1 SAFR Intercom Overview

SAFR SCAN offers an intercom capability that provides a mechanism for the person at a SAFR SCAN device to communicate with an operator using 2-way audio and one-way video (video from SCAN to the Operator). SAFR SCAN offers this capability through either WebRTC or SIP protocols. At any time, the operator can remotely issue an Access Granted action which either activates the local door relay or issues a pre-configured credential to the panel to unlock the door.

1.1 Known issues

• SIP Intercom UDP does not work with a number of SIP Servers. This issue will be resolved in a future release.

1.2 SAFR Intercom Protocols

1.2.1 SIP or WebRTC

SAFR offers the choice of either SIP or WebRTC protocols. Following summarizes the functionality of each and which protocol may fit best for you.

Protocol	Dependencies	Applications
SIP	SIP Server (may be supported through your access control manufacturer or a stand alone SIP Server can be used.) SIP-enabled client (either softphone or hardphone) Hardphones are devices that look like a traditional phone but connect via Wireless or Ethernet and support the SIP protocol. Softphones are software applications that run on a mobile device or PC.	Use with SAFR On-Premises or SAFR Cloud where SIP is preferred. Applications where device may need to route to one or more extensions. SIP Server can handle routing to multiple extensions either in parallel or sequence. Future release of SCAN will support using keypad to identify extension for multi-unit residential applications.
WebRTC	Amazon AWS Account with Kinesis Video Streams enabled. SAFR Cloud account (SAFR On-Premises is possible not, but for most applications not practical for WebRTC due to requirement that mobile clients sign into SAFR Server) WebRTC calls are only supported from SAFR Mobile for Android currently (future releases may include SAFR Desktop for Windows and SAFR iOS clients) SAFR SCAN and WebRTC Clients must have connection to AWS If new connection notifications are required, SAFR Mobile clients must have connection to SAFR Cloud account	Deployments using with SAFR Cloud. Deployment where tight integration to SAFR Mobile client for Android is desired.

1.3 SIP Overview

SIP offers the following capabilities:

• Enable interoperable intercom over SIP functionality on SCAN device.
• Allow user to call Operator (attendant) from SCAN.
• At later time, allow user to call contact from directory displayed on SCAN.
• Allow Operator or Contact to grant access (unlock door temporarily) via SCAN device connected by intercom session.
• Allow Operator to at any time initiate call to SCAN device.

1.3.1 SIP Architecture

Below is a diagram demonstrating SAFR SIP Architecture.

SAFR Mobile app will list out all connected readers if connected to SAFR Server. Status of each reader is provided and calls to the selected reader can be initiated from the SAFR Mobile App. Operators can also use a SIP softfone or hardphone to initiate calls to the readers by entering the SIP extension.

All calls are routed through a SIP Server (dark blue lines). Each SCAN device signs into the SIP server with its own SIP account. Soft or hard phones that will interact with SAFR SCAN must also be signed into the same account or otherwise accessible vis SIP Proxy from that SIP Server. The SIP Server maintains an extension for each SCAN device as well as the operators and is about to route calls as needed. Media is also routed through the SIP Server.

Operators can issue an unlock command by pressing a pre-configured number and sending a DTMF tone. The SCAN device will trigger an Access Granted action and if configured send a pre-defined credential through Wiegand or OSDP to the Panel (green wiring).

1.4 WebRTC Overview

1.4.1 WebRTC Architecture

Below is a diagram demonstrating SAFR WebRTC Architecture.

SAFR Mobile app will list out all connected readers if connected to SAFR Server. Status of each reader is provided and calls to the selected reader can be initiated from the SAFR Mobile App.

All calls are initiated using an AWS account configured with Kinesis Service (dark blue dotted lines). Each SCAN device signs into the AWS account with an AWS IAM account. Mobile Android phones that will interact with SAFR SCAN must also be signed into the same AWS account using SAFR Mobile App for Android (Only Android is supported at this time). AWS Kinesis initiates the session and allows the clients to negotiate an optimal path for media. If SCAN and the mobile phone are on the same network, media is transmitted across the local network. If SCAN and mobile phone are not on the same network, then media is transmitted through the AWS Kinesis account.

Operators can issue an unlock command by pressing the unlock button while in a call. The SCAN device will trigger an Access Granted action and if configured send a pre-defined credential through Wiegand or OSDP to the Panel (green wiring).

