S06 - 281300 - Physical Access Control System.pdf

VA Project No. 537-19-125

AE Works Project No. VJES-01

Jesse Brown VA Medical Center

Renovate Electronic Security System

Issued for Bid and Construction

PHYSICAL ACCESS CONTROL SYSTEM

28 13 00 - 1

SECTION 28 13 00

PHYSICAL ACCESS CONTROL SYSTEM

PART 1 – GENERAL

1.1 DESCRIPTION

A. This section specifies the finishing, installation, connection, testing and certification of a complete and fully operating Physical Access

Control System, hereinafter referred to as the PACS.

B. This Section includes a Physical Access Control System consisting of a system server, one or more networked workstation computers, operating system and application software, and field-installed Controllers connected by a high-speed electronic data transmission network. The

PACS shall have the following:

1. Physical Access Control:

a. Regulating access through doors, gates, or other access-control devices.

b. Visitor assignment

c. Surge and tamper protection

d. Secondary alarm annunciator

e. Credential cards and readers

f. Push-button switches

g. RS-232 ASCII interface

h. Credential creation and credential holder database and management

i. Monitoring of field-installed devices

j. Interface with IDS, SSTV, and DSPI

k. Reporting

2. Security:

a. Intrusion detection

b. Duress/ Panic

C. System Architecture:

1. Criticality, operational requirements, and/or limiting points of failure may dictate the development of an enterprise and regional server architecture as opposed to system capacity. Provide server and workstation configurations with all necessary connectors, interfaces and accessories as shown.

ACCOMPANYING 36C25222B0016 0002

Jesse Brown VA Medical Center

Renovate Electronic Security System

Issued for Bid and Construction

PHYSICAL ACCESS CONTROL SYSTEM

28 13 00 - 2

D. PACS shall provide secure and reliable identification of Federal employees and contractors by utilizing credential authentication per

FIPS-201.

E. Physical Access Control System (PACS) shall consist of:

1. Head-End equipment server,

2. One or more networked PC-based workstations,

3. Physical Access Control System and Database Management Software,

4. Credential validation software/hardware,

5. Field installed controllers,

6. PIV Middleware,

7. Card readers,

8. Biometric identification devices,

9. PIV cards,

10. Supportive information system,

11. Door locks and sensors,

12. Power supplies,

13. Interfaces with:

a. Video Surveillance and Assessment System

b. Gate, turnstile, and traffic arm controls

c. Automatic door operators

d. Intrusion Detection System

e. Intercommunication System

f. Fire Protection System

g. HVAC

h. Building Management System

i. Elevator Controls

F. Head-End equipment server, workstations and controllers shall be connected by a high-speed electronic data transmission network.

G. Information system supporting PACS, Head-End equipment server, workstations, network switches, routers and controllers shall comply with FIPS 200 requirements (Minimum Security Requirements for Federal

Information and Information Systems)and NIST Special Publication 800-53

(Recommended Security Controls for Federal Information Systems).

H. PACS system shall support:

1. Multiple credential authentication modes,

2. Bidirectional communication with the reader, Jesse Brown VA Medical Center

28 13 00 - 3

3. Incident response policy implementation capability; system shall have capability to automatically change access privileges for certain user groups to high security areas in case of incident/emergency.

4. Visitor management, I. All security relevant decisions shall be made on “secure side of the door”. Secure side processing shall include:

1. Challenge/response management.

2. PKI path discovery and validation.

3. Credential identifier processing.

4. Authorization decisions.

J. For locations where secure side processing is not applicable the tamper switches and certified cryptographic processing shall be provided per

FIPS-140-2.

K. System Software: Based on <Insert name of operating system> central-station, workstation operating system, server operating system, and application software.

L. Software and controllers shall be capable of matching full 56-bit FASC-

N plus minimum of 32 bits of public key certificate data.

M. Software shall have the following capabilities:

1. Multiuser multitasking to allow for independent activities and monitoring to occur simultaneously at different workstations.

2. Support authentication and enrollment:

a. PIV verification.

b. Expiration date check.

c. Biometric check.

d. Digital photo display/check.

e. Validate digital signatures of data objects (Objects are signed by the Trusted Authority).

f. Private key challenge (CAK & PAK to verify private key public key pairs exist and card is not a clone).

3. Support CRL validation via OCSP or SCVP on a scheduled basis and automatically deny access to any revoked credential in the system.

4. Graphical user interface to show pull-down menus and a menu tree format that complies with interface guidelines of Microsoft Windows operating system.

Jesse Brown VA Medical Center

28 13 00 - 4

5. System license shall be for the entire system and shall include capability for future additions that are within the indicated system size limits specified in this Section.

6. System shall have open architecture that allows importing and exporting of data and interfacing with other systems that are compatible with operating system.

7. Operator login and access shall be utilized via integrated smart card reader and password protection.

N. Systems Networks:

1. A standalone system network shall interconnect all components of the system. This network shall include communications between a central station and any peer or subordinate workstations, enrollment stations, local annunciation stations, portal control stations or redundant central stations.

O. Security Management System Server Redundancy:

1. The SMS shall support multiple levels of fault tolerance and SMS redundancy listed and described below:

a. Hot Standby Servers

b. Clustering

c. Disk Mirroring

d. RAID Level 10

e. Distributed Intelligence

P. Number of points:

1. PACS shall support multiple autonomous regional servers that can connect to a master command and controller server.

2. Unlimited number of access control readers, unlimited number of inputs or outputs, unlimited number of client workstations, unlimited number of cardholders.

