ILS Lock Operation User Guide

Transcription

1 ILS Lock Operation User Guide PERPETUAL INNOVATION

2 Lenel OnGuard 2012 ILS Lock Operation User Guide, product version 6.5. This guide is item number DOC-303E, revision 2.004, December 2011 Copyright Lenel Systems International, Inc. Information in this document is subject to change without notice. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of Lenel Systems International, Inc. Non-English versions of Lenel documents are offered as a service to our global audiences. We have attempted to provide an accurate translation of the text, but the official text is the English text, and any differences in the translation are not binding and have no legal effect. The software described in this document is furnished under a license agreement and may only be used in accordance with the terms of that agreement. Lenel and OnGuard are registered trademarks of Lenel Systems International, Inc. Microsoft, Windows, Windows Server, and Windows Vista are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Integral and FlashPoint are trademarks of Integral Technologies, Inc. Crystal Reports for Windows is a trademark of Crystal Computer Services, Inc. Oracle is a registered trademark of Oracle Corporation. Other product names mentioned in this User Guide may be trademarks or registered trademarks of their respective companies and are hereby acknowledged. Portions of this product were created using LEADTOOLS LEAD Technologies, Inc. ALL RIGHTS RESERVED. OnGuard includes ImageStream Graphic Filters. Copyright Inso Corporation. All rights reserved. ImageStream Graphic Filters and ImageStream are registered trademarks of Inso Corporation.

3 ILS Lock Operation User Guide Table of Contents Chapter 1: Introduction...9 Other Referenced User Guides... 9 Conventions Used in this Documentation... 9 Features and Functions Lock Installation...13 Lock Configurations Lock Audit Trail...16 Lock Attributes...16 Users Settings...17 Calendar Timezones Lock Operation Mode Changes Emergency Operations (ILS Wireless Locks Only) General Lock Characteristics Battery Life Replace Lock Batteries LED and Buzzer Indicators Micro-switches Connections Batteries and Privacy Mobile Configurator Card Reader Technologies Magnetic iclass revision 2 3

4 Table of Contents MIFARE khz Prox Lockcases Mortise with Deadbolt Mortise, Latch Only Heavy Duty Cylindrical Latch BLA Mortise with Deadbolt/AFC Mechanical Key Override State Changes Alternative Fire Code (AFC) Hardware AFC Lock Settings Latch and Door Sensor Monitoring Maintenance Clean the Reader Outer Cover Clean the Magnetic Read Head (Magnetic Stripe Reader Only) Door Position and Monitoring Door Sensor Contact Latch Monitoring Lock Operating Environment Lock Certifications Chapter 2: System Commissioning...37 Lock Installation Test the Locks Lock Commissioning revision 2

5 ILS Lock Operation User Guide Wireless Gateway Assign the Locks Initialize the Locks...39 Chapter 3: Mobile Configurator...41 Description Main Components Connectors Power Adapter Connections To the Lock To the Computer where OnGuard is Running Setup and Configuration Download the Lock Configuration File to the Mobile Configurator Upload the Mobile Configurator Lock Audits File to OnGuard Lock Operators Operator Logon Using the Mobile Configurator Initialize Update Lock...47 Change Lock Mode Tests and Diagnostics Read Lock Audits (Events) Open Lock Power Up Firmware Upgrade Lock information revision 2 5

6 Table of Contents Network Join (ILS Wireless Lock Only) Send Heartbeats (ILS Wireless Locks Only) Mobile Configurator Maintenance Wireless Functionality Wireless Connectivity Main Components Description Lock Radio ILS Wireless Lock Radio LED Indications Wireless Features Chapter 4: Site Planning for a Wireless Installation...61 ILS Wireless Components Overview Installation Planning Obtain a Floor Plan Identify the Wireless Lock Locations Determine Potential Wireless Gateway Locations Power and TCP/IP Network Access for the Wireless Gateway Mounting Feasibility Wireless Gateway Antenna Orientation Wireless Gateway Mounting Height Relative Positioning of a Wireless Gateway and Its Locks Wireless Gateway Mounted in the Middle of the Associated Locks Wireless Gateway Mounted on an Exterior Wall Estimating Wireless Range Basic Propagation Mechanisms Multipath Fading revision 2

7 ILS Lock Operation User Guide ILS Wireless Range Inside Buildings ILS Range in Hallways ILS Range with Wall Obstructions Impact of Obstructions Perform the Site Survey Visual Inspection of the Site Scan the RF Spectrum on the Site Chapter 5: Wireless Gateway...83 Description Wireless Gateway (Ethernet) Wireless Gateway (Wi-Fi) Commission the ILS Wireless Gateway Assign a Wireless Gateway IP Address Automatic IP Address Assignment (Ethernet Only) Assign an IP Address (Wi-Fi and Ethernet) Establish a Static IP Address (Ethernet Only) Lock Table (Data) Configure the Wi-Fi Wireless Gateway Connect Wi-Fi Wireless Gateway to the Computer via HyperTerminal Lock Data Wireless Gateway LEDs Wireless Gateway Power Supply Wireless Gateway Certifications Wireless Gateway Environmental Requirements revision 2 7

8 Table of Contents Chapter 6: Troubleshooting...97 Chapter 7: Hardware Upgrade Description Upgrade the Radio Upgrade/Replace the Radio Upgrade the Reader Upgrade/Replace the Reader Replace the Wireless Gateway Upgrade the Firmware or Software Upgrade Components Upgrade the Lock Using the Mobile Configurator Upgrade the Lock via the Wireless Gateway Upgrade the Mobile Configurator Application Appendices Appendix A: Alarm/Events Table Appendix B: Install Mechanical Key Override in ILS Locks 113 Installation Procedure Index revision 2

9 ILS Lock Operation User Guide Chapter 1: Introduction The scope of this document is limited to the installation and commissioning of Wireless Gateways and ILS wireless locks from an RF coverage perspective. The intended audience for this document includes the installation and service technicians that would need to plan and install ILS wireless components on a site. The document does not include any OnGuard specific configuration procedures, as this information is provided in the OnGuard documentation. Other Referenced User Guides This user guide describes the operation of your Lenel Integrated Locking Solution (ILS) as well as providing an overview of the installation and configuration of the locks. In addition to this user guide, the following guides are provided on the OnGuard installation disc: System Administration User Guide. This guide is intended for system engineers and administrators who want to build, operate, and maintain the OnGuard access control system. Instructions for designing, installing, and configuring the OnGuard system for ILS locks are covered in this guide. ID CredentialCenter User Guide. This guide is a sub-set of the System Administration User Guide intended for operators of the OnGuard system who want to monitor and administrate the system. Installation Guide. This walks you through the installation of the OnGuard software with a SQL Server or SQL Server Express database. It also includes steps to install the browser-based applications. ILS Lock Component Installation & Upgrade Guide. This guide provides instructions for installing or upgrading the lock reader or radio in the field. Conventions Used in this Documentation Where a term is defined, the word is represented in italics. Field names, menus, and menu choices are shown in bold. Keyboard keys are represented in angle brackets. For example: <Tab>, <Ctrl>. Keyboard key combinations are written in two ways: <Ctrl> + <Z> means hold down the first key and press the second <Alt>, <C> means press the first key, then press the second revision 2 9

10 1: Introduction Window buttons on the screen are represented in square brackets. For example: [OK], [Cancel]. The vocabulary used: ACF. Refers to Access Control Format. ActiveSync. A data synchronization program developed by Microsoft for use with its Microsoft Windows line of operating systems. It provides users of Microsoft Windows a means of transporting information between their desktop computer and a mobile device, such as a Mobile Configurator, mobile phone, or any other portable devices that support the ActiveSync protocol. ActiveSync is available as a free download from Microsoft s web site. ACU. Refers to the lock s Access Control Unit. ADA. Refers to Americans with Disabilities Act. In order to be ADAcompliant, extended strike and extended open time is assigned to cardholders with disabilities who require it. The ADA information is configured on the Wiegand card format form. For more information, refer to Add a Wiegand Card Format in the System Administration User Guide. AFC. Refers to Alternative Fire Code that is also known as Ontario Fire Code This mode requires presentation of the card to relock the door upon exit. Refer to Ontario Fire Code ANSI. Refers to American National Standards Institute. Audit trail. A log of event information that is recorded at the lock. Audit is used interchangeably with event in this document. BLA. Refers to Bored Latch Adapter used in the BLA lock. This adapter fits into the standard cylindrical door prep, but is much more secure and robust than the standard 3500 latch on your doors at home. Refer to Prep. CE. Refers to Consultants Europe. These experts identify hazards, assess risks, carry out all applicable tests to determine the appropriate measures to meet with CE mark regulations. DHCP. Refers to Dynamic Host Configuration Protocol. This protocol is used for assigning dynamic IP addresses to devices on a network. DST. Refers to Daylight Saving Time. ESD. Refers to Electrostatic Discharge. ESD, is a single-event, rapid transfer of electrostatic charge between two objects, usually resulting when two objects at different potentials come into direct contact with each other. ESD can also occur when a high electrostatic field develops between two objects in close proximity. ESD is one of the major causes of device failures in the semiconductor industry. FCC part 15. Federal Communications Commission regulation of low power, non-licensed transmitter devices that could cause potentially harmful 10 revision 2

11 ILS Lock Operation User Guide interference to licensed transmitters and vice versa. Part 15 covers an assortment of electronic equipment that generates RF energy whether it is intentional, unintentional or incidental. Heartbeat. Predefined message used by wireless locks to communicate with the wireless access point. iclass MHz read or write, contactless, smart card technology that is compliant with ISO LED. Refers to Light Emitting Diode. MAC. Refers to the Media Access Control address; also known as the hardware address or physical address. The MAC address is a unique value given to each device on an Ethernet network that allows the device to identify itself on the network. MAC addresses are 12-digit hexadecimal numbers (48 bits in length). IP networks maintain a mapping between the IP address of a device and its MAC address. DHCP also usually relies on MAC addresses to manage the unique assignment of IP addresses to devices. MC. Refers to the Lenel ILS Mobile Configurator. Use this portable device to initially configure and manage ILS offline and ILS wireless locks. The MC allows you to initialize, download card holders, download and upload events, download lock scheduling information, download firmware updates, and run lock diagnostics. You can also use the MC to unlock the lock and change reader modes as needed. NIST. Refers to the National Institute of Standards and Technology. Ontario Fire Code Provisions of the Ontario, Canada, Building Code, Section which requires that doors do not automatically lock when a person exits the room instead of relying on the key holder to relock the door themselves. Configurator adapter. The Mobile Configurator communicates with the ACU via the Configurator power adapter that can used to provide auxiliary power to the ILS offline and ILS wireless locks in case the battery power is low or has no power. PP. Refers to Portable Programmer also known as the Mobile Configurator. Prep. To prepare a door or frame for installation of a lock or other hardware. SCF. Refers to Smart Card Format. This card format describes to the lock how to retrieve access control data from the smart card credential and pertains to iclass and MIFARE locks, only. RTC. Refers to Real Time Clock. RoHS. Refers to Restriction of Use of Hazardous Substances. RoHScompliant electrical and electronic equipment is tested for the presence of Lead (Pb), Cadmium (Cd), Mercury (Hg), Hexavalent chromium (Hex-Cr), revision 2 11

12 1: Introduction Polybrominated biphenyls (PBB), and Polybrominated diphenyl ethers (PBDE). SSL Certificate. Secure Sockets Layers are cryptographic protocols that provide security for communications over networks such as the Internet. SSL creates a secure connection between a client and a server, over which any amount of data can be sent securely by using two keys to encrypt data; a public key known to everyone and a private or secret key known only to the recipient of the message. URLs that require an SSL connection start with https: instead of http: Trim. The portions of the lock the user can see when lock is installed on a closed door. UL10C. Underwriters Laboratories Standard for positive pressure fire tests of door assemblies. WAP. Refers to the Wireless Access Point device that is also known as the ILS Wireless Gateway. Wi-Fi. Refers to Wireless Fidelity. Describes a method of obtaining Internet access using wireless technology. Most portable computers can add Wi-Fi connectivity using an adapter that plugs into a computer card slot or USB port. Wireless Gateway. This is an ILS-specific Wireless Access Point (WAP) device; not a common access point. The ILS Wireless Gateway is used to communicate with its associated locks on the 900Mhz frequency range. In this document, Wireless Gateway is also referred to as the Wireless Access Point or WAP. WLM. WLM - Refers to the Wireless Lock Module; this is the radio module of the ILS wireless lock. WMC. Refers to the WAP Main Controller micro-controller. WWM. Refers to the Wireless WAP Module micro-controller. UL294. Certifies that RFID devices and systems conform to the Underwriters Laboratories UL-294 Access Control Systems Standard of safety. Features and Functions The feature and function descriptions in this document are common to both ILS offline and wireless locks unless otherwise stated. 12 revision 2

13 ILS Lock Operation User Guide Lock Installation Warning Installation of ILS locks should only be performed by a Lenel ILS (Integrated Locking Solutions) certified installer. Be sure to completely read and understand the lock installation template and guide before installing the locks. Lock Configurations When the lock is installed, it is configured with factory settings. After the lock is initialized with the Mobile Configurator, it has the settings that were configured in OnGuard and downloaded to the Mobile Configurator prior to initialization. Locks configured with factory settings support the use of the standard or owner construction cards. Factory Configuration Mode By default, every new lock comes pre-configured with factory settings and the Lock ID is zero (0). Such a lock is considered to be in the Factory Configuration Mode. When the lock is in Factory Configuration Mode, it provides basic lock/ unlock functionality during the installation period and only supports the use of construction cards. While in Factory Configuration Mode, the lock supports two (2) different card types standard and owner which support the Standard and Office Factory Modes, respectively. In addition, the lock supports the lookahead functionality with a default Codes look ahead value of 10. For more information, refer to Lock Attributes on page 16 or the System Administration User Guide. Construction Cards Construction cards are supported for magnetic, iclass, MIFARE, and proximity card technologies and are able to grant access when presented to a lock in the factory mode. For more information, refer to Card Reader Technologies on page 29. Standard construction card. When this card is presented, the lock will unlock and relock after six (6) seconds. This is the default value for Strike / Extended Open Time. The Badge ID of a standard construction card is This Badge ID has no special meaning after the lock is initialized and leaves the factory mode. Therefore, you can use this Badge ID for a normal user in the non-factory mode. If the lock is reset to factory mode, the lock treats this Badge ID as the special construction card once again. Office (lock owner) construction card. When this card is presented once, the lock will unlock and relock after 6 seconds. If this card is double-dipped within 6 seconds, the lock unlocks and remains unlocked until this card is doubled-dipped again, at which point the lock is relocked. The Badge ID of an office construction card is This Badge ID shall have no special meaning after the lock is initialized and leaves the factory mode. Therefore, you can use this Badge ID for a normal user in the nonfactory configuration. If the lock is reset to factory mode, the lock treats this Badge ID as the special construction card once again. revision 2 13

14 1: Introduction Note: Special purpose cards do not support factory configuration. Standard Configuration Mode After the lock is initialized, it enters the Standard Configuration Mode and its operation is then governed by the standard lock operational modes. For more information, refer to Lock Operation Mode Changes on page 18. Note: When the lock has factory settings, the privacy state is ignored. If the deadbolt is engaged when door is unlocked, the lock will not relock. If the deadbolt is engaged when door is locked, both Construction and Standard cards will unlock the door. The deadbolt will disengage when the door handle is actuated during open time or during Unlocked mode. For more information, refer to Privacy (Monitor Deadbolt) on page 18. Reset the Lock to Factory Configuration Mode After a lock is in initialized, it may need to be re-initialized, for example, when the System code is changed or the door/lock is moved to a new location. Important: A lock cannot be initialized unless it is in factory mode. If the lock is in standard mode, it must reset to factory mode first. 1. Remove the thumb turn after removing the thumb turn screw. 2. Remove the 12mm T-10 screw from the battery cover (upper inside escutcheon). 14 revision 2

