Andover Continuum CyberStation Access Control Essentials Guide

(1)

(2)

No part of this publication may be reproduced, read or stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without prior written permission of Schneider Electric.

This document is produced in the United States of America.

Product Names are trademarks of Schneider Electric. All other trademarks are the prop-erty of their respective owners.

Title: CyberStation Access Control Essentials Guide

Revision: D

Date: December, 2010

Schneider Electric part number: 30-3001-405 CyberStation version 1.92

The information in this document is furnished for informational purposes only, is subject to change without notice, and should not be construed as a commitment by Schneider Electric. Schneider Electric assumes no liability for any errors or inaccuracies that may ap-pear in this document.

On October 1st, 2009, TAC became the Buildings Business of its parent company Schneider Electric. This document reflects the visual identity of Schneider Electric. However, there remain references to TAC as a corporate brand throughout the Andover Continuum soft-ware. In those instances, the documentation text still refers to TAC — only to portray the user interface accurately. As the software is updated, these documentation references will be changed to reflect appropriate brand and software changes. All brand names, trade-marks and registered trade-marks are the property of their respective owners.

Schneider Electric One High Street

North Andover, MA 01845 (978) 975-9600

Fax: (978) 975-9782

(3)

December, 2010

Access Control Essentials Guide

30-3001-405

(4)

(5)

About this Manual ...

9

What’s new in this Manual ... 9

Chapter 3

Monitoring an Access Control System ...

123

Responding to Alarms ... 124

About the Alarm Status Bar ... 124

About the Active Alarm View Window ... 124

Monitoring Live Access Events ... 127

About Creating EventView Objects ... 127

More about EventView Objects ... 127

Using ListView Windows ... 128

About Predefined ListView Objects ... 129

About Creating ListView Objects ... 129

More about ListView Objects ... 130

Chapter 4

Advanced Topics for Access Control ...

131

Security Groups for CyberStation Users ... 132

About User Objects ... 132

Before Configuring Users ... 133

Creating a User Object ... 133

About Security Groups ... 134

Configuring User Security Groups ... 135

Displaying Security Groups ... 136

(8)

Creating a SecurityLevel Object ... 143

Displaying Access Privileges in the Security Tab ... 143

Universal Unlock Folder ... 144

Assigning Access Privileges in a SecurityLevel Object .... 144

Copying Access Privileges from a Single Security Group to Another Group ... 147

More about Users and Security ... 148

Using Area Lockdown ... 149

About Area Lockdown ... 149

What Happens During Lockdown ... 150

Locking down an Area ... 150

Locking down Individual Doors ... 151

More about Area Lockdown ... 152

Controlling Access with Condition Levels ... 153

About Changing the Condition Level ... 154

Implementing Condition Levels and Clearance Levels 154 Sending a Condition Level Message to Controllers ... 155

Restoring Controller Condition Levels to Previous Levels ... 155

About Sending Condition Level Values to Individual Controllers ... 156

More about Condition and Clearance Levels ... 156

Adding FIPS-PIV Card Credentials ... 157

Overview of FIPS-PIV ... 157

Overview of FIPS-PIV cards and readers ... 160

Configuring FIPS-PIV on a New System ... 162

Transitioning an Existing system to FIPS-PIV ... 164

(9)

About this Manual

What’s new in this Manual

This manual provides basic, essential information for planning, configuring and monitoring an access control system consisting of Schneider Electric controllers and CyberStation software. This manual provides the following information:

z An introduction to planning for an access control system z Step-by-step procedures for basic configuration tasks in

CyberStation

z Step-by-step procedures for monitoring your access control system

using CyberStation

z An overview of advanced access control features that you may want

to implement in your facility

This manual is intended to be used with the CyberStation online help and the documentation that accompanies Schneider Electric

controllers.

For complete user-interface details (beyond the scope of the basic tasks in this manual), you must consult the online help and the other CyberStation documents listed in the next section. The procedural information in this manual assumes that your access control hardware and software are installed, online, and ready to be configured.

(10)

Chapter 1

Getting Started

This chapter offers guidance on planning your access control system and includes the following topics:

z A review of a sample floor plan for a manufacturing facility, its access control issues, and access control devices in place to address the issues for this sample site

z A network configuration of controllers, servers, and CyberStation workstations that provides the access control infrastructure for the sample site

(12)

Planning an Access Control System

Schneider Electric’s access control products support the full range of access control needs:

z Small buildings to multi-site facilities

z Limited access validation and monitoring of personnel movement

within a facility to extensive oversight

As you prepare to implement an access control system in your

organization, you may want to work from floor plans of your facility to identify factors such as the following that will affect implementation:

z Locations where access control is needed z Personnel who use these locations

z The movement of personnel from one location to another z How you want to manage access permissions in each location

(13)

The following illustration is a floor plan of a small office and manufacturing facility.

The following issues for this sample site determine the access control devices that are needed and the configuration of the system:

z At the main entrance, a receptionist greets employees and visitors during business hours. The main entrance is locked during off hours, but employees may need to enter and exit at those times. The employer wants to monitor use of this door during off hours.

z Warehouse and manufacturing employees can use the rear

entrance to enter and leave the building.

Emergency Exit Loading Dock

Warehouse Manufacturing Floor

Main Entrance Rear Entrance

(14)

z The door in the manufacturing area to the outside is for

emergencies only and should be closed and locked under normal circumstances.

z Only authorized employees are allowed onto the manufacturing floor.

z The employer wants to monitor manufacturing employees who exit the building through the warehouse to the rear entrance.

The following illustration shows the same floor plan, with access control devices in place.

Emergency Exit: Loading Dock:

Warehouse Manufacturing Floor

Main Entrance: Card Reader Single Reader

Office

at Rear

Entrance Door Switch is_Supervised Door Switch isSupervised

for Employee Access Dual-Reader Door Motion Detector: Single-Reader Door Camera: Captures Video

Unlocks Door during Regular Hours Triggers Video during Off Hours

(15)

The following table describes how these access control devices address the issues identified for this facility. Note that the devices used in this example are only one of many possible access control solutions that can be implemented.