3. Total system solution to enable enterprise-wide, networked, multi-user access to all system resources via a wide range of options for connectivity with the customer’s existing LAN and WAN.

Q. Console Network:

1. Console network, if required, shall provide communication between a central station and any subordinate or separate stations of the system. Where redundant central or parallel stations are required, the console network shall allow the configuration of stations as master and slave. The console network may be a part of the field

Jesse Brown VA Medical Center

28 13 00 - 5 device network or may be separate depending upon the manufacturer's system configuration.

R. Network(s) connecting PCs and Controllers shall comply with NIST

Special Publication 800-53 (Recommended Security Controls for Federal

Information Systems) and consist of one or more of the following:

1. Local area, IEEE 802.3 Fast Ethernet [10 BASE-T] [100 BASE-TX], star topology network based on TCP/IP.

2. Direct-connected, RS-232 cable from the COM port of the Central

Station to the first Controller, then RS-485 to interconnect the remainder of the Controllers at that Location.

1.2 RELATED WORK

A. Section 01 00 00 - GENERAL REQUIREMENTS. For General Requirements.

B. Section 07 84 00 - FIRESTOPPING. Requirements for firestopping application and use.

C. Section 08 71 00 - DOOR HARDWARE. Requirements for door installation.

D. Section 26 05 11 - REQUIREMENTS FOR ELECTRICAL INSTALLATIONS.

Requirements for connection of high voltage.

E. Section 26 05 19 - LOW VOLTAGE ELECTRICAL POWER CONDUCTORS AND CABLES

(600 VOLTS AND BELOW). Requirements for power cables.

F. Section 26 05 33 – RACEWAYS AND BOXES FOR ELECTRICAL SYSTEMS.

Requirements for infrastructure.

G. Section 28 05 00 - COMMON WORK RESULTS FOR ELECTRONIC SAFETY AND

SECURITY. For general requirements that are common to more than one section in Division 28.

H. Section 28 05 13 - CONDUCTORS AND CABLES FOR ELECTRONIC SAFETY AND

SECURITY. Requirements for conductors and cables.

I. Section 28 05 26 - GROUNDING AND BONDING FOR ELECTRONIC SAFETY AND

SECURITY. Requirements for grounding of equipment.

J. Section 28 05 28.33 - CONDUITS AND BOXES FOR ELECTRONIC SAFETY AND

SECURITY. Requirements for infrastructure.

K. Section 28 08 00 - COMMISSIONING OF ELECTRONIC SAFETY AND SECURITY. For requirements for commissioning, systems readiness checklists, and training.

L. Section 28 13 16 - PHYSICAL ACCESS CONTROL SYSTEM AND DATABASE

MANAGEMENT. Requirements for control and operation of all security systems.

Jesse Brown VA Medical Center

28 13 00 - 6

M. Section 28 16 00 - INTRUSION DETECTION SYSTEM (IDS). Requirements for alarm systems.

N. Section 28 26 00 - ELECTRONIC PERSONAL PROTECTION SYSTEM (EPPS).

Requirements for emergency and interior communications.

1.3 QUALITY ASSURANCE

A. Refer to 28 05 00 COMMON WORK RESULTS FOR ELECTRONIC SAFETY AND

SECURITY, Part 1.

1.4 SUBMITTALS

1.5 APPLICABLE PUBLICATIONS

1.6 COORDINATION

1.7 MAINTENANCE & SERVICE

1.8 PERFORMANCE REQUIREMENTS

A. PACS shall provide support for multiple authentication modes and bidirectional communication with the reader. PACS shall provide implementation capability for enterprise security policy and incident response.

B. All processing of authentication information must occur on the “safe side” of a door.

C. Physical Access Control System shall provide access to following

Security Areas:

1. Controlled

2. Limited

3. Exclusion

Jesse Brown VA Medical Center

28 13 00 - 7

D. PACS shall provide:

1. One authentication factor for access to Controlled security areas.

2. Two authentication factors for access to Limited security areas.

3. Three authentication factors for access to Exclusion security areas.

E. PACS shall provide Credential Validation and Path Validation per NIST

800-116.

F. The PACS System shall have an Enterprise Path Validation Module (PVM) component that processes X.509 certification paths composed of X.509 v3 certificates and X.509 v2 CRLs. The PVM component MUST support the following features:

1. Name chaining.

2. Signature chaining.

3. Certificate validity.

4. Key usage, basic constraints, and certificate policies certificate extensions.

5. Full CRLs.

6. CRLs segmented on names.

G. Distributed Processing: System shall be a fully distributed processing system so that information, including time, date, valid codes, access levels, and similar data, is downloaded to Controllers so that each

Controller makes access-control decisions for that Location. Do not use intermediate Controllers for physical access control. If communications to Central Station are lost, all Controllers shall automatically buffer event transactions until communications are restored, at which time buffered events shall be uploaded to the

Central Station.

H. Number of Locations: Support unlimited number of separate Locations using a single PC with combinations of direct-connect, dial-up, or

TCP/IP LAN connections to each Location.

