281300.pdf

281300 - 1 ACCESS CONTROL

SECTION 281300 - ACCESS CONTROL

PART 1 - GENERAL

1.1 SUMMARY

A. Section Includes:

1. Security access central-control station.

2. One or more security access networked workstations.

3. Security access operating system and application software.

4. Security access controllers connected to high-speed electronic-data transmission network.

1.2 DEFINITIONS

A. Credential: Data assigned to an entity and used to identify that entity.

B. DTS: Digital Termination Service. A microwave-based, line-of-sight communication provided directly to the end user.

C. Identifier: A credential card, keypad personal identification number or code, biometric characteristic, or other unique identification entered as data into the entry-control database for the purpose of identifying an individual. Where this term is presented with an initial capital letter, this definition applies.

D. Location: A Location on the network having a PC-to-controller communications link, with additional Controllers at the Location connected to the PC-to-controller link with TIA 485- A communications loop. Where this term is presented with an initial capital letter, this definition applies.

E. PCI Bus: Peripheral Component Interconnect. A peripheral bus providing a high-speed data path between the CPU and peripheral devices such as monitor, disk drive, or network.

F. RAS: Remote access services.

G. TWAIN: Technology without an Interesting Name. A programming interface that lets a graphics application, such as an image editing program or desktop publishing program, activate a scanner, frame grabber, or other image-capturing device.

1.3 ACTION SUBMITTALS

A. Product Data: For each type of product indicated. Comply with SIA BIO-01.

B. Shop Drawings:

1. Diagrams for cable management system.

2. System labeling schedules.

3. Wiring diagrams.

4. Cable administration drawings.

ACCESS CONTROL 281300 - 2

5. Battery and charger calculations for central station, workstations, and controllers.

C. Product Schedules.

1.4 INFORMATIONAL SUBMITTALS

A. Field quality-control reports.

1.5 CLOSEOUT SUBMITTALS

A. Operation and maintenance data include the following:

1. Software documentation.

2. PC installation and operating documentation, manuals, and software for the PC and all installed peripherals. Software shall include system restore, emergency boot diskettes, and drivers for all installed hardware. Provide separately for each

PC.

3. Hard copies of manufacturer's specification sheets, operating specifications, design guides, user's guides for software and hardware, and PDF files on CD- ROM of the hard-copy submittal.

4. System installation and setup guides with data forms to plan and record options and setup decisions.

1.6 QUALITY ASSURANCE

A. Electrical Components, Devices, and Accessories: Listed and labeled as defined in NFPA 70, by a qualified testing agency, and marked for intended location and application.

B. Comply with NFPA 70, "National Electrical Code."

C. Comply with SIA DC-01 and SIA DC-03

1.7 PROJECT CONDITIONS

A. Environmental Conditions: System shall be capable of withstanding the following environmental conditions without mechanical or electrical damage or degradation of operating capability:

1. Control Station: Rated for continuous operation in ambient conditions of 60 to 85 deg F (16 to 30 deg C) and a relative humidity of 20 to 80 percent, noncondensing.

2. Indoor, Controlled Environment: NEMA 250, Type 1 enclosure. System components, except central-station control unit, installed in temperature-controlled indoor environments shall be rated for continuous operation in ambient conditions of 36 to 122 deg F (2 to 50 deg C) dry bulb and 20 to 90 percent relative humidity, noncondensing.

3. Indoor, Uncontrolled Environment: NEMA 250, Type 3R enclosures. System components installed in non-temperature-controlled indoor environments shall be rated for continuous operation in ambient conditions of 0 to 122 deg F (minus 18

281300 - 3 ACCESS CONTROL

to plus 50 deg C) dry bulb and 20 to 90 percent relative humidity, noncondensing.

PART 2 - PRODUCTS

2.1 MANUFACTURERS

A. Contractor shall match existing Advantor system.

2.2 DESCRIPTION

A. Security Access System: PC-based central station, one or more networked PC-based workstations, and field-installed controllers, connected by a high-speed electronic-data transmission network.

B. System Software: Based on 32-bit, central-station, workstation operating system, server operating system, and application software. Software shall have the following capabilities:

1. Graphical user interface to show pull-down menus and a menu-tree format that complies with interface guidelines of Microsoft Windows.

2. System license for the entire system including capability for future additions that are within the indicated system size limits specified in this Section.

3. Open-Contracting Officer’s Representativeure system that allows importing and exporting of data and interfacing with other systems that are compatible with Microsoft Windows.

4. Password-protected operator login and access.

5. Open-database-connectivity compliant.

C. Network(s) connecting PCs and controllers shall consist of one or more of the following:

1. Local area, IEEE 802.3 Fast Ethernet Gigabit-Ethernet star topology network based on TCP/IP.

2.3 OPERATION

A. Security access system shall use a single database for access-control and credential-creation functions.

B. Distributed Processing: A fully distributed processing system.

1. Access-control information, including time, date, valid codes, access levels, and similar data, shall be downloaded to controllers so each controller can make access-control decisions.