15 ILS Lock Operation User Guide 3. Remove the battery cover (upper inside escutcheon). 4. On the left facing battery circuit board, press the CLEAR button to reset the lock to the factory settings. CLEAR button Important: To prevent accidentally resetting the lock to factory mode, the lock can only enter factory mode when the CLEAR button is depressed for approximately 15 seconds. To ensure the lock is reset, press the lock s CLEAR button until the LED in front of the reader provides a visual indication. Default Settings Whenever the lock is reset to factory mode, all settings are reset to their default value. revision 2 15

16 1: Introduction Any previous configuration of the lock is cleared, including the Lock ID (Record number), System code, cardholders, timezones, automatic changes, holidays, etc. The audit trail is also erased but certain settings are not cleared such as the total lock cycles counter. The lock will retain the factory configuration until it is initialized by OnGuard via the Mobile Configurator. Lock Audit Trail During standard operation, the lock can record the last 1000 events in its memory. However, the memory does not overflow when it becomes full. Instead, new events are added to the end of the audit log and the oldest record is removed in a first-in, first-out process. Each recorded event includes the following information: Date Hour Minute User code (if applicable) Event type Access granted Access denied Invalid card Automatic lock state changes DST updates Blocking card Join card (Wireless) Test card Lock malfunction For the list of events, refer to Appendix A: Alarm/Events Table on page 109. Lock Attributes The lock has several attributes that modify its behavior. These attributes are configured in OnGuard. Some of the attributes are global. If a global attribute is enabled, it applies to all locks in the system. Other attributes are configured on a lock-by-lock basis. The following list includes attributes which apply on a lock-by-lock basis: Door unlock time (Strike Time) can be configured from seconds Door unlock time for disabled users (Extended Strike) used for ADA can be configured from seconds Is Lock when the handle is released feature used? Is the Unlock on deadbolt feature used? Is the Unlocked mode with card feature used? Global attributes include the following: 16 revision 2

17 ILS Lock Operation User Guide System code Lock or card date precedence? Store badge activate/deactivate dates? Codes lookahead - can be configured system-wide or on a lock-by-lock basis Clean up wireless diagnostics days (ILS wireless locks only) Are the AFC features used? Note: For more information about all of the lock attributes, refer to the System Administration User Guide. Users Settings Calendar Timezones User-specific settings allow the lock to function in a different manner for cardholders assigned with the following permissions within the system: ADA. An option that can be configured for the user who requires an extended amount of time to enter a door due to a handicap, injury, or other debilitating condition. If ADA is configured for the cardholder, it applies to every door the cardholder accesses. Device owner. An option that can be configured for a user who needs to override the privacy function of a given door, or needs to place a given door into the unlocked mode with the cardholder card. This option is configured as either ON or OFF for each cardholder in each door, so a cardholder may be the device owner of many doors, and a door may have many owners. Device owner is also referred to as the lock owner. Blocking override. When a blocking card is presented to the lock, the door is blocked, and the lock enters the blocked mode. An option can be enabled for a user who requires the ability to override a blocked door. The blocking override is typically enabled for security personnel. If the blocking override is enabled for a cardholder, it applies to every door to which the cardholder has access. For more information about the Blocked mode, refer to Lock Operation Mode Changes on page 18. The behavior of the lock with regard to the time of day (scheduled and automatic changes) can be different for every day of the week (Sunday - Saturday, and holidays). The calendar determines the days that will be specified as holidays. The lock supports up to 100 holidays. Splitting the holidays out and individually identifying the days of the week gives the system eight (8) different day types. Timezones are composed of time range/day intervals. Each interval is defined by the beginning hour and minute, the ending hour and minute and the day types to which the interval applies. Selectable days include any of the seven days of the week, plus any of up to eight (8) holiday types. For more information, refer to the System Administration User Guide. revision 2 17

18 1: Introduction You can configure ILS Offline/ILS Wireless timezones which are only downloaded to the ILS offline/wireless locks in the system. Each ILS offline/ wireless timezone supports up to five (5) time range/day intervals. A maximum of 64 ILS offline/wireless timezones are allowed including the two (2) predefined timezones; Always and Never. Lock Operation Mode Changes The lock may change modes of operation either by a user action or by an scheduled automatic change. The different operational modes include: Unlocked The lock is unlocked and cardholders may pass freely through the door. First Card Unlock The lock is placed in the Unlocked mode, but only after the first valid card is presented after the mode change. Card Only Each cardholder must present a valid card to open the door. Use of a card with the Device owner option allows the lock to change to the Unlocked mode (if enabled). Device owner is also referred to as the lock owner. Facility Code Only In Facility Code Only mode, the lock will only grant access to a card with valid credentials (facility code, authorization level, and card activate / deactivate date). If the deadbolt is engaged and the lock is in Facility Code Only mode, the lock will ignore the privacy state; the lock will relock. However, only a card with valid credentials will unlock the door. For more information, refer to Privacy (Monitor Deadbolt) on page 18. Blocked This is a special state controlled by the use of the blocking card. When a door is blocked with the blocking card, the lock will reject all cards that do not have the Blocking override enabled. The state of the lock changes alternatively from blocked to not blocked each time the blocking card is presented. Cards that override a blocked lock will place the lock into the blocked state. Each of these actions, as well as a card rejection due to a blocked lock, is registered in the audit trail. When in the blocked mode, the lock will ignore automatic scheduled changes unless these are initiated by OnGuard or a Mobile Configurator. Privacy (Monitor Deadbolt) When the cardholder engages the deadbolt (privacy knob) from inside the door, the door is considered to be in the privacy state. When the cardholder disengages the deadbolt, the door is no longer in the privacy state. 18 revision 2

19 ILS Lock Operation User Guide The privacy state of the lock is a combination of the OnGuard privacy setting (Monitor deadbolt) and the deadbolt position: When Monitor deadbolt is enabled: If the door is locked with the deadbolt engaged, only the lock owner will be granted access; the door will then unlock and the deadbolt will disengage when the door handle is turned. For more information, refer to Device owner on page 17. When Monitor deadbolt is disabled: If the door is locked with the deadbolt engaged, then anyone with a valid card will be granted access; the door will then unlock and the deadbolt will disengage when the door handle is turned. Note: If you change the lock to Secured, Unsecured, or Blocked mode from OnGuard, the Mobile Configurator, or the card (Emergency Lock, Emergency Unlock, or Blocked) this will override the privacy state of the lock. Emergency Operations (ILS Wireless Locks Only) The following commands can be issued by the lock operator from the Alarm Monitoring device view. For more information, refer to Secure/Unsecure All Locks from a Reader Device Group in the Alarm Monitoring User Guide. Emergency Commands Secure All. When the Secure All command is issued from a reader device group, all locks within the reader device group are locked and operate in the security mode (no card will be granted access) until the mode is changed from OnGuard, the Mobile Configurator, or a special purpose card. For adding locks to a reader device group, refer to the System Administration User Guide. Unsecure All. When the Unsecure All command is issued from a reader device group, all locks within the reader device group will remain unlocked and operate in the unsecured mode until the mode is changed from OnGuard, the Mobile Configurator, or a special purpose card. The following emergency lock operation modes can be set by the lock operator in the Alarm Monitoring system tree or by presenting one of the emergency special purpose cards. For more information, refer to ILS Special Purpose Cards in the System Administration User Guide. Emergency Operation Modes Secured. The lock operator can change the lock s mode to secured from the Alarm Monitoring system tree or by presenting the Emergency Lock card. During Emergency Lock mode the door locks, no card will be granted access, and the lock will operate in the security mode until the lock operator changes the mode from OnGuard or a Mobile Configurator, or presents the revision 2 19

20 1: Introduction Emergency Lock card again, at which point the lock will enter the Card Only mode. Unsecured. The lock operator can change the lock s mode to Unsecured from the Alarm Monitoring system tree or by presenting the Emergency Unlock card. The lock will remain unlocked and operate in the Unsecured mode until the lock operator changes the mode from OnGuard or the Mobile Configurator, or presents the Emergency Unlock card again, at which point the lock will enter the Card Only mode. Note: Scheduled automatic changes are not applied when the lock is in the security or unsecured mode. Note: When lock operation modes are changed from Alarm Monitoring, the change request waits at the Wireless Gateway to be sent on the heartbeat cycle of each lock. Lock operation mode changes cannot be pushed down to the lock until the lock wakes up and executes the change. For more information, refer to section Lock Heartbeat on page 56. Scheduled (Automatic) Changes The lock can be configured to automatically change state on a scheduled basis which is configured in OnGuard. This function allows the lock to automatically change operational mode up to 20 times per day type. Each change is registered in the lock audit trail. Optionally, you can configure up to 25 scheduled changes per ILS offline/ wireless lock. For information on configuring Timezone/Reader Modes, refer to the System Administration User Guide. Examples of possible ILS offline/wireless configurations: 5 timezones containing 5 intervals each 10 timezones containing 2 intervals each and 1 timezone containing 5 intervals 25 timezones containing 1 interval each Daylight Saving Time Locks can automatically adjust for daylight saving time. Each lock can store the dates of the next four (4) changes (two years). The lock will adjust one (1) hour forward or backward as dictated by the programming. 20 revision 2

21 ILS Lock Operation User Guide General Lock Characteristics Battery Life The lock is powered by three (3) alkaline type AA or LR4 batteries located under the battery cover (upper-inside escutcheon). When ILS offline and wireless locks are sleeping (not in use), they consume approximately 0.02mA. When the lock circuit is active, it consumes approximately 10mA. The motor consumes 150mA when it is active. Battery life estimates for wireless locks vary depending on the configurable radio heartbeat interval. Battery consumption is reduced for longer heartbeat intervals in conjunction with the number of openings per day. For more information, refer to Lock Heartbeat on page 56. New batteries provide 4.5 volts (100%). As the batteries are consumed, the lock will begin to indicate the low battery power condition starting when the batteries have 18% (3.5 volts) of usable power remaining. When the battery power level drops below 5% (3.3 volts), the lock will continue to signal the low battery condition but will refuse to grant access (unlock). Battery Lock Status Event 4.5 V V o l t a g e 4.5 V 100% No event P e r c e n t a g < = 3.5 V e <18% Low Battery < = 3.3 V 0% Access Denied - Low Battery 0 V You can monitor lock battery level in Alarm Monitoring. For more information, refer to View Wireless Lock Status in the Alarm Monitoring User Guide. revision 2 21

22 1: Introduction Replace Lock Batteries Important: If you replace the lock batteries due to a very low battery, the battery has no power, or you power off the lock by removing, and then replacing the batteries, the lock s real-time clock (RTC) must be updated using the Mobile Configurator. To replace the lock batteries, complete the following steps: 1. Remove the thumb turn after removing the thumb turn screw. 2. Remove the battery cover. 3. Remove the batteries. 4. Install the new batteries, and replace the battery cover and thumb turn. 5. Connect the power adapter to the lock by inserting the plug into the jack on the bottom of the lock. Ensure the adapter is connected to the Mobile Configurator. For more information, refer to Using the Mobile Configurator on page Power on the Mobile Configurator and the power adapter, and then log onto the Mobile Configurator application. For more information, refer to Operator Logon on page revision 2

23 ILS Lock Operation User Guide 7. Update the lock s clock time (RTC). From the Tools menu, select Update Lock Clock, and then click [Update]. Important: Make sure to verify the date and time displayed on the Mobile Configurator. If the Mobile Configurator has the wrong date and time, the lock will be updated with the wrong date and time and will not function as intended. 8. Disconnect the power adapter, and power off both the power adapter and the Mobile Configurator. revision 2 23

24 1: Introduction LED and Buzzer Indicators Notes: Automatic scheduled changes do not produce LED or buzzer indications. When a card is presented twice (after access is granted), and the mode or state of the lock changes, the access granted indication (solid GREEN) will be followed by a mode change indication (blinks GREEN or solid RED). For mode changes generated by presenting special purpose cards, only the mode change indication will be shown. For access granted events, the LED remains solid GREEN for the duration of the open lock timer. Buzzer Behavior LED or Buzzer Indication High Beep Low Beep Description The buzzer double-beeps continuously within a 50 ms interval. The buzzer single-beeps continuously within a 50 ms interval for the time specified in OnGuard for the Door Held Open Alarm. The lock uses two (2) LED indicators (RED and GREEN) to communicate with users or lock operators as shown in the following tables: LED Behavior LED or Buzzer Indication Solid GREEN Solid RED Blinks GREEN Blinks RED Description LED is solid GREEN for two (2) seconds LED is solid RED for two (2) seconds LED blinks GREEN four (4) times within two (2) seconds LED blinks RED four (4) times within two (2) seconds Access Granted (Solid GREEN) Event Access Granted Access Granted Entry Made Access Granted No Entry Made Door Open Description Access granted when no latch monitoring or door sensor Access granted and door opened; used when latch monitoring or door sensor are present Access granted but door not opened; used when latch monitoring or door sensor are present Lock opened via Mobile Configurator or OnGuard 24 revision 2

25 ILS Lock Operation User Guide Access Denied (High Beep and Blinks RED Only for Magnetic Locks) Event Inactive Badge Access Denied: Card Expired Invalid Badge Denied, Not Authorized Invalid Issue Code Denied, Invalid Timezone No Privacy Override Access Denied: Secured Mode No Blocking Override Access Denied: Invalid Access Control Data Invalid Facility Code Access Denied: Invalid Access Control Data Parity Access Denied: Invalid Access Control Data Length Access Denied: Invalid Access Control Data Type Access Denied: Access Control Format Not Found Access Denied: Invalid Smart Card Data Access Denied: Invalid Smart Card Authentication Access Denied: Invalid Smart Card Location Access Denied: Invalid Smart Card Type Access Denied: Smart Card Format Not Found Description Card not yet active Card has expired User information is not on the lock Authorization for access is missing Card is cancelled User is not enabled in this hour User does not have privacy override privilege Lock is in Security (Emergency Lock) mode; no users allowed access User does not have Blocked Override privilege Failed to process Integra card data Facility code for selected ACF did not match facility code retrieved from the card Parity calculations for retrieved data failed for selected ACF Length of retrieved data did not match length specified in selected ACF The type of retrieved data (Wiegand/Integra) did not match ACF type No ACFs stored at the lock Invalid header, invalid data length, failed to retrieve HID App data. Failed to authenticate to application specified by selected SCF Application data could not be located on the card based on the selected SCF (Smart Card Format) Either the card was not found in the field, or the card failed to respond to the requested RF protocol No SCFs stored at the lock Test or Join Failed Event (Blinks RED and High Beep) Event Test failed Join failed Description Blinks red, only. Blinks red, only. revision 2 25

