Building Automation Knowledge Base

Issue When following the Enabling Transparent Data Encryption configuration steps in the SX-SRVR Security Expert - Client Server - Installation Guide, an error is seen running the supplied script to backup the certificate and encryption key.   Cannot find the certificate ‘TDECertificate’, because it does not exist or you do not have permission. Product Line EcoStruxure Security Expert Environment Security Expert Server Microsoft SQL Server Cause When copying the text from the SX-SRVR Security Expert - Client Server - Installation Guide the formatting contains a carriage return that stops the script from being able to be run in SQL. Resolution 1. Ensure the correct database is being run against by selecting it from the drop down in the SQL Server Management Studio menu bar or by adding "use master" as the first line in the script. 2. Create folders "c:\storedcerts" and "c:\storedkeys". 3. Fix the script by removing the carriage return breaking up the "TDE Certificate" file name.   The following script was successfully used to backup one file in each directory. use master; go BACKUP CERTIFICATE TDECertificate TO FILE = 'c:\storedcerts\TDE Certificate' WITH PRIVATE KEY ( FILE = 'c:\storedkeys\TDE Key' , ENCRYPTION BY PASSWORD = 'Hard_drive' ); GO  

Issue JACE 8000 WiFi radio Product Line  TAC IA Series Environment I/A Series N4 Jace 8000 I/A Series N4.15 Software Cause Niagara Framework, Niagara 4.15, includes an update to the QNX operating system that no longer supports the WiFi chipset in the JACE 8000. Resolution Customers who have deployed JACE 8000 devices with the WiFi connectivity option will not be able to activate or configure the WiFi radio under Niagara 4.15.  Blackberry QNX has dropped support for the WiFi chipset used in the JACE 8000. This change was effective with the latest release of its QNX 7.1 Software Development Platform (SDP) in November of 2024. Niagara 4.15 includes this QNX 7.1 SDP update and will install based on the current setting of the JACE 8000 WiFi radio.   What should the Jace 8000 WiFi customer expect When upgrading a JACE 8000-WiFi unit to Niagara 4.15, switch the WiFi radio to the DISABLED setting before attempting to install. In this configuration, 4.15 will install normally. Note that after commissioning, you will no longer see the WiFi Configuration option on the platform menu, and you will not be able to connect via WiFi. Also, note that Niagara 4.15 will not install if the WiFi radio is set to ENABLED.     What to do in situations where WiFi connectivity is needed A factory reset will restore Niagara 4.9, and the JACE will regain its WiFi functionality. You can then commission the JACE 8000-WiFi unit with Niagara 4.14.

Issue An error may pop up when using Bosch RPS configuration software indicating there is an issue with the hardware key. The Bosch Panel is offline in Access Expert Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Bosch Panel using RPS (Remote Programming Software) SafeNet USB Driver Cause The USB hardware key may not be installed or the driver needs to be updated or repaired Resolution Note: This solution assumes that the Bosch panel has been online in Access Expert before.   While working with a Bosch panel to integrate with Access Expert, the RPS software is used to configure the Bosch panel. An error may pop up indicating there is an issue with the USB security dongle that is inserted into the PC to connect to the Bosch Panel using RPS. This error typically pops up when trying to login with RPS and making the connection to the panel in RPS. "Invalid or missing Hardware Key" Steps: 1. Check to make sure that the USB dongle is inserted into the PC RPS is installed on 2. Install, repair or update the Sentinel Driver in Windows Programs and Features  Navigate to Windows Programs and Features Right Click on the Sentinel Driver Select Repair       Clicked through Next and Install Prompted to restart the PC       Note: Before restarting the PC, Exit RPS, Stop and Exit Docker, Exit Access Expert and then Restart the PC. Once the restart is completed, restart RPS and connect the Bosch panel, there should not be an error with the hardware key. Restart Docker and Access Expert. The panel should show online in Access Expert.                Additional external reference from Bosch: https://community.boschsecurity.com/t5/Security-Intrusion/How-to-correct-the-Invalid-or-Missing-Hardware-Key-message-from/ta-p/2858

