes made to an EcoStruxure Security Expert SSN are NOT seen on the live target system after re-registering the License Product Line EcoStruxure Security Expert Environment EcoStruxure Security Expert Licensing Cause All EcoStruxure Security Expert License Registrations must be made from the SX Server itself. While it is possible to go through the steps of License Registration on Clients who are not on the SX Server, these registrations will not work and are not supported.   Ordinarily attempts to register a license using a Client which is not on the SX Server will produce a Hardware Mismatch error, because the Clients hardware details are different from the original Server's. However, in cases where the Server has also been intentionally moved and needs a Hardware Reset anyway, this could be missed. Resolution Always run SX License Registrations via a Client directly on the SX Server.  This is true for both direct online registrations and offline registrations alike.  A Client is always included in an SX Server installation so will always be available. If you are unsure whether you are trying to register an SX License on the correct machine please contact PSS via your local Customer Care Centre, as they can check the SSN Portal to make sure the Hardware Details of the new registration attempt, match the expected Server.

Issue Steps needed to create custom muster reports Product Line Security Expert Environment Security Expert Controller Cause Personalize who appears in the custom muster report (ex: Fire wardens in the office that day) Resolution Create a new Record Group for the users you want in your custom muster report. -Go to Sites| Record Groups click Add, name your record group, and click Save Go to Users| Users and assign your users to the record group Click Save Go to Reports| Setup| Muster   -Click Add to create a new Muster Report   -Name it, set Report Type to DETAIL   -Click Save     -Go to the Doors tab and add all doors     -Go to the Columns tab, click the add button      -be sure that the "Table" drop-down menu is set to "Muster Reports" and drag across all desired items    -alternatively, you can use the "Custom Fields" Table      -Click Save       5. Go to Reports| Muster   -Select the newly created muster report and execute: all the matching users will print on-screen   -Right-click a column header and select "Filter Editor..."      -In Filter Editor, click on "Status" and change it to "Record Group"    -change "Begins with" to "Equals"    -click <enter a value> and type in "Fire Wardens"      Note: if using Custom Fields, confirm spelling for each user because the filter option is case-sensitive       -make sure the "And" option is selected and add a condition (green "+" button) a new line should appear       -change to:  "Status" --Equals-- "In"    -You can add other conditions to meet your requirements (conditions: AND-OR-NOT-NotAND and NotOR)    -Click apply to see if the desired group is now filtered     note: The user badge must have checked in to print otherwise, it'll be filtered out      -Click OK    6. Click Save Report Filter to save changes and our report will print in this order Note: You can choose as many Custom Fields as needed. However, creating a Record Group minimizes the chance for typos

Issue Unable to find firmware update instructions in the SP-MNR2 installation guide Product Line EcoStruxure Security Expert Environment Security Expert Controller Security Expert SP-MNR2 Cause TFTP is needed to upgrade firmware Resolution What you need: TFTP WinAgent software (tftp.exe) PRT-MNR2-DIN firmware Download these files to the same folder(ex c:\fw) Steps: log into SP-MNR2's built-in web interface (default: 192.168.1.3) (if you are having trouble connecting to the interface, review the SP-MNR2 installation guide p.16-18) Browse to the MNR2 module and select the ‘Device’ page. Put the module into boot mode as seen below Open Command Prompt (Win key+R; cmd, Enter) Type: cd c:\fw Then Type: tftp -v -i <MNR2_IP_address> PUT <MNR2_Firmware_Filename.bin>   The command window should fill up with ‘packet received’ messages while the file transfer is being processed. Bring your SP-MNR2 back online. You should find that the firmware version is now updated

Issue After transitioning SP-AC1, hardware does not respond to manual commands. SX Client shows a valid read and shows the lock has been activated but the hardware does not change state (locked or unlocked) Product Line EcoStruxure Security Expert Environment Security Expert Cause The reader module type configuration did not transfer during the transition In Continuum, IOU modules (in Listview) show ProgramID value is empty/blank when it should have firmware version and module type Resolution In Security Expert, go to Programming|Outputs|General Tab Select irresponsive Module Change Address Module Type from <None> to <Reader(RD)> Save changes Test card read or manual lock

