SOFTWARE HOUSE From Tyco Security Products

SOFTWARE HOUSE From Tyco Security Products C•CURE 9000 Version 2.50 Areas and Zones Guide REVISION KO UM-2. KO EFTA01224642 C•CURE and Software House are registered trademarks of Tyco Security Products. The trademarks, logos, and service marks displayed on this document are registered in the United States [or other countries]. Any misuse of the trademarks is strictly prohibited and Tyco Security Products will aggressively enforce its intellectual property rights to the fullest extent of the law, including pursuit of criminal prosecution wherever necessary. MI trademarks not owned by Tyco Security Products are the property of their respective owners, and are used with permission or allowed under applicable laws. Product offerings and specifications are subject to change without notice. Actual products may vary from photos. Not all products include all features. Availability varies by region; contact your regional sales manager. Software version: 250 Document Number: UM-228 Revision Number: KO Release Date: December 2015 This manual is proprietary information of Software House. Unauthorized reproduction of any portion of this manual is prohibited. The material in this manual is for information purposes only. It is subject to change without notice. Software House assumes no responsibility for incorrect information this manual may contain. O 2015 Tyco Security Products. MI rights reserved. EFTA01224643 Table of Contents Preface 9 How to Use this Manual 10 Finding More Information 11 Conventions 12 Software House Customer Support Center 13 Chapter 1 - ISTAR Areas 15 iSTAR Areas Overview 16 Reasons for Using Areas 16 Setting Up Areas 18 Antipassback 21 Cluster Antipassback/Global Antipassback 21 Antipassback Types 21 Configuring Antipassback 24 Carpool Antipassback .26 Cards and Carpool Groups 26 Carpool Regular Antipassback 26 Carpool Timed Antipassback 27 Carpool Antipassback Limitations 27 Carpool Antipassback Exemptions 27 Using Personnel Antipassback and Carpool Antipassback 29 Antipassback Grace 30 Grace All Partitions/Grace All 30 Carpool Grace 37 Antipassback Decision Making 32 Cluster Antipassback Decision Making 32 Global Antipassback Decision Making 32 Global Antipassback Configuration Guidelines 34 Occupancy Restrictions 37 Carpool Antipassback and Occupancy 38 Pass-through Areas 39 Escorted Access 40 Dynamic Area Manager 42 C•CURE 9000 Areas and Zones User Gukle 3 EFTA01224644 Tracking the Location of Personnel 43 Area User Count 43 iSTAR Area Configuration Steps 45 Basic iSTAR Area Tasks 51 Accessing the STAR Area Editor 51 Creating an STAR Area 52 Creating an STAR Area Template 52 Configuring an STAR Area 53 Configuring an STAR Carpool Area for Carpool Antipassback 54 Viewing a List of STAR Areas 56 STAR Area List Context Menu 57 Viewing Personnel in an Area 60 Viewing Personnel Groups Associated with an Area 60 Viewing the Status of an STAR Area 61 Viewing STAR Area Status on the Dynamic View 61 Viewing Occupancy Mode Causes for an Area 64 Modifying an STAR Area 64 Deleting an STAR Area 65 Setting a Property for an STAR Area 66 Adding an STAR Area to a Group 66 iSTAR Area Editor 67 STAR Area General Tab 67 General Tab Tasks 68 STAR Area Editor Definitions 68 STAR Area General Tab Definitions 69 Configuring STAR Area Doors, Readers, and Adjacent Areas 70 Deleting STAR Area Doors, Readers, and Adjacent Areas 72 Configuring a Global Antipassback Area 72 STAR Area Antipassback Tab 74 Antipassback Tab Tasks 74 STAR Area Antipassback Tab Definitions 74 Configuring Regular Antipassback for STAR Areas 76 Configuring Timed Antipassback for STAR Areas 76 Configuring Carpool Antipassback for STAR Areas 77 Configuring Lockout for STAR Areas 77 STAR Area Occupancy Tab 78 Occupancy Tab Tasks 79 STAR Area Occupancy Tab Definitions 79 How Area Occupancy Configuration Affects Occupancy Mode 81 Rules for Area Occupancy Access 82 Configuring Area Occupancy Restrictions for All Personnel 84 Configuring Area Occupancy Restrictions for Personnel Groups 85 Configuring Dynamic Area Manager 85 Configuring Pass-through Areas 86 Deleting a Personnel Group from an STAR Area 87 STAR Area Escort Tab 87 Escort Tab Task 88 STAR Area Escort Tab Definitions 88 4 C•CURE 9000 Areas and Zones User Guide EFTA01224645 Configuring Escorted Access for STAR Areas 89 How Area Escort Configuration Affects Escorted Access 90 STAR Area Muster Tab 90 Muster Tab Tasks 91 STAR Area Muster Tab Definitions 91 Configuring a Muster Area 92 Configuring Muster/De-muster Areas for Personnel Groups 92 STAR Area Triggers Tab 94 Triggers Tab Tasks 94 How to Use the Triggers Tab 94 STAR Area Triggers Tab Definitions 95 Configuring Triggers for STAR Areas 96 Deleting a Trigger from an STAR Area 98 STAR Area Groups Tab 98 STAR Area Groups Tab Definitions 98 STAR Area Status Tab 99 Viewing Area Status on the Status Tab 100 STAR Area State Images Tab 100 State Images Tab Tasks 101 Configuring a Carpool Group for Carpool Antipassback 102 Carpool Group Editor Definitions 102 Carpool Group Editor Tasks 103 Configuring a Carpool Group 103 Deleting a Person from a Carpool Group 104 Configuring iSTAR Clusters for APB Comm Fail Modes and Global Antipassback 105 Cluster Antipassback Communications Failure Mode 105 Global Antipassback for the Cluster 105 Area Tab Field Definitions 106 Configuring Escorted Access Mode 109 Configuring Personnel Antipassback Options 111 Configuring Personnel Escorted Access Options 112 Configuring Event Actions to Affect Areas 114 Setting System Variables That Affect Areas 116 Viewing Area Location of Personnel 119 Viewing Area Information on the Door Editor 121 Running Area Pre-defined Reports 123 Running Area Reports from the Administration Report Dynamic View 123 Running Area Reports from the Monitoring Station Report Status List 125 Using an Event to Run an Area Report 126 Gracing Personnel 127 Viewing Area Status with Map Icons 132 Chapter 2 - 'STAR Intrusion Zones 135 Introduction ... 