Issue How to get an MSTP capture file so it can be analyzed for comm activity on an MSTP bus How to determine if a site is using bad COV management How to determine if a controller has poor bus design or installation How to determine if a site has multiple BBMD's on the same subnet Product Line Andover Continuum, EcoStruxure Building Operation Environment bCX4000, bCX4040, ASP, ASB b3 controllers Third party BACnet MSTP devices Wireshark Cause Analyze MSTP traffic via capture. Resolution To capture MSTP communication activity to a capture file that can be analyzed using a network sniffer application such as WireShark you will need the following. USB to RS-485 Adapter MSTP Capture application such as MSTPCap.exe WireShark   Connect the USB adapter cable to the USB port on a laptop PC Connect the RS232/RS485 adapter to the 9 pin end of the USB adapter cable. Attach a length of MSTP bus cable to the wire terminal on the RS485 adapter. Copy the MSTP Capture application to C:\ Open a command window. Launch the application by entering C:\> Mstpcap com# ###### where com# is the PC's serial port (Com1, Com2, etc.) and ##### is the current baud rate the bCX/AS MSTP bus is configured for (19200, 38400, etc.). The command window will indicate the name of the file the activity is being captured to. Once done, close the command line window The capture data can be viewed by running WireShark. Select File > Open and navigate to the folder the capture file was saved to and select the capture file. With the higher end MSTP capture tools such as tools developed by PolarSoft and Cimetrix, MSTP captures at 76.8K baud are possible. Lower end capture applications like MSTPCap typically are only able to capture MSTP packets from networks running at bus speeds at or below 38.4K baud. Also check out the BACnet-Capturing MS/TP Traffic Quick-Help video on the Exchange.

Issue BACnet 3rd party controller will not respond to Find New BACnet Devices (Who-Is/I-Am), so will not come online to Continuum or EBO Product Line Andover Continuum, EcoStruxure Building Operation Environment BACnet MSTP Continuum Cause Some 3rd party BACnet devices can be setup as master or slave. If the BACnet 3rd party BACnet device is setup as a slave device, it will not respond to the mstp token, therefore will not respond to the Who-Is broadcast and will not be able to communicate on the mstp network. The BACnet MS/TP protocol does not allow a slave only device to respond to a "Who-Is" broadcast. Resolution Check 3rd party device documentation or contact 3rd party device vendor for Master/Slave settings and configure for Master to communicate on a MSTP network. Slave only devices cannot come online and will require a 3rd party interface to convert to a protocol that can be directly supported by Continuum.   Examples of BACnet MSTP Slaves that are known not to respond to a Continuum Who-Is request and so not come online are: - The Babel Buster 485XM from Control Solutions Inc is BTL listed as a BACnet Slave device , their PICs statement can be seen Here. - Wilo pumps Interface Modules: IF-Modul BACnet & IF-Modul Stratos BACnet, their PICs statement can be seen Here. Additional Note In EBO  "slave only" MSTP device can be manually created. 

Issue After installing SigmaX version 5.0 or later, when running the software an error message reports a missing DLL. Product Line Satchwell Sigma Environment SigmaX version 5.0x, 6.0x and 7.0x Cause System Path variable is missing C:\Sigma\Bin in Environment Variables Resolution Make the following modification to the PC's System Properties. Note: This addition is only required on machines running SigmaX.   For Windows XP and Windows 7 Right click the My Computer icon on the desktop and select Properties Choose the Advanced tab and select the Environment Variables button From the System Variables section, highlight Path and select Edit The statement ‘;C:\Sigma\Bin’ must be added to the end of the Variable value line For Windows 10 In the search bar type and type 'environment' and go to 'edit the System Enviroment Variables' Bottom right go to Enviroment Variables In the bottom window 'System variables', find 'Path' and double click In the 'Edit environment variable pane - create a 'New' variable and add in c:\sigma\bin

Issue Error message "The Parameter is incorrect" when clicking OK in TAC Vista Server Setup Emailing alarms from TAC Vista is not working Product Line TAC Vista Environment TAC Vista Server Setup Cause The text encoding method has not been selected. Resolution Open TAC Vista Server Setup Click on the Mail Tab Check if the Text encoding Field is empty. If it is, select an encoding from the dropdown. Unicode (UTF-8) is suggested in the US with an Exchange Mail server.

