MEPVirtual Engineering Labs - CCTV, Access Control & Security SystemsELV TRAINING TOOL

An interactive reference and calculation tool for CCTV/video surveillance, access control and intrusion detection systems on building services projects. Companion to the Home Automation Virtual Control Lab and BMS Field Reference.

1. Fundamentals of ELV Security Systems

Electronic security on a modern building services project is normally delivered as three related but distinct ELV (extra-low-voltage) sub-systems. They are frequently procured and installed by the same specialist contractor and share cabling routes, containment and sometimes a common head-end room, but each has its own controllers, its own software platform and its own commissioning requirements.

CCTV / Video Surveillance

Network (IP) cameras record and stream video to a Network Video Recorder (NVR) or Video Management System (VMS) server. Used for deterrence, incident review, remote monitoring and, increasingly, video analytics (line-crossing, loitering, people counting, license-plate recognition).

Access Control

Controls and logs who may pass through a given door, turnstile or barrier, and when. Built around credentials (cards, fobs, mobile, biometric), door controllers and a management server/software platform. Provides an audit trail and can enforce anti-passback, time zones and interlocks.

Intrusion Detection

Detects unauthorized entry or forced access outside normal operating hours using motion detectors, door/window contacts and glass-break sensors, wired into an intrusion panel that reports to a monitoring station or the building's security operations centre (SOC).

How the three sub-systems typically integrate

CCTV ↔ Access Control: a door forced-open or invalid-badge event can automatically trigger the nearest camera to pop up on the operator workstation and start a bookmarked recording, giving visual verification of every access event.
Access Control ↔ Intrusion Detection: arming the intrusion panel is often tied to the last valid card exit of the day; a valid credential presented while the system is armed can auto-disarm the zone instead of triggering an alarm.
Security ↔ Fire Alarm System (FAS): this is a life-safety-critical interface. On a fire alarm signal, designated egress doors held by electric locks must release to fail-safe (unlocked) so occupants are never trapped behind an access-controlled door. This is covered in depth in Section 7.
Security ↔ BMS: the Building Management System commonly receives high-level status points from the security head-end (system armed/disarmed, door held open, camera offline) for building-wide dashboards, and may in turn provide security with occupancy or lighting schedule data. The BMS does not usually control security devices directly, it monitors and correlates.

Engineering note: even where CCTV, access control and intrusion detection are supplied as one "integrated security platform" by a single vendor, treat each sub-system's cabling, power and life-safety interfaces as if they were independent when reviewing shop drawings, because a controller or NVR failure should never propagate into an unrelated sub-system.

2. CCTV Camera Types & Selection

Dome Camera

Compact, discreet, vandal-resistant housing. Common for indoor corridors, lobbies, retail. The tinted dome makes it harder to see which way the lens is pointing.

Bullet Camera

Cylindrical housing, usually with an integrated sunshield and long IR illuminators. Highly visible, which itself acts as a deterrent. Common for perimeter and car park use.

PTZ (Pan-Tilt-Zoom)

Motorized camera that an operator (or an auto-tracking algorithm) can pan, tilt and zoom in real time. Used to cover large open areas such as car parks, stadium bowls or site perimeters where one camera needs to actively follow activity.

Turret (Eyeball) Camera

A hybrid of dome and bullet: a ball-and-socket lens module without a dome cover, which avoids IR reflection ("IR bloom") off a dome in low light. Popular for general indoor and covered-outdoor use.

Multi-Sensor / Panoramic Camera

Two to four independent lens/sensor modules in one housing, each covering a different field of view, stitched or handled as separate streams. Can replace several single-lens cameras at a single pole or corner, reducing containment and mounting points.

Specialist Types

Thermal cameras (perimeter detection in total darkness or through smoke/fog), explosion-proof/ATEX cameras (hazardous areas), and license-plate-recognition (LPR) cameras (car park entry/exit, tuned for high shutter speed and IR wavelength).

Comparison table

Type	Typical use case	Pros	Cons
Dome	Indoor corridors, lobbies, retail ceilings	Discreet, vandal-resistant options available, hard to see aim direction	Dome can cause IR reflection at night; harder to clean/re-aim than bullet
Bullet	Perimeter, car parks, building entrances	Long IR range, visible deterrent, easy to aim and re-aim on site	More exposed to physical tampering unless height-mounted; less discreet
PTZ	Large open areas, car parks, stadiums, perimeter follow-up	Active coverage of a wide area with one camera, operator-driven zoom on incidents	Only looking at one spot at a time unless on an auto-tour; higher cost; moving parts to maintain
Turret	General indoor / covered outdoor	No dome IR bloom, easy to aim, competitively priced	Lens module more exposed than a true dome
Multi-sensor	Building corners, wide junctions, façades	Reduces pole/containment count, wide combined coverage	Higher unit cost, single point of failure for several views

Key selection factors

Resolution / megapixel: higher megapixel count gives more detail for identification at distance (e.g. reading a face or number plate) but increases bandwidth and storage (see Section 3). Common tiers: 2MP (1080p), 4MP, 5MP, 8MP (4K).

