Repair B134 Spec - 28 10 05.pdf

SECTION 28 10 05

ELECTRONIC SECURITY SYSTEMS (ESS)

05/16

PART 1 GENERAL

1.1 REFERENCES

The publications listed below form a part of this specification to the extent referenced. The publications are referred to within the text by the basic designation only.

AMERICAN NATIONAL STANDARDS INSTITUTE (ANSI)

ASC/X9 X9.52 (1998) Triple Data Encryption Algorithm Modes of Operation

ASTM INTERNATIONAL (ASTM)

ASTM A123/A123M (2017) Standard Specification for Zinc (Hot-Dip Galvanized) Coatings on Iron and Steel Products

ASTM B32 (2008; R 2014) Standard Specification for Solder Metal

ASTM D709 (2017) Standard Specification for Laminated Thermosetting Material

BUILDERS HARDWARE MANUFACTURERS ASSOCIATION (BHMA)

ANSI/BHMA A156.23 (2010) Electromagnetic Locks

INSTITUTE OF ELECTRICAL AND ELECTRONICS ENGINEERS (IEEE)

IEEE 802.3 (2018) Ethernet

IEEE C2 (2017; Errata 1-2 2017; INT 1 2017) National Electrical Safety Code

INTELLIGENCE COMMUNITY STANDARD (ICS)

ICS 705-1 (2010) Physical and Technical Security Standard for Sensitive Compartmented Information Facilities

INTERNATIONAL ORGANIZATION FOR STANDARDIZATION (ISO)

ANSI ISO/IEC 7816 (R 2009) Identification Cards - Integrated Circuit Cards

NATIONAL ELECTRICAL MANUFACTURERS ASSOCIATION (NEMA)

NEMA 250 (2018) Enclosures for Electrical Equipment (1000 Volts Maximum)

Repair B134 HQ & Admin Facility Type B-3 Final McGhee Tyson ANG Base, TN April 2023

D3167700 SECTION 28 10 05 Page 1

PSXE152017

Control and Systems: General Requirements

NEMA ICS 2 (2000; R 2005; Errata 2008) Industrial Control and Systems Controllers, Contactors, and Overload Relays Rated 600 V

NEMA ICS 6 (1993; R 2016) Industrial Control and Systems: Enclosures

NATIONAL FIRE PROTECTION ASSOCIATION (NFPA)

NFPA 70 (2017; ERTA 1-2 2017; TIA 17-1; TIA 17-2;

TIA 17-3; TIA 17-4; TIA 17-5; TIA 17-6;

TIA 17-7; TIA 17-8; TIA 17-9; TIA 17-10;

TIA 17-11; TIA 17-12; TIA 17-13; TIA

17-14; TIA 17-15; TIA 17-16; TIA 17-17 )

National Electrical Code

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST)

NIST FIPS 140-2 (2001) Security Requirements for Cryptographic Modules

NIST FIPS 197 (2001) Advance Encryption Standard

NIST FIPS 201-2 (2013) Personal Identity Verification (PIV) of Federal Employees and Contractors

OPEN NETWORK VIDEO INTERFACE FORUM (ONVIF)

ONVIF (2017) Core Specification Version 17.06

TELECOMMUNICATIONS INDUSTRY ASSOCIATION (TIA)

TIA-222 (2005G; Add 1 2007; Add 2 2009; Add 3 2014; Add 4 2014; R 2014; R 2016) Structural Standards for Steel Antenna Towers and Antenna Supporting Structures

TIA-568-C.2 (2009; Errata 2010; Add 2 2014; Add 1 2016) Balanced Twisted-Pair Telecommunications Cabling and Components Standards

TIA-606 (2017c) Administration Standard for the Telecommunications Infrastructure

U.S. DEPARTMENT OF DEFENSE (DOD)

DODI 8500.01 (2014) Cybersecurity

U.S. NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

47 CFR 15 Radio Frequency Devices

UNDERWRITERS LABORATORIES (UL)

UL 1037 (2016; Reprint Sep 2017) UL Standard for Safety Antitheft Alarms and Devices

Repair B134 HQ & Admin Facility Type B-3 Final McGhee Tyson ANG Base, TN April 2023

D3167700 SECTION 28 10 05 Page 2

UL 1076 (2018) UL Standard for Safety Proprietary Burglar Alarm Units and Systems

UL 1610 (2016) UL Standard for Safety Central-Station Burglar-Alarm Units

UL 294 (2018; Reprint Oct 2018) UL Standard for Safety Access Control System Units

UL 437 (2013; Reprint Oct 2017) UL Standard for Safety Key Locks

UL 50 (2015) UL Standard for Safety Enclosures for Electrical Equipment, Non-Environmental Considerations

UL 681 (2014) Installation and Classification of Burglar and Holdup Alarm Systems

UL 796 (2016) UL Standard for Safety Printed-Wiring Boards

UL 969 (2017; Reprint Mar 2018) UL Standard for Safety Marking and Labeling Systems

1.2 SUBMITTALS

Government approval is required for submittals with a "G" designation;

submittals not having a "G" designation are for Contractor Quality Control approval. When used, a designation following the "G" designation identifies the office that will review the submittal for the Government.

Submit the following in accordance with Section 01 33 00 SUBMITTAL

PROCEDURES:

The Base will review and will approve submittals requiring special review in this section.