26 1: Introduction Solid GREEN, Blinks RED Event Denied Low Battery Unlocked Mode Change Denied: Low Battery Unlocked Under First Card Unlock Power Up (Solid green blinks red for 2 seconds) Description Door open/close failed due to low batteries Lock cannot enter office mode due to low battery Recorded after power up by Mobile Configurator Lock powered by batteries Mode Change Events (Blinks GREEN) Event Reader Mode Unlocked Reader Mode Unsecured Unlocked Under First Card Unlock Unlocked Under AFC Description Lock entered Unlocked mode Lock entered Security (Emergency Lock) mode First Card unlock Lock entered AFC mode Test pass Join pass Access Granted when lock is already unlocked Unlocked, unlocked in First Card Unlock Mode Change Events (Solid RED) Mode Change Event Locked Under First Card Unlock Unlocked Under AFC Reader Mode Secured Reader Mode Blocked Reader Mode Facility Code Only Reader Mode First Card Unlock Reader Mode Card Only Description First card relock End of AFC mode Lock entered Unsecured (Emergency Unlock) mode Lock entered Blocked mode Lock entered Facility Code Only mode Lock entered First Card Unlock mode Lock entered Card Only mode LED Alternate Solid RED and Solid GREEN Lock is reset; LED solid green and solid red for 5 seconds Lock is reset to Construction mode. Low Beep Only (Not Supported by Magnetic Locks) Door Held Open Alarm when door is left open; used when latch monitoring or door sensor are present. 26 revision 2

27 ILS Lock Operation User Guide Events Which Do Not Generate LED or Buzzer Indications Event ACU Firmware Upgraded Audit Trail Cleared Audit Trail Limit Reached Card Only Mode Change Denied: Blocked Mode Card Only Mode Change Denied: Security Mode Daylight Savings Time Audit Door Forced Open Door Forced Open Restored Door Held Open Restored Door Open by Key Door Open by Key Off Door Open from Inside Facility Code Only Mode Change Denied: Blocked Mode Facility Code Only Mode Change Denied: Security Mode First Card Unlock Mode Change Denied: Blocked Mode First Card Unlock Mode Change Denied: Security Mode Internal Deadbolt Internal Deadbolt Off Lock Initialized Lock Updated Low Battery Low Battery Restored Reader Module Firmware Upgraded Real-time Clock Updated Unlocked Mode Change Denied: Blocked Mode Unlocked Mode Change Denied: Security Mode WLM Firmware Upgraded Description Lock firmware update. Recorded when audit trail (event log) is cleared. Informs OnGuard when the audit log is becoming full and is about to be overwritten. Automatic change to Card Only mode denied since lock is in Blocked mode. Automatic change to Card Only mode denied since lock is in Security (Emergency) mode. DST start or DST end occurred. Alarm when door is forced open. Cleared state of Door Forced Open event. Cleared state of Door Held Open event. Mechanical key override is on. Mechanical key override is off. Door opened from inside, only when not in Unlocked mode. Automatic change to Facility Code Only mode denied since lock is in Blocked mode. Automatic change to Facility Code Only mode denied since lock is in Security (Emergency) mode. Automatic change to First Card Unlock first mode denied since lock is in Blocked mode. Automatic change to Unlocked mode denied since lock is in Security (Emergency) mode. Privacy knob (deadbolt) turned (engaged) from inside. Privacy knob turned back (disengaged) from inside. Lock initialized via the PP application. Lock was updated. Lock battery has reached 18% of usable capacity. Cleared state of Low Battery event. Update to reader firmware. Real-time clock updated. Automatic change to Unlocked mode denied since lock is in Blocked mode. Automatic change to First Card Unlock mode denied since lock is in Security (Emergency) mode. Lock radio module firmware updated. revision 2 27

28 1: Introduction With ILS offline locks, the reason for card rejection may be discovered by reading the lock with the Mobile Configurator, and then examining the readout either directly on the Mobile Configurator or at the computer. For instructions, refer to section Using the Mobile Configurator on page 45. In addition, audits can be requested from wireless locks from OnGuard. For more information, refer to Retrieve Events from Wireless Locks in the Alarm Monitoring User Guide. Micro-switches The lock uses micro-switches to detect different operations. Some microswitches are included on every lock, and some are only included as special options. The switches are listed as follows and notated as to whether they are Standard (S) or Optional (O): Card Insertion Micro-switch (S). This micro-switch is located within the card slot and is used to detect the presence of a card. (magnetic cards, only). Handle Micro-switch (S). This switch is located within the internal clutch mechanism and is used to detect the position of the inside and outside handle. Privacy Micro-switch (O). This switch is located on the inside subassembly below the battery pack and is used to indicate whether the privacy indicator is on or off. Mechanical Key Override Micro-switch (O). This switch is located within the internal clutch mechanism and is used to indicate the use of a mechanical key to open the lock. Connections Batteries and Privacy The ILS lockset is a self-contained unit that requires no wires to be pulled from a central processor or power supply for lock operation. The lock electronic module receives power from batteries located in the inside escutcheon. Also located in the inside escutcheon is the Privacy Micro-switch. The lock is connected to these items by a single 4-conductor wiring harness. This harness is attached to the outside escutcheon and plugs into CN1 on the inside subassembly. Mobile Configurator ILS offline and wireless locks require initial programming (Initialization), periodic updates, and a channel to retrieve the lock audit data. This may be accomplished by downloading the data from OnGuard to the Mobile 28 revision 2

29 ILS Lock Operation User Guide Configurator and then using the Mobile Configurator to perform the necessary programming or audit operation. The Mobile Configurator is connected to the lock by connecting the power adapter cable to the jack at the bottom of the lock. Note: After ILS wireless locks are initialized, most Mobile Configurator functions can then be performed wirelessly from OnGuard. ILS offline locks will always require the use of the Mobile Configurator for any updates or queries of the lock. Card Reader Technologies Based on the hardware configuration of the lock, OnGuard supports the card reader technologies described in this section. Note: ILS readers can be upgraded easily from one card reader technology to another. For instructions on upgrading the reader, refer Upgrade the Reader on page 103 and the ILS Lock Component Installation & Upgrade Guide. Magnetic iclass MIFARE 125 khz Prox The magnetic reader uses secure proprietary encoding that is stored on track 3. This 13.56MHz contactless, smart card reader supports CSN, A CSN, the HID access control application, and the Lenel access control application on 2k, 16k, and 32k iclass credentials. (Depending on your version of OnGuard, this card technology may not be available.) The MIFARE 13.56MHz contactless, smart card reader supports14443 A CSN and the Lenel access control application on MIFARE Classic 1K and 4K credentials. This 125 khz proximity reader supports HID Prox, AWID Prox, and Lenel proximity credentials. revision 2 29

30 1: Introduction Lockcases Mortise with Deadbolt Mortise, Latch Only This is a UL approved, ANSI Grade 1 standard full mortise lock with a 1 deadbolt. A unique feature of the deadbolt is that it can be projected from either inside or outside by lifting the handle. Projection from the outside requires a valid card. When the deadbolt is projected, a micro-switch signals this condition to the micro-processor. The deadbolt may be retracted by using the inside handle upon exit or the outside handle when a valid card is presented. ILS Integra CT30 locks are available with or without the deadbolt. This is a UL approved, ANSI standard mortise lock without a deadbolt. The privacy feature is not supported with this lockset. Heavy Duty Cylindrical Latch BLA This is a UL approved latch which installs in a standard prep for a cylindrical lock. Door thicknesses must be between 1-3/8 and 1-3/4. Latches are available for 2-3/8, 2-3/4, 3-3/4, and 5 backsets. Mortise with Deadbolt/AFC This is a UL approved, ANSI standard full mortise lock with a 1-inch 25.4 mm deadbolt. This lockcase contains a monitor switch which connects directly to the AFC lockset inside trim. The deadbolt is projected by use of a thumb turn from the interior. The deadbolt may be retracted by the inside handle upon exit or the outside handle when a valid card is presented. Mechanical Key Override Important: This feature is not intended for everyday use. The basic philosophies of a access control system are key control and security. Provision for the mechanical key override is intended for limited usage by emergency and maintenance personnel. It is the responsibility of the site to maintain key issuance records and key control if this feature is implemented. ILS locks offer the option of installing a mechanical key override in the lever. ILS locks currently support a 6-pin Schlage knob-lock cylinder that is supplied by the customer. Important: The mechanical key override should only be installed by qualified locksmiths. Before these cylinders can be used, the tail piece shipped with 30 revision 2

31 ILS Lock Operation User Guide the lock must be installed on the cylinder. For more information, refer to Appendix B: Install Mechanical Key Override in ILS Locks on page 113. When the cylinder is operated by a mechanical key, the outside handle is unlocked in the same manner that a card unlocks it. The lock will record the use of the key in the audit trail. Note: No cardholder data will be recorded in the audit trail when the key override is used. To operate the key cylinder, rotate the key in a clockwise direction 1/4 (onequarter) of a turn until it stops. Hold the key in this position, and then operate the handle. Release the key, return it to the original position, and then remove it from the cylinder. Warning ILS locking systems offer a high degree of security against surreptitious entry. Therefore the selection of the key cylinder hardware should include only high security cylinders that are resistant to picking and unauthorized key duplication. Failure to observe this rule will compromise the security of your lock system State Changes When the key is inserted in the lock, and turned to the unlocked position, the lock enters the Mechanical Key Override state and the Door Open by Key event is generated. During the Mechanical Key Override state, the lock continues normal operation according to its mode, scheduled automatic changes, commands from the Mobile Configurator, OnGuard, special purpose cards, lock owner cards, standard cards, and the privacy switch (deadbolt position) with the following exceptions: These events will be suppressed: Door Open From Inside Door Held Open Door Forced Open These events are replaced by the Access Granted event: Granted Access Entry Made Granted Access No Entry Made When the key is turned to the locked position, the lock exits the Mechanical Key Override state, an event is generated, and the lock continues normal operation according to its current mode. Note: When the key is turned to the locked position, the door needs to be closed within the Door Held Open time. If door remains open, the Door Held Open event will be generated. revision 2 31

32 1: Introduction Note: The mode of the lock may have changed during the Mechanical Key Override state. For example, if the lock is in the Mechanical Key Override state in the Card Only mode, and Latch monitoring is enabled. Alternative Fire Code (AFC) AFC is not a specific mode, but rather a set of configurable settings. These settings are used in countries such as Canada and Norway where the local fire code specifies that the lock must not lock automatically when the user enters or exits the room. Important: Be sure to check with the local authorities to verify if this option is allowed within your jurisdiction. Hardware AFC functionality is only available on locks specifically ordered for with this feature. The lockset used for AFC functionality utilizes a specific inside trim that includes a thumb turn. The mortise lockcase has a latch monitoring switch and detects when the door is opened. The circuit for this lock contains firmware specific to this functionality. AFC functionality, stated in the simplest terms, forces the trim to unlock any time the door is opened; the trim will not relock until the user takes a specific action to relock it, either by presenting a valid card (from outside the door) or by using the thumb turn (from inside the door). AFC Lock Settings The following describes how the lock will behave based on these AFC settings in System Administration (OnGuard): If Unlock when exit is enabled, the lock will not automatically lock the door after user exits the room. The user must use the authorized credential in order to lock the door. If Unlock when enter is enabled, the lock will not automatically lock the door after the user enters the room. If the door is unlocked, the door will relock after a specified amount of time as configured in the Relock timer field. If Relock on deadbolt is enabled, and the door is unlocked, the lock will relock the door if deadbolt is engaged. Note: If Relock on deadbolt is enabled, this does not alter the lock behavior associated with deadbolt monitoring. 32 revision 2

33 ILS Lock Operation User Guide Latch and Door Sensor Monitoring Latch or door sensor monitoring hardware must be present and monitored for the AFC settings to take effect. In order for lock to remain unlocked under AFC, the door must actually be opened (and remain open for specified period of time) first. In order for the Unlock on exit AFC function to take effect, the inside handle must be actuated followed by the latch or door sensor detecting the opening of the door. In order for the Unlock on enter AFC function to take effect, the door must be unlocked, then the outside handle must be actuated, following by the latch or door sensor detecting the opening of the door. Maintenance Clean the Reader Outer Cover The proper way to clean the outer surface of the reader is to use a wet cloth and simply wipe the dirt away. The use of solvents, thinners, polishes, or abrasive cleansers may damage the reader finish, and possibly the reader electronics and mechanical components. Some chemicals may weaken or damage the plastic reader housing. If the facility is to be pressure washed with a chemical agent, it is recommended that the reader be completely covered prior to this task, such that the chemical agents will not damage the reader. Clean the Magnetic Read Head (Magnetic Stripe Reader Only) The read head is the internal portion of the reader that reads the signal from a magnetic stripe card. To clean the read head, use a cleaning card made specifically for this purpose. Insert the cleaning card in the reader, and then remove the card. Repeat this process as necessary. This will remove dirt and minor oxidation from the surface of the read head, and improve performance. It is recommended the readers be cleaned as part of a regular maintenance cycle at least twice per year. If the area where the reader is installed is subject to extreme amounts of dust, humidity, or airborne debris, the reader may require cleaning more often. Door Position and Monitoring Door Sensor Contact Door contact hardware may be installed to report the open or closed position of the door. For ILS offline and wireless locks these door states are recorded in the lock audit trail. revision 2 33

34 1: Introduction For ILS wireless locks this information is reported directly to OnGuard. The door contact sensor connection accepts three (3) wire (C/NC/NO) door contacts. Latch Monitoring A mortise equipped with the latch monitor will be able to report that the latch has engaged and the door is secure. For ILS offline and wireless locks, this status is recorded in the lock audit trail. For ILS wireless locks this information is reported directly to OnGuard. Note: Latch monitoring within ILS is supported only when it is installed with a latch monitoring mortise. 34 revision 2

35 ILS Lock Operation User Guide Lock Operating Environment The lock operates with three (3) AA alkaline batteries. Operational parameters for AA alkaline batteries may vary. For more information, refer to the battery manufacture's standard for operating environment. The operating temperature of a lock equipped with a magnetic card reader is from -35 C to + 75 C. The operating temperature of a lock equipped an iclass reader is from -35 C to +65 C. Lock Certifications FCC part 15 RoHS CE UL10C IP46 iclass and 125Khz reader IP23 MAG readers Ontario Fire Code UL294 (pending) revision 2 35

36 1: Introduction 36 revision 2

37 ILS Lock Operation User Guide Chapter 2: System Commissioning Lock Installation Door Preparation For instructions to prepare doors and frames and the template on door preparation, refer to the template instructions specific to the type of lock you are installing. Instructions are provided specific to the type of lock purchased, either ANSI mortise, BLA, or reader (magnetic or iclass proximity). Important: Using an incorrect template can result in improper lock installation. For pre-existing locks, depending on the condition of the previous lock, cover plates and/or wrap plates may be required to cover the existing door preparation. Installation After the door has been properly prepped, the lock can be installed. Important: ILS locks should only be installed by technicians certified to install ILS locks. Wireless Radio and Reader Important: The batteries should not be installed into the lock until after all wiring connections have been done. The wireless radio module, readers, and rosette motor should all be connected before the batteries are installed. When you un-install these components, be sure to remove the batteries first. When installing iclass or proximity readers (locks), be sure to allow 30 seconds for the lock to power up. When installing the radio and reader, refer to the to the ILS Lock Component Installation & Upgrade Guide for proper installation practices and safety precautions. revision 2 37

