Building Automation Knowledge Base

Issue When logging in to SmartStruxure WorkStation you get a security certificate risk warning Security Certificate Risk There were errors validating the security certificate in use. This may pose a security risk to the system. The certificate presented by this server was issued for a different server's address. How do you wish to proceed? Trust certificate or Cancel You can also get a warning when logging in through WebStation if you use the https address Warning in Google Chrome - FireFox - Internet Explorer Product Line EcoStruxure Building Operation Environment SmartStruxure version 1.6 and newer WorkStation WebStation Cause Starting in version 1.6, a new security feature has been introduced validating the ES and AS server identity based on security certificates. In order to avoid seeing this warning each time you log in, you need to apply a certificate to each server (ES, AS, ASP or ASB) - either a self-signed or an existing. Resolution This article will describe how to import or generate a certificate, and how to install the certificate through WorkStation or a browser. If you generate the certificate for an Automation Server, make sure that the time and time zone is correctly set in the Automation Server before generating the certificate. Regarding external CA certificates In step 8 below, it's shown how to generate a self-signed certificate. It might be that it's required to use an external CA certificate issued by a trusted issuer e.g. Verisign. All X509 certificates are supported. The format of the certificate must be PEM (as opposed to DER, PKCS7 or PKCS12). More about certificate types here. SBO currently only supports certificates using the PEM format which is the most common. If the external CA certificate is delivered in a container format (such as .pfx) it must be extracted before it can be used in SmartStruxure. More about extracting certificates here. Importing or generating a certificate Log in to Workstation clicking "Trust certificate" Navigate to the control panel Click on "Security Settings" Click on "Certificates" If you see a message saying that a secure communication protocol is not in use, it means that one or more AS's are communicating with the ES using the TCP port (4444) rather than https. In order to manage certificates for all servers in one operation, you need to change the communication ports. Click on "Configure communication settings" to do that. - and change the protocol to HTTPS and the port to 443 Back in the certificates settings, select one or more servers (in this example just the ES) and click "Manage Certificate" Select a certificate type to add. Unless a certificate is bought from a third party provider, select "Generate certificate" which will make a self-signed certificate. Enter a name, tick "Use IP/DNS..." and select a date when the certificate will expire as a minimum, and fill out more info if needed. Click "OK".  NOTE: Do not exceed year 2060 in the "Valid to" field, doing so will result in a certificate expired error when trying to apply the certificate. Select the certificate just created and save   Installing a certificate through Workstation Close Workstation (just logging out is not enough) Open Workstation and log in using the IP address or DNS name - never "localhost" as that name will not match the certificate. Now you will be able to tick "Always trust this certificate" as the name (IP address or DNS name) in the certificate matches the server you are logging on to. Tick the box, and click "Trust Certificate". Click "Yes" to confirm the installation of the certificate Now you will not get the security warning when logging on Installing a certificate through a browser Access the server using Internet Explorer (important) entering the https address (e.g. https://localhost) Click on "Continue to this website" Click on the "Certificate error" field next to the address bar Click on "Install certificate" Select "Trusted Root Certification Authorities" Click next and ok Close the browser Now you can use both Internet Explorer, Google Chrome and FireFox to access the server from Webstation using https and not get the warning If the certificate fails to install and be trusted properly, it might be because you need to manually select which physical storage to add it to. Refer to the following discussion

Issue There have been questions about how the new EcoStruxure Building Operation 2.0 demo license works with the new scalable pricing structure. Product Line EcoStruxure Building Operation Environment EcoStruxure Building Operation 2.0 and up All previous builds of SBO 1.9 and below Cause Understanding what the EcoStruxure Building Operation evaluation license will allow to function in the newer versions of the product.  Resolution The EcoStruxure Building Operation Evaluation License is a temporary license used when a database is being brought online before the permanent license has been deployed or on engineering laptops. All authorized Schneider Electric employees and partners can download the file from the Exchange Extranet. The file is updated every quarter as each one has an expiration date. The functionality of the demo license has not changed in version 2.0 and newer. This license file will still allow functionality and engineering of a database to take place as long as the file is valid. The only difference is the new warning banner that will be present until permanent licenses are installed.  Note: With the new scalable pricing starting in version 2.0, once the evaluation license is removed from the site, a license is needed for each Automation Server attached to the Enterprise Server.  More information on the Scalable Pricing structure can be found in EcoStruxure Building Operation Licensing and Scalable Pricing Info. 

