Building Automation Knowledge Base

Issue How to Identify a specific PCT (Project Configuration Tool) project. Product Line EcoStruxure Building Operation Environment Project Configuration Tool Cause How to identify a specific PCT (Project Configuration Tool) project. Resolution In PCT check the project name for the project to be the backup. For this example, the project named “Test 5 Project” is used.   Go to the project storage folder. (The following is the default locations for PCT v1.2.7.223): C:\ProgramData\Schneider Electric EcoStruxure\Building Operation\Project Configuration Tool\storagemodule\projects   Using a text editor (for example Notepad or Notepad++) open each folder then open the file “project.thrift.pctj”, Open each folder in turn until the correct project has been identified to backup. The stored project folder name can be seen:   Further on in the text editor, the PCT project name can be seen, in this example 'Test 5 Project'.   Alternatively click the “edit” menu item and select find (ctrl + F) from the options and search the text for the PCT project name. Making sure PCT is not running when copies of any of the projects are taken

Issue Need to ensure that there are not any unresolved or invalid bindings Product Line EcoStruxure Building Operation Environment EcoStruxure Building Operation Workstation v1.5 and above Bindings Diagnostics Cause Bindings are invalid because they point to something that cannot be bound together or they are unresolved because the binding points to an object that is not in the database. Resolution From the Workstation run the Bindings Diagnostics to check for invalid or unresolved bindings.   Open the Control Panel To Check the Status of Bindings  click the option for Bindings Diagnostics.   Observe the Status to identify any invalid or unresolved bindings. Refer to the EBO Webhelp Binding Status Icons topic for more information Right-click the invalid or unresolved binding, edit the binding or view properties, and correct as appropriate.

Issue All Script programs in the AS have status unloaded. How do I get them working again? Environment Struxureware Building Operation 1.5. Cause A script program had an output binding that was linked to a PVR block in a Function block program. It looks like on the server boot up, the script engine tries to start up before the function block engine does and when an output of a script sees that the binding is null, it throws an exception and shuts down the script engine. This only seems to be a problem when binding a script programs output to any PV type in a function block program. Resolution  Bind to a Numeric output instead of a PVR block in the function block program.

Issue I/A Series R2 station installed on a JACE-645 retrofit board (TRD-RB-645) fails to run with the following errors Product Line TAC IA Series Environment JACE-645 Retrofit Board (TRD-RB-645) I/A Series R2 version 2.301.535.v1 I/A Series G3 version 3.6.406 Cause The R2 station has not been upgraded to R2 version 2.301.535 using the dbadmin command in the Niagara console. There are errors when converting the upgraded XML version of the station to SNS.  Resolution Ensure that the R2 station is upgraded as per step 3 on page 4 of the Retrofit Board Niagara R2 Install & Startup Guide before copying the station into the JACE-645 retrofit board. 

Issue The automation server password policy is grayed out making it unavailable to make configuration changes. Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Building Operation Workstation Building Operation Automation Server Premium   Cause When an Automation Server is attached to an Enterprise Server, all of the password policy configurations are inherited from the enterprise server. Therefore the AS settings cannot be changed.  Resolution The password policies of the Automation Server must be administered from the ES when it is connected to an Enterprise Server.   In order to make changes to the password policy settings in the Automation Server directly, it must be detached from the Enterprise Server. Note: For EBO V 1.9.X and lower, the password policy settings can be located under Control Panel > Security and Communication > Security settings area. For EBO 2.0.X and higher, the password policy settings can be located under Control Panel > Security and Communication > Password policy.