Area or Door Access Control

Main Entrance z Card reader allows access to employees. No access to visitors unless the receptionist is present. z Motion detector unlocks door for

exiting during regular hours, and triggers alarm with video during off hours.

z Camera captures video if triggered during off hours. Security guard at CyberStation workstation is alerted and can view video.

z Supervised input on door detects tampering and trigger an alarm. Door to Manufacturing

from Office

z Card reader allows access only to authorized employees.

z No access-validation needed to exit Manufacturing through this door. Door to Manufacturing

from Warehouse

z Card reader allows access to Manufacturing only to authorized employees, and requires employees to present access cards to exit

Manufacturing through this door. Rear Entrance z Card reader allows employees access

to Warehouse.

z No access validation needed to exit to the outside using this door.

z Supervised inputs on door detect opening or tampering during off hours and trigger an alarm.

(16)

Loading Dock z Supervised inputs on door detect opening or tampering during off hours and trigger an alarm. Emergency Exit z Supervised inputs on door detect

opening or tampering and trigger an alarm.

(17)

Overview of an Access Control Network

This illustration represents a sample Andover Continuum Security architecture.

The following components are standard in a security setup:

z CyberStation

z ACX 57xx Controller z NetController II z web.Client Server

z Integral DVMS (Digital Video Management System) z Badge Printer

(18)

(19)

Chapter 2

Configuring an Access

Control System

This chapter contains step-by-step procedures for configuring an access control network in CyberStation using ACX 57xx and NetController II controllers. The chapter presents basic configuration tasks in the sequence that you typically perform them.

So that you can more readily understand how the elements of an access control network work together, the procedures in this chapter cover basic setup tasks for a simple network. Each procedure provides cross references to the CyberStation online help so that you can obtain complete, detailed information about all the options associated with a configuration task.

(20)

Task 1: Open Continuum Explorer

Objects are the building blocks of your access control network. In CyberStation, objects are categorized by class. Area, Door, Schedule, and Personnel are examples of object classes. An object’s attributes are determined by its object class, although the attribute values are specific to the individual objects.

Objects may represent:

z Physical devices, such as a controller or a workstation z Folders that are storage locations for objects

z Data, such as points, alarms, schedules, and personnel records

When you configure a network in CyberStation, you create the objects that correspond to the devices, folders, and data in your network, and you specify their attribute values. Continuum Explorer is the tool that you use to configure and manage your network.

Navigation Pane

Select an object in this pane to display the objects it contains in the Viewing Pane.

Networks and their objects are organized in a hierarchy under Root.

(21)

Open Continuum Explorer

1. Open CyberStation if it is not running at your workstation, and login.

2. At the CyberStation main menu, click Explorer. Note: You can also open Continuum by clicking:

Start>Programs>Continuum>Continuum Explorer Continuum Explorer opens. The navigation pane does not yet contain any network objects or controllers. However, other predefined objects, created for you during installation, are displayed.

3. Proceed to “Task 2: Create a Network and a Controller” on page 22.

More About Continuum Explorer

(22)

Task 2: Create a Network and a Controller

A network is a logical organization of controllers that know about each other and have the ability to exchange data. The ACX 57xx is a highly intelligent controller that is designed for access control.

Containers and Parent/Child Objects

Each network in CyberStation has a hierarchical structure of objects. Many objects can be containers for other objects. For example, a network object contains all the controllers in that network.

A container object is also called a parent object. All objects within the container are child objects that are “owned” by the parent object. These relationships are important for organizing the many objects that make up a network. They are also significant because you can apply settings to container objects that affect all the child objects within them.

Each network contains one or more controllers, up to a maximum of 190 controllers. You can create additional networks to manage more controllers.

(23)

Create a Network

When you configure an access control network, the first object you create is the network itself.

1. In Continuum Explorer, right click Root, select New, and then select Network.

2. Enter a name for the network for Object Name, and click the Create button.

3. In the Network editor, enter the Universal Time Coordinate (UTC) offset in minutes for Time Zone.

The UTC offset is the difference between your local time and Greenwich Mean Time (GMT). Enter “-” if local time is behind GMT.

Note: “-300” minutes is an example of the Time Zone offset for Eastern Standard time.

4. Click OK.

CyberStation creates an alias from the object name that you enter. You can edit the alias if you wish. An alias cannot contain symbols or spaces.

CAUTION

It is required that you locate Continuum controllers and workstations and Pelco video system in the same time zone. You should also ensure that they are time synchronized with each other.

The system manager can act as a time server. Since the system manager is essentially a PC, however, be aware that the time of the PC may drift.

(24)

Web Configuration for Controllers

The NetController II and the ACX controllers are commissioned and configured using your PC’s Internet Browser.

To configure the controller, it must be installed and connected to your Ethernet network.

IP configurable NetControllers and ACX controllers are shipped with default IP addresses and Subnet Mask values. These values must be changed to new values, which are assigned by your local IT personnel.

The default values for all IP configurable controllers are:

IP Address: 169.254.1.1 Subnet Mask: 255.255.0.0

Prior to changing these values, the PC being used to commission the controllers must be configured to communicate with the controllers at their default address.

The setup values for the PC are:

IP Address: 169.254.1.(191-254) Subnet Mask: 255.255.255.0

1. From Microsoft Internet Explorer, in the Address field, enter the controllers default IP address (169.254.1.1).

The Andover Continuum Embedded WebServer page appears.

(25)

The Controller Configuration Login dialog displays.

3. In the login dialog enter the default controller user name and password:

Username: acc Password: acc

Note: The password can be changed by right clicking the Continuum task icon and selecting Change your password...

(26)

The Controller Configuration screen appears on the left menu.

5. Select Controller Configuration.

6. In the Configurable Properties section enter the following information:

ACCNet ID IP Address Subnet Mask Gateway Address Web Server Port PPP IP Address

Transport Type; use the drop down menu to make the proper

selection.

7. In the Miscellaneous section, using the dropdown menu, select the following information:

IO Configuration

(27)

8. Select Submit to Controller. 9. Exit the configuration setup.

Note: Once you have finished commissioning your controller, your PC’s IP address and Subnet Mask value can be returned to their normal settings.

Create a Controller

Note: Before performing this procedure, you must first install the controller, connect it to your Ethernet network, and then commission the controller. Refer to “Web Configuration for Controllers” on page 24.

1. In Continuum Explorer, right click the existing network object, select New, and then select InfinityController.

2. Enter a controller name for Object Name, and click the Create button.

3. In the InfinityController editor, enter a unique number from 1 to 190 for ACCNetID.

Note: This must match what was entered in the web configuration page.