Issue Where can we order pluggable/screw terminal block replacements? Product Line Security Expert Environment Security Expert Controller Cause Pluggable/screw terminal blocks are not available for order Resolution SE does not sell pluggable terminal blocks because they are readily available online Find part number etched on side of the terminal block.   For example:2EDGK5.00-04P14   Full pluggable terminal block catalogue 

Issue TGML Graphic worked without error in EcoStruxure Building Operation 2.0 WebStation. After an upgrade to 3.0, WebStation displays one of the following errors on page load: Script error in DocumentLoadEvent (Component_Name) Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' blob: 'unsafe-inline'". Do you want to continue running this script? This site says... Script error in DocumentLoadEvent (Component_Name) Blocked by Content Security Policy Do you want to continue running this script? Script error in DocumentLoadEvent (Component_Name) call to eval() blocked by CSP Do you want to continue running this script? Product Line EcoStruxure Building Operation Environment Building Operation 3.0 TGML Graphics Cause A new security setting in 3.0 disallows eval() statements by default in TGML JavaScripts presented in WebStation. An eval() statement executes a string of characters as code, which can open security vulnerabilities if enabled, something akin to a SQL injection or cross-site scripting attack. If graphics were created in earlier versions and relied on eval() to execute dynamic code, the user will be notified upon opening the graphic in 3.0 WebStation. Resolution Any graphics relying on eval() to execute dynamic code should have their JavaScript functions rewritten to avoid use of eval(). This is the preferred approach with respect to cyber-security. Work-Around It is possible, but not recommended, to disable the new security check in WebStation TGML graphics. Within WorkStation open the Control Panel Go to Security Settings Check the box for "Enable WebStation to use unsafe string evaluated JavaScript methods like 'eval' For more information, see Web Help article: Enabling WebStation to Use Unsafe JavaScript Methods. For the latest solution to this issue please refer to: Cannot Open Graphics in WebStation 

Issue Need to know if various AS-B footprints and their databases are interchangeable.  Product Line EcoStruxure Building Operation Environment Building Operation Automation Server Bundled Building Operation Automation Server Bundled (AS-B-24) Building Operation Automation Server Bundled (AS-B-24-L) Building Operation Automation Server Bundled (AS-B-24-H) Building Operation Automation Server Bundled (AS-B-36) Building Operation Automation Server Bundled (AS-B-36-L) Building Operation Automation Server Bundled (AS-B-36-H) Building Operation Automation Server Bundled (AS-B-24-P) Building Operation Automation Server Bundled (AS-B-24H-P) Building Operation Automation Server Bundled (AS-B-36-P) Building Operation Automation Server Bundled (AS-B-36H-P Cause There are several different footprints and versions of the AS-B hardware. This can cause confusion on whether these servers are interchangeable. Below are a few example scenarios:   Can an AS-B-24 be replaced with an AS-B-24-L? Can a backup from and AS-B-36-L be restored into an AS-B-24? Can a backup from and AS-B-24-L be restored into an AS-B-36-L? Can a backup from an AS-B-24 be restored into an AS-B-24-H or an AS-B-24-P or an AS-B-24H-P? Can a backup from an AS-B-36 be restored into an AS-B-36-H or an AS-B-36-P or an AS-B-36H-P?  Resolution The answer to 1, 2, and 3 of the above scenarios is "No". The various AS-B hardware ARE NOT INTERCHANGEABLE. Backup sets can only be restored from one AS-B to another AS-B of the EXACT SAME HARDWARE TYPE. If an import of one type of AS-B into an AS-B of a different hardware type is attempted, the error below will be encountered.    The answer to 4 and 5 of the above scenarios is "yes". Whether the AS-P has HOA switches or not or is a scalable type, does not change the backup.  