38 2: System Commissioning Test the Locks After you have connected all of the components and installed the batteries, test the lock for proper operation. To verify proper lock operation, present an ILS construction card to the lock. For more information, refer to Construction Cards on page 13. The reader LED indication should turn green, the lock motor should actuate, and the motor actuation should be audible and distinctive. Make sure you can hear the motor actuate as this allows the handle to turn and engage the latch. Lock Commissioning Wireless Gateway For ILS wireless locks, the wireless access points should be installed and commissioned using the instructions in Commission the ILS Wireless Gateway on page 86. After the Wireless Gateway is installed and commissioned, you can add the Wireless Gateway to the OnGuard database. Important: In order to preserve battery life, download the initial full lock configuration from OnGuard via the Mobile Configurator. Verifying all cardholders and access levels assigned to the lock prior to bringing the lock online will prevent lengthy downloads to the locks as the system is being brought online. This may also result in higher than normal battery drain in the initial stages of use. Assign the Locks Locks can be assigned to either a Wireless Gateway for the ILS wireless locks or to an offline Mobile Configurator for the ILS offline locks. All ILS locks should be configured in System Administration (OnGuard) with the following minimal settings prior to downloading to the lock. Lock name Reader type Card formats Cardholders Access levels Lock heartbeat (ILS wireless locks, only) For ILS offline locks, all information is mandatory in order to ensure proper lock operation and cardholder experience. 38 revision 2

39 ILS Lock Operation User Guide Initialize the Locks Refer to Using the Mobile Configurator on page 45 for instructions on downloading the database to the Mobile Configurator and lock initialization. After being initialized, the locks will join the associated Wireless Gateway. If the join process does not occur, and locks are not visible within OnGuard, refer to the section for Troubleshooting on page 97. revision 2 39

40 2: System Commissioning 40 revision 2

41 ILS Lock Operation User Guide Chapter 3: Mobile Configurator Description The Mobile Configurator (MC) is the portable communication device used to transfer data between the OnGuard computer and the electronic lock. The Mobile Configurator is a maintenance and security tool that provides lock diagnostics and on-screen lock audit trail data. Use the Mobile Configurator to initially program all of the ILS offline and ILS wireless locks with a lock ID (Record number), clock time, and locking plans. The Mobile Configurator application runs on Microsoft Windows Mobile 5.0 or later. Note: Make sure to download and install the latest Windows Mobile Device Center Driver Update from the Microsoft web site. The Mobile Configurator supports: 300 doors 100 ILS offline lock operators with unique passwords 1000 events per lock 5000 PP (Portable Programmer) events Languages: English, French and Spanish 29 revision 2 41

42 3: Mobile Configurator Main Components Connectors For basic Mobile Configurator features and connections, refer to the Motorola MC70 User Guide. Power Adapter The power adapter is used to physically connect the Mobile Configurator to the lock. The Mobile Configurator communicates to the adapter via the serial port and the adapter plugs into the jack at the bottom of the keypad on the locks. The power adapter uses a Motorola MC70 serial cable to connect to the Mobile Configurator and a 2-wire communicator to connect to the lock. The power adapter requires three (3) AA batteries to power up the lock when the lock battery is very low or has no power. Connections To the Lock The Mobile Configurator communicates with the lock serially using the Motorola MC70 pre-wired connector plug. To connect the Mobile Configurator to the lock, complete the following steps: 1. Insert the power adapter plug into the jack on the bottom of the lock. Ensure the power adapter is connected to the Mobile Configurator. 2. Power on the Mobile Configurator and the power adapter, and then log onto the Mobile Configurator application. 3. Select the appropriate menu option. For more information, refer to Operator Logon on page revision 2

43 ILS Lock Operation User Guide To the Computer where OnGuard is Running The workstation running OnGuard must be installed with Active Sync version 4.0 which acts as communication interface between the computer and the Mobile Configurator. For the computer system requirements, refer to the Installation Guide. All data files are transferred from the computer to the Mobile Configurator, and vice versa, using Active Sync. For information on installing Active Sync, refer to the Motorola MC70 User Guide. Setup and Configuration Complete the instructions provided in your Mobile Configurator guide to configure the operating system and initialization settings. The following three (3) Mobile Configurator setup files are provided on the installation disc in the PP Application folder: Two (2) of the files have names beginning with sqlce30. These are the database files. One (1) of the files has a name that begins with PPApp. To install these files, complete the following steps: 1. Copy the files into the synchronization folder of your Mobile Configurator using the ActiveSync application. Important: Wait for ActiveSync to sync the files to the Mobile Configurator. 2. Click on the sqlce30 files to install the database. 3. When the database installation is completed, click on the PPApp file to install the Mobile Configurator application. You are now ready to download the lock configuration files from OnGuard. revision 2 43

44 3: Mobile Configurator Download the Lock Configuration File to the Mobile Configurator OnGuard generates a PP application configuration data file containing the lock parameters. When a new lock configuration file has to be loaded to the Mobile Configurator, complete the following steps: 1. Connect the Mobile Configurator to a vacant USB port at a workstation where Microsoft ActiveSync, OnGuard, and Communication Server are running. Important: If you are using the Mobile Configurator with OnGuard on a Windows XP or Windows 2003 system, the Communication Server must be run as an application. 2. Perform the appropriate steps in OnGuard to download and transfer the PPdata.txt file into the My Document folder (\My Document) on the Mobile Configurator. Upload the Mobile Configurator Lock Audits File to OnGuard When the Mobile Configurator lock operator executes the Upload operation, the Mobile Configurator application generates the PP and lock audits file in its My Document folder (\My Document). OnGuard automatically reads the audit file from the Mobile Configurator when it is connected to workstation running Communication Server. The files created on the Mobile Configurator are uploaded to OnGuard including: PPAudits.txt. This is the PP (Portable Programmer) audit file containing the Mobile Configurator events. LockAudits.txt. This is the lock audit file containing the lock events. OnGuard deletes these files from the Mobile Configurator when the upload operation successfully completes in order to avoid the possibility of reading the same audit files again. For more information about downloading or uploading from the Mobile Configurator, refer to the System Administration User Guide. Lock Operators Each lock operator can operate the Mobile Configurator application depending on the privileges specified for that operator in OnGuard. Operator Logon When the PP data has been copied to the Mobile Configurator, start the PP Application (ILSPPApp) on the Mobile Configurator. If you are starting the 44 revision 2

45 ILS Lock Operation User Guide application for the first time, or after the data has been deleted, you must enter the unlock password into the system. The unlock password is ilsppapp. Note: This is an additional security measure in case your Mobile Configurator is lost or stolen. The operator password is also required before the system can be used. After entering the unlock password, the operator must enter their user name and password. This user name is configured in OnGuard. For more information, refer to the System Administration User Guide to assign Mobile Configurator operators, passwords, and privileges. If invalid operator logon information is entered a number of times, the software will deactivate itself and erase all data other than the PP database. If this occurs, a new PPData.txt file must be loaded onto the Mobile Configurator before another logon attempt can be made. Using the Mobile Configurator After logging onto the Mobile Configurator, select from the following menu options by using the touch screen to highlight the desired function: Initialize on page 46 Update Lock on page 47 Change Lock Mode on page 48 Check Lock Mode on page 48 Tests and Diagnostics on page 48 View Lock Information on page 49 Read Lock Audits (Events) on page 50 Audits (Events) Menu Options on page 50 Read Lock Audits on page 51 revision 2 45

46 3: Mobile Configurator Initialize View Lock Audits on page 51 Open Lock on page 54 Power Up on page 54 Firmware Upgrade on page 55 Network Join (ILS Wireless Lock Only) on page 55 Send Heartbeats (ILS Wireless Locks Only) on page 55 The lock can only be initialized when it is in factory mode. If the lock is in standard mode, it must be reset to factory mode. For more information, refer to Reset the Lock to Factory Configuration Mode on page 14. After it is initialized, all factory mode settings will be erased. During the initialization process, a new System code and Lock ID (Record number) are written in the lock followed by the lock configuration parameters. To initialize a lock, complete the following steps: 1. From OnGuard, download the required information to the Mobile Configurator. For more information, refer to the System Administration User Guide. Disconnect the Mobile Configurator and take it to the lock that needs to be initialized. 2. Connect the power adapter to the lock by inserting the plug into the jack on the bottom of the lock. Ensure the power adapter is connected to the Mobile Configurator. 3. Power on the Mobile Configurator and the power adapter, and then log onto the Mobile Configurator application. For more information, refer to Operator Logon on page Select Initialize from the Lock menu. The Initialize option is used to program the locks when they are first installed on the doors or when system settings have changed in OnGuard. During this process, the Mobile Configurator will download the lock identifier and system data, as well as the cardholder information, and time data. 5. All locks loaded into the Mobile Configurator will be displayed in the list; use the cursor keys to scroll through the list. Locks that have been initialized 46 revision 2

47 ILS Lock Operation User Guide or updated display with a check mark. Select the appropriate lock from the list, and then press <Enter>. When the data has been transferred to the lock, a message will be displayed confirming the lock was initialized successfully. Important: Ensure you select the correct lock name from the list because the Mobile Configurator will then assign this name to the lock. Failure to select the correct lock name may result in unauthorized personnel having access to this area. Update Lock The Update Lock function is used when changes have been made to the locking plan, the real-time clock (RTC) needs adjusting, or any other settings have changed which need to be communicated to the lock. This feature is different from the Initialize function in that it does not set the Lock ID (Record number), but reads the ID from the lock, and then loads the relevant information. 1. Connect the Mobile Configurator to a vacant USB port at a workstation where OnGuard is running. 2. Download the lock data from OnGuard to the Mobile Configurator. For more information, refer to the System Administration User Guide. 3. When the download is completed, disconnect the Mobile Configurator and take it to the lock you want to update. 4. Connect the power adapter to the lock by inserting the plug into the jack on the bottom of the lock. Ensure the adapter is connected to the Mobile Configurator. For more information, refer to Using the Mobile Configurator on page Power on the Mobile Configurator and the power adapter, and then log onto the Mobile Configurator application. For more information, refer to Operator Logon on page Select Update from the Lock menu, and then click [Update]. 7. Disconnect the power adapter, and power off the power adapter and the Mobile Configurator. revision 2 47

48 3: Mobile Configurator Change Lock Mode The Mobile Configurator allows the lock operator to change the mode of the lock. From the Lock menu, select Change Mode. On the Change Lock Mode window, select the mode of operation, and then click [Change]. Available lock operation modes include the following: Unlocked First Card Unlock Card Only Blocked Mode Facility Code Only Secured Unsecured Check Lock Mode The Mobile Configurator application can display the current operational mode of the lock. From the Lock menu, select Change Mode. On the Change Lock Mode window, click [Check]. Tests and Diagnostics The Mobile Configurator application allows you to perform several tests and diagnostics on the lock. System code and Lock ID validation is not available. Prerequisite: Before running the tests, connect the power adapter to the lock. Battery Level. Use the Mobile Configurator to test the battery level of the lock. To run this test: Connect the power adapter to the lock. Select Battery Level from the menu. Click [Test Battery]. The Mobile Configurator will run the battery test and display the results. When the battery level is 18% or less, you should replace the batteries. LED. From the Lock menu, select Tests > LED. On the LED Test window, select Red LED or Green LED radio button, and then click [Test] to start the LED test. 48 revision 2

49 ILS Lock Operation User Guide Buzzer. From the Lock menu, select Tests > Buzzer. On the Buzzer Test window, select the High Beep or Low Beep radio button, and then click [Test] to start the Buzzer test. Note: Magnetic card readers do not support the buzzer test. Switch Test. From the Lock menu, select Tests > Switch. From the Switch Test window, click [Test] to start the switch tests. The ILS lock has several switches that are used in their operation. These switches should be tested periodically to ensure proper function. To test the switches, connect the power adapter to the lock, and then select Switch Test from the menu. Choose from the following switch tests: Card - This test is used for locks with magnetic readers, only. Test by inserting a card. Latch Monitor - This test is used for ANSI Mortise units that have the latch monitoring feature. To test, press the latch monitor on the side of the mortise. Handle - Test this switch by turning the inside lever on the lock. Privacy - Test this switch is tested by turning the thumb turn on the inside trim if applicable. For more information, refer to Privacy (Monitor Deadbolt) on page 18. Clear - Test this switch by pressing the CLEAR button on the circuit board of the lock. Typically, this test is not required after the lock is installed and working. Key Override - Used to test the functionality of the key override switch if applicable to your installation. To test this switch, engage the key override to make the button available. For more information, refer to Mechanical Key Override on page 30. Door Sensor - This tests the magnetic sensor between the door and the frame. To test this, you must close and open the door. View Lock Information The View Info option displays the lock information. Ensure the power adapter is connected to the lock and then power on the Mobile Configurator. From the Lock revision 2 49

50 3: Mobile Configurator menu, select Tests > View Info. On the View Lock Info window, click [View Info]. Lock information includes: Manufacturing date and time Lock ID Firmware Version Hardware Version Serial No - serial number of the circuit board Lock Name Read Lock Audits (Events) The Mobile Configurator communicates with the lock and gets the lock audit trail (lock events). At the end of data transfer, the Mobile Configurator application updates the RTC of the lock. Audits (Events) Menu Options Use the Audits menu options to read the lock or Mobile Configurator events, view the collected lock or Mobile Configurator events, and upload the events to OnGuard. 50 revision 2

51 ILS Lock Operation User Guide Read Lock Audits To read the events at the lock or wall reader, connect the power adapter to the lock, power on the Mobile Configurator. From the Audits menu, select Read Audits, and then click [Read] to perform the operation. When read audits operation is completed, you can view the lock events on the Mobile Configurator or upload the events from the Mobile Configurator to OnGuard. View Lock Audits This option allows for fast viewing of the events that have been read from the lock directly onto the Mobile Configurator. From the Audits menu, select View revision 2 51

52 3: Mobile Configurator Audits > View Lock Audit Filter. You can filter the date range to show only the lock events for the period of time you want to view. Click [View Audits] to perform the operation. View PP (Mobile Configurator) Audits After the audits are read, use the View Lock Audit option to fast view the Mobile Configurator events that have been collected from the lock directly onto the Mobile Configurator. From the Audits menu, select View Audits > View PP 52 revision 2

53 ILS Lock Operation User Guide Audits. You can filter the date range to show only the Mobile Configurator events for the period of time you want to view. Upload Lock Audits From the Audits > Upload Audits menu, select Upload Lock Audits. Click [Upload] to perform the operation. Upload PP Audits From the Audits > Upload Audits menu, select Upload PP Audits. Click [Upload] to perform the operation. revision 2 53

54 3: Mobile Configurator Open Lock The Mobile Configurator is able to open the lock from outside in case there is a low battery or battery dead condition. Power Up The Mobile Configurator is able to power up the lock from outside in case there is a low battery or battery dead condition. 54 revision 2

55 ILS Lock Operation User Guide Firmware Upgrade You can use the Mobile Configurator to upgrade the lock firmware. 1. Select the Device Type (ACU, MIFARE, ICLASS, AWID, or WLM). For more information, refer to Card Reader Technologies on page Click [Browse] to navigate to the firmware file you want to download. 3. Click [Upgrade]. Lock information When this option is selected, the Mobile Configurator reads the number of cardholders stored in the lock, the firmware version of the ACU, and the current date and time of the lock. Read Openings Update RTC The Production test key will be read from the lock and displayed on the Mobile Configurator. Network Join (ILS Wireless Lock Only) The Network Join option sends the command to the radio module of the ILS wireless lock signaling the radio module to join its associated Wireless Gateway. For more information, refer to Network Join on page From the Tools menu, select WLM Diagnostics > Network Join. 2. Click [Join]. Send Heartbeats (ILS Wireless Locks Only) When the heartbeat command is issued by the lock operator, the application communicates with the lock and sends the command to lock. After successful communication with the lock, a message is displayed on the Mobile Configurator, communication with lock is ended, and a Mobile Configurator event is recorded. revision 2 55

