SECTION 281300
ACCESS CONTROL SYSTEM
PART 1 GENERAL
1.1 SECTION INCLUDES
A. Provide a modular and network-enabled access control system for access control, including engineering, supply, installation and activation.
1.2 RELATED SECTIONS
NOTE TO SPECIFIER: Include related sections as appropriate if access control system is integrated to other systems.
A. Section 260500 – Common Work Results for Electrical, for interface and coordination with building electrical systems and distribution.
B. Section 280513 – Conductors and Cables for Electronic Safety and Security, for cabling between system servers, panels and remote devices.
C. Section 280528 – Pathways for Electronic Safety and Security, for conduit and raceway requirements.
1.3 REFERENCES
A. Reference Standards: Systems specified in this Section shall meet or exceed the requirements of the following:
1. Federal Communications Commission (FCC): a. FCC Part 15 – Radio Frequency Device
b. FCC Part 68 – Connection of Terminal Equipment to the Telephone Network 2. Underwriters Laboratories (UL):
a. UL294 – Access Control System Units
b. UL1076 – Proprietary Burglar Alarm Units and Systems 3. National Fire Protection Association (NFPA):
a. NFPA70 – National Electrical Code 4. Electronic Industries Alliance (EIA):
a. RS232C – Interface between Data Terminal Equipment and Data Communications Equipment Employing Serial Binary Data Interchange b. RS485 – Electrical Characteristics of Generators and Receivers for use in
Balanced Digital Multi-Point Systems 5. Federal Information Processing Standards (FIPS):
a. Advanced Encryption Standard (AES) (FIPS 197)
b. FIPS 201: Personal Identity Verification (PIV) of Federal Employees and Contractors
6. Homeland Security Presidential Directive 12 (HSPD-12) 1.4 ACCESS CONTROL SYSTEM DESCRIPTION
A. The Access Control System shall function as a Web-based open-architecture facility management system that tracks individuals, defines and controls access levels, monitors alarms, and generates reports. The system shall include the capability to configure alarms and incorporate scheduled events that may be activated by either time or a specific programmed event. Access shall be controlled through a password-protected user
interface. Operators can communicate with the system either through a host software system or by connecting to the Web server through an Ethernet connection.
1.5 SUBMITTALS
A. Manufacturer’s Product Data: Submit manufacturer’s data sheets indicating systems and components proposed for use.
B. Shop Drawings: Submit complete shop drawings indicating system components, wiring diagrams and load calculations.
C. Record Drawings: During construction maintain record drawings indicating location of equipment and wiring. Submit an electronic version of record drawings for the Access Control System not later than Substantial Completion of the project.
D. Operation and Maintenance Data: Submit manufacturer’s operation and maintenance data, customized to the Access control System installed. Include system and operator manuals.
E. Maintenance Service Agreement: Submit a sample copy of the manufacturer’s maintenance service agreement, including cost and services for a two year period for Owner’s review.
1.6 QUALITY ASSURANCE
A. Manufacturer: Manufacturer shall have a minimum ten years experience in manufacturing and maintaining access control systems. Manufacturer shall be Microsoft Gold Certified. B. Certification: Installer shall be certified by Honeywell Integrated Security Dealer Service
Certification Program (DSCP). 1.7 DELIVERY, STORAGE, AND HANDLING
A. Materials: Deliver materials in manufacturer’s labeled packages. Store and handle in accordance with manufacturer’s requirements.
1.8 WARRANTY
A. Manufacturer’s Warranty: Submit manufacturer’s standard warranty for the access control system.
PART 2 PRODUCTS 2.1 MANUFACTURER
NOTE TO SPECIFIER: Select the configuration appropriate to the project.
A. Access Control System Manufacturer: NetAXS®-123 by Honeywell, Inc.
www.honeywellaccess.com. The system shall provide the following components:
1. One-door capacity: NetAXS®-123 NX1P – One-door compact (plastic) enclosure with tamper switch.
2. One-door capacity: NetAXS®-123 NX1MPS – One-door standard (metal) enclosure with power supply and battery.
3. Two-door capacity: NetAXS®-123 NX1P – One-door compact (plastic) enclosure with NXD1 one-door add-on board.
4. Two-door capacity: NetAXS®-123 NX1MPS – One-door standard (metal) enclosure with power supply and battery with NXD1 one-door add-on board.