The ACCNetID value uniquely identifies the controller within the access control network.

4. Select the controller model from the Controller Type dropdown menu.

(28)

For example, select 5740 for an ACX 5740 controller.

5. Select the Network tab.

6. Enter the IP address of the controller and subnet mask, and if required, enter the default router.

You obtain this information from your IT administrator. 7. Click Apply.

8. Select the General tab, and then click the Teach button.

9. In the Select Teach Mode dialog, select the InfinityController Teach radio button, and click OK.

Note: To confirm that the Comm Status is online, click the Refresh button.

10. Click OK to close the InfinityController editor.

11. Proceed to “Task 5: Designate the Primary Access Server” on page 44. Serial Number and Version will be read from the controller after the Teach operation.

(29)

More about Networks and Controllers

See the following topics in the CyberStation online help:

z “Network Editor”

(30)

Task 3: Configure IOU Modules

After you finish configuring a controller with the Comm port editor, you can define your input and output. Start by defining the IOU modules with the IOUModule editor.

IOU modules are electrical units that contain a number of input and/or output circuits that are electrically and sometimes physically attached to controllers. They provide controllers with the ability to interface with the outside world. There are four types of IOU Modules:

z Input modules z Output modules

z Mixed input and output modules z Special-purpose modules

Creating an IOU Module Object

The following steps allow you to add an IOU Module object for an IOU Module connected to a controller.

1. Right click the controller that you want to own this module, select New, and then select IOUModule.

2. When the New dialog appears, name the IOUModule and click Create.

(31)

General Tab – IOUModule Editor

Use the General tab to enter basic information about the IOU module.

Description The description is optional, but a good description of the IOUModule object helps others when they need to test, modify or manipulate the network. To enter a description, type up to 32 characters (including spaces) in the text field.

IOU Number Enter the IOU number here. You must manually assign a unique number (between 1 and 32) for each IOU module on a network controller.

Physically label the IOU modules with the numbers you assign. This number is not the same as the 12-digit module ID # assigned to the individual module at the factory.

You will use this number when you configure points on this controller.

Model

(32)

Security Level Tab – IOUModule Editor

The SecurityLevel tab shows the object security level and access privileges for the object.

More about the IOUModule Editor

For more information, see the “IOUModule Editor” topic and its related subtopics in the CyberStation online help.

Comm

Status This displays Online or Offline, depending on whether the controller is in communication with the module.

Module ID and

Program ID

These Schneider Electric-assigned numbers appear after the Learn process. The only time you will need these numbers is when speaking to a Schneider Electric Support Representative. These numbers will help our staff to answer your questions. You may manually enter the Module ID number in this field, (if you know it), rather than following the Learn process.

Learn Use the Learn button to commission the IOU module on the network. See “Commissioning an IOU Module” on page 33 later in this chapter. Wink Use the Wink button after commissioning the IOU

module to confirm that your system recognizes the IOU module.

Click the Wink button. The Status light on the IOU module should flash. This indicates the IOU module was successfully commissioned.

Update IOU Click the Update IOU button to browse for a *.iou file (a Schneider Electric-provided Flash File for individual modules) when updating IOU modules with new firmware.

(33)

Commissioning an IOU Module

Perform this procedure after installing the IOU module on the controller.

1. In the IOUModule editor, click the Learn button.

A dialog displays requesting the operator to press the Commission button on the physical module.

2. At the IOU Module, press the Commission button on the front panel.

The dialog at the workstation should disappear indicating that it received the information from the module.

If the module is not easily accessible, you can enter the module ID found on the label inside the cover of the module into field, and click the Apply button.

3. In the IOUModule editor, click the Refresh button.

The ModuleID for commissioned module, the ProgramID field, and the IO model type (i.e., AO-4-8) are automatically entered. This

(34)

Task 4: Configure Controller Comm Ports

The comm port you select to configure and the settings you choose in the CommPort editor depend on the model of network controller and the device you want to connect to it. Refer to the CommPort Editor topic of the CyberStation online help to identify the appropriate settings to use for your devices.

To configure a comm port, follow these steps:

1. In Continuum Explorer, expand the network controller whose comm ports you want to configure.

2. CommPort objects appear in the list of objects in the viewing pane. Double click the CommPort class folder under the controller. 3. Double click the CommPort object you want to configure.

4. In the CommPort editor, select the appropriate settings in each tab as described on the following pages.

(35)

General Tab – CommPort Editor

In the General tab, enter basic information about the comm port.

Note: In the event of a controller reset, each comm port reverts to it’s original default mode. For a complete list of default modes for each comm port on each controller, please see the help topics: “Configuring Settings for Infinet or MSTP,” “Default Modes for Controller Comm Ports,” and “Summary of Comm Port

Characteristics.”

Description Type in a description for the comm port. You can use up to 32 alphanumeric characters. This attribute is optional, but providing a good description can aid other users.

Comm Port

Number The CommPort attribute displays the number of the comm ports you are editing. Default

Mode Each comm port has a default mode. To change the default mode, select a different one from the Default Mode dropdown menu. The Settings tab displays different attributes, depending on the default mode you select.

Refer to the table of default modes and their descriptions for more information.

(36)

.

Default Mode Description

Printer Select this option when connecting a serial printer to this port.

XDriver

(XDriver option must be enabled to support this function)

Select this option to use a customized external equipment driver to connect to a third-party device.

Note: Before you can select the XDriver, you must first install it using the instructions provided with the software.

To select an XDriver file, click the browse button to locate and select the file for the XDriver. NotConfigured Select this option if the comm port is available.

Indicates that the port is not preset to any other default mode configuration.

(37)

Viewing the Status of an XDriver Device

In the General tab, click the XDriver Status button to view the status of the device that is using the XDriver. The XDriver Status button displays the following read-only information:

Status Displays the status of the device, or XdrvNotInstalled when no XDriver file has been selected.

Error Displays the last error to occur on the device.

Error Time Displays the time and date that the last error occurred on the device.

Error Count Displays the number of errors that have occurred on the device since you last set it to zero. Increments to 255 errors and remains set at 255 until you reset it to zero by clicking the Reset Count button.

(38)

Settings Tab – CommPort Editor

The Settings tab is where you view or edit the communications speed and handshaking settings for the mode that you have chosen for the port.

