Open Access Controller Guide

 Open Access Controller Guide

In the access control market, there are many software platforms, but only a few companies that make non-proprietary door controllers.

In 2019, Axis released a 3rd party-only controller, while HID purchased Mercury Security.

In this note, we contrast common access hardware providers and which brands of hardware many access management systems use.

·        The 3rd party offerings of Axis, HID, Isonas, and Mercury

·        How their pricing compares

·        Why ONVIF for Access Control Is Not A Big Factor

·        A chart explaining which controllers 34 notable access platforms support

·        The three factors that may complicate takeovers

What is an Access Control System?

An access control system is a security measure designed to regulate who can enter or exit a building or specific areas within it. These systems can range from simple mechanical locks to advanced biometric and cloud-based solutions. Modern access control systems often include features like keycards, PIN codes, mobile credentials, and facial recognition technology.

Select Access Hardware Components

Your access control system will require various hardware elements:

·        Control Panels: The brain of the system, managing access points and credentials.

·        Readers: Devices that scan keycards, biometrics, or mobile credentials.

·        Electric Locks: Magnetic or strike locks that secure doors.

·        Door Sensors: Detect whether a door is open or closed.

·        Request to Exit Buttons: Allow users to leave secured areas.

·        IT: If you run an on-premises access control system you will need a computer to run the software on and network connectivity.

Choose hardware compatible with your desired technology and ensure it meets your building’s security standards.

'Open' Controller Options

In the access market, the number of manufacturers producing door controller hardware is comparatively small to the total number of vendors writing management software.

While some companies choose to produce their own proprietary controller designs, a significant portion of the market chooses to integrate with 'open' 3rd party devices manufactured by others.

For the access control market, the most widely recognized non-proprietary door controllers are produced by three companies:

·        Axis: The company offers two different controllers, the A1001 and A1601. Both models are two-door controllers, but the A1601 is built with higher memory capacity, faster processors, form C relays. Both units use Axis' VAPIX API, although the free embedded Axis Entry Manager software is only an option for the A1001.

·        HID Global: Owned by Assa Abloy, HID also manufactures two series of controllers, Edge and Aero, that with a firmware update can be added to over 15+ different access systems.

·        Isonas: The Allegion owned access hardware manufacturer opened it's line of controllers to being integrated into other platforms in 2017. The company's line of combo readers/controllers are IP based and PoE powered.

·        Mercury Security: Purchased by HID in 2017, the hardware manufacturer sells only to other businesses. Mercury produces several lines of controllers and expansion modules, including the IP-based LP and EP series and Series 3 Redboard panels with a common firmware framework. Over 35 companies use Mercury designed hardware, or other hardware using Mercury's standard firmware.

These offerings compose most of the 'open' controller options in the market.

Defining 'Open' for Access

In the case of access control and the broader security market, 'Open' has a different general meaning than IT and software development use. 'Open' for access essentially means 'non-proprietary' that is potentially compatible with several systems.

This differs from 'openness' in other tech areas where 'open-source' generally means use is free, collaboration is public, and licensing (if implemented) is light and provisional.

Cost Comparison

While pricing varies for each controller, the hardware cost alone may also be subject to additional software licensing. However, on a hardware only basis, pricing looks like:

·        Axis A1001 & A1601: The A1001 is widely available online for ~$500, while the A1601 runs ~$700.

·        HID Edge EVO: The single door controller is available from distribution with a street price of ~$350, with options for units with integrated readers for ~$450.

·        HID Aero: The base controller and two-door expansion module is available through resellers for ~$650, but total cost varies depending on which base controller and how many expansion modules are used.

·        Isonas: The company's line of RC-04, PowerNet, and IP Bridge controllers range from $700 (single door) - $1,100 (three door bridge) depending on configuration of the included reader.

·        Mercury Security: None of these products are available as direct purchases from Mercury or through distribution. Single door controllers typical range in price from $250 - $400, but the final cost is often heavily negotiated and drops for projects with large door counts.

Compatibility Chart

The chart below provides a look at leading access brands, and which door controllers they work with:-

The Disadvantages of Proprietary Solutions

Discussions around the “myth” of open architecture often come from advocates of proprietary solutions who argue against the flexibility of open systems. However, this perspective can be compared to the fox guarding the henhouse—those who benefit from vendor lock-in are the ones discouraging open architecture. The primary aim of proprietary manufacturers is to secure ongoing reliance on their products, leaving organizations with little ability to switch to alternative solutions without a major cost.

Hardware installation is typically the most expensive part of an initial Physical Access Control System (PACS) deployment. By opting for a proprietary solution, organizations essentially commit to that manufacturer for the duration of the product’s lifespan. If the solution no longer meets operational needs, a costly overhaul is required to migrate to another system. This dependency aligns perfectly with the goals of proprietary vendors, keeping organizations tied to one source indefinitely.