5. Three-door capacity: NetAXS®-123 NX1MPS – One-door standard (metal) enclosure with power supply and battery with NXD2 Two-door add-on board.
2.2 ACCESS CONTROL SYSTEM SOFTWARE REQUIREMENTS
A. Software Requirements: The Access Control System shall be a modular one-, two-, or three-door access control system. The Access Control System shall run on a host system with access control units that exceed existing specifications. The Access Control System shall support communication via either the host system or a web server through an Ethernet connection. The Access Control System shall include the following:
1. Operation: The Access Control System shall support operation from an embedded Web-based server without a dedicated server or PC workstation.
2. Login: Operators shall have the capability to log on via the Web and remotely configure devices.
3. Access Levels: The Access Control System shall have the capability of defining and assigning access levels to users. Standard operator permission levels shall be enforced, with full operator audit.
4. Alarms/Events: The Access Control System shall define alarm events and monitor them.
5. Reports: The Access Control System shall generate event and card reports. 2.3 OPERATIONAL REQUIREMENTS
A. Access Control System Operational Requirements: 1. System Operations:
a. Authentication Login: The Access Control System shall use an integrated login method which accepts the user ID of the person who has logged on.
b. Graphical Landing Page: Upon login, the Access Control System shall display a landing page that displays icons representing the specific functions available in the Access Control System. Users shall be able to click an icon to automatically access a function page.
c. Password: Access Control System shall use an integrated authentication method.
d. Facility Access: The Access Control System shall be capable of managing operator access to the facility. Operators must have proper authorization to enter the facility.
e. Graphical User Interface: The Access Control System shall be fully compliant with Microsoft graphical user interface standards, with the look and feel of the software being that of a standard Windows application.
f. Status Displays: The Web Server shall display status screens which update automatically for system alarms, system events, input status, and output status. The Web Server shall also display a single event screen that contains events from any or all panels.
g. Time Management: The Access Control System shall define time zones (blocks of time) to control access. The Access Control System shall also configure a default set of holidays and recurring holidays for specific locales.
h. Reporting: The Access Control System shall generate reports of alarms and events upon request or in real time.
2. Access Control Functional Requirements: Functions shall include configuring the system, time management, doors, access levels, cards, other I/O, interlocks, and
users. Functions shall also include monitoring alarms, events, inputs, outputs, and system status, and generating reports. The following features shall be
programmable and shall be capable of being modified by a user with the proper authorization:
a. Configuring the System: The Access Control System shall monitor common data (time zones, cards, card formats, site codes, holidays, access information, and system configuration) and panel-specific data (access level assignments, door/reader configuration, and firmware, network, and communications aspects of system configuration).
b. Time Management: The Access Control System shall define the time zones during which an input, output, reader, access level, or card is active or inactive. In addition to Monday-Sunday, Holidays shall also be configurable. c. Holidays: The application shall allow holidays to be entered into the Access
Control System. Holidays shall have a start date plus duration defining multiple days. Holidays shall have a holiday type of 1, 2, or 3, which may be defined by the user.
d. Access Levels: The Access Control System shall allow the user to establish groups of readers at a facility for the purpose of granting or denying access to cardholders. Access levels shall be assigned to companies and individuals employed by the company.
e. Event Types: Definitions shall be shipped with system software.
f. Maintaining Cards: The Access Control System shall maintain information related to a cardholder’s access privileges. Upon entering this application, a window shall appear on the screen and all actions (add, modify, or delete) shall be initiated from this window. Access privileges shall be linked to the cards used to gain access to doors in the facility. Modifications shall be made by changing the information in the card fields.
g. Users: Information related to the users of the Access Control System software shall be stored in the database. Users entered into the Access Control System shall be assigned the access privileges of the card type to which they are assigned.
3. Application localization: The Access Control System shall support at least eight languages including English. The languages available must include French, Spanish,
Italian, Chinese (simplified), Czech, Dutch, and Arabic. All web screens and messages shall be localized.
2.4 FIRMWARE
A. Gateway panel external interface connection: The Access Control System shall include a gateway panel external Interface for communication via RS-485 with up to 31 panels (including the gateway panel).