136 C•CURE 9000 Areas and Zones User Guide 5 EFTA01224646 iSTAR Intrusion Zone Modes and States 137 Armed 137 Disarmed 137 Violated 138 Ready to Arm/Not Ready to Arm 138 Controlling Intrusion Zone Mode 140 Card Control 141 Event Control 142 Direct Action at the Monitoring Station 144 Inputs 144 Intrusion Zone Status Triggers 147 Doors 149 iSTAR Intrusion Zone Configuration Steps 153 Basic Intrusion Zone Tasks 155 Accessing the STAR Intrusion Zone Editor 155 Creating an STAR Intrusion Zone 155 Creating an STAR Intrusion Zone Template 156 Configuring an STAR Intrusion Zone 157 Viewing a List of STAR Intrusion Zones 157 Viewing Doors/Inputs for an Intrusion Zone 159 Viewing the Status of an STAR Intrusion Zone 161 Viewing Intrusion Zone Status on the Dynamic View 161 Modifying an STAR Intrusion Zone 162 Deleting an STAR Intrusion Zone 163 Setting a Property for an STAR Intrusion Zone 163 Adding an STAR Intrusion Zone to a Group 164 iSTAR Intrusion Zone Editor 165 iSTAR Intrusion Zone General Tab 166 STAR Intrusion Zone Editor Definitions 166 STAR Intrusion Zone General Tab Definitions 167 Configuring STAR Intrusion Zone Entrance/Exit Doors 169 Deleting STAR Intrusion Zone Entrance/Exit Doors 171 iSTAR Intrusion Zone Inputs Tab 172 STAR Intrusion Zone Inputs Tab Definitions 172 Configuring STAR Intrusion Zone Controlled/Protected Inputs 174 Configuring Display Names for STAR Intrusion Zone Monitored Inputs 176 Deleting STAR Intrusion Zone Controlled/Protected Inputs 176 iSTAR Intrusion Zone Ann - Disarm Tab 177 STAR Intrusion Zone Arm - Disarm Tab Definitions 177 Configuring Arming for an STAR Intrusion Zone 179 Configuring Disarming for an STAR Intrusion Zone 181 iSTAR Intrusion Zone Triggers Tab 183 STAR Intrusion Zone Triggers Tab Definitions 183 Configuring Triggers for STAR Intrusion Zones 184 Deleting a Trigger from art STAR Intrusion Zone 187 6 C•CURE 9000 Areas and Zones User Guide EFTA01224647 iSTAR Intrusion Zone Groups Tab 188 STAR Intrusion Zone Groups Tab Definitions 188 iSTAR Intrusion Zone Status Tab 189 Viewing Intrusion Zone Status on the Status Tab 189 iSTAR Intrusion Zone State Images Tab 191 State Images Tab Tasks 191 Configuring a Person to Arm/Disarm Intrusion Zones 192 Viewing Intrusion Zone Information on the Door Editor 193 Viewing Intrusion Zone Information on the Input Editor 195 Chapter 3 - Keypad Commands 197 Overview 198 Examples of Keypad Command Use 199 How Keypad Commands Work 200 Keypad Command Configuration Steps 202 Permissions Required to Configure Keypad Commands 203 Keypad Command Configuration Requirements 204 Keypad Command Format 205 Format Requirements 205 Example Formats 206 Defining Keypad Command Formats 207 System Variable STAR Variables Tab Definitions 209 Keypad Command Editor 210 Accessing the Keypad Command Editor 210 Keypad Command General Tab 211 Keypad Command General Tab Definitions 211 Keypad Command Permissions Tab 213 Keypad Command Permissions Tab Definitions 213 Keypad Command Groups Tab 215 Keypad Command Groups Tab Definitions 215 Keypad Command Tasks 216 Creating a Keypad Command 216 Creating a Keypad Command Template 216 Configuring a Keypad Command 217 Viewing a List of Keypad Commands 220 Modifying a Keypad Command 222 Deleting a Keypad Command 222 Setting a Property for a Keypad Command 222 Adding a Keypad Command to a Group 223 Configuring Readers for Keypad Commands 224 Configuring a Person to Use Keypad Commands 226 C•CURE 9000 Areas and Zones User Gukle 7 EFTA01224648 Enabling/Disabling Keypad Commands at Readers 227 Index 231 8 C•CURE 9000 Areas and Zones User Guide EFTA01224649 Preface This C• CURE 9000 Areas and Zones Guide is for new and experienced security system users. The manual describes the software features on the C•CURE 9000 Administration Client Areas and Zones menu and presents procedures for configuring and using them. You should have read the installation procedures described in the C•CURE 9000 Installation and Upgrade Guide and familiarized yourself with the basic C•CURE 9000 information provided in the C• CURE 9000 Getting Started Guide. In this preface How to Use this Manual 10 Finding More Information 11 Conventions 12 Software House Customer Support Center 13 C•CURE 9000 Areas and Zones User Guide Preface 9 EFTA01224650 How to Use this Manual How to Use this Manual This manual includes the following sections. Turn to the appropriate section for the information you need. Chapter 1: iSTAR Areas This chapter describes how to configure iSTAR Cluster Areas, physical regions regulated by C•CURE 9000, and how to use them to control and monitor access in your facility. Areas are used to control Antipassback— Regular and Timed—and with Occupancy Restrictions and also provide the capability to track Personnel. Chapter 2: iSTAR Intrusion Zones This chapter describes how to configure iSTAR Intrusion Zones, physical areas delineated by Doors and Inputs and monitored for alarms, and how to use them in C•CURE 9000 to monitor security in your facility. Chapter 3: Keypad Commands This chapter describes how to configure and use Keypad Commands that can activate Panel Events. 10 Preface C•CURE 9000 Areas and Zones User Guide EFTA01224651 Finding More Information Finding More Information You can access C•CURE 900(1 manuals and online Help for more information about C•CURE 9000. Manuals C•CURE 9000 software manuals are available in Adobe PDF format on the C•CURE 9000 DVD. You can access the manuals if you copy the appropriate PDF files from the C•CURE 9000 Installation DVD English \ Manuals folder. The available C•CURE 9000 and Software House manuals are listed in the C•CURE 9000 Installation and Upgrade Guide, and appear as hyperlinks in the online.pdf file on the C•CURE 9000 DVD English \ Manuals folder. These manuals are also available from the Software House Member Center website Online Help You can access C•CURE 9000 Help by pressing Fl or clicking Help from the menu bar in the Administration/Monitoring Station applications. C•CURE 9000 Areas and Zones User Guide Preface 11 EFTA01224652 Conventions Conventions This manual uses the following text formats and symbols. Convention Meaning Bold T his font indicates screen elements, and also ind tales w hen you should take a direct