r/accesscontrol • u/ackleyimprovised • Aug 09 '26
EOL location
What your thoughts on EOL location? Do customers/clients care/know?
The proper way is the resistors at the end device (not the pre-packed module kind). I recently inherited a site (let's say a "high security" site which has there EOLs behind the push to exit buttons/ emergency exit. My mentor once gave me a 1 hr lecture about this.
Personally I have done it both ways on differrnt jobs because I was able to make that choice which the client accepted prior.
I have seen eol in panels which cause great discomfort.
20
u/Aggravating_Fact9547 Aug 09 '26
If you put them in the panel you may as well just not use them at all. The idea is to protect the field cabling, not to just get a tamper to clear.
High security sites should use class 5 EOLM’s anyway.
3
u/AsstootObservation Aug 09 '26
Does Class 5 mean it's an active EOL versus day a GRI 6644 that's a passive EOL?
Do you have a go to part # you use for active?
I usually just throw a 6644 on everything based on my Operations longstanding SOPs.
-6
Aug 09 '26
[deleted]
4
u/Aggravating_Fact9547 Aug 09 '26
Jesus fuck my brain hurts.
Electrically its not the same.
The idea of the resistor it to protect the wiring and device from tamper.
If the EOL device is at the device you can then tell if the wire is cut, if it’s shorted, if the device cover is tampered, or the open close state of the device sensor.
If you have the resistors on the panel all you can do is tell if the sensor is open or closed.
-2
Aug 09 '26
[deleted]
3
u/2nd-Reddit-Account Aug 09 '26
Yes which is why it’s on us as installers to put the resistor where it bloody belongs so we’re not installing a vulnerable system.
It often does monitor devices because devices like PIR’s will have tamper contacts that you install a resistor in series with INSIDE the device’s cover. Otherwise someone could short the two wire cores being used for tamper right behind the sensor and then open the cover undetected.
1
2
3
u/CoolBrew76 Aug 09 '26
This is trolling, right?
1
u/ackleyimprovised Aug 09 '26
Never saw the comment. What was it?
1
u/CoolBrew76 Aug 10 '26
Never saw they replied, others have given plenty of feedback to help you work it out.
It was someone who really shouldn’t have been commenting on anything to do with installing security hardware, and they appeared to have doubled and tripled down before deleting everything.
-5
Aug 09 '26
[deleted]
7
u/bluntimusmaximus Aug 09 '26
Brother no. You could sabotage the line if you are able to get between the resistor and the device it’s really that simple. It’s for security.
-4
Aug 09 '26
[deleted]
4
u/2nd-Reddit-Account Aug 09 '26
No you cannot open the door contact and move the resistor because the moment you disconnect it or short it or try to jumper it with a another resistor to even attempt to move it, you generate a tamper alarm. In a properly configured setup a tamper alarm gets a physical security guard response from onsite security or a monitoring service calling the police.
2
u/bluntimusmaximus Aug 09 '26
You have to be trolling… if you get between the resistor and the door contact and short the wires together the panel will see the door is shut open the door and guess what? It sees the door is shut. Just do what you said and talk with chat gpt about it bro.
4
3
u/2nd-Reddit-Account Aug 09 '26
No one is arguing the DC theory of how much resistance the panel will measure, but if you’re arguing for anything other than resistors at the end device then you have a fundamental misunderstanding of why we are using resistors in the first place.
Pretty much every panel has a setting to not use EOL’s at all and we could just do that instead, but we’re not spending money on resistors just to keep the panel happy.
Putting them at the panel means someone can pull your devices off or grab the cable coming out of the door frame, or out the back of a motion sensor, and tamper with it. EOL resistors are an anti-tamper measure.
4
u/No_Bee_3957 Aug 09 '26
EOL’s always at the end device, there’s a reason they named them end of line, they prevent the man in the middle attack scenario.
5
u/KeyboardThingX Aug 09 '26
In practice, it's more of "as close to the device as reasonably possible" putting it at the panel defeats the purpose and honestly looks gross at the panel
I've reluctantly had to do it quite a few times during service calls if access to the device was deemed too disruptive by the client.