2. Intermediate controllers for access control are prohibited.

3. In the event that communications with the central controller are lost, controllers shall automatically buffer event transactions until communications are restored, at which time buffered events shall be uploaded to the central station.

C. Number of Locations:

ACCESS CONTROL 281300 - 4

1. Support at least 32,000 separate Locations using a single PC with combinations of direct-connect or TCP/IP LAN connections to each Location.

2. Each Location shall have its own database and history in the central station.

3. Locations may be combined to share a common database.

D. Data Capacity:

1. 130 different card-reader formats.

2. 999 comments.

3. 48 graphic file types for importing maps.

E. Location Capacity:

1. 128 reader-controlled doors.

2. 50,000 total-access credentials.

3. 2048 supervised alarm inputs.

4. 2048 programmable outputs.

5. 32,000 custom action messages per Location to instruct operator on action required when alarm is received.

F. System Network Requirements:

1. System components shall be interconnected and shall provide automatic communication of status changes, commands, field-initiated interrupts, and other communications required for proper system operation.

2. Communication shall not require operator initiation or response and shall return to normal after partial- or total-network interruption such as power loss or transient upset.

3. System shall automatically annunciate communication failures to the operator and shall identify the communications link that has experienced a partial or total failure.

4. Communications controller may be used as an interface between the central-station display systems and the field device network. Communications controller shall provide functions required to attain the specified network communications performance.

G. Central station shall provide operator interface, interaction, display, control, and dynamic and real-time monitoring. Central station shall control system networks to interconnect all system components, including workstations and field-installed controllers.

H. Field equipment shall include controllers, sensors, and controls.

1. Controllers shall serve as an interface between the central station and sensors and controls.

2. Data exchange between the central station and the controllers shall include down-line transmission of commands, software, and databases to controllers.

3. The up-line data exchange from the controller to the central station shall include status data such as intrusion alarms, status reports, and entry-control records.

4. Controllers are classified as alarm-annunciation or entry-control type.

281300 - 5 ACCESS CONTROL

I. System Response to Alarms: Field device network shall provide a system end-to-end response time of one second(s) or less for every device connected to the system.

J. False-Alarm Reduction: The design of the central station and controllers shall contain features to reduce false alarms. Equipment and software shall comply with SIA CP-01.

K. Error Detection:

1. Use a cyclic code method to detect single- and double-bit errors, burst errors of eight bits or fewer, and at least 99 percent of all other multibit and burst errors between controllers and the central station.

2. Interactive or product error-detection codes alone will not be acceptable.

L. Data Line Supervision: System shall initiate an alarm in response to opening, closing, shorting, or grounding of data transmission lines.

M. Door Hardware Interface:

1. Comply with requirements in Section 087100 "Door Hardware" and Section 087111 "Door Hardware (Descriptive Specification)" for door hardware required to be monitored or controlled by the security access system.

2. Electrical characteristics of controllers shall match the signal and power requirements of door hardware.

2.4 APPLICATION SOFTWARE

A. System Software: Based on 32-bit, Microsoft Windows central-station and workstation operating system and application software.

1. Graphical user interface shall show pull-down menus and a menu-tree format.

2. Capability for future additions within the indicated system size limits.

3. Open Contracting Officer’s Representativeure that allows importing and exporting of data and interfacing with other systems that are compatible with operating system.

4. Password-protected operator login and access.

B. Application Software: Interface between the alarm annunciation and entry-control controllers to monitor sensors, operate displays, report alarms, generate reports, and help train system operators.

1. Reside at the central station, workstations, and controllers as required to perform specified functions.

2. Operate and manage peripheral devices.

3. Manage files for disk I/O, including creating, deleting, and copying files; and automatically maintain a directory of all files, including size and location of each sequential and random-ordered record.

4. Import custom icons into graphics to represent alarms and I/O devices.

5. Globally link I/O so that any I/O can link to any other I/O within the same Location without requiring interaction with the host PC. This operation shall be at the controller.

ACCESS CONTROL 281300 - 6

6. Globally code I/O links so that any access-granted event can link to any I/O with the same Location without requiring interaction with the host PC. This operation shall be at the controller.

7. Messages from PC to controllers and controllers to controllers shall be on a polled network that utilizes check summing and acknowledgment of each message. Communication shall be automatically verified, buffered, and retransmitted if message is not acknowledged.

8. Selectable poll frequency and message time-out settings shall handle bandwidth and latency issues for TCP/IP, RF, and other PC-to-controller communications methods by changing the polling frequency and the amount of time the system waits for a response.

9. Automatic and encrypted backups for database and history backups shall be automatically stored at the central-control PC and encrypted with a nine-character alphanumeric password that must be used to restore or read data contained in backup.

10. Operator audit trail for recording and reporting all changes made to database and system software.

11. Support network protocol and topology, TCP/IP, Novel Netware, Digital Pathworks, Banyan Vines, LAN/WAN, and RAS.

C. Workstation Software:

1. Password levels shall be individually customized at each workstation to allow or disallow operator access to program functions for each Location.