Depending on which Default Mode you select on the General tab, some of the attributes on this tab may be unselectable (appear gray).

Baud Rate The Baud rate is the speed, measured in bits per second, at which the controller sends

information to the device that you are connecting to the comm port. Select the baud rate that matches that required by the equipment connected to this port.

(39)

Track CXD This option monitors a communications carrier detect signal called CXD. When selected, it enables the controller to detect when

communication with connected objects has been lost.

Depending on your modem configuration, the CXD (sometimes called DCD) signal (pin 8 on an RS_232 connector) is asserted “high” when the communications link is established between modems. Once the carrier signal is lost, CXD goes “low.” Track CXD looks for the high-to-low transition and makes the controller reset this comm port to its default mode. Track CXD “cleans up” the comm port by logging off the last user. Track CXD is selected by default, and it is required for comm ports that are connected to modems. If Track CXD is not selected, the controller cannot respond to the loss of the CXD signal.

Flow Control The flow control type determines how the comm port handles the flow of data between the controller and its attaches device (usually a printer, modem, or terminal). This process is also known as “handshaking.”

Select one of the following options from the dropdown menu:

z NoFlowControl: Select this flow control

type if you do not want to regulate the flow of information between the controller and its attached printer, modem, or terminal. Without a flow control type, buffers that hold data that is being transmitted or received could overflow, and some data could get lost.

(40)

CtsRts: This flow control type uses hardware signals to send “clear to send” (Cts) and “request to send” (Rts) messages. Both of these messages must be acknowledged by the controller and its attached device before information can be transmitted.

z XonXoff: This control flow type uses

software signals in the form of characters that are sent as part of the data being transmitted. When the controller or its attached device detects that it has been sent an Xon character, it makes itself available to receive data. It considers all data received after the Xon character as valid. When it detects an Xoff character at the end of the data steam, the controller or attached device knows the transmission is complete.

z XonXoff CtsRts: This flow control type uses

both the software (XonXoff) and hardware (CtsRts) handshake methods for regulating the flow of information between the

controller and its attached device.

Current Mode This is a read-only attribute that shows you the default mode selected in the General tab.

(41)

SecurityLevel Tab – CommPort Editor

Refer to “CommPort Editor” topic of the CyberStation online help for details regarding attaching or detaching SecurityLevel objects.

Field Bus Controllers Tab – CommPort Editor

When you set the General tab’s Default Mode to Infinet, MS/TP, or Wireless, the Field Bus Controllers tab appears on the CommPort editor.

This tab displays the controllers that reside on their respective field bus network — Infinet, BACnet MS/TP, or Wireless — connected to this comm port. The controllers will not display, however, until you click the Learn button on the Settings tab.

The CommStatus column displays either Online or Offline for controllers listed in the Name column. When a controller is Online, it is communicating with the rest of the network.

(42)

NetController II Model 9680

Comm Port Default Mode Other Modes

Infinet Port -

-User Port -

-COMM1 AutoSet Printer; Infinet; Lbus; LON; PPP; Wireless; XDriver COMM2 AutoSet Printer; Infinet; Wireless;

XDriver

COMM3 AutoSet Printer; PP; XDriver COMM4 AutoSet Printer I; Lbus; XDriver

COMM16 LON XDriver

(43)

-ACX 57XX Series

Note: For additional information, in the Comm Port editor, see the help topics: “Configure Settings for Infinet”, “Default Modes for Controller Comm Ports”, and “Summary of Comm Port

Characteristics”

Comm Port Default Mode Other Modes

Infinet Port -

-User Port -

-COMM1 AutoSet Infinet; Wireless; XDriver

COMM2 -

-COMM3 -

-COMM4 -

-COMM16 -

(44)

-Task 5: Designate the Primary Access Server

The Primary Access Server is the CyberStation workstation that you designate to record access events in the CyberStation database. If your network has multiple CyberStation workstations, you also should designate another workstation as a Secondary Access Server.

1. In Continuum Explorer, right click the workstation that you want to make the primary access server, and select Edit.

2. In the General tab of the Device editor, check the Primary Access Server check box, and click OK.

3. When prompted to teach the controllers and workstations about this workstation, click Yes.

4. Proceed to “Task 6: Create CyberStation Points” on page 45.

More about the Primary Access Server

See the topic “Device Editor” in the CyberStation online help. Select this check box.

(45)

Task 6: Create CyberStation Points

A point is an object that stores a value, such as an input indicating the status of a door lock, an output that locks or unlocks a door, or a True-False condition that triggers an alarm.

In access control systems, you most often work with the following types of point objects:

Points enable you to monitor and control access events. You use these points with schedules, alarms, and other objects to establish routine access control and to respond to unauthorized access events.

Create an InfinityInput Point

Supervised input points can monitor:

z The status of a contact or switch, and

z Whether the wiring for the contact or switch was tampered with. Supervised points can have one of three values: On, Off, or Trouble.

Point Type Use in Access Control Systems

Supervised

InfinityInput Used to monitor contact status as well as the condition of the wiring, allowing CyberStation to detect that wiring was tampered with.

Digital InfinityOutput Used to specify a digital (On or Off) value, allowing CyberStation to change the status of a switch or a contact.

InfinityNumeric Software point that stores a number value, including an On/Off value (1 or 0).

InfinityDateTime Software point that stores a date and time value.

(46)

You create a supervised input point for each input (for example, from a contact sensor) from the devices wired to channels at each controller in your network.

1. In Continuum Explorer, right click the controller where you want to create the point, select New, and then select InfinityInput. 2. Enter a point name for Object name, and click the Create button. 3. In the General tab of the InfinityInput editor, enter the units for

this point.

For example, define the meaning of the On value: “On = Closed.” Leave the Value field at 0. The system updates the value with the input from the associated controller channel.

4. Select the Settings tab.

5. Select Supervised for Elec Type.

6. Enter the controller channel number (marked on the controller) to which this input is wired.

7. Enter $####### for Format.

Entering a description helps other users identify what this point represents.

(47)

$ indicates a text value. Each # is a placeholder for one character. This format enables On, Off, or Trouble to be reported for the value.

$ indicates a text value. Each # is a placeholder for one character. Use a period to indicate the position of the decimal point, if needed An example for the Format value is “$#####.#”

8. Select the appropriate input type based on the wired configuration of the switch (normally open with a resistor in series, normally closed with a resistor in series).

