Building Automation Knowledge Base

Issue Schedules are not unlocking or locking doors according to the dates and times specified by the scheduled events Product Line EcoStruxure Security Expert Environment EcoStruxure Security Expert Cause The Security Expert system has a number of variables that schedules take into consideration when determining control of doors and if one of these isn't configured correctly, it will affect proper schedule function and control. Resolution 1. Verify that the schedule has the appropriate dates and times set 2. Check Holiday Groups and ensure that any calendar actions created to repeat each year have the same start and end date. Having different start and end dates with a repeat can cause the action to span long periods which can affect scheduled operations.    

Issue When following the Enabling Transparent Data Encryption configuration steps in the SX-SRVR Security Expert - Client Server - Installation Guide, an error is seen running the supplied script to backup the certificate and encryption key.   Cannot find the certificate ‘TDECertificate’, because it does not exist or you do not have permission. Product Line EcoStruxure Security Expert Environment Security Expert Server Microsoft SQL Server Cause When copying the text from the SX-SRVR Security Expert - Client Server - Installation Guide the formatting contains a carriage return that stops the script from being able to be run in SQL. Resolution 1. Ensure the correct database is being run against by selecting it from the drop down in the SQL Server Management Studio menu bar or by adding "use master" as the first line in the script. 2. Create folders "c:\storedcerts" and "c:\storedkeys". 3. Fix the script by removing the carriage return breaking up the "TDE Certificate" file name.   The following script was successfully used to backup one file in each directory. use master; go BACKUP CERTIFICATE TDECertificate TO FILE = 'c:\storedcerts\TDE Certificate' WITH PRIVATE KEY ( FILE = 'c:\storedkeys\TDE Key' , ENCRYPTION BY PASSWORD = 'Hard_drive' ); GO  

Issue JACE 8000 WiFi radio Product Line  TAC IA Series Environment I/A Series N4 Jace 8000 I/A Series N4.15 Software Cause Niagara Framework, Niagara 4.15, includes an update to the QNX operating system that no longer supports the WiFi chipset in the JACE 8000. Resolution Customers who have deployed JACE 8000 devices with the WiFi connectivity option will not be able to activate or configure the WiFi radio under Niagara 4.15.  Blackberry QNX has dropped support for the WiFi chipset used in the JACE 8000. This change was effective with the latest release of its QNX 7.1 Software Development Platform (SDP) in November of 2024. Niagara 4.15 includes this QNX 7.1 SDP update and will install based on the current setting of the JACE 8000 WiFi radio.   What should the Jace 8000 WiFi customer expect When upgrading a JACE 8000-WiFi unit to Niagara 4.15, switch the WiFi radio to the DISABLED setting before attempting to install. In this configuration, 4.15 will install normally. Note that after commissioning, you will no longer see the WiFi Configuration option on the platform menu, and you will not be able to connect via WiFi. Also, note that Niagara 4.15 will not install if the WiFi radio is set to ENABLED.     What to do in situations where WiFi connectivity is needed A factory reset will restore Niagara 4.9, and the JACE will regain its WiFi functionality. You can then commission the JACE 8000-WiFi unit with Niagara 4.14.