Warning Hazard of Electric Shock: Remove all power from all devices before removing any covers or doors of the system. Disconnect power at the device and at the power source. Electrostatic Discharge Required: Always discharge static electricity from your person by touching metal prior to handling any hardware. Failure to do so may result in damage to devices. Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue For hardware failure or persistent issues, it is necessary to replace Security Expert hardware components Product Line EcoStruxure Security Expert Environment Security Expert SP-C or SP-C-Web controller Expanders (i.e. RDM2 or SP08) Card Readers Cause A hardware failure occurs or a persistent issue happens that requires steps to replace Security Expert hardware Resolution At times it's necessary to replace Security Expert hardware   Steps to replace Security Expert SP-C Controllers: 1. Determine if the original controller has encryption turned on If the failed controller was setup for encrypted communications with the Security Expert server, the newly installed replacement controller will not have the encryption keys to be able to decode the packets from the server. Attempting to bring it online will be unsuccessful. On the controller's Configuration tab press the Disable controller encryption, then Yes to confirm. A replacement controller will typically be unencrypted. As soon as it shows online you can decide if you want to encrypt it. If it was already encrypted in Security Expert before replacing it, you might need to hit the encryption button again to get it in sync. Note: It can be helpful to use the event server diagnostic. If you see messages including “unencrypted” set encryption on the controller and see if it comes online. 2. Disconnect the old controller from its networks unplug ethernet and RS-485 module network and other hardware 3. Replace the Serial Number in Security Expert In Security Expert, navigate to Sites | Controllers. Replace the Serial number of the old controller with that of the new one. 4. Disable encryption In the Configuration tab, click Disable controller encryption. 5. Default the Controller If the controller has been used on a different server, default the new controller. See the SP-C Installation manual for detailed steps on performing a controller default https://ecoxpert.se.com/search?documentUUID=b4fb1237-fd07-2ee5-d9ad-4324178c364c&title=SP-C%20Security%20Expert%20-%20Security%20Purpose%20Controller%20-%20Configuration%20Guide  6. Enter the event server settings on the controller Log in to the new controller's web interface. In Settings, enter the same IP settings, event server and ports as those of the old controller, then restart the controller. Note: Remember to remove the jumper used to default the controller 7. Connect the new controller to the networks and hardware The controller should come online in Security Expert if all the network settings, serial number and encryption settings are in sync. 8. Download the controller In Security Expert, right click on the controller record and select Force download. The controller should receive the download. 9. Enable encryption Once the controller is online, in the Configuration tab click Enable controller encryption in Security Expert if desired. Steps to replace Security Expert SP-C-Web Controllers: 1. Take a backup of the old SP-C Web controller Login to SP-C Web, In System | Backup controller This creates a .bak file prompting to save in a folder or in the downloads folder 2. Disconnect the old controller Unplug the controller from the ethernet network, the RS-485 module network and other hardware. 3. Register the new controller Log in to the new controller and register it in System | Licensing 4. Restore the previous backup taken Navigate to System | Backup and Choose File and browse to the previously created .bak file 5. Configure the IP settings In System | Settings, enter the same IP settings as those of the old controller, then restart the controller 6. Connect the new controller to the networks and hardware and Test Steps to replace Security Expert Expanders: 1. Disconnect the old expander from the RS-485 module network and any inputs, outputs or card readers. 2. Connect the new expander to the module network and hardware. 3. Set the new expander's address to the same as that of the old expander.  In Security Expert, navigate to Sites | Controllers, right-click the controller and select Module addressing.  In SP-C-WEB, use the Expanders Wizard. To address a keypad, power cycle it and then press [X], [Enter]. Enter the new address and press [Enter] to save. Note: Sometimes the old expander can remain in the module addressing window even after being physically disconnected. To free up the address, module update the expander record. This will fail, but the address should become available. 4. Module update the new expander. The expander should start operating normally using the programming from the original expander. Steps to replace Security Expert Card Readers: 1. Disconnect the old card reader from the reader port. 2. Connect the new card reader 3. Apply any Custom Configurations If the reader needs any custom configuration, apply it within two minutes of the reader starting up using the config card. 4. Wiegand and RS-485 readers should connect automatically For OSDP readers, put the card reader into installation mode, then send an OSDP install mode command to the reader expander.   Additional configuration after controllers have been replaced If used at the site, areas that are configured for duress alarms default to un-armed after a SP-C has been replaced and need to be re-armed via forced arming. If used at the site, the alarm dialer (Contact ID) "Service Mode" defaults to "0 - Manual Mode" after a SP-C has been replaced (see the arrow below) and needs to be changed to "1 - Start with controller OS". Service mode Test the replaced hardware to ensure the issue is resolved