(48)

Create an InfinityOutput Point

An InfinityOutput point is a digital point that stores the value of a signal sent to an access control device. The value is sent via the controller channel to which the device is wired, and is used to control the device. For example, the output may lock a door.

An output point can have a value of On or Off. You create an output point for each output (for example, to a door lock) to the devices wired to channels at each controller in your network.

1. In Continuum Explorer, right click the controller where you want to create the point, select New, and then select InfinityOutput. 2. Enter a point name for Object name, and click the Create button. 3. In the General tab of the InfinityOutput editor, enter the units

for this point.

For example, define the meaning of the On value: “On = Unlock.” Leave the Value field at 0.

4. Select the Settings tab. 5. Select Digital for Elec Type.

(49)

6. Enter the controller channel number (marked on the controller) to which this output is wired.

7. Enter $### for Format.

$ indicates a text value. Each # is a placeholder for one character. This format enables On or Off to be reported for the value.

(50)

Create an InfinityNumeric Point

An InfinityNumeric point stores a number value, such as:

1. In Continuum Explorer, right click the controller where you want to create the point, select New, and then select InfinityNumeric. 2. Enter a point name for Object name, and click the Create button. 3. In the General tab of the InfinityNumeric editor, enter the units

for this point.

For example, define the meaning of the point value: “Max. Occupancy = 100” or “On=Occupied.”

4. Leave Value empty, or enter a value, depending on how you intend to use this point.

For example, if the point will be a constant, enter the number. If the value will be the result of a calculation, do not enter anything in the field.

5. Enter the format of the value for Format.

$ indicates a text value. Each # is a placeholder for one character. Use a period to indicate the position of the decimal point, if needed

Value Example

System constant Maximum occupancy for a specific area Result of a calculation Current occupancy of the area

(51)

An example for the Format value is “$#####.#”.

6. Click OK.

7. Proceed to “Task 7: Create Areas” on page 52.

More about Points

z “InfinityInput Editor” z “InfinityOutput Editor” z “InfinityNumeric Editor”

(52)

Task 7: Create Areas

An area is a space that can be accessed only by passing through an access control device, such as a card reader or keypad. Each area can be accessed through one or more doors where access control devices are configured.

For example, the manufacturing floor of a small facility might have doors leading to other areas of the facility, such as an office area, stock room, and emergency exit to the outside.

Factors to Consider When Defining Areas

Unlike Door objects, which correspond to actual doors in your facility, Area objects are not necessarily direct representations of each physical space in your facility. The number of Area objects that you need to create depends on many factors, including:

z The size and physical layout of your facility

z The movement of personnel into, out of, and through your facility

Lobby/Offices

Manufacturing Floor

(53)

z The degree of access control that you require for the movement of personnel within the facility

z The types of personnel who need access to various locations in your facility and when access is needed

After you create an area object, you configure doors that access the area. You also assign the area to personnel who need access to it. In addition, you can attach schedule points to Door and Personnel objects to determine when access can occur.

Create an Area

Because the doors accessing an area may be managed by different controllers, you typically create a folder for Area objects from Root. 1. In Continuum Explorer, right click Root, select New, and then

select Folder.

2. Enter a folder name, and click the Create button. 3. Right click the folder, select New, and then select Area. 4. Enter an area name, and click the Create button. 5. In the Area editor, click OK.

You can now assign doors and personnel to this area. 6. Proceed to “Task 8: Create Doors” on page 54.

More about Areas

(54)

Task 8: Create Doors

Door objects, along with Area and Personnel objects, are the

fundamental elements of your access control system. Door objects are highly customizable, and you can configure doors to meet the access control requirements of specific locations. You can configure access control devices, such as card readers and keypads, on one side of a door (single-reader door) or on both sides (dual-reader door).

When to Create a Door

You create Door objects only for doors that have access control devices associated with them. If you want to monitor a door that is simply closed or locked under normal circumstances, such as a fire door, you can do this by setting up supervised input points for the door switch and contacts.

Data that Defines a Door

You will need the following information to define each door:

z Card-format information for access-card sets

z Site codes (Wiegand or ABA card formats only) accepted at the door z Area(s) to which the door provides access

z Type of validation needed at the door (by site code, card number,

personal identification number [PIN], etc.)

z Channel numbers for card reader and keypad inputs z Channel numbers for door inputs and outputs

You can also attach schedule points to a door to determine when the door is locked or unlocked or when no access is allowed.

(55)

Create a Door

You create Door objects in the controller to which the door and reader inputs and outputs are wired.

1. In Continuum Explorer, right click the controller where you want to add the door, select New, and then select Door.

2. Enter a door name, and click the Create button. 3. In the Door editor, select the Card Formats tab.

4. If you use Wiegand cards, enter the site code(s) used with your access cards.

(56)

5. Select the card format, Wiegand or ABA, and then select the individual formats that you want the reader to recognize.

Note: The FIPS-PIV options are included in the Wiegand Formats section. Cyberstation version 1.9 and higher supports this special personnel category for federal employees and contractors whose security identification must comply with the Federal Information Processing Standard for Person Identity Verification (FIPS-PIV). In Cyberstation you can configure door and Personnel objects to accommodate PIV card or “credential” holders and FIPS-PIV card readers. For more information, see Adding FIPS-PIV Card Credentials in Chapter 4, Advanced Topics for Access Control. Refer also to the CyberStation help topic, “Defining a Custom FIPS-PIV String Format.”

6. Select the Entry Reader tab.

7. Enter the channel number on the controller that is connected to the card reader at this door.

(57)

9. Select the access validation options required at this door.

10. If the door has readers on both sides, select the Exit Reader tab, and repeat steps 7 - 9 to configure the second reader.

(58)

11. Select the Channels tab.

12. Enter the channel number where each input or output is wired.

Channel Description

Door Output Channel to which the door lock is wired. ADA (Americans

with Disabilities Act) Output

Channel to which an electronic door opener is wired.

Alarm Output Channel that will be energized when an alarm condition is active at this door. Exit Request Input Channel that receives input from a motion

detector, request-to-exit (REX) button, or other REX device.

(59)

Door Switch Input Channel to which the door switch is wired. The door switch monitors whether the door is open or closed. You also select the resistor type for the switch.

Bond Sensor Input Channel to which a bond sensor is wired. A bond sensor determines the physical position of the door latch. You also select the resistor type for the sensor.