1. Each Location shall have its own database and history in the

Central Station. Locations may be combined to share a common database.

I. Data Capacity:

1. 130 different card-reader formats.

2. 999 comments.

3. 16 graphic file types for importing maps.

J. Location Capacity:

Jesse Brown VA Medical Center

28 13 00 - 8

1. 128 reader-controlled doors.

2. 50,000 total access credentials.

3. 2,048 supervised alarm inputs.

4. 2,048 programmable outputs.

5. 32,000 custom action messages per Location to instruct operator on action required when alarm is received.

K. System Network Requirements:

1. Interconnect system components and provide automatic communication of status changes, commands, field-initiated interrupts, and other communications required for proper system operation.

2. Communication shall not require operator initiation or response and shall return to normal after partial or total network interruption such as power loss or transient upset.

3. System shall automatically annunciate communication failures to the operator and identify the communication link that has experienced a partial or total failure.

4. Communications Controller may be used as an interface between the

Central Station display systems and the field device network.

Communications Controller shall provide functions required to attain the specified network communications performance.

L. Central Station shall provide operator interface, interaction, display, control, and dynamic and real-time monitoring. Central Station shall control system networks to interconnect all system components, including workstations and field-installed Controllers.

M. Field equipment shall include Controllers, sensors, and controls.

Controllers shall serve as an interface between the Central Station and sensors and controls. Data exchange between the Central Station and the

Controllers shall include down-line transmission of commands, software, and databases to Controllers. The up-line data exchange from the

Controller to the Central Station shall include status data such as intrusion alarms, status reports, and entry-control records.

Controllers are classified as alarm-annunciation or entry-control type.

N. System Response to Alarms: Alarms shall be annunciated at the Central

Station within 1 second of the alarm occurring at a Controller or device controlled by a local Controller, and within 100 ms if the alarm occurs at the Central Station. Alarm and status changes shall be displayed within 100 ms after receipt of data by the Central Station.

Jesse Brown VA Medical Center

28 13 00 - 9

All graphics shall be displayed, including graphics-generated map displays, on the console monitor within 5 seconds of alarm receipt at the security console. This response time shall be maintained during system heavy load.

O. False Alarm Reduction: The design of Central Station and Controllers shall contain features to reduce false alarms. Equipment and software shall comply with SIA CP-01.

P. Error Detection: A cyclic code error detection method shall be used between Controllers and the Central Station, which shall detect single-and double-bit errors, burst errors of eight bits or less, and at least

99 percent of all other multibit and burst error conditions.

Interactive or product error detection codes alone will not be acceptable. A message shall be in error if one bit is received incorrectly. System shall retransmit messages with detected errors. A two-digit decimal number shall be operator assignable to each communication link representing the number of retransmission attempts.

When the number of consecutive retransmission attempts equals the assigned quantity, the Central Station shall print a communication failure alarm message. System shall monitor the frequency of data transmission failure for display and logging.

Q. Data Line Supervision: System shall initiate an alarm in response to opening, closing, shorting, or grounding of data transmission lines.

R. Door Hardware Interface: Coordinate with Division 08 Sections that specify door hardware required to be monitored or controlled by the

PACS. The Controllers in this Section shall have electrical characteristics that match the signal and power requirements of door hardware. Integrate door hardware specified in Division 08 Sections to function with the controls and PC-based software and hardware in this

Section.

S. References to industry and trade association standards and codes are minimum installation requirement standards.

T. Drawings and other specification sections shall govern in those instances where requirements are greater than those specified in the above standards.

Jesse Brown VA Medical Center

28 13 00 - 10

1.9 EQUIPMENT AND MATERIALS

1.10 WARRANTY OF CONSTRUCTION

A. Warrant PACS work subject to the Article “Warranty of Construction” of

FAR clause 52.246-21.

B. Demonstration and training shall be performed prior to system acceptance.

1.11 GENERAL REQUIREMENTS

A. For general requirements that are common to more than one section in

Division 28 refer to Section 28 05 00, REQUIREMENTS FOR ELECTRONIC

SAFETY AND SECURITY INSTALLATIONS.

B. General requirements applicable to this section include:

1. General Arrangement of Contract Documents.

2. Delivery, Handling and Storage.

3. Project Conditions.

4. Electrical Power.

5. Lightning, Power Surge Suppression, and Grounding.

6. Electronic Components.

7. Substitute Materials and Equipment.

8. Like Items.

PART 2 – PRODUCTS

2.1 GENERAL

A. All equipment and materials for the system will be compatible to ensure correct operation as outlined in FIPS 201, March 2006 and HSPD-12.

B. The security system characteristics listed in this section will serve as a guide in selection of equipment and materials for the PACS. If updated or more suitable versions are available, then the Contracting

Officer will approve the acceptance of prior to an installation.