The Advantages of Open Architecture Solutions

Open architecture solutions offer a range of benefits that boost security, flexibility, and efficiency. Companies like Mercury Security, HID Aero, and Axis provide open hardware platforms that are interoperable and supported by numerous technology partners. Choosing an open architecture approach means futureproofing your hardware investment, allowing for a flexible transition across providers without needing a complete system replacement.

For example, Mercury Security has the world’s largest access control hardware base, supported by over 20 OEMs. This extensive adoption enables users to switch to another Mercury OEM if the current solution is insufficient, preserving the existing hardware infrastructure and avoiding significant costs.

Five Reasons to Choose Open Architecture

1.   Interoperability and Integration: Open architecture supports seamless integration across various hardware and software, enabling vendor independence, smooth communication between platforms, and easy customization to meet unique security needs.

2.   Scalability and Flexibility: Open architecture systems are scalable and flexible, allowing for expansion and adaptability. Incremental upgrades are possible without major overhauls, reducing costs and supporting long-term system value.

3.   Cost-Effectiveness: Open architecture reduces expenses tied to proprietary systems, such as costly upgrades and vendor-specific maintenance. By supporting partial upgrades and enabling competitive pricing, it provides short- and long-term savings.

4.   Enhanced Security: Open systems allow organizations to implement the latest security protocols and quickly respond to emerging threats. They also support compliance with industry standards, ensuring a resilient and compliant security environment.

5.   Future-Proofing: Open architecture preserves initial hardware investments by allowing integration of new technologies through standard protocols. This approach ensures long-term relevance, efficiency, and cost savings.

Proprietary Private Brand Hardware Common

Notice not all platforms use or are compatible with third party panels.

For example, major providers like Tyco's Software House use proprietary controllers, which differ and are not compatible with other Tyco access products like the distribution access line Kantech that uses its own proprietary panels.

Startups like Openpath and Proxy sell 3rd-party compatible mobile readers, but also are available in versions that use their own proprietary controller boards/relays in a standalone management software.

Access ONVIF Not A Factor

When it comes to interoperability standards, access control is significantly less accepting of standards like ONVIF and no 3rd party standard is widely adopted.

As noted in Access Control Does Not Want ONVIF, despite being so readily adopted by video platforms, both ONVIF interoperability standards, Profile A and Profile C have weak adoption with support from only two vendors:

Three Common Takeover Exceptions

While generally possible, 'takeovers', where controllers associated with one platform are switched to another, have exceptions.

The three common factors that complicate system takeovers and controller interoperability are:

·        Unsupported Features/Integrations

·        New Licensing/OEM Mask Codes

·        Voided Warranty or Support

Unsupported Features/Integrations

First, in terms of existing system integrations and features, just because another system supports the same controller hardware, there is no certainty a new platform supports the same range of features and integrations. Individual features, like OSDP or event cross-linking may be supported at the panel in one system, but not the other.

New Licensing/OEM Mask Codes

Another pitfall, as noted in Does Lenel Support Unbranded Mercury Security Hardware? is some platforms may observe a 'Product OEM Mask' that codes hardware to a specific brand.

The codes are not always observed and not all 3rd party vendors have them in place, but adding existing hardware to a new system can be blocked and potentially require additional licensing fees or risk being refused by the new vendor.

In other cases, like Honeywell Prowatch, physically changing chips on the controller board may be required.

Voided Warranty or Support

Finally, vendors may choose to not 'tech support' taken-over devices, nor do they typically warranty them when something goes wrong.

Thanks to Mr. Brian Rhodes, IPVM writer.

Access Control Standards Revolution Now In Progress

Access Control Standards Revolution Now In Progress 

Access control provides the ability to control, monitor and restrict the movement of people, assets or vehicles, in, out and round a building.

Access control is essential for all businesses to protect people and assets and has the added benefit of being expanded from controlling, for example, a single entrance door, to a large integrated security network. There are also huge potentials in terms of integrating other systems, such as Time and Attendance, Visitor Management, ANPR, Fire, Intruder and CCTV.

Few specifications are seen more commonly in access control than UL 294. However, aside from seeing it in print, very few understand what it means. In this note, we break apart and define this spec, describing why it is a vital part of many Access RFPs.

A Standard Defined

The scope of UL 294 covers three aspects of Access Control systems: 

• Construction (Installation)
• Performance
• Operation

Essentially, the heart of UL 294 is a safety standard, where testing proves that system components can be assembled and operate reliably without hazard. In the case of access control, this is a step beyond just validating devices will not catch fire or spark - it attests that the system will not harm the safety or impede egress of those using the system.