Issue Support for OPC or DDE integration with EcoStruxure Building Operation Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Building Operation Automation Server Premium Cause The OPC Server is a software program that converts hardware communication protocol into the OPC protocol. The OPC client software is any program that needs to connect to the hardware. The OPC client uses the OPC server to get data from or send commands to the hardware. Resolution Neither the OPC server nor the DDE configuration is supported at this time. There is not currently a roadmap for direct OPC client or server capability within the EcoStruxure Building Operation. To avoid problems with OPC Integration (and lose a project), there are two options for OPC integeration: It is possibe to use a converter to convert OPC to/from one of EBO supported protocols.  For example, use a 3rd party software to translate all the OPC points into BACnet Objects, “OPC Server -> BACnet Server”, or translate all EBO BACnet points to OPC. Perhaps one of the software programs below will be of benefit. Take into consideration what specifically will the ES be doing. If it is exchanging point values then it should work fine. Kepware Matrikon SCADA engine Note: These are 3rd party products that are not supported by Shneider Electric.    Use a SmartConnector Extension to be a middleware between EBO and OPC cilent or server. Check available extenstions at Exchange shop and SmartConnector Server and refer to EBO SmartDriver and Smart Connector KB article for more information.

  Issue Is it possible to use the RP-C relays to control LED Light?  The specification sheet does not specify the maximum inrush current. Product Line EcoStruxure Building Operation Environment Building Operation Room Controller (RPC) 24 V Building Operation Room Controller (RPC) 230 V Cause RP-C is not designed for switching light loads, and especially not LED loads. LED loads will result in a very high inrush current and require relays that are designed for that. Furthermore, the light application often requires relays that keep the light on in case of power failures which is not the case for RP-C. Resolution The CRS light modules and the Hotel Relay modules have that type of relays and can handle peak currents up to 800A, which is typical for LED loads. If using the CRS modules is not an option for the customer another possibility is to use a contactor connected to the RP-C.

Issue How to add Basic Authentication header to SendWebRequest function in Script RESTful Web Services Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Building Operation Enterprise Central Building Operation Automation Server Building Operation Automation Server Premium Building Operation Automation Server Bundled Cause A 3rd party web service requires basic authentication for HTTP requests to ensure that data is requested securely, otherwise, the request will be rejected with an "Authorization Error".   Resolution Basic Authentication is a type of Authorization Request Headers, which transmits credentials as user-id/ password pairs, encoded using Base64, as defined in RFC 7617 - The 'Basic' HTTP Authentication Scheme (ietf.org).  Follow the below steps to create a Basic Authentication header in Script RESTful Web Services: Combine the User ID and the Password with a colon ex. "aladdin:opensesame". Encode the resulting string in base64 using script function to base64 encode a string posted in the Community or using the online encoder as Base64 Encode and Decode - Online, ex.  "aladdin:opensesame" will be "YWxhZGRpbjpvcGVuc2VzYW1l" after Base64 encoding. Construct SendWebRequest header in the following format:  Authorization: Basic <credentials>, as below example:  Headers= "Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l"'User ID=alaadin Password=opensesame Resultstring= SendWebRequest(BaseUrl,Method,ContentType,Headers,Message) Note: Basic Authentication is not a secure method of user authentication unless used in conjunction with HTTPS/TLS, as the user ID and password are transmitted as clear text. User ID and Password are Base64 encoded but Base64 can be easily decoded.  For more information refer to Script RESTful Web Services WebHelp and Authorization - HTTP | MDN (mozilla.org)