C. PACS equipment shall meet or exceed all requirements listed below.

D. A PACS shall be comprised of, but not limited to, the following components:

1. Physical Access Control System

2. Application Software

Jesse Brown VA Medical Center

28 13 00 - 11

3. System Database

4. Surge and Tamper Protection

5. Standard Workstation Hardware

6. Communications Workstation

7. Controllers (Data Gathering Panel)

8. Secondary Alarm Annunciator

9. Keypads

10. Card Readers

11. Credential Cards

12. Biometric Identity Verification Equipment

13. Enrolment Center (To be provided in accordance with the VA PIV enrollment and issuance system.)

14. System Sensors and Related Equipment

15. Push Button Switches

16. Interfaces

17. Door and Gate Hardware interface

18. RS-232 ASCII Interface

19. Floor Select Elevator Control

20. Video and Camera Control

21. Cables

22. Transformers

2.2 SECURITY MANAGEMENT SYSTEM (SMS)

A. Shall allow the configuration of an enrollment and badging, alarm monitoring, administrative, asset management, digital video management, intrusion detection, visitor enrollment, remote access level management, and integrated client workstations or any combination of all or some.

B. Shall be expandable to support an unlimited number of individual module or integrated client workstations. All access control field hardware, including Data Gathering Panels (DGP), shall be connected to all physical access control system workstation on the network.

C. Shall have the ability to compose, file, maintain, update, and print reports for either individuals or the system as follows.

1. Individual reports that consist of an employee’s name, office location, phone number or direct extension, and normal hours of operation. The report shall provide a detail listing of the

Jesse Brown VA Medical Center

28 13 00 - 12 employee’s daily events in relation to accessing points within a facility.

2. System reports shall be able to produce information on a daily/weekly/monthly basis for all events, alarms, and any other activity associated with a system user.

D. All reports shall be in a date/time format and all information shall be clearly presented. Shall be designed to allow it to work with any industry standard network protocol and topology listed below:

1. Transmission Control Protocol (TCP)/IP

2. Novell Netware (IPX/SPX)

3. Banyan VINES

4. IBM LAN Server (NetBEUI)

5. Microsoft LAN Manager (NetBEUI)

6. Network File System (NFS) Networks

7. Remote Access Service (RAS) via ISDN, x.25, and standard phone lines.

E. Shall provide full interface and control of the PACS to include the following subsystems within the PACS:

1. Public Key Infrastructure

2. Card Management

3. Identity and Access Management

4. Personal Identity Verification

F. Shall have the following features or compatibilities:

1. The ability to be operated locally or remotely via a LAN, WAN, internet, or intranet.

2. Event and Alarm Monitoring

3. Database Partitioning

4. Ability to fully integrate with all other security subsystems

5. Enhanced Monitoring Station with Split Screen Views

6. Alternate and Extended Shunt by Door

7. Escort Management

8. Enhanced IT-based Password Protection

9. N-man Rule and Occupancy Restrictions

10. Open Journal Data Format for Enhanced Reporting

11. Automated Personnel Import

12. ODBC Support

Jesse Brown VA Medical Center

28 13 00 - 13

13. Windows 2000 Professional, Windows Server 2003, Windows XP

Professionals for Servers, Windows 7

14. Field-Level Audit Trail

15. Cardholder Access Events

2.3 APPLICATION SOFTWARE

A. System Software: Based on 32 -bit, Microsoft Windows central-station and workstation operating system and application software. Software shall have the following features:

1. Multiuser multitasking to allow independent activities and monitoring to occur simultaneously at different workstations.

2. Graphical user interface to show pull-down menus and a menu tree format.

3. Capability for future additions within the indicated system size limits.

4. Open architecture that allows importing and exporting of data and interfacing with other systems that are compatible with operating system.

5. Password-protected operator and smart card login and access.

B. Peer Computer Control Software: Shall detect a failure of a central computer and shall cause the other central computer to assume control of all system functions without interruption of operation. Drivers shall be provided in both central computers to support this mode of operation.

C. Application Software: Interface between the alarm annunciation and entry-control Controllers, to monitor sensors and DTS links, operate displays, report alarms, generate reports, and help train system operators. Software shall have the following functions:

1. Resides at the Central Station, workstations, and Controllers as required to perform specified functions.

2. Operate and manage peripheral devices.

3. Manage files for disk I/O, including creating, deleting, and copying files; and automatically maintain a directory of all files, including size and location of each sequential and random-ordered record.

4. Import custom icons into graphics views to represent alarms and I/O devices.

Jesse Brown VA Medical Center

28 13 00 - 14

5. Globally link I/O so that any I/O can link to any other I/O within the same Location, without requiring interaction with the host PC.

This operation shall be at the Controller.

6. Globally code I/O links so that any access-granted event can link to any I/O with the same Location without requiring interaction with the host PC. This operation shall be at the Controller.

7. Messages from PC to Controllers and Controllers to Controllers shall be on a polled network that utilizes check summing and acknowledgment of each message. Communication shall be automatically verified, buffered, and retransmitted if message is not acknowledged.

8. Selectable poll frequency and message time-out settings shall handle bandwidth and latency issues for TCP/IP, RF, and other PC-to-

Controller communications methods by changing the polling frequency and the amount of time the system waits for a response.

9. Automatic and encrypted backups for database and history backups shall be automatically stored at [the central control PC] [a selected workstation] and encrypted with a nine-character alphanumeric password, which must be used to restore or read data contained in backup.

10. Operator audit trail for recording and reporting all changes made to database and system software.

D. Workstation Software:

1. Password levels shall be individually customized at each workstation to allow or disallow operator access to program functions for each

Location.

2. Workstation event filtering shall allow user to define events and alarms that will be displayed at each workstation. If an alarm is unacknowledged (not handled by another workstation) for a preset amount of time, the alarm will automatically appear on the filtered workstation.