ADA (Americans with Disabilities Act) Exit Request Input

Channel for input that requests that the door be opened for a person to leave the area accessed by this door.

ADA (Americans with Disabilities Act) Input

Channel for input indicating that the card holder has ADA access enabled on his or her access card.

(60)

(61)

14. Under Send Access Events, select the events you want to log for this door.

The events that you select for this door can be shown in logs, ListView and EventView windows, and reports. Events not selected here are not captured and cannot be retrieved for later viewing and reporting.

15. Click OK.

Note: Cyberstation version 1.9 and higher supports a special personnel category for federal employees and contractors whose security identification must comply with the Federal Information

Processing Standard for Person Identity Verification (FIPS-PIV). In Cyberstation you can configure door and Personnel objects to accommodate PIV card or “credential” holders and FIPS-PIV card readers. For more information, see Adding FIPS-PIV Card Credentials in Chapter 4, Advanced Topics for Access Control.

View Doors Assigned to an Area

1. In Continuum Explorer, expand the folder where you created areas, and double click the area to which you assigned the new door. 2. In the Area editor, select the Doors to Area tab.

(62)

The door you created now appears in the list. The list indicates whether the door provides access to the area, exits the area, or both.

3. Click Cancel.

4. Proceed to “Task 9: Create Personnel” on page 63.

More about Doors

See either the topic, “Door,” and its subtopics, or “Door Editor” in the CyberStation online help.

(63)

Task 9: Create Personnel

A Personnel object stores the access information for each person authorized to enter your facility. Personnel objects can also store personal and employee data for each person.

Access-Control Information in a Personnel Object

You can specify access control information for each Personnel object, such as:

z Card format z Site code z Card number

(64)

z Schedules points that determine when the person can access assigned areas

More advanced access control settings, such as area clearance levels and executive privilege, can also be defined in a Personnel object. These are described in greater detail in the CyberStation online help.

In addition, if you have purchased the badging option, you can create ID badges for Personnel objects. The badges can include a photo, signature, fingerprint, etc., to identify the card holder.

Methods of Creating Personnel Objects

You have several options for creating Personnel objects:

z You can enter new Personnel objects in the Personnel Manager dialog.

z You can use the Personal Import Utility to import personnel records from another application into CyberStation. Once imported, these records become Personnel objects that you can edit and manage in the Personnel Manager.

z You can import personnel records from a .CSV file and save the imported data as Personnel objects.

z You can create Personnel objects from templates.

z You can add new Personnel objects from Continuum Explorer.

Open the Personnel Manager for the First Time

The Personnel Manager automatically opens when you double click a Personnel object in Continuum Explorer. However, if you have not yet created any Personnel objects, you create a new Personnel object in Continuum Explorer, which also opens the Personnel Manager. You typically create one or more folders in which to store Personnel objects.

1. To create a Personnel folder in Continuum Explorer, right click Root, select New, and then select Folder.

2. Enter a folder name, and click the Create button.

(65)

4. Enter a name for the Personnel object (for example, you might want to enter the last name and first initial of the person), and click the Create button.

The Personnel Manager opens.

5. In the Details tab, enter the person’s full name. 6. Select the card format for Card Type.

7. For Wiegand cards, enter the site code for the card. For FIPS-PIV cards, enter agency code and system code.

8. Enter the card number. For FIPS-PIV cards, enter credential number.

(66)

10. Select the check box next to areas this person can access.

You can expand an area to attach a schedule point. Schedule points are described in “Task 10: Create Schedules” on page 68.

11. Click Apply.

Note: Cyberstation version 1.9 and higher supports a special personnel category for federal employees and contractors whose security identification must comply with the Federal Information

Processing Standard for Person Identity Verification (FIPS-PIV). In Cyberstation you can configure door and Personnel objects to accommodate PIV card or “credential” holders and FIPS-PIV card readers. For more information, see Adding FIPS-PIV Card Credentials in Chapter 4, Advanced Topics for Access Control.

Create a Personnel Object in the Personnel Manager

When the Personnel Manager is open, you can continue creating Personnel objects without closing and reopening it each time. 1. In the Personnel Manager, click the Add Record button. 2. Repeat steps 5 - 11 above to enter information for this person. 3. When you finish adding Personnel objects, click OK to save the

current object and close the Personnel Manager. 4. Proceed to “Task 10: Create Schedules” on page 68.

Note: An alternate method for creating a Personnel object is with the Personnel Editor. Refer to the “Personnel Editor” topic in the CyberStation online help for more details.

(67)

More about Personnel Objects

z “Personnel Manager”

z “Personnel Editor”

z “Personnel Import Utility”

(68)

Task 10: Create Schedules

A schedule is a graphical calendar of events that CyberStation uses to determine when activities occur. Access-control activities that you can manage with schedules include:

z When doors are locked or unlocked z When personnel have access to areas

About Schedule Points

Schedules use the following points to determine when the schedule is active and which CyberStation objects are controlled by the schedule:

z InfinityDateTime points that are updated with occupied and unoccupied times

z An InfinityNumeric or InfinityOutput point whose value is set by the schedule. Other objects that reference this point, such as a door, are controlled by the schedule that sets the point value.

(69)

Create and Configure a Schedule

You create schedules in the controller where the schedule will be used. (Later, you can use the Schedule editor’s Mass Create feature to copy the schedule to other controllers in your network, if needed.)

Note: Before creating a schedule, you must create the points called for in the schedule. See “Task 6: Create CyberStation Points” on page 45.

1. In Continuum Explorer, right click the controller, select New, and then select Schedule.

2. Enter a schedule name, and click the Create button. 3. In the Schedule editor, select the Configuration tab.

(70)

4. Under Point Configuration, use the browse button to locate each of the following points:

An InfinityDateTime point that the schedule updates with the

next occupancy time (the date and time at which an area will next be occupied)

An InfinityDateTime point that the schedule updates with the

next unoccupancy time (the date and time at which an area will next be unoccupied)

5. Use the browse button to locate the InfinityNumeric point that the schedule will set for Occupancy Point.

The value of this point will be set to On (Occupancy Time is now.) or Off (Unoccupancy Time is now.).

6. Check the Automatic Download check box, and select the day of the week and the time you want CyberStation to download the schedule to the controller.