action in a procedure. Bold font describes one of the following items: • A oommand or character to type, or • A button or option on the screen to press, or • A key on the keyboard to press • A screen element or name blue color text Indicates a hyperfink toa URL, or across-reference toa figure, table, or section in this guide. Regular Rabb font Indicates a new term. <text> Indicates a variable. The following items are used to indicate important information. NOTE TIP Sir P Indicates a note. Notes call attention to any item of information that may be of special importance. Indicates an alternate method of performing a task. Indicates a caution. A caution contains information essential to avoid damage to the system. A caution can pertain to hardware or software. Indicates a warning. A warning contains information that advises users that failure to avoid a specific action could result in physical harm to the user or to the hardware. Indicates a danger. A danger contains information that users must know to avoid death or serious injury. 12 Preface C•CURE 9000 Areas and Zones User Guide EFTA01224653 Software House Customer Support Center Software House Customer Support Center Telephone Technical Support During the period of the Agreement, the following guidelines apply: • Software House accepts service calls only from employees of the Systems integrator of Record for the installation associated with the support inquiry. Before Calling Ensure that you: • Are the Dealer of record for this account. • Are certified by Software House for this product. • Have a valid license and current Software Support Agreement (SSA) for the system. • Have your system serial number available. • Have your certification number available. Hours Normal Support Hours Monday through F riday. 8:00 to 8:00 , EST. Except holidays. Emergency Support Hours 24 hours/day, seven days a week, 365 daystyear. Requires Enhanced SSA"7 x2r Standby Telephone Support (emergency) provided to Certified Technicians. For all other customers. billable on time and materials basis. Minimum charges appty- See MSRP. Phone For telephone support contact numbers for all reg ions. see C•CURE 9000 Areas and Zones User Guide Preface 13 EFTA01224654 Software House Customer Support Center 14 C•CURE 9000 Areas and Zones User Guide EFTA01224655 1 iSTAR Areas This chapter explains how Areas can be used to control and monitor access to physical regions regulated by C•CURE 9000. Areas are used with Global/Cluster Antipassback— Regular and Timed—and with Area Lockout, Muster/De-muster, Occupancy Restrictions, and Escorted Visitor Access. They also provide the capability to track Personnel. In this chapter iSTAR Areas Overview 16 Setting Up Areas 18 Antipassback 21 Carpool Antipassback 26 Using Personnel Antipassback and Carpool Antipassback 29 Antipassback Grace 30 Antipassback Decision Making 32 Occupancy Restrictions 37 Carpool Antipassback and Occupancy 38 Pass-through Areas 39 Escorted Access 40 Dynamic Area Manager 42 Tracking the Location of Personnel 43 iSTAR Area Configuration Steps 45 Basic iSTAR Area Tasks 51 iSTAR Area Editor 67 Configuring a Carpool Group for Carpool Antipassback 102 Configuring iSTAR Clusters for APB Comm Fail Modes and Global Antipassback 105 Configuring Escorted Access Mode 109 Configuring Personnel Antipassback Options 111 Configuring Personnel Escorted Access Options 112 Configuring Event Actions to Affect Areas 114 Setting System Variables That Affect Areas 116 Viewing Area Location of Personnel 119 Viewing Area Information on the Door Editor 121 Running Area Pre-defined Reports 123 Gracing Personnel 127 Viewing Area Status with Map Icons 132 C•CURE 9000 Areas and Zones User Guide Chapter 1 15 EFTA01224656 STAR Areas Overview iSTAR Areas Overview An Area represents a physical region—such as a room, a specific section of a building, or an entire building. Areas are used to control and monitor access to the regions they represent. Maximum control of Areas imposes restrictions on customers that may be impractical, so C•CURE 9000 provides features that allow trade-offs between 'correctness' and 'convenience'. NOTE C•CURE 9000 currently supports iSTAR Areas only. ■ Control is defined as actually preventing access based on location information. Examples: A customer might wish to prevent card holders from using their badges and then passing them to friends so that they can gain entry. To prevent this, the customer can configure Areas with antipassback (APB). In such a configuration, the card holders are admitted, but when the friends present the cards, they are rejected. Another customer might want to make sure that a particular Area in the building was accessible to only a certain number of people at one time. To that end, the customer could configure Areas with a Maximum Occupancy Restriction. In this type of configuration, when the maximum number of personnel defined for the Area is reached, no one else can enter—until some personnel leave. Still another customer with sensitive laboratories might want personnel who entered/exited one particular Area to be unable to enter another laboratory area for a specified amount of time. The customer can use the Area lockout feature for this purpose. ■ Monitoring is defined as knowing how many people are in a given area as well as who they are, or which area a given person is in, without actually controlling access to that area. While Control and Monitoring represent different functionality, they can also be used together. Reasons for Using Areas There are various reasons for using Areas, including security, safety, and resource management. ■ Security - The customer's primary concern is to prevent legitimate card holders from entering Areas in an incorrect sequence, to prevent non-cardholders from using someone else's card, to prevent more than a specified number of cardholders from congregating in an area at the same time, or to prevent cardholders from entering a certain Area after being in another Area. ■ Safety - The customer's primary concern is the safety of employees. Consequently, they want to know where employees are at all times. Example: The customer might create an evacuation location at the facility where, in an emergency, employees have to present their cards. This location would be monitored, but not controlled. On the other hand, access within the facility would be controlled with antipassback—not to prevent cardholders from going wherever they needed, but so the system knows when employees are inside the facility and therefore in possible danger during an emergency. ■ Resource management - The customer's primary concern is to limit use of a specific facility so that it is appropriately available. 