E. Controller Software:

1. Controllers shall operate as an autonomous intelligent processing unit. Controllers shall make decisions about physical access control, alarm monitoring, linking functions, and door locking schedules for its operation, independent of other system components.

Controllers shall be part of a fully distributed processing control

Jesse Brown VA Medical Center

28 13 00 - 15 network. The portion of the database associated with a Controller and consisting of parameters, constraints, and the latest value or status of points connected to that Controller, shall be maintained in the Controller.

2. Functions: The following functions shall be fully implemented and operational within each Controller:

a. Monitoring inputs.

b. Controlling outputs.

c. Automatically reporting alarms to the Central Station.

d. Reporting of sensor and output status to Central Station on request.

e. Maintaining real time, automatically updated by the Central

Station at least once a day.

f. Communicating with the Central Station.

g. Executing Controller resident programs.

h. Diagnosing.

i. Downloading and uploading data to and from the Central Station.

3. Controller Operations at a Location:

a. Location: Up to 64 Controllers connected to RS-485 communications loop. Globally operating I/O linking and anti-passback functions between Controllers within the same Location without central-station or workstation intervention. Linking and anti-passback shall remain fully functional within the same Location even when the Central Station or workstations are offline.

b. In the event of communications failure between the Central

Station and a Location, there shall be no degradation in operations at the Controllers at that Location. The Controllers at each Location shall be connected to a memory buffer with a capacity to store up to 10,000 events; there shall be no loss of transactions in system history files until the buffer overflows.

c. Buffered events shall be handled in a first-in-first-out mode of operation.

4. Individual Controller Operation:

a. Controllers shall transmit alarms, status changes, and other data to the Central Station when communications circuits are operable.

If communications are not available, Controllers shall function in a stand-alone mode and operational data, including the status

Jesse Brown VA Medical Center

28 13 00 - 16 and alarm data normally transmitted to the Central Station, shall be stored for later transmission to the Central Station. Storage capacity for the latest 1024 events shall be provided at each

Controller.

b. Card-reader ports of a Controller shall be custom configurable for at least 10 different card-reader or keypad formats.

Multiple reader or keypad formats may be used simultaneously at different Controllers or within the same Controller.

c. Controllers shall provide a response to card-readers or keypad entries in less than 0.25 seconds, regardless of system size.

d. Controllers that are reset, or powered up from a nonpowered state, shall automatically request a parameter download and reboot to its proper working state. This shall happen without any operator intervention.

e. Initial Startup: When Controllers are brought on-line, database parameters shall be automatically downloaded to them. After initial download is completed, only database changes shall be downloaded to each Controller.

f. Failure Mode: On failure for any reason, Controllers shall perform an orderly shutdown and force Controller outputs to a predetermined failure mode state, consistent with the failure modes shown and the associated control device.

g. Startup After Power Failure: After power is restored, startup software shall initiate self-test diagnostic routines, after which Controllers shall resume normal operation.

h. Startup After Controller Failure: On failure, if the database and application software are no longer resident, Controllers shall not restart, but shall remain in the failure mode until repaired. If database and application programs are resident, Controllers shall immediately resume operation. If not, software shall be restored automatically from the Central Station.

5. Communications Monitoring:

a. System shall monitor and report status of RS-485 communications loop; TCP/IP communication status of each Location.

b. Communication status window shall display which Controllers are currently communicating, a total count of missed polls since midnight, and which Controller last missed a poll.

Jesse Brown VA Medical Center

28 13 00 - 17

c. Communication status window shall show the type of CPU, the type of I/O board, and the amount of RAM memory for each Controller.

6. Operating systems shall include a real-time clock function that maintains seconds, minutes, hours, day, date, and month. The real-time clock shall be automatically synchronized with the Central

Station at least once a day to plus or minus 10 seconds. The time synchronization shall be automatic, without operator action and without requiring system shutdown.

F. PC-to-Controller Communications:

1. Central-station or workstation communications shall use the following:

a. Direct connection using serial ports of the PC.

b. TCP/IP LAN network interface cards.

c. Dial-up modems for connections to Locations.

2. Serial Port Configuration: Each serial port used for communications shall be individually configurable for "direct communications,"

"modem communications incoming and outgoing," or "modem communications incoming only"; or as an ASCII output port.

3. Multiport Communications Board: Use if more than two serial ports are needed.

a. Expandable and modular design. Use a 4-, 8-, or 16-serial port configuration that is expandable to 32 or 64 serial ports.

b. Connect the first board to an internal PCI bus adapter card.

4. Direct serial, TCP/IP, and dial-up communications shall be alike in the monitoring or control of system, except for the connection that must first be made to a dial-up Location.

5. TCP/IP network interface card shall have an option to set the poll frequency and message response time-out settings.

6. PC-to-Controller and Controller-to-Controller communications

(direct, dial-up, or TCP/IP) shall use a polled-communication protocol that checks sum and acknowledges each message. All communications shall be verified and buffered and retransmitted if not acknowledged.

G. Direct Serial or TCP/IP PC-to-Controller Communications:

1. Communication software on the PC shall supervise the PC-to-

Controller communications link.

Jesse Brown VA Medical Center

28 13 00 - 18

2. Loss of communications to any Controller shall result in an alarm at all PCs running the communications software.

3. When communications are restored, all buffered events shall automatically upload to the PC, and any database changes shall be automatically sent to the Controller.