Warning Hazard of Electric Shock: Remove all power from all devices before removing any covers or doors of the system. Disconnect power at the device and at the power source. Electrostatic Discharge Required: Always discharge static electricity from your person by touching metal prior to handling any hardware. Failure to do so may result in damage to devices. Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue For hardware failure or persistent issues, it is necessary to replace Security Expert hardware components Product Line EcoStruxure Security Expert Environment Security Expert SP-C or SP-C-Web controller Expanders (i.e. RDM2 or SP08) Card Readers Cause A hardware failure occurs or a persistent issue happens that requires steps to replace Security Expert hardware Resolution At times it's necessary to replace Security Expert hardware   Steps to replace Security Expert SP-C Controllers: 1. Determine if the original controller has encryption turned on If the failed controller was setup for encrypted communications with the Security Expert server, the newly installed replacement controller will not have the encryption keys to be able to decode the packets from the server. Attempting to bring it online will be unsuccessful. On the controller's Configuration tab press the Disable controller encryption, then Yes to confirm. A replacement controller will typically be unencrypted. As soon as it shows online you can decide if you want to encrypt it. If it was already encrypted in Security Expert before replacing it, you might need to hit the encryption button again to get it in sync. Note: It can be helpful to use the event server diagnostic. If you see messages including “unencrypted” set encryption on the controller and see if it comes online. 2. Disconnect the old controller from its networks unplug ethernet and RS-485 module network and other hardware 3. Replace the Serial Number in Security Expert In Security Expert, navigate to Sites | Controllers. Replace the Serial number of the old controller with that of the new one. 4. Disable encryption In the Configuration tab, click Disable controller encryption. 5. Default the Controller If the controller has been used on a different server, default the new controller. See the SP-C Installation manual for detailed steps on performing a controller default https://ecoxpert.se.com/search?documentUUID=b4fb1237-fd07-2ee5-d9ad-4324178c364c&title=SP-C%20Security%20Expert%20-%20Security%20Purpose%20Controller%20-%20Configuration%20Guide  6. Enter the event server settings on the controller Log in to the new controller's web interface. In Settings, enter the same IP settings, event server and ports as those of the old controller, then restart the controller. Note: Remember to remove the jumper used to default the controller 7. Connect the new controller to the networks and hardware The controller should come online in Security Expert if all the network settings, serial number and encryption settings are in sync. 8. Download the controller In Security Expert, right click on the controller record and select Force download. The controller should receive the download. 9. Enable encryption Once the controller is online, in the Configuration tab click Enable controller encryption in Security Expert if desired. Steps to replace Security Expert SP-C-Web Controllers: 1. Take a backup of the old SP-C Web controller Login to SP-C Web, In System | Backup controller This creates a .bak file prompting to save in a folder or in the downloads folder 2. Disconnect the old controller Unplug the controller from the ethernet network, the RS-485 module network and other hardware. 3. Register the new controller Log in to the new controller and register it in System | Licensing 4. Restore the previous backup taken Navigate to System | Backup and Choose File and browse to the previously created .bak file 5. Configure the IP settings In System | Settings, enter the same IP settings as those of the old controller, then restart the controller 6. Connect the new controller to the networks and hardware and Test Steps to replace Security Expert Expanders: 1. Disconnect the old expander from the RS-485 module network and any inputs, outputs or card readers. 2. Connect the new expander to the module network and hardware. 3. Set the new expander's address to the same as that of the old expander.  In Security Expert, navigate to Sites | Controllers, right-click the controller and select Module addressing.  In SP-C-WEB, use the Expanders Wizard. To address a keypad, power cycle it and then press [X], [Enter]. Enter the new address and press [Enter] to save. Note: Sometimes the old expander can remain in the module addressing window even after being physically disconnected. To free up the address, module update the expander record. This will fail, but the address should become available. 4. Module update the new expander. The expander should start operating normally using the programming from the original expander. Steps to replace Security Expert Card Readers: 1. Disconnect the old card reader from the reader port. 2. Connect the new card reader 3. Apply any Custom Configurations If the reader needs any custom configuration, apply it within two minutes of the reader starting up using the config card. 4. Wiegand and RS-485 readers should connect automatically For OSDP readers, put the card reader into installation mode, then send an OSDP install mode command to the reader expander.   Additional configuration after controllers have been replaced If used at the site, areas that are configured for duress alarms default to un-armed after a SP-C has been replaced and need to be re-armed via forced arming. If used at the site, the alarm dialer (Contact ID) "Service Mode" defaults to "0 - Manual Mode" after a SP-C has been replaced (see the arrow below) and needs to be changed to "1 - Start with controller OS". Service mode Test the replaced hardware to ensure the issue is resolved

