ANVILFIELD Try FieldOS

Electrical

Intrusion alarm system installation and design field guide

Design the detection layers and place the sensors to catch a real entry without the false alarms, then run dual-path signaling, verification, and a walk test.

Intrusion AlarmFalse Alarm ReductionAlarm VerificationCentral Station MonitoringSecurity

Direct answer

An intrusion alarm system detects unauthorized entry through layered sensors, door and window contacts, motion detectors, and glassbreak, reports it at a keypad and a central station, and signals a response. It lives or dies on false-alarm control, and the manufacturer, the monitoring station, and the local alarm ordinance control the specifics.

Key takeaways

  • Intrusion alarm is a security system, not life-safety fire; it falls under NFPA 731 (which calls for two independent power supplies), not NFPA 72.
  • Over 90 percent of traditional intrusion alarm activations are false, so design false alarms out with placement and dual-tech sensors rather than tuning them after handover.
  • Mount motion detectors away from HVAC registers, heat sources, and direct sun, at the manufacturer's height (commonly 7 to 8 ft), so an intruder crosses the field of view.
  • Enhanced call verification (ECV) requires the central station place at least two calls to different account numbers before requesting a police dispatch.
  • Run a supervised dual-path communicator over cellular and IP; POTS phone lines are retired and a single line is easily cut at the demarcation.

What an intrusion alarm system is, and why a system that cries wolf gets dropped

An intrusion alarm system detects an unauthorized entry, reports it, and signals a response. Strip the brand names off and every system is the same handful of parts: a control panel that holds the logic and the zones, a keypad to arm and disarm it, the sensors that catch the entry, a sounder that makes noise on site, and a communicator that carries the signal off premises to a central station. The sensors fall into two camps, perimeter and interior, and the design is the order they catch an intruder in.

The part nobody sells you on is the one that decides whether the system survives. A system that cries wolf gets ignored. Trip on the cleaning crew, a delivery, a balloon riding an HVAC draft, or a spider on a motion lens, and three things happen in order: the staff stop trusting it and prop the door or leave it disarmed, the city starts fining the false dispatches, and the police drop the address down the priority list or off it entirely. The detection worked. The system still failed.

So the real work is not picking sensors off a catalog. It is designing the layers, placing the sensors, setting the arming, and building the verification so the system catches a real entry and stays quiet on everything else. This guide is the security side. Video surveillance is covered in the video surveillance and CCTV system design guide, and life-safety fire detection, a different system under different code, is covered in the fire alarm installation and testing guide.

Intrusion is security, not life-safety fire

Intrusion and fire are two different systems, and treating them as one is the fastest way to get both wrong. An intrusion alarm protects property and people from an intruder. A fire alarm protects life from fire and smoke. They detect different things, answer to different codes, and carry different consequences when they fail.

The code split is the clean line. Fire alarm is life-safety equipment governed by NFPA 72, with a required 100 percent acceptance test, supervised circuits the AHJ signs off on, and rules written so a silent failure is never allowed. Intrusion is a security system. It is not life-safety, it is not NFPA 72. The NFPA document that does cover it is NFPA 731, the standard for the installation of electronic premises security systems, which among other things calls for two independent power supplies, but the authority that cares about it is usually the police department through a local alarm ordinance, not the fire marshal. A fire signal gets an unconditional emergency response. A burglar signal, in most cities now, gets verified before anyone rolls.

Keep the two physically and logically separate. They can share a building and even an integration platform, but the intrusion side must never interfere with the fire side, and a panic or holdup signal is a security function rather than a fire function. The fire alarm installation and testing guide covers that system in full. This guide stays on the security side of the wall.

The parts and what each one does

Every intrusion system is built from the same parts, and knowing what each one does keeps the design honest. The panel is the only piece with judgment. Everything else either feeds it, announces it, or carries it offsite. Spend the budget on the parts that catch the entry and the part that gets the signal out, not on a fancy keypad.