  Issue The LEDs on the Flex server indicate the status of the gateway's connection with the Internet and server. This document contains the details that will help in understanding the gateway status.   Product Line EcoStruxure Building Activate Environment ESXBFXSVR00B008 ESXBFXSVR0BC008 ESXBFXSVRBCW008 Cause The behavior of top LEDs and Bottom LEDs are different in terms of troubleshooting and understanding the Flex server state. Resolution The LED blink patterns are indicators used to check the status of the internet connection, server connection, SD card health, gateway firmware health, device connection, and data transfer. Fig 1: Side View of the Flex-Server showing LED location     Fig 2: Gateway Status LED indication   Fig 3: Network Status LED   Fig 4: Ethernet Status LED   Fig 4: Power LED indications            

Issue Esmi Transition tool stopped working after upgrading to SX-SOAP version 1.7.0.0 or higher Product Line EcoStruxure Security Expert Environment EcoStruxure Security Expert Esmi Transition Tool SX-SOAP Cause The SOAP service no longer allows unencrypted communications over HTTP (port 8030) Instead use HTTPS over port 8040. Resolution 1. Open Esmikko Database transition tool 2. Go to the tab "Data Sync Service" the change the SOAP Server Address from http://localhost:8030/SecurityExpertSOAPService/service.svc to https://localhost:8040/SecurityExpertSOAPService/service.svc or https://SERVER_HOSTNAME:8040/SecurityExpertSOAPService/service.svc Note: bolded characters in the second line     3. Click on the button Create Data Sync Service Settings File The tool will stat working.

Issue What SQL collation does Security Expert use? Product Line EcoStruxure Security Expert Environment Security Expert server Microsoft SQL Server Cause Need to know the SQL collation used in Security Expert databases. Resolution The default collation is SQL_Latin1_General_CP1_CI_AS. This is the only supported collation and is set by default during installation and creation of the Security Expert databases.   Changing the collation can have serious ramifications to the stability and operation of Security Expert and is not supported.

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support Services for assistance. Issue Log data is not being logged into SQL. The Reports Server indicates that the database is full.   This view will be shown when logging into the WebReports interface. If this chart is not shown, the PC is not running an Express edition of SQL. Product Line EcoStruxure Building Operation Environment Reports Server Cause In most instances, the data that quickly fills the SQL database are Events. Event data fills the SQL Database and prevents log data from passing to the Reports Server database. If the data has filled within a few days, this would indicate an issue, and contacting your local support is the best option here. The Process below allows the user to stop the reporting agent from passing specific information to the Reports Server. If the data files are due to the amount of data stored, then an upgrade to the Standard/Full version of SQL is recommended.   Resolution To verify that the Events table is the likely cause of the SQL filling up, there are Standard Reports in the later versions of SQL.  The below example uses SQL Server version 13.x and shows the "Disk Usage by Top Tables."   If the Standards Reports are not available, then use the following article Building Operation Reports SQL Database Full, for instructions on how to show the details for each table.     The Process below allows the user to stop the reporting agent from passing Event information to the SQL Database: Download the latest SBO Reports Agent Config tool from the community. Load the Tool onto the Reports Server PC. Stop the Reporting Agent Using the Tool Press F7 to get to the Advanced Agent Configuration Page Change the numEventRecordToRead property to 0. This will prevent future event data from being written to the Reports Server database. Press Ok Under the Maintenance tab of the tool - there are two options under Events  Delete future events, alarms, and trends  Delete events and alarms older than... Restart the Reporting Agent This will stop any further Events from being passed through to the SQL Database.  