1.5 Intercom Display States

SAFR SCAN uses the display to indicate when the device is intercom enabled and what state it is in. Following are the three states the device may be in for the full size SAFR SCAN readers with 3.5 inch displays (SC100 and SC200).

Waiting	Ringing	In Call

When there is no activity, the device will display a white phone icon indicating that it is an intercom enabled device. If a person at the device clicks the call button, the “Ringing” state is shown with animated arrows. The device will stay in this state until the SIP Server disconnects. Once an intercom connection is established, the icon changes to green with a solid green horizontal light indicating that the deice is in a call.

If SCAN is unable to communicate with the Intercom Server (SIP or AWS) or other issues prevent intercom from functioning, the waiting state will indicate such using following graphic:

Following are the display states for the mullion SAFR SCAN readers with the 1.5 inch display.

Waiting	Ringing	In Call

1.6 Call Behavior

1.6.1 Outbound Calls

Outbound calls are initiated by pressing the call button on the SAFR SCAN display screen. When pressed, SCAN will initiate a call to the number configured in SCAN Intercom settings. This number can be different for each SCAN device. The SIP Server may implement customized call routing such as sequential or simultaneous calling routing.

When a call is initiated, SCAN will begin to display the Ringing state as shown above. SCAN will remain in this state while awaiting a connection. This cannot be cancelled from the SCAN device. Ringing will continue until timed out by the SIP Server or an operator picks up the call.

Once connected, SCAN display will change to the In Call state as shown above. If configured, SCAN will send 2-way audio and 1-way video (from SCAN’s camera to the operator) for the duration of the call.

Calls cannot be ended from the SCAN device. Only the operator can end the call.

1.6.2 Inbound Calls

Calls can be initiated from a remote SIP client if enabled in SAFR SCAN settings. When an operator initiates a call to SCAN, there is no indication of an inbound call (i.e. no ringing). SCAN will go from Waiting state shown above directly to In Call state shown above. Immediately audio and video are transmitted from the device to the operator and operator may begin speaking.

Calls cannot be ended from the SCAN device. Only the operator can end the call.

1.7 Temporary Unlock

SCAN Intercom allows the operator to issue a temporary unlock command to unlock the door. This is performed slightly differently for SIP or WebRTC Intercom and described in the respective sections below.

Regardless of the Intercom Protocol, the unlock action is the same. When a Temporary Unlock command is issued, the following occurs:

• SAFR SCAN triggers the Door Relay action if enabled.
• SAFR SCAN sends a fixed credential via Wiegand or OSDP if enabled.
• SAFR SCAN shows Access Granted Message
  • If Feedback From Panel is configured, then SAFR SCAN will delay the Access Granted message until panel has responded.

1.7.1 Temporary Unlock Credentials

SAFR SCAN can send a temporary unlock command to the access control panel. To do this, a pre-configured credential must be added to the panel and that credential added to SAFR SCAN as follows:

1. Open SAFR SCAN Operation Settings
2. Go to Access Control page
3. Enable “Temporary unlock signal to Control Panel” and supply a facility id and card id.
   • The Card Format that is configured in the “Card Reader” tab will be used (excluding the UID-32-Mapped and UID-56-Mapped formats)

2 SIP Intercom

SAFR SIP implementation supports making a call from SCAN or calling the device from a SIP phone. A PBX or SIP server is required. Connections are brokered through the server. SAFR support 1-way video (SCAN->Phone) and 2-way audio. When Intercom is enabled, you will see a call button on SAFR SCAN screen. If Intercom is offline, the call button will appear with a line through it. When active, the button can be pressed to initiate a call.

This section describes how to set up SAFR for SIP Intercom.

2.1 System requirements

• SAFR SCAN SC100, SC200 or SC50 models
• SAFR SCAN Firmware version 1.16 or later
• SAFR Recognition App for Android version 3.16 or later (optional)
• 3^rd party SIP Server with 1 SIP account created for each SCAN device.
• 3^rd party SIP Client (software application or SIP enabled physical phone)

2.1.13 ^rd Party SIP Applications

You will need a SIP Server to broker the connection between SCAN and a SIP enabled soft or hard phone. If you don't have one you can use one of the following which have been tested and work well with SAFR:

• Free PBX - https://www.freepbx.org/
• Mizotech:https://www.mizu-voip.com/Software/VoIPServer/WindowsPBX.aspx

You can then connect both SAFR SCAN and your SIP phone to the server and make calls between them.