Issue Getting error message when selecting Character set file for the TAC  Xenta Operator Panel (OP).     Product Line EcoStruxure Building Operation, TAC Vista, Xenta OP Environment TAC Xenta OP EcoStruxure Building Operation Microsoft Windows 10 Cause Microsoft Windows 10 does no longer allows the software to change files in all directories. Resolution Manually open up the directory C:\Program Files (x86)\Schneider Electric EcoStruxure\Building Operation 3.2\WorkStation\CharSet.lib Select the Charset you want to use, depending on the language, and copy the file. Remove the extension, so that the file is named Charset, without any extension. Manually open up the directory C:\ProgramData\Schneider Electric EcoStruxure\Building Operation\WorkStation\Function Block Editor Paste the copied file here.

Issue Automation Server Classic support for hosting MPX or RPC Product Line EcoStruxure Building Operation Environment Building Operation Automation Server Classic, AS-P, AS-B Building Operation SmartX MPX, MPC, MPV field controller Building Operation SmartX RPC field controller Cause The original Automation Server (Classic) can be set up to fully host (host server) and configure both MPX and RPC devices, but the Architectural Guidelines do not specify how many devices can be fully hosted. Resolution Full hosting of MPX, RPC is only supported and tested on AS-P, AS-B and Enterprise Server. This is confirmed in the MPX and RPC Specification Sheet. "MP-C/MP-V/RPC can either be used as a standalone BACnet/IP field controller or as part of an EcoStruxure BMS with a SmartX AS-P or AS-B server or an Enterprise Server as the parent server." MPX, RPC can be simply be BACnet hosted on an Automation Server Classic, but the use as parent or host server is not supported or tested.

Issue Troubleshoot Security Expert Controllers showing offline in the client. Product Line EcoStruxure Security Expert Environment Security Expert Cause Require some common troubleshooting steps to help determine why controllers may be offline to the client. Resolution The main items to check are: Refer to the Troubleshooting Security Expert Controller Connectivity - Application Note on Exchange Restart the client software. Power restart the controller. Remove power Wait for all LED's on the controller to go completely off Apply power to the controller. In the controller web interface, on the Settings page, check that Event Server 1 has the correct IP address. Check that the Firewall is disabled. Check any Anti-Virus Firewalls/settings as well. Restart the Security Expert services under the PC's Services option in Control Panel. These need to be restarted when any changes are made. Confirm that the module versions are all the same. Go to About  > Version and check there. If the database has not been upgraded to the same version as the client software, then this can cause communications issues. On the Security Expert Server check that MSMQ is still enabled in Windows Features as this is now a requirement. If MSMQ was installed after Security Expert, you'd need to reinstall Security Expert to allow it to run correctly. If MSMQ is installed and controllers are still not coming online (or the controllers are "bouncing" offline/online) then anecdotal evidence suggests enabling Windows 8 Compatibility Mode may help especially for Windows Server 2016 and Server 2019. Set the Windows 8 Compatibility Mode checkbox in the Properties page for C:\Program Files (x86)\Schneider Electric\Security Expert\SecurityExpertEvtSvr.exe   Also, note that if you have imported a database backup, then you will need to check/change some other settings as well to ensure everything is set up for your specific server and controller.   Under Global > Download Server confirm that your computer name is the name of the PC where the download server service is running. Under Global > Event Servers ensure that the computer name is the name of the PC where the event server service is running. Under Sites > Controllers confirm the Serial number, IP Address, Download Port, Download Server and Control and Status Request Port match what is set in the controller's configuration web page (browse to the controllers IP Address to view). On that same General tab go to Diagnostic Windows and open the download and event server windows. Review the information contained and if there are any errors shown. Right click the controller and select Get Health Status. Review the status messages displayed.