B. USB/Ethernet connection: The Access Control System shall include an embedded web server that can be connected to a web server via USB or Ethernet port.
C. Doors: A door, as a logical object, shall consist of a primary reader, a secondary reader, a Supervised input serving as a Door Position Switch, a Supervised input serving as an Egress Input, a tamper input for the primary reader, a tamper input for the secondary reader, and a relay output serving as the door lock. The Access Control System shall provide the following configurations:
1. One door (controller board only)
2. Two doors (controller board with a 1-door I/O board) 3. Three doors (controller board with a 2-door I/O board)
D. Application Interfaces: The Access Control System shall provide WIN-PAK Release 2 and WIN-PAK Release 3 compatibility.
E. Database:
1. The Access Control System shall provide Common Configuration tables—data common to every panel in a cluster.
2. The Access Control System shall provide panel-specific Configuration tables. 3. The Access Control System shall provide a card table containing
cardholder/credential data, common to every panel in a cluster.
4. The Access Control System shall provide functionality for database upload and download.
G. Gateway and Panel Interworking:
1. The Access Control System gateway function shall provide access to up to 31 RS-485- connected panels.
2. The gateway shall allow concurrent updates of common database tables. 3. The gateway shall support interoperability with RS-485 downstream panels. H. General Network Capabilities:
1. The Access Control System shall enable user-provided network address information to be configured statically, if a DHCP service is not used for address assignment. 2. The Access Control System firmware shall support the following network address
information in a non-volatile memory: a. Factory Default: 1) IP Address of 192.168.1.150 2) Subnet Mask of 255.255.255.0 3) IP Router IP address 192.168.1.1 b. User Provided: 1) Panel IP address 2) Subnet mask 3) IP router IP address
c. Setting factory-default values: The Access Control System shall ensure that initial values of user-provided IP address and subnet mask are set to the factory default values.
d. Selectable: The Access Control System shall include a DIP switch for selecting either the factory network addresses or the user-provided network addresses. 3. Assigning IP addresses: The firmware shall automatically and transparently assign an
I. Web Server Provisions:
1. Updating common database tables: The Web Server shall update the common database tables concurrently.
2. Status screens: The Web Server shall provide the following status screens, which shall update the status information dynamically:
a. System alarms b. System events c. Input status d. Output status
3. Browser connections over USB: The Web Server shall support browser connections over a USB port (using IP over USB) capability.
4. Landing page: Upon logon, the user shall select a specific task area on a landing page with graphical icons.
J. PCI Provisions: The PCI shall pass a unique identifier, such as an Ethernet MAC address, to the host after initiating a Reverse IP connection to a host.
K. Memory Capacity:
1. Downstream panels: Gateway firmware shall support up to 31 downstream panels. 2. Database elements: Gateway firmware shall support the database elements (time
zones, access levels, holidays, etc.). L. Access Control Provisions:
1. Time zone support: The Access Control System shall provide time zone support. 2. Recurring holiday support: The Access Control System shall recurring holiday
support.
3. Manual pulse and output: The Access Control System shall provide manual pulse and output support.
4. Duress detection: the Access Control System shall provide duress detection during a time zone period.
5. Configurable anti-passback forgiveness: The Access Control System shall provide configurable anti-passback forgiveness.
M. Hardware Control Provisions:
1. DPS status LEDs: The Access Control System shall display Panel Door Position Status (DPS) LEDs to indicate the following when the DPS is in a four-state input:
a. LED will be ON if the DPS is in the ALARM state. b. LED will be OFF if the DPS is in the NORMAL state.
2. Panel Door Relay LEDs: The Access Control System shall display a Panel Door Relay LED to indicate the following:
a. LED will be on when the relay is energized. b. LED will be off when the relay is de-energized.
3. Communication status LED: The Access Control System shall display a red or green RS-485 Communication Status LED to indicate the following events:
a. Blink green each time a character is transmitted. b. Blink red each time a character is received.
4. Other LEDs: The Access Control System shall display red or green LEDs to indicate the following events:
a. Blink green once per second during normal firmware operation. b. Show solid red in the event of a known failure.
5. Alarms: The Access Control System shall support both Acknowledged and Unacknowledged Alarms.
O. Firmware Upgrade Provisions:
1. Upgrading via Web browser: The Access Control System shall support upgrading panels in a cluster via the web browser with a single request.