You will also need a SIP enabled client. This can be a software-based SIP client running on PC or mobile or a physical SIP-enabled phone (hardphone). Following is a good free option that is tested and known to work with SAFR SCAN:

Linphone - https://www.linphone.org/

• Android -https://play.google.com/store/apps/details?id=org.linphone
• iOS -https://apps.apple.com/us/app/linphone/id360065638
• Windows - https://www.linphone.org/category-product/windows-desktop

2.2 Configuring SAFR SCAN for SIP Intercom

Before configuring SAFR SCAN, install a SIP Server and add one account for each SAFR SCAN device. An account is typically made up of digits 0 through 9 (though SCAN supports any ASCII characters in username). You will need the password associated with the account unless your SIP server does not require a password for the account.

2.2.1 Enable SIP on SAFR SCAN

You can configure Intercom settings on SCAN either in SAFR SCAN Web Console (if running SCAN in standalone mode) or Video Feeds window of SAFR Desktop (If SAFR SCAN is connected to SAFR Server).

On SAFR SCAN Web Console or SAFR Desktop

1. Go to Operation Settings
   1. Web Console: Operation > Intercom
   2. SAFR Desktop: Video Feeds > “…” menu for desired SCAN > Operation Settings > Intercom
2. Select SIP from the Protocol dropdown list. The dialog will show the following options.

3. Set the following settings
   1. SIP Server Address (IP Address or hostname)
   2. SIP Server Realm (if required)
   3. SIP Device Username and Password
   4. Call button action (This is the SIP account that will be called when pressing call button on SCAN diplay)
   5. Door unlock dial key (When this key is sent by the remote device, scan will perform a temporary unlock)

Below table describes the settings.

Setting name	Default value	Description
SIP Server Address	None (req’d)	IP Address or host name of the SIP Server.
SIP Server Realm	*	Realm defined on SIP Server. Realms provide a unique namespace for usernames. Often a domain name is used. Use * to not limit to a Realm.
SIP Device Username	None (req’d)	Account username defined on SIP Server. Can be letters or numbers but most often are just numbers to facilitate easily dialing by keypad.
SIP Device Password	None	The password of above account if required by SIP Server. An account does not need to have a password but when completing this dialog, a value is required so enter any value if password not required by SIP Server.
Transport	TCP	The network transport to use. Either TCP, UDP or TLS. This should match what is allowed by your SIP Server. Often SIP Server will allow two or more. Use TCP or UDP if unsure.
Video	Enabled	SCAN supports 1-way video from SCAN to the remote SIP device. Set to disable will to save bandwidth by not sending video from SCAN to remote SIP device. Video takes up about 1 Mbps of bandwidth.
Call button action	Call operator	The action triggered by pressing the phone icon on the SCAN touch screen display. Disabled – No action. Calls cannot be intiated from SCAN device. Call operator (ext-0) – Initiates a SIP call to extension 0 on PBX server. SIP server must be configured to accept this action. Call extension – Initiates a sip call to the extension provided in the Extension setting. This will be another SIP account on the SIP Server. SIP Server can be configured for various actions such as routing a call to a specific user, calling a group, route a call to available operator, etc.
Door unlock via dial key	Enabled	Enables or disables option to temporarily unlock SAFR SCAN from the remote SIP device. If set, the Door unlock dial key should be set. If set, the Temporary unlock signal to Control Panel in Access Control settings page will indicate the credentials to send to the access control panel when Door unlock dial key is pressed.
Door unlock dial key	0	Digit 0 through 9 used to issue a temporary unlock command. When pressed SCAN will display the Access Granted messaging and if configured will send the temporary unlock credential configured in Access Control settings (see below).
Accept Incoming calls	Enabled	Use disable to prevent calls from remote SIP devices from opening a SIP session to this SCAN device.
Limit incoming to extensions	None	If no extensions are entered, all calls from SIP Server are accepted. If any extensions are entered, only calls from entered extensions will be accepted.

2.2.2 SIP Notifications

Typically, the SIP client will notify operators of an incoming call. This may not always be supported on mobile operating systems such as iOS which may not allow an application to run in the background or behave like a typical incoming phone call.

