Intrusion detection

Intrusion detection is the supervised loop that tells the institution something is wrong. Where access control says who can come in, intrusion detection says when someone is in who should not be. The work is straightforward (panel, sensors, supervised zone wiring, central station reporting), and the discipline is in the zone design, the false-alarm reduction, and the ULC-listed monitoring path. Get those right and the system catches the events it should; get them wrong and the system catches every shopping cart, every cleaner, every HVAC cycle, until the central station ignores it.

The governing standards

When the standards apply

Every monitored intrusion install in Canada. The standards below define the equipment listing, the install practice, and the central station performance.

The standards

Panel selection

When the rule applies

Every intrusion install. The panel is the controller for the system: it monitors the zones, manages arming and disarming, and communicates to the central station.

The spec

// PANEL SELECTION CRITERIA

ULC-S304 listed for the application
Zone capacity sized for the as-installed count plus 25 percent spare
Communication paths: dual-path standard (IP primary, cellular or POTS secondary) for institutional installs; ULC-S301-listed central station as the receiving party
Encryption: AES-128 minimum on the IP path to the central station
Keypad and user interface: institutional-grade keypad with backlit display, ADA-compliant where required
Battery backup: minimum 24 hours per ULC-S304
Tamper monitoring on the panel, every keypad, and every junction box
Event log: minimum 1000-event circular log retained in the panel
Reporting: every event (arm, disarm, alarm, fault, restoration) reported to the central station with the event code per the Contact ID or SIA-DC09 protocol
Programming: panel-side programming through the institution’s preferred tool; cloud-managed where the institution supports it

Field note

Sensor types and applications

When the rule applies

Every zone on the install. The sensor type is selected against the space being protected and the threat being detected.

The six common sensor types

Passive infrared (PIR): Detects motion by sensing changes in infrared heat signature within the protected area. Used indoors for area protection. False alarms triggered by HVAC airflow, sun warming surfaces, small animals, fluorescent light cycling. Mount carefully against environmental factors.
Dual-technology (PIR + microwave): Combines PIR with microwave (motion-detection radar). Both technologies must agree on a detection event before triggering an alarm. Significantly lower false alarm rate than PIR alone, at slightly higher unit cost. Used indoors in environments where PIR false alarms are documented.
Glassbreak: Detects the acoustic signature of glass breaking. Mounted on the wall opposite or adjacent to the protected glass, ceiling level, within 4500 mm (15 ft) of the protected glass. Used for perimeter window protection.
Magnetic contact (door/window contact): Reed-switch sensor on the door or window frame, magnet on the moving leaf. Detects the open/closed state. Used on every door and window in a perimeter zone, plus secured-room interior doors.
Photoelectric beam (active infrared): Transmitter-receiver pair forming an infrared beam across an opening or an outdoor perimeter. Detects beam interruption. Used outdoors for perimeter detection along fence lines and across driveway entrances.
Perimeter LiDAR: Laser-scanning sensor that creates a detection plane along a wall, fence, or property line. Detects intrusion across the plane with sub-metre accuracy and rejects environmental clutter (wildlife, vegetation movement). Used at high-security perimeters where false alarm rate matters and the budget supports the technology.

Field note

// WHAT I USE

Bosch ISC-PDL1 series PIR and ISC-BDL2-WP12G dual-technology motion detectors for indoor zones; the Bosch family integrates cleanly with the Bosch B Series panels. Bosch ISC-SK1 series glassbreak detectors with accurate frequency analysis to discriminate glass from other acoustic events. Bosch ISN-C45 magnetic contacts for door and window points. Optex for outdoor and perimeter work: Optex SIP series outdoor PIR, Optex SL series long-range outdoor PIRs, Optex REDSCAN mini for perimeter LiDAR detection.

Optex REDSCAN is the institutional default where false-alarm rate at a perimeter matters; the technology rejects environmental clutter that defeats standard PIR and active-IR beams. Used heavily on critical infrastructure, federal facilities, transit yards, and high-security commercial.

Zone design

When the rule applies

Every intrusion install. The zone design defines how the panel reports the alarm: which zone caused it, what type of alarm it is, and what the operator should do about it.

The spec

// ZONE DESIGN

Zone identification scheme: building, floor, room number, sensor type (e.g., “BLDG-A-FL2-RM215-PIR”)
Zone type assignment in the panel::
- Entry / exit delay: doors used as part of the arming and disarming workflow; allow time to enter and disarm or exit after arming
- Interior follower: sensors that should only trigger after the entry door has been opened and the entry delay has elapsed; PIR sensors in the entry path
- Instant: immediate alarm on detection; perimeter doors and windows, glassbreaks
- 24-hour: always armed, regardless of system state; smoke, panic, hold-up, tamper
- Day / night: armed only when the system is fully armed (not stay-armed)
- Bypassable: can be bypassed by the user for legitimate operational reasons
- Non-bypassable: cannot be bypassed; panic, tamper, smoke
One sensor per zone for institutional work (no zone doubling); allows precise alarm location
Zone wiring: 2-wire supervised loop with end-of-line resistor pair
Zone identifier matched on the panel, the as-built drawing, the central station’s response sheet, and the institutional user training material

Supervised zone wiring

When the rule applies

Every zone on the install. Supervised wiring lets the panel detect not just alarm/normal state but also tamper conditions (cut wire, short, removed sensor).