PartRoleField note
Control panelHolds the logic, the zones, the user codes, and the arming stateThe brain; mount it hidden, not by the door an intruder reaches first
Keypad / interfaceArms and disarms, shows status and trouble, runs panic keysThe one part users touch; a second keypad at a back door is common
Door/window contactsPerimeter sensors that report an openingThe first layer; catch entry at the skin of the building
Motion detectorsInterior sensors that report movementThe second layer; PIR or dual-tech, placed to ignore false sources
Glassbreak / shockCatch breaking or struck glassCover the windows the contacts do not, and the safe
Sounder / sirenMakes noise on site to deter and alertInterior piezo plus an exterior bell or horn where allowed
CommunicatorCarries alarm, supervisory, and trouble signals offsiteCellular plus IP dual path; this is the link to help
Backup batteryRuns the panel when utility power dropsSized for the standby hours required, and supervised

Detection layers: perimeter, interior, and the trap

Detection works in layers, and the layers are the design. The perimeter layer catches an intruder entering: door and window contacts on every opening that can be forced, glassbreak on the glass. The interior layer catches an intruder moving once inside: motion detectors covering the spaces they have to cross to reach anything worth taking. Perimeter is the first warning. Interior is the backstop.

You run both because each covers the other's miss. Perimeter contacts do nothing once a person is inside, and they do nothing against someone who hid until closing. Interior motion does nothing until the intruder is already in and moving, by which point the glass is broken and the door is open. Layer them and you catch the entry early and catch the movement if the entry slips through.

The strongest version of the interior layer is the trap. Place a motion detector on the one path an intruder cannot avoid, the hallway between the back door and the office, the aisle to the safe, the route to the register. A burglar who defeats one perimeter point still has to cross the trap to reach the goods, and the trap is where you catch the ones the skin missed. Design the layers to the building and the target, not to a sensor count.

Door and window contacts: the first layer

Magnetic door and window contacts are the perimeter layer and usually the first sensor on any design. A contact is two parts, a switch and a magnet. The magnet mounts on the moving door or window, the switch on the frame, and when the two separate the panel sees the zone open. On a recessed install the two parts hide in the door edge and the jamb. On a surface install they sit on the face, faster to retrofit and easier to defeat.

Put a contact on every perimeter opening a person can get through: exterior doors, ground-floor and accessible windows, roof hatches, overhead and dock doors, and any interior door to a high-value room. The ones crews skip are the ones that matter, the second man-door at the dock, the window off the flat roof, the gate to the yard.

For higher-security work, a balanced or triple-biased magnetic contact resists the old trick of defeating a simple reed switch with an external magnet held against the frame. On overhead doors use a floor-mounted contact rated for the abuse. The contact is cheap and the install is most of the cost, so spend the install on covering every opening rather than half of them well.

Motion detectors: PIR, dual-tech, and the false sources

Motion detectors are the interior layer, and they cause more false alarms than any other sensor, so they earn the most care in placement. The common type is passive infrared, PIR, which sees the heat signature of a person moving across its field of view. It is accurate indoors and cheap, but it reacts to anything that moves heat across the lens: a forced-air register blowing warm air, sunlight tracking across a floor, a space heater, hot equipment cycling, or a rodent.

Dual-technology detectors pair PIR with microwave and alarm only when both technologies agree. The PIR sees the heat, the microwave sees the motion, and an event that trips only one, the HVAC draft on the PIR or a vibration on the microwave, does not make an alarm. Dual-tech is the default for spaces with the conditions that fool a plain PIR. For sites with animals, a pet-immune PIR or a dual-tech unit ignores a target below a set weight and height.

Placement is where motion detectors are won or lost. Aim them away from registers, glass with direct sun, and heat sources. Mount at the height the manufacturer specifies, commonly 7 to 8 ft, and orient the detector so an intruder crosses the field of view rather than walking straight at it, because PIR is most sensitive across its beams. Confirm the coverage pattern, the mounting height, and the pet-immunity rating against the manufacturer's data sheet for the specific model, because the numbers shift by lens and unit.