Issue How to send an event based alarm to one or multiple email addresses using an MPM Product Line EcoStruxure Building Expert Environment SmartStruxure Lite Multi-Purpose Manager MPM-VA MPM-UN MPM-GW Cause Emails can only be sent using a Lua script Resolution To send e-mails to alert a list of recipients when a pre-defined condition is met, you need to create a Lua Program object (PG1 for example) on your monitor MPM. Copy and paste the attached Email_Alert_AN015 script in the Loop section of the program object and activate it by pressing the green Play button. Don’t forget to save both the object and the database when you are done. You will need to modify this script to represent your own event, including the server information, the list of recipients and the content of the message sent. The monitored variable and the limit conditions can be modified directly from the Event object in Building Expert. In the above example, room temperature is 23 which means that the "Event State" is 0. An email alert will be sent out when the temperature exceeds the high limit (Event State = 3) or when the temperature goes below the low limit (Event State = 4) defined by the event.   Tip 1 Only a Manager connected via Ethernet has the ability to send emails. For a network composed of a daisy chain (CANbus) or a wireless mesh (ZigBee mesh), the Lua program that manages e-mail alerts for all the nodes on the network must reside on the monitor node. The variables in the Lua program will be obtained from any remote node on the network, and the email sent by the monitor if a condition is met. To get an object from a remote node, refer to Display values/objects from a remote MPM on dashboard of the monitor MPM Tip 2 Should you have issues sending emails with the above script, verify that the User and Password defined in the script are accurate and up to date and that all server information is accurate. Also ensure that the Ethernet configuration (ETH1 object) of your SmartStruxure™ Lite Manager is accurate and represents the current settings of your network. Pay special attention to the DNS and Gateway settings. Your monitor Manager will be able to operate on a local network even if these settings are not accurate, but will not be able to access the Internet, which is required to send emails. Tip 3 When using Google’s server mentioned below, it is important to use the following information Google* Server aspmx.l.google.com Domain google.com Port 25** Sender *** Recipient   Username (Not Required)**** Password (Not Required) *Google can only be used to send emails internally from Gmail to Gmail **When port 25 is used, emails are stored in the spam folder ***Bracket < > are not to be discarded, otherwise syntax error 5.5.2 appears ***Note that the user authentication is not required for the google server and if included, will be rejected. Tip 4 The AOL’s server mentioned below can be used to send emails from an AOL account to any other email and does not send the emails to the spam folder AOL Server Smtp.aol.com Domain Aol.com Port 25 or 587 Sender email@AOL.com Recipient Your_email@AOL.com Username (Required) email@AOL.com     (or any other email) Password (Required) Your password   Tip 5 Email server using Port 25 and not requiring authentication, sendUser and SendPassword lines needed to be deleted from Variables section

Issue How to program a limit block for use in Niagara G3. Environment Niagara G3 Cause Limit are configure using the Reset object in the kitControl palette in the Math folder. Resolution Use the Reset object found in the kitControl palette in the Math folder.  To use it set the "Input Low Limit" and the "Output Low Limit" to the lowest desired output.  Set the "Input High Limit" and "Output High Limit" to the highest desire value. kitControl-Reset This component performs a linear “reset” on the inA value. Reset is available in the Math folder of the kitControl palette. Reset operation is defined by the following four slots: Input Low Limit — must be less than the Input High Limit Input High Limit — must be greater than the Input Low Limit Output Low Limit — may (or may not) be greater than the Output High Limit Output High Limit — may (or may not) be greater than the Output Low Limit For example, a Reset object is used to establish a hot water control setpoint, based on the outside air temperature at inA. When the outside air temperature is 0°F, the hot water setpoint is 200°F. When the outside air temperature is 75°F, the hot water setpoint is 100°F. The Reset object is configured as: Input Low Limit = 0.0 Input High Limit = 75.0 Output Low Limit = 200.0 Output High Limit = 100.0 Whenever the inA value is beyond the input limits, the output is limited by the corresponding output limit (in this case, 200 at 0°F or below, 100 at 75°F or above). When the input is at an intermediate value, the output scales linearly. For example, when the outside air temperature is at 38.2°F, the Reset output is 149.1°F.

Issue Adding a new Netcontroller II (CX 9680) or a new ACX II(ACX 57xx) to an existing system creates problems if the versions are not compatible Environment Netcontroller II (CX 9680) ACX II (ACX 57xx) Cyberstation Cause Current Production of Netcontroller II and ACX II as of 12/1/08 have versions 2.1 and 1.1 on these products respectively. These versions are only compatible with Cyberstation V1.82 or greater.  Resolution If you have a system that is lower than Cyberstation V1.82 you will need to downgrade these controllers to V2.0 and V1.0 respectively. The flash files are available on the Exchange Extranet as is the complete version compatibility chart.

Issue Is there a replacement for the EM52L actuator? Environment EM52L actuator 8522221010 Cause The EM52L actuator is obsolete. Resolution Both the EM52L actuator and the V354/V355 valves that are associated with it are obsolete, so both will need replacing. The replacements would be the MZ20A (Selectable control signal) or the MZ20A-R (Fixed 0-10v control) actuator, with the VZ*19 range of valves. For a data sheet for the MZ20A actuator, please click HERE. For a data sheet for the VZ*19 valve range, please click HERE.  

