Building Automation Knowledge Base

Warning Hazard of Electric Shock: Remove all power from all devices before removing any covers or doors of the system. Disconnect power at the device and at the power source. Electrostatic Discharge Required: Always discharge static electricity from your person by touching metal prior to handling any hardware. Failure to do so may result in damage to devices. Issue Detector showing internal trouble. Product Line ESMI Fire Detection. Environment FFSULH2001. FFSULH2003. Cause If the analogue value of a detector measured by the panel is outside of the normal operating range (≤41 to ≥95) the panel will show “Internal Trouble” indicating that the detector is faulty and should be serviced. Resolution Replace the faulty detector.

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue The added to parent column shows incorrect information. PCT 1.X  PCT 2.x Product Line EcoStruxure Building Operation Environment Building Operation Project Configuration Tool (PCT) Cause PCT doesn't detect detachment in WorkStation. Resolution Do not detach the child server from its parent in PCT 1.x and 2.x. Webhelp information: Adding a Virtual EcoStruxure BMS Child Server to a Parent Server.

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue When hosting objects from EWS/Smart Connector, such as Security Expert, into EcoStruxure Building Operation (EBO), additional or mismatched object names can result in unresolved bindings and duplicate EWS IDs. Common symptoms include:  - Duplicate EWS IDs with different names - Unresolved or broken bindings - Binding loss after deleting containers   Duplicate EWS IDs with different names Unresolved or broken bindings     Product Line EcoStruxure Building Operation, EcoStruxure Security Expert. Environment EcoStruxure Building Operation Enterprise Server (ES) Security Expert Smart Connector Integration EcoStruxure Web Service (EWS) Cause Typical reasons for this to occur: Hosted object names do not match those in Security Expert. Deleting containers without proper renaming can cause binding loss. Resolution   Best Practices for Future Hosting Always rename the hosted object in EBO before rehosting from the hardware folder. This ensures that existing bindings are preserved. Avoid hosting the entire `SecurityExpertServer` container—only host changed or new objects. For Unbound or Irrelevant Objects: - If objects have no bindings, naming is not critical from an EBO perspective - Delete the container and rehost the object from the **Hardware folder**.   To Retain Existing Bindings  Identify the correct object name in the Hosted Containers folder  Copy the name to avoid typos. Delete the duplicate object with the correct name. Rename the existing EWS ID to match the copied name. Save the rename Verify bindings: Right-click the renamed object Select Delete Click Show References Confirm bindings are still valid. Click No to cancel deletion. Repeat this process for each object (inputs, outputs, doors, etc.) that has existing bindings.  

Issue Unable to log into Workstation because the user password is unknown. Product Line EcoStruxure Building Operation Environment Building Operation Workstation Building Operation Automation Server (AS, AS-P, or AS-B) Building Operation Enterprise Server Building Operation Enterprise Central Building Operation Project Configuration Tool (PCT) Cause The password for an Automation server or Enterprise server/Central has been forgotten. Resolution IMPORTANT: The session ID is unique for this session of WorkStation. You cannot close WorkStation until the password has been reset. If you close WorkStation, before the password has been reset, a new session ID is generated that cannot be used with the temporary password provided by your local Schneider Electric Buildings support team.       The following are the steps to populate the session ID, which is required for doing the password reset.   For servers with EBO older than V3.1.X In the WorkStation logon page, while holding the shift key, left-click the area near the EcoStruxure Building Operations Icon.   This will populate the Session ID. Copy the Session ID.   For servers with EBO V3.1.X:   In Device Administrator, select the server you need to perform the reset to. Check the box and click the hyperlink   From the top bar select Password Reset Select OK when you get the “Password reset token created” pop-up Now, on the WorkStation logon page, while holding the shift key, left-click the area near the EcoStruxure Building Operations Icon. This will populate the Session ID. Click the Copy button.    For servers with EBO V3.2.X and higher In Device Administrator, select the server you need to perform the reset to From the top bar, select the “Edit Connection Password/Reset password” and press OK Now, on the WorkStation logon page, while holding the shift key, left-click the area near the EcoStruxure Building Operations Icon. This will populate the Session ID. Click the Copy button.   For servers within PCT 2.X Start the server Left click on the Server Menu  Select "Set password reset mode"  Now, on the WorkStation logon page, while holding the shift key, left-click the area near the EcoStruxure Building Operations Icon. This will populate the Session ID. Click the Copy button.    NOTE (for servers with EBO V3.1.X and higher)  For the Automation Server password reset, ensure that the Automation Server is connected to your PC machine via a USB cable. For the Enterprise server and Enterprise Central password reset, add the server to the Device Administrator using the “Add Server” button on the top bar. Please note even if you enter the wrong password, the Server would still be added to the Device Administrator.     After having the Session ID:   Send the Session ID to your local Schneider Electric Buildings support team Once PSS provides you with the unlock key In WorkStation, ensure that the Session ID is still visible, enter: User Name: admin Password: paste the result from the webpage Domain: Local and click Log On This will pop-up the Change-Password form Fill in the “old password” field with the unlock Key Put in a new password you want to use and then enter the new password in again. Click OK   NOTE:  When attempting to reset the password and unlock with the sessionid/temp password, you receive the error: "Your account has insufficient permission to use the system. Contact your administrator. "  Open a case with your local Product Support group and submit a request to unlock the user.   NOTE: WebHelp article 6749   The following video shows the password reset procedure for EBO older than V3.1.X. It covers most of the important steps for newer versions. Quick-Help video    