Glassbreak and shock sensors

Glassbreak and shock sensors cover the attack the contacts miss: someone breaking the glass instead of opening the door. There are two kinds and they work differently. An acoustic glassbreak detector listens for the specific sound signature of breaking glass, the thud of the impact followed by the high-frequency shatter, and covers every window in a room from one ceiling or wall mount, commonly out to about a 20 to 25 ft radius. A shock or vibration sensor mounts on the glass or the frame and feels the impact directly, so it covers the one pane it is on.

The tradeoff is coverage versus nuisance. One acoustic detector protects a room full of windows, which is cheaper per window, but it can react to other sharp sounds, dishes, thunder, a slammed door, so it wants the sensitivity set and the room considered. A shock sensor is harder to false because it has to feel a real impact, but you mount one per pane, which adds up fast.

Use acoustic on rooms with several windows and shock on a small number of high-value panes or a single critical opening. For a safe or a vault, a shock sensor on the body catches an attack on the container itself, which is a layer the room sensors never see.

Holdup, panic, duress, and environmental sensors

Past the standard sensor types, a few specialty devices cover threats the perimeter and interior layers do not. A holdup or panic device is a manually operated switch a person triggers under threat, at a register, a teller window, or a reception desk. A holdup switch usually signals silently so it does not provoke the robber, sending a priority signal to the central station while the room stays calm. A panic button can be set audible or silent depending on the intent.

A duress code is the software version. It is a valid user code that disarms the system normally on the keypad while sending a silent duress signal offsite, for the case where someone is forced to open up under threat. The system looks disarmed. The central station knows it is not.

Environmental sensors ride on the same panel because the wiring and the monitoring are already there. Low-temperature sensors catch a failed heating system before pipes freeze, water sensors catch a leak in a server room or a basement, and high-temperature or humidity points protect sensitive spaces. None of these are intrusion detection, but the panel that already calls a central station is a cheap place to add them.

The control panel, the zones, and the programming

The control panel is the only part of the system with judgment, and the design lives in how it is programmed. Physically it is a board in a metal can with the power supply, the battery, the zone terminals or the addressable loop, and the communicator. Logically it holds the zones, the partitions, the user codes, the arming schedules, and the rules that decide what each input does.

A zone is an input the panel watches, mapped to a sensor or a group of sensors and given a type that sets its behavior. An entry-exit zone runs the delay timer so the front door does not alarm the instant you open it. A perimeter zone alarms immediately. An interior zone is bypassed in stay mode so you can move around inside while the skin is armed. A 24-hour zone, like a holdup or an environmental point, is always live regardless of arming. Get the zone types wrong and you get either false alarms or holes.

Mount the panel out of sight and out of reach. The classic mistake is putting the panel, or worse the only communicator, where an intruder reaches it inside the entry delay, so a smash of the panel kills the signal before it goes out. Hide the panel, run the keypad separately, and on higher-security jobs use a panel that reports a crash-and-smash attempt before the delay expires.

Arming modes, delays, partitions, and codes

Arming is how the user tells the system what to watch, and the modes exist so the building can be occupied or empty without fighting the alarm. Away mode arms everything, perimeter and interior, for an empty building. Stay mode arms the perimeter but bypasses the interior motion so people can move around inside without tripping it. The two modes are the difference between a closed store and a back office working late.

The entry and exit delays make the system usable. Exit delay gives the last person out a set time to leave through the designated door after arming without an alarm. Entry delay gives the first person in a set time to reach the keypad and disarm before the alarm trips. Set these too long and an intruder has a free window. Set them too short and you generate false alarms from your own staff. The SIA CP-01 control panel standard exists largely to set sane defaults for these timers, and a CP-01 listed panel is worth specifying for that reason.

Partitions split one panel into independent areas, each with its own keypad, codes, and arming state, for a multi-tenant building or a business with separate areas that keep different hours. User codes tie an arm or disarm to a person, so the log shows who opened up and when. Give each user a unique code, never a shared one, because the audit trail is worthless when everyone uses 1234.

What causes false alarms, and why they sink the system

False alarms are the single biggest problem in the trade, and they come from three places: the user, the install, and the environment. User error leads the list, an employee who forgets the code, props an armed door, or never learned stay mode. Bad installs are next, a contact that drifts out of alignment, a motion detector aimed at a register vent, a sensor mounted where a door slams it. The environment fills out the rest, sun, HVAC drafts, balloons and signage moving on air currents, insects on a lens, and rodents.