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue Need to setup SAML SSO with Azure EntraID Product Line EcoStruxure Building Operation Environment Building Operation Workstation Azure Cause The SAML configuration requires details setup Resolution Part 1: EBO configuration Creating and Configuring the SAML Configuration Object To create and configure a SAML configuration object. In WorkStation, in the System Tree pane, expand the System folder. Expand the Federated Authentication folder. Select the SAML Authenticator object. On the File menu, click New object. Select SAML Configuration. Enter a name, path, and description on the object you want to create. Click Create. Configure the settings. Enabling Federated Authentication To enable federated authentication In WorkStation, in the System Tree pane, select the EcoStruxure BMS server you want to configure. Click the Control Panel tab. Click Security Settings. Select Enable federated authentication. Click the Save button. Configure SAML Configuration object Service Provider To configure the service provider. In WorkStation, in the System Tree pane, click the SAML Configuration object. Click the Service Provider Settings tab. Configure the settings. Identity Provider To configure the identity provider. In WorkStation, in the System Tree panel, click the SAML Configuration object. Click the Identity Provider Settings tab. Configure the settings. Configuring the Security To configure the security. In WorkStation, in the System Tree pane, click the SAML Configuration object. Click the Security Settings tab. Configure the settings. Create and configure domains Create and configure a domain to be used for Federated Authentication. Create a Domains Create a group Configure the permission for the group Part 2: Azure Configuration Login to https://azure.microsoft.com/ Create SAML application under Entra ID Click Microsoft Entra ID Click Enterprise Application Select Create your down application Enter the name of the App Select “Integrate any other application you don’t find in the gallery (Non-gallery)” An Enterprise Application is created with the name Create a group Select Groups Click New Group Select “Microsoft 365” for the Group type Enter the name of the group, the “Group name” must match the Domains Groups name in EBO. Add Owners and Members to the group Configure Entra ID Select Assign users and groups in the Enterprise Application Overview Select Add user/group then click Assign The selected group is under the application Select Set up single sign on in the Enterprise Application Overview Under Basic SAML configuration Enter the information from EBO SAML Authenticator Basic Tab The Sign on URL is Base URL The Identifier is Entity ID The Reply URL is AAssertion Consumer Service URL Click on Edit from Attributes & Claims Click on “Add a group claim” Select Groups assigned to the application Select Cloud-only group display names under Source attribute update the “Unique User Identifier” Value to user.displayname Download the “Federation Metadata XML” certificate Open the XML file and find the line with certificate, it will start with <XXXXCertificate> Copy the string between the two brackets and paste it in Public key certificate under Identity Provider Settings Copy the Entity id and Single Sign On Service URL from Azure to EBO. The Entity Id is Microsoft Entra Identifier. The Single Sign On Service URL is Login URL. Part 3: Testing Test Single Sign On Go to Webstation by entering the SmartX Server network address. Click on Log on with SSO Select the account within the Azure Group Successful login screen

Issue On a system requiring Semantics after adding Enterprise Servers to an Enterprise Central alarms are generated that cannot be cleared.  Changing the password for the Servers does not fix the issue. Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Central Building Operation Enterprise Server Building Operation Workstation Cause Incorrect method used when setting up Semantics during installation, Semantics were enabled on the Enterprise Server as well as the Enterprise Central.  After adding to the Enterprise Central the Enterprise Server points to a different address where the alarm is for the original Enterprise Server address.   Resolution On the Enterprise Server the alarm needs to be verified against the original connection, this involves removing the lead object link and changing the settings to look at the original Semantic Database.   On the Enterprise Server Semantic Settings remove the lead object entry pointing to the Enterprise Central.  Open the Services Manager and Stop and Re-Start the GraphDB service, if stopped start it. Additionally, Stop and Start the Enterprise Server service, this can also be done in the Services manager using Software Administrator to stop and start will show any errors if evident. Log back into the Enterprise Server and the password alarm should be cleared, this may take a minute or so but not any longer.  This is only if the password has been changed, please see Semantic DB authentication failure" alarm. Also, in the EC the password alarm should have cleared. Once the alarm is cleared the GraphDB service can be disabled from within services as it is not required. Re-instate the lead object entry pointing to the Enterprise Central that was initially removed. For more information on Semantics please see Semantic Overview