In practical terms, this means doors will not accidentally stay locked and keep people in harm's way even during a malfunction. The UL standard subjects each labeled device to a range of testing designed to show the equipment meet relevant code expectations from:

• NEC (NFPA 99): Requirements that each component will not create a hazard either during (recommended) install or use (Sparking, Grounding)
• NFPA 72: Fire Code compliance, assures that controllers include interfaces with fire alarm/suppression systems 
• NFPA 101: System devices 

A UL 294 mark is a 'extra step' the vendor has taken to 'prove' their equipment is safe, and it stands as a 'mark of assurance' when included in buying specifications that dubious equipment will not be purchased.

The Mark

While Underwriter's Laboratories offer a range of 'UL Symbols' that can be interpreted to signify different standards. In the case of UL 294, the mark looks like this:

The UL 'Security Mark' applies only to products such as intrusion detectors, burglar alarms, access control, safes, and vaults.

Performance Tests

UL 294 includes several tests that evaluate how well devices withstand damaging environments. Devices are subjected to atypical electrical, environmental, and brute force situations, including:

• Variable Voltage
• Variable Ambients (Environment)
• Humidity
• Endurance (Ruggedness)
• Transients
• Corrosion
• Standby Power (Battery backup)
• Physical Attack Toughness

Tests are performed individually and are not 'layered' or 'stacked' simultaneously as might occur in the field. The exact methodology for each test depends on the device being tested, but the resulting grade is given in four levels of security performance with Level I (lowest level security equipment) to Level IV (highest level security equipment). 

Exclusions

However, not all parts and features of an Access platform fall under the scope of UL 294. Two areas excluded from the scope include:

• Headend Server/Database: The scope reads "The accuracy of logged data is not evaluated by this standard", and also "This standard does not apply to supplementary computer equipment that is not necessary for operation of the access control system..."
• Intrusion Detection: Again, the scope details "Where an access control equipment and/or system incorporates the features and functions of a burglar alarm control unit, the requirements of the Standard for Proprietary Burglar Alarm Units and Systems, UL 1076, shall also apply"

This is important to note when careless specs are written that "All Access Equipment shall be UL 294 Certified", because this is inherently not possible. There will be major functional aspects outside the scope of the standard.

Large System Adoption

Especially for larger systems, UL 294 is common, including devices from: Mercury Security, C*Cure, S2, Maxxess, Sargent, etc.

However, certification is done on a component basis, and there may be gaps in a brand's portfolio. If UL 294 compliance is required in a system, every hardware component must be checked for conformity, as there is no 'system' certification.

Systems and platform intended for smaller deployments (<100 doors) typically forego the certification, because it simply is not a purchasing driver for many non-enterprise customers.

Prime Use

Regardless of the 'safety' overtures, like UL certification for surveillance equipment, 294 is primarily used to exclude non-compliant systems from specifications. UL 294 evaluation is not mandatory for Access Equipment, and many vendors forego the cost of certification especially when their offerings are not well suited for larger government, institutional, and hospital verticals where 294 is commonly cited. 

Likewise, while the mark's testing 'proves' that devices are safe, the onus remains on the field technician to install them in the correct fashion to indeed live up to the certification.

Remember once UL certification has void OEM is not responsible for any health & safety incident of your premises. UL certification void due to repairing through unauthorized service provider....etc.

NFPA 101

While NFPA 101 is comprehensive, the most relevant passages for access control include:

• NFPA 101: 'Electrically Controlled Egress Doors' (2012: 7.2.1.5.6; 2009: 7.2.1.5.5)
• NFPA 101: 'Releasing Devices' ( 2012: 7.2.1.5.10-12; 2009, 2006, 2003: 7.2.1.5.9 -7.2.1.5.11)
• NFPA 101: 'Access Controlled Egress Doors' (7.2.1.6.2)

Specifically, requirements like Access Control Request to Exit (RTE), Exit Devices, and Delayed Egress foundationally conform to NFPA 101.

NFPA 72

In general, this code is the foundation of requirements that doors must release when fire alarms or smoke detectors go into alarm.

NFPA 80

Specifically, this code examines Fire Doors and how they are properly used for protection in a building. In many cases, these door types are also slated to become access-controlled openings, and the 'Locks or Latches (6.4.4)' section describes which modifications are permitted for access use without voiding their fire door ratings.

IBC: International Building Code

The IBC, published by the International Code Council, is essentially a guidebook for designing and engineering safe buildings.

If not observed directly as the authority, then whatever resulting codes that do have authority take guidance from the source.

• ·     IBC: 'Door Operations' (2012, 2009: 1008.1.9; 2006, 2003: 1008.1.8)
• ·       IBC: 'Sensor Release of Electrically Locked Egress Doors' (2012: 1008.1.9.8; 2009: 1008.1.4.4; 2006, 2003: 1008.1.3.4)
• ·       IBC: 'Electromagnetically Locked Egress Doors' (2012: 1008.1.9.9; 2009: 1008.1.9.8)