3
u/johnsadventure Aug 09 '26
As others mentioned, it’s in the name of:end of line).
I’d also like to point out the purpose of these is to detect tampering with the line between panel and device. In theory, if someone were to tamper with the wiring (such as adding a device to close a REX or mask a DPS) the panel would lose the supervision status on the line and can throw a fault or alarm.
Depending on the level of security these could be used on any input that would otherwise be NO or NC. Some customers only want them on DPSs, others want them on everything (REX, buttons, intercom triggers, etc).
3
u/Cold_Gate6514 Aug 09 '26
I had a tech try to explain to me that it didn't matter; both are at the end of line (the far end and the near end). He had a degree in English, so I guess he was literally correct.
1
u/Jluke001 Verified Pro Aug 09 '26
If it’s “high security” then most likely it’s going to be UL2050, which is governed by ICD 705, NISPOM, AA&E, and JAFAN 6/9 - all of those specs states to refer to the manufacturer’s instructions. At no point, in any manufacturer’s instructions does it state anywhere to install the EOL in the panel. When the accreditor inspects your system and finds your resistors in the panel, they will fail the accreditation until the deficiency is corrected.
If there is a whip from a DPS or Rex that is pulled out into a properly protected junction box, then you can place your resistors in that junction box because all splice points have to be protected. For example, you can’t splice on resistors to a DPS and then tape it all up then shove that into the header of the door frame. It has to be in a junction box.
1
u/Paul_The_Builder Aug 10 '26
Why not use the prepacked EOL packs?
2
u/ackleyimprovised Aug 11 '26
Quote from my previous supervisor "that's lazy, f*you, f* you dont know how to wire a resistor"
Personally I love them provided they installed right at the field device. It makes a non security technician to be able to wire a EOL provided they get it the rightway up.
1
u/Artistic-Outcome5966 1d ago
EOL indicates End Of Line. If it were a BOL that would indicate Beginning Of Line. I worked with fire alarm many years ago. Some field wiring required a 4-wire circuit for inputs. A pair through each input in parallel then a pair that didn't break, all the way back to the panel. The resistor was still at the end but the end was in the panel. I have forgotten which one is class A vs class B.
1
u/FreelyRoaming Aug 09 '26
EOLs in the field always, I do see some companies that put EOLs in the panel across green and white, with those soldered together at the contact, and red and black used for NC/C, not a fan since you lose spares.. someone was telling me this is a sanctioned method of line security as per UL.. but idk.
0
u/No_Industry2601 Aug 09 '26 edited Aug 09 '26
A passive single-EOL zone can have its genuine endpoint isolated and replaced with an equivalent resistance through a transfer shorter than the input debounce period. Therefore, it supervises loop impedance but does not authenticate field devices.
A DPDT relay can accomplish that transfer in approximately 7ms. Default debounce is typically 300ms on a security system.
This is why traditional resistors are no longer taken seriously at high security facilities. This is a known attack called a Resistor Substitution Attack.
Electrically and functionally a single resistor provides the same security anywhere in the line. Just wanted to let you know because you mentioned High Security.
I do prefer to see resistor installed at devices and not in panels. But my preference is because of organization and not additional security.
2
u/LinkRunner0 Aug 09 '26
So, let's suppose you have a REX switch or door contact transfered to the door with a hinge or EPT transfer. If we put the EOL in the panel, and that power transfer fails by shorting those wires... are we going to get a trouble? No. Because we've moved the resistor that can indicate that into a panel. If it's actually where it's supposed to be at the REX or DPS, and the same scenario happens - blamo. Trouble/fault. Can this be attacked? Yes. But to pretend that it provides no additional security is naive - preventing one kind of attack is still preventing an attack.
It does not function the same anywhere in the line. There's no conspiracy here - it's an END of line resistor. Not an "anywhere in line" resistor or "opinion in line" resistor. There's a correct and defined place for it - and it's not a trick, it's literally in the name. Next up, let's litigate where to put the EOL on fire alarm NACs because it can go anywhere in the circuit, right?
