View single post by agenor
 Posted: Friday Nov 29th, 2013 11:58 am
 PM  Quote  Reply  Full Topic 
agenor



Joined: Thursday Apr 21st, 2011
Location: Rijeka, Croatia
Posts: 86
Status: 
Offline

  back to top

Yesterday we experienced very strange behaviour on one of our installations.

The system is a 9000 ultra, with 3 SEMs and 3 LEMs (altogether 56 zones and only several home automation outputs for remote control), UCM/GSM, 1 KP06, and 1 KT03. Panel and every SEM has its own power supply and battery.

The system is configured via a UCM/Eth02 that we bring with us every time.

Previously to this problem the system had a series of problems with UCM/GSM and with occasional false alarms occuring from different PIR, smoke and window magnet sensors all around the house. False alarms occur from time to time and are not related to any single SEM, or part of the house, etc.

Yesterday, a housekeeper entered the house as usually, tried to key in his regular user code at the KT03, by the front door, but the panel did not accept it. It continued to count the entry delay time. The housekeeper went down the hall to the garage and tried to key in the same code at the KP06 in the garage, with the same result. After trying too many times, he triggered a signin tamper, approximately at the same time that the sirens started.

As the sirens kept sounding, and he couldn't disarm the system, he (I don't know how) simply bypassed all the zones in the house so the sirens stopped.

The next morning we came in to see what happened.

All user codes were deleted from the system. The two window magnet zones that previously made a false alarm now and again - were now permanently open (the zones are open although the windows are actually closed).
I cancelled the signin tamper using the default code *1234# twice.
We downloaded the event log and made a full backup of the panel (for analysis) and then made a partial download of the user codes back into the panel.

Then we tried to test the system. It was working, but it was very laggy and unresponsive. I.e. - I press the night mode, and then it takes about 5-10 seconds until the touch-screen announces the open zones, I press #, and again it takes about 5 seconds until it announces "Night mode". Then we deliberatly cause an alarm (open a window) and try to key in a user code. After keying in the correct code and pressing #, the sirens are still sounding. 2-3 seconds later, I key in the code again. The sirens are still sounding, the touchscreen says "Wrong code" and then, a second later, the sirens stop, and the system says "security off, thank you, goodbye". I suppose it's because the last digit of the code is 0, so it interpreted a "0" followed by a "#" as "security off" command and then command to stop talking.

Next, we try the same thing again, only, under intruder alarm, I key in the code only once. After about 10 seconds, the alarm stops, and system accepts the signin.

Then we try the same thing from the keypad in the garage (thinking that the lag may be caused by the touch screen unit), but it behaves the same.

Then we go to lunch and an hour later, everythings behaves perfectly??!!

Analyzing the event log, this is where the problems started:

11/27 14:17 Zone Activation # FrontDoor (7)
11/27 14:17 Alarm Type # EntryAlert (10)
11/27 14:17 Sign in - User # 2
11/27 14:18 Delete User # 0
11/27 14:18 Delete Message # All Mailboxes
11/27 14:18 Alarm Type # EntryWarning (21)
11/27 14:18 Alarm Type # Intruder (1)
11/27 14:18 Dial Number # 1
11/27 14:19 Dial Number # 2
11/27 14:19 Alarm Type # SigninTamper (31)
11/27 14:19 Alarm Type # SigninTamper (31)
11/27 14:19 Alarm Type # Intruder (1)
11/27 14:19 Zone Activation # GarageDr (11)
11/27 14:19 Alarm Type # SigninTamper (31)
11/27 14:19 Dial Number # 1
11/27 14:19 Alarm Type # SigninTamper (31)
11/27 14:19 Remote Signin - User # CMS Kissoff
11/27 14:20 Alarm Type # SigninTamper (31)
 


after this last line, comes another dozen of signin tampers then some intruder alarms, then bypassing of all the zones, occasional signintamper, dialling out to the monitoring centre, etc.

But look at the two lines "Delete User # 0" and "Delete Message # All Mailboxes". This is something that he surely didn't do. He hasn't got the clearance for that *and* he doesn't know how to do it. What happened at that moment is - the panel didn't accept his code and he went to the garage to try on another keypad. Going down that hallway there aren't any PIRs to trigger the alarm this whole space is entry zone (hallway between front door and garage, and the garage itself).

If you need a complete event log and/or panel backup, let me know, I can upload it for you.

Last edited on Friday Nov 29th, 2013 12:00 pm by agenor

 Close Window