Issue In EcoStruxure Building Operation (EBO) version 3.1 and later the password reset function have changed, how does it work, and what is changed from before? Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Building Operation Automation Server Building Operation Project Configuration Tool (PCT) Cause The changes have been done due to cybersecurity issues. The basic workflow is the same as before but the generation of the reset token has changed. Resolution IMPORTANT: The session ID is unique for each session of WorkStation. You cannot close WorkStation until the password has been reset. If you close WorkStation, before the password has been reset, a new session ID is generated that cannot be used with the temporary password provided by your local Schneider Electric Buildings support team.  See online help topic: Copying the Session ID when Resetting the Password   To get a password reset token in version 3.1 and later you need to set the server in password reset mode(valid 24 hours)   For Automation Server(AS, AS-P, AS-B) this is done using the Device Administrator(DA), a USB connection is required between the computer and the server   For the Enterprise Server(ES) administrator privileges on the PC where the ES is installed are required. The ES is set in password recovery mode using the DA, the DA needs to be started as an administrator.   For the virtual server environment, Project Configuration Tool (PCT) tool is used. To get access to the password reset mode, the server needs to be started.     For detailed information please see the video: 

Issue BACnet requires applications to listen on the same port across the IP subnet to receive BACnet discovery broadcasts. Two applications running on the same machine can not use the same port as the Listening Port. Product Line EcoStruxure Building Operation, Continuum, TAC I/A Series Environment Building Operation Enterprise Server I/A Series WorkPlace Tech Continuum Cyberstation Cause The site can not provide a separate machine or VM for each BACnet application, which is recommended for independent operation. Resolution With this configuration, one application will act as BBMD to receive and distribute BACnet Broadcast Messages. The other application will act as a Foreign Device, relying on BBMD to relay BACnet Broadcast messages. Once BACnet devices and the Application, configured as Foreign Device, have shared their IP and Port, messages between them will be unicast and will not pass through the BBMD. Ensure one application can be configured as a BACnet BBMD and the other as a Foreign Device. Configure one as BBMD, usually EBO Enterprise Server Configure the other application as a Foreign Device referencing the BBMD IP and Port

Issue When a Reader Expander is offline from the controller, users with Credential Type-based access are unable to be authenticated. Product Line EcoStruxure Security Expert Environment Security Expert SP-C, SP-AC1, SP-ACX SP-RDM2, SP-MRDM2 Cause Reader Expanders store a limited number of user card records locally, depending on the Offline Operation setting. However, user credentials (such as credential types, biometric or PIN-based data) are stored only in the controller, not in the Reader Expander. It’s important to note that the term "card" in the Offline Operation feature (as described in the online help and the SX-SRVR Security Expert - Operator Reference Guide) refers specifically to the Card Numbers section [1] of a user record, not the Credentials section [2]. User record Resolution The Offline Operation functionality of Reader Expanders supports authentication using Card Numbers only. It does not support authentication using Credential Types when the expander is offline.  