SD-02 Shop Drawings

ESS Components; G

Overall System Schematic; G

SD-03 Product Data

Premise Control Unit; G

Detection Sensors; G

Access Control Unit; G

Access Control Devices; G

Cameras; G

Camera Lenses; G

Camera Housing and Mounts; G

Repair B134 HQ & Admin Facility Type B-3 Final McGhee Tyson ANG Base, TN April 2023

D3167700 SECTION 28 10 05 Page 3

Thermal Imaging System; G

Video Recording; G

Printers; G

Communications Interface Devices; G

Radio Frequency Link; G

Network Switch; G

Video and ESS Transmission; G

Infant Protection Alarm System (IPAS); G

Uninterruptible Power Supply (UPS); G

Batteries; G

Component Enclosure; G

Equipment Rack; G

SD-05 Design Data

Backup Battery Capacity Calculations; G

Access Control Throughput Rates; G

CCTV Storage Calculations

SD-07 Certificates

Contractor Qualifications; G

Instructor Qualifications; G

Data Encryption; G

SD-10 Operation and Maintenance Data

Training Plan; G

Training Content; G

ESS Components and ESS Software: Data Package 4; G

ESS Software and ESS Components: Data Package 4; G

Submit data package in accordance with Section 01 78 23

OPERATION AND MAINTENANCE DATA

SD-11 Closeout Submittals

As-Built Drawings; G

Repair B134 HQ & Admin Facility Type B-3 Final McGhee Tyson ANG Base, TN April 2023

D3167700 SECTION 28 10 05 Page 4

1.3 QUALITY ASSURANCE

1.3.1 Regulatory Requirements

The advisory provisions in each of the publications referred to in this specification are mandatory. Interpret these publications as though the word "must" has been substituted for "should" wherever it appears.

Interpret references in these publications to the "authority having jurisdiction," or words of similar meaning, to mean the Contracting Officer.

Equipment, materials, installation, and workmanship must be in accordance with the mandatory and advisory provisions of NFPA 70 unless more stringent requirements are specified or indicated.

1.3.2 Standard Products

Provide materials and equipment that are products of manufacturers regularly engaged in the production of such products which are of equal material, design and workmanship and:

a. Have been in satisfactory commercial or industrial use for 2 years prior to bid opening, and have been utilized in applications of equipment and materials under similar circumstances and of similar size.

b. Have been available on the commercial market through advertisements, manufacturers' catalogs, or brochures during the 2-year period.

c. Where two or more items of the same class of equipment are required, provide products of a single manufacturer.

d. Provide commercial off-the-shelf (COTS) products in which the manufacturer allows a network of qualified distributors to sell, install, integrate, maintain, and repair the hardware and software products that make up the system.

1.3.2.1 Alternative Qualifications

Products having less than a 2 year field service record will be acceptable if a certified record of satisfactory field operation for not less than 6000 hours, exclusive of the manufacturers' factory or laboratory tests, is furnished.

1.3.2.2 Material and Equipment Manufacturing Date

Products manufactured more than 1 year prior to date of delivery to the site are not acceptable.

1.3.2.3 Product Safety

System components are to conform to applicable rules and requirements of NFPA 70 . Equip system components with instruction stickers including warnings and cautions describing physical safety, and special or important procedures to be followed in operating and servicing system equipment.

Repair B134 HQ & Admin Facility Type B-3 Final McGhee Tyson ANG Base, TN April 2023

D3167700 SECTION 28 10 05 Page 5

1.3.3 Shop Drawings

1.3.3.1 ESS Components

Submit the ESS Components, Data Package 4 with the ESS Software submittal package in accordance with Section 01 78 23 OPERATION AND MAINTENANCE DATA.Submit drawings that clearly and completely indicate each ESS component function that includes:

a. Termination device points.

b. Interconnections required for system operation .

c. Interconnections between modules and devices.

d. Proposed wireway or conduit systems to be used including:

(1) Locations.

(2) Sizes.

(3) Types.

e. Drawings showing:

(1) Device locations and spacing.

(2) Mounting and positioning details.

(3) Riser Diagrams with cable sizes and types.

(4) Bill of Materials (Device make, model and quantities).

(5) Alarm and access control zones.

(6) CCTV and sensor coverage areas.

(7) Spare capacity.

1.3.3.2 Overall System Schematic

Indicate the relationship of integrated components on one-line diagram and show:

a. Power source .

b. System controls .

c. Impedance matches .

d. Interconnecting wire data including:

(1) Number.

(2) Size.

(3) Identification .

(4) Maximum lengths.

Repair B134 HQ & Admin Facility Type B-3 Final McGhee Tyson ANG Base, TN April 2023

D3167700 SECTION 28 10 05 Page 6

Repair B134 HQ & Admin Facility Type B-3 Final McGhee Tyson ANG Base, TN April 2023

1.3.4 Evidence of Experience and Qualifications

1.3.4.1 Contractor Qualifications

Submit experience and certified qualifications data prior to installation. Show that specific installers who will perform the work have a minimum of 2 years of experience successfully installing ESS of the same type and similar design as specified. Include the names, locations, and points of contact of at least two installations of similar type and design as specified in this document where the installer has installed such systems. Indicate the type of each system installed. Certify that each system has performed satisfactorily in the manner intended for a period of at least 12 months.

1.3.4.2 Instructor Qualifications

Submit the instructor's experience and certified qualifications data prior to installation. Show that the instructor has received a minimum of 24 hours of ESS training from a technical organization such as the National Burglar and Fire Alarm Association, and 2 years experience in installing the specified ESS type.

1.4 Environmental Conditions

1.4.1 Interior Conditions

Equipment installed in environmentally protected interior areas must meet performance requirements specified for the following ambient conditions:

1.4.1.1 Temperature

32 to 120 degrees F. Components installed in unheated security protected areas must meet performance requirements for temperatures as low as 0 degrees F.

1.4.1.2 Pressure

Sea level to 15,000 feet above sea level.

1.4.1.3 Relative Humidity

5 to 95 percent.

1.4.1.4 Fungus

Components must be constructed of nonfungus nutrient materials or be treated to inhibit fungus growth.

1.4.1.5 Acoustical Noise

Components must be suitable for use in high noise areas above 100 dB, without adversely affecting their performance.