2. Application firmware images: The Access Control System shall store two application firmware images of the same or different versions on the same panel.
3. Upgrading a standalone: The Access Control System shall upgrade a standalone using a USB port via the web server.
4. Firmware download activation: Access Control System users shall specify immediate or deferred activation of a firmware download.
5. Monitoring progress/status: The Access Control System shall monitor the progress and status of any database, firmware, or report upload or download.
P. USB Troubleshooting: A USB driver shall be provided for troubleshooting. 2.5 HARDWARE
A. Memory block: The controller’s memory block shall provide a minimum of 64MB of SDRAM for non-volatile program and data memory. The memory’s contents shall be retained for at least three months without main power or an external battery. Field personnel shall be able to revise the memory without exchanging memory devices.
B. Real Time Clock (RTC) Block: The controller’s RTC block shall be implemented by hardware, using a crystal of 32.768kHz as the time base. A power backup circuit with a capacitor device shall support the block. The RTC block shall operate for at least 24 hours from the capacitor at 25° C, if no other circuitry is supported by the capacitor. The RTC accuracy shall be greater than one minute per month at 25° C.
C. Supervised Input Block: The Supervised Input Block shall provide the following supervised inputs:
1. Seven supervised analog inputs, configurable as two-state, three-state, or four-state inputs on the controller board.
2. Nine supervised analog inputs, configurable as two-state, three-state, or four-state inputs on the two-door I/O board.
3. Five supervised analog inputs, configurable as two-state, three-state, or four-state inputs on the one-door I/O board.
The block shall also provide an A/D function to monitor the input voltage on the supervised inputs, and a low-pass filter on the inputs.
D. Relay Output Block: The Relay Output Block shall provide the following relays: 1. Three relays associated with door control with form C contacts (normally open,
normally closed, and a common –SPDT).
2. Three relays associated with auxiliary use with form C contacts (normally open, normally closed, and a common –SPDT). One auxiliary relay shall be mounted on the controller board.
3. One door relay mounted on the controller board. One auxiliary relay shall be mounted on the controller board.
4. Two door relays mounted on the two-door I/O board. Two auxiliary relays shall be mounted on the two-door I/O board.
5. One door relay mounted on the one-door I/O board. One auxiliary relay shall be mounted on the one-door I/O board.
The Relay Output Block shall also provide a relay contact rating of 3A @ 30VDC inductive load. Relay contacts shall be jumper-configurable and able to select either the Normally Open or Normally Closed contacts, and to select either dry contacts or self-whetted (+12VDC) contacts. The block shall provide an LED for each relay to indicate the relay’s status, either energized or de-energized. The following signals shall be connected to a terminal block: NO/NC (Relay # - jumper-selectable contact), C (Relay # common contact), GND (Circuit common).
E. RS-485 Communications Block: Port 0 and Port 1 of the RS-485 Communications Block shall function as half-duplex, two-wire RS-485 communications ports. The block shall provide selectable end-of-line resistors for the RS-485 Port 0 (main RS-485 channel). The RS-485 device address shall be set by a DIP switch at RS-485 Port 0. The RS-485 Port 0 shall use a 5-pin 5.0mm removable field wired terminal block, and shall provide the following signals: A (Data A – RS-485 positive), B (Data B—RS-485 negative), +12VDC (output), Circuit Common, and +24VDC (input). The RS-485 Port 1 shall be reserved for use through a backplane connector. The backplane connector signals shall be +12VDC (input power for the I/O board, output power for the control board), GND (Circuit Common), A (RS-485 Data), and B (RS-485 Data). The RS-485 bus shall support a total of 31 devices. The block shall support a 9600 baud rate over a distance of 4000 feet, and a rate of 115.2K
(maximum) with a reduction of communications distance. The firmware shall set the baud rate as needed.
F. Ethernet Communications Functional Block: Port 3 shall be used for Ethernet
communications, and it shall support 10/1000Mbps half/full duplex communications over standard Ethernet cable and distance.
