Correlate an intrusion alarm, access event and video record without inventing a cause. Identify evidence gaps. Plan an authorized, coordinated follow-up that preserves safe egress and protects records.
This is an original fictional office training case, not a live investigation. Door D-12 appears in an approved schedule with reader R-12, intrusion zone Z-12 and camera C-12. A report says the intrusion system generated an alarm even though an access event was recorded near the same time.
You have read-only training records, not permission to change equipment. The building is an ordinary office; do not apply this example as a locking design for detention or other special occupancies.
Access record: R-12, 10:00:00, access granted. Intrusion record: Z-12, 10:00:02, zone alarm. Video index: C-12, 09:58:00, visible door movement. All dates and displayed time zones are the same. For this exercise, an authorized reviewer independently verified that the access and intrusion clocks agree with the reference and that the camera was exactly two minutes slow throughout the relevant interval.
The camera view does not clearly identify the person. No approved integration sequence, zone programming export or door-input trace has yet been supplied. Treat those items as missing, not as proof of a fault.
Use the approved door schedule and device records to connect physical D-12 with the three records. A similar name or a camera thumbnail is not sufficient when IDs conflict. Record the source revision and any uncertainty.
If C-12 actually points at another opening, its footage cannot establish D-12's movement. If a zone is a group of contacts rather than the single door, document that scope. Do not quietly rewrite the map to fit a preferred explanation.
Retain all original timestamps and exports. Add a separate analytical column for reference time, the offset applied and the evidence supporting that offset. Do not overwrite source timestamps or alter original video to make the timeline look cleaner.
Given the exercise's verified stable offset: 09:58:00 + 00:02:00 = 10:00:00. The intrusion event follows that normalized time by two seconds.
In real work, verify time zone, date, daylight-saving interpretation, clock drift, logging behavior and the relevant interval. A present-day clock check alone does not prove an identical historical offset. Network synchronization being configured also does not prove that it was functioning.
The access record establishes that the controller recorded a grant. It does not by itself prove who passed, whether the door moved or whether the intrusion system was supposed to change state.
The intrusion record establishes an alarm event under that system's configured meaning. Without the approved sequence and configuration evidence, do not declare it a false alarm, a defective contact or a failed integration.
The video establishes visible movement within its coverage and limitations. In this exercise it does not identify a person. Aligned timestamps help comparison but do not make a causal connection certain.
A useful finding is: “Records align near 10:00:00 after the documented camera offset. Door identity and expected intrusion/access behavior need confirmation before determining cause.” This is more defensible than “the reader caused the alarm.”
Ask the responsible supervisor for the approved sequence of operation, door and zone mappings, relevant configuration revision, raw event exports and any authorized test history. Ask the owner who may access the video and how it must be retained.
Keep credentials and personal information out of the general training portfolio. Use approved storage, controlled access and the required retention process. A learning exercise does not authorize broad access to customer video or access histories.
A proposed test should identify the task owner, prerequisites, expected inputs and outputs, monitoring notifications, witnesses, stop conditions and restoration checks. Any actual test belongs under the employer's and owner's approved process.
Do not bypass a zone, defeat a door release, alter a lock mode, share an administrator password or force an alarm merely to gather a quick answer. Do not assume an access-control software command establishes safe egress.
Protect the exit route throughout the work. OSHA's workplace exit-route provisions address opening exit doors from inside and avoiding devices that restrict emergency use if they fail, with specified exceptions. The applicable building/fire requirements, approved hardware arrangement and responsible authority still need project-specific evaluation.
Prepare a one-page issue record:
No actual equipment test or restoration has occurred in this fictional exercise.
Axis NTP API: https://developer.axis.com/vapix/network-video/ntp-api/ Supports clock synchronization and status/offset concepts. This exercise uses no API commands and recommends no uncontrolled clock change. OSHA 1910.36: https://www.osha.gov/laws-regs/regulations/standardnumber/1910/1910.36 Supports limited workplace egress principles, not approval of a particular lock design.
Keep the camera's original 09:58:00 entry and add a reference-time column. The independently verified two-minute slow offset means adding 00:02:00, producing 10:00:00. The access grant is also at 10:00:00, and the intrusion alarm at 10:00:02 follows by two seconds. That alignment supports comparing the records, but it supplies neither the expected integration behavior nor a person's identity. The issue record therefore reports the timing and requests the approved sequence, mappings and configuration revision. It does not conclude that the reader caused the alarm or authorize a bypass test.
In a separate paper case, access is logged at 14:20:00 and intrusion at 14:20:04. Video displays 14:21:00, and an authorized reviewer has independently verified that this camera was exactly one minute fast throughout the interval. Preserve the original camera time, calculate its reference time and state one conclusion that the timing cannot establish.
Answer: Subtract 00:01:00 from 14:21:00 to obtain 14:20:00. Intrusion follows by four seconds. Timing alone cannot prove passage identity, expected integration behavior or the cause of the alarm. Request the missing design and configuration evidence.
Mistake: Subtracting two minutes from a camera known to be slow. Correction: A slow camera displays an earlier time; add the verified offset to obtain reference time. Preserve the original value and the evidence supporting the offset.
Mistake: Calling the alarm false because an access grant occurred nearby in time. Correction: A grant is a controller event, not proof of passage or of the intended intrusion response. Compare the approved sequence and relevant records before deciding cause.
Mistake: Bypassing the zone or changing lock behavior to reproduce the complaint without approval. Correction: Route a coordinated test proposal through the responsible supervisor and owner, with notifications, stop conditions and restoration checks. Preserve safe egress throughout authorized work.
Texas journeyman, 15 questions, scored by topic against the 70% mark. No card, and no account needed to start.
Free study material for low-voltage apprentices. This is a national foundation course: requirements differ by state and by local jurisdiction, and a practice that is common in one place is not a rule everywhere. Nothing here is a licence, a certification, or authority to work unsupervised, and completing it does not count as apprenticeship hours or continuing-education credit. Check the codes adopted where you are working, the licensing authority for that work, and your employer's safety programme. VoltMark is not affiliated with, endorsed by, or sponsored by NFPA, OSHA, NICET, BICSI, FOA, or any state or local licensing authority.
Electrician licensing exam prep: practice questions, timed exam simulations, and step-by-step help finding every answer in the NEC.