2. Workstation event filtering shall allow user to define events and alarms that will be displayed at each workstation. If an alarm is unacknowledged (not handled by another workstation) for a preset amount of time, the alarm will automatically appear on the filtered workstation.

D. Controller Software:

1. Controllers shall operate as autonomous, intelligent processing units.

a. Controllers shall make decisions about access control, alarm monitoring, linking functions, and door-locking schedules for their operation, independent of other system components.

b. Controllers shall be part of a fully distributed processing-control network.

c. The portion of the database associated with a controller, and consisting of parameters, constraints, and the latest value or status of points connected to that controller, shall be maintained in the controller.

2. The following functions shall be fully implemented and operational within each controller:

a. Monitoring inputs.

b. Controlling outputs.

c. Automatically reporting alarms to the central station.

d. Reporting of sensor and output status to central station on request.

e. Maintaining real time, automatically updated by the central station at least once a day.

f. Communicating with the central station.

281300 - 7 ACCESS CONTROL

g. Executing controller resident programs.

h. Diagnosing.

i. Downloading and uploading data to and from the central station.

3. Controller Operations at a Location:

a. Up to 64 controllers connected to TIA 485-A communications loop.

Globally operating I/O linking and anti-passback functions between controllers within the same Location without central-station or workstation intervention. Linking and anti-passback shall remain fully functional within the same Location even when the central station or workstations are off-line.

b. In the event of communication failure between the central station and a Location, there shall be no degradation in operations at the controllers at that Location. Controllers at each Location shall be connected to a memory buffer with a capacity to store up to 10,000 events; there shall be no loss of transactions in system history files until the buffer overflows.

c. Buffered events shall be handled in a first-in-first-out mode of operation.

4. Individual Controller Operation:

a. Controllers shall transmit alarms, status changes, and other data to the central station when communications circuits are operable. If communications are not available, controllers shall function in a stand-alone mode; operational data, including the status and alarm data normally transmitted to the central station, shall be stored for later transmission to the central station. Storage capacity for the latest 1024 events shall be provided at each controller.

b. Card-reader ports of a controller shall be custom configurable for at least 120 different card-reader or keypad formats. Multiple reader or keypad formats may be used simultaneously at different controllers or within the same controller.

c. Controllers shall provide a response to card readers or keypad entries in less than 0.25 seconds, regardless of system size.

d. Controllers that are reset, or powered up from a nonpowered state, shall automatically request a parameter download and reboot to their proper working state. This shall happen without any operator intervention.

e. Initial Startup: When controllers are brought on-line, database parameters shall be automatically downloaded to them. After initial download is completed, only database changes shall be downloaded to each controller.

f. On failure for any reason, controllers shall perform an orderly shutdown and force controller outputs to a predetermined failure-mode state, consistent with the failure modes shown and the associated control device.

g. After power is restored, following a power failure, startup software shall initiate self-test diagnostic routines, after which controllers shall resume normal operation.

h. After controller failure, if the database and application software are no longer resident, controllers shall not restart but shall remain in the failure mode until repaired. If database and application programs are resident, ACCESS CONTROL 281300 - 8 controllers shall immediately resume operation. If not, software shall be restored automatically from the central station.

5. Communications Monitoring:

a. System shall monitor and report status of TIA 485-A communications loop of each Location.

b. Communication status window shall display which controllers are currently communicating, a total count of missed polls since midnight, and which controller last missed a poll.

c. Communication status window shall show the type of CPU, the type of I/O board, and the amount of RAM memory for each controller.

6. Operating systems shall include a real-time clock function that maintains seconds, minutes, hours, day, date, and month. The real-time clock shall be automatically synchronized with the central station at least once a day to plus or minus 10 seconds. The time synchronization shall be automatic, without operator action and without requiring system shutdown.

E. PC-to-Controller Communications:

1. Central-station or workstation communications shall use the following:

a. Direct connection using serial ports of the PC.

b. TCP/IP LAN interface cards.

2. Each serial port used for communications shall be individually configurable for "direct communications," "modem communications incoming and outgoing," or "modem communications incoming only," or as an ASCII output port. Serial ports shall have adjustable data transmission rates and shall be selectable under program control.

3. Use multiport communications board if more than two serial ports are needed.

a. Use a 4-, 8-, or 16-serial port configuration that is expandable to 32 or 64 serial ports.

b. Connect the first board to an internal PCI bus adapter card.

4. Direct serial, TCP/IP, and cable or satellite communications shall be alike in the monitoring or control of system except for the connection that must first be made to a voice-over IP Location.

5. TCP/IP network interface card (NIV) shall have an option to set the poll-frequency and message-response time-out settings.

6. PC-to-controller and controller-to-controller communications (direct or TCP/IP) shall use a polled-communication protocol that checks sum and acknowledges each message. All communications shall be verified and buffered, and retransmitted if not acknowledged.