Lux rating / low-light performance: the lux rating states the minimum scene illumination at which the camera still produces a usable image. Lower lux figures indicate better low-light sensitivity; features such as a larger sensor, wide aperture lens or "starlight"-grade sensor improve this.

IR range and lens focal length / field of view: built-in infrared illuminators extend usable range into darkness (spec'd in metres); a shorter focal length (wide-angle) lens gives a wider field of view but less detail at distance, while a longer focal length (telephoto) narrows the view but reaches further, so lens choice is a direct trade-off against coverage area.

IP66 / IK-rated housing for outdoor or exposed locations: IP66 indicates the housing is dust-tight and protected against powerful water jets, suitable for external mounting; an IK rating (e.g. IK10) indicates mechanical impact resistance for vandal-prone areas.

These are widely-taught, representative concepts for training purposes. Always confirm exact resolution, lux, IR range and ingress/impact ratings against the specific manufacturer's datasheet for the model being specified.

3. CCTV Storage Calculator

Estimate the raw NVR storage required for a camera population, based on resolution, frame rate, hours recorded per day and retention period.

storage (GB) = (bitrate_Mbps / 8) x 3600 x hours_per_day x retention_days x num_cameras / 1000 storage (TB) = storage (GB) / 1000

Number of cameras

Camera resolution (representative typical bitrate)

Frames per second (informational, affects bitrate choice)

Hours recorded per day (24 = continuous, lower = motion-triggered)

Retention period (days)

These bitrate figures are representative estimates for training purposes only. Actual bitrate depends heavily on compression standard (H.264 vs H.265), frame rate, scene complexity/motion, and camera-side settings. Final NVR/storage sizing must also add RAID overhead (e.g. RAID 5/6 parity capacity) and be verified against the specific manufacturer's own storage calculator tool before ordering hardware.

4. Access Control Fundamentals

Credential types

Proximity card/fob: low-frequency RFID (125 kHz) read at a short distance; simple and inexpensive but easily cloned, considered legacy technology.
Smart card: higher-frequency (13.56 MHz, e.g. MIFARE/DESFire/iCLASS) encrypted credential, harder to clone, can store multiple applications on one card.
Mobile credential: the phone (via Bluetooth or NFC) acts as the credential; convenient and revocable remotely, but depends on phone battery/app and network provisioning.
Biometric: fingerprint, facial recognition or iris; ties the credential to the person rather than a token, often combined with a card as two-factor authentication for higher-security doors.

Reader → controller → server hierarchy

A typical access control architecture is layered:

Card reader at the door reads the credential and passes the code to the door controller.
Door controller (sometimes called a field panel) makes the access decision (or forwards it), holds a local cache of authorized credentials so the door keeps working if the network link drops, and drives the lock relay, monitors the door position switch and REX input.
Access control server / head-end software holds the master cardholder database, access levels, schedules and audit trail, and pushes credential updates down to each door controller.

Fail-safe vs fail-secure locking hardware

Fail-safe (unlocks on power loss)

A fail-safe device (typically an electromagnetic lock / maglock) requires continuous power to remain locked. If power is removed, either by design (fire alarm relay) or by a fault, the door unlocks.

Why fire egress doors use fail-safe: life safety takes priority over security. Building codes and fire strategies require that occupants can always exit through a designated egress path, so if the fire alarm activates (or power simply fails), the door must release rather than trap people inside.

Fail-secure (locks on power loss)

A fail-secure device (typically an electric strike) requires power to unlock, and remains mechanically locked with no power. Used where security of the space (e.g. a server room, cash office, IT riser) must be maintained even during a power or fire alarm event, provided the door is not on the primary means of egress, or a separate mechanical egress device (e.g. a panic bar) allows free exit from inside regardless of the electric lock state.

Fail-safe/fail-secure selection for every door is a life-safety decision. It must always be verified against the project's approved fire strategy, egress drawings and local life-safety code requirements (e.g. building regulations, NFPA 101/80, or the equivalent local authority-having-jurisdiction rules) before hardware is ordered or installed, and agreed with the fire engineer/authority having jurisdiction, not decided by the security designer alone.

5. Access Control Wiring Diagram (Single Door)

Click any component in the diagram to see what it does and how it is wired in.

Data/control wiring Power wiring Monitoring wiring

Select a component

Click any box in the diagram to see its role, typical wiring and key notes.

6. Intrusion Detection

Common detection devices

PIR (Passive Infrared) motion detector: detects the change in infrared heat signature as a warm body moves across its field of view. Common general-purpose interior sensor.
Door/window contact: a magnetic reed switch pair, one on the frame and one on the leaf, that opens the circuit when the door/window is opened.
Glass-break detector: an acoustic (or shock) sensor tuned to the specific frequency signature of breaking glass, mounted within listening range of the glazed opening it protects.
Panic / duress button: a manually operated device (fixed or portable) that raises an immediate, silent alarm to security or the monitoring station, typically at reception desks, cash offices or control rooms.