Issue TLS Error seen when attempting to export WebReports data from the displayed report as follows: Unable to download ReportsView.aspx (IP address) Unable to open Internet site, the requested site is not accessible or can not be found  Product Line EcoStruxure Building Operation Environment Building Operation WebReports 3.0.x and above  Internet Explorer (used within WorkStation) and Google Chrome Web Browsers Cause To download files, Internet Explorer must create a cache or temporary file. In Internet Explorer 9 or a later version, if the file is delivered over HTTPS, and any response headers are set to prevent caching, and if the Do not save encrypted pages to disk option is set, a cache file is not created. Therefore, the download fails Resolution See Microsoft documentation on how to correct this.  Typically Method 1 will correct the issue. Cannot download files from secure websites - Browsers | Microsoft Docs

Issue PCT workstation displays message “Server version not compatible with client", when restoring a server configuration with new IDs. Product Line EcoStruxure Building Operation Environment Buildings Operation Project Configuration Tool Cause When backing up and restoring an AS-P/AS-B with a new ID in PCT at EBO 3.2.2.61, when logging back on with PCT using the installed EBO workstation,  the message “Server version not compatible with client" is displayed Resolution PCT is the offline programming tool but, it launches the workstation installed on the computer. If the workstation version on the computer is EBO 3.2.2.61, Hotfix 3.2.2.4002 (CP3) is required to be installed on the computer running PCT, taking the computer’s installed workstation version to 3.2.2.4002.

Issue Clarity is needed on the new ES License Inheritance feature available in EBO 3.x Product Line EcoStruxure Building Operation Environment Building Operation Enterprise Server  Building Operation Enterprise Central Building Operation SmartX Server (AS-P, AS-B) Cause The evolving Licensing Model of EBO has offered the option of Embedded Licenses in SmartX Servers, such as SNMP Licenses, since EBO 2.x.  The concept of Inheriting Licenses from an ES into a SmartX Server is a new option which can be used from EBO 3.1 onward, although the original Embedded License option still remains, but what does this actually mean? Resolution In EBO 3.1, SNMP Licenses may be inherited from an ES into any number of child SmartX Servers (up to limits defined in relevant Architectural Guideline documentation).   In EBO 3.2 SNMP and TimescaleDB. Licenses may be inherited from an ES into any number of child SmartX  Servers (up to limits defined in relevant Architectural Guideline documentation).   'Inheritance' means that an ES License will be shared down to its child SmartX Servers while also being retained for use by the ES.   Note: SmartX Servers must be running the minimum supported 3.x version for Inheritance to function There is no such thing as a 'Site License' that can accommodate multiple ES There is no Licenses Inheritance from an EC

Issue When attempting to use the Door Entry Requires Verification option in a Door Type the verification window does not pop up when a User badges at the door. Product Line EcoStruxure Security Expert Environment Security Expert Cause This option requires a Camera record to be assigned to the Door record even if there is no physical camera at the door. Resolution Create a Door Type that has the Door Entry Requires Verification option enabled. Door Type Create a Camera under Monitoring | Setup | Cameras and set the Type to Direct Camera and URL to any value (this needs to be set even if it is not correct). Camera Configuration In your Door set, the Door Type to the new one created earlier and the Camera (Entry) to the camera just created. Door Configuration Operation: Badging a valid User at the Door will create an Entry Verification event (1) that pops the camera window that includes an Unlock Door button (2) allowing the Operator to manually open the Door (3) once visually identifying the User. Operator Verification

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue Unable to view PINs in the User screen if “Allow PIN Duplication” is checked   Product Line EcoStruxure Security Expert Environment Security Expert Server Cause This is viewed as a Site Security Enhancement feature Resolution Disable both the "Require Dual Credential for Keypad Access" and "Allow PIN Duplication" options