Issue How can I troubleshoot a communication issue with the Modbus protocol Is there a log available within the AS or ES that shows the Modbus communication between Modbus devices Product Line EcoStruxure Building Operation Environment Building Operation Workstation Building Operation Automation Server Building Operation Enterprise Server Cause When troubleshooting Modbus issues in an AS or ES it can be helpful to see the communication between devices to help identify this issue. The trace log within both server types is available and is configured as described below in the resolution. Resolution Open Workstation and navigate to [AS/ES name]/System/Modules/Trace/Loggers/nsp/nsp.pin. Right-click "nsp.pin.modbus" and choose Properties. Under Level, change from "Information" to "Debug", then click ok. In EBO 7.0 and higher, "Debug" will report 1 line per transaction, where "Trace" will report 8 lines for the same transaction. In EBO 7.0 and higher, instead of logging all Modbus with "nsp.pin.modbus," you can log separately Modbus TCP and Modbus Serial using either "nsp.pin.modbus.CommunicationLayer.ModbusCommsLogger.Serial" or "nsp.pin.modbus.CommunicationLayer.ModbusCommsLogger.TCP" Let it run a few minutes. If there are some user input needed to recreate the Modbus issue, then perform these steps now. Retrieve the log by right-clicking [AS/ES name]/System/Modules/Trace/TraceSettings and choose Trace settings->Get trace log.  Save the log file. A useful tool available on the Community, the Modbus decoder can be used to assist in viewing/debugging the Modbus trace log file information saved in the previous step. Once debugging is complete remember to change log level back to "Information" (reverse of step 3). Note: If the ES or AS is reset, i.e. cold started or warm started, the log level will return to 'Information', so if further increased logging is required, the procedure will need to be repeated. Note2: From v6 (2024), adding the trace below can be helpful for Modbus RTU /[ASName]/System/Modules/Trace/Loggers/nsp/nsp.pin/nsp.pin.sport/nsp.pin.sport.DeviceRS485   Here is a video showing the above process. 

Warning Hazard of Electric Shock: Remove all power from all devices before removing any covers or doors of the system. Disconnect power at the device and at the power source. Electrostatic Discharge Required: Always discharge static electricity from your person by touching metal prior to handling any hardware. Failure to do so may result in damage to devices. Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue For hardware failure or persistent issues, it is necessary to replace Security Expert hardware components Product Line EcoStruxure Security Expert Environment Security Expert SP-C or SP-C-Web controller Expanders (i.e. RDM2 or SP08) Card Readers Cause A hardware failure occurs or a persistent issue happens that requires steps to replace Security Expert hardware Resolution At times it's necessary to replace Security Expert hardware   Steps to replace Security Expert SP-C Controllers: 1. Determine if the original controller has encryption turned on If the failed controller was setup for encrypted communications with the Security Expert server, the newly installed replacement controller will not have the encryption keys to be able to decode the packets from the server. Attempting to bring it online will be unsuccessful. On the controller's Configuration tab press the Disable controller encryption, then Yes to confirm. A replacement controller will typically be unencrypted. As soon as it shows online you can decide if you want to encrypt it. If it was already encrypted in Security Expert before replacing it, you might need to hit the encryption button again to get it in sync. Note: It can be helpful to use the event server diagnostic. If you see messages including “unencrypted” set encryption on the controller and see if it comes online. 2. Disconnect the old controller from its networks unplug ethernet and RS-485 module network and other hardware 3. Replace the Serial Number in Security Expert In Security Expert, navigate to Sites | Controllers. Replace the Serial number of the old controller with that of the new one. 4. Disable encryption In the Configuration tab, click Disable controller encryption. 5. Default the Controller If the controller has been used on a different server, default the new controller. See the SP-C Installation manual for detailed steps on performing a controller default https://ecoxpert.se.com/search?documentUUID=b4fb1237-fd07-2ee5-d9ad-4324178c364c&title=SP-C%20Security%20Expert%20-%20Security%20Purpose%20Controller%20-%20Configuration%20Guide  6. Enter the event server settings on the controller Log in to the new controller's web interface. In Settings, enter the same IP settings, event server and ports as those of the old controller, then restart the controller. Note: Remember to remove the jumper used to default the controller 7. Connect the new controller to the networks and hardware The controller should come online in Security Expert if all the network settings, serial number and encryption settings are in sync. 8. Download the controller In Security Expert, right click on the controller record and select Force download. The controller should receive the download. 9. Enable encryption Once the controller is online, in the Configuration tab click Enable controller encryption in Security Expert if desired. Steps to replace Security Expert SP-C-Web Controllers: 1. Take a backup of the old SP-C Web controller Login to SP-C Web, In System | Backup controller This creates a .bak file prompting to save in a folder or in the downloads folder 2. Disconnect the old controller Unplug the controller from the ethernet network, the RS-485 module network and other hardware. 3. Register the new controller Log in to the new controller and register it in System | Licensing 4. Restore the previous backup taken Navigate to System | Backup and Choose File and browse to the previously created .bak file 5. Configure the IP settings In System | Settings, enter the same IP settings as those of the old controller, then restart the controller 6. Connect the new controller to the networks and hardware and Test Steps to replace Security Expert Expanders: 1. Disconnect the old expander from the RS-485 module network and any inputs, outputs or card readers. 2. Connect the new expander to the module network and hardware. 3. Set the new expander's address to the same as that of the old expander.  In Security Expert, navigate to Sites | Controllers, right-click the controller and select Module addressing.  In SP-C-WEB, use the Expanders Wizard. To address a keypad, power cycle it and then press [X], [Enter]. Enter the new address and press [Enter] to save. Note: Sometimes the old expander can remain in the module addressing window even after being physically disconnected. To free up the address, module update the expander record. This will fail, but the address should become available. 4. Module update the new expander. The expander should start operating normally using the programming from the original expander. Steps to replace Security Expert Card Readers: 1. Disconnect the old card reader from the reader port. 2. Connect the new card reader 3. Apply any Custom Configurations If the reader needs any custom configuration, apply it within two minutes of the reader starting up using the config card. 4. Wiegand and RS-485 readers should connect automatically For OSDP readers, put the card reader into installation mode, then send an OSDP install mode command to the reader expander.   Additional configuration after controllers have been replaced If used at the site, areas that are configured for duress alarms default to un-armed after a SP-C has been replaced and need to be re-armed via forced arming. If used at the site, the alarm dialer (Contact ID) "Service Mode" defaults to "0 - Manual Mode" after a SP-C has been replaced (see the arrow below) and needs to be changed to "1 - Start with controller OS". Service mode Test the replaced hardware to ensure the issue is resolved