Issue This is a project to support integration with the Schindler PORT system. It should be deployed on a customer site to directly connect to the Schindler PORT firewall and be configured to connect to the customer instance on the Access Expert (AX) side to add, update, or remove people from Schindler PORT based on which access levels they belong to in AX.  Product Line EcoStruxure Access Expert Environment Access Expert Hosted software Cause Please read all the instructions to properly deploy and configure this service. Resolution Card formats The Schindler reader produces a 16-digit hexadecimal value after reading a card and sends it to the Schindler Port system for validation. The value from the Schindler reader is a different value from what is entered as the encoded card number in AX. Therefore, there needs to be an additional entry of the hexadecimal value in AX in the Hex Value field of a card assignment. The Hex Value will be sent to the Schindler Port system as the card number so that it matches with the Schindler reader value to get access.   To find out what the Hex Value needs to be, the process was to send Schindler 10 cards from a particular project then they get back to us with the correct hexadecimal representation of those cards. This will need to be done between you and Schindler for your project.   Prior to version 22.3.1 of the AX Schindler service, the service was used to encode the Encoded Card Number from AX using a 16-digit value of 0100000020000000, then replace the zeroes at the end with the hexadecimal representation of the Encoded Card Number. The service will still do that if no Hex Value is specified for a card but that may not be the correct encoding for your project.   In short, you need to enter the Hex Value of a card assignment in AX as the value that is generated by the Schindler card reader. Deployment The Schindler service is deployed using Docker. If you are using Windows, we recommend having WSL2 installed and enabled for Docker. The installer needs to pull the images for both Seq (for logging) and the Schindler service from the Docker hub.   The installer also needs to create a Docker network called ax-net. To create the network, execute: docker network creates ax-net To get the Seq image: docker pull datalust/seq To get the Schindler service: docker pull feenics/feenics-keep-schindler To install Seq (replace /path/to/seq/data with the actual path of a directory on disk, this is the linux notation): docker run -d --name seq --restart unless-stopped --network keep-net -e ACCEPT_EULA=Y -v /path/to/seq/data:/data -p 5341:80 datalust/seq To install Schindler (env.txt is in the same directory where you are executing the docker run in this case): docker run -d --name feenics-keep-schindler --restart unless-stopped --network ax-net --env-file env.txt feenics/feenics-keep-schindler Environment configuration The following environment variables can be specified in a file (env.txt in the example above) that is passed to the container when launching it from Docker. In the file, each of these properties will be followed by an equal sign then its value. ClientInstance= ClientUsername= ClientEncryptedPassword= ClientWSS= ClientAddress= Company= TagName= SchindlerServerIp= SchindlerServerPort=   Below is the description of each property: ClientInstance - the name of the client instance ClientUsername - the username to login the client instance ClientEncryptedPassword - the encrypted password obtained from the service password utility ClientWSS - the address of the MQTT event publisher (for USA: wss://keepevents.feenicshosting.com/mqtt) ClientAddress - the address of the API (for USA: https://keepapi.feenicshosting.com) Company - the company name as configured in the PORT system TagName - the tag name that will be assigned to the Schindler access levels in Access Expert SchindlerServerIp - IP address of the Schindler PORT firewall SchindlerServerPort - Port to use to connect to the Schindler PORT firewall Password The password in the environment configuration needs to be encrypted. The service has an embedded encryption utility. If you start the service with an additional parameter called "password", it will run the password encryption utility instead. Copy the encrypted password and add it to the configuration. To run it, execute the following: docker run --rm -it --name feenics-schindler-utility feenics/feenics-keep-schindler password The --rm will remove this container after it exists so you do not have to delete it manually.   Permissions The service user needs to have permission to read access levels, read people, read event messages and publish all Schindler event types. This is done by creating a group that has those permissions and assigning that group to the service user in Access Expert. The service will monitor the changes in the current instance and all the instances below it in the hierarchy.   Operation The Schindler PORT integration limits the configuration capabilities that can be performed from AX. We are able to add, update, or remove people from profiles in PORT. The Schindler PORT system has profiles defined with particular access to certain floors. These profiles need to have access levels in AX with the exact same name as the profile in order to add, update, or remove people from these profiles in PORT automatically. An access level matching a profile needs to be tagged with a tag name agreed upon and configured in the Schindler service (TagName). A person can only be in ONE profile in the Schindler system. This means that a person can only be in one access level tagged for Schindler sync. If a person is in more than one Schindler tagged access level, only one of the access levels will be chosen. If a person needs to have access to additional Schindler access levels, this needs to be performed from the Schindler system by defining a profile with all the required access and then adding an access level in AX with that profile name and Schindler tag. The Schindler service listens to changes in people and checks if they belong to a Schindler tagged access level then sends an update to Shindler PORT (first name, last name, 3 card assignments, profile name, start and expiry date) PORT only supports one start and expiry date for all three cards so we take the union of the three The Schindler service also listens to changes in access levels that have the defined TagName, whether a Schindler tag was added or removed to either send or remove the people in that access level from the Schindler system Warning: DO NOT delete an access level that has a Schindler tag. You need to remove the tag first in order for the service to know which updates it needs to send to PORT. Schindler command and response numbers (logged in Seq) The first three numbers in the command are an index, it is incremented with each command sent, and the PORT systems reply with the same command index. The next two numbers are the command type or the reply type as follows: SendAlive = "00" SendAliveSuccess = "01" ChangeInsertPerson = "06" ChangeInsertPersonSuccess = "03" ChangeInsertPersonError = "07" DeletePerson = "08" DeletePersonSuccess = "05" DeletePersonError = "09"   Important Add a permission restriction that an access level tagged with the Schindler tag cannot be deleted. This is important because we need to remove the people in Schindler PORT before deleting the access level. The workflow would be to delete the Schindler tag first, then you are allowed to delete the access level.   Recommendations The enterprise should review all access levels tagged with the Schindler tag to audit the entities that are giving elevator access. The enterprise creates the profile (access level) in the PORT system. If the tenant has a shared instance, the enterprise informs the tenant of the access level name and the Schindler tag to automatically send their people to the PORT system.