The spec

// EOL RESISTOR SUPERVISION

Two end-of-line resistors per zone: one in series with the sensor’s alarm contact, one across the contact
Resistor values per the panel manufacturer’s specification (typically 2.2 kΩ and 4.7 kΩ, or 1 kΩ and 1 kΩ depending on the panel)
EOL resistors mounted at the sensor end of the loop, not at the panel end (so a cut anywhere on the loop is detected)
Zone states detected::
- Normal (sensor closed): one resistor value (e.g., 2.2 kΩ)
- Alarm (sensor open): both resistors in series (e.g., 6.9 kΩ)
- Short circuit (line shorted): 0 Ω
- Open circuit (line cut): infinite Ω
Cable: minimum 22 AWG twisted-pair for short runs, 18 AWG for longer runs or higher-noise environments
Cable jacket: plenum-rated where the route is through plenum (chapter 07)
Conduit and pathway per chapter 02

Field note

Central station monitoring

When the rule applies

Every monitored intrusion install. The central station (sometimes called a monitoring station, signal receiving centre, or SRC) is the third-party service that receives the panel’s alarms and dispatches the appropriate response.

The spec

// CENTRAL STATION REQUIREMENTS

Central station ULC-S301 listed for fire alarm or ULC-S302 listed for burglar alarm
Verify the central station’s current listing at the start of every project; listings can lapse or change scope
Service level: ULC Active (5-second response), ULC Standard (30-second response), or institutional preference
Communication path: IP primary (encrypted, supervised at minimum every 200 seconds), cellular secondary (encrypted, supervised at minimum every 200 seconds for dual-path)
Account: the institution holds the account; the integrator is the installer of record, not the account holder
Response plan: who is called, in what order, for what alarm type; updated at every personnel change at the institution
Test schedule: panel reports a periodic supervisory test signal (typically every 24 hours) to the central station; missing test signals generate an alert
Annual inspection: per CAN/ULC-S302, including a full functional test of every zone and a verified test signal to the central station

Field note

False alarm reduction

When the rule applies

Every monitored install. False alarms degrade the institution’s response: the central station ignores them, the police down-prioritise the address, and the system loses its institutional credibility. False-alarm reduction is design discipline, not after-the-fact tuning.

The spec

// FALSE ALARM REDUCTION

Dual-technology motion detectors in areas with documented false-alarm sources (HVAC airflow, fluorescent fixtures, sun warming)
Pet-immune PIRs in spaces where small animals are present (some institutional environments include service animals or wildlife)
Glassbreak sensors with frequency analysis (not just acoustic threshold) to reject non-glass sounds
Entry-exit delay sized to the realistic disarming time, not the minimum panel value (typical 30 to 60 seconds entry, 45 to 90 seconds exit)
Verified alarm protocol: panel reports the initial alarm and any subsequent zone activations within a defined window; central station responds only after two confirming events for non-critical zones, or immediately for critical zones (panic, hold-up, fire)
Cross-zoning: two zones must trip within a defined window before alarm is reported to central station (used selectively, where false-alarm reduction matters more than detection sensitivity)
Operator training: covered in chapter 22; users trained on the difference between bypass, arm-stay, arm-away, and how to cancel an accidental alarm
Annual review of false-alarm statistics with the institutional security team; tune problem zones at every review

Field note

Integration with access control and video

When the rule applies

Most institutional deployments combine intrusion with access control and video on shared infrastructure. The integration determines what the operator sees when an alarm occurs.

The spec

// THE PRACTITIONER POSITION

Intrusion is the supervised loop that tells the institution something is wrong. ULC-S304 listed panel (Bosch B Series institutional default, DSC PowerSeries for smaller installs), one sensor per zone with EOL resistor supervision at the sensor end. Dual-technology motion in spaces with false-alarm sources. Optex outdoor and perimeter sensors where the false-alarm rate at the perimeter matters; Optex REDSCAN where the budget supports laser-perimeter detection. Dual-path encrypted IP and cellular communication to a ULC-S301 or S302 listed central station. Build false-alarm reduction into the design, not into post-install tuning. Get the design right and the system catches the events that matter; get it wrong and the institution pays false-alarm fees while the system credibility erodes.