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue Importing certificates into EBO may require OpenSSL to perform the tasks. Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Building Operation Enterprise Central Building Operation Device Administrator Building Operation Automation Server Cause OpenSSL needs to be used to manipulate certificates so they are in the correct format for importing into EBO Servers. Resolution OpenSSL is installed with Enterprise Server, Enterprise Central, and Device Administrator, so use the following path to resolve your installation. In this example, EBO 2022 is installed on the C Drive, so a change in the path may be necessary for your installation. In EBO 2023, OpenSSL was upgraded to 3.x version (3.0.8 dated 7 Feb 2023). Enterprise Server Location: C:\Program Files (x86)\Schneider Electric EcoStruxure\Building Operation 4.0\Enterprise Server\bin\openssl.exe Device Administrator Location: C:\Program Files (x86)\Schneider Electric EcoStruxure\Building Operation 4.0\Device Administrator\OpenSSL\openssl.exe One can use the command openssl version to see the version installed. In this example with EBO 2022 OpenSSL version 1.1.1l (Letter L) dated 24 Aug 2021 is installed.   Enterprise Server  Device Administrator  Use Copy Path to use openssl.exe in the current directory In Windows Explorer, find openssl.exe Hold SHIFT, Right-Click on openssl.exe, and select Copy Path Paste into the command prompt, and you will see double quotes since the path can contain spaces. Continue to type your command and reference files by name in the current directory. 

Issue Moving the Enterprise Server database path on an existing system Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server (ES) Cause The Enterprise Server database can be affected by system changes (system restore, Windows reinstall, reformatting the system drive, etc.) if it is located at the default path on the system drive. In some instances, the default location is not the best for the customers' site. Resolution The default path where the Enterprise Server database is installed depends on the operating system it is installed on as well as the version:  The default database path for Building Operation 1.9 and below: C:\ProgramData\Schneider Electric StruxureWare\Building Operation 1.x\Enterprise Server For 2.0 and above  C:\ProgramData\Schneider Electric EcoStruxure\Building Operation x.x\Enterprise Server To move or change the Enterprise Server database path. Log on to the Enterprise Server from Workstation. Perform a backup (all data) of the Enterprise Server (right-click on the server and select 'Backup'). After the backup completes, save the backup set to the local drive (server > System > Backup and Restore > Backup sets > Local).  Exit the Workstation. Stop and uninstall the Enterprise Server. Install the Enterprise Server (same version as the version that was uninstalled). When prompted for the database path, browse to the new directory where the Enterprise Server database is to be located. In the example below, the new Enterprise Server database path is  After the Enterprise Server is installed, run the Software Administrator. The database path should now point to the new database directory. Start the Enterprise Server if it is not already running.  Log on to the Enterprise Server from Workstation and restore the backup set (all data) which was saved.  Log on to the Enterprise Server and verify operation. 

Issue Communication issues between the Enterprise Server and Automation Servers result in an offline status of the AS. More information is required on how this status is detected.  Product Line EcoStruxure Building Operation Environment Enterprise Server Automation Server Cause An AS behaves as if it is online yet shows up as offline in Workstation.  Resolution As of 1.5.0.10001 there is a new model for detecting online / offline servers. Prior to 1.5.0.10001 When a communication error was detected the Automation Server was marked as offline. As of 1.5.0.10001 and Newer An immediate DetectOnline call is scheduled. Only after three failed DetectOnline with an interval of one second we consider the  server to be offline. When offline an alarm is generated.and set the offline status as normal, and also go back to one minute interval for online detection. In 1.5.0.10001 the number of retries and interval is possible to set in server.properties. From 1.6.0 this is configurable from WorkStation. *** Server Communication folder is hidden in more recent versions of SBO See Also: How BACnet b3 controllers are established as being Online / Offline How the communication status of BACnet devices are verified

Issue The CyberStation installation guide states that the Continuum DB Server can be run on a Windows 7 PC while the Continuum Compatibility Matrix does not. Which document is correct? Product Line Andover Continuum Environment CyberStation WebClient ContinuumDB Server Cause There are a variety of documents that describe system requirements for various Continuum products, it is unfeasible to update system requirement information in each document every time a change occurs. For this reason the Continuum Compatibility Matrix should be used as the ultimate word on Continuum products and controllers and the software and firmware that support them. Resolution The Continuum Compatibility Matrix is the ultimate authority when it comes to hardware/software/firmware compatibility.