7. Click OK.

8. In Continuum Explorer, right click the workstation that you want to perform the schedule download, and select Open.

9. In the General tab of the Device editor, click the Auto Download check box, and click OK.

Each week, at the day and time you selected in the schedule, this workstation downloads the next seven days of the schedule to the controller.

(71)

Attach a Schedule Point to a Door

After you create and configure a schedule, you attach the point you selected for the Occupancy Point to the objects you want the schedule to control.

1. In Continuum Explorer, double click the door to which you want to attach the schedule point.

2. In the Door editor, select the Options tab.

3. Click the browse button next to one of the schedule fields, and navigate to and select the schedule point you want to attach. You can use schedule points to control the door in two ways:

4. If you are using the Force Lock option, select the Entry Reader tab, and ensure that the Door Force Lock Schedule check box is selected for Normal under Access Validation. Repeat for the Exit Reader tab if this is a dual-reader door.

5. Click OK.

Attach the point to . . . To . . . Door Force Lock

Schedule

z Lock the door, with access allowed to valid personnel when the schedule is On, and

z Lock the door, with no access allowed when the schedule is Off. Door Force Unlock

Schedule

z Unlock the door, with no access validation required when the schedule is On, and

z Lock the door, with access allowed to valid personnel when the schedule is Off.

(72)

Attach a Schedule Point to an Area in a Personnel Object

Attaching schedule points to areas in a Personnel object enables you to specify when this person can access the assigned areas without

affecting access to the areas by other personnel.

For example, you may want permanent employees to have access to your facility at any time. You may also want temporary workers to have access only during the regular business day and be denied access after hours. You can limit the times of access for temporary workers by attaching schedule points to area assignments in their Personnel objects.

1. In Continuum Explorer, double click the Personnel object that you want to edit.

2. In the Personnel Manager, under Access Rights, expand Assigned, and then expand an area where you want to attach a schedule point.

If . . . Then . . .

A schedule point is attached to

an area in the Personnel object the person can access the area only when the schedule associated with the point is active.

No schedule point is attached to an area in the Personnel object

the person can access the area as determined by schedules (if any) that are attached to doors to the area.

(73)

3. Click the icon next to Add Schedule to display the Add Schedule dialog.

4. Select the browse button next to Schedule Points Location to locate, and select the controller with the schedule point that you want to add.

5. Select a schedule point, select the area(s) where you want to attach the point, and click OK.

6. Click OK.

7. Proceed to “Task 11: Configure Alarms” on page 75. Click here to display

the Add Schedule dialog.

Select a schedule point in this pane . . .

. . . And in this pane, select the check box for each area that you want to use the point.

(74)

More about Schedules

z “Schedule Editor”

z “Options Tab” (located in the “Door Editor” topics)

z “Editing a Personnel Object” (located in the “Personnel Manager” topics)

(75)

Task 11: Configure Alarms

When you have configured your access control system to define when, where, and to whom access is permitted, your next task is to set up alarms that notify you when unauthorized access is attempted or other access-related conditions occur.

Two CyberStation objects work together to define alarm conditions and the system’s response to the alarm:

z An EventNotification object determines what happens in response

to the alarm.

z An AlarmEnrollment object specifies the conditions that define the

alarm state and the return to normal state. You attach an

AlarmEnrollment object to the objects, such as doors and points, to configure the alarm for that object.

About Event-Notification Objects

In an EventNotification object, you specify how the system responds to an alarm condition. You also specify how a user, when notified of an alarm, must respond to acknowledge the alarm.

Actions the system can take include:

z Displaying alarm messages in the Active Alarm View window or

the Alarm Status bar at specific workstations

z Beeping or playing an audio file at the workstations

z Sending an e-mail message and/or paging one or more individuals

These EventNotification objects define the response to alarms of different levels of severity.

These AlarmEnrollment objects define some typical door-related alarm conditions.

(76)

z Displaying a video layout that shows video from cameras in locations affected by the alarm

z Displaying a graphics panel associated with the alarm You can also specify the notification actions that occur when the conditions that triggered the alarm return to normal.

Create an Event-Notification Object

You create EventNotification objects in Root. Typically, you create a folder in Root to store both EventNotification objects and

AlarmEnrollment objects.

1. In Continuum Explorer, right click Root, select New, and then select Folder.

2. Enter a folder name, and click the Create button. 3. Right click the folder, select New, and then select

EventNotification.

4. Enter a name, and click the Create button.

Note: The Fault state referred to in the EventNotification editor does not apply to access control events.

5. In the General tab of the EventNotification editor, enter a number for the priority of the alarm state and the return to normal state.

(77)

Priority is used to sort events in the Active Alarm View window, with higher-priority events (events with a smaller priority number) at the top of the list. For example, a certain kind of alarm may be priority 1, while the return to normal for the alarm is priority 10. You can choose how you want to assign priorities to alarms.

6. Under Colors and Fonts, right click to select the colors and fonts used to display the alarm in the Active Alarm View window and the Alarm Status bar.

7. If you want the notification to be reissued if the alarm continues, enter the number of minutes between notifications for Repeat. 8. Select the Actions tab.

(78)

9. Click the check box next to each action you want the system to take in notifying users of the alarm and the return to normal.

Note: You can receive an email notification of an alarm by choosing one of the email selections from the checklist. For more information about email notification of alarms see “About Notification by E-mail and Pages” on page 80.

10. Select the Delivery tab.

11. Click the Add Recipient button.

12. In the Recipients Configuration dialog, click the browse button to locate and select the CyberStation workstation to be notified of the alarm.

Note: The “recipients” referred to in this dialog are the CyberStation workstations that you want to be notified of the alarm and that will then take the actions you selected in the Actions tab. 13. Specify the days and times of day that this workstation should

(79)

For example, you might designate Workstation 1 as the recipient of alarm notification during office hours Monday through Friday. You might then designate another workstation as the recipient of notification at night and on weekends.

14. Click the check box next to the actions the workstation should take if it receives notification during the times you selected.

If you want the

workstation . . . Then . . . Always to perform the

action Select the check box under Primary for the action. To perform the action only

if a workstation that was designated as primary for this action is offline

Select the check box under Secondary for the action.

To perform the action only

(80)

15. Click OK.

16. Select the Deactivate tab.

17. Select when to remove the alarm from the Active Alarm View window.

18. Click OK.

You can now create an AlarmEnrollment object that uses this EventNotification object.