56 3: Mobile Configurator If there is any communication error before the end of the operation, or the configurable timeout period occurs, the Mobile Configurator will display an error message. For more information, refer to Lock Heartbeat on page 56. Mobile Configurator Maintenance For information on maintaining the Mobile Configurator, refer to the Mobile Configurator owner s manual. Wireless Functionality Wireless Connectivity The ILS wireless lock can operate and communicate back to the OnGuard system wirelessly. Wireless communication to the OnGuard requires an ILS Wireless Gateway, also know as the Wireless Gateway, and an ILS lock equipped with an ILS 900 MHz radio module. Main Components Description Lock Radio Lock Radio Wireless Gateways: Wireless Access Point (Ethernet 10/100) Wireless Access Point (Wi-Fi ) Power-over-Ethernet (PoE) Wireless Access Point (Ethernet 10/100)) A proprietary 900 MHz radio module is used to provide communication from the ILS wireless lock through the Wireless Gateway to the OnGuard. Installation For more information on the installation the wireless lock radio, refer to section Upgrade/Replace the Radio on page 103 or refer to the ILS Lock Component Installation & Upgrade Guide. Lock Heartbeat A lock heartbeat is the amount of time each lock remains in non-host communication. During this time the lock ACU does not receive updates from OnGuard. After the lock heartbeat interval elapses, the lock radio will wake up and poll the Wireless Gateway for any updates. If updates are present, the information is transferred to the lock ACU and stored. 56 revision 2

57 ILS Lock Operation User Guide Each heartbeat of the lock is configurable on a per-lock basis in OnGuard and can be selected from 1 minute to 24 hours. Note: Optimum heartbeat time has been established to be approximately five (5) minutes providing maximum battery life, quick response, and updates to the locks. For more information on configuring the lock heartbeat, refer to the System Administration User Guide. Wireless Connectivity Prior to each lock radio joining the network, the wireless access points must be commissioned and configured. For more information, refer to Wireless Gateway on page 83. Network Join After the lock data has been downloaded to each Wireless Gateway, all locks can be initialized via the Mobile Configurator (if not done so previously) with the appropriate Lock ID (Record number). Each lock must then be commanded to join the Wireless Gateway it has been assigned to using the Network Join command. The Network Join command can be sent by performing any of the following actions: 1. From the Mobile Configurator, send the Network Join command to lock. For more information, refer to Network Join (ILS Wireless Lock Only) on page Present the Network Join card. 3. Press the Reset button on the lock radio unit for approximately three (3) seconds. 4. Perform a Power Cycle/Reset. Note: Power Cycle/Reset occurs when the lock power source is removed and then replaced. Visual Feedback Successful Join Visual feedback indicating a successful join to the network is provided to the user in the following location: On the inside trim, the radio module - flashing green LED. The inside trim must be removed for these LEDs to be visible. Failed Join Visual feedback indicating a successful join to the network is provided to the user in the following location: revision 2 57

58 3: Mobile Configurator On the inside trim, the radio module - flashing red LED. The inside trim must be removed for these lights to be visible. Connectivity Loss The lock may use communication to the access point due to the Wireless Gateway going offline. The Wireless Gateway going offline may be caused by an extended power loss to the access point or some other issue. The lock will attempt to rejoin the wireless access point for a period of two (2) heartbeat cycles. If the lock is unsuccessful in rejoining its wireless access point, the lock will enter the offline state. After the wireless access point has been restored, the lock must rejoin the network via the actions described in Network Join on page 57. Poor/No Connectivity A RF site survey should be performed prior to the installation of the wireless access point to verify its connectivity level to each lock position. The survey should confirm the ability of each lock radio, in its install position, to join the wireless access point. If the lock radio continues to experience poor or no connectivity, you may need to install and test an additional wireless access point to improve the network connectivity of each radio. 58 revision 2

59 ILS Lock Operation User Guide ILS Wireless Lock Radio LED Indications The ILS wireless lock radio has two (2) LEDs that are used for indicating the joining status: LED 1 is located next to the 8-pin connector J4 on the antenna side of the board. LED 2 is located next to the push button SW 1 on the antenna side of the board. ILS Wireless Lock Radio LED Indicators Description Only Occurs If Wireless Gateway is Found LED 1 LED 2 Lock Front LED Lock radio is searching for a Wireless Gateway. Lock radio was able to find its associated Wireless Gateway. Flashes ORANGE GREEN RED RED Lock radio was unable to find its associated Wireless Gateway. RED RED Flashes RED. This indication occurs if the lock radio is unable to find a Wireless Gateway on any of the 26 RF channels. Prior to this, lock radio LED 1 will have flashed ORANGE approximately 55 times. Lock radio and Wireless Gateway link quality is good. Lock radio and Wireless Gateway cannot establish link quality. GREEN RED Flashes GREEN Flashes RED Join was successful. GREEN Stays ON for approximately 3 seconds, and then turns OFF. GREEN Stays ON for approximately 3 seconds, and then turns OFF. Flashes GREEN indicating Join success. revision 2 59

60 3: Mobile Configurator ILS Wireless Lock Radio LED Indicators Description Only Occurs If Wireless Gateway is Found LED 1 LED 2 Lock Front LED Join failed - Poor RF quality. RED Stays ON for approximately 3 seconds, and then turns OFF. RED Stays ON for approximately 3 seconds, and then turns OFF. Flashes RED indicating Join failure. Wireless Features All ILS Mobile Configurator functions can be performed from OnGuard with the addition of a Wireless Gateway and a lock radio. Each lock must have its own wireless radio installed to communicate with OnGuard via the Wireless Gateway. Each Wireless Gateway supports up to 32 locks equipped with a wireless radio. For the Mobile Configurator functionality available through wireless connectivity, refer to Using the Mobile Configurator on page revision 2

61 ILS Lock Operation User Guide Chapter 4: Site Planning for a Wireless Installation This section provides guidelines for planning the installation of ILS wireless components on a site. For more information, refer to ILS Wireless Components Overview on page 62. It outlines a step-by-step procedure for site planning, giving you pointers on how to determine the number of Wireless Gateways required, and where to locate them, to yield adequate wireless coverage to the desired areas on a site. 1. Obtain a Floor Plan on page Identify the Wireless Lock Locations on page Determine Potential Wireless Gateway Locations on page 63. a. Power and TCP/IP Network Access for the Wireless Gateway on page 64. b. Mounting Feasibility on page 64. c. Wireless Gateway Antenna Orientation on page 64. d. Wireless Gateway Mounting Height on page 65. e. Relative Positioning of a Wireless Gateway and Its Locks on page Perform the Site Survey on page 77. a. Visual Inspection of the Site on page 77. b. Scan the RF Spectrum on the Site on page 78. When the determining the location of the Wireless Gateway and its locks, several other factors should be considered: Basic Propagation Mechanisms on page 69 Multipath Fading on page 71 ILS Wireless Range Inside Buildings on page 72 Impact of Obstructions on page 75 In addition, specialized tools may be used during the site survey to identify any sources of RF interference on the site. For more information, refer to Scan the RF Spectrum on the Site on page 78. Finally, information is provided for choosing the RF-related configuration settings such as the ILS Wireless Channel Plan table on page 79. revision 2 61

62 4: Site Planning for a Wireless Installation ILS Wireless Components Overview 62 revision 2

63 ILS Lock Operation User Guide Installation Planning The objective of RF installation planning is to arrive at a preliminary ILS wireless network layout for the site. The preliminary layout should provide the following information: Areas on the site where you want wireless coverage Number of Wireless Gateways required to provide the wireless coverage Placement of Wireless Gateways to facilitate the wireless coverage Mapping between the wireless locks and Wireless Gateways Wireless configuration settings The preliminary layout can then be used for either of the following: Quoting an ILS wireless installation job As a baseline for the actual installation of an ILS wireless system Obtain a Floor Plan The first step in planning the installation is to obtain a copy of the site floor plan. A good floor plan is: Drawn to a known scale. Depicts position of rooms, hallways, stairwells, etc. Identifies equipment rooms, elevator hoists, IT closets, steel doors, firewalls, and HVAC ducts. Specifies wall finishes and composition. Note: If a detailed floor plan is not available for the site, you can use a copy of the site fire escape plan; many commercial building have these. Expand the fire escape plan by filling in the details described here for a good floor plan. Identify the Wireless Lock Locations On the floor plan, mark all doors where the ILS wireless locks are to be installed, including doors which can potentially be upgraded to wireless locks at a later stage. These identified locations define the desired coverage area for low-power wireless communication. Determine Potential Wireless Gateway Locations To facilitate the desired wireless coverage to the locks, as identified in the previous step, determine the Wireless Gateway locations based on the following factors: Power and TCP/IP Network Access for the Wireless Gateway on page 64 Mounting Feasibility on page 64 Relative Positioning of a Wireless Gateway and Its Locks on page 67 ILS Wireless Range Estimates on page 72 revision 2 63

64 4: Site Planning for a Wireless Installation Power and TCP/IP Network Access for the Wireless Gateway ILS Wireless Gateways are available in three (3) variations and, depending the on the Wireless Gateway type, the following should be ensured: Ethernet Wireless Gateway: Ensure that both Ethernet and AC power outlets are accessible. PoE Wireless Gateway: Ensure that a PoE compliant network outlet is accessible. The PoE Wireless Gateway derives power from a PoE outlet, so there is no need for a separate power wiring. Wi-Fi Wireless Gateway: Ensure there is Wi-Fi infrastructure on the site and AC power outlets. Mounting Feasibility Wireless Gateways are designed such that they can be mounted either on a ceiling, wall, or vertical post. However, the selected Wireless Gateway locations should allow for the mounting of Wireless Gateways such that the Wireless Gateway antennae are clear of metal obstructions near-by. If a particular building code mandates protective enclosure (such as NEMA enclosures) for electronic equipment, make sure that Wireless Gateway antennae are fully exposed. Preferably, a Wireless Gateway antenna should be in the line of sight of as many associated doors as possible. Wireless Gateway Antenna Orientation Antenna orientation determines the polarization of radio waves. Polarization refers to the direction of the electric field, and is an important characteristic that affects the signal reception. In case of ILS wireless components, polarization is simply the orientation of the antenna whip. An antenna whip that is perpendicular to the earth s surface produces vertically polarized waves. In order to achieve maximum range the transmitter and receiver antennas should be oriented with the same polarization. If they are not oriented in the same polarization, a certain amount of power is lost due to this mismatch. The radio module on an ILS wireless lock is mounted with fixed vertical polarization. Therefore, to achieve maximum range between wireless locks and a Wireless Gateway, the antenna on the Wireless Gateway should always be positioned such that it is perpendicular to the earth s surface. Wireless Gateways come equipped with a ½-wave dipole antennae with articulating base. This allows the antenna to tilt 90º and rotate 360º. Because of this feature, a Wireless Gateway can be mounted with the optimal antenna orientation (vertical) on a wall, ceiling, or vertical post. Wireless Gateways mounted just below ceiling girders or just above a drop ceiling, with antenna protruding outside the drop ceiling, usually provide the best coverage. 64 revision 2

65 ILS Lock Operation User Guide Ceiling-mounted Wireless Gateway Wall-mounted Wireless Gateway Wireless Gateway Mounting Height The Wireless Gateway mounted on the ceiling, with vertically oriented antenna visible from associated locks is an ideal Wireless Gateway placement. However this may not always be feasible. If a Wireless Gateway needs to be mounted on a wall, special attention should be paid to mounting height, the higher the height of a wall mounted Wireless Gateway the better. A Wireless Gateway mounted at a higher elevation would have longer line-of-sight distance, and reduced effects of obstructions on the floor, resulting better wireless coverage. An exception to the recommendation is a building with a very high ceiling. In such buildings, Wireless Gateway elevation should not exceed feet. revision 2 65

66 4: Site Planning for a Wireless Installation Otherwise, if the Wireless Gateway elevation is too high, it may cause higher free space propagation loss, which in turn may degrade the overall wireless coverage. At the minimum, a wall mounted Wireless Gateway should be at an elevation higher than that of locks on the same floor. 66 revision 2

67 ILS Lock Operation User Guide Relative Positioning of a Wireless Gateway and Its Locks Wireless Gateways come equipped with Omni-directional antennae. This means the antenna radiates RF signals with equal gain in all directions. The following diagram shows the radiation pattern of an Omni-directional antenna: Due to the Omni-directional radiation pattern, it is preferable to place the Wireless Gateway in the middle of its associated locks to maximize the usage of the available wireless coverage from a Wireless Gateway. For the same reason, placing a Wireless Gateway along an exterior wall is not preferred because a too much of the antenna energy will be radiated outside of the building. revision 2 67

68 4: Site Planning for a Wireless Installation Wireless Gateway Mounted in the Middle of the Associated Locks Wireless Gateway Mounted on an Exterior Wall 68 revision 2

69 ILS Lock Operation User Guide Estimating Wireless Range Achievable wireless range is the most important factor in determining Wireless Gateway locations. Even though the theoretical radiation pattern is Omnidirectional, the achievable range, in practice, in different directions will be different and will depend on manifold factors. Below are some of the factors that affect wireless range in indoor environments: Free-space propagation loss Attenuation due to building materials Attenuation due to occupants (transient) Multipath fading In-building wireless propagation is notoriously difficult to predict. Because of the above mentioned factors, every building presents a unique RF propagation environment, and the achievable wireless range can vary significantly from one building to another. The following subsection presents the guidelines that can be used for estimating the wireless range, for planning purposes, within a building for which a detailed floor plan is available. Note that the range estimates derived by the use of these guidelines are for planning purposes only and the actually range can vary widely from these estimates. Basic Propagation Mechanisms The following describes basic mechanism for radio wave propagation: Free-Space Propagation A fundamental model of radio wave propagation is the free-space propagation model, which is used to predict range when the transmitter and receiver have a clear, unobstructed line-of-sight path between them. According to free-space model, propagation loss is proportional to the square of the distance from the transmitter, and also to the square of the frequency of radio signal. Because ILS operates on MHz band, losses due to frequency will be same for the whole band. Satellite communication systems and microwave line-of-sight radio links typically undergo free-space propagation. The indoor radio propagation rarely follows the simple free-space model. The indoor propagation is impacted by three basic mechanisms: Reflection Reflection occurs when a propagating radio wave strikes upon an object which has very large dimensions, as compared to the wavelength (33cm for the ILS lock radios) of the propagating wave. Inside buildings reflection may occur from walls, floor, ceiling, doors, etc. Reflection is prominent from metallic materials as they reflect back all incident energy. Non-conducting materials reflect back revision 2 69

70 4: Site Planning for a Wireless Installation only part of the incident energy, absorb and dissipate (as heat) part of the energy, and transmit across the remaining energy. 70 revision 2

71 ILS Lock Operation User Guide Diffraction Diffraction occurs when the path between the transmitter and the receiver is obstructed by a sharp edge such as door edges. Diffraction (bending of wave) happens when a radio wave strikes the door surface edge. Scattering Scattering occurs when the medium through which the wave travels consists of objects with dimensions that are smaller compared to the wavelength of the propagating wave. Scattered waves are produced by small objects, rough edges, and other irregular obstructions. Multipath Fading In an indoor environment, all the above described mechanisms combine, in some form, with the free-space propagation and determine the overall propagation loss between the transmitter and receiver. The impact of different propagation mechanisms is that radio waves from the transmitter reach the receiver via multiple paths. These multiple RF signals then combine in the receiver antenna to produce the signal received and processed by revision 2 71