The cost is not just the nuisance. A false alarm wastes a police response on nothing, and cities answer by fining the address, escalating the fine with each repeat, and eventually refusing to respond at all until the alarm is verified. Industry figures have long put the false rate on traditional intrusion alarms above 90 percent of all activations, which is exactly why the response model changed. The damage on site is quieter and worse: staff stop trusting the system, leave it disarmed, and the building you were paid to protect runs open.

You design false alarms out, you do not tune them out after the fact. Dual-tech motion in the wrong spots, contacts mounted to stay aligned, sensitivity set for the room, entry-exit delays matched to how the staff actually move, unique user codes, and training at handover. The verification layer below catches what the design misses, but the design comes first.

What is alarm verification?

Alarm verification is the step between a tripped sensor and a police dispatch, and it is the modern standard because police will no longer roll on an unverified burglar signal in most places. The baseline is enhanced call verification, ECV. Before the central station requests a dispatch, the operator places at least two calls to different numbers on the account, trying to reach a responsible party who can confirm the alarm is real or cancel it. ECV alone cuts false dispatches sharply and is required by many ordinances.

Video verification is the stronger form and where the trade is heading. The alarm event pulls up the camera on that zone, and a monitoring operator looks at live or recorded video to confirm an actual intruder before requesting police. A verified alarm, one a human has confirmed is real, gets treated as a priority call, where an unverified one gets a low priority or no response. The TMA AVS-01 alarm validation scoring standard formalizes how monitoring centers grade and communicate that confidence to dispatchers.

This is the cleanest reason to tie the intrusion system to the cameras, covered in the video surveillance and CCTV system design guide. The exact verification procedure, the call sequence, and the dispatch priority are set by the monitoring station's protocol and the local police policy, so confirm them with the central station and the AHJ for the jurisdiction rather than assuming a response that may not come.

The communicator: cellular and IP, because POTS is dead

The communicator is the part that carries the alarm off the property, and a system that detects an intrusion but cannot report it protects nothing. It sends three kinds of signal to the central station: alarms, supervisory signals, and trouble signals. For decades it dialed out over a POTS phone line. That path is effectively dead. Copper phone service is being retired, VoIP and digital lines break the old dialer in ways nobody notices until the test fails, and a single phone line was always easy to cut at the demarcation outside the building.

The current standard is a dual-path communicator over cellular and IP. The cellular path uses an LTE or 5G radio to a carrier network. The IP path rides the building's internet connection. Run both and a failure of one, a cut internet line, a cellular dead spot, leaves the other carrying the signal. Each path is supervised on its own, so the central station knows within a set window if either one drops.

The point of dual path is that no single failure should silence the system, and a cut line is the classic single failure. Confirm the supervision interval, the cellular carrier coverage at the actual address, and the listing of the communicator for the grade of service the job requires with the manufacturer and the monitoring station, because those numbers and the acceptable paths are set by them and by any ordinance, not by habit.

Signaling paths, supervision, and the cut line

Signaling is the path the communicator uses and how the system proves the path is alive. The two paths in a modern install are cellular and IP, and the design choice is single path versus dual path. A single path is cheaper and is sometimes acceptable for low-risk premises, but it has one failure that ends monitoring, and for anything worth alarming, dual path is the call.

Supervision is what separates a monitored alarm from hope. The communicator and the central station exchange a heartbeat on a set interval, and if the signal stops, the central station raises a trouble condition and someone investigates. Without supervision a cut path is silent until the next real alarm fails to arrive, which is the worst possible moment to learn the line was dead. The line-cut case is exactly why supervised dual path replaced the unsupervised single phone line.

The supervision interval, the acceptable paths, and the grade of signaling required all depend on the protection level the job is rated for and any insurance or ordinance requirement. Pull those numbers from the monitoring station, the manufacturer's listing, and the AHJ or insurer, because the right answer for a jewelry store is not the right answer for a warehouse, and the standard that governs the grade is set above the installer.

The central station and the monitoring

The central station, more formally the supervising or monitoring station, is the staffed facility that receives the signals and acts on them. Operators are on duty around the clock. A signal arrives, the operator reads the account, runs the verification procedure, and either dispatches police, calls the responsible parties on the call list, or clears it as a known event. The system you install is only as good as the station behind it.

For commercial work that has to meet an insurance or specification requirement, the station should be UL-listed under the central-station alarm service standard, UL 827, which sets the requirements for the building, the standby power, the staffing, the signal handling, and the record-keeping. A listed station is audited against those requirements; an unlisted one is a phone in a room. The grade of service, the response time, and the runner or guard requirements depend on the protection level the account is written for.

The call list and the dispatch instructions are part of the install you hand over, not an afterthought. Get the current responsible parties, their numbers in priority order, the duress and cancel procedures, and the police and ordinance details on file with the station, and keep them current. A perfect detection system dispatched against a five-year-old phone list fails at the last step. Confirm the station's listing, response procedure, and verification protocol with the monitoring provider.

Panel power and battery backup

The panel runs on utility power through a transformer, with a backup battery that takes over when the power drops. Both have to be right or the system fails in the dark, which is exactly when a smart intruder kills the power. The transformer feeds a low-voltage supply that runs the panel and charges the battery, and the panel supervises the battery so a dead or missing one shows as a trouble.

The battery is sized for a standby period: how long the system has to run on battery alone, plus enough left to sound the alarm at the end of it. The required standby hours depend on the application and any listing or ordinance the job is held to, so size the battery to the calculated load over that period rather than to whatever fits the can. A battery that holds the panel for the rated standby when new will not hold it after a few years, which is why the battery is on the maintenance schedule.

Supervision is the part that makes the backup trustworthy. The panel tests the battery and reports a low or failed one as a trouble signal, and the communicator carries an AC-loss signal so the central station knows the building lost power. A backup that nobody knows has failed is the same as no backup, and a dead battery is one of the most common findings on a system that was never maintained.

Wired or wireless alarm sensors?

Wired and wireless sensors both work, and the honest answer is that the building usually decides. A wired sensor runs on cable back to the panel, draws its power from the panel, and is supervised by the wiring itself, so it has no battery to die and a tamper or a cut shows up as a trouble. Wired is the durable choice for new construction where the walls are open and you can pull the cable cheaply.

Wireless sensors talk to the panel over an encrypted radio link and run on batteries. They install in a fraction of the time with no fishing of cable, which makes them the practical choice for a finished building, a retrofit, a leased space, or any opening that is hard to reach. The cost is the battery and the supervision: each device carries a battery that runs a few years and then has to be changed, and the panel supervises the radio link so a dead device or a jammed band reports as a trouble rather than going silent.

Most commercial jobs end up mixed. Existing buildings often have usable cabling for the main points, and wireless fills in the additions and the awkward openings. The supervision interval, the battery life, and the encryption all vary by product line, so confirm them with the manufacturer, and on a wireless job put the battery changes on the maintenance schedule before the first one dies.

Integrating with video and access control

An intrusion system is worth more tied to the other security on the building than standing alone. The integration that pays for itself first is video. Link the alarm zones to the cameras and an alarm event pulls up the picture, which is what makes the video verification above possible and is the reason police will treat the call as real. The cameras, their resolution, and their placement are covered in the video surveillance and CCTV system design guide; the intrusion side needs the zone-to-camera mapping and the link to the monitoring station.

Access control is the other common tie-in. When access control and intrusion share a platform, a valid badge can disarm the area the cardholder is entering, a forced or held-open door raises an alarm, and the same credential database runs both, so a terminated employee loses access and arming rights at once. That removes the shared-code problem and gives one audit trail across both systems.

Integration runs on a platform, and the platforms vary in what they actually support across brands. Confirm the specific integration, the supported events, and the listing implications with both manufacturers before you promise it, and keep the security side from ever interfering with the life-safety fire system, which stays separate per the fire alarm installation and testing guide.

The local alarm ordinance and the permit

The local alarm ordinance is the rule that decides whether the police respond at all, and it is the part installers skip and owners get burned by. Most cities now require the alarm registered or permitted with the police or a third-party administrator before they will dispatch on it. No permit, no response, and often a fine on top. The permit ties the address to a current call list and gives the city a way to bill the false alarms.

The false-alarm penalties escalate. A typical ordinance allows one or two free false alarms a year, then fines each one after, with the fine climbing on each repeat, and many cities cut off police response entirely after a set number of false alarms in a permit year until the account is cleared. Some jurisdictions have gone further to verified response, where they will not dispatch on a burglar alarm at all unless it is verified by video, audio, an eyewitness, or a panic button.

Register the system and hand the owner the permit, the renewal date, and the false-alarm rules at closeout. The specific permit requirement, the fine schedule, the false-alarm threshold, and whether the city runs a verified-response policy all vary by jurisdiction, so confirm them with the local police department or alarm administrator and the AHJ for the address, not from a guide. This is the step that turns a working system into one that actually gets a response.

UL listings, CP-01, and the grade of protection

Intrusion work has its own standards, and on jobs where insurance or a specification calls for a graded system they decide what equipment and what station qualify. The installation and classification of burglar and holdup alarm systems is covered by UL 681, which sets the extent of protection on the premises, the safe, or the vault. The central-station alarm service is covered by UL 827, which lists the monitoring station itself. The burglar-alarm units used in those systems fall under UL 1610, the central-station burglar-alarm unit standard. The amount of protection installed is graded, and an insurer or a high-value contract can require a specific grade with a UL certificate to back it.

On the false-alarm side, the SIA CP-01 control panel standard, recognized by ANSI, sets the panel features that reduce false alarms: sane exit and entry timing, an abort window, swinger shutdown that stops a chattering zone from dialing forever, and clear arming feedback. Specifying a CP-01 listed panel builds those protections in rather than leaving them to programming.

Where a system has to be UL-certificated, the certificate is only valid while the install, the equipment, and the monitoring all meet the standard, and it has to be maintained. Confirm the required grade, the certificate, and the listing of the equipment and the central station with the manufacturer, the monitoring provider, the insurer, and the AHJ, because the grade required is set by the risk and the contract, not by the installer.

Commissioning and the walk test

Commissioning is where you prove the system on the actual building, and a walk test is the heart of it. Put the panel in test mode so it logs without dispatching, then walk every zone and trip every sensor by hand. Open each contact, cross every motion detector through its real coverage, set off each glassbreak with a tester, and confirm the panel names the right zone for each one. A sensor that reads on the wrong zone is a sensor that sends the police to the wrong part of the building.

Test the arming the way the staff will use it. Arm away and arm stay, confirm the interior zones bypass correctly in stay, walk the entry and exit delays with a watch to confirm the timers, and try a user code and a duress code so you know the duress path actually signals. Then confirm the signal end to end: trip an alarm and have the central station confirm they received it, on each communication path, and that the account, the zone descriptions, and the call list on their side match the building.

The step crews shortcut is hunting the false-alarm sources before handover instead of after the first dispatch. Stand in each space during a real HVAC cycle, check the motion detectors against sun and registers at the worst hour, and fix the placement now. A system that was never walk-tested is a system whose first real test is an actual break-in, and that is the wrong time to find the contact that never worked.

Maintenance and the annual test

A security system degrades quietly, and the day of the break-in is the worst day to discover a dead sensor. Set a maintenance cadence instead of waiting for a failure. The common interval is an annual inspection and test, with higher-grade or insured systems on a tighter schedule set by the listing or the policy.

Each visit, test the sensors and the arming the same way commissioning did, on a walk test, and confirm the signal still reaches the central station on every path. Check and load-test the backup battery, because a battery that held the rated standby when new fades over a few years and is one of the most common dead parts found. Change wireless sensor batteries on schedule before they fail. Clean and realign contacts that have drifted, and check motion detectors for new false sources, a register that got rebalanced, a display that now reflects sun, a seasonal sun angle that did not exist at install.

Keep the call list current at every visit, because people leave and numbers change, and a verification call to a disconnected number is a dispatch that does not happen. Confirm the permit is current and the false-alarm count is clean. The annual is also when you catch the slow drift, the propped door that became a habit, the zone someone bypassed and never restored.

What to document

The record is what makes the system maintainable and what answers the questions after an incident, and a field tool such as FieldOS keeps the zone list, the device schedule, the codes, the central-station account, and the test history in one place instead of scattered across a panel printout, an email, and somebody's memory. Capture enough that the next technician and the owner can run, test, and defend the system.

Record each zone and the device on it with its location and type, the arming partitions and the user-code assignments, the central-station account number and the current call list, the communicator paths and supervision settings, the battery size and standby rating, the permit number and renewal date, and the walk-test results with the date and who ran them. Tie the grade and any UL certificate to the document that required it, so the next person knows why the system is built the way it is.

ZoneDeviceNote
01Front entry door contactEntry-exit, delay set to staff walk time
02Lobby dual-tech motionInterior, bypassed in stay, aimed off the window
03Back office glassbreakAcoustic, covers three windows, sensitivity set for room
04Safe shock sensor24-hour, mounted on the safe body
05Register holdup24-hour, silent, priority dispatch
06Server room low-temp and water24-hour environmental, not intrusion
07Dock overhead door contactFloor-mounted, rated for the abuse

Common mistakes

  • A false-alarm-prone install that staff stop trusting and leave disarmed.
  • A single signaling path that a cut line or a lost internet connection defeats silently.
  • No alarm verification, so the police treat the signal as low priority or do not respond.
  • Motion detectors aimed at HVAC registers, heat sources, or direct sunlight.
  • A backup battery that was never load-tested and no longer holds the rated standby.
  • Never walk-testing, so a sensor on the wrong zone or a dead contact is found at the break-in.
  • No alarm permit, so the city will not dispatch and fines the activations.
  • The panel or the only communicator mounted where an intruder reaches it inside the entry delay.

Field checklist

0 of 10 complete

Want this checklist to run itself on every job — with photo proof and a signed record crews can hand the customer? That's FieldOS.

Standards and references

Intrusion design pulls from several authorities, and the honest move is to cite the one that controls the point and hedge the rest to the people who own it. The installation and classification of burglar and holdup alarm systems is governed by UL 681, the central-station service by UL 827, and the burglar-alarm units by UL 1610. False-alarm control on the panel side follows the SIA CP-01 control panel standard recognized by ANSI, and the validation scoring that monitoring centers use to grade verified alarms follows the TMA AVS-01 standard. Cite these by topic and confirm the edition and the required grade against the project, because the grade is set by the risk and the contract.

The verification procedure, the signaling paths and supervision intervals, and the equipment listings are the manufacturer's and the monitoring station's territory, so confirm the call sequence, the dispatch priority, the acceptable paths, and the listings with them, not from a guide. The local alarm ordinance, the permit, the false-alarm fine schedule, and any verified-response policy are set by the police department or alarm administrator and the AHJ for the address, and they vary enough that you confirm them for the jurisdiction every time.

Design the false alarms out with layered detection and good sensor placement, run dual-path signaling with verification, and walk-test and register the system. The other security on the building sits in the video surveillance and CCTV system design guide, and the life-safety fire detection, a separate system under different code, sits in the fire alarm installation and testing guide.

Units and terms

Intrusion carries its own vocabulary, and the same idea shows up under several names across a panel manual, a drawing, and an ordinance. These are the terms a design hangs on.

A zone is the unit the panel watches; a partition is an independently armed group of zones. Arming away covers the whole building, arming stay covers the perimeter only. The communicator and its paths are the link offsite, and verification is the step that turns a signal into a dispatch. Keep the layer, the zone type, and the arming attached to every device and the rest of the design follows.

Intrusion alarm system
Layered sensors that detect an unauthorized entry, report it at a keypad and a central station, and signal a response; a security system, not life-safety
Perimeter vs interior detection
Perimeter catches entry at doors and windows; interior catches movement inside with motion detectors; layered so each covers the other's miss
PIR / dual-tech motion
PIR senses a moving heat signature; dual-tech adds microwave and alarms only when both agree, which cuts false alarms from HVAC and sun
Glassbreak / shock
Acoustic glassbreak hears breaking glass across a room; shock senses impact on the single pane or safe it is mounted to
False alarm / ECV
A signal with no real intrusion; enhanced call verification places at least two calls to different numbers before a dispatch is requested
Verification
Confirming an alarm is real, by call or video, before police respond; a verified alarm gets priority, an unverified one may get none
Communicator / dual path
The device that carries signals offsite over cellular and IP; dual path so a failure of one does not silence the system
Central station
The staffed, often UL-listed station that receives signals, verifies them, and dispatches per the call list

Related tools

Calculators and readiness checks for this work

Compare your options

FAQ

What is an intrusion alarm system?

An intrusion alarm system is the monitored, supervised network of sensors, a control panel, and a communicator that detects a break-in and reports it offsite. What separates it from a hardware-store alarm is supervision and a central station: a cut line or a dead sensor shows as a trouble, and a real alarm reaches someone who dispatches help.

What causes false alarms?

False alarms come from the user, the install, and the environment: a forgotten code or a propped door, a drifted contact or a motion detector aimed at a vent, and sun, HVAC drafts, balloons, or insects. Over 90 percent of traditional alarm activations are false, which is why you design them out with placement and dual-tech sensors.

What is alarm verification?

Alarm verification is confirming a burglar signal is real before police are dispatched. Enhanced call verification has the central station place at least two calls to different numbers first. Video verification has an operator look at the camera on the zone. A verified alarm gets priority response; an unverified one may get a low priority or none.

Wired or wireless alarm sensors: which is better?

Wired sensors draw power from the panel and are supervised by the cabling, with no battery to die, which suits new construction. Wireless sensors install fast on a radio link and fit retrofits and finished buildings, but each runs on a battery you replace every few years. Most commercial jobs mix the two. Confirm supervision with the manufacturer.

Why won't the police respond to my burglar alarm?

Most cities require the alarm registered or permitted with the police before they will dispatch, and they fine false alarms on an escalating schedule, often cutting off response after a set number. Some jurisdictions only dispatch on a verified alarm. Register the system and confirm the permit and false-alarm rules with the local police or alarm administrator.

What is the difference between arm away and arm stay?

Arm away covers the whole building, perimeter and interior, for when it is empty. Arm stay covers the perimeter but bypasses the interior motion so people can move around inside without tripping it, for an occupied back office or an overnight closing. The entry and exit delays let staff come and go through the designated door.

Do I still need a phone line for an alarm system?

No. The POTS phone line that alarms used for decades is being retired, and a single line was always easy to cut outside the building. The current standard is a dual-path communicator over cellular and IP, each path supervised on its own, so a failure of one does not silence the system. Confirm carrier coverage at the address.

Where should a motion detector not be placed?

Keep motion detectors away from HVAC registers, heat sources, and windows with direct sun, because a plain PIR reacts to moving heat and false-alarms on all three. Mount at the manufacturer's height, commonly 7 to 8 ft, and aim the detector so an intruder crosses the field of view rather than walking straight at it.

What is the difference between an intrusion alarm and a fire alarm?

An intrusion alarm protects property and people from an intruder and answers to the local police through an alarm ordinance. A fire alarm protects life from fire and smoke under NFPA 72, with the fire marshal in charge. They are separate systems under separate code, and the security side must not interfere with the fire side.

What is enhanced call verification (ECV)?

Enhanced call verification, ECV, is a monitoring procedure where the central station places at least two calls to different numbers on the account before requesting a police dispatch, to reach someone who can confirm or cancel the alarm. It cuts false dispatches sharply and is required by many alarm ordinances. The exact sequence is set by the monitoring station.

People also ask

Codes cited in this guide

This guide is written and reviewed against the published standards below. Always confirm the current adopted edition with the authority having jurisdiction.

NFPA 72NFPA 731UL 1610UL 681UL 827