Issue Supplemental Documentation on the Menta/Function Block PID simple blocks Product Line TAC Vista, EcoStruxure Building Operation Environment Menta/Function Block editor Cause The document below is intended to clarify some of the more subtle aspects of the Menta/Function Block PID blocks and when/how to use them. Resolution A Brief Overview of PID Control Proportional-integral-derivative (PID) control is a generic feedback control loop algorithm. A PID controller calculates the error from the desired setpoint of a measured variable. It then adjusts the control output accordingly to try and minimize this error. Parameters used in the calculation must be tuned according to the system they are employed to control. The three prominent parameters are the proportional, integral, and derivative values. The proportional value affects the change in the output signal based upon the current error from setpoint. The integral value works based on the sum of the most recent errors. The derivative value reacts based on the rate at which the error has been changing. The weighted sum of these three actions is used to adjust the control output. The most typical application used in HVAC controls is actually a proportional-integral control with no derivative influence (PI). Derivative action is very sensitive to measurement noise, and generally considered too complex for the relatively limited benefit to slower, more easily controlled loops.   Three Types of PID Blocks in Menta Menta has three different simple blocks for PID control. They are: PIDI, PIDP, and PIDA (links to Web Help). PIDI PIDI is a PID controller with an incremental output. It is designed to be used together with two digital pulse output (DOPU) blocks in control loops with increase/decrease actuators. Input parameters to the PIDI will influence the operation of the controlled output in the same way as the analog PID blocks. The output, however, will not show a percentage. The end user will only be able to force an “open” or “close” command to the actuator – not set it to a desired percentage. Examples of how to use PIDI are explored later in the document. PIDP PIDP is the newer of the two analog output PID controllers in Menta. Because of this, it can only be used in Xenta controllers with a system program version of 3.6 or later. In Menta, under Options > Device Specification, it may be necessary to set the file to system version 3.6 or later during the programming phase. PIDP differs from PIDA in 4 distinct ways: PIDP will remain in saturation for a longer time than PIDA. The integral portion of the calculation keeps a running sum of previous error adjustments. Because of this, it can “wind up” a stored integral response. There is an anti-wind up mechanism to combat the effect, but PIDA has no wind up at all. In PIDP, a change in the setpoint value will not cause a step change when using PI or PID control. The measured error is not from the setpoint input, but rather from the last sampled measured value. The PID block samples a measured variable any time it is inside the deadzone. The allows for the calculation’s setpoint to equal the edge of the deadzone and have a less dramatic response to exiting the deadzone. The other time it will sample a new measured variable is any time a control coefficient is changed. This is an important distinction to be aware of during tuning operations. It may be useful to force the measured variable equal to setpoint after altering tuning parameters. The tracking of the tracking signal is not instantaneous in PIDP, as opposed to PIDA. Looping back the output to the TSg tracking signal feedback input will not cause the PID to stay synched with an overridden output. Additional logic is needed to switch the Mode to 0 for one program cycle in order to lock in the feedback signal any time it does not equal the output signal. The D-part is not as sensitive to measurement noise in PIDP as in PIDA. PIDA PIDA uses the following equation to calculate its output: where e is the control error, y is the measured value (MV), G is the controller Gain, Ti is the integral time, Td is the derivative time and h is the Control Interval (ControlInt), i.e. the time between two successive updates of the controller output signal. While analyzing and understanding this formula is beneficial to fully understanding the PID simple block, do not get too mired in the details. This document will help to demystify input parameters to make the PID work in a number of situations. For the purpose of this document, a PIDA will be assumed for all applications.   Inputs to the PIDA Block MV Measured value is the process variable for the PID controller. It is an input value of type Real. Examples of this would be a room temperature, a return air CO2 level, or a hot water differential pressure. SP Setpoint is the desired value of the measured value. It is an input value of type Real. It could be a static value (Operator “Real const”), adjustable from the front end (Simple Block “PVR”), a stepping value, or a modulating value. If the setpoint is likely to change often, it is recommended to use the PIDA block as opposed to PIDP. Mod The mode input to the PID block will control its action and enable or disable the control output. It is an input value of type Integer. There are four possible modes: Mode = 0 Web Help lists this mode as, “Off, controller stopped.” A more accurate description would be, “The value present at the TSg input will pass through to the output.” If the looped back output value is not changing, then the PID output will freeze. Mode = 1 Normal control. A new output value will be calculated on every Control Interval. Mode = 2 Controller output forced to UMax. This could be used on a hot water valve when freeze protection is enabled. Mode = 3 Controller output forced to UMin. This typically represents the “off” position of a PID. G Gain is the proportional parameter of the PID control. It is an input value of type Real. It is represented by the following equation: To arrive at an appropriate default value for Gain, three parameters must be considered: UMax, UMin, and proportional band. In typical applications, UMin and UMax will be 0% and 100%, respectively. This is because most valve or damper actuators are going to control between 0-100%. For the following examples, this will be assumed, but do not discount the effect it will have on default Gain parameters if these values change (such as in a cascade control application). Appropriate default parameters are merely in the same mathematical order of magnitude as the final tuned value. Rarely will the default parameter result in perfect operation of the control loop. It is only intended to get close enough to provide decently steady control until proper tuning can take place. It is usually easier to think in terms of proportional band than proportional Gain. Consider a room temperature. What would be an appropriate band around the setpoint to maintain? Perhaps ±5°F. If ±5°F is selected, that would result in a 10°F proportional band. Plug that into the equation along with the assumed UMin and UMax values: This would result in a default Gain of 10. It is important to remember that Gain is a unit-less value. A Gain of 10 is neither large nor small – merely relative to the process variable and anticipated error from setpoint. Consider a PID controlling an outside air damper to maintain an outside air flow of 1000cfm. Would a proportional band of 10cfm make sense in this situation? Probably not. A more appropriate value might be a band of 500cfm. Plug this into the same equation as before: In the case of air flow control, because the process variable and anticipated error from setpoint are so much larger than in temperature control, a more appropriate default Gain would be 0.2. In a third situation, consider a PID controlling static air pressure in a supply duct by modulating a variable speed fan. A proportional band of 500”wc would not make sense. A band of 0.8”wc might be more appropriate. In the instance of static air pressure, a default Gain of 125 would be suitable. Comparing these three situations with Gains of 0.2, 10, and 125, they will all have relatively similar speeds in the control loop. Just by glancing at these values alone, it cannot be said that any of them are “bigger” or “faster” than the others without a more in depth mathematical analysis. In addition to the value of the Gain, the sign is also important. Positive values represent reverse acting PIDs like a hot water valve where the signal to the valve will decrease as the room temperature increases. Negative values represent direct acting PIDs like a chilled water valve where the signal to the valve will increase as the room temperature increases. To avoid confusion at the front end, and reduce the possibility that end users will accidentally reverse the action of a PID, it is best practice to always use a positive value PVR to represent the value of the Gain. Then use an Expression absolute value operator “ABS()” to remove any sign and apply a negative value when necessary. Using this method, the Gain from the front end will always appear as a positive value and no consideration for the proper action of the PID will need to be taken after the programming phase is complete. Ti Ti is the integral time, or the integral portion of the PID control. It is an input value of type Real. Adding integral control to a straight proportional algorithm helps to avoid “controlling to an offset.” It is theoretically possible that a chilled water valve at 40% is exactly the amount of chilled water required to maintain a supply air temperature of 58°F, even if the setpoint is 55°F. If the error in the signal never changes, then the proportional algorithm will not change the output signal. And an offset has been achieved and will now be maintained indefinitely. Integral time will eliminate this possibility. Every Control Interval that the temperature remains above the setpoint, integral control will add a little more to the control output. This will cause the measured variable to always approach the setpoint. Because this value does have units (seconds) it is possible to compare one integral time value to the next. Ti is inversely proportional to the integral effect in the formulation of the next control output. In general, the smaller the Ti value, the more integral control will affect the control output. A value of 50 seconds would have a very large impact on the output. A value of 2500 seconds would hardly affect the control output at all. The exception to this rule is that a value of 0 seconds will disable integral control. Typical default values fall anywhere between 250-1000 seconds. Some PID solutions may be susceptible to “integral wind up” where the internal calculation desires and integral response beyond the output limits. When the control signal reverses, the integral wind up must be reversed before the output sees the change. In the PIDA algorithm, integral wind up is not a concern. Td Derivative time is also measured in seconds and represents the D portion of the PID. It is an input value of type Real. Derivative control is generally considered too complex and sensitive to measurement noise to be of sufficient benefit to HVAC control. A Simple Block “PVR” set to a value of 0 seconds will disable derivative control, but allow the tuner to add derivative control if desired. DZ Dead zone refers to the amount above and below the desired setpoint that will result in no change to the control output. It is an input value of type Real. This differs from the concept of a proportional band in that it is not centered around the value. While a proportional band of 10°F represents ±5°F around setpoint, a dead zone of 10°F would represent ±10°F around setpoint. A dead zone is helpful to reduce “hunting” of the control output where it repeatedly rises and falls when a steady output would cause the control variable to steady out. Typical values depend on the process variable. For a supply air temperature, anywhere from 0.25°F to 0.5°F would suffice. For outside air flow, anywhere from 50cfm to 100cfm might be appropriate. In a supply air static pressure control loop, limiting the dead zone to 0.1”wc would suffice. TSg TSg is short for tracking signal. It is an input value of type Real. The internal equation uses this as the value of the previous control signal. It should be looped back to the PID from the output signal. This might be directly from the output of the PID, or it may be after some external logic. The TSg input can be used in another way as well. When the PID is in Mode 0, the TSg value passes directly through to the output signal. By setting the PID to Mode 0 for the first second of a control period, initial positions other than UMin or UMax can be achieved. It can also be used to keep a PID in synch with an output that has been overridden by the front end. If the PID is controlling a physical output AO, then the output of the AO should be looped back to the PID.   Configuration Parameters of the PIDA Block ControlInt The Control Interval represents the number of seconds in between each successive calculation of outputs. If this value is set to 0 seconds, then the Control Interval will match the cycle time of the application. The Control Interval should be thought of in terms of how long a change in the control output will take before the impact is realized on the measured variable. Consider three scenarios: Scenario 1: A variable speed drive modulates a pump speed to maintain chilled water differential pressure. Because water is incompressible, a change in the pump speed results in an almost immediate change in the pressure. A Control Interval of 1 second is appropriate in this scenario. Scenario 2: A chilled water valve modulates to maintain a supply air temperature setpoint. The supply air temperature sensor is a few feet down the duct from the chilled water coil. A PID controller moves the chilled water valve from 0% to 10%. How long will it take before the supply air temperature starts to fall? Granted, there are several X factors in this equation, but a good guess might be around 20 seconds. A Control Interval of 20 seconds is appropriate in this scenario. Scenario 3: A supply air temperature setpoint modulates to maintain a large auditorium's temperature setpoint in a classic cascade control configuration. A chilled water valve then modulates to maintain the supply air temperature setpoint. Room temperature dictates that the supply air temperature setpoint should drop from 60°F to 55°F. How long will it take before this change in setpoint causes the room temperature to fall? It may take a full minute, perhaps even several minutes before that change has an affect at the room temperature sensor. A Control Interval of 80 seconds, while seeming very slow, is perfectly appropriate here. Correctly configured Control Intervals will allow one change in position to have an effect on the measured variable before a second (or third, or fourth...) change is made. A proper Control Interval will stop the valve from overshooting unnecessarily. UMin UMin is the minimum possible output of a PID controller. In most applications (valve and damper actuators) this will be set to 0%. In the case of a cascade control supply air setpoint PID, it might be set to 50°F. If the hardware output has a minimum position (say on an outside air damper), it is best to accomplish this with secondary logic as opposed to using the PID UMin. Otherwise if the PID is made public to the front end, the user will never see this value drop to 0, even if the control output is at 0. UMax UMax is the maximum possible output of a PID controller. In most applications (valve and damper actuators) this will be set to 100%. In the case of a cascade control supply air setpoint PID, it might be set to 90°F. StrokeTime The name Stroke Time refers to the manufacturer specified stroke time of a physical actuator. By setting the PID to the same stroke time as the valve it is controlling, it is guaranteed not to “wind up” faster than it is possible for the valve to react. Whenever possible, set the stroke time to match the physical stroke time of the actuator it is controlling. However, stroke time can be thought of in another way. It is used to calculate DuMax, the maximum rate of change of the controller output during one Control Interval. In the case of a chilled water valve that modulates between 0% and 100% with a Control Interval of 20 seconds, see how a stroke time of 180 seconds affects the DuMax: A stroke time of 0 seconds will not limit the rate of change at all in the controller. Based on the error and the Gain, it could potentially jump the full 100% stroke at once. By setting the stroke time to 180 seconds, the amount that the control signal can move every 20 seconds is now limited to 11.11%. It is not proper practice to employ stroke time as a tuning mechanism of a PID. It should be set prior to and independent from the tuning process.   Output of a PIDA Block The output of a PIDA block will usually control a hardware output from a Xenta controller. Because of this, it is typically connected to a Menta Simple Block “AO.” In Function Block it may be output to an analog value or hardware output.   Output of a PIDI Block A PIDI controls a floating actuator using two Simple Block “DOPU” digital pulse outputs. The PIDI will output a value between -1 and 1, which the DOPU block converts into the appropriate pulse lengths. Inverting the decrease signal will pulse the actuator closed when the output of the PIDI is negative.   The downside to PIDI control is that there is no percentage value to report to the front end about the position of the actuator. This is why use of the PIDI is somewhat rare. The same control can be accomplished using a PIDA with some external logic to pulse the floating actuator open and closed. Using a “virtual feedback” signal to mathematically monitor the assumed position of the floating actuator allows the end-user to view a percentage open signal for the actuator. It also allows them to override the Not-Connected AO to a certain position and have the floating actuator travel to that position just as an analog output would. The following example converts a Not-Connected AO from a PIDA into pulse output DOs from the controller. Public Signals and Public Constants All of the parameters that go into the operation of a PID need to be considered when tuning its operation. Eventually, one will come to the question of what parameters need to be made available from the front end. While some thoughts might end up on the well-meaning, under-trained end-user who could potentially wreak havoc by adjusting values, it is more important to consider the startup technician. If a value is not public from the front end, then a download must be performed to make any changes to any values. By making every parameters public by default (and only selectively removing certain parameters during exceptions) less time will be spent in the field during start up. After the PIDs have been tuned, it is always possible to remove certain values from being public. The exceptions are UMin and UMax, which when controlling a valve or a damper are almost always 0% and 100%. If desired, these can usually be hard-coded into the PID with little consideration. However, they can also be made available from the front end with little or no ill effects. Floating, PID, or Cascade Control There are three main control loop algorithms to consider when programming. Which one best suits the application is really a factor of the control loop speed. Consider the three options: Floating Floating control (also called bump control) involves making small, measured adjustments to the control signal on specified intervals. This is usually the best option any time a variable speed drive is involved. This is because these drives typically control supply fan static pressure or hot/cold water pump differential pressure. Both of these are very fast control loops. A slight change in the speed of the drive results in an almost instantaneous change in the measured variable. Floating control reacts more gradually to these quick changes. It compares the measured variable to the setpoint, and if it is too high, it bumps the control signal down a little bit. If the measured variable is too low, it bumps the control signal up a little bit. PIDs can (and often have been) used successfully to control very fast control loops. However, they are typically tuned to closely resemble floating control – low Control Interval, very little proportional control, very high integral control. In the end, it may be easier for a technician to understand and adjust “1% every 5 seconds” than “a Gain of 125 and an integral time of 175 seconds.” The other advantage to floating control is its adaptability. When tuning a PID, it is tuned to one exact set of circumstances – a certain load on the building, a certain volume of piping, etc. If enough of those conditions change by enough, the PID can be sent into oscillations. Floating control will not be affected by these changes. Consider a PID tuned to control a chilled water pump, which maintains differential pressure during the winter when loads are low. During the summer, a manual valve is opened to provide cooling to the athletics storage shed that was unoccupied all winter. This will increase both the demand for cooling and the volume of the pipe. This could potentially render the PID useless. However, a floating control will not react any differently. It will simply increase and decrease the speed as needed. See an example of floating control: The downside to floating control is that there is no proportional control. It will not take a bigger step size when the error is high. To combat this, and especially to aid during startup of equipment, this floating control macro utilizes two different step sizes – one for when error is low, and one for when error is high. By setting the threshold sufficiently high, this will cause more rapid acceleration during startup, and then quickly revert back to normal control during normal operation. This same code will also work relatively well for any size or nature of supply fan or supply pump. Minor adjustment of the parameters may be needed, but it will give a very decent starting point. PID PID control is for control loops of moderate speed. It can be thought of as the "valves and dampers" control method. A chilled water valve modulating to control supply air temperature or a damper modulating to control outside air flow are two examples of when PID control is appropriate. It is a source of debate whether PID control is appropriate in different situations. Some attest that a PID loop can be tuned to accurately control in any situation, including those where this document recommends either floating or cascade control. While this is certainly true, just because a PID can be used, does not mean that it is always the most appropriate solution, or that it will continue to work even as conditions change. Cascade Control Cascade control is used in very slow control loops. It is called cascade because two PIDs are used in a cascading arrangement – the output of the first is the setpoint of the second. An example of when to use cascade control is to modulate a chilled water valve to maintain the space temperature in a very large gym or auditorium. A small change in the chilled water valve position could take a very long time to have an effect at the sensor. If a regular PID is used, it is likely that the PID will wind up all the way to 100% output before the sensor ever experiences the first adjustment's effect. Then it will stay at 100% until it over-cools the space and starts decreasing the call for cooling. The same thing will happen on the reverse side as it modulates all the way to 0% and under-cools the space. And the cycle will continue indefinitely. In this cascade configuration, the supply air temperature setpoint is modulated based on the room temperature and setpoint. The chilled water valve PID then maintains the supply temperature. This will allow control that is more accurate and prevent the oscillation sometimes seen by inappropriate use of a single PID.   Putting It Into Practice There are college courses devoted entirely to the subject of PID control. The subjects covered in this document have barely scratched the surface of the topic. The intent is to give the average Menta/Function Block programmer and field technician the information needed to get a system up and running in as little time as possible with the most satisfied customer possible. Understanding when and why to use PID control will increase accuracy and efficiency of control loops and decrease wasteful overshoot, hunting, and oscillation. Tuning efforts will also be accelerated when the default parameters only require minor tweaking instead of calculation and trial and error. Using the hints and tips suggested will allow not only for proper programming techniques, but also for creation of macro libraries that can be reused and shared to improve effectiveness across business units.