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue Contemporary Controls Skorpion Switch configuration setting for using RSP with MPX and RPX controllers Product Line EcoStruxure Building Operation Environment Contemporary Controls EISK8M-100T Skorpion Switch Building Operation Automation Server Premium Building Operation Multi-purpose Controller Building Operation Multi-purpose VAV Building Operation Room-purpose Controller Cause Contemporary Controls Skorpion switches have several caveats to consider before using them in a site design. Specific Skorpion switch configuration settings are needed in order for the RSTP protocol to work with MPX controllers.  Resolution Contermporary Controls EISK8m-100T switch documentation: https://www.ccontrols.com/ctrlink/eiskm.php    There are a number of configuration options available to use these switches and MPX/RPX controllers. This article is not meant to be a comprehensive guide.   Two caveats to consider  before   using these switches:  Contemporary Controls (CC) Support has indicated that these switches have a limitation to 39 devices (MPXs) per switch.   Other vendor's switches do not have this limitation and allow 39 devices per RSTP loop. Multiple RSTP loops are not supported on a Skorpion switch. Multiple Skorpion switches may be used and daisy-chained to allow for greater than 39 devices. The 39 total number includes the switch itself, so effectively, 38 MPXs. A static IP address of the switch   should not   be in the same IP range (10.110.210.x) if the AS-P is being used as a DHCP server. Configuring the switch this way may cause the AS-P to assign a duplicate IP address to 1 of the MPXs in that range. The DHCP server in the AS-P is a very basic DHCP server to allow for quick IP assignments in a private network. There aren't any configuration options for designated exceptions in the AS-P. (Note: This may be a security concern for sites that do not want a switch on their main network. Setting the Skorpion switch to DHCP enable can allow the ASP to assign a non-static IP to the switch and not interfere with MPXs. RSTP enabled - the snapshot below shows the settings to enable RSTP o the switch Redundancy state: STP/RSTP STP State: Enable Version: RSTP The Bridge Priority setting should be changed to 4096 to be a higher priority than the controllers. See the Priority setting in the snapshot above. Root ID: Self-populating field will indicate "Self" when set for a single root with 1 RSTP ring Rood ID "mac-address" may indicate a different switch that is the root switch Non-STP State Port Some ports must be set to not pass BPDU RSTP traffic,  i.e. the ASP, a PC used to configure the switch and connecting other network switches. 2 or more switches can be connected to allow for more devices to be connected (38 each) but RSTP traffic must be restricted to each switch. The ports connecting them need to be configured as Non-STP.   Note: Admin edge turns off almost all RSTP traffic, but not all Non-STP State ON disables the port from participating in the STP or RSTP ring The ports that are connecting the 1st, 2nd or 3rd switches need to have Auto-MDX set properly to behave as a cross-over cable. Either that or use a physical cross-over cable. In the Skorpion configuration page, click on the picture of the switch where the ports are showing "Auto-Mdix enable" on one switch and "Auto-Mdix disable" on the other switch. Click on the actual port from the main page to get to this setting. Example: Switch 1 port 8           Switch 2 port 1            General observations: Switch manufacturers have different limitations and options for configuration. Pay close attention to the Vender’s switch and MPX documentation. After a reconfiguration of the switch, give it several minutes for convergence to take place and to let the system settle. A  flooding network traffic loop state may happen in several circumstances: a. RSTP not enabled on an MPX (factory default will reset RSTP to disabled) Note: The Device Report will extract information directly from the controller b. MPX not warm started after setting RSTP c. A switch misconfiguration (Ex. Port not set to Non-STP On) A restart (power off) of the switch may be necessary to recover d. Too many RSTP devices in a loop (>39 including the Skorpion switch) e. IP address conflict This state can be observed when all the controllers go offline and access to the switch config page isn’t possible. It’s best to get RSTP working with MPXs on each individual switch with separate rings and then daisy chain them after configuring Auto-Mdix first and finally plug in the ethernet cable into the next switch. Using 2 PCs can be helpful when setting these up so that 1 can be used to access the switch(s) on the 192.168.92.x network and the other with EBO running on the other network that the ASP is set to. Otherwise switching the NIC settings back and forth is cumbersome. Once both switches are configured and both are working with RSTP, controllers may still show offline. A power cycle can clear this up so that the ASP can reassign an IP with both switches connected. *** 1 MPX controller that has not been set to RSTP will throw the whole system into offline mode. Use the device report to ensure every single controller has been set to RSTP AND has been warm started.  ***   Using the Control Panel MP Series devices link, the Search feature and the Device report in EBO can be helpful to observe all the necessary settings for MPX and RSTP Control Panel MP Series devices link