Zone types

Perimeter zone: covers the building's outer shell, entry doors and accessible windows. Usually the first line armed, often stays armed even when some interior zones are temporarily bypassed for out-of-hours staff.
Interior follower zone: covers the path a legitimate user takes from the entry door to the keypad to disarm the system, with a short entry/exit delay; only alarms if the delay expires without a valid disarm.
24-hour zone: always active regardless of the overall arm/disarm state, used for panic buttons, tamper switches and other conditions that should always be reported.

Simple zone map

Zone design principle: the entry/exit path should always be the follower zone so a legitimate user has time to reach the keypad and disarm before other interior zones (which have no delay) would trip.

7. Fire Alarm Integration & Fail-Safe Override

When the fire alarm system (FAS) activates, access-controlled egress doors fitted with fail-safe locking hardware must release automatically, overriding the access control system's normal locked state, so that no occupant is ever trapped behind a locked door during an evacuation. This mirrors the fire/smoke override pattern used elsewhere on this site (see the HVAC tool's fire/smoke damper override), the fire alarm system always takes priority over the normal operating state of any other ELV or building services system it interfaces with.

Interactive state toggle

NORMAL OPERATION

FIRE ALARM ACTIVE

State: Normal Operation

Egress doors on fail-safe maglocks: locked, released only by valid credential, REX button, or door position switch logic.
Fail-secure doors (e.g. server room): locked, unlock only on valid credential.
CCTV: recording on normal schedule (continuous or motion-triggered per Section 3 settings).
Intrusion detection: armed/disarmed per normal schedule.
Access control audit log: recording routine card-read events.

State: Fire Alarm Active

Fail-safe egress doors: fire alarm relay cuts power to the maglock → doors release and unlock immediately, regardless of access control state.
Fail-secure doors on the egress path: must still permit free exit via a separate mechanical device (e.g. panic bar), independent of the electrical lock state.
CCTV: system typically switches to an alarm-triggered view, auto-displaying cameras nearest the activated fire zone and/or the released egress doors on the operator wall.
Intrusion detection: normally suppressed/disregarded for the affected area during evacuation, since doors are expected to be opened.
Access control audit log: logs the fire-release event and every door's forced-unlock status for later review.
BMS: receives the fire alarm status point and may simultaneously initiate other overrides (e.g. AHU shutdown, smoke damper actuation) as covered in the HVAC tool.

This fail-safe release requirement is non-negotiable life-safety functionality. The specific doors requiring fire-alarm release, the release method (direct relay vs addressable fire panel output vs access control software rule) and any exceptions must be defined in the approved fire strategy and verified with the fire alarm system designer and the authority having jurisdiction, and must be function-tested as part of commissioning (see Section 9).

8. Network & PoE Budget Calculator

PoE standards reference (typical maximum delivered power)

Standard	Common name	Approx. max power at device
IEEE 802.3af	PoE	~15.4 W
IEEE 802.3at	PoE+	~30 W
IEEE 802.3bt Type 3	PoE++ / 4PPoE	~60 W
IEEE 802.3bt Type 4	PoE++ / 4PPoE	~90 W

Figures are representative maximums per port as commonly taught; always confirm exact class/wattage against the specific camera, controller or switch manufacturer's datasheet, since cable length and PoE class negotiation both affect delivered power.

Device list

Switch PoE power budget available (W)

9. Commissioning & Testing Checklist

10. Troubleshooting Guide

Symptom	Likely causes	Checks
Camera offline / no video	PoE fault or budget exceeded; network switch/port failure; loose or damaged Cat cable; camera firmware crash; IP address conflict	Check switch port link/PoE status LED; verify PoE budget (Section 8); ping camera IP; check cable continuity and connectors; power-cycle camera; review switch/NVR event log
Poor night image quality	Insufficient IR range for scene distance; IR reflecting off nearby glass/foliage causing washout; low-light lux rating unsuitable for the location; dirty lens/housing	Re-check IR range vs mounting distance; reposition to avoid reflective surfaces close to lens; review lux spec against actual scene illumination; clean lens/dome; review IR/exposure settings in camera web interface
Door not releasing on fire alarm	Fire relay/interface wiring fault; incorrect fail-safe/fail-secure hardware installed; door controller override rule missing or misconfigured; power supply fault	Verify fire alarm interface relay operation with a test signal; confirm lock hardware matches the approved fire strategy for that door; check door controller fire-override programming; test power supply output; retest and log result per Section 9
False intrusion alarms	PIR aimed at HVAC vents, blinds or sunlight causing thermal false triggers; loose door/window contact magnet; glass-break detector picking up unrelated noise (e.g. keys, HVAC); pest activity	Reposition/reangle PIR away from air currents and direct sunlight; re-align/re-fit contact magnets and check gap tolerance; adjust glass-break sensitivity or reposition; review event history for pattern before condemning the device
PoE device not powering	PoE class mismatch between device and switch port; total switch PoE budget exceeded; damaged Cat cable or connector; incompatible PoE injector/midspan	Confirm device PoE class vs switch port capability; recalculate total demand against switch budget (Section 8); test with a known-good short patch cable; try an alternate verified PoE port; check for cable length exceeding standard limits

11. Assessment

Answer all questions, then press "Check Answers" to see your score. You can reset and retry as many times as you like.