72 4: Site Planning for a Wireless Installation the receiver. The received signal strength varies from point to point because it depends on phases and amplitude of the arriving signals. Multipath fading is observed pre-dominantly in confined spaces with smooth metal walls and other reflective surfaces. Typical examples include small enclosed rooms, stairwell, underground pathways, and tunnels. The implication of multipath fading is that it may result in dead spots where signal is nonexistent. Also, these dead spots cannot be predicted by analyzing a detailed floor plan. However, during the actual installation, moving the Wireless Gateway only a few inches can change the reception from no signal to a full signal. ILS Wireless Range Inside Buildings ILS radios, on the lock and the Wireless Gateway, can be configured for one of the four available RF output power settings. The following table shows the range estimates for the different power levels. 10dBm setting is the default value and recommended power level for the lock radios, as it offers the best trade-off between battery life and wireless range. For the Wireless Gateway, the power level default is the maximum level, 15dBm because the Wireless Gateway does not operate on batteries. ILS Wireless Range Estimates RF Output Power Settings Open Space (line-of-sight) in Feet In-building (line-of-sight) in Feet 0 dbm dbm dbm dbm revision 2

73 ILS Lock Operation User Guide Note: These range estimates are theoretical and do not account for the complex propagation mechanisms discussed above. It is not possible to arrive at a single estimate for the indoor range while accounting for various propagation effects that are highly dependent upon the path between the transmitter and the receiver. Nonetheless, they provide decent baseline estimates for planning purposes. The potential Wireless Gateway mounting location should be inspected for accessibility in case of servicing. Important: The location of the Wireless Gateways and ILS wireless and offline locks should always be updated on the building and site floor plans. Examples follow of indoor range numbers for ILS wireless system in real world deployments: ILS range in hallways: With RF output power at the lock radio set to 10dBmand the building constructed of sheetrock with steel studs, the observed range was 92 feet. Refer to the diagram ILS Range in Hallways on page 74. ILS range with wall obstructions: With RF output power at the lock radio set to 10dBmand the building constructed of sheetrock with steel studs, the observed range with six (6) intervening walls was 54 feet. Refer to the diagram ILS Range with Wall Obstructions on page 74. revision 2 73

74 4: Site Planning for a Wireless Installation ILS Range in Hallways ILS Range with Wall Obstructions 74 revision 2

75 ILS Lock Operation User Guide Impact of Obstructions When a radio wave encounters an obstruction, part of its energy is absorbed by the obstruction, a portion of it is reflected back, and the remaining energy is allowed to pass thorough the obstruction. In effect, a radio signal gets attenuated by the obstruction. The level of the signal attenuation depends on the type and thickness of the material that obstructs the wave. Note: This document assumes that the obstructions extend up to a building's ceiling. The following table provides the amount of attenuation induced by different types and thicknesses of commonly used building materials. The attenuation caused by the obstructions will reduce the wireless range. A range reduction factor (F r ) is also included which can be multiplied with either the range observed in a corridor of the same building (if available) or the theoretical indoor range estimates given in the ILS Wireless Range Estimates table on page 72 to obtain the estimate of the range with obstructions. Attenuation Caused by Building Materials Obstruction Material (t) Thickness (mm) Attenuation (db) Range Reduction Factor (F r ) DryWall revision 2 75

76 4: Site Planning for a Wireless Installation Attenuation Caused by Building Materials Obstruction Material (t) Thickness (mm) Attenuation (db) Range Reduction Factor (F r ) Plywood dry Glass Lumber dry Brick Masonry block Plain concrete Reinforced concrete (1%) Non-reinforced concrete Reinforced concrete (2%) When there is more than one type of obstruction, and more than one obstruction of each type, use the following equation to obtain the estimate for range with obstructions: Where: R O is the estimated range with obstructions. 76 revision 2

77 ILS Lock Operation User Guide R NO is the range with no obstructions. This could either be a range estimate from the ILS Wireless Range Estimates table on page 72 or the measured range in a corridor of the same building. F r (ObsTyp t ) is the range reduction factor for the obstruction of type t. So if t is Drywall (16mm), then look up the range reduction factor (F r ) for Drywall (16mm), and then substitute this variable with that value. n t is the number of obstructions of type t. If there are 3 Drywalls (16mm), then n t for t = Drywall (16mm) will be 3. Obstructions to Avoid As seen in the Attenuation Caused by Building Materials table on page 75, the following types of obstructions cause significant signal attenuation: Masonry block Plain concrete Non-reinforced concrete Reinforced concrete (1%) Steel Important: Wherever possible, Wireless Gateway locations should be chosen such that the obstructions that present significant attenuation of signals do not fall in between the Wireless Gateway and its associated locks. It is important to avoid these obstructions whenever possible, not only because they unnecessarily dissipate a lot of RF energy, but also because the actual range in such situations can vary widely from the estimates. Perform the Site Survey After arriving at the preliminary network layout through the off-site installation planning, a site survey must be performed for fine tuning each Wireless Gateway's placement and wireless configuration settings. The following subsection outlines the steps that should be performed during the site survey. Visual Inspection of the Site Before proceeding with the RF spectrum scanning, visually inspect the site for validating the preliminary layout. Below are some of the considerations that should be made during the visual inspection: Walk through the building to take note of RF obstacles that are usually not depicted by floor plans. Below are some of the examples: Metal racks Filing cabinets revision 2 77

78 4: Site Planning for a Wireless Installation Metal partitions Refrigerators HVAC ducts Transformers and other heavy electrical equipment should be avoided altogether Inspect the potential Wireless Gateway mounting locations for accessibility. Update the preliminary network layout based on the findings from visual inspection. Scan the RF Spectrum on the Site For reliable operation of any kind of wireless system, RF interference from other external wireless systems should be avoided. It is therefore important to identify and locate other 900 MHz wireless systems operating on the site. The following includes examples of wireless devices that may interfere with ILS wireless operation: 900 MHz cordless phones 900 MHz wireless headsets - such as wireless headsets from Plantronics Fire and security alarm systems operating at 900 MHz band Wireless Meter Reading systems operating at 900 MHz band The following includes examples of wireless devices that do not interfere with the ILS wireless system: Microwave ovens operating at 2.4GH Wi-Fi network and access points operating at 2.4 GHz Cordless phones operating at 2.4 GHz and 5 GHz - Most of the cordless phones in use today. Security and fire detection systems operating at 315, 433 MHz - Many wireless fire and security systems operate at this frequency. Important: If Wi-Fi Wireless Gateways are used in the system, care must be taken to avoid interference from 2.4 GHz wireless devices. Wi-Fi Wireless Gateways operate at 2.4GHz. To find the channels occupied by other wireless systems, or any other RF interference that may be present, use a hand-held RF signal strength analyzer at 78 revision 2

79 ILS Lock Operation User Guide the site.the Protek 3290N is an example of a hand-held RF signal strength analyzer: Some of the key specifications for this analyzer include: Hand-held and battery operated 100 KHz MHz measurement range High sensitivity (-117dBm maximum) Detects wide-band and narrow-band FM, AM, and single side-band signals Detachable antenna The signal strength analyzer can be programmed to scan multiple channels at a time to detect the presence of an external RF device. For information on programming the analyzer to scan the ILS wireless channels for interference, refer to the analyzer s instruction manual. The following table presents the channel plan for the ILS wireless devices: ILS Wireless Channel Plan ISM Band Maximum RF output power Maximum duty cycle MHz 15 dbm No restriction 6 db BW > 500 KHz Baud rate 76 Kbps Channel spacing (KHz) 1000 revision 2 79

80 4: Site Planning for a Wireless Installation Frequency Band 902 MHz MHz Channel Center Frequency After programming the analyzer with the center frequencies for the ILS channels, the RF spectrum in the vicinity of all potential Wireless Gateway locations should be scanned for the presence of an interference. Channels on which the signal level is found to be above 70dB should be marked as occupied. 80 revision 2

81 ILS Lock Operation User Guide In the following example, a signal analyzer was used to detect RF interference. The red indicates the -75dBm interference threshold. Important: To avoid RF interference, the ILS Wireless Gateways should not use channels that are occupied. revision 2 81

82 4: Site Planning for a Wireless Installation 82 revision 2

83 ILS Lock Operation User Guide Chapter 5: Wireless Gateway Description In OnGuard, the ILS Wireless Gateway is treated as an access panel. The ILS Wireless Gateway is a special type of Wireless Access Point (WAP) used to facilitate communication between a wireless-enabled ILS lock and OnGuard. Communication from the Wireless Gateway is bi-directional as information is passed from the ILS lock through the Wireless Gateway to OnGuard and from OnGuard through the Wireless Gateway to the ILS lock. There are two (2) versions of the Wireless Gateway: Ethernet 10/100 Wi-Fi Each Wireless Gateway supports up to 32 ILS wireless locks. Support of 32 ILS wireless locks is dependent on the placement of the Wireless Gateway in relationship to the wireless lock and the building construction. revision 2 83

84 5: Wireless Gateway Wireless Gateway (Ethernet) The wireless Ethernet Wireless Gateway transfers TCP/IP packets to OnGuard on the network using wired (10/100 BaseT) communications Mhz antenna 2. Ethernet Wireless Access Point 3. 5V power cable Mhz antenna connection 5. OnGuard Communication - Wireless Gateway has established connection to OnGuard. 6. Wireless Network Traffic - Denotes data transfer to and from the lock and the Wireless Gateway. 7. Ethernet Traffic - Denotes data transfer to and from the Wireless Gateway and OnGuard. 8. Ethernet Link - Denotes Wireless Gateway connection to the network. 9. Power 10. Connection for 5V power 11. Connection for RS Connection for USB cable 13. Connection for Ethernet cable 84 revision 2

85 ILS Lock Operation User Guide Wireless Gateway (Wi-Fi) The wireless (Wi-Fi) Wireless Gateway transfers TCP/IP packets to OnGuard on the user's network using wireless (802.11b/g) communications Mhz antenna 2. Wi-Fi antenna 3. Wi-Fi wireless gateway 4. 5V power cable Mhz antenna connection 6. OnGuard communication a. Wireless Gateway has established connection to head end software 7. Wireless network traffic a. Denotes the data transfer to and from the lock and the Wireless Gateway 8. Wi-Fi Traffic a. Denotes the data transfer to and from the Wireless Gateway and OnGuard 9. Wi-Fi Link a. Denotes the Wireless Gateway connection to the network 10. Power 11. Connection for 5Vpower 12. Connection for RS Connection for USB cable 14. Wi-Fi antenna connection revision 2 85

86 5: Wireless Gateway Commission the ILS Wireless Gateway Each ILS Wireless Gateway ships from the factory with an installed SSL certificate and DHCP enabled. The Wireless Gateway must be commissioned with a unique IP address to allow OnGuard to configure the Wireless Gateway on the network. Commissioning of the Wireless Gateway requires the following components: Computer with terminal emulation software that can access the USB port Note: HyperTerminal is available with Windows Server 2003 or earlier. If you are using a later version of Windows, you can download a terminal emulation program. Free are available that emulate most common terminals. USB cable The proper serial port emulator (driver) - A serial port emulator (CDM20600.exe) is provided on the Supplemental Materials disc. Install the emulator to recognize the Wireless Gateway by mapping the USB connection to the USB serial port. Power supply to the Wireless Gateway (provided with the Wireless Gateway) Network connection to the Wireless Gateway Assign a Wireless Gateway IP Address All Wireless Gateways are shipped from the factory with DHCP enabled. Prerequisites: The method used to assign Wireless Gateway IP addresses depends on the type of network where the Wireless Gateway is being installed: If the network uses static IP addressing (non-dhcp), follow the instructions in Assign an IP Address (Wi-Fi and Ethernet) on page 87. If the network uses DHCP, follow the instructions in Automatic IP Address Assignment (Ethernet Only) on page 86. Automatic IP Address Assignment (Ethernet Only) 1. Contact your site network administrator to request a DHCP reservation based on each of the Wireless Gateway MAC addresses. The MAC address 86 revision 2

87 ILS Lock Operation User Guide is a 12-digit physical address on the label attached to the bottom of the Wireless Gateway. In this example: 00:40:9d:3c:54:7d Note: Compile a list of the each Wireless Gateway MAC address and its associated IP address assigned in the reservation. You will need this information in order to configure the IP address for each Wireless Gateway in OnGuard. 2. Install the Wireless Gateway by connecting the Wireless Gateway to the network using a standard Ethernet cable. 3. Apply power to the Wireless Gateway by connecting the power supply to the Wireless Gateway, and then plug the power supply into an AC outlet. The network will automatically assign the Wireless Gateway to the IP address. Assign an IP Address (Wi-Fi and Ethernet) Note: The Wireless Gateway can be installed in place prior to commissioning provided the power and the network connections are also installed, and the computer s USB connection can reach the Wireless Gateway at its installed location. Prerequisite: Each unit must be assigned an IP address. Assigning IP addresses requires a computer with HyperTerminal or other terminal emulation software. 1. Connect each Wireless Gateway to the network via the Ethernet cable. 2. Connect the Wireless Gateway to the configuring computer via USB connection. 3. Power on the Wireless Gateway. 4. Launch HyperTerminal. revision 2 87

88 5: Wireless Gateway 5. Assign a Name to the connection and then click [OK]. 6. Connect the Wireless Gateway to the computer or laptop using the USB cable. 7. Select the appropriate COM port. The COM port location can be determined from the computer s Device Manager. Click [OK]. 88 revision 2

89 ILS Lock Operation User Guide 8. Configure the COM port setting as shown: 9. From HyperTerminal, type ifconfig and then press <Enter>. The MAC address, IP Address, and gateway for the access point will be displayed. 10. Make a note of the IP address and location of the access point because you will need to configure these in OnGuard. 11. For Ethernet, only: Continue to the instructions in section Establish a Static IP Address (Ethernet Only) on page 89. Establish a Static IP Address (Ethernet Only) Static IP addressing is set up via HyperTerminal. Prerequisites: Ensure the serial port emulator (CDM20600) is installed. Contact the site network administrator and request DHCP reservations based on the Wireless Gateway MAC addresses as well as the network submask and gateway for the static IP addresses. revision 2 89

90 5: Wireless Gateway Note: Compile a list of the Wireless Gateway MAC addresses and their associated IP addresses assigned in the reservations. You will need this list to configure the IP address for each Wireless Gateway in OnGuard. 1. Start the Wireless Gateway. During Wireless Gateway startup, you will have approximately five (5) seconds to press any key, and then the program will guide you through a series of setup prompts to configure the device. 2. When the configuration is complete, disconnect from the Wireless Gateway. 3. Ping the unit from a network connected computer to verify that the Wireless Gateway is active with the assigned IP address. Lock Table (Data) After the Wireless Gateway have been commissioned in OnGuard, the associated locks can then be assigned to the Wireless Gateway. The associated locks are known as the Wireless Gateway lock table. Refer to the System Administration User Guide or online Help for the appropriate menu options to download the lock table data to each Wireless Gateway. Configure the Wi-Fi Wireless Gateway Prior to the configuration of the Wi-Fi Wireless Gateway, the following information must be identified by the site network administrator: Wireless IP address Wireless subnet mask Wireless IP address of default gateway Wireless country name configured is United States Wireless protocol mode is for access point (infrastructure) networks, only Wireless SSID Frequency band is band b, only Wireless channel is (search) Wireless transmit rate is 11 (Default) Wireless transmit power is 16dbm (Default) Wireless multi domain capability (802.11d) disabled (Default) Authentication type Hardware Parameters Serial channel baud rate: 9600 (Default) Board serial number (specific to the Wireless Gateway) 90 revision 2

