Schneider Electric SpaceLogic AS-P
Schneider Electric · DIN-rail building automation server, two Ethernet ports · AS-P
what it is
An automation server of the EcoStruxure Building Operation system. It does not drive a valve or a relay itself — it supervises field controllers, for example SpaceLogic RP-C room controllers, and passes their data to the building management system (BMS).
The housing is an electronics module that plugs into a terminal base on a DIN rail. Together with the base it measures 90 × 114 × 64 mm and weighs 0.321 kg, the module alone 0.245 kg (manufacturer's specification sheet). PC/ABS plastic, IP20 rating. Powered from 24 V DC through the base, consumption 10 W. It neither accepts nor supplies PoE.
Connectors according to the manufacturer's installation sheet:
- two Ethernet ports 10/100 RJ45; from the factory Ethernet 1 gets its address via DHCP, and Ethernet 2 is disabled,
- two RS-485 buses (Com A and Com B) and LonWorks TP/FT-10 on terminals,
- USB mini-B for service and firmware updates, and USB-A (5 V, 2.5 W).
The variants cannot be told apart by the housing. AS-P-S differs only in secure boot (Secure Boot) and has the same manufacturer drawing. AS-P-NL and AS-P-NLS do not support LonWorks and have seven LEDs instead of nine. The deciding factor is the text: the model-name field in BACnet, the "Module Type" label on the base plate, or counting the LEDs.
what we read from it
We read this model without logging in, in four ways:
- BACnet/IP (UDP 47808) — from the Device object: object name, model (
AS-P) and firmware version. The object name is assigned by the integrator, so it may be the building's own name or contain the device number. - HTTPS certificate with the subject "Schneider Electric Buildings Operation server" and the page title "Building Operation WebStation". Without logging in, the page gives nothing more.
- SSH banner on port 22.
- Reachability of each network interface separately.
two addresses, one device
The server is sometimes connected to two networks at once: Ethernet 1 to the BMS supervision network, and Ethernet 2 as the gateway to the network of controllers it supervises. From outside you then see two live addresses, and it is easy to take them for two devices. The pair belongs to one unit when:
- the MAC addresses of both interfaces are consecutive — the Ethernet 2 interface has an address one higher,
- both addresses present the same HTTPS certificate,
- both interfaces have ports 22, 80 and 443 open and the same WebStation page.
BACnet usually responds on only one interface. No response on the other does not mean it is a different device.
A failure of the Ethernet 2 interface cuts off supervision of the entire chain of controllers. The controllers themselves keep running and respond on their own network — only the path to them disappears.
how to identify it on the network
The MAC prefix 00:50:06 is registered in the IEEE registry to TAC AB, a former company acquired by Schneider Electric. Filtering the prefix database by the name "Schneider" will not find it.
The same prefix is carried by RP-C room controllers and AS-B servers. The server is distinguished from RP-C by its open TCP ports — the controller has none. From AS-B it is distinguished only by model-name in BACnet; without that field the model cannot be determined.
port layout
The front consists of three bands. The top and bottom covers are tinted, almost black. The middle band carries, from the left: the Reset hole, a block of four RS-485 LEDs (columns A and B, rows for transmit and receive), below it the USB mini-B port, then the Ethernet 1 and Ethernet 2 LEDs, the LON and LON Mode LEDs, and in the bottom right corner the Status LED. The drawing above is a to-scale schematic made from the manufacturer's dimensioned view.
No RJ45 port is visible from the front. The bottom edge carries, from the left: USB-A, Ethernet 1 and Ethernet 2 — the plug goes in from below. Three removable terminal plugs protrude 9 mm from the top edge:
| terminals | purpose |
|---|---|
| 1–4 | RS-485 Com A: TX/RX+, TX/RX−, RET, Bias+ |
| 5–7 | RS-485 Com B: TX/RX+, TX/RX−, RET |
| 8–12 | RS-485 or LonWorks: TX/RX+, TX/RX−, RET, LON-1, LON-2 |
The manufacturer gives the order of the ports on the edges, but does not dimension their positions.
what we cannot read
- Installation data — the controller list, sensor values or the program. All of that is behind the WebStation login.
- Distinguishing AS-P from AS-B without BACnet — the certificate, ports and MAC prefix are shared.
- LED colors first-hand — the manufacturer's help gives them, but does not serve the page to automated clients; the colors come from a weaker source than the LED positions.
- Whether AS-P-NL identifies itself in BACnet as "AS-P" — not checked. If it does,
model-namealone will not distinguish the variant without LonWorks.
full parameter list
A full parameter list for this model is not here yet — the ones described above are those we have read and verified. A missing list does not mean the device exposes nothing more.