Issue Where to find information for Schneider Electric's SmartStruxure Lite and ExoStruxure Building Expert offer Product Line EcoStruxure Building Expert Environment MPM SE8000 range Cause Information required for the SmartStruxure Lite and ExoStruxure Building Expert offer Resolution SmartStruxure Lite and EcoStruxure Building Expert information. There are several sources of information: Schneider Electric's Building Expert Product Selector website. Schneider Electric's Exchange (filter by SmartStruxure Lite) is a source for the SmartStruxure Lite and Building Expert product. Specification sheets Firmware Product Announcements Guides Videos For support contact your region's Customer Care Center

Issue Clarification on dip switch six and station addressing for the SCU1200, SCU1280, or SCU1284 Product Line TAC INET Environment I/NET Seven with Access Control using an SCU SCU1200, SCU1280, or SCU1284 Cause Clarification on SCU and dip switch settings being open, enabled for dual or single station addressing (2 or 4 doors) Resolution If the Device Type is SCU1200, SCU1280, or SCU1284: set the Number of points to either 1 or 2. Choose 1 if the SCU is configured to operate in the “single-address” mode (DIP switch S1-6 = OFF). Choose 2 if the SCU is configured to operate in the “double-address” mode (DIP switch S1-6 = ON). In order to control more than two doors, the SCU1284 must be configured to operate in the double-address mode. Though the TCON312 shows the dip switches for 1-6, there is still a bit of clarity which can be provided on how that looks on an actual SCU. The example from the TCON is shown here: And this is a photo below of an SCU which is setup as 0101 with dual addressing since Dip Switch 6 is in Dual Address mode shown in the picture below. When penetrating down to it using Edit, Host Computer, Network Configuration, SCU 1284 is shown with 2 Points with door addresses: 010108 Door1 010109 Door2 010208 Door3 010209 Door4 After checking MCU Configuration, I added the points in the Network configuration. The main point here is that Dip Switch 6 is up on the Open side of the Switch bar shown in red which is the dual point and 4 door configuration.   Note: Concerning the numbering scheme for addressing the SCU, it is important to number your SCUs with an address then skip the next number so in the event you dual addressing for four doors, the second address is available. Don't use addresses 28, 29,30, and 31 as those are reserved for the Remote Arming Terminal.  Overlooking this can result in future headaches of moving SCUs around in the addressing scheme which is never recommended. Example for a site containing 4 SCU door controllers: SCUa address 2, SCUb Address 4, SCUc Address 6, SCUd Address 8.  Another example configuration: One reader inputs to READER1 and READER2? Here is that wiring example. In order to use more than the first eight inputs on the SCU, you must configure the SCU as a double-address controller. When you enable the double-address mode (DIP switch S1-6 = ON), inputs 1 through 8 are monitored on the selected subLAN address (i.e., the primary address) and inputs 9 through 12 are monitored on the next consecutive subLAN address (i.e., the secondary address). The input points are defined in the I/NET host using two separate SCU controller assignments, the first providing eight input point definitions and the second providing 4 input point definitions. The SCU’s outputs are also divided across two LAN addresses when the SCU is operating in the double-address mode. The first four outputs are assigned to bit offsets 00 through 03 on the SCU’s primary address. The last four outputs are assigned to bit offsets 00 through 03 on the SCU’s secondary address.

Issue Can licenses be transferred in Security Expert? Product Line EcoStruxure Security Expert Environment Security Expert Cause Unsure if a single SSN can be authenticated on multiple PC's or if licenses can be transferred or moved. Resolution Each PC requires a separate SSN. These licenses can be transferred between PC's. As part of the licensing process, the hardware details of the computer are recorded against each SSN, so any hardware changes require re-licensing, this also means SSN's cannot be shared across computers, and if used on a virtual machine – it must be assigned a static MAC address. Licenses can be transferred between machines without issue, Product Support will add a registration onto the license and clear the hardware profile after receiving a request. The installer will then do a License Update from the Security Expert server.