H. Dial-up Modem PC-to-Controller Communications:

1. Communication software on the PC shall supervise the PC-to-

Controller communications link during dial-up modem connect times.

2. Communication software shall be programmable to routinely poll each of the remote dial-up modem Locations, collecting event logs and verifying phone lines at time intervals that are operator selectable for each Location.

3. System shall be programmable for dialing and connecting to all dial-up modem Locations and for retrieving the accrued history transactions on an automatic basis as often as once every 10 minutes and up to once every 9999 minutes.

4. Failure to communicate to a dial-up Location three times in a row shall result in an alarm at the PC.

5. Time offset capabilities shall be present so that Locations in a different geographical time zone than the host PC will be set to, and maintained at, the proper local time. This feature shall allow for geographical time zones that are ahead of or behind the host PC.

6. The Controller connected to a dial-up modem shall automatically buffer all normal transactions until its buffer reaches 80 percent of capacity. When the transaction buffer reaches 80 percent, the

Controller shall automatically initiate a call to the Central

Station and upload all transactions.

7. Alarms shall be reported immediately.

8. Dial-up modems shall be provided by manufacturer of the system.

Modems used at the Controller shall be powered by the Controller.

Power to the modem shall include battery backup if the Controller is so equipped.

I. Controller-to-Controller Communications:

1. Controller-to-Controller Communications: RS-485, 4-wire, point-to-point, regenerative (repeater) communications network methodology.

2. RS-485 communications signal shall be regenerated at each

Controller.

Jesse Brown VA Medical Center

28 13 00 - 19

J. Database Downloads:

1. All data transmissions from PCs to a Location, and between

Controllers at a Location, shall include a complete database checksum to check the integrity of the transmission. If the data checksum does not match, a full data download shall be automatically retransmitted.

2. If a Controller is reset for any reason, it shall automatically request and receive a database download from the PC. The download shall restore data stored at the Controller to their normal working state and shall take place with no operator intervention.

3. Software shall provide for setting downloads via dial-up connection to once per 24-hour period, with time selected by the operator.

4. Software shall provide for setting delays of database downloads for dial-up connections. Delays change the download from immediately to a delay ranging from 1 to 999 minutes.

K. Operator Interface:

1. Inputs in system shall have two icon representations, one for the normal state and one for the abnormal state.

2. When viewing and controlling inputs, displayed icons shall automatically change to the proper icon to display the current system state in real time. Icons shall also display the input's state, whether armed or bypassed, and if the input is in the armed or bypassed state due to a time zone or a manual command.

3. Outputs in system shall have two icon representations, one for the secure (locked) state and one for the open (unlocked) state.

4. Icons displaying status of the I/O points shall be constantly updated to show their current real-time condition without prompting by the operator.

5. The operator shall be able to scroll the list of I/Os and press the appropriate toolbar button, or right click, to command the system to perform the desired function.

6. Graphic maps or drawings containing inputs, outputs, and override groups shall include the following:

a. Database to import and store full-color maps or drawings and allow for input, output, and override group icons to be placed on maps.

Jesse Brown VA Medical Center

28 13 00 - 20

b. Maps to provide real-time display animation and allow for control of points assigned to them.

c. System to allow inputs, outputs, and override groups to be placed on different maps.

d. Software to allow changing the order or priority in which maps will be displayed.

7. Override Groups Containing I/Os:

a. System shall incorporate override groups that provide the operator with the status and control over user-defined "sets" of

I/Os with a single icon.

b. Icon shall change automatically to show the live summary status of points in that group.

c. Override group icon shall provide a method to manually control or set to time zone points in the group.

d. Override group icon shall allow the expanding of the group to show icons representing the live status for each point in the group, individual control over each point, and the ability to compress the individual icons back into one summary icon.

8. Schedule Overrides of I/Os and Override Groups:

a. To accommodate temporary schedule changes that do not fall within the holiday parameters, the operator shall have the ability to override schedules individually for each input, output, or override group.

b. Each schedule shall be composed of a minimum of two dates with separate times for each date.

c. The first time and date shall be assigned the override state that the point shall advance to, when the time and date become current.

d. The second time and date shall be assigned the state that the point shall return to, when the time and date become current.

9. Copy command in database shall allow for like data to be copied and then edited for specific requirements, to reduce redundant data entry.

L. Operator Access Control:

1. Control operator access to system controls through three password-protected operator levels. System operators and managers with

Jesse Brown VA Medical Center

28 13 00 - 21 appropriate password clearances shall be able to change operator levels for operators.

2. Three successive attempts by an operator to execute functions beyond their defined level during a 24-hour period shall initiate a software tamper alarm.

3. A minimum of 32 passwords shall be available with the system software. System shall display the operator's name or initials in the console's first field. System shall print the operator's name or initials, action, date, and time on the system printer at login and logoff.

4. The password shall not be displayed or printed.

5. Each password shall be definable and assignable for the following:

a. Commands usable.

b. Access to system software.

c. Access to application software.

d. Individual zones that are to be accessed.

e. Access to database.

M. Operator Commands:

1. Command Input: Plain-language words and acronyms shall allow operators to use the system without extensive training or data-processing backgrounds. System prompts shall be a word, a phrase, or an acronym.

