A Judicious Integration Project: Integrating Security Systems Requires Careful Planning and Testing.
WHO'S IN CHARGE. A system integration project is a complexundertaking that requires considerable coordination in both the planningand execution stages. To ensure that all the parties work together, theorganization should form a committee comprising representatives from allaspects of the project, including the architect, contractors, thesecurity consultant, integrators, facility managers, and thoseultimately responsible for security in the completed facility. Thiscommittee should be led by the security director. SYSTEM INTEGRATION holds the promise of offering companies a way toget the most from their security equipment, but planning and installingan effective integrated system is not a simple process. Having consultedwith clients on numerous integration projects, we have learned a numberof dos and don'ts. To illustrate these lessons, we'll use theexample of a newly built facility that we'll call SouthwestCourthouse, an eight-story, 24-courtroom, 272,000-square-foot facilitythat opened in late 2001. The building's security measures include64 CCTV cameras, no card readers, and dozens of glass-break sensors, allof which had to be made to work together. The lessons learned can bedivided into six key categories: who's in charge, sequence ofoperation, wiring and fiber connections, documentation, commissioning,and operator training. To determine what the organization wants its integrated securitysystem to do, the security director can have the committee go through abrainstorming session to create a matrix of likely threat scenarios.Committee members can then agree on how the system should respond ineach case. The matrix can serve as a template for the installation andconfiguration of the system, including the sequence of operations (moreon this in the following section). Similarly, the organization must decide who, among the contractors,will take the lead during installation. The integrated buildingenvironment management control systems contractor is often a logicalchoice. That person can work closely with an "owner's engineerappointed by the owner to keep the technical aspects of the installationon track and to specify rigorous testing requirements. At the courthouse, no lead contractor was designated. The sameelectrical contractor installed the wiring for both the IT and securitysystem networks. This contractor worked alongside the integratedbuilding environment management control systems contractor. However, theelectrical contractor worked directly for the owner (in this case, thepublic authority), while the other contractors were subcontractors hiredby the general contractor. As a result of that arrangement, some ditches occurred. While theywere discovered and fixed during the testing process, the project wouldhave taken less time and been completed more efficiently if there hadbeen one contractor designated as the project leader or configurationmanager and given ultimate responsibility for ensuring that wiringconnected the right components, that connections fit system requirements and functioned properly, and that the documentation matched the workdone (more on wiring and documentation later.) Sequence of operation. One of the biggest roadblocks to creating aneffective integrated security system at the courthouse arose becausethere was no agreement before the devices were installed on how thedifferent components of the security system should interact duringdifferent alarm scenarios. This is the type of issue that should have been addressed by thecoordinating committee. For example, the courthouse has a fire alarm system, a card accesscontrol system, and cameras monitoring the doors, all of which must worktogether in a specific sequence when an alarm activates. Ideally, whenan alarm is triggered, the cameras should begin recording and the firesystem should deactivate the access control system so that people canget out of the building. Similarly, in a theft scenario, if someone onthe second floor of the courthouse grabs a laptop computer, runs down astairwell, and pushes the panic bar to open the door at the foot of thestairs, the camera monitoring that door should record the theft.However, that initially didn't happen in the courthouse becausethat particular scenario had not been considered and the appropriatesequence of operation had not been programmed into the system. Thecameras were not set up to activate. Had this scenario been consideredin advance, alternative sequences of operations could have been inplace; ultimately, the problem was solved by having th e cameras trainedon the doors record whenever the doors opened. Another example at the courthouse involved the turnstiles thatcontrol access to certain parts of the building. In the event of a bombscare, which is announced through the alarm system, the alarm systemmust "talk" to the turnstile access control system anddeactivate it to release the turnstiles so that occupants can exitquickly. However, this option was not programmed into the system whenthe courthouse first opened, and the oversight was discovered andrepaired only when on-site testing began. Going back to fix suchproblems is more difficult and time consuming once the building is open. Wiring and fiber. While some security system manufacturers tout theidea of being fully IT compatible, the use of an existing IT network forsecurity system data communications has some pitfalls. There are somedata security and system performance ramifications implicit in thisapproach that must be considered. For example, typical IT networks arenormally not designed to accommodate the large amount of data inherentin a video system, particularly if high-frame-rate data is required. Inaddition, security systems typically cannot tolerate planned networkmaintenance outages, and allowing alarm signals to travel across anetwork run by another department creates greater exposure for thesecurity system. Another concern is that network staff charged with overseeing thetransmission of security data may be focused primarily on IT concerns,not physical security issues. Giving these additional personnel accessto alarm data and the ability to alter card access rights may alsocompromise security. The integrators at Southwest Courthouse avoided this issue bycreating a separate data network that links the card-key access systemand CCTV cameras across an Ethernet network using Cat-5 wiring, a typeof highspeed network cabling. This network is monitored and administeredby a dedicated staff in the security command center. Documentation. Ideally, the same person will serve as the projectmanager throughout the project, from planning and design throughconstruction. But since that period can last as long as four years for alarge facility such as the courthouse, turnover may be unavoidable.Adequate documentation is vital to ensure a smooth transition and propercompletion of the project under a new manager. Unfortunately, because there was no one contractor with overallresponsibility for the installation and testing of the courthousesystems, some of the documentation-particularly the documentation aboutthe cabling-was incomplete. This led to problems after the project wascompleted. For example, a contractor was called in to do sometroubleshooting. When he adjusted one part of the cabling to fix aproblem with a panic button, he inadvertently damaged another part ofthe cable affecting a card reader connection, because there was no clearrecord of where cables ran. Keep it clear. A different problem can arise when documentation isnot thorough