Issue Trend charts don't display any data in Advanced Display v3 (ADv3) although the data can be seen in a trend log list  The trend charts display data normally on other WorkStation and WebStation clients. Product Line EcoStruxure Building Operation Environment Advanced Display V3 Cause The ADv3 date is incorrect, therefore the trend chart when opening shows an interval that doesn't include any data. Resolution Set the correct date and time in the ADv3:   Exit the SmartX HMI Kiosk app - Short press the power button (less than 3 seconds) Enter the password to exit the app and return to SmartX HMI Kiosk To Exit the Kiosk mode repeat the previous 2 steps. In the Home screen mode slide up and tap Settings Tap the System option Tap the option Date and Time and adjust accordingly or enable the option Automatic date and time.  

Issue Some graphics are not visible from specific WorkStations but are visible in other WorkStations or WebStation. The graphic has an orange exclamation point overlay in the system tree and the graphic has an INVALID OBJECT error with the following error description: "An unexpected error occurred when fetching type udt <alpha numeric string>. The type cannot be decoded." No Showing graph in WorkStation Product Line  EcoStruxure Building Operation Environment Building Operation WorkStation Cause This issue is due to corruption in the WorkStation cache. Note that the WorkStation cache is NOT cleared when WorkStation is uninstalled, it needs to be manually removed. Resolution Uninstall ALL versions of WorkStation on the PC Navigate to: %AppData%\Schneider Electric EcoStruxure\Building Operation\ Delete the WorkStation folder Re-install WorkStation and open the graphics again.          

Issue “Invalid certificate for https communication” alarm pops up after upgrading to EBO 4.0     Product Line EcoStruxure Building Operation Environment EcoStruxure Building Operation Cause "Invalid certificate settings for Server to Server communication" is set to enabled (Generate Alarm) by default for new installations/upgrades. This function was deliberately designed to alert existing installations that their sites might be subject to security-related issues, and necessary action needs to be taken. Resolution If users want to get rid of this alarm, they need to: Suppress the alarm by unchecking the “Generate alarm” under Security Settings/ Invalid certificate settings for server to server communication   Or Replace the server certificates with one that can be validated against a CA certificate.   Note: Please refer to the following web pages for more information. CA Certificate Management Security Settings – Control Panel  SSL Certificates 

Issue Presented with a message saying the activation was completed but "The license file could not be found". The license was then not activated. Product Line EcoStruxure Security Expert Environment Security Expert License Activation Cause This is a credential issue. What happens during a license update is that the license is downloaded to ..\ProgramData\Schneider Electric\SecurityExpert\License folder and is then loaded from that location. If the current Windows user doesn't have the correct permissions to write or read from that folder then the process will fail and we will get the error message Resolution Go to the C:\ProgramData\Schneider Electric\SecurityExpert\License location and right-click on the folder white space and select properties.  This will bring up the properties window of the folder "License" shown in the screenshot below.  Go to the Security tab and ensure that the SYSTEM and Users accounts have  the same permissions set as what is shown in the screenshot below (specifically read and write permissions).