F. Direct Serial or TCP/IP PC-to-Controller Communications:

1. Communication software on the PC shall supervise the PC-to-controller communications link.

281300 - 9 ACCESS CONTROL

2. Loss of communications to any controller shall result in an alarm at all PCs running the communication software.

3. When communications are restored, all buffered events shall automatically upload to the PC, and any database changes shall be automatically sent to the controller.

G. Controller-to-Controller Communications:

1. TIA 485-A, four-wire, point-to-point, regenerative (repeater) communications network methodology.

2. TIA 485-A communications signal shall be regenerated at each controller.

H. Database Downloads:

1. All data transmissions from PCs to a Location, and between controllers at a Location, shall include a complete database checksum to check the integrity of the transmission. If the data checksum does not match, a full data download shall be automatically retransmitted.

2. If a controller is reset for any reason, it shall automatically request and receive a database download from the PC. The download shall restore data stored at the controller to their normal working state and shall take place with no operator intervention.

I. Operator Interface:

1. Inputs in system shall have two icon representations, one for the normal state and one for the abnormal state.

2. When viewing and controlling inputs, displayed icons shall automatically change to the proper icon to display the current system state in real time. Icons shall also display the input's state, whether armed or bypassed, and if the input is in the armed or bypassed state due to a time zone or a manual command.

3. Outputs in system shall have two icon representations, one for the secure (locked) state and one for the open (unlocked) state.

4. Icons displaying status of the I/O points shall be constantly updated to show their current real-time condition without prompting by the operator.

5. The operator shall be able to scroll the list of I/Os and press the appropriate toolbar button, or right click, to command the system to perform the desired function.

6. Graphic maps or drawings containing inputs, outputs, and override groups shall include the following:

a. Database to import and store full-color maps or drawings and allow for input, output, and override group icons to be placed on maps.

b. Maps to provide real-time display animation and allow for control of points assigned to them.

c. System to allow inputs, outputs, and override groups to be placed on different maps.

d. Software to allow changing the order or priority in which maps will be displayed.

7. Override Groups Containing I/Os:

ACCESS CONTROL 281300 - 10

a. System shall incorporate override groups that provide the operator with the status and control over user-defined "sets" of I/Os with a single icon.

b. Icon shall change automatically to show the live summary status of points in that group.

c. Override group icon shall provide a method to manually control or set to time-zone points in the group.

d. Override group icon shall allow the expanding of the group to show icons representing the live status for each point in the group, individual control over each point, and the ability to compress the individual icons back into one summary icon.

8. Schedule Overrides of I/Os and Override Groups:

a. To accommodate temporary schedule changes that do not fall within the holiday parameters, the operator shall have the ability to override schedules individually for each input, output, or override group.

b. Each schedule shall be composed of a minimum of two dates with separate times for each date.

c. The first time and date shall be assigned the override state that the point shall advance to when the time and date become current.

d. The second time and date shall be assigned the state that the point shall return to when the time and date become current.

9. Copy command in database shall allow for like data to be copied and then edited for specific requirements, to reduce redundant data entry.

J. Operator Access Control:

1. Control operator access to system controls through three password-protected operator levels. System operators and managers with appropriate password clearances shall be able to change operator levels for operators.

2. Three successive attempts by an operator to execute functions beyond their defined level during a 24-hour period shall initiate a software tamper alarm.

3. A minimum of 32 passwords shall be available with the system software. System shall display the operator's name or initials in the console's first field. System shall print the operator's name or initials, action, date, and time on the system printer at login and logoff.

4. The password shall not be displayed or printed.

5. Each password shall be definable and assignable for the following:

a. Selected commands to be usable.

b. Access to system software.

c. Access to application software.

d. Individual zones that are to be accessed.

e. Access to database.

K. Operator Commands:

1. Command Input: Plain-language words and acronyms shall allow operators to use the system without extensive training or data-processing backgrounds.

System prompts shall be a word, a phrase, or an acronym.

281300 - 11 ACCESS CONTROL

2. Command inputs shall be acknowledged and processing shall start in not less than one second(s).

3. Tasks that are executed by operator's commands shall include the following:

a. Acknowledge Alarms: Used to acknowledge that the operator has observed the alarm message.

b. Place Zone in Access: Used to remotely disable intrusion-alarm circuits emanating from a specific zone. System shall be structured so that console operator cannot disable tamper circuits.

c. Place Zone in Secure: Used to remotely activate intrusion-alarm circuits emanating from a specific zone.

d. System Test: Allows the operator to initiate a system-wide operational test.

e. Zone Test: Allows the operator to initiate an operational test for a specific zone.

f. Print reports.

g. Change Operator: Used for changing operators.

h. Run system tests.

i. Generate and format reports.

j. Request help with the system operation.

1) Include in main menus.

2) Provide unique, descriptive, context-sensitive help for selections and functions with the press of one function key.

3) Provide navigation to specific topic from within the first help window.