16 Chapter 1 C•CURE 9000 Areas and Zones User Guide EFTA01224657 ISTARAreasOvervlow Example: The customer might have a parking lot which they do not want employees to let their Mends use—by parking their own cars and then handing their cards to friends. In this case, the customer just wants to make sure that there is enough room for the vehicles of the other employees. The customer might have a high-security laboratory which operates optimally with four personnel present. In this case, the customer could configure that Area with Minimum Occupancy (also known as N-man Rule) specifying the number of personnel who must enter the lab at the same time to gain access, and who also must remain in the Area. Strict area control and monitoring impose certain restrictions on the customer. In general, most doors in a facility have a reader on one side and a request-to-exit (RTE), using a motion detector, on the other side. Card holders must present their card to enter, but to exit they just walk up to the door and open it. Antipassback, however, requires both entry and exit readers because the system must see that a cardholder has left an area before it can let them back in again. ■ Having exit readers means that going out through the door is now slower. • Personnel might be lining up to go to lunch, where previously they just walked right out. • Personnel also have to learn to interact with the system in a new way: to pay attention and present their cards when exiting, even if their Mends hold the door open for them. Otherwise, their next access attempts are denied, requiring them to find a system administrator to 'grace' them. ■ Installing Exit readers also doubles the cost of readers in a new facility and could incur building costs in a retro- fit situation. ■ Finally, in systems large enough to spread areas across more than one controller, access decisions may require these controllers to exchange messages over the network. Then if the network is slow or unavailable, 'correct' decisions may be impossible to make in a timely fashion. (The controller can guess, but sometimes it will be wrong.) The preceding issues mean that customers may wish to make trade-offs between correctness and convenience. The following features allow them to do so: ■ Timed antipassback ■ Non-antipassback areas ■ "Local access" failure mode ■ Monitoring of card holder location ■ Occupancy that counts Personnel numbers without restricting access C•CURE 9000 Areas and Zones User Guide Chapter! 17 EFTA01224658 Setting Up Areas Setting Up Areas Areas are defined by a set of Doors, Readers, and the Adjacent Areas to which these lead. Doors between Areas require at least one Reader. In some configurations, such as for Antipassback control of the location of Personnel, an entrance Reader and an exit Reader are required. C•CURE 9000 uses Areas to regulate Antipassback control and Occupancy Restrictions. When high security and reliable tracking of Personnel is required, Areas can be configured to require people to use their badges to both enter and exit an Area. This provides a record of when a person leaves an Area, allowing the system to track the location of a person at any time. C•CURE 9000 uses this information to produce Roll Call Reports, Mustering/De-mustering control and reports, and Antipassback notifications. Figure 1 on Page 18 presents a simple example of two Areas with Doors and Readers controlling entry and exit. Figure 1: Areasand Doorswith Entry and Exit Readers intnind lac I NK 4,11,Thid ()inn .+1 circiger 2 with .(n)7.11 Anti-Passback Area A Anti-Passback Area B ••• 3 ..tif Olt 4 with KiNtriOd exit witl~Kr. Cart • AlhICryped You can select from two types of implementation of antipassback on the C•CURE 9000: • iSTAR Cluster Antipassback - Allows each iSTAR Cluster to have its own set of Areas and antipassback does not function across Clusters. Antipassback for iSTAR Ouster Areas means that all Doors, Readers, and adjacent Areas are within the same iSTAR Ouster. The host does not participate in Area access decisions so these continue to function even if host communication is lost. When there is a communications failure within the Ouster-between the master Controller and one or more member Controllers, decisions are made according to the failure mode you configure for the Ouster. For more detailed information, see: • How the Ouster Antipassback Decision is Made on Page 32 • How Ouster Antipassback Works During Communications Failure on Page 32. • iSTAR Global Antipassback (Cross-Cluster) - Allows an Area to cross multiple iSTAR clusters to share antipassback information. The Ouster master Controller makes the Antipassback decision when it owns the card being swiped. Otherwise, that master Controller asks the C•CURE 9000 Server to ask the Ouster master Controller that is the card's owner for an antipassback decision. For more detailed information, see: • How Global Antipassback Decisions are Made on Page 32 • How Global Antipassback Works During Communications Failure on Page 33. You can configure Areas to control and/or monitor access in the following ways or in combinations thereof: • With no limitation - a person with appropriate clearances can freely enter and exit from an Area. 18 Chapter 1 C•CURE 9000 Areas and Zones User Guide EFTA01224659 Setting Up Areas ■ Using Antipassback where access is restricted as follows: • Regular antipassback - Personnel cannot exit an Area they are not in, nor reenter an Area without exiting it first. • Timed antipassback - Personnel cannot reenter an Area until a specified amount of time has passed. • Area Lockout - Personnel can only access a current target location based on their last entrance/exit time from a Lockout Area. • Carpool antipassback - Carpool regular antipassback - Personnel in a carpool group cannot exit an Area they are not in, nor re- enter an Area without exiting it first. - Carpool timed antipassback - Personnel in a carpool group cannot re-enter an Area until a specified amount of time has passed. NOTE Carpool Areas and Carpool Antipassback can only be configured for iSTAR Cluster Areas. They are not configurable for Cross-Cluster Areas and Global Antipassback. ■ Using Maximum or Minimum Occupancy where access is restricted as follows: • Personnel cannot access an Area: - If the number of personnel already in the Area exceeds the maximum number defined. - If they are not accompanied by the minimum number of personnel required to be in the Area at the same time. • Personnel can access an Area regardless of the Maximum and Minimum Occupancy configured, but their number is counted. ■ Using Passthrough, where Personnel must exit an area within a specified amount of time, failing which an Event can activate—if configured to do so. You can configure Passthrough violations independent of antipassback. ■ Using Escorted Access, where cardholders designated as Escorted Visitors must be accompanied by cardholders designated as Escorts. ■ Using Muster/De-muster, where Personnel gather in a designated Mustering Area in case of emergency. Once the emergency has passed, you can manually de-muster these personnel to a configured de-muster Area. (If a de- muster Area has not been designated, at de-muster time any Personnel in the Mustering Area will be graced and can go to any Area in the facility. You can monitor access and track a person's location in the following ways: ■ By running • Roll call reports, which indicate the current location, by Area, for all Personnel at the time the report is generated. • Carpool Area Roll call reports, which indicate the current location, by Carpool Area, for all Personnel at the time the report is generated. The report indicates each person's Carpool Group and whether he/she is the driver. For information, see Running Area Pre-defined Reports on Page 123. ■ By displaying their current Area on the Administration application Personnel Dynamic View (based on the last Area the person entered on a valid admit). For information, see Viewing Area Location of Personnel on Page 119. C•CURE 9000 Areas and Zones User Guide Chapter! 19 EFTA01224660 Setting Up Areas ■ By displaying for any selected Area the Personnel in that Area from both the Administration application Area Dynamic View and the Monitoring Station Area Status List. For information, see Viewing Personnel in an Area on Page 60 and the C•CURE 9000 Monitoring Station Guide. 20 Chapter 1 C•CURE 9000 Areas and Zones User Guide EFTA01224661 Antipassback Antipassback Antipassback (sometimes known as APB) prevents a person from passing back a card to another person to use, and detects when someone tailgates (follows another person with a valid card admit through a door without using their own card). Cluster Antipassback/Global Antipassback ■ In Cluster Antipassback, the antipassback decisions are enforced within one cluster. The cluster members always ask the master for passback information. If the members of this cluster lose communications with the master, they enforce antipassback according to the Communication Failure Mode configured for the cluster—whether No Access or Local. ■ Global (Cross-Cluster) Antipassback—sometimes referred to as "Host-assisted Antipassback'—works on top of Cluster Antipassback. It allows antipassback information to be shared between multiple iSTAR clusters to enforce the antipassback decisions. Appropriate passback requests are forwarded to the Host. The Host retrieves the information from the appropriate owner and then passes it back to the Master to pass back to the member who made the original request. The Master of the cluster to which this member belongs now takes up the ownership of the Personnel card. If the members of this cluster are not in communication, the System Variable user-defined failure mode (iSTAR Driver/iSTAR Global Antipassback Communication Failure Mode) will be enforced. For detailed information, see Table 25 on Page 116 in Setting System Variables That Affect Areas. Antipassback Types Antipassback can be either for Personnel or Carpools, and you can configure the following types: ■ No Antipassback on Page 21 ■ Regular Antipassback on Page 22 ■ Timed Antipassback on Page 22 ■ Area Lockout on Page 22 No Antipassback You can configure an Area without antipassback and use it to: ■ Designate boundaries. ■ Interface with Areas of the antipassback system. ■ Monitor access. ■ Create Roll Call Reports Example: The front Door of a building typically leads from a non-antipassback Area to a controlled antipassback Area. The non-antipassback Area can be either a physical space or a 'conceptual' area, such as 'outside'. C•CURE 9000 Areas and Zones User Guide Chapter! 21 EFTA01224662 Antipassback Regular Antipassback You can use a regular antipassback Area when you need to control the movements of personnel based on their location. Configuring regular antipassback prevents a person from exiting an Area that, according to the system, he/she is not in or from entering an Area that, according to the system, he/she is already in. ■ A passback violation occurs when a person enters an Area and then passes the card to another person who uses it to enter the same Area. ■ A tailgate violation occurs when a person tries to leave an Area that, according to the Controller making the decision, he/she is not in. This can occur if the person entered the Area by "tailgating" and then uses his/her card to exit the Area. You can only enforce antipassback if you have both entry and exit Readers in an Area. Timed Antipassback You can use timed antipassback when you are not tracking all exits from an Area. ■ A timed antipassback violation