About Notification by E-mail and Pages

If you want to use the e-mail and paging options in an

EventNotification object, you also need to set up distribution lists in the e-mail application at the computer that distributes alarm

notifications. For each EventNotification object, create a distribution list of the people you want to be paged or receive e-mail when an associated alarm occurs.

Create the lists in the first address book that appears in the e-mail application, and use the formats shown in the following table for the list names. The list names in the Example column are for an

EventNotification object named “dooralarms.”

Requirements for forwarding CyberStation alarms via E-mail or page:

z The CyberStation workstations that have been designated primary and backup E-mail and/or page handlers must have a MAPI-compliant E-mail client such as MS Exchange or Outlook.

z The mail client application can communicate with an existing E-mail server application, such as MS Exchange Server.

z The primary or backup E-mail/paging workstation must be running CyberStation at the time an alarm is generated.

(81)

z Each EventNotification object associated with the alarms that you wish to E-mail or page must have its own E-mail distribution list in the personal address book or Contacts list of the client E-mail application using a specified naming convention as outlined in Step 4 below.

This E-mail distribution list must be stored in the first address book shown in the list of available address books in the E-mail client application. For example, if you create an EventNotification distribution list in the Personal Address Book in Microsoft Outlook, then the Personal Address Book must be the first one showing in the address list dropdown menu when you open the Address Book.

Creating an EventNotification Distribution List

To create an E-mail or page distribution list, proceed as follows: Note: The following steps are based on Microsoft Outlook. Other mail applications may have different menu names and choices but the general procedure is the same.

1. Open the Address Book for the E-mail account on the CyberStation workstation that will be providing the E-mail/paging service(s). Your toolbar may have a button for this. If not, use the Address Book option of the Tools menu.

2. Select New Entry from the Files menu.

3. Select the entry type Personal Distribution List and put this entry in the Personal Address Book.

4. In the Name field enter a name for the distribution list using the following format:

List

Type Format of List Name Example

E-mail acc.eventnotification.na

me acc.eventnotification.dooralarms Paging acc.page.eventnotificatio

(82)

For example, if your EventNotification object is named Severe, the personal distribution list for E-mail deliveries should be named: ACC.Severe. Likewise, your personal distribution list for page deliveries should be named: ACC.page.Severe.

Note: Use the EventNotification object Name not the Alias, for example, Critical Temp, not CriticalTemp.

5. Add members (the E-mail addresses or pager and service numbers of those to whom the notification of the alarm will be sent) to your personal distribution lists.

6. Set address book options so that the address book where your personal distribution lists are stored is the first one to be searched when sending E-mails or pages. For example, in Microsoft

Exchange, select Options from the Tools menu. Click the Addressing tab. When sending mail, check names using these address lists in the following order area, use the Add button, then the up or down arrow buttons to add the correct address book to this field and position it at the top of the list.

About AlarmEnrollment Objects

An AlarmEnrollment object:

z Defines the conditions that your access control system uses to determine that a point is in the alarm state

z Defines the conditions that the system uses to determine that the point has returned to its normal state

z Contains the text messages that are displayed in the Active Alarm View window or the Alarm Status bar

z Has an attached EventNotification object that defines how the system responds to the alarm and notifies the appropriate people You attach an AlarmEnrollment object to points, doors, and other objects that you want to alarm.

(83)

Create an Alarm-Enrollment Object

You create AlarmEnrollment objects in Root or in an alarms folder that you previously created in Root for AlarmEnrollment and

EventNotification objects.

1. In Continuum Explorer, right click the folder that contains your AlarmEnrollment objects, select New, and then select

AlarmEnrollment.

2. Enter a name for the alarm (for example, doorisajar), and click

the Create button.

3. In the General tab of the AlarmEnrollment dialog, click the browse button to locate and select the EventNotification object that determines how the system responds to the alarm.

4. Select Value for Alarmed Attribute.

This is the attribute that triggers the alarm, based on the parameters you define for Value in the Algorithms tab. 5. Select Expression for Alarm Type.

You define the expression used to define the alarm condition in the Algorithms tab. Most access control alarms use the Expression

The EventNotification object you select here determines how the system responds if the alarm condition occurs.

(84)

Andover Continuum CyberStation Access Control Essentials Guide

December, 2010

Access Control Essentials Guide

Chapter 3

Chapter 4

About this Manual

Related Documentation

Document Document Number

Chapter 1

Planning an Access Control System

Warehouse Manufacturing Floor

Warehouse Manufacturing Floor

Area or Door Access Control

Overview of an Access Control Network

Task 1: Open Continuum Explorer

Navigation Pane

Open Continuum Explorer

More About Continuum Explorer

Create a Network

CAUTION

Create a Controller

More about Networks and Controllers

Creating an IOU Module Object

Model

Security Level Tab – IOUModule Editor

Module ID and

Commissioning an IOU Module

Task 4: Configure Controller Comm Ports

General Tab – CommPort Editor

Comm Port

Default Mode Description

Viewing the Status of an XDriver Device

Settings Tab – CommPort Editor

SecurityLevel Tab – CommPort Editor

NetController II Model 9680

Comm Port Default Mode Other Modes

-ACX 57XX Series

Comm Port Default Mode Other Modes

-Task 5: Designate the Primary Access Server

More about the Primary Access Server

Create an InfinityInput Point

Point Type Use in Access Control Systems

Create an InfinityOutput Point

Create an InfinityNumeric Point

Value Example

More about Points

Factors to Consider When Defining Areas

Lobby/Offices

Create an Area

More about Areas

Data that Defines a Door

Create a Door

Channel Description

ADA (Americans with Disabilities Act) Exit Request Input

View Doors Assigned to an Area

More about Doors

Methods of Creating Personnel Objects

Open the Personnel Manager for the First Time

Create a Personnel Object in the Personnel Manager

Task 10: Create Schedules

Create and Configure a Schedule

Attach a Schedule Point to a Door

Attach the point to . . . To . . . Door Force Lock

Attach a Schedule Point to an Area in a Personnel Object

If . . . Then . . .

More about Schedules

About Event-Notification Objects

Create an Event-Notification Object

EventNotification.

If you want the

About Notification by E-mail and Pages

Creating an EventNotification Distribution List

Type Format of List Name Example

About AlarmEnrollment Objects

Create an Alarm-Enrollment Object

AlarmEnrollment.