If desired, SAFR can be configured to send SMS notifications to operators when the call button is pressed. See Intercom Notifications below for details on how to use SAFR to generate SMS notifications.

2.3 Troubleshooting SIP Intercom

• Symptom: Not found error or similar errors upon connecting from SCAN or SIP Endpoints
  • Cause: Server address or port incorrect or possibly caused by invalid account credentials (either username or password)
  • Resolution: Ensure that SIP server address and port are correct. Test these from alternate SIP endpoint. Also confirm username and password and ensure SIP server is configured correctly.
• Symptom: Unable to make calls from SCAN to a SIP Client but can make calls from SIP Client to SCAN
  • Cause: Possibly caused by mismatch of transport protocol.
  • Resolution: Ensure that the client is configured to the same transport protocol (TCP, UDP or TLS) as SAFR SCAN
• Symptom: Inbound calls from scan are delayed or SAFR SCAN disconnects from PBX frequently.
  • Cause: Could be due to network configuration issues.
  • Resolution: Try configuring scan to use Static ip address.
• Symptom: Outbound calls from scan are delayed.
  • Cause: Could be due to unreachable DNS Server.
  • Resolution: If using DHCP, ensure DNS Server returned by DHCP server is valid. If using Static IP address, ensure valid DNS server is configured in SAFR SCAN or

3 WebRTC Intercom

SAFR WebRTC implementation supports making a call from SCAN or calling the device from SAFR Mobile Android application. An AWS account is required in order to broker connections between the SCAN device and SAFR Android Mobile client. SAFR support 1-way video (SCAN->Phone) and 2-way audio. When Intercom is enabled, you will see a call button on SAFR SCAN screen. If Intercom is offline, the call button will appear with a line through it. When active, the button can be pressed to initiate a call.

This section describes how to set up SAFR for WebRTC Intercom.

3.1 System requirements

• SAFR SCAN SC100, SC200 or SC50 models
• SAFR SCAN Firmware version 1.16 or later
• SAFR Recognition App for Android version 3.16 or later
• AWS Account with Amazon Kinesis enabled

SAFR SCAN should be connected to SAFR Server to initiate connections either through the Android App as described below or through SMS Notifications.

SAFR Intercom requires that both SAFR SCAN and the Android phone running the SAFR Operator App can establish a connection out to AWS and require an AWS Account set up by the administrator. This document provides some guidance on setting up SAFR Intercom.

3.2 Setup AWS Account

Kinesis video streaming is required to enable SAFR SCAN WebRTC Intercom. SMS Notifications enable you to send a notification to an operator to initiate the intercom call.

See Article Create AWS Account at http://docs.real.com or http://support.real.com for information on setting up AWS Account.

3.3 Configure WebRTC Intercom

You can configure Intercom settings on SCAN either in SAFR SCAN Web Console (if running SCAN in standalone mode) or Video Feeds window of SAFR Desktop (If SAFR SCAN is connected to SAFR Server).

3.3.1 Enable WebRTC Intercom on SAFR SCAN

On SAFR SCAN Web Console or SAFR Desktop

1. Go to Operation Settings
   1. Web Console: Operation > Intercom
   2. SAFR Desktop: Video Feeds > “…” menu for desired SCAN > Operation Settings > Intercom

2. Select WebRTC via AWS KVC from the Protocol dropdown list. The dialog will show the following options.
   
3. Set the following settings
   1. AWS Region Code (In desktop app click “i’ to select a region near you. In Web Console see Amazon Kinesis Data Streams endpoints and quotas <https://docs.aws.amazon.com/general/latest/gr/ak.html> for a list of regions.)
   2. AWS Account Access Key and Secret Key you recorded during AWS IAM User setup above.
   3. AWS Channel Name (must be unique within your AWS Account)

To enable the operator to receive a notification when the call button is pressed, a notification must be set up. See Notifications below for details.

Below table describes the settings.