2. Command inputs shall be acknowledged, and processing shall start in not less than one (1) second.

3. Tasks that are executed by operator's commands shall include the following:

a. Acknowledge Alarms: Used to acknowledge that the operator has observed the alarm message.

b. Place Zone in Access: Used to remotely disable intrusion alarm circuits emanating from a specific zone. System shall be structured so that console operator cannot disable tamper circuits.

c. Place Zone in Secure: Used to remotely activate intrusion alarm circuits emanating from a specific zone.

d. System Test: Allows the operator to initiate a system-wide operational test.

Jesse Brown VA Medical Center

28 13 00 - 22

e. Zone Test: Allows the operator to initiate an operational test for a specific zone.

f. Print reports.

g. Change Operator: Used for changing operators.

h. Security Lighting Controls: Allows the operator to remotely turn on/off security lights.

i. Display Graphics: Used to display any graphic displays implemented in the system. Graphic displays shall be completed within 20 seconds from time of operator command.

j. Run system tests.

k. Generate and format reports.

l. Request help with the system operation.

1) Include in main menus.

2) Provide unique, descriptive, context-sensitive help for selections and functions with the press of one function key.

3) Provide navigation to specific topic from within the first help window.

4) Help shall be accessible outside the applications program.

m. Entry-Control Commands:

1) Lock (secure) or unlock (open) each controlled entry and exit up to four times a day through time-zone programming.

2) Arm or disarm each monitored input up to four times a day through time-zone programming.

3) Enable or disable readers or keypads up to twice a day through time-zone programming.

4) Enable or disable cards or codes up to four times per day per entry point through access-level programming.

4. Command Input Errors: Show operator input assistance when a command cannot be executed because of operator input errors. Assistance screen shall use plain-language words and phrases to explain why the command cannot be executed. Error responses that require an operator to look up a code in a manual or other document are not acceptable. Conditions causing operator assistance messages include the following:

a. Command entered is incorrect or incomplete.

b. Operator is restricted from using that command.

c. Command addresses a point that is disabled or out of service.

Jesse Brown VA Medical Center

28 13 00 - 23

d. Command addresses a point that does not exist.

e. Command is outside the system's capacity.

N. Alarms:

1. System Setup:

a. Assign manual and automatic responses to incoming point status change or alarms.

b. Automatically respond to input with a link to other inputs, outputs, operator-response plans, unique sound with use of WAV files, and maps or images that graphically represent the point location.

c. 60-character message field for each alarm.

d. Operator-response-action messages shall allow message length of at least 65,000 characters, with database storage capacity of up to 32,000 messages. Setup shall assign messages to access points, zones, and sensors.

e. Secondary messages shall be assignable by the operator for printing to provide further information and shall be editable by the operator.

f. Allow 25 secondary messages with a field of 4 lines of 60 characters each.

g. Store the most recent 1000 alarms for recall by the operator using the report generator.

2. Software Tamper:

a. Annunciate a tamper alarm when unauthorized changes to system database files are attempted. Three consecutive unsuccessful attempts to log onto system shall generate a software tamper alarm.

b. Annunciate a software tamper alarm when an operator or other individual makes three consecutive unsuccessful attempts to invoke functions beyond their authorization level.

c. Maintain a transcript file of the last 5000 commands entered at the each Central Station to serve as an audit trail. System shall not allow write access to system transcript files by any person, regardless of their authorization level.

d. Allow only acknowledgment of software tamper alarms.

Jesse Brown VA Medical Center

28 13 00 - 24

3. Read access to system transcript files shall be reserved for operators with the highest password authorization level available in system.

4. Animated Response Graphics: Highlight alarms with flashing icons on graphic maps; display and constantly update the current status of alarm inputs and outputs in real time through animated icons.

5. Multimedia Alarm Annunciation: WAV files to be associated with alarm events for audio annunciation or instructions.

6. Alarm Handling: Each input may be configured so that an alarm cannot be cleared unless it has returned to normal, with options of requiring the operator to enter a comment about disposition of alarm. Allow operator to silence alarm sound when alarm is acknowledged.

7. Alarm Automation Interface: High-level interface to Central Station alarm automation software systems. Allows input alarms to be passed to and handled by automation systems in same manner as burglar alarms, using an RS-232 ASCII interface.

8. CCTV Alarm Interface: Allow commands to be sent to CCTV systems during alarms (or input change of state) through serial ports.

9. Camera Control: Provides operator ability to select and control cameras from graphic maps.

O. Alarm Monitoring: Monitor sensors, Controllers, and DTS circuits and notify operators of an alarm condition. Display higher-priority alarms first and, within alarm priorities, display the oldest unacknowledged alarm first. Operator acknowledgment of one alarm shall not be considered acknowledgment of other alarms nor shall it inhibit reporting of subsequent alarms.

1. Displayed alarm data shall include type of alarm, location of alarm, and secondary alarm messages.

2. Printed alarm data shall include type of alarm, location of alarm, date and time (to nearest second) of occurrence, and operator responses.

3. Maps shall automatically display the alarm condition for each input assigned to that map, if that option is selected for that input location.