Issue What Techniques can be used to troubleshoot Modbus TCP/IP X Driver? Product Line Andover Continuum Environment Continuum Modbus TCP/IP X Driver Cause Advice/ tips required to help isolate & determine Modbus IP communications problems. Resolution The first thing to check is that you are using the latest release of the driver and manual, also that it is the correct one for the controller model you are using, currently V2.00002 for the 1st Generation controllers (e.g. Netcontroller CX9900 etc) and V2.00018 for the 2nd Generation controllers (e.g. Netcontroller II and bCX1). Download Modbus TCP/IP xDriver. Ensure you are using only 1 XDriver for all your Modbus IP comms, if say you are using Comm1 as your X Driver enabled port then all of the Modbus IP points must be under Comm1, you cannot have 2 X Driver ports loaded with this X Driver (See Can multiple Modbus TCP/IP XDrivers be installed on a single 2nd Generation NetController?). The following points should be checked with reference to the Modbus TCP/IP X Driver Manual downloaded with the software: Set the X Driver accordingly for Client or Server mode (Client mode and will be polling the 3rd party devices, server mode responds to requests for data). Check that your Configuration point has been setup correctly as a Infinity String and the parameters are correct for the mode you are using. For Client mode check that Param 1 is set to a polling rate that the 3rd party devices can cope with also that Param 3 is long enough for the devices to respond between 20 and 60 seconds. Use Parameter 4 to enable the error logging in an appropriate date format, this will then put the errors into the String array behind this point, ensure you have set the log size to say 50, automatic log and the interval to be 0 (a semi automatic log See How to log data only when a point changes). This will then log the error in the string each time they occur, you can view these errors with a function that loops for the log size printing out each line to the Message Window, or put a number of lines of the error log array lines on a graphic as lines of text. Create a Remote Device Status point to monitor the state of the remotely connected Modbus IP servers, again this can be put on a graphic to show which devices are on/offline. By selectively disabling or removing some of the X Driver points you can limit the polling to certain devices, that way each device can be tested in turn. Another tool that can help debugging Modbus IP comms is Wireshark as it allows you to monitor the IP comms between the Client and the Servers. Check the correct addressing and function codes are used in the polls and that the servers are responding correctly. As per the Compatibility Matrix check that your NCII has a compatible firmware loaded for the Cyberstation software used (2.0x or 2.1x) In Client Mode, ensure the 3rd party system does not poll the driver too fast, see Typical data throughput rates for Modbus XDrivers. Ensure the Xdriver Objects (usually Numerics) have correct details within the Parameter Fields. An incorrectly formatted IP address can cause the Controller to Cold Start following a download. The quickest way to check the Parameters is to load the Controllers with all the objects apart from the Xdriver Configuration String, then create a listview with parameters 1 to 6.  

Issue Need to prevent passback in a Continuum access control system. Product Line Andover Continuum Environment Continuum Access Control Cause Access control users may try to "passback" their card in order to have another user enter an area. Resolution The way that anti-passback works in Continuum is that all the Door's entering into an Area that require the feature need to be setup for anti-passback. This then means that any one granted access at any of the Door's is then denied access at the other Door's into that same Area until they have badged out. There are two variations on the anti-passback implementation: Strict anti-passback. This restricts the same card from being used to enter the same Area until that Personnel badges out into an exit Area. It also ensures that the person's current area is adjacent to the area he/she is trying to access so if the system has the person's current area as OUTSIDE and the person tailgates into the premises and then badges at an internal door she will be denied access due to anti-passback violation. Relaxed anti-passback. This also restricts the same card from being used to enter the same Area but will allow access if the Personnel is in any different Area. As long as the Personnel is not currently in the Area they want to enter then they will be allowed in. (See Anti-passback enforcement on area re-entry only)   How to setup To setup anti-passback you will need to have at least two Areas created. One you want to restrict access to and another where they will be coming from. Next, you will need to configure the Door objects entering these Areas for both Entry and Exit. Make sure to define both of these Areas otherwise the anti-passback options will not be selectable. (See Anti-Passback Protection option is not available) Then go to the Entry Options and/or Exit Options tabs and tick "Anti-Passback Protection". This will provide strict anti-passback unless relaxed is enable by the next step. You can enable relaxed anti-passback by ticking the "Allow Entry on an Anti-Passback Violation" option. There is also an option for timed anti-passback, which if ticked, allows access on anti-passback after the "Timed Anti-Passback" time has lapsed.   Possible Solutions When Exit Readers Not Available You do need to have exit readers as well as entry readers to be able to configure and use anti-passback. To restrict access to an Area we need to know the current Area that each Personnel is in, we can only do this with Exit readers. This may not mean having to install exit readers at every entry reader though, there a couple of possibilities. First though, you will need to setup dummy exit readers in the Door objects you want to have anti-passback enabled. This will allow you to access the anti-passback function. The main problem will be that after entering the Area successfully, that same user will not be able to enter again unless they are shown to have exited that Area. There a number of possibilities on how to provide this: Install a single "badge out" reader at the exits for Personnel to badge out before exiting through free egress doors. This reader will be tied to a Door object with an exit area attached. Timed anti-passback could be used with a large enough window to deter tail-gating but still allow the cardholder to exit then enter again normally throughout the day. Could use the "allow access on anti-passback violation" option to monitor (and potentially trigger an alarm at the entry point) to note the violation for latter analysis but still allow the Personnel through.