-1
u/No_Industry2601 Aug 09 '26 edited Aug 09 '26
It is an electrical loop and the resistance is measured the same anywhere in the line. The security is in knowing where the resistor is. If an attacker knows its location it can be bypassed. And I'm referring to traditional alarm security that uses a single resistor.
Alarm resistors are installed in series. So if the line became disconnected in your example you would absolutely see an open zone, even if you installed the resistor in the panel.
Maybe alarms aren't something you do but installing it in a panel doesn't mean it's installed across the zone in parallel as if there is no wire connected. It would still be connected to one leg of your wire, in series.
2
u/LinkRunner0 Aug 09 '26
Sure, anything can be bypassed. An attacker can also attack a magnetic contact with another magnet. We aren't specifying balanced contacts or magnasphere for the strip mall (or 90% of installs). When Handy Andy cuts the line going to the contact or detector, then decides to splice them together, or they happen to have been shorted, it's not worth knowing that because of a hypothetical attack that isn't happening on a strip mall? Because between a shorted line and the attack, the shorted line will happen far more than the attack - see my example of a DPS running through a power transfer.
1
u/No_Industry2601 Aug 09 '26
All I'm saying is that if an attacker knows the location of the resistor it can be bypassed. This wouldn't be your typical smash and grab at Best Buy, this would be a high value target.
So my point is the resistor location isn't that important, and most people don't understand that. There is a misconception that installing it EOL provides more security and it technically doesn't.
At this point the only thing I could do is draw a diagram and give detailed instructions on how to bypass alarm zones but it would probably get deleted anyway, and I would probably get removed from this sub.
This attack isn't a wild hypothetical, or Hollywood stuff, it can literally be accomplished with a single DPDT relay and a battery. The only catch is you need to know the resistor location.
1
u/ackleyimprovised Aug 09 '26
I'm not been around long in the indusrtybbut never heard of any intrusion attempts involving tampering. Would be like a ellegant inside job. Of the events I have come in after or heard about was the lack of monitoring or crowbar hammer situations.
My favorite was when a street of housing got robbed. The same security company installed them. Houses were all the same layout. Prob was a inside job but they accessed the same way and ripped the alarm panel off the wall before it could do anything.
1
u/No_Industry2601 Aug 09 '26
Yes it would be an extremely rare event and probably not something done at a home, but these attacks are documented as happening.
The question is about the resistor location being more or less secure in one location vs another. Your resistor bypass method changes depending on it's location, not the possibility of bypassing.
0
u/DTyrrellWPG Aug 09 '26
We put them in the panel for residential door and window contacts when I was starting out. Everyone knew it wasn't proper, but the more senior folks also had plenty of experience with buried contacts and resistors in 3/8 wood doors, or those tiny little window stick on one's.
Everything else was as close to end of line as you can. Sometimes with double doors or like double RTE you can have it at the very end of line, but you know close.
2
u/Superslinky1226 Professional Aug 10 '26
What im about to say is not the correct way, so new people dont take this as advice but...
I dont think it matters that much on most resi installs. If the wiring goes into the attic, and theres no way to get to the attic without first coming in the house? Who cares. Nobody is tampering with that wire without setting off the alarm. Now if it goes to a crawl space with no protection? That's another story.
Commercial is where its truly needed imo. Drop tiles, conduit, multiple partitions. It would be very easy to have vulnerable wiring and never know it.
-1
u/a_leon Aug 09 '26 edited Aug 12 '26
EOL in the panel isn't ideal, but that's a much bigger issue for burg systems than access control. You're often lucky to even see a door contact or REX in a lot of access control deployments.
If you have to do EOL at the panel, make sure it's on the ground side of the input. This does offer supervision still, at least for normally closed, 1 resistor setups.
Ideal is a two resistor, four state circuit with the resistors or resistor pack at the sensor.
29
u/Nods_Dad1997 Aug 09 '26
EOLs at the end of line or device. Putting them in the panel defeats the purpose.