1.4.2 Exterior Conditions

Components in enclosures must meet performance requirements when exposed to the following ambient conditions:

D3167700 SECTION 28 10 05 Page 7

1.4.2.1 Temperature

Minus 25 to 140 degrees F.

1.4.2.2 Pressure

Sea level to 15,000 feet above sea level.

1.4.2.3 Solar Radiation

Six hours of solar radiation per day at dry bulb temperature of 120 degrees F including 4 hours of solar radiation at 104 watts per square foot.

1.4.2.4 Sand and Dust

Wind driven for up to 6 miles per hour (mph).

1.4.2.5 Rain

2 inches per hour and 5 inches per hour cyclic with wind plus one period of 12 inches per hour.

1.4.2.6 Humidity

5 to 95 percent.

1.4.2.7 Fungus

Warm, humid atmosphere conducive to the growth of heterotropic plants.

1.4.2.8 Salt Fog

Salt atmosphere with 5 percent salinity.

1.4.2.9 Snow

Snow loading of 48 (psf) per hour; blowing snow of 4.6 psf per hour.

1.4.2.10 Ice Accretion

Up to 1/2 inches of radial ice.

1.4.2.11 Wind

Continual velocity up to 50 mph with gusts to 66 mph, except that fence sensors must detect intrusions up to 35 mph.

1.4.2.12 Acoustical Noise

Components must be suitable for use in high noise areas above 110 dB without adversely affecting their performance. Examples areas include flight lines, runup pads, and generator sites.

1.5 SYSTEM CALCULATIONS AND ANALYSIS

1.5.1 Backup Battery Capacity Calculations

Submit calculations showing that backup battery capacity exceeds sensor

Repair B134 HQ & Admin Facility Type B-3 Final McGhee Tyson ANG Base, TN April 2023

D3167700 SECTION 28 10 05 Page 8 operation, communications supervision, and alarm annunciation power requirements for proposed equipment plus 25 percent spare capacity.

1.5.2 CCTV Storage Calculations

Submit calculations showing the required storage capacity for each video storage device.

1.6 ESS SOFTWARE, DATA PACKAGE 4

Submit the ESS software, Data Package 4 with the ESS Components submittal package in accordance with Section 01 78 23 OPERATION AND MAINTENANCE DATA. Describe the functions of all software in the software manual and include:

a. All information necessary to enable proper loading, testing, and operation.

b. Terms and functions definitions.

c. Use of system and application software.

d. Procedures for system initialization, start-up and shutdown.

e. Alarm reports.

f. Reports generation.

g. Database format and data entry requirements.

h. Directory of all files.

i. All communication protocol descriptions, including data formats, command characters, and a sample of each type of data transfer.

j. Interface definition.

k. List of software keys.

1.7 AS-BUILT DRAWINGS

Maintain a separate set of drawings, elementary diagrams, and wiring diagrams of the system to be used for as-built drawings. Keep this set accurately and neatly up-to-date with all changes and additions. This set is not to be used for installation purposes.

Finish the final drawings submitted with the endurance test report in accordance with Section 01 77 00 CLOSEOUT PROCEDURES for as-built requirements.

PART 2 PRODUCTS

2.1 SYSTEM DESCRIPTION

Provide a complete and integrated electronic security system (ESS) that the meet requirements of the current Advantor system. ESS must be compatible with the Installation's central monitoring system and monitored within the secure/protected area and at the Installation central monitoring station. Installation's central monitoring system is

Repair B134 HQ & Admin Facility Type B-3 Final McGhee Tyson ANG Base, TN April 2023

D3167700 SECTION 28 10 05 Page 9 manufactured by Advantor. ESS consists of the following subsystems and features:

a. Intrusion Detection System (IDS).

b. Access Control System (ACS).

c. Closed-circuit Television System (CCTV).

d. Security Command Center (SCC).

e. Communications System.

f. Security Lighting Systems.

Include materials not normally furnished by the manufacturer with the ESS equipment as specified in:

a. Section 26 20 00 INTERIOR DISTRIBUTION SYSTEM.

2.2 PERFORMANCE REQUIREMENTS

Integrate the installed and operating subsystems into the overall ESS system to detect intrusion, control access, provide CCTV surveillance, provide visual verification, and perform as an entity, as specified below. Provide electronic equipment that complies with 47 CFR 15 and are suitable for the environment where they will be installed.

2.2.1 Growth Capability

Provide capability for modular ESS expansion of inputs, outputs, card readers, and remote control stations with minimal equipment modification.

Software must be able to handle design requirements plus 25 percent spare capacity. Growth capability is not to be limited by the provided products.

2.2.2 Hazardous Locations

When located in areas where fire or explosion hazards exist, provide system components rated and installed according to Chapter 5 of NFPA 70 .

2.2.3 Network Certification

Certify all Platform Information Technology (PIT) in accordance with DODI 8500.01 and the individual service implementation policy.

2.2.4 Maintainability

Provide components that can be maintained using commercially available tools and equipment. Arrange and assemble components to be readily accessible to maintenance personnel without compromising system defeat resistance and with no degradation in tamper protection, structural integrity, EMI or RFI attenuation, or line supervision after maintenance when it is performed in accordance with manufacturer's instructions.

2.2.5 Availability

Provide components rated for continuous operation. Provide solid-state electronic components mounted on printed circuit boards, conforming to UL 796 . Provide boards that are plug-in, quick-disconnect type. Do not

Repair B134 HQ & Admin Facility Type B-3 Final McGhee Tyson ANG Base, TN April 2023

D3167700 SECTION 28 10 05 Page 10 impede maintenance with densely packed circuitry. Provide power-dissipating components with safety margins of not less than 25 percent with respect to dissipation ratings, maximum voltages, and current-carrying capacity. Provide solid-state type or hermetically sealed electromechanical type light duty relays and similar switching devices.