occurs when a person (identified by their card) tries to access the same Area more than once during a specified period of time. Examples: ■ If a person enters an Area, exits the Area, and then presents his/her card to enter that same Area again—all within the timed antipassback period, a timed antipassback violation occurs. ■ Alternatively, if a person enters an Area and then passes his/her card to some one else to use to enter the same Area during the timed antipassback period, a timed antipassback violation occurs. (In this case, the system thinks the same cardholder is trying to access the Area more than once during the specified time period.) Enforcing timed antipassback does not require exit Readers in an Area, only entry Readers. Area Lockout Area Lockout allows you to configure an iSTAR Area in which the presence of Personnel, monitored by the Area's entry and exit Readers, locks the cardholders out of a designated target Area or Group of iSTAR Areas for a specified period of time. A facility with multiple laboratories or highly sensitive manufacturing areas might require this functionality to prevent cross-contamination and a resultant loss of productivity and/or human injury or life. The iSTAR Area(s) from which the Personnel are locked out can actually be or include the Area being entered. The target locked-out iSTAR Area can be any of the following ■ Same iSTAR Area ■ Another iSTAR Area ■ iSTAR Area group A cardholder can be locked out of one and the same target Area due to accessing multiple different Lockout Areas. This can occur because an Area may be in more than one iSTAR Area group specified as a target for lockout. In addition, an iSTAR Area group may be used as a target Area by multiple Lockout Areas. Personnel are locked out of such a common target area for the longest lockout time configured on any of the Lockout Areas, as illustrated in the example shown in Figure 2 on Page 23. 22 Chapter 1 C•CURE 9000 Areas and Zones User Guide EFTA01224663 Figure 2: Area Lockout Example Lab al Group 1 Lab 1 Lab a2 Group 2 Lab Lab 2 Example: ■ In the example in Figure 2 on Page 23, Lockout Area Lab 1 locks cardholders out of target Area Group 1 (which contains Lab al and Lab a2) for 8 hours. Lockout Area Lab 2 locks cardholders out of target Area Group 2 (which contains Lab bl and Lab a2 as well) for 24 hours. Note that Lab a2 is a Locked-out target Area common to both Lockout Areas, Lab 1 and Lab 2. If the cardholder is not currently locked out of any Areas, the following could occur: a. The cardholder's entry/exit access in Lab 1 locks him/her out of Lab al and Lab a2 for 8 hours. b. One hour later, the cardholder's entry/exit access in Lab 2 locks him/her out of Lab bl and Lab a2 for 24 hours. The cardholder is now locked out of the common target Area Lab a2 for 24 hours, the longest lockout time, rather than the 7 hours remaining from the first access in Lab 1. c. Two hours later the cardholder re-enters Lab 1. The cardholder is now locked out of Lab al for 8 more hours from this access, but remains locked out of the common target Area Lab a2 for the 22 hours remaining from the Lab 2 access in Step b. d. If during the lockout times enumerated in Step c —from Lab al for 8 hours and from Lab a2 for 22 hours —the cardholder is lockout graced, all lockout timers for this person are cleared. The cardholder can now enter any of the labs without waiting for the remaining lockout time to expire. e. Other cardholders may enter Lab al, Lab a2, or Lab bl without triggering lockout restrictions. The lockout timer starts when Personnel present a card at the entrance or exit Readers of the Lockout Area. If the iSTAR Area doing the locking out and the target Area being locked out are the same, the condition is similar, though not identical, to timed Antipassback where a person cannot present his/her card to enter the same Area through which the most recent access occurred. C•CURE 9000 Areas and Zones User Guide Chapter! 23 EFTA01224664 Antipassback An Area Lockout violation can activate an Event, and any Area associated with Area Lockout functionality can be configured with such an Event. Personnel may exit and reenter the Lockout Area during the Lockout period as often as they wish (unless it is one of the locked-out target Areas), but every entrance/exit resets the Lockout timer and extends the Lockout time to the full configured period. Personnel can, however, access other non-lockout Areas without affecting the Area Lockout time period. Regular Antipassback can also be used with Lockout Areas, but is not required for Area Lockout functionality. If Personnel activate a lockout, they cannot enter the locked-out target Area until the Lockout period has passed. If configured via the controller's RM LCD messages, the reader will display a reject "lockout" message with the time remaining in the Lockout period. If Personnel do not enter the locked-out target Area until the Lockout period has passed, they can then access this target Area without being rejected. NOTE An Area Lockout Grace is available for gracing individual Personnel separately from the regular Personnel Antipassback Grace Personnel. However Grace All and Grace All Partitions, grace all Personnel for both regular Personnel Antipassback and Area Lockout. Configuring Antipassback To configure antipassback, you must configure at least two Areas. ■ For Cluster Antipassback, the Areas must be controlled by Readers in the same iSTAR Cluster. ■ For Global Antipassback, the Areas can be controlled by Readers on different iSTAR Clusters. You can use the Area Antipassback tab to set up Regular and Timed Antipassback. ■ Configuring Regular Antipassback for iSTAR Areas on Page 76 ■ Configuring Timed Antipassback for iSTAR Areas on Page 76 ■ Configuring Lockout for iSTAR Areas on Page 77 Antipassback Events You can configure triggers to activate Events for antipassback entry/exit violations for an Area for those Personnel with the Activate Antipassback Event option selected on the General tab of the Personnel Editor. ■ Entry events are pulsed on any violation that occurs on a Reader that leads into the Area. ■ Exit events are pulsed on any violation on a Reader that leads out of the Area. The specific cause of the violation does not affect which event is pulsed. For information, see: ■ iSTAR Area Triggers Tab on Page 94 ■ Configuring Personnel Antipassback Options on Page 111. For detailed information on configuring Events, see the Events chapter in the C•CURE 9000 Software Configuration Guide. Antipassback Exempt Personnel If you select the Antipassback Exempt option while configuring a Personnel record, the system allows the person to access Areas without being tested for antipassback. 