enough. Those creating the documentation must realize thatit will be used by service technicians and others who may not bespecialists. The cabling at the courthouse all leads into a networkcommunication room, where thousands of cables terminate in a punch-downblock. If the terminations aren't documented adequately, as wasinitially the case at the courthouse, it becomes impossible for servicepersonnel to know which wire is connected to which glass break, forexample. Keep it current. It is not unusual for a system to be fine-tuned asit is installed and commissioned. The documentation should reflect thesechanges and accurately reflect the final as-built conditions. This was one area in which the courthouse project workedparticularly well. One example of how updating documentation is valuablecomes from one of the specialized components of the courthouse'ssecurity system. To meet special security needs for detention areas at thecourthouse, an independent Detention Control System (DCS) was installedto integrate a range of security functions, including video cameras andmonitors, parking gates, and metal detection/x-ray stations. Initially,the sheriff's office had requested installation of cameras in thecorridors outside the courtrooms, in the holding-cell area, and in theparking garage. Later, when the initial plans went through avalue-engineering process to reconcile the plans with the approvedbudget, some of those cameras were eliminated. Fortunately that changewas documented, because after the courthouse was occupied, certainofficials questioned why those cameras hadn't been installed, andintegrators were able to use the existing documentation to answer thesequestions. Commissioning. All systems need to be tested to ensure that thevarious systems function properly both individually and together. Thisprocess is called commissioning. If possible, even before installation begins, integrators andothers involved in a construction project should assemble the systemcomponents and software, either in a factory-floor acceptance test (forsmaller installations) or in a mock-up at the job site (when manymanufacturers' products are involved). The setup should be ascomplete as possible, and it should then he tested against the threatscenarios that the project committee designated as likely. This processensures that the system works as intended and uncovers glitches beforethey can adversely affect the installation process, thus making for asmoother installation. Naturally, the system will need to be tested again once it'sinstalled-ideally before it is expected to be operational- but theduration and complexity of installed-system tests are reduced if thesystem has already been exercised in all possible modes on the factoryfloor. At the outset, the project team should document how the systemshould work and the procedures that must be followed in testing todetermine whether performance objectives are being met. In the case ofthe courthouse, those involved in this process included the people whowould be operating the building, the security staff, the sheriff'sstaff, and the judges. The courthouse's owner, the municipality,had to sign off on the process. An added benefit of involving staff who will later use the systemin the planning for the tests is that they become more familiar with thespecific system configuration, giving them a head start in training tobecome proficient at using the system once it is operational.Additionally, they gain the advantage of insider knowledge. Project planners should allow for a commissioning period before thesystem goes live; they should build this time-consuming step into theoverall construction schedule, Realistically, however, as schedules getsqueezed, it isn't always possible to complete the tests before thesystem goes online. In the case of Southwest Courthouse, some testing was completedbefore the building opened. Those tests revealed an incorrect line ofcode that prevented the fire alarm and access control systems fromcommunicating, as well as a signal from the panic button on thejudge's bench that did not reach the sheriff's station. Oncethese were discovered, they were quickly repaired. But integrators were not completely satisfied with the results ofthese initial tests. Therefore, commissioning continued during eveninghours after the building was occupied. Every aspect of the system waschecked three times, which took four months. Operator training. The final--and crucial--element of a successfulintegrated security system installation is adequate operator training. Asystem with all the connections checked and double-checked and with allthe bugs worked out is still not going to perform the way it should ifthe people operating it don't know how to get the most out of it.The situation at Southwest Courthouse illustrates why it doesn'talways happen the way it should. Many facilities have several different parties responsible forsecurity over the course of a 24-hour period--typically an in-house staff handles security during the day, and contracted security personneltake charge overnight. This was the situation at the courthouse: Thesheriff's department had ultimate responsibility and handledsecurity operations during the day, while at night responsibility wastransferred to a private security force. Additionally, there werefacility operations personnel who needed to know the system well. Task-based training. The round-the-clock operation of thecourthouse meant that there was a large pool of people involved insecurity operations, working different shifts on different days. So thefirst requirement for adequate operator training was to offer anextensive schedule of training sessions, rather than a few shortsessions. The training format is another issue. At the courthouse, theintegrators provided 40 hours of training to the various people involvedwhen the building opened and another 40 hours after it had beenoperating for six months. However, that amount of training proved to beinsufficient, and the integrator was asked to come back for several moretraining sessions. Security managers can better ensure proper education of all staffmembers by making training task based, not time based. This means thatcontractors should be asked to train operators until they know what thesystem is supposed to do and how to use it properly This arrangementmakes it more difficult for the contractors providing the training toestimate how much training would be required. Therefore, a detailedagreement is necessary to ensure that everyone involved understands thecontractor's training responsibilities. Another consideration is where the training will take place.Training is effective only if it takes place on the equipment that theoperators will be using, so installation of the integrated system shouldbe complete before training sessions start. The authors' companytrained three different staffs (the sheriff's department staff,which operated the DCS equipment; the facilities operations staff; andstaff members of the company that provided security at night) at thecourthouse, using the same equipment they used in their jobs. After more than a year in operation, all systems are now workingtogether smoothly at the courthouse, but as these examples show, a fewobjections were raised before this judicious ending was reached, Forothers about to embark on similar proceedings, the lessons learned heremay help their case go more smoothly. Tom Allen is vice president of Johnson Controls Security Systems.Derek Trimble is vice president of marketing and new productdevelopment, security solutions, Johnson Controls, Inc.'s ControlsGroup.