2.2.6 Fail-Safe Capability

Provide fail-safe capability in critical elements of the ESS including, but not be limited to, the capability to monitor communication link integrity and to provide self-test. Provide fault annunciation when diminished functional capabilities are detected. Annunciate fail-safe alarms to clearly distinguish from other types of alarms.

2.2.7 Line Supervision

Provide the same geographic resolution for fault isolation at the systems level as provided for intrusion detection. Provide either a static or dynamic system with active mode for line supervision of communication links of the ESS.

a. The static system must represent "no-alarm" always by the same signal, which is different than the originally transmitted signal.

b. The dynamic system must represent "no-alarm" with a signal which continually changes with time.

2.2.8 Power Loss Detection

Detect AC and DC power loss and generate an alarm when a critical component of the system experiences temporary or permanent loss of power.

Annunciate the alarm in the Secured Area and the Security Command Center to clearly identify the component experiencing power loss.

2.2.9 Controls and Designations

Provide controls and designations as specified in NEMA ICS 1 .

2.2.10 Special Test Equipment

Provide all special test equipment, special hardware, software, tools, and programming or initialization equipment needed to start or maintain any part of the system and its components. Special test equipment is defined as any test equipment not normally used in an electronics maintenance facility.

2.2.11 Electromagnetic Interference (EMI)

Configure and provide ESS components employing electromagnetic radiation constructed to provide minimal vulnerability to electronic countermeasures.

2.2.12 Electromagnetic Radiation (EMR)

Provide only ESS communication components which are Federal Communications Commission (FCC) licensed and approved. Provide system components which are electromagnetically compatible.

Repair B134 HQ & Admin Facility Type B-3 Final McGhee Tyson ANG Base, TN April 2023

D3167700 SECTION 28 10 05 Page 11

2.2.13 Interchangeability

Use off-the-shelf components which are physically, electrically, and functionally interchangeable with equivalent components as complete items. Equivalent, replacement components must not require new or other component modification. Do not use custom designed or one-of-a-kind items. Interchangeable components or modules must not require trial and error matching in order to meet integrated system requirements, system accuracy, or restore complete system functionality.

2.3 INTRUSION DETECTION SYSTEM (IDS)

The IDS primary function is to detect intrusion into secured areas.

Utilize a single database for all IDS programming data that seamlessly integrates with the ESS under a single operating environment. The IDS events must be viewable as separate or as a combined list of all ESS events. Control the IDS alarm monitoring through software control from the ESS.

a. Provide both supervised and non-supervised alarm point monitoring.

b. Arm or disarm alarm points both manually and automatically by time of day, day of week or by operator command.

2.3.1 IDS Components

Provide components:

a. Premise Control Units (PCU).

b. Detection Sensors.

c. Tamper Switches.

2.3.2 Detection Sensitivity

The sensitivity of the IDS must allow for the following:

a. Locating intrusions at individually protected assets or at an individual portal.

b. Locating intrusions within the coverage on a single volumetric sensor.

c. Locating failures or tampering at individual sensors.

2.3.3 Detection Alarm and Reporting Capacity

Collect, communicate, and display up to 32 sensor zone alarms and to enable control of one card reader with integral keypad for arming and disarming inside of the protected area with a delayed alarm.

Identify individual sensors in alarm if the sensor zone is a multiple alarm source combination. Annunciate a single alarm within 1 second maximum, after sensor transducer or other detection device activation.

2.3.4 False Alarm Rate

The false alarm rate for each interior IDS zone must not exceed one false alarm per 30-day period. The false alarm rate for each exterior IDS zone

Repair B134 HQ & Admin Facility Type B-3 Final McGhee Tyson ANG Base, TN April 2023

D3167700 SECTION 28 10 05 Page 12 must not exceed one false alarm per 24-hour period.

2.3.5 Nuisance Alarm Rate

The nuisance alarm rate for each interior IDS zone must not exceed three nuisance alarms per 30-day period. The nuisance alarm rate for each exterior IDS zone must not exceed three nuisance alarms per 24-hour period.

2.3.6 Premise Control Unit (PCU)

Install the PCU command processor in a tamper resistant enclosure that is specified in paragraph "Component Enclosure". Package the following with the PCU:

a. Power transformer.

b. Battery(s).

c. Network connection cable.

d. Keypad(s).

e. Keypad connection cable(s).

f. Additional components as required for full functionality.

2.3.6.1 PCU Capabilities

Provide the PCU at a minimum but not limited to, the following capabilities;

a. Expansion to a total of at least 10,000 user codes with 99 user profile definitions.

b. Support up to 16 keypads with alphanumeric display. Each keypad must be capable of securing and accessing any system area based on a pass code or access control card and or key FOB authorization. Provide keypad alphanumeric display with complete prompt messages during all stages of operation and system programming and display all relevant operating and test data.

c. A total of at least 100 programmable output relay schedules.

d. 32 individual reporting areas.

e. Data line supervision or two separate lines of communication.

f. Two-man access code or credentials.

g. Support programming to require the same or different access code entered within a programmed delay time of 1 to 15 minutes after disarming before activating a silent ambush alarm.

h. Support area programming that disables schedule and time-of-day changes while system is armed so that area can only be disarmed during scheduled times.

i. Provide a minimum of a 4,000 event log buffer per PCU. Record and hold alarm activity information in the log buffer until the ESS is

Repair B134 HQ & Admin Facility Type B-3 Final McGhee Tyson ANG Base, TN April 2023

D3167700 SECTION 28 10 05 Page 13 connected and receives the information. Provide a software-configurable warning log buffer filling notification for PCU(s) configured with network switch capabilities.

j. Support a Network Interface Card (NIC) plug-in module with built in network router capable of 128 Bit AES Rijndael Encryption process certified by NIST (National Institute of Standards and Technology).