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue Access Expert uses Docker containers and images for the Bosch and Schindler integrations and at times the virtual machine image(s) need to be updated. Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Cause Feenics updates virtual machine images which requires an update Resolution Feenics may update a Docker image for one of their integrations.  Note: A Docker software update may be indicated in the bottom right of the Docker Window This is only a software update for Docker and will not update the container image. An image update requires a command to Pull the image down from Feenics. The Docker software update is not required to update the Docker Image.  (see yellow highlight in the snapshot below)   Here are the instructions to update the Docker Container Image to the (latest) Open Docker Desktop for Windows 1. Under Containers, make note of the current bosch service name Ex. AX-bosch-service1 2. Stop the container/service using the stop button 3. Click the Red Delete button above the container Click Delete Forever No container after the delete Image still shows 4. Delete the Image by clicking on the Red Delete button under Images Select Delete Forever (Image) Image deleted (See below) 5. Click on the Blue button 'Search images to run' Type in the following to search for Images feenics/keep-bosch:latest   6. Select the 'feenics/keep-bosch:latest' Image and Click PULL You will see the progress of the image downloading 7. Click on Containers on the top left - the container will not be there 8. Click on Images and then Click the Play button on the Feenics/bosch entry 9. On the next screen, after selecting Play, select the down arrow next to Optional settings Enter the original container name that was noted above i.e. AX-bosch-service1, Click Run You will see messages from the bosch service startup Although the image is updated and running, you will likely see an 81 exception error in the startup log (see highlight above). Here are some additional steps to finalize this process.   10. Check in Windows Services> Docker Desktop Service One of the updates along the way may have changed the startup type to Manual Double-click on the service and select Automatic for Startup type Click Start (to start the service) Click Ok.   11. Open Windows PowerShell in ADMIN mode (standard mode will not work) Run the following command   docker run -d --restart unless-stopped --name feenics-bosch-service --env-file C:\ENV\env-us.txt feenics/keep-bosch   If you try to run the command with the same name as the original service, you will receive the following message in PowerShell  Successful running of the Power Shell command This command ensures Docker runs with the parameters that are stored in c:\env-us.txt 12. Click on Containers, and there will be 2 Containers Select the one that is NOT running and click the Red Delete button The Delete Forever prompt comes up, select the Delete forever button One container should remain and should be running The panel should be online and communicating 13. Test and verify everything is working with the Bosch integration