24 Chapter 1 C•CURE 9000 Areas and Zones User Guide EFTA01224665 Antipassback NOTE The preceding does not apply to personnel in a Carpool Group. They are subject to Carpool Antipassback rules even when their Personnel record is configured with the Antipassback Exempt option. Even if a person is configured as antipassback exempt, you can also choose to configure the Activate Antipassback Event option for him/her. In this case, while the person will gain access to the Area, he/she will also bigger any antipassback violation Events configured. For information, see Configuring Personnel Antipassback Options on Page 111. C•CURE 9000 Areas and Zones User Guide Chapter! 25 EFTA01224666 CarpooiAntipassback Carpool Antipassback Carpool Antipassback provides the capability to designate an Area as a Carpool Area and to organize Personnel into Carpool Groups that use these Areas. A Carpool Area always enforces antipassback rules, and a Carpool Group always moves into/out of a Carpool Area as a unit. Whenever an entrance to a Carpool Area is accessed by a member of a Carpool Group, all members of the Group are considered to have passed through that entrance. The person who presented the card to enter the Carpool Area is designated as the Group driver. The system maintains a Carpool Location (Carpool Area) for each Carpool Group in order to report the location for the Group members. When the Carpool Group member swipes at a Carpool entrance or exit, the group's location is moved. NOTE The Carpool Group member designated as the driver must have Clearance at the Entrance Reader for the group to be given access to the Carpool Area.. Cards and Carpool Groups Carpool Antipassback allows a Group of Personnel to be moved by a single Card swipe. Antipassback can be enforced on the Group when any Group member's Card is read. This Group of Personnel is known as a 'Carpool Group'. If you apply Carpool Antipassback to multiple Areas in the same iSTAR cluster, all the Areas together behave as one Carpool system. That is, if a Carpool Group enters one Carpool Area on a cluster, antipassback is enforced for this group on all other Carpool Areas on this cluster. A Carpool Group can have an unlimited number of Personnel in it, but each person can be in only one Carpool Group. When a person who is in a carpool group accesses a Carpool Area, the iSTAR will admit or reject based on the Carpool Group's location and whether or not Carpool Grace has been applied. If the Carpool Group is admitted and the entrance opens, the Carpool Group location for all Personnel in the Carpool Group is changed. Carpool Regular Antipassback Carpool regular antipassback works similarly to Personnel regular antipassback, except that is applies to a group of Personnel. It requires the following ■ Carpool Area: an Area that admits all Personnel in a Carpool Group with one card read. ■ Carpool Group: a Group of Personnel configured to be admitted into a specified Carpool Area by presenting the card of any member of the Group. A Carpool antipassback violation occurs when actions occur in the following sequence: 1. A card from the Carpool Group is presented at the entrance Reader. 2. Access is granted. 3. The Carpool location for all Group members is changed to the Area accessed. 4. A card from the same Carpool Group (the same or another card) is presented at the entrance Reader, without an exit read. 26 Chapter 1 C•CURE 9000 Areas and Zones User Guide EFTA01224667 CarpoolAntipassback A tailgate Carpool Croup violation can occur when: • A card from the Carpool Group is presented at the entrance Reader. • Access is granted. • Another Carpool Group or member of another Carpool Group also enters the Area without presenting their card. • Anyone from the second group tries to exit the Area. (They are denied egress.) Carpool antipassback and regular antipassback are separate features and cannot be configured in the same Area or in Areas adjacent to each other (where the exit Reader from one area is the entrance Reader into another). If the Areas are adjacent, you can have both Areas exit into a 'virtual' common non-antipassback Area. NOTE Carpool Timed Antipassback A Carpool timed antipassback violation occurs when a Carpool Group member presents a card at any entrance Reader to the same Carpool Area already accessed by that Group within a previously configured time period. NOTE Both Carpool antipassback and Carpool timed antipassback work only with iSTARs. Carpool Antipassback Limitations If you configure Carpool antipassback in multiple areas on the same Cluster, the system considers the Carpool Areas as one Carpool system. You cannot enter Carpool Area A if the system thinks you are in Carpool Area B—both on the same Ouster, as long as the two Areas are not adjacent. A Carpool Area may be adjacent to another Carpool Area or a non-Carpool Area. However, the following rules apply: • A Carpool Area cannot be configured for: • Area Lockout. • Area Muster. • An Area adjacent to a Carpool Area cannot be a: • Muster Area. • Cross-Cluster Area. • A non-Carpool Area adjacent to a Carpool Area cannot enforce any form of Antipassback. Carpool Antipassback Exemptions Antipassback checking is exempt under the following condition: • Any Person not in a Carpool Group can access a Carpool Antipassback Area if he/she has a valid clearance for this Area. The access does not display as a Group access. However, a Person who is in a Carpool Group is subject to Carpool Antipassback rules even if their Personnel record has the Antipassback Exempt option selected. C•CURE 9000 Areas and Zones User Guide Chapter! 