91 ILS Lock Operation User Guide Board Wireless Gateway MAC Address (specific to the wireless access point) Start-up code: After the board is reset, the start-up code will be available in approximately five (5) seconds (Default) Connect Wi-Fi Wireless Gateway to the Computer via HyperTerminal 1. After the connections are made, re-start the Wireless Gateway by typing the following and then press <Enter>: reboot pwd=netsilicon Netsilicon is the initial password; it can be reset during the following configuration process. 2. After the system has started again, press any key to change the default settings. The current setting can either be accepted or modified. Press m to modify, and then press <Enter>. Press any key in 5 seconds to change these settings. Press A to Accept the settings, or M to Modify?m 3. Re-enter the password, and then choose to reconfigure the settings. Enter the root password: ******** Reset configuration to default values [N]? Y 4. The following message is then displayed in HyperTerminal. This allows the previously saved settings to remain in the Wireless Gateway configuration. For each of the following questions, you can press <Return> to select the value shown in the braces, or you can enter a new value. revision 2 91

92 5: Wireless Gateway 5. If you are assigning a static IP address, disable DHCP. WIRELESS INTERFACE SETTINGS: Obtain IP settings automatically using DHCP for WIFI interface [Y]? N 6. Input your IP address (if DHCP is disabled). 7. Enter the network Subnet mask. 8. Enter the network Gateway address. 9. MAC Address [assigned at the factory] - does not need an input. 10. Country name [United States]. 11. Network type: Network type [1]? 0 for any available wireless network 1 for access point (infrastructure) networks only 2 for peer-to-peer (ad hoc) networks only 3 do not join a BSS 4 start Wi-Fi Protected Setup 12. Enter the Network name (SSID). 13. Select the maximum transmit power [16dbm]. Maximum transmit power [16 dbm]? 0 for 16dbm 1 for 14dbm 2 for 12dbm 3 for 10dbm 4 for 8dbm 5 for 6dbm 14. Select the wireless authentication settings. Authentication type [4]? 0 for Any available authentication 1 for Shared Key 2 for WEP (802.1x) 3 for WPA Personal (WPA-PSK) 92 revision 2

93 ILS Lock Operation User Guide 4 for WPA Enterprise (802.1x) 5 for Cisco LEAP 6 for Open System 7 for Cisco EAP FAST 15. User name and password are required for WEP, WPA, Cisco LEAP, and Cisco EAP FAST: For WEP (802.1x), WPA (802.1x), Cisco LEAP and Cisco EAP FAST authentication: Username [no change]? Password [no change]? 16. Select wireless network encryption type. Encryption type [4]? 1 for WEP 2 for TKIP 3 for CCMP (AES) 4 for Open System (no encryption) 17. Serial port connection should remain at SERIAL CONSOLE PORT SETTINGS: Set the baud rate of the serial console port [9600]? 9600, 19200, 38400, 57600, The Wireless Gateway password can now be reset. This password is Wireless Gateway-specific, but can be assigned to multiple Wireless Gateways. SECURITY SETTINGS: Would you like to update the Root Password [N]? Lock Data 19. After the configuration is complete, the Wireless Gateway can be disconnected from the commissioning computer. In OnGuard, after the Wireless Gateway is configured, the OnGuard, the Wireless Gateway s associated locks are then assigned to the Wireless Gateway. revision 2 93

94 5: Wireless Gateway Refer to the System Administration User Guide or online help for the appropriate menu options to download the lock data to each Wireless Gateway. Wireless Gateway LEDs The Wireless Gateway unit has five (5) LEDs for user feedback. These LEDs provide the following information: OnGuard Connection. Connection to OnGuard is established. Wireless Network Traffic. Data transmission from the lock to its associated Wireless Gateway. Ethernet (or Wi-Fi) Traffic. Data transmission between the Wireless Gateway and OnGuard. Ethernet (or Wi-Fi) Link. Connection established to the network via either Ethernet or Wi-Fi. Power. Wireless Gateway Power Supply Both the wired and wireless access points operate on a single external 5V DC power supply. The Wireless Gateway has over-voltage protection up to 28V that prevents equipment damage if an incorrect power supply is used. In the event of a fault condition, the Wireless Gateway will be completely powered down. There will be no indication that the Wireless Gateway is in a fault condition other than it is non-functional. Wireless Gateway Certifications The Wireless Gateway device complies with part 15 of the FCC Rules. Its operation is subject to the following two conditions: (1) This device may not cause harmful interference, and (2) this device must accept any interference received, including interference that may cause undesired operation. FCC ID: R32-WLMWWM01 IC ID: 5059A-WLMWWM01 FCC part 15 UL 94 revision 2

95 ILS Lock Operation User Guide CSA RoHS CE ICES-001, CAN/CSA C108.6-M91 Wireless Gateway Environmental Requirements The Wireless Gateway shall adhere to following environmental requirements: Temperature: Operational: 0 C to 49 C Storage: -40 C to +70 C Humidity: Operational: 95% at 49 C Storage: 95% at 70 C Vibration: Operational: 2 Grms per 1 hr. on each axis Transportation: G2/Hz per 3 hrs on each axis Shock (if applicable): Operational: 10G Transportation: 100G revision 2 95

96 5: Wireless Gateway 96 revision 2

97 ILS Lock Operation User Guide Chapter 6: Troubleshooting Lock Troubleshooting Symptom Cause Action Lock LED is GREEN, but there is no motor activation. Lock LED is RED. Lock LED gives no indication. The motor is not connected to the lock control board. Invalid cardholder data. The cardholder is not in the lock database. The lock is not initialized. The lock batteries are exhausted. Lock is in the Security mode Check that the lock rosette cable is properly connected to the CN6 connection on the lock control board. Check the system settings for valid cardholder authorization, access level, timezone, and deactivate/activation dates. Verify that the lock has been initialized with the correct database and time. Verify that the lock has been initialized. Replace with new AA batteries. The lock may be in Secure mode; change the lock operation mode to Card Only. Mobile Configurator Troubleshooting Symptom Cause Action Mobile Configurator will not communicate with the lock. Database cannot be downloaded to the Mobile Configurator. OnGuard does not recognize the Mobile Configurator. Database cannot be loaded onto the Mobile Configurator. Lock communication timeout. Communication Server is not running as an application. Communication Server is not running as an application. ActiveSync is not installed/running. Mobile Configurator is not connected to the computer. Invalid CSV file. Verify that the power adapter is powered on. Check the power adapter batteries. Start the Communication Server. Start the Communication Server. Install Microsoft ActiveSync. Check the USB connection from the Mobile Configurator to the computer running Microsoft ActiveSync and Communication Server. Download the database to the Mobile Configurator from OnGuard Check for correct password ilsppapp and user name and password combination. revision 2 97

98 6: Troubleshooting Lock Join Troubleshooting Symptom Cause Action There is no LED activity on the radio module board. Lock is in the factory mode. Lock is not initialized properly. WLM-ACU identification may have failed. Initialize the lock using the Mobile Configurator. Initialize the lock using the Mobile Configurator following the specified procedure, and then wait for at least 20 seconds. Re-initiate the Join command using the Mobile Configurator or the Join card. Lock Communication Troubleshooting Symptom Cause Action Cannot find Wireless Gateway; LED 2 flashes approximately 50 times and both LEDs go solid RED. The lock drops offline and does not come back online on its own. There is a site ID mismatch. Wireless Gateway is offline. The Wireless Gateway lock table is out of date. The lock was unable to join after an ACU, WLM, or reader firmware upgrade. Ensure that the lock was initialized using a Mobile Configurator configured from the same OnGuard as the Wireless Gateway. Refer to Wireless Gateway Troubleshooting on page 98. Ensure that the Wireless Gateway is online and the Wireless Gateway status information is correct. Re-initiate the lock join operation. Verify the lock battery level using the Mobile Configurator. Replace the lock batteries. Wireless Gateway Troubleshooting Symptom Cause Action The Wireless Gateway is not properly powered. Network connection problem The power LED is off or blinking. Wi-Fi/Ethernet link LED is blinking. Check that the AC power supply is properly plugged in. Ensure that the network supports PoE for a PoE Wireless Gateway. Check that the Ethernet connection is properly plugged in. Check the Wi-Fi configurations at the router and the Wireless Gateway. Ensure the Wi-Fi access point supports IEEE b. Prerequisites: The following symptoms require the use of HyperTerminal or terminal emulation software as well as the ability to FTP onto the Wireless Gateway. Wireless Gateway does not remain connected to OnGuard; the connection is intermittent. Ensure the SSL communication is correct. Check network connectivity/speed/strength (Wi-Fi) If the SSL communication is incorrect, this problem will manifest itself in regularly scheduled connectivity interval of approximately every seconds showing online briefly. For more information, refer to the Knowledge Base article on setting up SSL. 98 revision 2

99 ILS Lock Operation User Guide Wireless Gateway Troubleshooting Symptom Cause Action The Wireless Gateway does not connect to OnGuard. The IP address is not correct. The network configuration is not correct. The Wireless Gateway is connecting to the wrong Wi-Fi network. The memory is corrupted. Wireless Gateways are configured for DHCP by default. Issue one of the following commands from the HyperTerminal connection to resolve: For Ethernet Wireless Gateways: setnetwork For Wi-Fi Wireless Gateways: setwireless This will report if DHCP is enabled or not, and also the current IP address. Verify the Wireless Gateway IP address with the Wireless Gateway IP address configured in OnGuard. If necessary, issue the command: setnetwork pwd=password dhcp=off In order to set a static IP address, complete the following steps: 1. Issue the command: setnetwork pwd=password ip=<your.ip.address.here> 2. After the IP address is set, start the Wireless Gateway again. <your.ip.addr.here> should display immediately after NETWORK INTERFACE PARAMETERS in the startup window in HyperTerminal. Specify the correct SSID in the configuration settings instead of Search. The Start window in the terminal emulation displays an indication that the application image has been corrupted: WAP_BACKUP_APPLICATION READY Contact Technical Support for further assistance. revision 2 99

100 6: Troubleshooting 100 revision 2

101 ILS Lock Operation User Guide Chapter 7: Hardware Upgrade Description Warning All individuals must take sufficient steps to reduce the possibility of ESD during installation, upgrade, and servicing of the ILS components. ILS locks are designed for quick and easy modification and upgrade. Depending on the current lock version, the ILS lock can be upgraded to or from any available ILS reader technology. Standard Door Preparation with Offline Lock Versions Current Lock Version Magnetic offline ILS Reader Technology After Upgrade iclass offline MIFARE offline eprox offline Magnetic online iclass online MIFARE online eprox online iclass offline Magnetic offline MIFARE offline eprox offline Magnetic online iclass online MIFARE online eprox online MIFARE offline (Depending on your version of OnGuard, this option may not be available.) Magnetic offline iclass offline eprox offline Magnetic online iclass online MIFARE online eprox online revision 2 101

102 7: Hardware Upgrade Standard Door Preparation with Offline Lock Versions Current Lock Version eprox offline ILS Reader Technology After Upgrade Magnetic offline iclass offline MIFARE offline Magnetic online iclass online MIFARE online eprox online Standard Door Preparation with Online Lock Versions Current Lock Version Magnetic online ILS Reader Technology After Upgrade iclass online MIFARE online eprox online iclass online Magnetic online MIFARE online eprox online MIFARE online (Depending on your version of OnGuard, this option may not be available.) eprox online Magnetic online iclass online eprox online Magnetic online iclass online MIFARE online Upgrade the Radio Offline ILS locks can be upgraded to wireless functionality with the addition of a radio module. A radio module upgrade kit is available that includes the following components: Wireless radio module Hybrid battery cover for the lock Mounting screws Connection cable 102 revision 2

103 ILS Lock Operation User Guide Note: The hybrid battery cover must be used in conjunction with the radio module for proper signal transmission to occur. Upgrade/Replace the Radio Prerequisites: Before you perform the lock radio upgrade, the Wireless Gateway that will communicate with the lock must be updated first by associating the lock ID (Record number) to the Wireless Gateway. For information about assigning the lock to the Wireless Gateway, refer to the System Administration User Guide. 1. Remove the existing battery cover. 2. Power down the lock by removing the three (3) AA batteries. 3. Position the radio module on the top bracket of the lock back plate. 4. Secure the radio module with two (2) screws. 5. Attach the connection cable to the radio module and the ACU control board. 6. Replace the three (3) AA batteries. a. After the batteries have been replaced, the lock will go through a power cycle in which the radio module will automatically attempt to join the wireless access point. b. Complete the steps in section Network Join on page 57. Upgrade the Reader When you replace or upgrade the reader head, power down the lock by removing the batteries. The lock configurations will remain in memory. Upgrade/Replace the Reader 1. (Optional) If the lock is equipped with a thumb turn, remove the thumb turn from inside of the lock. 2. Remove the top battery cover of the lock inside trim by removing the torx screw. 3. Remove the batteries. 4. Uninstall the two (2) screws from the reader. 5. Depress the ribbon cable connector to release the reader connector. Make sure to note how the cable is routed through the door interior. 6. Remove the old ILS reader and replace it with the new reader. Ensure the reader connection cable is rerouted properly as it was previously installed. 7. Reconnect the ribbon cable connection and secure them in place by properly closing the contacts. revision 2 103

104 7: Hardware Upgrade 8. Power the lock by replacing the batteries. The lock should automatically rejoin its Wireless Gateway after power up. For more information, refer to Network Join on page Replace the back cover and thumb turn. Replace the Wireless Gateway When you are replacing an existing ILS Wireless Gateway with a new one, follow the configuration process in section Commission the ILS Wireless Gateway on page 86. The Wireless Gateway ID should remain unchanged in OnGuard unless a new access point with new lock table is being installed. 1. Disconnect the power source of the existing Wireless Gateway. 2. The new Wireless Gateway should only be installed after it has been commissioned. 3. After Wireless Gateway has been installed, reconnect the power source. 4. All locks associated with the original Wireless Gateway must rejoin the new Wireless Gateway using the steps in Network Join on page 57. Upgrade the Firmware or Software Upgrading the firmware for most of the hardware components can be accomplished using the Mobile Configurator or by sending the appropriate download firmware command from OnGuard to the Wireless Gateway. For more information, refer to the System Administration User Guide and the Alarm Monitoring User Guide. Upgrade Components There are six (6) system components available for firmware or software upgrades: Firmware Upgrades 1. Lock s ACU (Access Control Unit board on the lock) 2. Lock s reader 3. WLM (Wireless Lock Module) This is the lock s radio. 4. Wireless Gateway Software Upgrades 5. Mobile Configurator application 6. OnGuard 104 revision 2

105 ILS Lock Operation User Guide Upgrade the Lock Using the Mobile Configurator There are no constraints for the firmware upgrade procedure via the Mobile Configurator. The components can be upgraded in any order unless otherwise defined. For more information, refer to Firmware Upgrade on page 55. Upgrade the Lock via the Wireless Gateway You can upgrade all of the locks assigned to a Wireless Gateway panel or upgrade locks individually. 1. Log onto OnGuard and Alarm Monitoring. 2. From the Alarm Monitoring system status tree, download the Wireless Gateway firmware (upgrades the WWM and WMC micro-processors). For more information, refer to the Alarm Monitoring User Guide. 3. Select the Wireless Gateway, and then download the ACU, WLM, or Reader firmware to all locks belonging to that Wireless Gateway. 4. (Optionally) Select the lock, and then download the ACU, WLM, or Reader firmware to that lock. Important: Do not attempt to access the lock until the updated firmware version is shown in the lock status information and the upgrade events confirm the firmware upgrade is completed. Upgrade the Mobile Configurator Application From the installing computer, complete the following steps: 1. Connect the Mobile Configurator device to the installing computer via the appropriate USB cable. 2. On the computer, navigate to the folder containing the Mobile Configurator.CAB file. 3. Copy the.cab file from the folder to the Mobile Configurator. 4. In Microsoft Active sync, click Explore and paste the file to the device. Microsoft ActiveSync Connection revision 2 105