Issue Users who clean-dist or factory restore JACE-8000 to Niagara version 4.1 risk losing the serial ports.   Product Line TAC IA Series Environment I/A Series N4 Jace 8000 Cause Due to an old defect (fixed in Niagara 4.2 update 2; 4.2.36.38), a programmable device that controls the serial port may be left in an erased state during firmware programming. If this happens, serial ports (COM ports) will be missing when viewing the Serial Port Service under Platform Services in a station. This continues to be an issue for customers who routinely clean-dist or factory reset to Niagara 4.1 on upgrade scenarios. It is not necessary to clean-dist or factory reset when upgrading JACE-8000. If you are advised to do so, it is recommended that you use the 4.9u1 clean dist rather than the 4.1 version one, to avoid being affected by the old defect.  Resolution When the JACE-8000 is loaded with Niagara 4.14u2 (or newer) the issue will be automatically detected and fixed on boot. However, when a serial expansion module has been erased, the software cannot distinguish between an RS-232 expansion module versus an RS-485 expansion module. The following messaging will appear in serial shell (and system logs) when the JACE is booting (it will continue booting):   Starting USB-0 and USB-1 Host controllers... Started USB-0 and USB-1 Host controllers get_ctrlperms: ctrlperms set to 644 Check for usb firmware updates Re-creating firmware info file in /etc/usb ERROR: Expansion module info file /etc/usb/350130901TF9S81 is empty, cannot reprogram or start serial ports        1) To populate the info file with path to appropriate firmware, execute one of following at console command line:               For RS-485 expansion module: echo "/sys/images/usb/vid03eb/pid2425/Tridium485-2_r01" > /etc/usb/350130901TF9S81               For RS-232 expansion module: echo "/sys/images/usb/vid03eb/pid2404/Tridium232_r01" > /etc/usb/350130901TF9S81        2) Reboot to reprogram Check for usb firmware updates done   To fix the issue, download and start PuTTY. In PuTTY Configuration, select the radio button labeled Serial under Connection type. In the text field under Serial line enter COM3 (or whatever the port number is) and enter 115200 in the text field under Speed. Press the Open button to connect. You will need the same VCP driver that is noted in Preparing for new JACE commissioning  and JACE-8000 Backup and Restore Guide. Sign in to the JACE serial shell. At the prompt type 'sh' to exit the menu and enter serial shell prompt (shell prompt is $ dollar sign). Copy the correct command from the serial shell instructions. To copy with PuTTY, click and drag over the text. When you lift the mouse button, the text will be in the clipboard. To paste the text, you simply right-click. In the instructions above, 350130901TF9S81 is serial number of a programmable device that controls the serial port. Your serial number will be different. But if that was your serial number, and the erased device was an RS-485 expansion module, then the command to enter would be:    echo "/sys/images/usb/vid03eb/pid2425/Tridium485-2_r01" > /etc/usb/350130901TF9S81   And if it was an RS-232 expansion, then the command to enter would be:    echo "/sys/images/usb/vid03eb/pid2404/Tridium232_r01" > /etc/usb/350130901TF9S81   The file name and path may change in newer versions of Niagara. Therefore, copy from the instructions given in the serial shell output (do not copy the command from this Knowledge Base Article). Press the enter key after the command has been pasted correctly. Then send shutdown to warm-boot the JACE-8000, or just cycle power.  Observe the following output on the next boot:   Starting USB-0 and USB-1 Host controllers... Started USB-0 and USB-1 Host controllers get_ctrlperms: ctrlperms set to 644 Check for usb firmware updates Reprogramming usb device: 1.2 350130901TF9S81... loaded 350130901TF9S81 with /sys/images/usb/vid03eb/pid2404/Tridium232-1_r07.bin Reprogramming usb device done: 1.2 350130901TF9S81 Expansion boards have been reprogrammed - rebooting... exiting usbinit, shutdown requested   The JACE will boot one more time, and then it will operate normally.  Please refere to this additonal article for more help.   Jace 8000 Serial Port Issues 

Issue The F3 Search function in EcoStruxure Building Operation (EBO) WorkStation does not return results for Notification File objects (e.g., .xlsx, .pdf, .txt), even when using wildcards.     Product Line EcoStruxure Building Operation Environment EcoStruxure Building Operation WorkStation Search Cause This behavior is functioning as designed (FAD). Notification files generated using the "Write to File" option are not stored in the EBO database. Therefore, they are not indexed and cannot be retrieved using the F3 search function. Resolution Although these files are not searchable within EBO, they are saved locally in a fixed directory: ...\db\notifications To assist users in locating these files:  Create a Hyperlink Object in EBO that points to the above folder. Users can then open the folder directly within WorkStation and use the operating system’s search functionality to locate specific files. Note: The notification file path is not configurable. For more information, refer to the official documentation in WebHelp: Accessing a Notification Written to a File

Issue What is the password policy for Security Expert operators, and how can it be configured to meet specific cybersecurity requirements? Product Line EcoStruxure Security Expert Environment Security Expert Server Security Expert Client Cause Some sites require customized password policies to comply with cybersecurity standards. These may include requirements such as: Enforcing regular password changes Preventing the reuse of previous passwords Setting minimum password length Requiring strong password complexity Resolution   Default Password Policy in Security Expert By default, Security Expert enforces the following password policy for operator accounts: Minimum password length: 8 characters Password change required: On first login For more information on Security Expert’s cybersecurity practices, refer to the SX-SRVR Security Expert System Hardening Reference Guide. Custom Password Policies via Active Directory Integration Security Expert does not support advanced password policy configuration directly within the client interface. However, enhanced password policies can be enforced by integrating Security Expert with Windows Active Directory. To implement this: Integrate Security Expert with Active Directory Follow the steps outlined in Option 1 of the How to Integrate Active Directory with Security Expert article or Option 2 for full Active Directory integration. See AN 288 Security Expert - Using Active Directory - Integration Guide for additional details. Configure Password Policies in Windows Domain Once integration is complete, operator accounts managed through Active Directory will adhere to the domain’s password policy. This allows you to enforce: Password expiration intervals Password history restrictions Minimum and maximum password lengths Complexity requirements (uppercase, lowercase, numbers, symbols)

Issue Confusion about the current release version of Security Expert and the limited release Security Expert for the Enterprise Download Service. Product Line EcoStruxure Security Expert Environment Security Expert Enterprise Download Service Cause Two parallel development branches now exist for Security Expert: Maintenance Builds –  version 4.3.370.15 (Released 2025-May-01 - latest stable release) Limited Release Builds –  version 4.3.386.2, intended for use with the new Enterprise Download Service. This has led to confusion because: The limited release version (4.3.386.2) has a higher version number than the current maintenance release (4.3.370.15).  The Supported Software 2025 landing page does not host the actual installation files for the limited release. Instead, it now provides a ZIP file containing instructions and a request form. Initially, version 4.3.386.2 was directly downloadable, but it has since been replaced with the ZIP package. Resolution To Access the Current Maintenance Release Visit the EcoStruxure™ Security Expert – Software and Firmware page on the Extranet. Sort the list by date to find the most recent maintenance version (currently 4.3.370.15 Released 2025-May-01).   To Access the Limited Release (Enterprise Download Service) Go to the Supported Software 2025 landing page. Select either: “2025 Enterprise Download Service (VM Bundles)”, or “Client/Server Security Expert - v.4.3.386.2”. Both links download the same ZIP file, which includes: Instructions for requesting the limited release. A site evaluation form that must be submitted  to TeamVipers@se.com who will review and provide the installation files.   If You Need to Roll Back from 4.3.386.2 to 4.3.370.15 Due to database version incompatibility, rolling back requires the following steps: Backup the current SecurityExpert and SecurityExpertEvents databases. Record the site’s license SSN. Uninstall the current Security Expert version. Important: Any configuration or event data added after the backup will be lost and must be manually re-applied. Restore the database backups from version 4.3.370.15 or earlier. Install the maintenance version (4.3.370.15).

Issue After an upgrade the SP-C-WEB is showing "NOT REGISTERED" with the option to register the controller. Attempts to register the controller fail as it is already registered. SP-C-WEB not registered When attempting to create new records their is a "License Limit Reached" message displayed and the new records are unable to be created. SP-C-WEB license limit reached Product Line EcoStruxure Security Expert Environment SP-C-WEB Cause Browser has cached settings for this controller that are interfering.  Resolution Use browser incognito mode and/or clear the browser cookies and cache.