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue Validation of SSL Certificate does not work Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server Building Operation Enterprise Central Building Operation Space-Logic Server (AS-X) Cause Cloud Connectivity makes use of the Baltimore CyberTrust Root Certificate for communication to the cloud, and often this certificate is not updated due to lack of maintenance routines on the Windows Server. Resolution Run Windows Update: On the server running the ES/EC, run Windows Update and make sure the Operating System is updated to the latest maintenance version available. Manually update certificate:  On the server running the ES/EC, go to https://curl.se/docs/caextract.html using a web browser and follow the instructions to download a collection of the most commonly used certificates on the web that are up to date. Click on the start-menu, type in ”certmgr” and press enter. Navigate to Trusted Root Certification Authorities/Certificates Under Trusted Root Certification Authorities, right-click the Certificates folder and select ”All Tasks > Import…” Follow the guide, click ”Next” and then locate the file you downloaded in Step 2a (make sure you filter to All Files). Click ”Next” on all steps and then click ”Finish”.

Issue There is a need to identify the Ports, URLs and Static IPs which must be open through customer's firewall for EcoStruxure Building Activate Flex Server and Partner Portal Product Line EcoStruxure Building Activate Environment EcoStruxure Building Activate Flex Server EcoStruxure Building Activate Partner Portal Cause Ports, URLs and Static IPs list needed to create firewall exceptions for EcoStruxure Building Activate Flex Server and Partner Portal in order to keep them functioning correctly. Resolution Below are the list of ports, URLs and static IPs that must be open through a site's firewall/network: URL Port Protocol Usage https://sentry.zenatix.com 443 TCP Allows the gateway to upload error logs and diagnostics. https://router.zenatix.com 443 TCP Allows the gateway to download Linux & Python updates from the Zenatix Server. Regularly polls the Zenatix Server to check internet connectivity. https://timesync.zenatix.com 9090 TCP Time server allows the gateway system & gateway clock to remain synchronized with Zenatix Server. https://gitlab.zenatix.com 443 TCP Used for troubleshooting to update the gateway codebase from the Zenatix Server. https://telemetry.zenatix.com 443 TCP Used for sending IoT device data and gateway health data to the Zenatix Server. https://emgx.zenatix.com 8883 TCP Used for communication between gateways and Zenatix cloud services for getting configuration or alarms from Zenatix Server to gateway and vice versa. 54.169.200.193 1194 UDP Allows Zenatix to remotely access and do API calls to the gateway through OpenVPN. https://mender.zenatix.com 443 TCP Used to download firmware updates to gateway from Zenatix Server.   Note: For the list of URLs to be whitelisted for the Global Portal, please refer to Required list of URLs/Ports to be whitelisted under firewall/network for EcoStruxure Building Activate (Global Portal).

  Issue The LEDs on the Flex server indicate the status of the gateway's connection with the Internet and server. This document contains the details that will help in understanding the gateway status.   Product Line EcoStruxure Building Activate Environment ESXBFXSVR00B008 ESXBFXSVR0BC008 ESXBFXSVRBCW008 Cause The behavior of top LEDs and Bottom LEDs are different in terms of troubleshooting and understanding the Flex server state. Resolution The LED blink patterns are indicators used to check the status of the internet connection, server connection, SD card health, gateway firmware health, device connection, and data transfer. Fig 1: Side View of the Flex-Server showing LED location     Fig 2: Gateway Status LED indication   Fig 3: Network Status LED   Fig 4: Ethernet Status LED   Fig 4: Power LED indications            

Issue In earlier SLP firmware the sensor displayed the CO2 with yellow and red as shown below:                               However new sensors display CO2 differently.   Is it possible to go back to the old look?   Product Line Field Devices Environment SLP Sensor Cause When launched, the SLA/SLP PM series sensor firmware was updated to display stoplight indicators (red, green, yellow) over the CO2 and PM values. In previous firmware, the stoplight function only applied to CO2 and the full screen showed red, green or yellow, but current firmware highlights the individual CO2 or PM value in the appropriate color. Resolution Firmware of this offer is not field upgradable; it is not possible to revert to the previous functionality.  