2.3.6.2 Overcurrent Protection and Indication

When overcurrent more than it is rated for is detected by the PCU, communication bus(es) and keypad(s) are to be shut down and an overcurrent notification LED lit to indicate the situation.

2.3.6.3 Manual and Self-Test

All testing from any alphanumeric keypad include testing for: standby battery, alarm bell or siren, and communication to the Security Command Center (SCC). Include provisions for an automatic, daily, weekly, 30 day, or up to 60 day communication link test from the PCU installation site to the SCC. Include a provision for displaying the internal system power and wiring conditions.

Include the following for internal monitoring points:

a. The bell circuit.

b. AC power.

c. Battery voltage level.

d. Charging voltage.

e. Panel box tamper.

f. Phone trouble line 1.

g. Phone trouble line 2.

h. Transmit trouble.

i. Network trouble.

A battery test must be automatically performed to test the integrity of the standby battery by disconnecting the standby battery from the charging circuit and placing a load on the battery. Perform this test at an interval no greater than 180 days.

2.3.7 Detection Sensors

a. Required sensor power is 12 VDC unless otherwise specified.

b. An interior IDS zone is a room or space within a building that can be armed and disarmed independently from all other zones.

c. Provide line supervision for all sensors with an end-of-line resistor at the sensor or within a tampered junction box with conduit from the junction box to the sensor.

Repair B134 HQ & Admin Facility Type B-3 Final McGhee Tyson ANG Base, TN April 2023

D3167700 SECTION 28 10 05 Page 14

d. Provide line supervision for all sensors with an end-of-line resistor at the sensor or within a tampered junction box with conduit from the junction box to the sensor.

d. Provide sensors and components rated for operation in the installed environment. The sensors must transmit an alarm signal to the alarm annunciation system upon change detection. Provide all sensors with a tamper switch and elements housed in a tamper-alarmed enclosure in accordance of paragraph "Component Enclosure".

2.3.7.1 Interior Sensors

2.3.7.1.1 High Security Balanced Magnetic Switch (BMS)

Mount the BMS inside the secure location and on the opening side of the door. BMS sensors do not have the capability to incorporate an end-of-line (EOL) resistor.

2.3.7.2 Tamper Switches

2.3.7.2.1 Tamper Switch Performance Requirements

Tamper switches are to be:

a. Inaccessible until switch is activated.

b. Under electrical supervision at all times, irrespective of the protection mode in which the circuit is operating.

c. Annunciated to be clearly distinguishable from intrusion detection alarms and exempt from being disarmed, shunted, or silenced.

d. Spring-loaded and held in the closed position by the door or cover protected.

e. Wired to break the circuit when the door or cover is disturbed.

f. Wired so that each sensor and device is annunciated individually at the central reporting processor.

2.4 ACCESS CONTROL SYSTEM (ACS)

Provide an access control system based upon a modular distributed microprocessor architecture complete with access control cards and ready for operation.

a. The ACS card credentials are required to be Common Access Cards (CAC), and CAC cards are being provided by the Government. Interface system with and provide alarm and other status to the overall ESS. Provide ACS that meets the communications requirements of UL 1076 and UL 294 and has the capability of controlling up to 16 card readers and keypads per card reader controller, 128 alarm inputs, or 128 relay outputs or any components combination.

b. System is to grant or deny access or exit based upon:

(1) Keypad identification data.

(2) CAC card identification data.

Repair B134 HQ & Admin Facility Type B-3 Final McGhee Tyson ANG Base, TN April 2023

D3167700 SECTION 28 10 05 Page 15

(3) Video.

(4) Smart card identification data.

(5) Identification technologies combination.

(6) Input through the access control devices compared to data stored within the system.

(7) Time of day, day of week, and special day and holiday scheduling with card validation override.

c. Decision to grant or deny access or exit is to be based upon authorization for such data to be input at a specific location for the current time period. Access decisions for high security areas are to be based upon two identification technology combinations: card and keypad.

d. Provide ACS that supports the configuration and simultaneous monitoring of multiple access control devices when TCP/IP communication interfaces are used between the ESS and the primary Access Control Unit (ACU). The events of the ACS are to be viewable as separate or as a combined list of all ESS events. Provide overall control of the ACS, alarm monitoring, and photo identification through software control of the ESS.

e. Access control, photo imaging, and programming data must reside on a single database and instantly accessible to every networked PC workstation connected to the ESS.

f. Provide both supervised and non-supervised alarm point monitoring.

g. Provide the capability to arm or disarm alarm points both manually and automatically by time of day, day of week or by operator command and the capability to disarm alarm points based on a valid access event.

h. Provide programmable 'delay' setting for all alarm points. The alarm points are not to report an ENTRY type alarm until the delay setting has expired and not report a dwell type alarm condition until the alarm has been active for the full delay period.

i. Provide the capability to place ACU(s) in an off-line mode. In the off-line mode, the ACU(s) must retain a historical summary of all ACU activity transactions, up to the maximum capacity of the ACU memory buffer. Provide the ability for manual operator control of system output relays with the manual functions to energize, de-energize, enable or disable.

j. Provide the ability to display a stored 'video image' of the cardholder based on card activity, and switch real-time CCTV camera to the card reader location for specific card usage. The card reader must not activate the door lock until positive operator acknowledgment from the SCC.

2.4.1 ACS Programming

Provide software capable of, but not limited to, the following programming:

Repair B134 HQ & Admin Facility Type B-3 Final McGhee Tyson ANG Base, TN April 2023

D3167700 SECTION 28 10 05 Page 16

2.4.1.1 Time Schedules

Provide up to 256 user-definable time schedules. These time schedules are to determine the day(s) and times that access will be granted or a scheduled event is to occur. Any and all of the time schedules are to be available for defining access privileges and scheduled events. Provide ALWAYS and NEVER schedules that cannot be altered or removed from the system. Each user-defined time schedule must have the option of reacting or not reacting to user-defined special days, with the ability to react uniquely to each type of special day.