1. The port connector shall be an RJ-45 connector that meets Power Over Ethernet (POE) power requirements.
2. The interface to the firmware shall be a standard MAC register set.
3. The LINK LED shall show the network status, and the ACTIVITY LED shall show the Ethernet status.
4. One LED shall indicate the power from POE or the external adapter, and one LED for the external power supply.
5. The following shall be the colors and functions of the LEDs:
a. LED1 shall be green. When it is on, it shall indicate activity/POE. When it is off, it shall indicate that there is no activity.
b. LED2 shall be yellow. When it is on, it shall indicate a good link. When it is off, it shall indicate that there is no link.
6. The FLASH device that contains the firmware shall include the programming of a unique MAC address. The MAC address also shall appear on a physical label on the controller board.
7. The Ethernet port shall support auto MDIX.
8. The Ethernet RJ-45 connector shall accommodate shielded CAT5. G. USB Communications Functional Block:
1. The USB port shall be configured as an OTG port USB revision 2.0, and it shall use a Micro AB connector.
2. The USB interface between hardware and firmware shall use the integrated USB MAC of the processor.
3. The USB Communications Block shall provide 200mA to a device when NetAXS-123 is used as a master.
H. Reader Communications Block:
2. Reader ports shall multiplex the following reader signals: a. +12V (output power to reader)
b. GND (Circuit common to reader) c. D0 (Reader data line 0)
d. D1 (Reader data line 1)
e. LED Control (reader LED control line) f. BUZZER (external sounder control)
3. Each reader port shall have separate signals for the following: a. Tamper 1 (Tamper for first reader on port)
b. Tamper 2 (Tamper for second reader on port) c. HOLD 1 (Hold line for first reader on port) d. HOLD 2 (Hold line for second reader on port)
4. Two Phoenix type connectors shall be used for reader ports: a. Seven-pin connector: 1) LED 2) D0 3) D1 4) GND 5) +12VDC 6) Tamper 1 7) Buzzer b. Three-pin connector: 1) Tamper 2 2) HOLD 1 3) HOLD 2
5. One Wiegand reader port shall support two multiplexed readers.
6. One-door I/O board shall have one port that supports two multiplexed Wiegand readers.
7. Two-door I/O shall have two ports; each port shall support two Wiegand multiplexed readers.
8. The Terminal Block PIN assignments shall be the same for the Wiegand, Extended Wiegand, and ABA Wiegand interfaces:
a. PIN 1: LED1 b. PIN2: D0 c. PIN3: D1 d. PIN4: GND e. PIN5: Power f. PIN6: Tamper g. PIN7: Buzzer
9. Reader power shall be 12VDC (13.8VDC if battery powered) nominal +-5% for each reader port.
10. Circuit protection for the Reader Power Outputs shall include are self-resetting, current-limiting devices, such as PTCs.
11. Maximum reader wiring length (18 AWG wire) shall be 500 feet.
12. Reader ports shall interface through a secondary MCU on the controller board and/or tertiary MCU processor (on the I/O board) or similar component.
13. Bit-counter register (provided by a secondary and/or tertiary MCU) shall indicate the number of bits read from a card.
14. Secondary and/or tertiary MCU shall provide a register to store the number read from a card.
15. Hardware shall provide an interrupt to the firmware, indicating an incoming message.
16. Readers shall require an external and separate 24VDC power supply for reader power.
17. A secondary MCU on the I/O board shall process door I/O and communicate I/O status through a SPI bus back to the main MCU. The secondary MCU shall process enough I/O to accommodate two doors.
18. A tertiary MCU on the controller board shall process door I/O and communicates I/O status through an SPI bus back to the main MCU. The tertiary MCU shall process enough I/O to accommodate one door.
19. The reader control outputs (LED/BUZZER and HOLD) for each reader port shall be configured as Open Collector outputs.
I. Open Collector Output Block:
1. The controller board shall have four Open Collector outputs that are used by the reader port.
2. The Open Collector outputs shall provide connection to a maximum of +12VDC through an external (off-board) load, and at least a load current of 32mA.
3. The one-door I/O shall have four Open Collector outputs that are used by the reader port.
4. The two-door I/O shall have eight Open Collector outputs that are used by the reader ports.
J. Secondary MCUs and I/O Interface Block
1. The controller board shall interface with the I/O board via a pair of multi-pin mating connectors, using the SPI bus for communication.