4) Help shall be accessible outside the application program.

k. Entry-Control Commands:

1) Lock (secure) or unlock (open) each controlled entry and exit up to four times a day through time-zone programming.

2) Arm or disarm each monitored input up to four times a day through time-zone programming.

3) Enable or disable readers or keypads up to two times a day through time-zone programming.

4) Enable or disable cards or codes up to four times a day per entry point through access-level programming.

4. Command Input Errors: Show operator input assistance when a command cannot be executed because of operator input errors. Assistance screen shall use plain-language words and phrases to explain why the command cannot be executed. Error responses that require an operator to look up a code in a manual or other document are not acceptable. Conditions causing operator assistance messages include the following:

a. Command entered is incorrect or incomplete.

b. Operator is restricted from using that command.

c. Command addresses a point that is disabled or out of service.

d. Command addresses a point that does not exist.

e. Command is outside the system's capacity.

ACCESS CONTROL 281300 - 12

L. Alarms:

1. System Setup:

a. Assign manual and automatic responses to incoming-point status change or alarms.

b. Automatically respond to input with a link to other inputs, outputs, or operator-response plans; unique sound with use of WAV files; and maps or images that graphically represent the point location.

c. Sixty-character message field for each alarm.

d. Operator-response-action messages shall allow message length of at least 65,000 characters, with database storage capacity of up to 32,000 messages. Setup shall assign messages to zone.

e. Secondary messages shall be assignable by the operator for printing to provide further information and shall be editable by the operator.

f. Allow 25 secondary messages with a field of four lines of 60 characters each.

g. Store the most recent 1000 alarms for recall by the operator using the report generator.

2. Software Tamper:

a. Annunciate a tamper alarm when unauthorized changes to system database files are attempted. Three consecutive unsuccessful attempts to log onto system shall generate a software tamper alarm.

b. Annunciate a software tamper alarm when an operator or other individual makes three consecutive unsuccessful attempts to invoke functions beyond their authorization level.

c. Maintain a transcript file of the last 5000 commands entered at each central station to serve as an audit trail. System shall not allow write access to system transcript files by any person, regardless of their authorization level.

d. Allow only acknowledgment of software tamper alarms.

3. Read access to system transcript files shall be reserved for operators with the highest password authorization level available in system.

4. Animated Response Graphics: Highlight alarms with flashing icons on graphic maps; display and constantly update the current status of alarm inputs and outputs in real time through animated icons.

5. Alarm Handling: Each input may be configured so that an alarm cannot be cleared unless it has returned to normal, with options of requiring the operator to enter a comment about disposition of alarm. Allow operator to silence alarm sound when alarm is acknowledged.

M. Alarm Monitoring: Monitor sensors, controllers, and DTS circuits and notify operators of an alarm condition. Display higher-priority alarms first and, within alarm priorities, display the oldest unacknowledged alarm first. Operator acknowledgment of one alarm shall not be considered acknowledgment of other alarms nor shall it inhibit reporting of subsequent alarms.

281300 - 13 ACCESS CONTROL

1. Displayed alarm data shall include type of alarm, location of alarm, and secondary alarm messages.

2. Printed alarm data shall include type of alarm, location of alarm, date and time (to nearest second) of occurrence, and operator responses.

3. Maps shall automatically display the alarm condition for each input assigned to that map if that option is selected for that input location.

4. Alarms initiate a status of "pending" and require the following two handling steps by operators:

a. First Operator Step: "Acknowledged." This action shall silence sounds associated with the alarm. The alarm remains in the system "Acknowledged" but "Un-Resolved."

b. Second Operator Step: Operators enter the resolution or operator comment, giving the disposition of the alarm event. The alarm shall then clear.

5. Each alarm point shall be programmable to disallow the resolution of alarms until the alarm point has returned to its normal state.

6. Alarms shall transmit to central station in real time.

7. Alarms shall be displayed and managed from a minimum of four different windows.

a. Input Status Window: Overlay status icon with a large red blinking icon.

Selecting the icon will acknowledge the alarm.

b. History Log Transaction Window: Display name, time, and date in red text. Selecting red text will acknowledge the alarm.

c. Alarm Log Transaction Window: Display name, time, and date in red.

Selecting red text will acknowledge the alarm.

d. Graphic Map Display: Display a steady colored icon representing each alarm input location. Change icon to flashing red when the alarm occurs.

Change icon from flashing red to steady red when the alarm is acknowledged.

8. Once an alarm is acknowledged, the operator shall be prompted to enter comments about the nature of the alarm and actions taken. Operator's comments may be manually entered or selected from a programmed predefined list, or a combination of both.

9. For locations where there are regular alarm occurrences, provide programmed comments. Selecting that comment shall clear the alarm.

10. The time and name of the operator who acknowledged and resolved the alarm shall be recorded in the database.

11. Identical alarms from the same alarm point shall be acknowledged at the same time the operator acknowledges the first alarm. Identical alarms shall be resolved when the first alarm is resolved.