Issue Unable to log into Workstation because the user password is unknown. Product Line EcoStruxure Building Operation Environment Building Operation Workstation Building Operation Automation Server (AS, AS-P, or AS-B) Building Operation Enterprise Server Building Operation Enterprise Central Building Operation Project Configuration Tool (PCT) Cause The password for an Automation server or Enterprise server/Central has been forgotten. Resolution IMPORTANT: The session ID is unique for this session of WorkStation. You cannot close WorkStation until the password has been reset. If you close WorkStation, before the password has been reset, a new session ID is generated that cannot be used with the temporary password provided by your local Schneider Electric Buildings support team.       The following are the steps to populate the session ID, which is required for doing the password reset.   For servers with EBO older than V3.1.X In the WorkStation logon page, while holding the shift key, left-click the area near the EcoStruxure Building Operations Icon.   This will populate the Session ID. Copy the Session ID.   For servers with EBO V3.1.X:   In Device Administrator, select the server you need to perform the reset to. Check the box and click the hyperlink   From the top bar select Password Reset Select OK when you get the “Password reset token created” pop-up Now, on the WorkStation logon page, while holding the shift key, left-click the area near the EcoStruxure Building Operations Icon. This will populate the Session ID. Click the Copy button.    For servers with EBO V3.2.X and higher In Device Administrator, select the server you need to perform the reset to From the top bar, select the “Edit Connection Password/Reset password” and press OK Now, on the WorkStation logon page, while holding the shift key, left-click the area near the EcoStruxure Building Operations Icon. This will populate the Session ID. Click the Copy button.   NOTE (for servers with EBO V3.1.X and higher)  For the Automation Server password reset, ensure that the Automation Server is connected to your PC machine via a USB cable. For the Enterprise server and Enterprise Central password reset, add the server to the Device Administrator using the “Add Server” button on the top bar. Please note even if you enter the wrong password, the Server would still be added to the Device Administrator.     After having the Session ID:   Send the Session ID to your local Schneider Electric Buildings support team Once PSS provides you with the unlock key In WorkStation, ensure that the Session ID is still visible, enter: User Name: admin Password: paste the result from the webpage Domain: Local and click Log On This will pop-up the Change-Password form Fill in the “old password” field with the unlock Key Put in a new password you want to use and then enter the new password in again. Click OK   NOTE:  When attempting to reset the password and unlock with the sessionid/temp password, you receive the error: "Your account has insufficient permission to use the system. Contact your administrator. "  Open a case with your local Product Support group and submit a request to unlock the user.   NOTE: WebHelp article 6749   The following video shows the password reset procedure for EBO older than V3.1.X. It covers most of the important steps for newer versions. Quick-Help video    