106 7: Hardware Upgrade Mobile Configurator Device Directory Install the Application File on the Mobile Device On the Mobile Configurator, complete the following steps: 1. After the files have been copied to the Mobile Configurator they can then be installed on the device. 2. To install the file on the device navigate to the files. a. Start the Mobile Configurator file explorer (from Start, select File Explorer). b. Click the appropriate Mobile Configurator.CAB file to install the application. The file will run and begin the installation. 3. After the installation is complete, click [OK] in the top right corner of the Mobile Configurator screen. 106 revision 2

107 Appendices

108

109 ILS Lock Operation User Guide Appendix A: Alarm/Events Table Event Name Access Denied: Access Control Format Not Found Access Denied: Blocked Mode Access Denied: Card Expired Access Denied: Invalid Access Control Data Access Denied: Invalid Access Control Data Length Access Denied: Invalid Access Control Data Parity Access Denied: Invalid Access Control Data Type Access Denied: Invalid Smart Card Authentication Access Denied: Invalid Smart Card Data Access Denied: Invalid Smart Card Format Not Found Access Denied: Invalid Smart Card Location Access Denied: Invalid Smart Card Type Access Denied: Secured Mode Access Granted Access Granted Entry Made Access Granted No Entry Made ACU Firmware Upgraded Audit Trail Cleared Audit Trail Reached Limit Card Only Change Denied: Security Mode Description No ACFs (Access Control Formats) stored at the lock. User does not have blocked override privilege. Card has expired. Failed to process Integra card data. Length of retrieved data did not match length specified in selected ACF (Access Control Format). Parity calculations for retrieved data failed for selected ACF (Access Control Format). Retrieved data type (Wiegand/Integra) did not match the ACF (Access Control Format) type. Failed to authenticate to application specified by the selected SCF (Smart Card Format). Due to invalid header, invalid data length, failed to retrieve HID application data. No SCFs (Smart Card Formats) are stored at the lock. Application data could not be located on the card based on the selected SCF (Smart Card Format). Either the card was not found in the field or the card failed to respond to the requested RF (Radio Frequency) protocol. Lock is in security mode; no users allowed access. Access granted, when no latch or door sensor monitoring is present. Access granted and door opened when latch or door sensor monitoring is present. Access granted but door not opened when latch monitoring or door sensor is present. Lock firmware was updated. Recorded when the event log is cleared. Informs OnGuard when the event log is becoming full and will be overwritten. Automatic change to Card Only mode denied because lock is in the security mode. revision 2 109

110 A: Alarm/Events Table Event Name Card Only Mode Change Denied: Blocked Mode Daylight Saving Time Audit Denied Low Battery Denied, Invalid Timezone Denied, Not Authorized Door Forced Open Door Forced Open Restored Door Held Open Door Held Open Restored Door Open Door Open by Key Door Open by Key Restored Door Open from Inside Facility Code Only Mode Change Denied: Blocked Mode Facility Code Only Mode Change Denied: Security Mode First Card Unlock Mode Change Denied: Blocked Mode First Card Unlock Mode Change Denied: Security Mode Inactive Badge Internal Deadbolt Off Internal Deadbolt On Invalid Badge Invalid Facility Code Invalid Issue Code Description Automatic change to Card Only mode denied because lock is in Blocked mode. DST (Daylight Saving Time) start or DST end has occurred. Door open/close failed due to low batteries. User is not enabled for this timezone. Authorization for access is missing. Alarm when door is forced open. Generated when a Door Forced Open condition has been restored. Alarm when door is left open when latch monitoring or door sensor is present. Generated when a Door Held Open condition was restored. Lock opened through the Mobile Configurator or OnGuard. Mechanical key override on. Mechanical key override off. Door opened from inside, only when not in Unlocked mode. Automatic change to Facility Code Only mode denied because lock is in Blocked mode. Automatic change to Facility Code Only mode denied because lock is in Secured mode. Automatic change to First Card Unlock mode denied because lock is in Blocked mode. Automatic change to Unlocked mode denied because lock is in Secured mode. Generated when access was denied because the badge was inactive. Privacy knob (deadbolt) disengaged from inside. Privacy knob (deadbolt) engaged from inside. Generated when access was denied because the badge ID was unknown to the controller. Facility code for selected ACF (Access Control Format) did not match facility code retrieved from the card. Card is cancelled. 110 revision 2

111 ILS Lock Operation User Guide Event Name Lock Initialized Lock Powered Up by Portable Programmer Lock Updated Locked Under AFC Locked Under First Card Unlock No Privacy Override Low Battery Low Battery Restored Reader Mode Blocked Reader Mode Card Only Reader Mode First Card Unlock Reader Mode Secured Reader Mode Unlocked Reader Mode Unsecured Reader Mode Facility Code Only Reader Module Firmware Upgraded Realtime Clock Updated Unlocked Mode Change Denied: Blocked Mode Unlocked Mode Change Denied: Low Battery Unlocked Mode Change Denied: Security Mode Unlocked Under AFC Unlocked Under First Card Unlock WLM Firmware Upgraded Description Lock was initialized using the PP (Portable Programmer) application. Recorded after a power up to the lock via the portable programmer. Lock was updated. End of AFC mode. First Card Unlock relock. User does not have privacy override privilege. Lock battery level has reached 18% or less of its usable power. Generated when the lock battery has been restored. Lock entered Blocked mode. Lock entered Card Only mode. Lock entered First Card Unlock mode. Lock entered Secured mode. Lock entered Unlocked mode. Lock entered Unsecured mode. Lock entered Facility Code Only mode. Reader firmware was updated. Real-time clock was updated. Automatic change to Unlocked mode denied because lock is in Blocked mode. Lock cannot go to Unlocked mode due to low battery. Automatic change to First Card Unlock mode denied because lock is in security mode. Lock entered AFC mode. First Card Unlock mode; door is unlocked. Radio module firmware updated. revision 2 111

112 A: Alarm/Events Table 112 revision 2

113 ILS Lock Operation User Guide Appendix B: Install Mechanical Key Override in ILS Locks Components Keys and Key Cylinder Parts package including the Tailpiece Installation Procedure Prerequisites: Clear the lock. For more information, refer to Reset the Lock to Factory Configuration Mode on page 14. Remove the batteries. For more information, refer to Replace Lock Batteries on page Replace the Standard Tailpiece with the ILS-supplied Tailpiece. a. The Cylinder has a small Brass Pin that restricts the Cap Nut from turning. revision 2 113

114 B: Install Mechanical Key Override in ILS Locks b. Insert a small-tipped screwdriver into the Pin, and then softly push down while turning the Cap Nut counter-clockwise to remove. Tailpiece removed. ILS Tailpiece installed. 114 revision 2

115 ILS Lock Operation User Guide Cylinder Orientation Door Locked - Tailpiece and Key positioned horizontally to the Pins Door Open - Tailpiece and Key positioned vertically (90 degrees) to the Pins 2. (Optional) If the Handle is on the Rosette, remove the Handle by inserting a small-pointed device (such as an awl) into the Handle Hole This action can only be performed with the Cylinder removed or the Cylinder and Key installed with the Key in the Open position. revision 2 115

116 B: Install Mechanical Key Override in ILS Locks Handle Shaft Inside View Note: The Slot at the bottom of the Handle Shaft is horizontal. 3. Prepare to install the Key Cylinder. Use the construction card to place the lock into the Unlocked mode. The Slot at the bottom of the Handle Shaft will be able to be turned counter-clockwise into the vertical position, and then remain in the vertical position. However, if the lock is not placed into the Unlocked mode, the Slot will spring back to the horizontal position. Note: The construction card will only work if the lock has not been initialized. 116 revision 2

117 ILS Lock Operation User Guide Key Cylinder Installed Key Cylinder installed Key Cylinder with the Key in the Open position 4. Install the Cylinder on the Rosette by completing the following steps: a. Place the Key in the Cylinder. b. Turn the Key 90 degrees counter-clockwise. revision 2 117

118 B: Install Mechanical Key Override in ILS Locks c. Insert the Handle with the Cylinder into the Handle Shaft. Use the tip of the screwdriver to push the Side Pin in while sliding the Handle on. 5. Wire the Key Switch. The Key Cylinder Rosettes have two (2) wires, one (1) for the Clutch (Motor), and one (1) for the key has been used audit trail. Wire White-to-White and Red-to-Red. 6. Initialize the lock using the Mobile Configurator. For more information, refer to Using the Mobile Configurator on page revision 2

119 ILS Lock Operation User Guide The completed installation: Key in Key out revision 2 119

120 B: Install Mechanical Key Override in ILS Locks 120 revision 2

121 ILS Lock Operation User Guide Index Numerics 125 khz proximity card readers MHz radio module A ADA... 16, 17 Alarm/events table Alternative Fire Code (AFC) Assign IP address on DHCP network... 86, 87 Assign static IP address on non-dhcp network 87 Assign the locks Attenuation caused by building materials Audit trail Auditor menu Automatic lock state changes B Batteries and privacy Battery cover life test level of Battery low or dead condition Battery replacement Blocked mode (state) Blocking card Buzzer general behavior C Calendar Card Insertion Micro-switch Card Only mode Card reader technologies khz Prox iclass magnetic MIFARE CE Change lock mode Blocked Card Only Facility Code Only First Card Unlock Secured Unlocked Unsecured Change lock operation mode Channel plan for ILS wireless devices Check mode Clean magnetic read head outer cover Commission the ILS Wireless Gateway... 38, 86 Commission the locks assign the locks initialize the locks Configure Wi-Fi Wireless Gateway Configure blocking override Configure the Wi-Fi Wireless Gateway hardware parameters Connect the Wi-Fi Wireless Gateway to the computer via HyperTerminal Connection cable Connections... 28, 42 to the computer to the lock to the Mobile Configurator Connectivity loss poor/none Connectors Construction card owner standard Construction cards D Lock when the handle is released Database files Daylight Saving Time Device owner Diffraction Door names Door position and monitoring Door sensor contact Door sensor test Door unlock time for disabled users (ADA) Download lock configuration file to the Mobile Configurator DST updates E Emergency lock and unlock features Emergency operations unlock wireless locks wireless locks revision 2 121

122 Index Establish static IP Address (Ethernet Wireless Gateway) Estimating wireless range Event Type Events access denied access granted Events that do not produce LED/buzzer alarms. 27 F Facility/Foyer Factory configuration mode Failed join FCC part Firmware upgrade version of First Card Unlock mode Free-space propagation G General lock characteristics H Handle Micro-switch Hardware upgrade version of Hardware parameters of the Wi-Fi Wireless Gateway Hardware upgrade Heartbeat time Heavy-duty cylindrical latch BLA Hybrid battery cover , 103 I iclass card readers ILS locks features and functions ILS wireless cluster components ILS Wireless Gateway commissioning of ILS wireless lock radio LED indications Initialize the lock Initialize the locks Install lock lock radio Install application file on the mobile device Install Mechanical Key Override Installation planning ceiling-mounted Wireless Gateway determine potential Wireless Gateway locations identify wireless Lock locations mounting feasibility obtain floor plan power and network access for Wireless Gateways relative positioning of the Wireless Gateway and its locks wall-mounted Wireless Gateway Wireless Gateway antenna orientation Wireless Gateway mounted in the middle of locks Wireless Gateway mounted on exterior wall 68 Wireless Gateway mounting height Introduction... 9 Invalid card IP23 MAG readers IP46 IClass & 125Khz reader J Join card (wireless) Join network K Key override Key Override Micro-switch L Languages Latch monitoring mortise LED and buzzer indications behavior LEDs general behavior ILS wireless lock radio indications Wireless Gateway Lock attributes audit file audit trail certifications configurations default settings of factory configuration mode firmware heartbeat maintenance malfunction operating environment operators Power Cycle/Reset power up revision 2

123 ILS Lock Operation User Guide radio reset standard configuration mode update Lock data Lock ID Lock information timestamp Lock installation Lock Name Lock operation mode changes Lock operation modes Card Only First Card Unlock Unlocked Lock radio installation Lock table Lockcases heavy-duty cylindrical latch BLA mortise latch only mortise with deadbolt mortise with deadbolt (AFC) Log onto Mobile Configurator M Magnetic card readers Magnetic read head Main components wired access points wireless lock radio Maintenance... 33, 56 Mechanical key override state changes Micro-switches MIFARE card readers Mobile Configurator Auditor menu description languages main components of maintenance operator logon power adapter what it supports Mobile Configurator files LockAudits.txt PPApp PPAudits.txt sqlce Mortise latch only Mortise with deadbolt Mortise with deadbolt (AFC) Mounting screws for radio upgrade Multipath fading N Network join Network join key O Obstructions attenuation caused by building materials equation for estimating range impact of Obstructions to avoid Office with card function Ontario Fire Code Open lock Optimum heartbeat time Other referenced user guides... 9 Outer cover Override blocking Owner construction card P Perform site survey channel plan scan RF spectrum on site visual inspection of site Portable Programmer (Mobile Configurator) Power adapter Power Cycle/Reset Power supply Power up the lock PP (Portable Programmer) audit file Privacy function Privacy Micro-switch Privacy state Privacy with factory settings Production test key Propagation diffraction free-space propagation multipath fading reflection Protek 3290N R Radio module upgrade Range in buildings hallway diagram hallways with wall obstruction diagram revision 2 123

124 Index with wall obstructions Read audit trail events Read lock audit Read lock openings Reflection Replace lock batteries Replace the Wireless Gateway Reset lock to factory mode RF output power settings RF signal strength analyzer RF untapped coverage Wireless Gateway on exterior wall RoHS S Scan RF spectrum on site Scheduled (automatic) changes Send heartbeats Serial number Setup and configuration Site planning overview Standard configuration mode Standard construction card Successful join Switch tests Door sensor how to test the switches T Terms used in this document Test and diagnostics Switch Test Test buzzer Test card Test LEDs Timestamp Timezones Troubleshooting U UL10C UL294 (pending) Unlock wireless locks Unlocked mode Update RTC Update the lock Upgrade firmware from offline lock version from online lock version hardware Mobile Configurator Application radio reader Upgrade components Upgrade firmware lock information Upgrade lock using the Mobile Configurator using the Wireless Gateway Upgrade lock firmware Upgrade or replace radio reader Upload PP lock audits file to OnGuard User code Users settings Using the Mobile Configurator V View lock audit View lock information serial number Visual feedback Visual inspection of site W When key override is used Wired Access Point (Ethernet)... 84, 85 Wireless connectivity... 56, 57 Wireless device that do not cause interference Wireless device that may cause Interference Wireless features Wireless functionality Wireless Gateway assign IP address on DHCP network... 86, 87 assign static IP address on non-dhcp network 87 certifications description of environmental requirements LEDs Omni-directional antenna power supply Wireless Gateways Ethernet 10/ Power-over-Ethernet (Ethernet 10/100) Wi-Fi Wireless lock system main components of send heart beats Wireless radio module Wireless range estimates inside buildings revision 2

125 ILS Lock Operation User Guide revision 2 125

126 Lenel Systems International, Inc Pittsford-Victor Road Pittsford, New York USA Tel Fax