12. Alarm functions shall have priority over downloading, retrieving, and updating database from workstations and controllers.

13. When a reader-controlled output (relay) is opened, the corresponding alarm point shall be automatically bypassed.

ACCESS CONTROL 281300 - 14

N. Monitor Display: Display text and graphic maps that include zone status integrated into the display. Colors are used for the various components and current data. Colors shall be uniform throughout the system.

1. Color Code:

a. FLASHING RED: Alerts operator that a zone has gone into an alarm or that primary power has failed.

b. STEADY RED: Alerts operator that a zone is in alarm and alarm has been acknowledged.

c. YELLOW: Advises operator that a zone is in access.

d. GREEN: Indicates that a zone is secure and that power is on.

2. Graphics:

a. Support 32,000 graphic display maps and allow import of maps from a minimum of 16 standard formats from another drawing or graphics program.

b. Allow I/O to be placed on graphic maps by the drag-and-drop method.

c. Operators shall be able to view the inputs, outputs, and the point's name by moving the mouse cursor over the point on graphic map.

d. Inputs or outputs may be placed on multiple graphic maps. The operator shall be able to toggle to view graphic map associated with I/Os.

e. Each graphic map shall have a display-order sequence number associated with it to provide a predetermined order when toggled to different views.

f. Camera icons shall have the ability to be placed on graphic maps that, when selected by an operator, will open a video window, display the camera associated with that icon, and provide pan-tilt-zoom control.

g. Input, output, or camera placed on a map shall allow the ability to arm or bypass an input, open or secure an output, or control the pan-tilt-zoom function of the selected camera.

O. System test software enables operators to initiate a test of the entire system or of a particular portion of the system.

1. Test Report: The results of each test shall be stored for future display or printout.

The report shall document the operational status of system components.

P. Report Generator Software: Include commands to generate reports for displaying, printing, and storing on disk and tape. Reports shall be stored by type, date, and time.

Report printing shall be the lowest-priority activity. Report-generation mode shall be operator selectable but set up initially as periodic, automatic, or on request. Include time and date printed and the name of operator generating the report. Report formats may be configured by operators.

1. Automatic Printing: Setup shall specify, modify, or inhibit the report to be generated; the time the initial report is to be generated; the time interval between reports; the end of period; and the default printer.

2. Printing on Request: An operator may request a printout of any report.

281300 - 15 ACCESS CONTROL

3. Alarm Reports: Reporting shall be automatic as initially set up. Include alarms recorded by system over the selected time and information about the type of alarm (such as door alarm, intrusion alarm, tamper alarm, etc.), the type of sensor, the location, the time, and the action taken.

4. Access and Secure Reports: Document zones placed in access, the time placed in access, and the time placed in secure mode.

5. Custom Reports: Reports tailored to exact requirements of who, what, when, and where. As an option, custom report formats may be stored for future printing.

6. Automatic History Reports: Named, saved, and scheduled for automatic generation.

7. Cardholder Reports: Include data, or selected parts of the data, as well as the ability to be sorted by name, card number, imprinted number, or by any of the user-defined fields.

8. Cardholder by Reader Reports: Based on who has access to a specific reader or group of readers by selecting the readers from a list.

9. Cardholder by Access-Level Reports: Display everyone that has been assigned to the specified access level.

10. Panel Labels Reports: Printout of control-panel field documentation including the actual location of equipment, programming parameters, and wiring identification.

Maintain system installation data within system database so that they are available on-site at all times.

11. History Reports: Custom reports that allows the operator to select any date, time, event type, device, output, input, operator, Location, name, or cardholder to be included or excluded from the report.

a. Initially store history on the hard disk of the host PC.

b. Permit viewing of the history on workstations or print history to any system printer.

c. The report shall be definable by a range of dates and times with the ability to have a daily start and stop time over a given date range.

d. Each report shall depict the date, time, event type, event description, and device; or I/O name, cardholder group assignment, and cardholder name or code number.

e. Each line of a printed report shall be numbered to ensure that the integrity of the report has not been compromised.

f. Total number of lines of the report shall be given at the end of the report.

If the report is run for a single event such as "Alarms," the total shall reflect how many alarms occurred during that period.

12. Reports shall have the following four options:

a. View on screen.

b. Print to system printer. Include automatic print spooling and "Print To" options if more than one printer is connected to system.

c. "Save to File" with full path statement.

d. System shall have the ability to produce a report indicating status of system inputs and outputs or of inputs and outputs that are abnormal, out of time zone, manually overridden, not reporting, or in alarm.

13. Custom Code List Subroutine: Allow the access codes of system to be sorted and printed according to the following criteria:

ACCESS CONTROL 281300 - 16

a. Active, inactive, or future activate or deactivate.

b. Code number, name, or imprinted card number.

c. Group, Location, access levels.

d. Start and stop code range.

e. Codes that have not been used since a selectable number of days.

f. In, out, or either status.

g. Codes with trace designation.