Issue Cardholders and door schedules are no longer working and they were yesterday Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Cause There is likely a holiday or holiday group that is affecting the entire system Resolution A holiday in Access Expert will make every schedule in that instance NOT run that day. Holidays are exceptions to a normally scheduled interval. The holidays within the system apply globally to all schedules. Schedules normally activate at the beginning of an interval and deactivate at the end, however, on a holiday, the schedules do not activate. This creates Holidays as global exceptions to schedules.   Example: A site recently lost all card access and schedules did not work on Veteran's Day. Not all cardholders were out of the office that day.  Reviewing the Instance's Holidays showed that Veteran's Day was configured, so schedules and cards were not working.   ** To resolve this issue: 1. The Veteran's Day holiday was deleted from the above list 2. Next, the controller(s) needed a right click and then "Push controller database" After doing this, the schedules and cardholder access worked normally.

Issue After installing the Feenics Keep Bosch Service to integrate Bosch panels with Access Expert the service will not start Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Bosch Service and panels Cause A configuration issue is preventing the service from starting successfully Resolution The Feenics Bosch Service will fail to start for a number of reasons: 1. Check that the Feenics Keep Bosch Service exists and hasn't been deleted. "C:\BoschService" 2. The service is unable to authenticate to the Access Expert Instance.  Double-check the username and password being used for the service. Ensure they haven't been recently changed or the username and/or password is correct. Typically the username is Bosch with a configured password. 3. While attempting to start the Bosch service open Live monitoring and see if there is a failed login attempt or other related errors. 4. Open the Windows application log on the PC that has Access Expert and the Bosch service installed and check if there is an exception or a similar error like the following: 5. Install and use the SEQ Log to troubleshoot For Install Instructions for SEQ, see the following article:  https://community.se.com/t5/Building-Automation-Knowledge/Access-Expert-Installing-SEQ-Logs/ta- p/436521  Once installed, run the SEQ Log http://localhost:5341 while attempting to start the Bosch Service and see if errors are being posted. Example:   6. Check the last ping from the Bosch service to the Feenics host API : This date/time will give an idea of the last successful ping which can help target what may have been changed on the system or network that has affected the service. 7. Run the telnet command to access the Feenics host server If the DOS page is blank/black after hitting enter on the telnet command, that is a good sign. If there are any errors these can be a clue as to what is happening. If a firewall is blocking this connection you won't be able to reach the Feenics server.   Note: If the telnet command isn't recognized, telnet may not be enabled on the PC If none of these steps help to identify the issue, please open a Support case.

Issue Prevented from logging in to Security Expert due to client licenses being available. See message "Licensed number of connections exceeded" when attempting to login. Login Message Product Line EcoStruxure Security Expert Environment Security Expert Client Cause The Concurrent client connections are being used up by active Security Expert clients or clients that have not been properly logged out.   Available licenses can be confirmed by checking under About | License. The Concurrent client connections feature will show the number of used connections out of the total available for use.  Consumed Connection Licenses Resolution 1 - Log out unused Security Expert clients. Currently logged in Operators can be determined by checking the Windows application event logs Security Expert Data Service events for "New Operator Logon" and "Remove Operator by Disconnect". These contain the record id and name of the operator identifying who has logged in. Those Operators are still logged in if there is no reciprocal disconnect message seen. If it can't be determined from the Operator which machine is being logged into this can be identified by viewing currently open ports to the server using Wireshark.   2 - Correctly close the Security Expert client to release the client license Closing the Security Expert client by clicking the "x" on the windows taskbar can close the application without first logging out the current Operator. This can result in the concurrent client license not being released. To then release the consumed licenses the Security Expert server must be restarted. Taskbar Log out the Operator before closing the Security Expert client or close the Security Expert client by clicking the "x" at the top right of the client window. Close Client   3 - Operator timeout This setting is disabled by default. Set the "Enable operator timeout" setting on Operators for an appropriate time. After this amount of time with no activity the Operator will be automatically logged out releasing the client license. Operator timeout