4. Alarms initiate a status of "pending" and require the following two handling steps by operators:

Jesse Brown VA Medical Center

28 13 00 - 25

a. First Operator Step: "Acknowledged." This action shall silence sounds associated with the alarm. The alarm remains in the system

"Acknowledged" but "Unresolved."

b. Second Operator Step: Operators enter the resolution or operator comment, giving the disposition of the alarm event. The alarm shall then clear.

5. Each workstation shall display the total pending alarms and total unresolved alarms.

6. Each alarm point shall be programmable to disallow the resolution of alarms until the alarm point has returned to its normal state.

7. Alarms shall transmit to Central Station in real time, except for allowing connection time for dial-up locations.

8. Alarms shall be displayed and managed from a minimum of four different windows.

a. Input Status Window: Overlay status icon with a large red blinking icon. Selecting the icon will acknowledge the alarm.

b. History Log Transaction Window: Display name, time, and date in red text. Selecting red text will acknowledge the alarm.

c. Alarm Log Transaction Window: Display name, time, and date in red. Selecting red text will acknowledge the alarm.

d. Graphic Map Display: Display a steady colored icon representing each alarm input location. Change icon to flashing red when the alarm occurs. Change icon from flashing red to steady red when the alarm is acknowledged.

9. Once an alarm is acknowledged, the operator shall be prompted to enter comments about the nature of the alarm and actions taken.

Operator's comments may be manually entered or selected from a programmed predefined list, or a combination of both.

10. For locations where there are regular alarm occurrences, provide programmed comments. Selecting that comment shall clear the alarm.

11. The time and name of the operator who acknowledged and resolved the alarm shall be recorded in the database.

12. Identical alarms from same alarm point shall be acknowledged at same time the operator acknowledges the first alarm. Identical alarms shall be resolved when the first alarm is resolved.

13. Alarm functions shall have priority over downloading, retrieving, and updating database from workstations and Controllers.

Jesse Brown VA Medical Center

28 13 00 - 26

14. When a reader-controlled output (relay) is opened, the corresponding alarm point shall be automatically bypassed.

P. Monitor Display: Display text and graphic maps that include zone status integrated into the display. Colors are used for the various components and current data. Colors shall be uniform throughout the system.

1. Color Code:

a. FLASHING RED: Alerts operator that a zone has gone into an alarm or that primary power has failed.

b. STEADY RED: Alerts operator that a zone is in alarm and alarm has been acknowledged.

c. YELLOW: Advises operator that a zone is in access.

d. GREEN: Indicates that a zone is secure, and that power is on.

2. Graphics:

a. Support 32,000 graphic display maps and allow import of maps from a minimum of 16 standard formats from another drawing or graphics program.

b. Allow I/O to be placed on graphic maps by the drag-and-drop method.

c. Operators shall be able to view the inputs, outputs, and the point's name by moving the mouse cursor over the point on graphic map.

d. Inputs or outputs may be placed on multiple graphic maps. The operator shall be able to toggle to view graphic map associated with inputs or outputs.

e. Each graphic map shall have a display-order sequence number associated with it to provide a predetermined order when toggled to different views.

f. Camera icons shall have the ability to be placed on graphic maps that, when selected by an operator, will open a video window, display the camera associated with that icon, and provide pan-tilt-zoom control.

g. Input, output, or camera placed on a map shall allow the ability to arm or bypass an input, open or secure an output, or control the pan-tilt-zoom function of the selected camera.

Q. System test software enables operators to initiate a test of the entire system or of a particular portion of the system.

Jesse Brown VA Medical Center

28 13 00 - 27

1. Test Report: The results of each test shall be stored for future display or printout. The report shall document the operational status of system components.

R. Report Generator Software: Include commands to generate reports for displaying, printing, and storing on disk and tape. Reports shall be stored by type, date, and time. Report printing shall be the lowest priority activity. Report generation mode shall be operator selectable but set up initially as periodic, automatic, or on request. Include time and date printed and the name of operator generating the report.

Report formats may be configured by operators.

1. Automatic Printing: Setup shall specify, modify, or inhibit the report to be generated; the time the initial report is to be generated; the time interval between reports; the end of period; and the default printer.

2. Printing on Requests: An operator may request a printout of any report.

3. Alarm Reports: Reporting shall be automatic as initially set up.

Include alarms recorded by system over the selected time and information about the type of alarm, such as door alarm, intrusion alarm, tamper alarm, etc., and the type of sensor, the location, the time, and the action taken.

4. Access and Secure Reports: Document zones placed in access, the time placed in access, and the time placed in secure mode.

5. Custom Reports: Reports tailored to exact requirements of who, what, when, and where. As an option, custom report formats may be stored for future printing.

6. Automatic History Reports: Named, saved, and scheduled for automatic generation.

7. Cardholder Reports: Include data, or selected parts of the data, as well as the ability to be sorted by name, card number, imprinted number, or by any of the user-defined fields.

8. Cardholder by Reader Reports: Based on who has access to a specific reader or group of readers by selecting the readers from a list.

9. Cardholder by Access-Level Reports: Display everyone that has been assigned to the specified access level.

10. Who Is In (Muster) Report:

Jesse Brown VA Medical Center

28 13 00 - 28

a. Emergency Muster Report: One click operation on toolbar launches report.

b. Cardholder Report. Contain a count of persons that are "In" at a selected Location and a count with detailed listing of name, date, and time of last use, sorted by the last…