Issue Modbus Register Groups feature can overcome some Modbus communication problems. It has been seen before where the Modbus controller falls offline for a few seconds then comes back online. This cycle will repeat every few seconds. When register groups are not used, there may also be issues with the amount of time it takes for a Modbus points to update. Product Line EcoStruxure Building Operation Environment Building Operation Workstation Building Operation Enterprise Server Building Operation Automation Server Premium (AS-P) Building Operation Automation Server Bundled (AS-B) Cause In a normal Modbus network, a Modbus polling device obtains data from a polled device by sending a query message to the device and then waiting for the response message that contains the requested value from the selected register. If data from another register is required, the polling device sends out a new query message and awaits the response message. This process is repeated until all subscribed points values have been read. The Modbus Register Groups are a batch read function to poll Modbus devices. Instead of reading each register individually, the batch read function reads registers in manually created groups. When all registers in a group have been read, the response message returns subscribed register values for the whole group. Register grouping provides a dramatic saving in the time taken to poll your devices. For more guidance and tips on this topic, see Section "Modbus Batch Read Function" in the EcoStruxure Building Operation Technical Reference Guide.  Note: When viewing a graphic containing Modbus values, those values will update at the same interval as their Modbus register group. Resolution When grouping Modbus points, it is important to keep in mind some of the following points. Try to ensure that as many Modbus points as possible are contained in as few groups as possible. This will reduce the overall time it takes the Enterprise Server or Automation Server to read all the subscribed points in each Modbus device. Network performance can be enhanced by choosing the method of grouping that is most suitable for each device in the Modbus network.  Network performance can be enhanced by selecting a different default poll time for each register group. Network performance can also be enhanced by grouping points that have the same or similar polls. Start with higher group poll times to ensure a stable system before reducing the poll time. Make sure to delete Modbus points out of a register group individually before deleting the group. If this is not done, it can cause system delays. See article  Modbus Batch Read Multiple Registers Groups Creating a Modbus Register Group In Workstation, in the System Tree pane, right-click on a Modbus device and go to New > Modbus Register Group. In the "Create Object: Modbus Register Group" pane, type in the name and description of the group. Now that the group has been created, Modbus points can be dragged and dropped into the group. New Modbus points can be created in the group by right-clicking on the Register Group and going to New > Modbus Point.

Issue When attempting to log in the below network errors, or similar, are displayed. Connect: The server was unable to process the request due to an internal error. Could not log on to Server. Please check your remote connection setup Further checking the Windows Application Event logs on the Server you may also find error messages similar to the below being logged against the Security Expert services. CDTNames::GetTagName : Cannot open database "SecurityExpert" requested by the login. The login failed. Product Line EcoStruxure Security Expert Environment Security Expert MS SQL Cause The Security Expert services do not have the correct credentials to access the SecurityExpert database. Resolution Confirm the user account that the Security Expert services are using in Windows. Go to Start > Run > and type "Services.msc". Confirm the account that those services are being run under. By default, and in the example, this is the Local System account. Run Microsoft SQL Server Management Studio and under your server browse to Security > Logins. Find the user account that your services were used in step 1 In the Server Roles page of this user account. Enable the "sysadmin" server role Save changes and restart the Security Expert services.  