Issue When a card is presented at the Smart Reader it beeps but no card data is sent through to the Security Expert Controller. The Reader LED is flashing red then green every second continuously. Product Line EcoStruxure Security Expert Environment Security Expert Smart Card Readers which support both 125Khz and 13.56Mhz (SX-DRD-xx, SX-DRK-xx, SX-RK-xx) Cause The Smart Card Reader is not able to communicate with the Controller as it is in RS-485 mode but the connection being used is Weigand. Once connecting to the the Smart Reader in RS-485 mode the reader will not communicate if it is then connected up to a Wiegand port. Resolution Once a Security Expert Smart Card Reader is used in an RS-485 configuration it will not work in Wiegand configuration until it has been re-programmed with a configuration card designed for that purpose. The configuration card  (SX-ISO-CONFIG) must be purchased through Schneider Electric. See the Security Expert Credentials Order Form for details.   This is because RS-485 is a two-way communication, intelligent wiring protocol. Once the reader is set in this two-way communication mode there is currently no way, without the configuration card, to go back to a less intelligent one-way mode like Wiegand.   Note: Readers manufactured in 2017 or before may have a firmware version that uses a configuration mode that will not respond to a configuration card. If you contact Schneider Electric for a configuration card, supply the serial number (SN) from the back of the reader on your request.

Issue Cannot change the IP address or host a SpaceLogic IP device, MP or RP controllers, or IP-IO modules in a second EBO Server. Product Line EcoStruxure Building Operation Environment IP address BACnet Building Operation Multi-purpose Controller Building Operation Multi-purpose VAV Building Operation Room Controller  Building Operation IP-IO Building Commission Application Cause 1. IP settings are saved (eg in Building Commission), but the IP address of the Controller does not change. (Option to change most settings is grayed out from Building Commission for hosted SpaceLogic IP devices) 2. The Controller is already hosted by an EBO server and cannot be hosted by a second EBO server, thus data objects cannot be read. 3. Rehosting an SpaceLogic IP device to a different EBO server Resolution 1. Changing the IP address "settings" can be done with Building Commission application, formely know as eCommission Tool, in some earlier versions but if the SpaceLogic IP device, formely known as SmartX IP device, is already fully hosted by an EBO Server, then a warm start from the Building Commission is inhibited. (Option to change most settings is grayed out from Building Commission for hosted SpaceLogic IP devices) Without the hosting Server initiated warm start the new IP setting will not be used. If the SpaceLogic IP device is not hosted then the IP address can be changed from the Building Commission, using the warm start option. Notes A local warm start initiated at the SpaceLogic IP device(manually with the reset button) will not force the SpaceLogic IP device to use these new settings. See BACnet/IP Controller Commissioning Scenarios The IP address of a Hosted SpaceLogic IP device cannot be modified from eCommission Tool A factory reset will force the SpaceLogic IP device to return to AutoIP and DHCP, the BACnet Id will generally be retained see Automatic Association after a Factory Reset in a BACnet Controller or IO Module 2. When a SpaceLogic IP device is fully hosted by an EBO Server, it can be BACnet hosted by a second EBO Server, but this will only contain the standard BACnet Applications folder. This hosted BACnet Device needs to be manually created using the SpaceLogic IP device instance Id.  Below, it can be seen that the fully hosted SpaceLogic IP device and the BACnet only hosting under ASP_22   3. When a SpaceLogic IP device is configured or programmed via the hosting EBO Serving using WorkStation, some of the objects (eg. Scripts or Function Block) data is not fully contained within the SpaceLogic IP device. Thus if the hosting EBO server is changed, some of the configuration data will be lost and a simple upload to the new hosting EBO Server will not upload all the data required to recreated these objects. In such a case, an export from the original hosting EBO Server should be imported into the new hosting EBO Server to ensure no data is lost.

Issue Temperature Sensor Resistance Charts Product Line Andover Continuum, EcoStruxure Building Operation, Field Devices, Satchwell MicroNet, Satchwell Sigma, TAC IA Series, TAC INET, TAC Vista Environment Temperature Sensors Cause Temperature (°C) to Resistance Charts (ohms). Upgrading the site BMS, but retaining the existing sensors and the sensor resistance values are not known. Resolution The resistance of a sensor at a specific temperature can be downloaded below, there are a number of tables collated from different sources for a number of Schneider Electric sensors and other BMS suppliers.   In EBO, the thermistor selection in the IO module or controller does not represent the thermistor bead type, an example is the Continuum Type I in EBO, but the bead is a Type 3,. For further information regarding this see the KB article  Thermistor type selection in EBO.   The document All Sensors covers the following:   Satchwell DxT sensors are replaced by STR600, STP660, STD600, STO600 type T with shunt, and use the Satchwell T range chart Drayton DC1000, DC1100 30K6A1 is now known as STR600D, STP600D, STO600D Andover 10K4A1 TAC Inc. Vista 1.8KA1 I/A series 10K3A1 with 11K shunt INET 10K2A1 (10k Dale) BALCO 1000 ohm RTD   Older Satchwell ranges: Satchwell DW1204, DW1305, DWS1202 Satchwell DO Satchwell DD/DR Other manufacturers included: Allerton 3K3A1 Ambiflex 2012, Honeywell Aquatrol, Jel/Thorn, Trend, York 10K3A1 Schlumberger (air) 5K3A1 Schlumberger (immersion) 100K6A1 Automatrix, York, Sibe 10K4A1 Honeywell 20K6A Landis & Gyr PT100A, PT1000A   Further information regarding INET, IA, the document Thermistor Types Tables (Veris Industries) is available.  The 1k Balco resistance chart is also available.   Further information for the Continuum ACC Temp 10K Type 3 also known as 10K4A1, the document Thermistor Temp Resist Chart (Precon Thermistors) is available.   TC900 series TC900 RS-03 sensor chart   For I/A Series Controllers (MNL/MNB) Compatible sensors that have a built-in 11k shunt resistor include the TS-5711-850 TS-57011-850 TS-57031-850 TSMN-90110-850 Series Any sensor that matches resistance to temperature curve for a 10K Thermistor Type G (U.S. Sensor), Type 9 (Dale/Vishay) or Type III (ACI Series AH) can be used with the I/A Series MNL and I/A Series MNB series controllers, provided that a 11k ± 0.1% 1/8 watt resistor is wired in parallel with the sensor. The input has a range of -10 to 135 °F (-23.3 to 57.2 °C) with an accuracy of ±1% of span. Temperature / Resistance Reference Values Temperature Deg F (Deg C) Resistance Resistance Incl. 11k Shunt 32 (0) 25490 8,012 68 (20) 12,260 5,798 75 (25) 10,000 5,238 104 (40) 5,592 3,707 140 (60) 2,760 2,206 The full temperature/resistance table for the US Sensor 10K Thermistor R-T Curve Type G sensor. Please note that the controller may not be able to use the full temperature range shown in the table.  