Setting name	Default value	Description
AWS Region Code	None (req’d)	AWS hosting region where connections are made. Pick a region close to your location. In desktop app click “i’ to select a region near you. In Web Console see Amazon Kinesis Data Streams endpoints and quotas <https://docs.aws.amazon.com/general/latest/gr/ak.html> for a list of regions.
AWS Account	Req’d	The AWS Account Access Key and AWS Account Secret Key for the IAM User you gave permissions for above. Be careful to avoid pasting spaces onto the beginning or end of the strings.
AWS Channel Name	Req’d	A unique string associated with the SCAN device. SCAN will create a channel in AWS using this name. It must be unique within the AWS Account SCAN is connected to. SAFR SCAN will create an AWS Signaling Channel configuration using this value as the channel name. You will see this Signaling Channel on your AWS Account. This channel name should not be used by any other devices, and you should not use the AWS Webcam demo to test this signaling channel as this will “steal” the signaling channel from the SCAN device. If this occurs, disable, and re-enable the SAFR SCAN Intercom setting in order to re-acquire the AWS Signaling Channel for this SCAN device.
Video	Enabled	Option to disable video. Video takes about 1 Mbps from SCAN to operator. With WebRTC, video is routed directly between SCAN and the SAFR Mobile app on Android if possible. Otherwise, the AWS Kinesis account will be used to proxy the video. AWS Vide data transfer and video charges may apply – see AWS Costs above.
Call button action	Disabled	Options: Disabled, Call Operator, Call Mobile Phone. Call Operator: Generates callRequested event with recipient set to “Operator” Call Mobile Phone: Specify a mobile phone number (including country code with “+” prefix) in the Mobile phone number field. When provided, SCAN will send an SMS message to the indicated number when the call button is enabled. Requires that SMS be configured for your SAFR Server. You can also use SAFR’s SMS Alarms dashboard to configure notifications to multiple operators. See Notifications section below.

3.3.2 Configure Intercom on SAFR Android Client

1. Open SAFR Mobile App for Android
2. Click hamburger menu in upper left (three horizontal lines)
3. Click App Settings
4. Click Intercom
5. Complete the following dialog:

Required fields:

• Access Id and Access Key – the AWS IAM User credentials. See above.
• Region – AWS Region. Use the same AWS Region you used above.

Signaling Channel field is only required to test Intercom. Enter the AWS Channel Name from the SAFR SCAN device you wish to test with. Under normal operation, Android client will get the signaling channel during session initiation and thus can operate with any SCAN device.

Press back button to save settings.

3.3.3 Connecting SAFR Mobile for Android to SAFR Server

SAFR SCAN WebRTC Intercom requires SAFR Mobile App for Android be connected to SAFR Server to make or receive calls.

See SAFR Documentation for how to connect SAFR Mobile App for Android to SAFR Server. A quick summary is:

• Log out of android client if you are already logged in.
• Use the “Gear” button to choose “SAFR Custom” connection option.
• Complete the URLs for server. Use following ports:
  • COVI:https://IPADDRESS:8081
  • Event:https://IPADDRESS:8083
  • Object:https://IPADDRESS:8085
  • Virga: https://IPADDRESS:8087

3.3.4 Verify WebRTC Intercom

Use Event Sources page to see if Intercom is enabled and working. Each SCAN device is listed as an event source. SCAN devices that have Intercom enabled appear with a phone icon. The status of the phone icon will indicate the state of the device (active, in-call, ringing or error state).

Following shows view from Event sources on Android and iOS. iOS Intercom sources are view only – intercom sessions cannot be established from SAFR Mobile for iOS at this time.

Android	iOS

Following shows a single Event source for Android and iOS. iOS only allows viewing of the video – 2-way audio is not supported.

Android	iOS

3.4 Initiating WebRTC connection

You can initiate a SAFR WebRTC Intercom session in 2 ways:

• Event Sources: Initiate a call to SCAN from Event Sources
• SMS Notification: Accept calls from SCAN from SMS Notification

Both options require SAFR Mobile App for Android be connected to SAFR Server. See instructions below.

3.5 Initiating calls through SAFR Mobile App for Android

You can make calls from the Android phone to SAFR SCAN. This is done through SAFR Mobile App Event Sources. This requires that SAFR Mobile App for Android be connected to SAFR Server and configured with the AWS Kinesis account as described above.

3.5.1 Making calls from SAFR Mobile App for Android

1. Go to Event Sources from the upper left menu in SAFR Mobile App for Android.
2. Find the SAFR SCAN device you wish to connect to. Ensure that it has a green phone icon indicating Intercom is enabled.
   