Issue Network scanning software causes a loss of Jace network communication. Product Line TAC IA Series Environment I/A Series Jace 8000 N4.9 and later Cause As network security awareness continues to expand, software-based scanners, such as industry-standard Qualys and Nessus, intended to detect and report on vulnerabilities within internal networks will likely continue to gain popularity.  Today, Tridium is seeing these scanners being deployed and run against Niagara-based platforms like the JACE-8000 and Edge 10.  In some cases, these scans are causing Niagara platforms to become unresponsive or reboot via an Engine Watchdog Timeout, all of which are not acceptable for the critical applications that Niagara facilitates. Resolution While Tridium has no control over how these scanners behave, or how and when they are executed within an organization, Niagara 4.9 introduces a number of changes intended to allow a Niagara-based hardware platform to appropriately respond to the scanning utilities, and also maintain operation.  Below is a brief explanation of how Niagara will function under the different known circumstances currently employed by these scanners, and how to interpret the results.   Recognition of non-Niagara Traffic on the platform In the event a scanner is interrogating a Niagara 4.9+ platform connection, the Niagara Daemon has been modified to recognize non-Niagara traffic over a period of time, shut down the connection if necessary, and wait for a pre-determined amount of time before re-enabling connectivity.  Under these conditions, a scanning utility may report that the Niagara instance has encountered denial of service, when in fact, Niagara has simply disabled the communication mechanism by which the scanner was attempting its interrogation. During this time, normal platform communication will also be affected; however, the Niagara platform and station will continue to run.   Prioritization of Internal vs. External Communication on the Niagara station In the event, a scanner is interrogating a Niagara 4.9+ station (external communication) and Niagara detects that this interrogation may cause an Engine Watchdog Timeout, the station’s web server will be stopped and restarted. Under these conditions, a scanning utility may report that the Niagara instance abruptly stopped communicating, and may have encountered denial of service.  During this time period, normal/expected client web connections to the station will also be affected; however, the Niagara platform and station will continue to run. As mentioned, these scanners are outside the control of Tridium, and likely always evolving to meet the needs of the various threats they are intended to protect against. As a best practice, Tridium recommends not scanning in production if possible, as any findings would be just as legitimate during scheduled downtime. Additionally, it may be prudent to work with the scanning tools to configure the appropriate priority of a scan, as the intensity of which you scan a production multicore, failover redundant web server host, is likely not the best choice for scanning a single-core JACE. Should you encounter an issue with a network scanning utility and Niagara 4.9 and above, please contact your support organization.

Issue When renaming a new Enterprise Server a validation error is received that states: "Validation failed for property 'HttpPort' Path: 'Enterprise Server/HttpPort' Type 'HttpPort' The value '0' is outside the range of allowed values Environment Enterprise Server Cause Whilst this issue may at first appear to be an issue with the port assignment. It is in fact an issue with the Enterprise Server certificate. Typically this occurs when a backup containing a base configuration has been used to create the new Enterprise Server. Resolution Remove the Active certificate, please see EBO Webhelp for instructions on how to remove a certificate

Issue Error 503 when testing for SOAP service availability using URL:   http://localhost:8030/SecurityExpertSOAPService/service.svc  Product Line Security Expert Environment Security Expert Server Cause Application pool in IIS not running.   Resolution In IIS Application Pools, start the pool associated with the Security Expert site.

Issue Downloading a license update, such as after adding features to a site license or extending the evaluation period on an evaluation license, and this fails with the below error being shown. The SSN is invalid for this installation. Product Line EcoStruxure Security Expert Environment Security Expert Cause Wrong SSN being used. The SSN being used is different to what was used when Security Expert was initially installed. Resolution Uninstall Security Expert and re-install using the correct SSN. Backup the SecurityExpert and SecurityExpertEvents databases and copy the resulting backup files somewhere safe. Manual backups can be initiated from the Global > Global Settings menu. Select the directory location and press backup now. Uninstall Security Expert from Windows Add or Remove Programs. Search for "Security Expert" to filter the results. Install Security Expert from available installation files. When asked for the license make sure to use the correct SSN.

Issue Can licenses be transferred in Security Expert? Product Line EcoStruxure Security Expert Environment Security Expert Cause Unsure if a single SSN can be authenticated on multiple PC's or if licenses can be transferred or moved. Resolution Each PC requires a separate SSN. These licenses can be transferred between PC's. As part of the licensing process, the hardware details of the computer are recorded against each SSN, so any hardware changes require re-licensing, this also means SSNs cannot be shared across computers, and if used on a virtual machine – it must be assigned a static MAC address. Licenses can be transferred between machines without issue, Product Support will add a registration onto the license and clear the hardware profile after receiving a request. The installer will then do a License Update from Security Expert.