2.4.1.2 Special Days

Provide an unlimited number of user definable special days to be used for configuring exceptions to the normal operating rules, typically for specifying holiday operating rules. Allow for each special day to be assigned to a user-defined type.

2.4.1.3 ACU Daylight Savings Time Adjustment

Provide a software-configurable, user defined adjustment for Daylight Savings Time. The ACU must not need to be connected to a PC workstation in order for the adjustment to occur.

2.4.1.4 Scheduled Events

Any access controlled reader is to be capable of scheduled unlock periods to allow for card-free access. The access controlled reader is to also be capable of requiring one valid access event before beginning a scheduled unlock period.

Any access control point is to be capable of requiring a valid card as well as a PIN code via keypad on a scheduled basis for high security areas. The use of PIN via keypad functions must not reduce the number of card readers or alarm points available in the ACU(s). Any designated alarm input must be able to be scheduled Armed and Disarmed. Any relay output must be capable of scheduled ON and OFF periods to allow for automatic input and output system control.

2.4.1.5 Maximum User Capability

Up to 64,000 individual users may be given access cards or codes and have their access controlled and recorded.

2.4.1.6 Access Groups

Each system user must be assignable to a maximum of 4 of 256 possible access groups. An access group is defined as one or more people who are allowed access to the same areas at the same days and time periods.

2.4.1.7 Active and Expire Dates

Any card or user may be configured with activation and expiration dates.

The card can be assigned to any valid access group and will be activated and expired according to the specified dates.

2.4.1.8 Maximum Use Settings

Any card or user may be configured with maximum number of uses for that

Repair B134 HQ & Admin Facility Type B-3 Final McGhee Tyson ANG Base, TN April 2023

D3167700 SECTION 28 10 05 Page 17 card. The card can be assigned to any valid access group and will be expired according to the specified number of card uses.

2.4.1.9 Door Outputs

Provide each access control reader with one dedicated relay output. Both relays are to provide Normally Open and Normally Closed contacts. Use the first relay for electric lock control while the second is software configurable to activate for door forced open, door left open too long, duress, passback violations, invalid access attempts and valid unlock conditions. Allow for both relays to be separately programmable for energize times from 1 second to 10 minutes. The second relay must allow a delay time to be specified, causing its activation to be delayed after an activating condition occurs.

2.4.1.10 Anti-Passback

Provide global anti-passback capability. Any door on the system can be linked to one of 256 user defined passback areas or two 2 pre-defined areas. Each door may be set up to automatically forgive passback entries at one of the following intervals:

(1) Never

(2) Midnight

(3) Every 12 hours (Midnight and Noon)

(4) Every 6 hours

(5) Every 2 hours

(6) Each hour

(7) Every 30 minutes

Each door can be configured to deny or grant access for passback violations and individual users can be exempt to the passback rules. The anti-passback features must be a global function and operate completely independent of the ACS software, except configuring the passback rules.

Additionally, the operator is to have the ability to manually forgive an individual user or all users by command from the ACS.

2.4.1.11 Two Person Rule

Any access control reader on the system is to have the ability via software programming to require two valid cards for access. Any access control reader on the system that includes a keypad is to also have the ability to require a valid PIN number associated with each of the two valid cards.

2.4.1.12 User List or Who's In (Muster Reports)

Provide the capability to generate dynamic lists of users in certain access-controlled areas, based either upon selected users or selected areas. The lists must have the option of automatically refreshing after a user-selected interval of time.

Repair B134 HQ & Admin Facility Type B-3 Final McGhee Tyson ANG Base, TN April 2023

D3167700 SECTION 28 10 05 Page 18

2.4.1.13 Crisis Mode

Provide support for a "crisis mode", in which user-selected alarm point activations cause changes to user access privileges. The changes to user access privileges must be configurable to restrict normal access to no access or limited access.

2.4.1.14 Door Groups

Allow up to 256 door groups to be configured. Doors belonging to the same group are be able to be locked, unlocked, disabled, and enabled on command from the ACS.

2.4.1.15 Door Interlocking

Allow a group of doors to be software configured so that if any door in the group is unsecure, all other doors are automatically disabled. This feature is also known as a "mantrap" configuration. The interlocking features must not require the ACS to be on-line for proper operation.

2.4.1.16 PIN Required

Provide support for the required use of a keypad code, in addition to a valid credential during user-selected schedules.

2.4.1.17 Remote Door Control

Provide the ESS operator the capability of manually controlling any access point by issuing a simple command from the ACS. Provide the operator the ability to lock, unlock, enable, and disable any door or Door Group in this manner. This activity is to cause an entry to be logged displaying the door name, number and time that it was performed.

2.4.1.18 Key Control

When interfaced with an approved key-control system, the system is to allow users to deny access to certain doors for any users who have keys in their possession.

2.4.1.19 Guard Tour

Provide support for user-defined guard tours configurable in a set pattern of tour points, or following a mode in which all tour points can be visited in any order within an allotted time. Allow for a tour to be started by ACS command, by use of a selected card at a selected reader, or by use of a selected keypad code at a selected keypad. Detect guard late-to-point, point missed, and point out-of-sequence events. Generate a report at tour completion.

2.4.1.20 Reader Disable

Provide support for disabling readers in reaction to a user-selected number of invalid access attempts.

2.4.1.21 Disable Event Messages

Allow users to disable user-selected event messages (Door Forced Open, Door Open Too Long, Door Closed, Request to Exit) for user-selected doors. Allow users to disable certain messages (Door Forced Open, Door

Repair B134 HQ & Admin Facility Type B-3 Final McGhee Tyson ANG Base, TN April 2023

D3167700 SECTION 28 10 05 Page 19

Open Too Long) according to a user-selected schedule.