Issue TGML Graphic worked without error in EcoStruxure Building Operation 2.0 WebStation. After an upgrade to 3.0, WebStation displays one of the following errors on page load: Script error in DocumentLoadEvent (Component_Name) Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' blob: 'unsafe-inline'". Do you want to continue running this script? This site says... Script error in DocumentLoadEvent (Component_Name) Blocked by Content Security Policy Do you want to continue running this script? Script error in DocumentLoadEvent (Component_Name) call to eval() blocked by CSP Do you want to continue running this script? Product Line EcoStruxure Building Operation Environment Building Operation 3.0 TGML Graphics Cause A new security setting in 3.0 disallows eval() statements by default in TGML JavaScripts presented in WebStation. An eval() statement executes a string of characters as code, which can open security vulnerabilities if enabled, something akin to a SQL injection or cross-site scripting attack. If graphics were created in earlier versions and relied on eval() to execute dynamic code, the user will be notified upon opening the graphic in 3.0 WebStation. Resolution Any graphics relying on eval() to execute dynamic code should have their JavaScript functions rewritten to avoid use of eval(). This is the preferred approach with respect to cyber-security. Work-Around It is possible, but not recommended, to disable the new security check in WebStation TGML graphics. Within WorkStation open the Control Panel Go to Security Settings Check the box for "Enable WebStation to use unsafe string evaluated JavaScript methods like 'eval' For more information, see Web Help article: Enabling WebStation to Use Unsafe JavaScript Methods. For the latest solution to this issue please refer to: Cannot Open Graphics in WebStation 

Issue Cannot find documentation on how to use the new Graphic components release with EBO 2.0 Getting the following errors when previewing my graphic page: "Script error in function "onLoad" .... ReferenceError: "_firstRun" is not defined "Script error in function "onChange" ... ReferenceError: "_setVisuals" is not defined The component added to the graphic shows no binding label in the WorkStations edit bindings window Product Line EcoStruxure Building Operation. Environment Building Operation Graphic Editor 2.0 and above GlobalScripts V2.0.0262 and above Cause With the release of EBO 2.0, a set of new components/snippets have been released, which are different from those issued in earlier releases, although there is very little change visually. The scripting, in most cases but not all, has been removed from the components themselves and put into single scripts. This means we can take advantage of the functionality of the global script. This requires the user to set the UseGlobalScripts attribute to True within the TGML graphic editor, which can be on a per-graphic basis and ensures that existing graphics will still function. Once turned to True, all components with scripts and requirements for other global scripts to function correctly can function as designed. For example, the setpoint box requires global scripts to ensure units and decimal places are displayed as designed/required due to the scripts. There are also two binds available on the box, one for reading and one for writing. Both need to be bound to enable the component to function correctly.  The components are designed this way to allow use in BACnet, where it may require reading the resultant Value but Writing at a specific Priority. Without the scripts added to the graphic, the component cannot function. For further details/questions, refer to the following Community Posts, which also include the current PDF documentation: Help-with-an-EBO-2-0-component EcoStruxure-Building-Operation/Graphic-Component-Library-Rev-AB1-002-pdf NAM Standards Team TGML Component Library - Communities (se.com) This article provides the necessary steps required to enable and get these new components working and does not provide in-depth functionality. Resolution Within Graphics Editor, enable UseGlobalScripts. To do this: Select the -Tgml object shown in the Objects pane In the Properties pane Change the UseGlobalScripts from False to True In the Global Graphic Snippets: Drag the GlobalScripts V2.0.xxxx onto the -Tgml object.  GlobalScripts then appends as shown below. Note: This must be done before adding any components and ONLY once on each Graphic page. Add a Component by dragging it into the Design window. Example showing the Component: Analogue Single Line Text, 100W Add Snippets to allow the relevant Bindings to be added to this component.  To do this: Select the Snippets tab, Select Select Global Bind Snippets Drag the appropriate snippet onto the Component. EcoStruxure Analog Value bind snippet is added to the Analogue Value component Save the graphic Preview - no errors should appear.  If there are errors: Ensure that the scripts/components have been added in the correct order Ensure the correct Snippet has been added to the correct Component.  Refer to the Graphic-Component-Library-Rev-AB1-002-pdf documentation for the tested snippets/component combinations. Open WorkStation and Edit Bindings on the saved graphic page Note: The default binding name displayed View the graphic page   Example: Showing forced value      

Issue When PC based firewall's are used, some configuration in the license system and in the firewall are required to be made. In some cases, the error below when logging into Workstation appears: License server machine is down or not responding (Error code -15 or -96) Product Line EcoStruxure Building Operation Environment Building Operation Workstation Cause The TAC license (taclic) vendor daemon by default uses a random port each time it's started. This setting makes it difficult to handle in a firewall. Also the various EcoStruxure programs using the license system needs to be allowed in the firewall, as well as the ports used by the license system. Here is a simple explanation of how the license request from a client is made. Resolution Make sure there is a valid license installed on the license server. For more information read Requested license not available for Enterprise Server, Workstation or editors The easiest way to configure Windows firewall, is to run the SBO Firewall Config tool on all PC's having EcoStruxure software installed. For any questions regarding the use of this tool please contact the developer, details in the tool. In order to manually make the configuration follow the steps below. For more information on how to create Windows firewall rules, read Creating Inbound and Outbound Windows Firewall Rules.   On the server PC Make the port used by the vendor daemon fixed. Follow Define the port used by the taclic vendor daemon guide to do that. On the PC having the license server installed, open the following TCP ports in the firewall both inbound and outbound.  80 443 4444 2170 27000 through 27009 (If a user defined defined port has been used other than 2170 for the vendor daemon then use that instead of 2170)   On the client PC On the PC having EcoStruxure software installed using the license server on a remote PC, make these exceptions in the firewall: Allow ports TCP 80, 443, 4444, 2170 and TCP 27000 through 27009 both inbound and outbound. (If you defined a port other than 2170 for the vendor daemon then use that instead of 2170) Allow the following programs: SE.Graphics.Editor.exe SE.SBO.Script.Editor.Proxy.exe SE.SBO.ScriptEditor.exe SE.SBO.WorkStation.exe SE.WorkStation.IA.WptEd.exe tam32.exe They are typically located here: On 32 bit OS: C:\Program Files\Schneider Electric StruxureWare\Building Operation 1.X\WorkStation On 64 bit OS: C:\Program Files (x86)\Schneider Electric StruxureWare\Building Operation 1.X\WorkStation

Issue The process of acquiring a license Entitlement ID and how to activate, release and/or transfer a license in EcoStruxure Building Operation Product Line EcoStruxure Building Operation Environment Building Operation License Administrator Building Operation Enterprise Server Building Operation WorkStation Cause There are two different ways to activate a license and different types of licenses that can be purchased. Resolution This article discusses Building Operation Software licenses applied to software platforms such as EC, ES, and Workstation. For details on applying licenses on SmartX Server devices, refer to the Automation Server Licensing Workflow Webhelp topic and/or the Offline activation of embedded licenses Knowledge Base article.   Purchasing a License The licenses that can be purchased are listed in the Part Number Summary. After an order is placed, you will receive an email with an Entitlement ID certificate attached. For further details, see the Order Information Request Webhelp topic.   Evaluation Licenses Evaluation licenses are used for demonstration purposes, training, or site engineering. The evaluation license is a file that can be downloaded from the Exchange and is valid for up to 3 months. Refer to the Activating an EcoStruxure Building Operation Demo License webhelp topic for the activation process.   Activating an Entitlement ID Entitlements can be activated online or offline; however, the online method is far simpler and is preferred. The online method requires the computer that the License Administrator resides on have an internet connection. Online Activation If the computer that the License Administrator is installed on has an internet connection, then refer to the Activating EcoStruxure Building Operation Software Licenses Webhelp topic for the activation process. Offline Activation If the computer that the License Administrator is installed on does not have an internet connection and one can not be temporarily arranged, then refer to the License activation or repair without Internet access Knowledge base article. Once a license file or Entitlement ID has been activated, and the Status reads "Valid" in the License Administrator, the activation process has been completed. The license does not need to be re-hosted after an upgrade and will remain on the computer if the Building Operation Software is uninstalled and reinstalled. To check the status of the license server and licenses that have been activated on the local machine, the Flexnet License Administrator can be accessed by navigating to localhost:8888 in a web browser. The licensing system is the same as used in TAC Vista, which can be seen in License troubleshooting in Vista 5.1.8 or greater.   Returning an Entitlement ID License If the computer on which the License Administrator is being replaced, or it has major operating system changes. In that case, licenses may become invalid and should be returned before those changes. Entitlements can be returned online or offline; however, the online method is far simpler and is preferred. The online method requires the computer that the License Administrator resides on have an internet connection. Online License Return If the computer that the License Administrator is installed on has an internet connection, then refer to the Returning an EcoStruxure Building Operation Software License Webhelp topic for the return process. Offline License return If the computer that the License Administrator is installed on does not have an internet connection and one can not be temporarily arranged, then refer to the License activation or repair without Internet access Knowledge base article. Transferring an Entitlement ID License There is no separate process when transferring a license from one system to another.  Simply return the License from the current system as indicated above and then check that the available seat count has increased by one via the original Entitlement ID. Once returned, activate this same License on the new system as detailed earlier.   Note: Releasing and reactivating licenses can only be carried out a finite number of times per year (4 license returns each year) to prevent misuse of the licensing system.

Issue The binding between an Enterprise Server and Automation Server or between two Automation Servers shows Unresolved Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Building Operation Automation Server Binding Diagnostics Cause The communication between the two servers is incorrectly configured, blocked by software such as firewalls or antivirus or another application is using the port. Resolution For Firewall Issues: Ensure the Windows firewall on the Enterprise Server PC is set up correctly, for example follow Creating Windows Firewall rules to allow Building Operation to communicate on the TCP port to set up inbound and outbound rules.   Alternatively configure the Windows firewall using the Firewall Config tool on all PC's having EcoStruxure software installed. Problems with firewall settings can arise if the Enterprise Server PC is removed during the commissioning process and the firewall settings swap between Private Networks and Public Networks. For example All the Automation Servers may appear online, but the "Unresolved" bindings issue may be seen. Automation Servers cannot be restored via the Enterprise Server If a suitable option temporarily disable the firewall to see if it fixes the issue.   For 1.4 or 1.5 Servers with a name containing the "&" symbol: Ask Product Support for Hotfix R1.4.1.16201 (or later version) for version 1.4 and R1.5.0.1601 (or later version) for version 1.5.    For other Causes: Follow these troubleshooting steps in order until the issue has been resolved. Check that the ES IP address is the same as the PC IP address.  If they do not match, follow How to set the Enterprise Server IP address to change the ES IP.  All ports must be open between the ES and AS, for port numbers search "Network Ports" in the Information Technology System Planning Guide. If the address of the ES is a domain name, try using the IP address instead. If there are more than one network adaptor on the ES can, for example, take the address of a wireless adaptor, VMware virtual adaptor or VirtualBox adaptor.  The ES should be using the NIC adaptor, either follow the link in item 1 or disable the other network adaptors. Right click on the ES and select Advanced > Repair Server Communication.  This should update the Communication tables of the servers. Detach the automation servers from the ES and then add the automation servers back.  Follow Unable to add an Automation Server underneath an Enterprise Server. Select each server and click on the Communication Tab.  If communication is valid, it should list the details of every other server. Try to disable any network monitor function of anti-virus software on the computer. If a Schneider laptop is used, right click the Trellix software in the system tray and Enable Firewall Timed Groups. Although not a supported architecture if a user installs the Enterprise Central and Enterprise Server on the same PC with default settings the ports will conflict.  Either remove the unsupported Enterprise Central or if for testing stop the service and set appropriate usable ports.    

Issue Even though Windows Server 2008 R2 is exclusively a 64-bit operating system, 32-bit applications are supported by enabling the WoW64 optional feature. NOTE: These are general instructions for utilizing the WoW64 function. Not all Schneider Software will be able to run in an emulated environment. If uncertain, please check with Product Support Services to ensure proper installation. Product Line Andover Continuum, Field Devices, Other, Satchwell MicroNet, Satchwell Sigma, TAC INET, TAC Vista Environment Windows Server 2008 R2 WoW64 feature. All 64bit OS Cause If the WoW64 feature is not enabled and you try to run a 32-bit application, the application will fail to execute. WoW64 option in in undesired state. Resolution If the WoW64 feature is not enabled and you try to run a 32-bit application, the application will fail to execute. The WoW64 execution layer is an optional component that is installed by default on R2 releases. You can save resources by removing the feature if you are not going to be running 32-bit applications on your Server Core install. Install the WoW64 Execution Layer using the following command: dism /online /enable-feature /featurename:ServerCore-WOW64 If your solution has a .NET 32-bit dependency, then also invoke the following sequence: dism /online /enable-feature /featurename:NetFx2-ServerCore dism /online /enable-feature /featurename:NetFx2-ServerCore-WOW64 Note: In Windows Server 2008 R2 RC1, WoW64 is enabled by default. If you don't want WoW64 enabled, just disable the feature as follows:  dism /online /disable-feature /featurename:ServerCore-WOW64

Issue What specification should BACnet MS/TP cable meet? Product Line Andover Continuum, EcoStruxure Building Operation Environment MS/TP BACnet devices Cause Often an incorrect cable type is used when wiring MS/TP devices causing unreliable communications. Resolution The BACnet Controller Technical Reference defines the following cable specification for a MS/TP cable: RS-485 Cable Specifications: Cables used to form the RS-485 network should conform to the following specifications: Wire Size: 22-24 AWG Cable Type: Twisted-pair, copper wire, tinned Shield: Braid Nominal Impedance: 100-120 Ohms Velocity of propagation: 78% Capacitance: <12.5 pF/ft (~ 41pF/M) between conductors and < 22 pF/ft (~72pF/M) between the conductor connected to ground and the next conductor. An example of a cable that meets this specification is Belden 3105A. Also check out the SmartStruxure-RS485-Network Installation Quick-Help video on the Exchange.

Issue Trouble synchronizing the time of the Automation Server or Enterprise Server to a NTP server or between each other Product Line EcoStruxure Building Operation Environment EcoStruxure Building Operation Enterprise Server EcoStruxure Building Operation Automation Server Cause The Enterprise Server and the Automation Server (ASP/ASB) do not synchronize time to each other, they must use an NTP server for synchronization Resolution The information below is mainly concerned with synchronizing the time setting but not the actual time.   Overview To synchronize the server times an NTP Server will be required, they do not synchronize time with each other. A common misconception is that the Automation Servers sync time with the Enterprise Server via server-to-server communications. To find an external NTP server consult support.ntp.org . Alternatively, an existing internal NTP server can be used or consult Setting up a Local / Internal NTP Server to configure the Enterprise Server computer as a time server The time settings on the Enterprise Server are configured through the operating system settings on the computer where Enterprise Central is installed.  EcoStruxure Building Operation cannot be used to configure the NTP server for the Enterprise Server. Please refer to Network Time on WorkStation, Enterprise Server, and Enterprise Central To find the Network Time Protocol (NTP) configured on a WorkStation, Enterprise Server, or Enterprise Central computer open a command prompt and enter w32tm /query /peers. If configured the peer NTP server(s) will be listed If you need to ensure an NTP server is actually running on certain IP or DNS address, please reference Ensure IP or DNS address is valid NTP server The time settings on the Automation Servers can only be configured via the Workstation. As per the image they can be configured to look at an NTP server (1) or set manually (2). For synchronization, they must use an NTP Server. Please refer to  Network Time Server on an Automation Server on Webhelp Starting in version 1.5, the time adjustment depends on how much the Automation Server drifts from the NTP server. The faster the Automation Server drifts, the more frequently the time is updated.  Please refer to How often will an Automation Server ask the NTP server for the time?  If the time server is a URL, such as time.nist.gov, then it is critical that a Primary DNS is set for each Automation Server, and possibly a Secondary DNS via Device Administrator. Without a DNS, the Automation Server will be unable to resolve the URL to an IP address. Please refer to Configuring the Automation Server IP Address on Webhelp The time displayed for a server in Workstation (Properties -> Basic) will reflect the time zone of the local computer that Workstation is installed on. All events and alarms will be automatically modified to match the time of the workstation that was used to log into the server. The "Server time" will represent the date and time of the server adjusted to client local time zone, while the fields below "Server time" represent the settings of the Automation Server.   How to synchronize date and time settings on multiple Automation Servers   IMPORTANT: Only the time settings are synchronized via the Lead/Shadow configuration, the time itself IS NOT synchronized via the Lead/Shadow but rather by all servers synchronizing with the configured timer server.   The synchronizing of multiple Automation servers can be achieved with a lead/shadow relationship. The primary and secondary network time server settings for connected shadow Automation servers are defined on the Enterprise server. Setting up the Primary and secondary time servers in the Enterprise Server only passes those configuration settings to the AS controllers, it does not send the actual time and date value.   Select the Enterprise server (1), click the Date & Time tab (2), select Enable (3) and enter the Primary time server (4) and, if used, the Secondary time server (5) the Automations Servers will use. Ensutre the time zone for the Enterprise Server is set correctly (6).   Save the settings  From EBO version 2.0 all Automations Servers are automatically configured to shadow the date and time settings configured in the Enterprise Server. To verify this expand the System folder of an Automation Server and select Time Settings -> Date and Time (1). Observe the Date and Time are Shadow-Read only (2), replicating the Enterprise Server settings. Attempting to change any of the settings, other than the Lead object (3), will result in an error. All the Automation Servers will be 'looking' to the same Primary (4) and Secondary time servers, i.e. they will all receive the same time and be synchronized Similarly, select the Time Zone (1) of the Automation Server in the System Tree; this will also be shadow-read only (2). The lead object is set to the Time Zone on the Enterprise Server (3) Before EBO version 2.0 the Automation Servers were not automatically set to shadow the Enterprise Server settings but this could easily be achieved en masse using Search . In the Search box in the top right corner of the Workstation, type "Date and Time" and click Search (1) to find the date and time object of all connected servers. In the Search view select the servers (2) that require their Date and Time settings synchronized to the Enterprise Server, the Enterprise Server does not need selecting. Select the Time tab (3) and then click the triple dots (4) to navigate to and select the Date and Time object on the Enterprise Server (5)   You may need to stop and start the Enterprise server to get the configuration settings to pass down to the shadow Automation servers Note: To set up synchronization of the time zone settings follow the above search steps for date and time but search on Time Zone Tip/Tricks To see the time of on the Enterprise Server and multiple Automation Servers use the Search to find the Date and Time object (1). Individually select each server (2) and then drag the Date and Time object (3) into the Watch Window (4) It is the Automation Server that initiates the synchronization. To check the Automation Server communication settings select the Automation Server (1) and in the Communication tab (2) select the Enterprise Server (3) and make sure the Automation Server has the correct IP address (4) To check the Enterprise Server communication settings select the Enterprise Server (1) and in the Communication tab (2) select each Automation Server (3) and make sure the correct IP address is specified for each Automation Server (4).  If a firewall exists ensure that the ports are open so the Automation Server can connect to the Enterprise Server. Please search for the EcoStruxure Building Operation IT Reference Guide on Exchange for details Further Information Release 1.2.0 and higher Until the time is set, b3 data will not update in the Watch Window Until the time is set, BACnet COV will not be functional Automation Server time does not synchronize directly with the Enterprise Server. Instead, all servers can synchronize to the same accessible time server To adjust the Automation Server time, time zone, and DST, access to the Automation Server is through a WorkStation

Issue When logging into Workstation one of the following error codes is given.  Invalid returned data from license server system. (Error code: -12) Cannot connect to license server system. (Error code: -15) License server system does not support this feature (Error code: -18) The desired vendor daemon is down. (Error code: -97) Product Line EcoStruxure Building Operation Environment Workstation License Server Cause These type of issues are contributed to the License Server, Vender Daemon being down or not having a valid license for the application which is used. Here is a complete list of error codes Resolution If Workstation is installed on a different PC than the license server, refer to SmartStruxure Workstation or editors can't get license when using firewall (errors -15 or -96). If you get license error -18 refer to Error "Requested license is not available on the license Server" even though the license for the StruxureWare Building Operation is valid. Start by working through the troubleshooting steps below. In some cases the Building Operation License Server was unable to start due to antivirus programs on the computer.    Cannot connect to FlexNet License Admin Using your internet browser and go to localhost:8888. If you are unable to connect to this address then the License Server is not running.  Ensure that the Building Operation X.X License Server is running as a service. Right Click on the Computer icon on the desktop and click on manage. In the system tree on the left, go to Services and Applications > Services.  Scroll through the list and select Building Operation X.X License Server. Click start in the top left corner of the window. Some times the following Windows Error 1067 is given when trying to start the License Server. Note: In the past this error has been caused by antivirus software on the computer. In this situation the antivirus program had to be uninstalled in order to allow the License Server to start.    If the Building Operation License Server will not start then it may be due to another program using TCP port 8888. Use TCPView to search for programs running on local port 8888 and stop the other program.      Vendor Daemon is Down Note: If working with a 32 bit PC, replace "Program Files (x86)" with "Program Files" in the file paths below. Using your internet browser go to the address localhost:8888. Click on Administration in the top right corner of the screen and login with admin/admin (If logging in for the first time it will prompt you to change the password.  Click on the Vendor Daemon Configuration tab and then select the taclic daemon.  Verify that the path in the License File or Directory field matches the location of the taclic.lic file. The first half of the file path is C:\Program Files (x86)\Schneider Electric StruxureWare\Building Operation X.X\License Server\ followed by what is in the License File or Directory field. Verify that the taclic.exe is located in the path found in the Vendor Daemon Location field. The first half of the file path is C:\Program Files (x86)\Schneider Electric StruxureWare\Building Operation X.X\License Server\ followed by what is in the Vendor Daemon Location field. If changes were made then click Save and then Start.    Vendor Daemon is Down issue caused by ipv6 Cases have been seen where having ipv6 enabled on the same computer where the license server is running causes the Daemon is down error. To confirm whether this is the issue ask the site if it is OK to disable ipv6 on the machine temporarily. In Windows control panel disable ipv6 Reboot the computer. In some cases, it might be needed to disable IPv6 completely in the registry: https://tweaks.com/windows/40099/how-to-properly-disable-ipv6/ If the issue is resolved then inquire with the site if it is OK to leave ipv6 disabled, the root cause of this is not fully understood yet and is under investigation by SE R&D

Issue Email notifications from 3rd party email account such as Gmail, Hotmail, Yahoo SMTP issues Event notification Product Line EcoStruxure Building Operation Environment StruxureWare Building Operation site with any of the following: AS, ES, Reports Server Cause Sending notifications to Gmail, Yahoo mail, Hotmail, or other outside email account. Wanting to use other SMTP than Schneider Electric E-mail Server: if wanting to setup an ES or AS to send email notifications with third party SMTP, an Exchange server using port 25 supports the notifications. In release 1.7.1 and earlier though Gmail, for example, suggests port 465 and 587, the workstations alarms that the email can not be sent since it cannot connect to email server. The problem is with the Gmail-account and often other 3rd party email providers both public and private, Google requires that you connect with SSL, which have been missing in the requirements and therefore these releases do not have this functionality. In release 1.8.1 and later, you can send emails not encrypted or encrypted using either the TSL or the SSL protocol. You can select one method for the primary email server and another method for the secondary email server. The Schneider Electric Email Server does not support encrypted emails. When logging on to the email server, the user is authenticated using an authentication protocol. If no user name is specified, no authentication protocol is specified. If a user name is specified, the SmartStruxure server tries to authorize the user using the CRAM-MD5 protocol. If the first authentication fails, the SmartStruxure server tries to authorize the user using the LOGIN protocol using the CRAM-MD5 protocol. Resolution In Email Notification put the 3rd party email address such as yourname@mailprovider.com. AS and ES will use the Schneider Electric SMTP server or the POP server of your choice to send the email notification. For multiple emails, check Multiple Email Addresses for Email Notifications or Alarm Recipients. Sometimes the mail is put in the Spam folder for the recipient. Check there and change settings to Not Spam. Installing a valid SSL certificate for the Enterprise Server to allow SSL operation is not planned in a future version. Currently, the default certificate does not identify the system and is not trusted, but nevertheless enables SSL operation. ESMTP (Extended) is not supported through current release. Base64 SMTP authentication is not supported. Wanting to use SMTP other than Schneider Electric E-mail Server: An Exchange server or SMTP server which supports POP and uses port 25 supports AS and ES Notifications. Other servers which would require the setting of Primary/Secondary E-mail server fails to login to SMTP Server require an encrypted (SSL/TLS) connection which is not supported in Struxureware Building Operation versions up to and including 1.7.1. A solution is to use an SMTP proxy on the ES or another computer on the network that will handle the TLS/SSL authentication. Release 1.8.1 and later support TLS and SSL for email authentication natively. Using SmtpProxy on an Enterprise Server SmtpProxy is a small freeware application that listens on a port you choose; the default port is 25. When SmtpProxy detects a connection on this port, it does the following: Connects to the SMTP server you configure (GMail / Microsoft Live Mail / any other SMTP server) Starts an encrypted connection with the SMTP server Returns the connection information to the ES After the initial connection is established, SmtpProxy acts as a middleman. Any SMTP data received from the ES is forwarded to the SMTP server and any data returned from the SMTP server is sent the ES. SmptProxy runs as a Windows service so it can be installed on a LAN server and used by multiple devices such as AS. Note that SmtpProxy does NOT login to the SMTP server but rather credentials are passed through from the ES or AS. Note: SmtpProxy is a third party application and therefore no support is provided by Schneider Electric. Installing SmtpProxy SMTPProxy can be downloaded from http://smtpproxy.codeplex.com/ The download is a Windows Installer (MSI) file that can be used to install SmtpProxy on any machine that supports the .NET Framework v4 – Client Profile. Configuring SMTPProxy for Gmail SmtpProxy is configured using a config file. A sample config file is installed with SmtpProxy, this is a plain text file that can be edited with Notepad. Create a copy of the sample config file and rename it to: On 32 bit machines: C:\Program Files\SmtpProxy\SmtpProxy.exe.config On 64 bit machines: C:\Program Files (x86)\SmtpProxy\SmtpProxy.exe.config The following items can be configured with SmtpProxy’s config file: SmtpProxy can write a log of all its activities. The default file to write the log file to is SmtpProxy.trace.log. SmtpProxy can log several different types of activities. You can control what is written to the log file by setting the log switches. By default, they are set to Off so nothing is written to the log file. Valid switch values are Off, Error, Warning, Info, and Verbose with each one providing more information than the last. Once you have SmtpProxy working, you should turn logging Off. The Url to the SMTP server. Default is smtp.live.com. The SMTP server port. Default is 587. The port to listen on. Default is 25. Scroll to the end of the config file and locate the section SmtpProxy.Properties.Settings section and find the string mail.live.com Edit this to smtp.gmail.com After modification, you must restart the Smtp Proxy service from the services control panel for the new settings to take effect. Configuring ES to use SmtpProxy Right click on the Server in the tree and select Properties then click the Email tab Select Primary/Secondary E-Mail Server Enter Sender E-mail (e.g. Mysite@gmail.com) Under Primary E-Mail Server Settings enter Host: localhost (or 127.0.0.1) Enter the users account information. User name: e.g. gmailaccountname@gmail.com Password: MyPassword Confirm: MyP

Issue License needs to be activated or repaired but there is no Internet access on the computer that the license is being hosted on. Product Line EcoStruxure Building Operation Environment Building Operation License Administrator  Cause There is an inability to move the computer to a location with Internet access, activate or repair the license, then move it  back to the site. In other situations the IT Department is so strict that they will not allow internet access on the computer just for licensing activation. Resolution SBO Offline Activation Tool There SBO Offline Activation tool posted on the Community outlines the step by step process to perform an offline license activation. It can be accessed here: SBO Offline Activation Tool. Click on "Instruction and Help" in the tool for the step by step process and other helpful videos/charts.  SBO Offline License Repair The same SBO Offline Activation tool used for activation can also be used to repair an offline license. Download the tool here: SBO Offline Activation Tool. After launching the offline tool, click on the "Special Operations" menu and click on Repair License.  If this does not repair the license, then please contact PSS for further troubleshooting assistance. 

Issue When the EWS is installed on the same machine using the service then all packets will be going to the localhost and will not hit the NIC so will not be captured in a Wireshark packet capture. Product Line EcoStruxure Building Operation, EcoStruxure Security Expert Environment Security Expert Building Operation Enterprise Server Building Operation Automation Servers (AS-P, AS-B) Cause Packets sent between services on the same machine (like SOAP and EWS) do not hit the NIC and therefore cannot be captured with the default configuration of Wireshark using the WinPcap packet sniffing library.  Resolution Replace WinPcap with Npcap to emulate a loopback NIC for packet capture. Go to https://nmap.org/npcap/ for details on the library. Download the library installer from https://nmap.org/npcap/#download Uninstall WinPcap. Install Npcap. Npcap will then create an adapter named Npcap Loopback Adapter. In Wireshark choose this adapter to capture, loopback traffic will be the seen the same way as other non-loopback adapters. This can be tested by typing in commands like "ping 127.0.0.1" (IPv4)  or "ping ::1" (IPv6).

Issue Setting up, using, and troubleshooting Windows Active Directory with Building Operation Workstation and WebStation. Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Building Operation WebStation Windows Active Directory Windows Server Cause When integrating EcoStruxure with Windows Active Directory, NO user accounts need to be created in EcoStruxure, all that needs to be done is map the EcoStruxure User Account Group(s) with the Windows group(s) that will be used.  You can map Windows Active Directory groups to Building Operation user account groups if Building Operation runs on a network that uses this directory to manage users and user account groups. A Building Operation user account group that includes a Windows account group can also be a member of another Building Operation user account group. Mapping Windows Active Directory account groups to Building Operation user account groups has advantages both for administrators and operators. Administrators can manage the user accounts in the Windows Active Directory, rather than managing the accounts in two places. Any changes are instantly implemented to the mapped Building Operation user account group. Operations only have to remember the Windows login. Once logged in to a Windows user account that is mapped to a Building Operation account, the user is authenticated to access WorkStation without having to log in a second time. Note: The Building Operation domain used to map the Windows Active Directory user account groups must be a member of the Windows domain where the Active Directory is located. Windows Active Directory account groups can only be mapped on servers that are based upon Microsoft Windows operating system. Automation Servers, cannot map Windows Active Directory groups. For example, the Windows Active Directory user account groups Main Admin and Main User are mapped to the Building Operation user account groups Administrators and External Users. The External Users user account group is a member of the Operator user account group. The Administrators account group, which is a member of the External Users, inherits access to the Operation workspace. The user will then log into Windows on the PC where the WorkStation is installed. When logging into EcoStruxure Workstation the authentication is automatically done from the Windows user account. Resolution NOTE: Active Directory association cannot be achieved using the inbuilt Local Domain Create a new EBO Domain and associate it with your active windows Domain. NOTE: It is best to only use the Domain (Netbios) name (as shown above) when adding the Windows Domain name to this property.  Using the full DNS Domain name, for example, eur.gad.schneider-electric.com will cause issues when utilizing other features that require active directory authentication.  One example where this has been identified is with Change Control.   Create an EBO Domain Group within that new Domain and associate it with the Windows Domain Group in which the Windows Active Directory user(s) reside. Log in using Windows Username, Password, and Domain rather than EBO credentials. When logged on to the Enterprise Server PC as a Domain User it is also possible to select the "Log on as" box. See WebHelp: How to Create and Configure a Domain Conceptual Information on Windows Active Directory User Groups How to Create User Account Groups Troubleshooting Windows Active Directory with Workstation Log in Error: Wrong user name or password If the EcoStruxure Building Operation Domain has the same name as the Windows Active Directory domain name, it will expect the user account to exist locally in the Building Operation domain. Log in Error: "User account not associated with a group. Contact your Administrator." Verify that the Windows user is a part of the Windows group configured in the Building Operation Group settings. In order to identify every group that the current windows user belongs to, run the command: whoami /groups Once the Windows user has been confirmed as a member of the configured Windows group, try changing the Log On as credentials for the Enterprise Server service. The default user that is used when installed is the "Local System account". The Windows account used to run the Enterprise Server service needs "read access" to all places (e.g. OUs) in the Active Directory where user groups potentially involved in an EBO Windows log-on can be found. Note: By default, all domain users in an Active Directory have read access to Active Directory "Users and Computers" objects so it is the sites that have restricted this in some way that may face issues. You do not need to use “domain admin” type accounts for this as they are granted way too much authority in general. An account that has read access to sufficient parts of the AD while having only normal local user privileges on the machine where the Enterprise Server is running will suffice. From the Windows Start menu, launch Computer Management. In Computer Management go to Services and Application > Services. Find Building Operation X.X Enterprise Server, select it and Stop the service. Right-click on Building Operation X.X Enterprise Server and go to Properties. Select the Log On tab. Under Log On as select "This account". Enter a Windows user login that has sufficient Windows rights for the Enterprise Server to log on as. Click OK and then start the service again. Log in to Workstation again using Active Directory. Troubleshooting Windows Active Directory with WebStation From version 1.5.0 and up, using Windows Domain accounts is supported in WebStation. However, the following must be done in order to log in. Must use HTTPS. Must enter your Windows username and password. Must enter the domain as the Windows domain as defined within Building Operation.  See below: An example log-on format is shown below when using the above configuration when using WebStation:    Alternatively, if the following is configured in Building Operation: WebStation log-on will look as follows:  Download a TVDA for Single Sign-On Instructions