2. The interface connector shall contain the following signals: a. SPI bus signals: Data In, Data Out, CS, CLK
b. Programming bus signals (using SPI BI-Wire): SBWDATA, SBW c. Control signals as needed: Interrupt, Reset, +12VDC, GND, CTL d. Additional GND signals for noise suppression
3. The secondary MCU block on the I/O board shall handle a maximum of 9 Analog Inputs, shall provide a maximum of 11 Digital Inputs for reader functions and I/O board type indication, and shall provide a maximum of 15 Digital Outputs for reader functions and on-board LED control.
4. The secondary MCU block for the controller board shall handle a maximum of 7 Analog Inputs, shall provide a maximum of 10 Digital Inputs for reader functions and
I/O board type indication, and shall provide a maximum of 9 Digital Outputs for reader functions and on-board LED control.
5. There shall be a method to indicate which I/O board type is plugged in to the controller board’s interface connector.
K. Power Supply Onboard Regulators Block:
1. A separate connector shall connect the panel to a 12VDC external power source. 2. The operating input voltage range shall be 10.4 to 15.2 VDC.
3. The maximum operating current budget shall be 4.5A when supplied by an external 12VDC power supply. The maximum operating current budget shall be 1A when supplied by POE power.
4. The power supply input shall be reverse polarity protected.
5. The terminal block shall include a three-pin, 5.00 mm removable terminal block for external power input. The placement shall allow the use of non-limited power sources without requiring special cabling protection.
6. There shall be two main power input points on the controller board; only one power input point shall be active at any given time.
7. Connection to two power sources at once shall not damage the panel.
8. The panel shall monitor the amount of current it consumes. An LED also shall indicate the current-monitoring status.
9. The controller board processor and an I/O board shall continue to run if the power is overloaded. A short between a Power pin and Ground pin shall not bring down the controller or the I/O board.
L. Power-Over-Ethernet (POE) Functional Block:
1. The panel shall conform to the IEEE Powered Device (PD) 802.3 specification. 2. The panel shall switch the input power from a POE source to the external power
source, if both power sources are plugged into the panel’s control board simultaneously.
M. Downstream Devices:
1. The controller board shall communicate with downstream devices via RS-485 half-duplex hardware ports and allow a maximum total of 1.5A to power the devices. 2. When a downstream device requires more than 12VDC (i.e., 24VDC for S-Net
devices), then an external power supply of appropriate voltage and current capabilities shall be used.
3. When multiple downstream devices are connected to the panel, these devices shall be 12VDC devices, and the total current supplied by the panel shall be limited to 1.5A.
4. The controller shall be able to communicate with 31 downstream devices.
5. Devices shall be supported by 24VDC power from the appropriate pin on the five-pin connector of the RS-485 port.
N. The controller shall support the following connectors:
1. A two-position header (strap) shall be used to re-set the board after a short occurs. 2. An on-board jumper shall allow the discharge of the RTC backup power capacitor. 3. A bi-color RUN LED under firmware control to be used in software development. 4. A secondary enclosure tamper switch input on a two-pin header connector. O. The I/O boards shall support the following connectors:
1. A secondary enclosure tamper switch input on a two-pin header connector. 2. A JTAG header for testing and programming.
PART 3 EXECUTION 3.1 EXAMINATION
A. Examine site conditions to determine site conditions are acceptable without qualifications. Notify Owner in writing if deficiencies are found. Starting work is evidence that site
conditions are acceptable. 3.2 INSTALLATION
A. Access Control System, including but not limited to access control, alarm monitoring and reporting, time management, and user identification cards shall be installed in accordance with the manufacturer’s installation instructions.
B. Supervise installation to appraise ongoing progress of other trades and contracts, make allowances for all ongoing work, and coordinate the requirements of the installation of the Access Control System.
3.3 FIELD TESTING AND CERTIFICATION
A. Testing: The access control, alarm monitoring and reporting, time management, and user identification cards shall be tested in accordance with the following:
1. Conduct a complete inspection and test of all installed access control equipment. 2. Provide staff to test all devices and all operational features of the Access Control
System for witness by the Owner’s representative and authorities having jurisdiction as applicable.
3. Correct deficiencies until satisfactory results are obtained. 4. Submit written copies of test results.