14. The reports of system database shall allow options so that every data field may be printed.

15. The reports of system database shall be constructed so that the actual position of the printed data shall closely match the position of the data on the data-entry windows.

Q. Anti-Passback:

1. System shall have global and local anti-passback features, selectable by Location. System shall support hard and soft anti-passback.

2. Hard Anti-Passback: Once a credential holder is granted access through a reader with one type of designation (IN or OUT), the credential holder may not pass through that type of reader designation until the credential holder passes through a reader of opposite designation.

3. Soft Anti-Passback: Should a violation of the proper IN or OUT sequence occur, access shall be granted, but a unique alarm shall be transmitted to the control station, reporting the credential holder and the door involved in the violation. A separate report may be run on this event.

4. Timed Anti-Passback: A controller capability that prevents an access code from being used twice at the same device (door) within a user-defined amount of time.

5. Provide four separate zones per Location that can operate without requiring interaction with the host PC (done at controller). Each reader shall be assignable to one or all four anti-passback zones. In addition, each anti-passback reader can be further designated as "Hard," "Soft," or "Timed" in each of the four anti-passback zones. The four anti-passback zones shall operate independently.

6. The anti-passback schemes shall be definable for each individual door.

7. The Master Access Level shall override anti-passback.

8. System shall have the ability to forgive (or reset) an individual credential holder or the entire credential-holder population anti-passback status to a neutral status.

R. Visitor Assignment:

1. Provide for and allow an operator to be restricted to only working with visitors.

The visitor badging subsystem shall assign credentials and enroll visitors. Allow only those access levels that have been designated as approved for visitors.

2. Provide an automated log of visitor name, time and doors accessed, and name of person contacted.

3. Allow a visitor designation to be assigned to a credential holder.

4. Security access system shall be able to restrict the access levels that may be assigned to credentials issued to visitors.

5. Allow operator to recall visitors' credential-holder file, once a visitor is enrolled in the system.

281300 - 17 ACCESS CONTROL

6. The operator may designate any reader as one that deactivates the credential after use at that reader. The history log shall show the return of the credential.

7. System shall have the ability to use the visitor designation in searches and reports. Reports shall be able to print all or any visitor activity.

S. Training Software: Enables operators to practice system operation including alarm acknowledgment, alarm assessment, response force deployment, and response force communications. System shall continue normal operation during training exercises and shall terminate exercises when an alarm signal is received at the console.

T. Entry-Control Enrollment Software: Database management functions that allow operators to add, delete, and modify access data as needed.

1. The enrollment station shall not have alarm response or acknowledgment functions.

2. Provide multiple, password-protected access levels. Database management and modification functions shall require a higher operator access level than personnel enrollment functions.

3. The program shall provide means to disable the enrollment station when it is unattended, to prevent unauthorized use.

4. The program shall provide a method to enter personnel identifying information into the entry-control database files through enrollment stations. In the case of personnel identity-verification subsystems, this shall include biometric data. Allow entry of personnel identifying information into the system database using menu selections and data fields. The data field names shall be customized during setup to suit user and site needs. Personnel identity-verification subsystems selected for use with the system shall fully support the enrollment function and shall be compatible with the entry-control database files.

5. Cardholder Data: Provide 99 user-defined fields. System shall have the ability to run searches and reports using any combination of these fields. Each user-defined field shall be configurable, using any combination of the following features:

a. MASK: Determines a specific format with which data must comply.

b. REQUIRED: Operator is required to enter data into field before saving.

c. UNIQUE: Data entered must be unique.

d. DEACTIVATE DATE: Data entered will be evaluated as an additional deactivate date for all cards assigned to this cardholder.

e. NAME ID: Data entered will be considered a unique ID for the cardholder.

6. Personnel Search Engine: A report generator with capabilities such as search by last name, first name, group, or any predetermined user-defined data field; by codes not used in definable number of days; by skills; or by seven other methods.

7. Multiple Deactivate Dates for Cards: User-defined fields to be configured as additional stop dates to deactivate any cards assigned to the cardholder.

8. Batch card printing.

9. Default card data can be programmed to speed data entry for sites where most card data are similar.

10. Enhanced ACSII File Import Utility: Allows the importing of cardholder data and images.

ACCESS CONTROL 281300 - 18

11. Card Expire Function: Allows readers to be configured to deactivate cards when a card is used at selected devices

2.5 SYSTEM DATABASE

A. Database and database management software shall define and modify each point in database using operator commands. Definition shall include parameters and constraints associated with each system device.

B. Database Operations:

1. System data management shall be in a hierarchical menu-tree format, with navigation through expandable menu branches and manipulated with use of menus and icons in a main menu and system toolbar.

2. Navigational Aids:

a. Toolbar icons for add, delete, copy, print, capture image, activate, deactivate, and muster report.

b. Point and click feature to facilitate data manipulation.

c. Next and previous command buttons visible when editing database fields to facilitate navigation from one record to the next.

d. Copy command and copy tool in the toolbar to copy data from one record to create a new similar record.

3. Data entry shall be automatically checked for duplicate and illegal data and shall be verified for valid format.

4. System shall generate a memo or note field for each item that is stored in database, allowing the storing of information about any defining characteristics of the item. Memo field is used for noting the purpose for which the item was entered, reasons for changes that were made, and the like.

C. File Management:

1. File management shall include database backup and restoration system, allowing selection of storage media, including 3.5-inch floppy disk, Zip and Jaz drives, and designated network resources.

2. Operations shall be both manual and automatic modes. The number of automatic sequential backups before the oldest backup becomes overwritten; FIFO mode shall be operator selectable.

3. Backup program shall provide manual operation from any PC on the LAN and shall operate while system remains operational.

D. Operator Passwords:

1. Support up to 32,000 individual system operators, each with a unique password.

2. One to eight alphanumeric characters.

3. Allow passwords to be case sensitive.

4. Passwords shall not be displayed when entered.

5. Passwords shall have unique and customizable password profile, and allow several operators to share a password profile. Include the following features in the password profile:

281300 - 19 ACCESS CONTROL

a. Predetermine the highest-level password profile for access to all functions and areas of program.

b. Allow or disallow operator access to any program operation, including the functions of View, Add, Edit, and Delete.

c. Restrict doors to which an operator can assign access.

6. Operators shall use a user name and password to log on to system. This user name and password shall be used to access database areas and programs as determined by the associated profile.

7. Make provision to allow the operator to log off without fully exiting program. User may be logged off but program will remain running while displaying the login window for the next operator.

E. Access Card/Code Operation and Management: Access authorization shall be by card, by a manually entered code (PIN), or by a combination of both (card plus PIN).

1. Access authorization shall verify the facility code first, the card or card-and-PIN validation second, and the access level (time of day, day of week, date), anti-passback status, and number of uses last.

2. Use data-entry windows to view, edit, and issue access levels. Access-authorization entry-management system shall maintain and coordinate all access levels to prevent duplication or the incorrect creation of levels.

3. Allow assignment of multiple cards/codes to a cardholder.

4. Allow assignment of up to four access levels for each Location to a cardholder.

Each access level may contain any combination of doors.

5. Each door may be assigned four time zones.

6. Access codes may be up to 11 digits in length.

7. Software shall allow the grouping of locations so cardholder data can be shared by all locations in the group.

8. Visitor Access: Issue a visitor badge for data tracking or photo ID purposes without assigning that person a card or code.

9. Cardholder Tracing: Allow for selection of cardholder for tracing. Make a special audible and visual annunciation at control station when a selected card or code is used at a designated code reader. Annunciation shall include an automatic display of the cardholder image.

10. Allow each cardholder to be given either an unlimited number of uses or a number from one to 9999 that regulates the number of times the card can be used before it is automatically deactivated.

11. Provide for cards and codes to be activated and deactivated manually or automatically by date. Provide for multiple deactivate dates to be preprogrammed.

F. Security Access Integration:

1. Photo ID badging and photo verification shall use the same database as the security access and may query data from cardholder, group, and other personal information to build a custom ID badge.

2. Automatic or manual image recall and manual access based on photo verification shall also be a means of access verification and entry.

ACCESS CONTROL 281300 - 20

3. System shall allow sorting of cardholders together by group or other characteristic for a fast and efficient method of reporting on, and enabling or disabling, cards or codes.

G. Operator Comments:

1. With the press of one appropriate button on the toolbar, the user shall be permitted to enter operator comments into the history at any time.

2. Automatic prompting of operator comment shall occur before the resolution of each alarm.

3. Operator comments shall be recorded by time, date, and operator number.

4. Comments shall be sorted and viewed through reports and history.

5. The operator may enter comments in two ways; either or both may be used:

a. Manually entered through keyboard data entry (typed), up to 65,000 characters per each alarm.

b. Predefined and stored in database for retrieval on request.

6. System shall have a minimum of 999 predefined operator comments with up to 30 characters per comment.

H. Group:

1. Group names may be used to sort cardholders into groups that allow the operator to determine the tenant, vendor, contractor, department, division, or any other designation of a group to which the person belongs.

2. System software shall have the capacity to assign one of 32,000 group names to an access authorization.

3. Make provision in software to deactivate and reactivate all access authorizations assigned to a particular group.

4. Allow sorting of history reports and code list printouts by group name.

I. Time Zones:

1. Each zone consists of a start and stop time for seven days of the week and three holiday schedules. A time zone is assigned to inputs, outputs, or access levels to determine when an input shall automatically arm or disarm, when an output automatically opens or secures, or when access authorization assigned to an access level will be denied or granted.

2. Up to four time zones may be assigned to inputs and outputs to allow up to four arm or disarm periods per day or four lock or unlock periods per day; up to three holiday override schedules may be assigned to a time zone.

3. Data-entry window shall display a dynamically linked bar graph showing active and inactive times for each day and holiday, as start and stop times are entered or edited.

4. System…