Issue The Access Expert Bosch integration User sync stopped working whereas previously the Users and their passcodes from the Bosch Panel could be brought into Access Expert using Import Configuration. Example: In the case below, there should be 4 Users, not 2 compared to Bosch RPS.   Note: User 0 is not counted Product Line EcoStruxure Access Expert Environment Access Expert V3 Hosted Bosch Panel Integration Bosch Remote Programming Software (RPS) Docker Cause There was a September 2024 update from Feenics to fix a User synchronization defect and there are pre-requisites for the User synchronization to operate normally Resolution 1. Check the version number of Access Expert that is displayed when logging in. The version should be 24.9.1.0 or greater 2. Pre-requisites for the User synchronization     a. Area Authority Assigned     b. Person assigned to the User - the person cannot be blank. This can happen if LDAP is used     c. At least 1 Area Assigned To verify: In Access Expert> Access Configuration Select Area Assighnment 1, or 2, etc. Blank Person for a User Open Bosch RPS and connect to the panel, Expand User Configuration> User Assignments 3. Check Access Expert Live Monitoring and the Docker Logs  If the Import is still not working after ensuring Access Expert client software is up to date and the pre-requisites are set, check to see if there are any entries related to the Import or Users that may help troubleshoot by using Live Monitoring in Access Expert and/or the Docker Logs. An Example of the Docker Logs: Launch Docker> Under the Bosch Service> Logs (User 2 and 4 were not coming in prior to the Sep. Update) If the above steps do not resolve the issue, please open a case with Product Support for assistance.

Warning Electrostatic Discharge Required: Always discharge static electricity from your person by touching metal prior to handling any hardware. Failure to do so may result in damage to devices.   Issue If you are having trouble with the screen operation, you may need to re-calibrate the touch screen. Product Line ESMI Fire Detection. Environment FFSULH1001. FFSULH1002. FFSULH1003. Cause During shipping, the touch screen calibration may become misaligned. Resolution To calibrate the touch screen, do the following: Hold down the function button on the back of the main PCB and press and release the reset button, continue to hold down the function button firmly until the calibration screen appears this can take up to a minute Once the calibration screen has appeared you will be prompt with 5 crosshairs which you must press in turn. Note: Please note when pressing these crosshairs ensure you use your hand as it has been known to cause issues using tools or stationery as pointers

  Issue Cardholders are getting automatically changed from Active to Inactive (deactivated). When the LDAP/AD integration is configured to map the Active Directory attribute UserAccountControl to Card Status in Access Expert; records that have useraccountcontrol = 512 (normal active account) are getting their cards deactivated. These records should NOT be deactivated.   An LDAP query mapped to UserAccountControl Card(s) showing Inactive in Access Expert   Event History record showing the date and time the cardholder record was set to Inactive by LDAP Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Active Directory Cause A version of the LDAP service less than 24.2.1 Resolution Manually set the cardholder to Active as a workaround Ensure the LDAP service installed is greater than version 24.2.1. See the following link to a KB article showing how to "Identify which LDAP service is currently installed" : https://community.se.com/t5/Building-Automation-Knowledge/Identifying-which-Access-Expert-LDAP-integration-version-is/ta-p/480424    If the version installed is older than 24.2.1, perform the following steps: Uninstall LDAP from Windows Programs and Features Navigate to C:\ProgramData\Feenics_LDAP and delete the .dat file Restart the PC Install an updated version of LDAP from Feenic's web site: https://s3.amazonaws.com/download.feenics.com/ldap/Feenics.Keep.Installer.ActiveDirectory.msi  Test to ensure the issue has been resolved with the updated LDAP service

Issue In earlier SLP firmware the sensor displayed the CO2 with yellow and red as shown below:                               However new sensors display CO2 differently.   Is it possible to go back to the old look?   Product Line Field Devices Environment SLP Sensor Cause When launched, the SLA/SLP PM series sensor firmware was updated to display stoplight indicators (red, green, yellow) over the CO2 and PM values. In previous firmware, the stoplight function only applied to CO2 and the full screen showed red, green or yellow, but current firmware highlights the individual CO2 or PM value in the appropriate color. Resolution Firmware of this offer is not field upgradable; it is not possible to revert to the previous functionality.  