Issue Cardholders and door schedules are no longer working and they were yesterday Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Cause There is likely a holiday or holiday group that is affecting the entire system Resolution A holiday in Access Expert will make every schedule in that instance NOT run that day. Holidays are exceptions to a normally scheduled interval. The holidays within the system apply globally to all schedules. Schedules normally activate at the beginning of an interval and deactivate at the end, however, on a holiday, the schedules do not activate. This creates Holidays as global exceptions to schedules.   Example: A site recently lost all card access and schedules did not work on Veteran's Day. Not all cardholders were out of the office that day.  Reviewing the Instance's Holidays showed that Veteran's Day was configured, so schedules and cards were not working.   ** To resolve this issue: 1. The Veteran's Day holiday was deleted from the above list 2. Next, the controller(s) needed a right click and then "Push controller database" After doing this, the schedules and cardholder access worked normally.

Issue After installing the Feenics Keep Bosch Service to integrate Bosch panels with Access Expert the service will not start Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Bosch Service and panels Cause A configuration issue is preventing the service from starting successfully Resolution The Feenics Bosch Service will fail to start for a number of reasons: 1. Check that the Feenics Keep Bosch Service exists and hasn't been deleted. "C:\BoschService" 2. The service is unable to authenticate to the Access Expert Instance.  Double-check the username and password being used for the service. Ensure they haven't been recently changed or the username and/or password is correct. Typically the username is Bosch with a configured password. 3. While attempting to start the Bosch service open Live monitoring and see if there is a failed login attempt or other related errors. 4. Open the Windows application log on the PC that has Access Expert and the Bosch service installed and check if there is an exception or a similar error like the following: 5. Install and use the SEQ Log to troubleshoot For Install Instructions for SEQ, see the following article:  https://community.se.com/t5/Building-Automation-Knowledge/Access-Expert-Installing-SEQ-Logs/ta- p/436521  Once installed, run the SEQ Log http://localhost:5341 while attempting to start the Bosch Service and see if errors are being posted. Example:   6. Check the last ping from the Bosch service to the Feenics host API : This date/time will give an idea of the last successful ping which can help target what may have been changed on the system or network that has affected the service. 7. Run the telnet command to access the Feenics host server If the DOS page is blank/black after hitting enter on the telnet command, that is a good sign. If there are any errors these can be a clue as to what is happening. If a firewall is blocking this connection you won't be able to reach the Feenics server.   Note: If the telnet command isn't recognized, telnet may not be enabled on the PC If none of these steps help to identify the issue, please open a Support case.

Issue Esmi Transition tool stopped working after upgrading to SX-SOAP version 1.7.0.0 or higher Product Line EcoStruxure Security Expert Environment EcoStruxure Security Expert Esmi Transition Tool SX-SOAP Cause The SOAP service no longer allows unencrypted communications over HTTP (port 8030) Instead use HTTPS over port 8040. Resolution 1. Open Esmikko Database transition tool 2. Go to the tab "Data Sync Service" the change the SOAP Server Address from http://localhost:8030/SecurityExpertSOAPService/service.svc to https://localhost:8040/SecurityExpertSOAPService/service.svc or https://SERVER_HOSTNAME:8040/SecurityExpertSOAPService/service.svc Note: bolded characters in the second line     3. Click on the button Create Data Sync Service Settings File The tool will stat working.

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support Services for assistance. Issue Log data is not being logged into SQL. The Reports Server indicates that the database is full.   This view will be shown when logging into the WebReports interface. If this chart is not shown, the PC is not running an Express edition of SQL. Product Line EcoStruxure Building Operation Environment Reports Server Cause In most instances, the data that quickly fills the SQL database are Events. Event data fills the SQL Database and prevents log data from passing to the Reports Server database. If the data has filled within a few days, this would indicate an issue, and contacting your local support is the best option here. The Process below allows the user to stop the reporting agent from passing specific information to the Reports Server. If the data files are due to the amount of data stored, then an upgrade to the Standard/Full version of SQL is recommended.   Resolution To verify that the Events table is the likely cause of the SQL filling up, there are Standard Reports in the later versions of SQL.  The below example uses SQL Server version 13.x and shows the "Disk Usage by Top Tables."   If the Standards Reports are not available, then use the following article Building Operation Reports SQL Database Full, for instructions on how to show the details for each table.     The Process below allows the user to stop the reporting agent from passing Event information to the SQL Database: Download the latest SBO Reports Agent Config tool from the community. Load the Tool onto the Reports Server PC. Stop the Reporting Agent Using the Tool Press F7 to get to the Advanced Agent Configuration Page Change the numEventRecordToRead property to 0. This will prevent future event data from being written to the Reports Server database. Press Ok Under the Maintenance tab of the tool - there are two options under Events  Delete future events, alarms, and trends  Delete events and alarms older than... Restart the Reporting Agent This will stop any further Events from being passed through to the SQL Database.  

Issue What temperature limit should the CPU Temperature stay within? Product Line EcoStruxure Building Operation. Environment Building Operation Automation Server Premium Building Operation Automation Server Bundled Cause From EBO version 3.2, the CPU Temperature is added. Resolution The CPU temperature parameter displayed in the UI property dialog Automation Server Properties – Basic Tab is intended for internal debugging purposes only. Users are not required to monitor or take action based on this value, as there is no specified maximum CPU temperature level that requires user intervention or indicates potential CPU performance degradation.  

Issue Prevented from logging in to Security Expert due to client licenses being available. See message "Licensed number of connections exceeded" when attempting to login. Login Message Product Line EcoStruxure Security Expert Environment Security Expert Client Cause The Concurrent client connections are being used up by active Security Expert clients or clients that have not been properly logged out.   Available licenses can be confirmed by checking under About | License. The Concurrent client connections feature will show the number of used connections out of the total available for use.  Consumed Connection Licenses Resolution 1 - Log out unused Security Expert clients. Currently logged in Operators can be determined by checking the Windows application event logs Security Expert Data Service events for "New Operator Logon" and "Remove Operator by Disconnect". These contain the record id and name of the operator identifying who has logged in. Those Operators are still logged in if there is no reciprocal disconnect message seen. If it can't be determined from the Operator which machine is being logged into this can be identified by viewing currently open ports to the server using Wireshark.   2 - Correctly close the Security Expert client to release the client license Closing the Security Expert client by clicking the "x" on the windows taskbar can close the application without first logging out the current Operator. This can result in the concurrent client license not being released. To then release the consumed licenses the Security Expert server must be restarted. Taskbar Log out the Operator before closing the Security Expert client or close the Security Expert client by clicking the "x" at the top right of the client window. Close Client   3 - Operator timeout This setting is disabled by default. Set the "Enable operator timeout" setting on Operators for an appropriate time. After this amount of time with no activity the Operator will be automatically logged out releasing the client license. Operator timeout

  Issue EcoStruxure Building Activate Flex Server doesn't pass the GSM Signal Strength test.   Product Line EcoStruxure Building Activate Environment EcoStruxure Building Activate Flex Server EcoStruxure Building Activate Partner Portal Cause The Flex Server must achieve a GSM Signal Strength greater than 14 to pass the test. If the signal strength is less than 14, the test will fail.   Resolution Below are the troubleshooting steps which should be checked/followed: Ensure the Gateway is located in an area with good network coverage. If possible, reposition the Gateway to improve signal strength. Verify that the APN settings for the SIM card in the Device Management Dashboard are correct. Change the network carrier and reconfigure the APN again

Issue What SQL collation does Security Expert use? Product Line EcoStruxure Security Expert Environment Security Expert server Microsoft SQL Server Cause Need to know the SQL collation used in Security Expert databases. Resolution The default collation is SQL_Latin1_General_CP1_CI_AS. This is the only supported collation and is set by default during installation and creation of the Security Expert databases.   Changing the collation can have serious ramifications to the stability and operation of Security Expert and is not supported.