   If intercom is not working, you will see an error status like the following:
   
3. Click on the entry in the Video Feeds list.
4. Click on the “Open Intercom” button.

When in the call, you can take the following actions:

• End Call – Closes connection to SAFR SCAN
• Issue Temporary Unlock – SCAN will show Access Granted and if configured, send Temporary Unlock Credentials to the panel.
• Mute Audio – Mutes audio from Android client.

3.6 Accepting calls through SMS Notifications

SMS messages are used to notify one or more operators of an inbound call from SAFR SCAN. The process works as. Follows:

1. SAFR SCAN will generate a “Intercom Call Requested” Event
2. SAFR will generate an SMS Message to one or more phone numbers (configurable routing)
3. Operator clicks the SMS message to launch SAFR Mobile App for Android
4. Operator is presented with an “Intercom call requested” page showing photo from SAFR SCAN camera.
5. Operator can click a button to initiate the call.

3.6.1 Configuring SMS Notifications

Following steps describe how to set up SMS Notifications in SAFR to notify one or more operators to initiate a SAFR WebRTC Intercom session.

3.6.1.1 Enable SMS Notifications Service

To initiate intercom via SMS you will first need to enable SMS for SAFR Server. With SAFR Cloud accounts, you can do this by simply choosing “SARF Cloud” as the SMS provider. To set up SMS on SAFR On-premises server, you must setup an AWS Account and enable SMS as described above in “Setup AWS Account”. Once the AWS Account is created, use the IAM User credentials to configure SMS for SAFR Server as follows:

1. Open System Configuration page as. Follows:
   1. SAFR Desktop: Tools Menu > System Configuration
   2. SAFR Server Web Console: Go to Status page
2. Scroll down to “Enable Notifications Services”
3. Click on “Set up SMS”
4. Complete the following dialog using AWS IAM Credentials.

• Amazon SNS Sender ID is any random string you choose
• You can find a list of SNS Regions here: SMS Supported Regions and Countries < https://docs.aws.amazon.com/sns/latest/dg/sns-supported-regions-countries.html>
  • Pick on that is closes to your server.
• Enter a phone number for testing. Be sure to add “+” in front and the country code.

3.6.1.2 Create one or more SMS Alarms

Once SMS is enabled, you can create one or more SMS Alarms in SAFR as follows:

1. Go to SAFR Reports page
   1. SAFR Server Web Console: Click on “Reports” Tab
   2. In SAFR Desktop: Go to Tools menu > “Create New Report…”
2. Click “Add New Alarm”
3. Chose “Intercom” as the type
4. Complete other settings for the Alarm.
5. For phone number, make sure to include the “+” prefix and country code.

You can send the SMS to up to 10 phones which all may connect to the intercom session in parallel.

3.6.1.3 SAFR Notifications Call Notification Flow

Once set up, clicking on the Call Button on SAFR SCAN will initiate an SMS message to the configured phones. The SMS will include a link. That link will launch the SAFR Android App and display the Intercom event that triggered the alarm. User can launch the intercom session from that event by launching the SAFR Android App. The SAFR App must be installed to initiate the Intercom call.

1. An “Intercom Call Requested” event is generated.
2. The SMS is triggered from an Intercom event.
3. Operator opens the SMS message as shown below.
   
4. Operator clicks the link.
5. Clicking the link launches SAFR App and opens the Recent Events view as shown below.
6. Click on the “Intercom Call Requests” button to launch the intercom session.

4 Troubleshooting

4.1 SIP Intercom

Symptom: Inbound calls from scan are delayed or SAFR SCAN disconnects from PBX frequently.

Cause: Could be due to network configuration issues.

Resolution: Try configuring scan to use Static ip address.

Symptom: Outbound calls from scan are delayed.

Cause: Could be due to unreachable DNS Server.

Resolution: If using DHCP, ensure DNS Server returned by DHCP server is valid. If using Static IP address, ensure valid DNS server is configured in SAFR SCAN or

4.2 WebRTC Intercom

You can test your intercom session with the following URL:

• https://awslabs.github.io/amazon-kinesis-video-streams-webrtc-sdk-js/examples/index.html

Connect from AWS Web client (as viewer - DO NOT CONNECT AS MASTER or this will interfere with SCAN’s connection and require the channel be deleted before it can work again).