2.4.1.22 Input and Output Groups

Allow for up to 256 user-defined (input and output) groups to be defined.

Each Input device is to be able to be linked to these groups for arming, disarming, shunting and unshunting as well as output control.

2.4.1.23 Delays

Each alarm device must allow a delay to be specified which is either an entry type or a dwell type. An entry-type delay is to prevent the input from issuing an alarm event until the delay elapses. If unarmed during the delay period, the alarm is to be ignored. A dwell-type delay requires the input to remain in the alarm state for the full delay duration before issuing an alarm.

2.4.1.24 Remote Input Control

The operator cannot have the capability to shunt or disable a tamper alarm.

2.4.1.25 Output Configuration

Allow each output relay to be software configurable as:

(1) Follows

(2) Latch

(3) Timeout

(4) Scheduled

(5) Timeout Re-triggerable

(6) Limit

(7) Counter

Allow for a time schedule to automatically control the activation and de-activation of the Scheduled type with all other types configured to activate based on input and output group conditions. Additionally, a time schedule must be specified to configure when the output is to actively monitor the input and output groups.

2.4.1.26 Remote Output Control

Provide the operator the capability of manually controlling any output point by issuing a simple command from the SCC. Based upon the output type, provide the ESS operator the ability to ENABLE, DISABLE, turn ON and turn OFF any output in this manner. A FOLLOWS type output must not be capable of being turned OFF or ON. Log an entry when this activity is performed displaying the output name and time performed. Manual control of outputs are not permissible in ICS 705-1 applications.

2.4.1.27 Remote Reset Command

Provide the capability for any ACU to reset manually or by command issued from the ACS with the option of simulating the ACU reset settings, or

Repair B134 HQ & Admin Facility Type B-3 Final McGhee Tyson ANG Base, TN April 2023

D3167700 SECTION 28 10 05 Page 20 forcing a reset type as specified by the user. The remote reset command is not to cause the ACU to degrade its level of protection to any access points defined.

2.4.1.28 Time Zone

Allow the user to select the time zone in which the ACU is located, so that event times displayed for that ACU will match the local time where the ACU is located.

2.4.1.29 User-Selected LED Behavior

Allow the user to select different behaviors for the LEDs of each access controlled reader.

2.4.1.30 Traced Cards

Provide the capability of selecting any number of cardholders for the purpose of limiting reports to only traced users displaying all traced cardholder events in a user-selected alternate color.

2.4.2 Access Control Unit (ACU)

UL 294 . Provide micro-processor based ACU with all access and input and output decisions to be made by the individual ACU(s). Provide modular solution which will allow for present security requirements and the capability to expand. Configure all field ACU panels to intercommunicate via TCP/IP or fiber-optic communication. Equip all field ACU(s) with a tamper contact.

Designate one ACU as "Primary", responsible for all ACS-to-ACU communications. All other ACU(s) up to a maximum of 64 are to be designated as "Secondary" and communicate with the "Primary" via a TCP/IP network or fiber-optic configuration. Provide ACU capable of, but not limited to, the following:

a. Built-in surge suppression circuitry on plug-in modular circuit boards with surge suppression, configured as an integral component of the system and self-sacrificing in the event of extreme surges or spikes.

b. Capable of supporting at least 2 ports and be expandable in increments of two ports up to a maximum of 16 ports per ACU.

c. Each port configured by ACS to support any one of the following peripheral devices:

(1) Card reader

(2) Alarm Monitoring Module

(3) Output Relay Module

Any device combination can be supported on each ACU, up to a total of 16 devices per ACU.

d. Capability of supporting multiple card reader technologies simultaneously, including:

(1) Keypad

Repair B134 HQ & Admin Facility Type B-3 Final McGhee Tyson ANG Base, TN April 2023

D3167700 SECTION 28 10 05 Page 21

(2) Card and Keypad

(3) CAC compatible

This capability must be an integral part of the ACU and will not require special external equipment.

e. Built-in battery back-up of programmed information sustainable for a period of at least 90 days.

f. Powered by a 24 VDC power source rated at a minimum of 2 amperes with a battery back-up for complete system operation in the event of power failure. Provide battery backup for all ACU(s) to sufficiently power the ACU for 8 hours continuous service.

g. Electric strikes, other locking devices and ancillary peripherals on a separate power supply with battery back-up for continued operation in the event of power failure as specified in paragraph "Backup Power".

h. A minimum of a 10,300 event log buffer per ACU to record and hold access and alarm activity information until the ACS is connected and receives the information. Provide a software-configurable warning log buffer filling notification for ACU(s) configured with network switch capabilities.

2.4.3 Access Control Devices

UL 294 . The card, card reader, and panels must meet encryption requirements that are specified in paragraph DATA ENCRYPTION. Devices are to be tamper alarmed, tamper and vandal resistant, and solid state, containing no electronics which could compromise the access control subsystem should the subsystem be attacked.

2.4.3.1 Card Readers

Provide semiflush or weatherproof mountable card readers as indicated for each individual location. Provide contactless type card readers capable of reading CAC and Keypad type of access control cards.

Keypads must contain an alphanumeric and special symbols keyboard with symbols arranged in ascending ASCII code ordinal sequence. Provide keypad integrated into the card reader.

2.4.3.1.1 Contact Card Readers

Provide contact card readers that can read credential CAC cards whose characteristics of size and technology meet those defined by ANSI ISO/IEC 7816 and are in compliance with NIST FIPS 201-2 .

Provide readers with "flash" download capability to accommodate card format changes and the capability of reading the card data and transmitting the data, or a portion thereof, to the ESS control panel.