Issue BACnet/IP controllers are not configured in RSTP Mode by default, therefore must be configured during installation. Having RSTP Mode disabled by default allows one to connect BACnet/IP controllers to any switch, even with port security configured to detect BPDU packets and disable the port. Product Line EcoStruxure Building Operation, TAC IA Series Environment Multi-purpose Controller (MP-C) Multi-purpose VAV (MP-V) Room Controller IP-IO I/A Series N4 Jace8000 SmartX IP Driver for Niagara Cause RSTP protocol requires that controllers, switches, and network architecture are configured to ensure the protocol will operate as expected.  Resolution Setting RSTP Mode for BACnet/IP Controllers ALL devices in the RSTP loop MUST BE IN RSTP MODE to function properly. This is not a huge issue because during startup you can unplug 2nd side of the loop and it will function properly in a daisy chain. Ensure the SmartX Controllers are configured correctly Configuring BACnet/IP Controller Device Settings A factory or network reset returns the RSTP setting to Disabled. Important: Whenever you change RSTP settings, the controller MUST be WARM START. If you fail to perform this restart, the BACnet/IP controller will continue communicating using its previous RSTP settings. 'Activate IP Changes' does not affect RSTP mode. Ensure the switch is configured correctly per Configuring RSTP on a Managed Switch for SmartX IP Controllers. If asked to review this for a case, please provide PSS screenshots from the switch configuration page(s).  Bridge Priority = 4096 Hello Time = 2 sec Max Age = 40  (40 is the maximum value allowed by the protocol. Default is 20) Forward Delay = 21 sec Bridge Priority Considerations Change Bridge Priority by adding 4096 as switches get further away from AS. (8192, 12288, 16384, 20480, 24576, 28672) DO NOT set the priority as 32768 or higher because that is the built-in Bridge Priority of BACnet/IP Controllers. First, configure the Root Bridge Switch (closest to the Automation Server) settings. Then, configure the additional Switches in order of increasing Bridge Priority. Plug in 2nd side of the RSTP Loop If all devices stay online, then it is working properly. Now test line breaks or controllers that are powered off. If all devices go offline and/or the switch LED is flashing rapidly, then go to RSTP Troubleshooting. Managed Switch Troubleshooting Consult the documentation or contact the vendor or manufacturer to assist with configuration for the items below. Ensure the switch is IEEE 802.1D - 2004 capable. BACnet/IP Controller Networking Term Definitions RSTP Ring mentions the Rapid Spanning Tree Protocol is specified in IEEE 802.1D - 2004. Ensure the firmware is up-to-date by contacting the vendor or manufacturer or downloading it from its website. Ensure ports not participating in RSTP are configured as Edge Port, Admin port, or have STP disabled. Nomenclature for those settings on your specific managed switch may vary. Adding BACnet/IP controllers to site-managed switches, work with Local IT to add these devices to their network. They will need to work with their switch vendor/manufacturer/support group to ensure the configuration of those switches because it could be more complex than changing the minimum recommended four settings above. Also, since RSTP Protocol is limited to Max Age = 40 (hops including site switches and BACnet/IP controllers), each loop's size may be limited based on their site switch network configuration and architecture.  Determined the proper configuration (or disable) for the following features. DHCP snooping Dynamic ARP inspection Denial-of-service (DOS) mitigations BPDU Guard BPDU Filter RSTP Troubleshooting Check each BACnet/IP Controller -> Diagnostics -> Device Report to confirm in RSTP Mode MANUAL CHECKOUT Double-click MP - Diagnostics Files - Device Report It will open in the default text editor Review the Device Settings section near the bottom. In firmware 1.00.0x, the report should report RSTP Mode: Enable In firmware 2.00.0x or higher, RSTP: Enabled and RSTP Status: Operational If it reports disabled, then perform Setting RSTP Mode for BACnet IP Controllers Step 1 until RSTP is working properly. USE SEARCH & EVENTS EBO 2.x MP Device IP and Settings.xml for EBO 2.0 as it only includes MP controllers EBO 3.x SmartX Device IP and Settings.xml for EBO 3.x or higher Import attached search USE RSTP STATUS GRAPHIC IN WEBSTATION MUST BE EBO 3.1 or higher which includes ClientAPI support Frontline Fridays Episode 02 - Rapid Spanning Tree Protocol (RSTP) Date: 2022-11-11 Mike Botens posted the following in the thread: RSTP Status TGML dated 2022-11-09 PDF of the presentation Fusion Fridays - Session 07 ​​​​ Date: 2020-05-28 The start of the video shows the graphics page in use RSTP Status.zip is downloaded via the link below the video. Extract the TGML and drop it on the AS to import. The suggestion is to store TGML directly under the AS to help with navigation in Webstation. bind Network to the BACnet/IP network with the BACnet/IP Controllers. (You may need a second TGML page if BACnet/IP controllers are on Primary and Secondary IP) Run from web browser via WebStation because utilizes ClientAPI KNOWN ISSUES Offline controllers that are scattered are NOT an RSTP issue. Check to see if there is a possible DHCP issue by verifying controllers are still at their AUTO-IP address (IP 169.254.nnn.nnnn Subnet Mask 255.255.0.0). RSTP communications issues affect the entire RSTP loop or one contiguous group of controllers. Factory Reset or controller replacement should leave one ethernet cable unplugged until configured for RSTP per these articles: Replace a BACnet/IP Controller in an RSTP Ring Network Workflow and MP Controller Reset Modes If BACnet/IP Controller Device Report OR RSTP Graphic reports RSTP Status: Changes Pending instead of RSTP Status: Operational, disable RSTP Mode, Warm Start, re-enable RSTP Mode, Warm Start, and check again. SmartX is now SpaceLogic. KNOWN ISSUES with Firmware affecting RSTP: If Firmware 3.02.01 is installed, please upgrade to 3.02.02. RSTP not performing as expected with Static IP addressing RSTP does not work well on RPC HW RPC-16-B HW revision 6

Warning Electrostatic Discharge Required: Always discharge static electricity from your person by touching metal prior to handling any hardware. Failure to do so may result in damage to devices. Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue Data cannot be seen on Partner Portal for RS485 devices. Product Line EcoStruxure Building Activate Environment EcoStruxure Building Activate Flex Server EcoStruxure Building Activate Partner Portal Cause Data for the Modbus devices can be seen on third-party tools like Modscan but not on the Partner Portal. Resolution Follow the steps below if the Flex Server RS485 port is not sending any data: Ensure connections are made according to the installation instructions. Verify the correct port is configured. Double-check that the connections are not reversed. Inspect for any loose wires. Confirm the Modbus/BACnet ID is correct. Verify the baud rate configured for the end device. Check for any loose wire strands shorting on the bus or to the ground. Ensure no Modbus device is connected to the BACnet bus, or vice-versa. Confirm the number of devices in the loop matches the specifications in the installation instructions. Check if the loading of devices causes significant changes in resistance. Do not connect more than two resistors on a single bus. Ensure cables used are as per the specifications in the installation instructions.

Issue Can the EasyLogic range of controllers & RP-IO Modules work under Building Operation 3.2 as BACnet MS/TP third-party devices  Product Line EcoStruxure Building Operation Environment EasyLogic Controllers, EasyLogic RP-V, EasyLogic RP-C, EasyLogic MP-C EasyLogic RP-IO SpaceLogic Advanced, Pro, and Pro Plus Controllers that support native BACnet MS/TP (via a SpaceLogic RS-485 Adapters.   Standalone BACnet field controller Cause The documentation states that EasyLogic Controllers can be used as a Native BACnet MS/TP device. These devices must be configured using their respective supported Building Operation versions, such as Building Operation 2022 and above. However, there are no guidelines on whether they can be used as a third-party BACnet device, particularly in earlier versions such as Building Operation 3.2.    Resolution EasyLogic controllers can be used as BACnet MS/TP third-party devices in Building Operation 3.2 since the EasyLogic range of RP and MP controllers, and RP-IO I/O modules, natively communicate using the BACnet MS/TP protocol.  This same concept applies when using the devices as true 3rd-party devices (e.g., with Continuum and I/A systems) when older controllers fail, and these EasyLogic controllers are used as temporary replacements before a complete transition.   What MUST be understood before taking this approach is that there is no automatic conversion when migrating the site (and devices) to later Building Operation versions that support these devices natively. After the upgrade, the controller must be deleted from the database and hosted as a native EBO controller.   During this process, some programming may be lost. This risk may be mitigated by creating Custom Types for the application once engineered in Building Operation 2022 (or higher) to future-proof the site for upgrades.  Using the latest firmware for the EasyLogic range of devices is also recommended.     Furthermore, the SpaceLogic Controller Range that supports native BACnet MS/TP (via an RS-485 Adapters) can be configured in the same fashion as described for the EasyLogic range.   Refer to Hardware Overview for further details on each product line. 

Issue There is a performance issue affecting EBO Workstation and Product Support has requested logs. Product Line EcoStruxure Building Operation Environment Building Operation Workstation Cause Product Support has requested logs from EBO Workstation. Resolution The WorkStation logs and crash dumps are stored in the application data folder. The full path depends on the software installed:   EcoStruxure: %appdata%\Schneider Electric EcoStruxure\Building Operation\WorkStation\Logs %appdata%\Schneider Electric EcoStruxure\Building Operation\WorkStation\Crashes   StruxureWare: %appdata%\Schneider Electric StruxureWare\Building Operation\WorkStation\Logs %appdata%\Schneider Electric StruxureWare\Building Operation\WorkStation\Crashes     All files from the Logs folder starting with CoreLog or CrashLog must be included. All files from the Crashes folder must be included.   Perform the following to quickly access the appropriate folder above: Select link Paste into Windows Explorer Address Bar  If you can replicate an issue, perform this process to Temporarily Raise the Log Level before running the test and collecting the logs. Log in to WorkStation Click the Tools menu Click Options Hold down the left SHIFT key on the keyboard Click Apply Release the left SHIFT key on the keyboard and click OK to close the dialog The WorkStation log level is now set to INFO and will collect additional information Please note the logging level will remain at INFO while logging out and in.  To return the workstation log level to default close the Workstation and re-open.

Issue This issue is described in Tridium's internal case NCCB-71360. Users will notice that the default Nrio Device Manager view (Ux/web media) of the NrioNetwork driver in N4.14 looks identical to the previously existing workbench AX view; however, due to this defect, devices discovered and added through the web view will not function as expected.  Product Line TAC IA Series Environment I/A Series N4 Jace 9000 I/A Series N4.14 Framework Version Cause With the release of the Jace 9000, users may notice that the IO-R-16 and IO-R-34 devices will not function properly when discovery and configuration are performed through the web views. Resolution To tell if the device was added through the correct view, there are a few indicators. Malfunctioning devices will not show up with an Installed Version or a Sec version in either view: Working devices will display these values with no issue in either view: The malfunctioning devices' health section will read 'fail' even with a status of ok: Users in N4.14 should only use the Workbench AX Nrio Device Manager view to discover and add devices to a station. This use case is currently not supported in the browser for N4.14. All other use cases function in the UX Web Views, such as viewing devices, adding points, and commanding points.