Issue Unable to login to Webstation when it is embedded in an iframe on a webpage even though the security setting Enable WebStation to be embedded into another website is set. Clicking Log on after entering credentials just makes the login page reload. Security Setting "Enable WebStation to be embedded into another website" security setting   Webstation login page in iframe Webstation might even go into a login loop if the Guest account is activated and Webstation logs in automatically to this account: Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Building Operation Enterprise Central Building Operation Webstation Building Operation Automation Server Building Operation Automation Server Premium Building Operation Automation Server Bundled Cause The Webstation login functionality relies on HTTPS redirect to function properly when it is embedded in an iframe. Error message in the browser developer tool console says: Blocked autofocusing on a <input> element in a cross-origin subframe. Resolution Webstation needs to redirect web clients to HTTPS. There is a setting in Security Manager that controls this. Follow the steps below to activate the redirect: Login to Workstation and go to Control Panel and then Security Settings. Check Redirect web clients to HTTPS and save the change.

Issue WorkStation will play audible alarms but the same alarms will not play in WebStation Product Line EcoStruxure Building Operation Environment Building Operation WebStation   Cause Alarms can be viewed in WebStation but they do not have audible alarm sounds.  Resolution Audible alarms are available in WebStation from 3.2 onward.   See online help topic: WebStation and WorkStation Differences - EcoStruxure WebHelp

Issue Users or engineers may be unsure of how to access the best support for issues with EBO Smart Connectors, especially where site specific Smart Connectors have been developed, or believe the issue is with the underlying framework. Product Line EcoStruxure Building Operation Environment Integration Cause Unlike EBO, which is a standard EcoStruxure product that falls under normal R&D, the Smart Connector (formerly known as Mongoose) was developed by Schneider Electric Buildings Labs and a separate R&D Team.   Resolution If using a Smart Connector developed specifically for a project by a separate Integration Team within Schneider-Electric, then it is always best to go back to that team with your technical issues. In all other cases, the Smart Connector Framework is now supported via normal Product Support channels by raising a support case with your local Customer Care Centre, just as you would for any other EcoStruxure Issue.   The  SmartConnector Developer Forum: can still also still be found on the community.  

Issue Numbers are rounded. Why two values of nearly equal magnitude are subtracted, significant digits are lost.  This occurs in a variety of places within EcoStruxure Buildings Operation, and explained using a script program in the example below. Product Line Ecostruxure Building Operation Environment Building Operation Enterprise Server Building Operation Automation Server Cause In a string program and the NumToStr function, if a number (example 5.7) is entered and Save is selected, then the Value in the Variables window at the bottom shows 5.6999998. The value is altered from the original. Resolution When looking at a value in the watch window or variables view, there is no rounding so you are going to see the full length of the float number which suffers from a thing called “loss of significance” More information on float numbers can be found at: https://en.wikipedia.org/wiki/Loss_of_significance This phenomenon happens everywhere. An alternative would be to add a formatting feature to do the rounding. Script handles numbers as IEEE754 single precision floats, so the accuracy is limited to (IIRC) seven significant digits. The accuracy loss starts around 1.677E7. On www.binaryconvert.com/convert_float.html?decimal site, a decimal number can be converted to binary and then back to decimal in order to see how the decimal number will be handled in Script. Script handles numbers as IEEE754 single precision floats, so the accuracy is limited to (IIRC) seven significant digits.   The accuracy loss starts around 1.677E7.   On this site you can convert a decimal number to binary and then back to decimal in order to see how the decimal number will be handled in Script. http://www.binaryconvert.com/convert_float.html?decimal