Issue The Access Expert Bosch integration User sync stopped working whereas previously the Users and their passcodes from the Bosch Panel could be brought into Access Expert using Import Configuration. Example: In the case below, there should be 4 Users, not 2 compared to Bosch RPS.   Note: User 0 is not counted Product Line EcoStruxure Access Expert Environment Access Expert V3 Hosted Bosch Panel Integration Bosch Remote Programming Software (RPS) Docker Cause There was a September 2024 update from Feenics to fix a User synchronization defect and there are pre-requisites for the User synchronization to operate normally Resolution 1. Check the version number of Access Expert that is displayed when logging in. The version should be 24.9.1.0 or greater 2. Pre-requisites for the User synchronization     a. Area Authority Assigned     b. Person assigned to the User - the person cannot be blank. This can happen if LDAP is used     c. At least 1 Area Assigned To verify: In Access Expert> Access Configuration Select Area Assighnment 1, or 2, etc. Blank Person for a User Open Bosch RPS and connect to the panel, Expand User Configuration> User Assignments 3. Check Access Expert Live Monitoring and the Docker Logs  If the Import is still not working after ensuring Access Expert client software is up to date and the pre-requisites are set, check to see if there are any entries related to the Import or Users that may help troubleshoot by using Live Monitoring in Access Expert and/or the Docker Logs. An Example of the Docker Logs: Launch Docker> Under the Bosch Service> Logs (User 2 and 4 were not coming in prior to the Sep. Update) If the above steps do not resolve the issue, please open a case with Product Support for assistance.

Warning Electrostatic Discharge Required: Always discharge static electricity from your person by touching metal prior to handling any hardware. Failure to do so may result in damage to devices.   Issue If you are having trouble with the screen operation, you may need to re-calibrate the touch screen. Product Line ESMI Fire Detection. Environment FFSULH1001. FFSULH1002. FFSULH1003. Cause During shipping, the touch screen calibration may become misaligned. Resolution To calibrate the touch screen, do the following: Hold down the function button on the back of the main PCB and press and release the reset button, continue to hold down the function button firmly until the calibration screen appears this can take up to a minute Once the calibration screen has appeared you will be prompt with 5 crosshairs which you must press in turn. Note: Please note when pressing these crosshairs ensure you use your hand as it has been known to cause issues using tools or stationery as pointers

  Issue Cardholders are getting automatically changed from Active to Inactive (deactivated). When the LDAP/AD integration is configured to map the Active Directory attribute UserAccountControl to Card Status in Access Expert; records that have useraccountcontrol = 512 (normal active account) are getting their cards deactivated. These records should NOT be deactivated.   An LDAP query mapped to UserAccountControl Card(s) showing Inactive in Access Expert   Event History record showing the date and time the cardholder record was set to Inactive by LDAP Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Active Directory Cause A version of the LDAP service less than 24.2.1 Resolution Manually set the cardholder to Active as a workaround Ensure the LDAP service installed is greater than version 24.2.1. See the following link to a KB article showing how to "Identify which LDAP service is currently installed" : https://community.se.com/t5/Building-Automation-Knowledge/Identifying-which-Access-Expert-LDAP-integration-version-is/ta-p/480424    If the version installed is older than 24.2.1, perform the following steps: Uninstall LDAP from Windows Programs and Features Navigate to C:\ProgramData\Feenics_LDAP and delete the .dat file Restart the PC Install an updated version of LDAP from Feenic's web site: https://s3.amazonaws.com/download.feenics.com/ldap/Feenics.Keep.Installer.ActiveDirectory.msi  Test to ensure the issue has been resolved with the updated LDAP service

Warning Hazard of Electric Shock: Remove all power from all devices before removing any covers or doors of the system. Disconnect power at the device and at the power source. Electrostatic Discharge Required: Always discharge static electricity from your person by touching metal prior to handling any hardware. Failure to do so may result in damage to devices. Issue Why is it recommended to not mix high and low voltage connections on the same side of an CRS-HH-REL-10? Product Line EcoStruxure Building Operation. Environment Building Operation Room Controller (RPC) 24 V Building Operation Room Controller (RPC) 230 V Cause According to the documentation, it is not recommended to mix high and low voltage connections on the same side of the device.   Resolution There must be a minimum distance between terminals connected to High Voltage and terminals connected to Low Voltage of at least 5.5 mm to prevent the chance of voltage creep between the terminals.