Warning Hazard of Electric Shock: Remove all power from all devices before removing any covers or doors of the system. Disconnect power at the device and at the power source. Electrostatic Discharge Required: Always discharge static electricity from your person by touching metal prior to handling any hardware. Failure to do so may result in damage to devices. Issue Why is it recommended to not mix high and low voltage connections on the same side of an CRS-HH-REL-10? Product Line EcoStruxure Building Operation. Environment Building Operation Room Controller (RPC) 24 V Building Operation Room Controller (RPC) 230 V Cause According to the documentation, it is not recommended to mix high and low voltage connections on the same side of the device.   Resolution There must be a minimum distance between terminals connected to High Voltage and terminals connected to Low Voltage of at least 5.5 mm to prevent the chance of voltage creep between the terminals.

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue It is sometimes necessary to move a previously configured Infinet i2 device from one Infinet network to another in the same parent Automation Server. EcoStruxure Building Operation does not provide an automatic way to move an i2 device; it must be done manually. Product Line  EcoStruxure Building Operation Environment Building Operation Automation Server Cause Guidance on steps to move Infinet i2 device from one Infinet network to another in the same host Automation Server Resolution In this example, we are going to move multiple Infinet i2 devices from the Infinet network on COM-A to the Infinet network on COM-B.   Backup Make sure to make a backup of the Automation Server before attempting the steps below. This is in case there is a need to revert the changes for whatever reasons. Export Devices from COM-A From COM-A Infinet network, display a List View of the devices, making sure to have columns displaying the Infinet ID and Serial Number. Write down the Infinet IDs and Serial Numbers of the devices to be moved. In the List View, multi-select the devices to be moved, right click and perform an 'Export', leave the Export Reference Filter at default (Export). After successful export, right click on the selected devices again and delete them from COM-A Infinet network. Prepare COM-B for Import From COM-B Infinet network, display a List View of the devices, making sure to have columns for Infinet ID and Serial Number. Observe the Infinet ID column, and compare with the notes taken above of the moving devices' Infinet ID, for IDs that are already in use in COM-B, you will need to assign a new ID to the device moving from COM-A Infinet network to COM-B, update your notes to include an available ID on COM-B. (see example below of what the notes might look like)   Import Devices to COM-B ***  In the System Tree, select the COM-B Infinet network and perform an import of the XML file created via export above. Physically move the devices from COM-A Infinet to COM-B Infinet. When doing so, avoid introducing duplicated Infinet IDs into COM-B Infinet. Make sure to power down the devices you are moving, connect them to COM-B Infinet, and only then power up the devices. On power up, the devices perform an ID check and stay off the bus if they detect their IDs are already in use. Configure Devices in COM-B From COM-B Infinet network, display a List View of the devices making sure to have columns for Infinet ID and Serial Number. Right click each device moved from COM-A Infinet to COM-B Infinet, and select "Properties", in the "Advanced" tab, enter the appropriate Infinet ID and Serial Number for the device then click "OK". In the List View, right click the device from previous step again, select "Device->Commission", after successful commission the device should go ONLINE Final Steps After all the moved devices are online, you should download ALL (whether moved or not) the devices to have their programs recompile and rebuild their Import/Export tables. Fix any references that were lost due to devices changing Infinet network and Infinet ID *** NOTE Due to an issue that was corrected in EBO 6.x, import may fail with error "Invalid InfinetId", the workaround for this problem is to manually create the Infinet devices on the destination port using the appropriate name, serial number and Infinet ID, then do the import selecting the option to merge on conflict.

Issue What temperature limit should the CPU Temperature stay within? Product Line EcoStruxure Building Operation. Environment Building Operation Automation Server Premium Building Operation Automation Server Bundled Cause From EBO version 3.2, the CPU Temperature is added. Resolution The CPU temperature parameter displayed in the UI property dialog Automation Server Properties – Basic Tab is intended for internal debugging purposes only. Users are not required to monitor or take action based on this value, as there is no specified maximum CPU temperature level that requires user intervention or indicates potential CPU performance degradation.  

