Intrusion Detection & Central Station Automation

The alarm monitoring industry processes over 38 million alarm signals per year in the United States, of which 95-98% are false. Municipalities respond by imposing escalating false-alarm fines ($100-$500+ per occurrence), verified-response ordinances that require positive confirmation before police dispatch, and in extreme cases, alarm permit revocation after repeated false activations. For alarm monitoring companies, each false dispatch represents not just a fine but erosion of subscriber trust, police department cooperation, and brand reputation.

Traditional central station operations rely heavily on human operators following sequential call-down procedures: alarm signal arrives, operator calls the subscriber, waits for answer, calls backup contacts, and eventually requests dispatch if no one responds. This process takes 3-7 minutes per signal and is the primary bottleneck in alarm response. During peak periods (morning arm/disarm cycles, severe weather events), signal queues back up and response times degrade. Operator training, turnover, and fatigue introduce variability in how procedures are followed.

The transition from legacy PSTN (Public Switched Telephone Network) alarm communication paths to IP-based transmission adds complexity. As telecom carriers decommission copper infrastructure, alarm communicators that rely on POTS (Plain Old Telephone Service) lines are losing connectivity. IP-based alarm communication via SIA DC-09 offers superior reliability and richer data payloads, but central station receivers, automation platforms, and operator procedures must be updated to handle the new protocol format and the significantly higher signal volume that IP monitoring enables.

Our automation platform sits between the central station receiver (Sur-Gard, Bosch, DICE/Osborne-Hoffman) and the operator workstation, intercepting raw alarm signals and applying intelligent processing before presenting events to operators. The first layer is signal normalization: Contact ID signals received via SIA DC-07 (DTMF over IP) and SIA DC-09 (SIA IP protocol with AES encryption) are decoded and mapped to a unified event schema. Each signal is enriched with subscriber metadata, site zone maps, alarm history, and applicable jurisdiction ordinance requirements.

The second layer is verification automation. For subscribers with video-enabled alarm systems, the platform automatically retrieves associated camera feeds (via ONVIF or alarm.com/Brivo/Eagle Eye API) and presents them to the operator alongside the alarm event, enabling visual verification within seconds of signal receipt. For audio-verified systems, two-way audio from the panel microphone is streamed to the operator console. The system applies sequential zone confirmation logic: a single perimeter zone activation holds for a configurable confirmation window (default 45 seconds), and only escalates to dispatch if a second zone activates or video/audio confirms the event.

The third layer is dispatch automation. When an event is verified as genuine, the system automatically formats a dispatch request per the jurisdiction's requirements—Enhanced Call Verification (ECV) compliance, verified-response documentation, GPS coordinates, subscriber contact information—and transmits it to the PSAP (Public Safety Answering Point) via the appropriate channel. For jurisdictions supporting CAD-to-CAD integration, dispatch requests are transmitted electronically. Post-event, the system generates signal disposition reports for UL 2050 audit compliance, including signal-to-operator time, operator-to-dispatch time, and call-down completion records.

Alarm signal ingestion supports three primary communication paths. SIA DC-07-2001.04 (Contact ID over IP) signals are received via TCP listener on port 12345, decoded from the 16-character DTMF format (ACCT MT QXYZ GG CCC) where ACCT is the subscriber account, MT is message type, Q is event qualifier, XYZ is event code per SIA DC-05-1999.09, GG is group/partition, and CCC is zone/user. SIA DC-09-2007 signals arrive as encrypted ADM-CID (Ademco Contact ID encapsulated in SIA IP protocol) messages over TLS, supporting AES-256 encryption with RSA-2048 key exchange. Legacy Sur-Gard receiver integration captures signals via the receiver's output API for sites that have not migrated to direct IP communication.

The video verification subsystem integrates with camera systems through multiple paths. For commercial alarm panels with integrated video (DMP, Honeywell, DSC), the platform connects via the panel manufacturer's cloud API to retrieve clips triggered by zone activation. For standalone camera systems at alarm-monitored sites, the ONVIF Profile S interface pulls snapshots or RTSP streams from cameras associated with the alarming zone. The system maintains a zone-to-camera mapping that is configured during site setup and supports multiple camera associations per zone. Video is displayed in the operator interface within 8-12 seconds of alarm signal receipt, with automatic keyframing to the moment of zone activation.

Dispatch automation formats requests per the jurisdiction's alarm ordinance requirements, which are stored in a PostgreSQL database maintained by the monitoring company's compliance team. The system supports Enhanced Call Verification (ECV) as defined by ASAP-to-PSAP (Automated Secure Alarm Protocol) for agencies participating in the TMA ASAP program, transmitting CAD-ready dispatch requests in ANSI/APCO 2.103.2 format. For non-ASAP jurisdictions, the system queues dispatch calls with scripted operator prompts that include the required ordinance-specific information (alarm permit number, verification method used, subscriber contact status). All signal processing timestamps are recorded with millisecond precision for UL 2050 compliance reporting, which requires documented signal-to-operator times and operator-to-dispatch times for each event.