2.4.3.1.2 Contactless Card Readers

Provide contactless card readers that can read credential CAC cards whose characteristics of size and technology meet those defined by ANSI ISO/IEC 7816 in close proximity to the card reader and are in

Repair B134 HQ & Admin Facility Type B-3 Final McGhee Tyson ANG Base, TN April 2023

D3167700 SECTION 28 10 05 Page 22 compliance with NIST FIPS 201-2 .

Provide readers with "flash" download capability to accommodate card format changes and the capability of reading the card data and transmitting the data, or a portion thereof, to the ESS control panel.

2.4.3.1.3 Card Reader Display

Provide card readers with an LED or other visual indicator display which indicate power ON and OFF and whether user passage requests have been accepted or rejected.

2.4.3.1.4 Card Reader Response Time

The card reader is to respond to passage requests by generating a signal to the local processor.

2.4.3.1.5 Card Reader Power

Power the card reader from the source as shown on the drawings. The card reader must not dissipate more than 5 Watts.

2.4.3.1.6 Card Reader Mounting Method

Provide card readers suitable for surface, semi-flush, or weatherproof mounting as required.

2.4.3.2 Keypads

Entry control keypads are to use unique alphanumeric and other symbol combinations as an identifier. Keypads must contain an integral alphanumeric and special symbols keyboard with symbols arranged in ascending ASCII code ordinal sequence. Communications protocol is to be compatible with the local processor.

2.4.3.2.1 Keypad Display

Keypads are to include an LED or other type of visual indicator display and provide visual status indications indicating power ON and OFF and whether user passage requests have been accepted or rejected.

The maximum horizontal and vertical viewing angles are to be limited by the keypad display or enclosure. The maximum horizontal viewing angle must be no more than plus and minus 5 degrees off a vertical plane perpendicular to the plane of the face of the keypad display. The maximum vertical viewing angle must be no more than plus and minus 15 degrees off a horizontal plane perpendicular to the plane of the face of the keypad display.

2.4.3.3 Card Readers with Integral Keypad

Equip contact and contactless card readers with integral keypads as specified in paragraph "Keypads".

2.4.3.4 Access Control Cards

Provide cards with the capability of modification and lamination during enrollment process without readability reduction for use as a picture and identification badge. Cards must contain binary coded data arranged in a

Repair B134 HQ & Admin Facility Type B-3 Final McGhee Tyson ANG Base, TN April 2023

D3167700 SECTION 28 10 05 Page 23 scrambled pattern as a unique identification code stored on or within the card and of the type readable by the subsystem card readers. Include a non-duplicated unique facility access control subsystem identification code common to access control cards within the card binary data.

2.4.3.4.1 Panic Bar

Include panic bar emergency exit hardware on emergency exit doors as indicated. Provide an alarm shunt signal from the panic bar emergency exit hardware to the appropriate local processor. Provide panic bar compatible with mortise-mount door hardware and operate by retracting the bolt.

2.4.3.4.1.1 Emergency Egress With Alarm

Include a conspicuous warning sign with 1 inch high, red lettering notifying personnel that an alarm will be annunciated if the panic bar is operated.

Panic bar hardware operation is to generate an intrusion alarm. The panic bar must depend upon a mechanical connection only and not depend upon electric power for operation, except for local alarm annunciation and alarm communications.

2.4.3.4.1.2 Normal Egress

Panic bar hardware operation is not to generate an intrusion alarm. The panic bar must depend upon a mechanical connection only when exiting.

Provide the exterior, non-secure side of the door with an electrified thumb latch or lever to provide access after the credential I.D.

authentication by the ESS.

Signal Switches: Strikes/bolts are to include signal switches indicating to the system when the bolt is not engaged or the strike mechanism is unlocked. The signal switches are to report a forced entry to the system.

2.4.3.4.2 Electromagnetic Lock

Electromagnetic locks are to contain no moving parts and depend solely upon electromagnetism to secure a portal by generating at least 1200 pounds of holding force. Interface the lock with the local processors without external, internal or functional local processor alteration. Incorporate an end-of-line resistor to facilitate line supervision by the system.

Install MOVs to protect the controller from reverse current surges if not incorporated into the electromagnetic lock or local controller. Provide in accordance of ANSI/BHMA A156.23 .

2.4.3.4.2.1 Armature

The electromagnetic lock is to contain internal circuitry to eliminate residual magnetism and inductive kickback. The actuating armature must operate on 24 VDC and not dissipate more than 12 Watts. The holding current must be not greater than 500 milli-amperes. The actuating armature must take not more than 300 milli-seconds to change the status of the lock from fully secure to fully open or fully open to fully secure.

2.4.3.4.2.2 Tamper Resistance

The electric strike and bolt mechanism is to be encased in hardened guard

Repair B134 HQ & Admin Facility Type B-3 Final McGhee Tyson ANG Base, TN April 2023

D3167700 SECTION 28 10 05 Page 24 barriers to deter forced entry.

2.4.3.4.2.3 Mounting Method

Provide electric strikes and bolts suitable for use with single and double door installations, with mortise-type hardware as indicated, and compatible with right or left hand mounting.

2.5 CLOSED-CIRCUIT TELEVISION (CCTV) SYSTEM

Select system components that conform to the Open Network Video Interface Forum ( ONVIF) specification. Provide compatible UL listed CCTV components to provide visual assessment of ESS alarms automatically upon alarm or upon SCC operator selection. Otherwise, the subsystem is to continuously display the coverage area. Display alphanumeric camera location ID on all monitors. Provide the number of alarm monitors as required. The scene from each camera must appear clear, crisp, and stable on the respective monitor during both daytime and nighttime operation. Provide component equipment that minimizes both preventive and corrective maintenance.

Provide components from a single manufacturer or justify mixing manufacturer components and demonstrate compatibility in submittal information.

2…