Issue The instance values the Function Block program had when the backup was taken is lost when the backup is restored in an AS-P running in PCT. Product Line EcoStruxure Building Operation Environment Building Operation Project Configuration Tool (PCT) Cause When the program is first initiated, the values for it is written to the database. If the “Program executions” Is turned off, the instance values the program had when the backup was taken is not read. Hence the values are set to 0.   On a real AS-P, a Cold start is performed after the restoring of the backup. When restoring a backup on an AS-P in PCT, one or two cold starts are done, followed by an additional warm start at least for the PCT 2. Resolution To get the instance values from the backup when it is restored, the “Program execution”/”Enable program” In PCT should be turned on before the restore is done.   Since a warm start is done for the PCT, the issue regarding Retain level vs. FB Backup property needs to be taken into consideration. https://ecostruxure-building-help.se.com/bms/Topics/show.castle?id=15741&locale=sv-SE&productversion=7.0&a=1

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue Bog File Encryption Changes in 4.15 Product Line TAC IA Series Environment I/A Series N4 Enterprise Server I/A Series N4 Jace 9000  Cause In Niagara 4.15, to continue to provide the best security practices, the user password hashes are now included in the encryption by the system passphrase. Resolution The system passphrase was introduced in Niagara 4 to provide additional protection to sensitive data from the Niagara system. Prior to Niagara 4.15, this included all reservable passwords (such as Niagara Network, database connection passwords, etc.), excluding the user's passwords as those are protected by being hashed. If you do not have the system passphrase for a station and need to unlock it through Workbench, both the user and encrypted data such as passwords will be removed where prior to Niagara 4.15 the user were left untouched as they are hashed. If you are copying a station from a remote host which you do not have the system passphrase for, you will need to reset the passphrase to successfully copy the station onto a new remote host. You will be required to enter the passphrase to edit or modify users or encrypted properties such as password fields for email, Niagara Network, etc. Prior to Niagara 4.15, you could edit and modify users without the passphrase, in Niagara 4.15 this will require the passphrase to decrypt the users.   Operation Niagara 4.14 Niagara 4.15 Modifying users in offline station bog file Users can be modified without entering the station bog file passphrase Station bog file passphrase is required to modify users Reset station bog file passphrase Removes reversable client passwords such as email, Niagara Network, etc. Hashed user passwords are not impacted Removes both reversable client passwords and hashed user passwords Understanding the System Passphrase in 4.15 Workbench or Supervisor When Niagara is installed on the engineering or supervisor device for the first time, the user will set the passphrase for that device. NOTE: When setting system passphrases, make sure that you take note of what they are. These should be shared with the owner of the building/site as the passphrase is owned by the device. You can change the system passphrase in the Platform Administration screen. You will be required to enter the current passphrase in order to successfully change it to a new passphrase, highlighting the importance of providing it to the owner of the building/site. JACEs & Remote Niagara Devices The passphrase is set during the commissioning process of the remote device. The remote device's passphrase can also be changed through the Platform Administration view with the same requirements as changing the Supervisor/device's passphrase.   Station Bog File Passphrases In 4.15, you will have the option to encrypt the new station with either the local system passphrase or a custom passphrase in the New Station Wizard. This passphrase is required to unlock the bog file in the user home when configuring encrypted properties as well as when copying this station onto a remote host. New Station Wizard: Note: When selecting the "Use the system passphrase" option, this is the passphrase for the local host (Workbench) Unlocking the station in the User Home: Copying the Station to a remote host with a different passphrase: Understanding how the station passphrase changes when using the Station Copier When a station from a remote host to your local host, the passphrase which is encrypting the data will be the system passphrase of the remote host. Copying a station from your local host to a remote host: For a station that originated on your local host with a passphrase encrypting its sensitive data, once you enter the current station bog file passphrase and successfully copy the station onto the remote device, it will utilize the system passphrase of the remote device when copying from the remote device back to your local host. Copying a station from a remote host to your local host: When a station is copied from the remote host, it will automatically be encrypted with the system passphrase of that remote host.   What do I do if I do not know the system passphrase of the remote host I copied the station from? In the user home,  you are able to reset the passphrase of the station, however, you will lose the encrypted sensitive data including system and user passwords. In this workflow, you have the option to remove all users except for one new super user which you provide the new username and password in the Bog File Passphrase dialog: