2 Genetec Configuration

2.1 Enable RIO Configuration Tab

• Enable the RIO configuration tab in Config Tool for your Cloud Link unit using the following URL command: https://[Unit IP]/Features/DuiRIO/Enabled/Set?value=true, where [Unit IP] is the IP address of your Cloud Link unit.

2.2 Create RIO API User

To ensure the Genetec Synergis Cloud Link is secure, create a specific user account for the RIO API. This user account can limit the access rights of the RIO API calls to the channel.

To create a specific RIO API user:

• In your web browser, go to https://[Cloud link IP]/smc/accountmanagement.html , where [Cloud Link IP] is the IP address of your Synergis unit.
• Log in using the admin credentials.

• Click Add a new user.

• In the Authentication section, enter a username and password for the new user. There are two choices for what permissions this user is granted.
  • Grant user only monitor permission and include an Admin user with "Administrator" and "Can control hardware" permission
  • Grant user all three permissions:
    1. Administrator
    2. Can monitor events
    3. Can control hardware

Admin User	Monitor only user

2.3 Connect SAFR SCAN To Cloud Link

After you create a RIO API user, you need to set up RIO connection. You do so by connecting SAFR SCAN to the Cloud Link device. SAFR SCAN takes care of configuring a necessary hardware in Genetec. The configuration of that hardware is dependent upon the selections made when connecting SAFR SCAN to your Cloud Link device:

1. Open SAFR Desktop
2. Go to Tools menu > Video Feeds
3. Select Edit Operation Settings from the "…" menu for the SAFR SCAN you wish to connect
4. Click on RIO page
   The RIO is disabled by default.
   
5. Enable the RIO connection and configure as follows (settings are explained below):
   
6. Once you enable RIO, you need to set up RIO for the first time. All properties will be preserved for each device and loaded into the dialog upon enabling.
   The parameters in the config box are as follows:

Host Address	Cloud Link device address
Channel name	RIO channel name. This is the name of the SAFR SCAN device that appears on the Genetec config tool. Example above uses the default name of SAFR SCAN but in practice you would want to use a logical name that indicates what door the SAFR SCAN is mounted at.
Interface Address	RIO interface address. This is the address of SAFR SCAN. If left empty, SAFR SCAN's IP Address is used.
User ID	The user ID on the Cloud Link device that was created above. This is used to communicatewith the Cloud Link. See Create RIO API User above for more information.
Password	The password corresponding to the Cloud Link user id above.
Reader Operating Mode	Possible values: "empowered" and "cooperative". Empowered mode The device operates independent of connection to Cloud Link. All cardholders and credentials are loaded on the device and decisions for unlocking door are made locally. This method does not allow for some advanced schedules or panel rules such as two-man-rule. This option requires additional space on the device to store access levels which will reduce its overall capacity depending on the number of access levels. Space required for access levels will reduce the total cardholder limit from the normal 50,000 (mask or no mask) or 100,000 (no masks) models. In this mode, SAFR SCAN acts as a panel. Only in this mode will SAFR SCAN perform actions on the door such as activating the door strike or accepting input signal from a REX (Request to Exit button). Cooperative mode The device defers access control decisions to connected Cloud Link device. Due to the dependence on the Cloud Link device, if connection to Cloud Link is lose, then the function of the device is lost as well. Because access levels do not need to be stored, the device can reach the stated capacity of 50,000/100,000 cardholders. In this mode, SAFR SCAN depends upon the physical access control panel to unlock doors and receive inputs such as REX. This is accomplished by sending person credentials to the Cloud Link device.
Dual Reader configuration	This setting allows a 2nd reader to be configured on the door. Most often this is used to connect an outbound badge reader to the inside of the door. This reader is connected via OSDP. Credentials are validated and door action triggered accordingly. Possible values: "disabled", "primary-in-secondary-out", "primary-out-secondary-in". Disabled - No secondary reader included. primary-in-secondary-out - Primary reader (SAFR SCAN) on the inbound side of door. Secondary (badge only) reader on the outbound side. This is the most common configuration. primary-out-secondary-in - Inverse of above option.
Configure the channel on the host	Check this to create and configure the channel on the Cloud Link device. This should always be set.
Channel admin User ID and Channel admin Password	Optional user id and password for device configuration. This is only needed if the User Cloud Link id and password is only set for monitor permission.
Host validation	Used to set the type of SSL certificate on the Cloud Link device. Setting this to Disabled will disable validation of the SSL certificate.

7. You will see the connection status as OK. This confirms the RIO connection setup.
   1. If RIO status will be reported as “Initializing”, as the connection is established
   2. If RIO status is changed to “OK” once the connection is successfully established and the hardware is fully configured on the Cloud Link device.
   3. If RIO status is set to “Error” with a short error message if there are connections, authorization or other errors creating the hardware.

Following shows SAFR SCAN successfully connected with "OK" status.

As mentioned, once connected, the necessary hardware is created in Genetec. You can view this under Hardware in the RIO tab for the Cloud Link Device as shown below:

Go to Access Control. Select the Cloud Link device on the left. Go to the Hardware Tab and click RIO page.

Observe that the Channel name is the name provided in SAFR SCAN RIO configuration dialog. The Address is the IP Address of SAFR SCAN. Multiple inputs/outputs are created to accommodate SAFR SCAN device configuration options as explained below. These are:

• Monitor - Door status (open / closed)
• REX - Request to Exit which is controlled by connecting to the appropriate PINS on SAFR SCAN wiring connector.
• Lock - Door strike or maglock controlled by SAFR SCAN's Normally Open or Normally Closed dry contact relays
• Reader - The secondary reader connected to SAFR SCAN via OSDP in wiring.

2.3.1 Configure SCAN Door I/O

By default, SAFR SCAN has all settings that may expose security vulnerabilities disabled. To enable SAFR SCAN to control doors as described in previous section (Lock, Door Status, and REX). To enable these options, go to Operation Settings for the SAFR SCAN Device ("…" menu > Edit Operation Settings) and click on "Door I/O" on the left.

2.4 Configure Door with SAFR SCAN Door I/O in Genetec

Once SAFR SCAN has connected, necessary hardware is created. This hardware can then be attached to a door in Genetec Config Tool. This section outlines briefly the hardware made available by SAFR SCAN.

2.4.1 Set Door I/O

1. In your SAFR console, go to Operation Settings in Video Feeds
2. Click on Door I/O on left hand side

2.4.1.1 Electric door strike relay

It Indicates if door relay activation is enabled.

When selected, option to set suitable duration for relay activation is provided. The door relay duration is the duration in seconds the relay remains open once activated.

2.4.1.2 Door open input

Configures the door open input signal. See wiring diagram below for information on how to connect the door state sensor to SAFR SCAN. Options are:

• Disabled - Door input signal is not active.
• Door open on Low - SAFR SCAN reports the door as open if zero voltage is applied to the connection.
• Door open on High - SAFR SCAN reports the door as open if voltage is applied to the connection.

2.4.1.3 Request to Exit input

Configures the REX input signal. See wiring diagram below for information on how to connect the door state sensor to SAFR SCAN. Options are:

• Disabled - REX input signal is not active.
• Request to exist on Low - SAFR SCAN will unlock door if zero voltage is applied to the connection.
• Request to exist on High - SAFR SCAN reports the door as open if voltage is applied to the connection.

Following shows all three controls in enabled state:

2.5 SAFR SCAN Door I/O Wiring

2.5.1 SC100 / SC200 Models

Following diagram demonstrates wiring for Door I/O on SC100 and SC200 models.

2.5.1.1 REX Input

• Positive input goes to PIN1 on Terminal Block 1 (Wiegand D0 Input)
• Ground input goes to PIN5 on Terminal Block 1

2.5.1.2 Door Status

• Positive input goes to PIN5 on Terminal Block 2 (TTL input)
• Ground input goes to PIN5 on Terminal Block 1

2.5.1.3 Door Relay - Normally Open Circuit

SAFR SCAN provides a dry contact relay (power must be supplied externally) to control the door lock. Following connections are required for the Normally Open Circuit.

• Positive input goes to PIN6 on Terminal Block 1
• Ground input goes to PIN8 on Terminal Block 1 (common)

2.5.1.4 Door Relay - Normally Closed Circuit

SAFR SCAN provides a dry contact relay (power must be supplied externally) to control the door lock. Following connections are required for the Normally Closed Circuit.

• Positive input goes to PIN7 on Terminal Block 1
• Ground input goes to PIN8 on Terminal Block 1 (common)

2.5.2 SC50 Models

Following diagram demonstrates wiring for Door I/O on SC50 model.

2.5.2.1 REX Input

• Positive input goes to Green with black segment wire (Wiegand D0 Input)
• Ground input goes to Solid Black wire (Ground)

2.5.2.2 Door Status

• Positive input goes to Solid White with black segment wire (Wiegand D1 Input)
• Ground input goes to Solid Black wire (Ground)

2.5.2.3 Door Relay - Normally Open Circuit

SAFR SCAN provides a dry contact relay (power must be supplied externally) to control the door lock. Following connections are required for the Normally Open Circuit.

• Positive input goes to Violet wire (Normally Open)
• Ground input goes to Brown wire (common)

2.5.2.4 Door Relay - Normally Closed Circuit

SAFR SCAN provides a dry contact relay (power must be supplied externally) to control the door lock. Following connections are required for the Normally Closed Circuit.

• Positive input goes to Blue wire (Normally Closed)
• Ground input goes to Brown wire (common)

2.6 Configuring a Door in Genetec

As described above, once connected, SAFR SCAN creates all the necessary Door I/O hardware for door configuration in Genetec Config Tool. This section briefly outlines how the Door I/O is leveraged in Genetec.

Creating a Door

A new door is created in Area View > Add entity > Door. When creating a door in Genetec, the SAFR SCAN device will be listed as an Interface Module (prefixed with RealNetworks) within the Cloud Link device as shown below in the create door wizard

In the Hardware tab, the Door I/O components created by SAFR SCAN can be selected:

Above shows the SAFR primary reader, Door Lock, REX and Door I/O created above are selected.

In above case, had SAFR been configured for a secondary reader, it would appear in the Out Reader option.

2.7 Access Roles

Access Roles play a key role in which cardholders are synchronized to the readers in both empowered and cooperative modes and allows SAFR to make independent decisions in empowered mode.

This section outlines the steps to configure access roles within Genetec Synergis for SAFR RIO integration.

2.7.15.1. Access the Role Configuration Panel

1. Open Genetec Security Center Config Tool.
2. Navigate to Access Rules in th,ke left-side panel.

3. Select Access Control > Access Rules.

2.7.25.2. Create a New Access Role

1. Click Add an Access Rule.

2. Enter a descriptive name for the access role (e.g., "SAFR Facial Recognition Access").

3. (Optional) Provide a description for the role.

2.7.35.3. Define Access Conditions

1. Under the Access Permissions section, click Add Entities.
2. Select the doors or areas controlled by Synergis where the SAFR integration will be applied.
3. Set the schedule for access (e.g., 24/7, business hours).
4. Under Authentication Mode, choose Facial Recognition to ensure access is granted based on SAFR validation.

2.7.45.4. Assign Users or Cardholders

1. Navigate to the Cardholders or User Groups section.
2. Click Add Cardholders and select the users who should have access via SAFR.
3. If needed, assign the role to an existing user group for easier management.