27 EFTA01224668 CarpooiAntipassback NOTE To allow Personnel in a Carpool Group to be exempt from antipassback checking, you can either remove them from the Group or apply timed Carpool Grace for the Group. You can also create a Carpool Group with a single person. Personnel who are not in any Carpool Group can be given Clearances for a Carpool Area. They can then enter and exit without any antipassback checking. 28 Chapter 1 C•CURE 9000 Areas and Zones User Guide EFTA01224669 Using PersonnelAntipassback and CarpoolAntipassback Using Personnel Antipassback and Carpool Antipassback Carpool Antipassback and Personnel Antipassback are separate features. You cannot configure them in the same Area, nor in Areas adjacent to each other (where the exit Reader from one Area is the entrance Reader into another). You cannot enforce antipassback in the entrance and exit Carpool Areas in certain combinations. See Table 1 on Page 29 for combinations that you cannot use. Table 1: Unallowed An ipassback Combinations if Entrance Area Enforces... Exit Area Cannot Enforce... Regular Antipassback Carpool Regular Antipassback Regular Antipassback Carpool Timed Antipassback Timed Antipassback Carpool Regular Antipassback Timed Antipassback Carpool Timed Antipassback Carpool Regular Antipassback Regular Antipassback Carpool Regular Antipassback Timed Antipassback Carpool Timed Antipassback Regular Antipassback Carpool Timed Antipassback Timed Antipassback Carpool Regular Antipassback Muster Area Carpool Timed Antipassback Muster Area NOTE If you use any of these inappropriate combinations, the system displays a warning message and does not allow you to continue. C•CURE 9000 Areas and Zones User Guide Chapter 1 29 EFTA01224670 Antipassback Grace Antipassback Grace When you grace Personnel, it resets their cards' Antipassback/timed antipassback information. Consequently, the first time Personnel use their cards after a grace action, the system does not check for Antipassback violations. Once they present their cards and open the door/entrance, the system logs them into the Area. After this move, for all subsequent use of their cards, the system returns to checking for Antipassback violations. Grace also resets the iSTAR Global Antipassback owners of Personnel cards when the iSTAR owners are not communicating. The first time Personnel use their cards after a reset action, the controllers at which the cards are presented become the owners. You can grace card(s) from both the Administration application and the Monitoring Station. ■ 'Grace Personnel' clears the antipassback and timed antipassback information for single Personnel. ■ 'Person Area Lockout' grace clears all Area lockout timers for single Personnel, allowing entry to all target Areas that he/she is locked out of. ■ 'Person Antipassback Reset Card' resets the iSTAR Global Antipassback owner of a single Personnel card; this also graces antipassback and area lockout. ■ 'Carpool Grace' clears the antipassback and timed antipassback information for all Personnel in that Carpool Group. You can apply the preceding types of 'person grace' as follows: ■ On the Administration application in several places: • Personnel Dynamic View - for one or more selected persons. • Carpool Group Dynamic View - for all persons in the Group. ■ On the Monitoring Station in several places: • Swipe & Show tab - for a single card. (If the card belongs to a person in a Carpool Group, 'Carpool Grace' applies to all Group members.) • On the Personnel in Area list - for one or more selected persons. (For instructions on granting grace, see Gracing Personnel on Page 127.) Grace All Partitions/Grace All 'Grace All' clears the Antipassback/Area Lockout information for all cards in one or more selected Partition(s), as well as resetting the iSTAR Global Antipassback owners of their cards. Grace MI also applies a one-time Carpool Grace that applies to the next access for that Carpool Group. (This is not the 'timed' Carpool Grace.) NOTE In an unpartitioned system, when all Objects are only in one Partition —the 'Default' Partition, Grace MI does this for all cards in the system. Grace All functions as follows: ■ On the Administration application: • From the Partition Dynamic View - for one or more selected Partitions. • By configuring an Event with a Grace All Action. ■ On the Monitoring Station Swipe & Show Grace Partition tab: 30 Chapter 1 C•CURE 9000 Areas and Zones User Guide EFTA01224671 Antipassback Grace NOTE This is available only on the legacy' Swipe & Show View, not on any of the new 'Default' Views. • Grace MI Partition Button - for all Personnel in all Partitions in the system, no matter how many. • Grace MI — If the system is not partitioned, gracing the Default Partition graces all cards in the database. — If the system is partitioned, you can select one or more Partition(s) for which you want to grace all cards. Carpool Grace You can grace all Personnel within a Carpool Group for antipassback for a specified time period with set start/end times. For the duration of the configured time, the Carpool Group members can move in and out of Carpool Areas without restriction. During this grace period, the Group's location remains unchanged. Example: A system administrator or guard could configure the grace period for the Carpool Group the day before. Then anyone in the Group could drive his/her own car and park freely in the parking Areas.. The first time a Carpool Group member uses his/her card after the specified time period, the system does not check for Carpool antipassback. Once grace is granted, the Carpool Group must move through the entrance (present a card, open the entrance, and move through). After this move—for the next access, their correct location information is recorded, and antipassback is enforced as usual. ■ A roll call report run during the grace period may display multiple drivers, since any card swipe will be accepted, and the person swiping the card will be marked as a carpool driver. If a