Reading Event Codes on a Signal History

Why this matters

The central station's signal history is the only record of what the panel actually did while nobody was watching. A tech who walks in and starts pressing keypad buttons, or worse, powers the panel down to "reset it," can clear the trouble conditions that are the evidence and learns nothing the history would have told them in two minutes from the truck. Reading the history first tells you whether you are chasing an alarm, a trouble or a communication failure, which zone or user was involved, and in what order things happened. It also catches the one failure the customer never notices: a panel that quietly stopped checking in.

How a history line is built

Most panels report to the central station in Contact ID (SIA DC-05), a reporting format in which every event is a short string: the account number, an event qualifier, a three-digit event code, a partition (area) number and a three-digit zone or user number. Other formats exist (SIA is the other common one, with two-letter event codes), and the station's automation software translates whatever arrives into a readable line. The meaning carries across formats even when the letters differ.

The parts that matter on the screen:

• Qualifier. In Contact ID a 1 means a new event or an opening, a 3 means a restore or a closing. Station software usually shows these as E (event) and R (restore) in front of the code. So E130 is a burglary alarm and R130 is that zone going back to normal.
• Event code. The three digits name what happened. The 100s are alarms (fire, panic, burglary), the 300s are system troubles, the 400s are openings and closings, and the 600s include test reports. A few you will see weekly: 130 burglary, 131 perimeter, 132 interior, 134 entry/exit, 301 AC power loss, 302 low system battery, 401 opening or closing by a user, 602 periodic test.
• Zone or user. For an alarm or a zone trouble, the three digits are the zone. For an opening or closing, they are the user number. The same field means different things depending on the event, which is why a station screen labels it.

An opening is a disarm and a closing is an arm. The words come from commercial practice, where opening the business means turning the alarm off. New techs read "OPENING" as a door opening, which sends them to the wrong zone.

The history

Here is the signal history for one residential account, pulled on the morning of 10/17 after the customer reported the keypad "beeping and showing a battery message." The panel is a hybrid panel on a cellular communicator, programmed to send a periodic test once a day at 03:00. Times are the station's receive times.

ACCT 4417   SIGNAL HISTORY     (oldest first)
DATE  TIME   CODE  AREA  ZN/USR  DESCRIPTION
10/15 03:00  E602   00    000    PERIODIC TEST
10/15 07:48  R401   01    U002   CLOSING (ARMED)
10/15 16:52  E401   01    U002   OPENING (DISARMED)
10/16 03:00  E602   00    000    PERIODIC TEST
10/16 08:05  R401   01    U003   CLOSING (ARMED)
10/16 13:41  E134   01    Z001   BURG ALARM FRONT DR
10/16 13:42  E401   01    U003   OPENING (DISARMED)
10/16 13:43  R134   01    Z001   RESTORE FRONT DR
10/16 14:20  E301   00    000    AC POWER LOSS
10/16 23:55  E302   00    000    LOW SYSTEM BATTERY
10/17 04:00  ----   --    ----   LATE TO TEST (STATION)
10/17 06:12  R301   00    000    AC POWER RESTORE

Before reading it, note the one line that is different in kind. A LATE TO TEST line is not from the panel. The station's software generates it when an expected periodic test does not arrive within its grace period after the scheduled time. It is the station telling you about silence.

Reading it, line by line

10/15 and the 10/16 test: the baseline. Tests arrive at 03:00 both days. User 2 arms in the morning and disarms in the late afternoon. That is the household's normal pattern, and you need it to see what is abnormal.

10/16 08:05: user 3 arms. A different user from the day before. Check the user list on the account: user 3 is the house cleaner, who arms the system when leaving.

10/16 13:41 to 13:43: an alarm, a disarm, a restore. E134 on zone 1 is a burglary alarm on the front door, an entry/exit zone. One minute later E401 from user 3 is a disarm, and a minute after that R134 is the front door zone returning to normal (the door closed).

Three things to read out of those lines:

• The disarm came from a valid user one minute after the alarm. That is the shape of a person who came in, did not reach the keypad inside the entry delay, and then disarmed. User 3 came back for something. The operator log for that alarm will show the call to the premise and the passcode given or not.
• The restore is a zone restore, not a cancel. R134 means the front door contact closed. It does not mean anyone cancelled the alarm, and it is not proof the alarm was false. A cancel report, where the panel sends one, is its own code.
• The burglary is a separate story from the battery complaint. It goes in the false alarm record (see related: The False Alarm Follow-Up SOP), and the entry-delay timing for user 3 may be worth a conversation, but it did not cause the beeping.

10/16 14:20: AC power loss. E301 with zone 000 means the panel itself lost its 120 V supply. Many panels hold this report for a programmed delay so a short flicker does not send a signal, so the actual loss can be earlier than the receive time. The customer later confirms the breaker feeding the panel's transformer outlet tripped when the cleaner ran a vacuum on the same circuit.

10/16 23:55: low system battery. E302 means the standby battery's voltage under load fell below the panel's threshold. The battery had carried the panel for roughly nine and a half hours by then (14:20 to 23:55). Whether that is normal depends on the panel's load and the battery's size and age, which is a battery-math question. See related: How to Size a Standby Battery for an Alarm Panel.

10/17 03:00 should have had a test. It did not. The station flagged it as late at 04:00. Read that against the lines above: the panel had been on battery since 14:20 and reported low at 23:55. By 03:00 it most likely had not enough voltage left to power the communicator, or had shut down entirely. For several hours on the night of 10/16, this house was not protected, and the only line in the history that shows it is the one the panel did not send.

10/17 06:12: AC restore. The customer reset the breaker in the morning. R301 arrives. Notice what is missing: no R302. The battery has not recovered enough to clear its low-battery condition, which is exactly why the keypad is still beeping and showing a battery message.

What the history told you before you touched the panel

From the truck, without opening a door:

1. The panel lost AC at or before 14:20 on 10/16 and ran on battery until morning.
2. The battery reached its low threshold after about nine and a half hours and most likely dropped the panel off the air before the 03:00 test.
3. AC is back; the battery has not recovered.
4. There was also a false alarm by user 3 at 13:41, unrelated to the battery, which needs to be logged.

That shapes the visit. Find out why the panel's transformer shares a circuit that trips; load-test the battery and replace it if it fails, since a deeply discharged battery often does not come back to its rated capacity (see related: How to Replace an Alarm Panel Battery and Load Test It); then confirm the panel sends a battery restore and a manual test that the station receives. Put the account on test before any of that (see related: How to Put an Alarm Account on Test and Take It Off), and take it off only after the operator confirms the test signal.

Telling an alarm from a trouble from a restore

A quick way to sort any history line:

An alarm without its restore usually means the zone is still faulted: a door left open, a window contact knocked off. A trouble without its restore means the condition is still present, as with the missing R302 above.

Spotting a missed periodic test on a longer history

The 10/17 miss was obvious because the station flagged it. On a long history, look for it deliberately: scan the E602 lines and check the spacing. A daily test that skips a day, or a monthly test that arrives a week late, means the path was down for that stretch. Two common patterns:

• A gap that starts with an AC loss, as here: the panel died on battery.
• A gap with no AC loss and no troubles at all: the panel was powered and armed normally but its communicator could not get out. That is a communicator or network problem, and it is the more dangerous one because the panel may show nothing wrong at the keypad, especially where it is not programmed to watch its own communication path.

The test interval is set per account, and a long interval hides a long outage. An account that tests monthly can be off the air for weeks before anyone knows.

References

• SIA DC-05, Contact ID reporting format (the event codes and qualifiers used above)
• Panel maker programming guide: AC loss report delay, test interval, low battery threshold
• See related: How a Central Station Handles a Signal, from Panel to Dispatch
• See related: How to Replace an Alarm Panel Battery and Load Test It
• See related: How to Put an Alarm Account on Test and Take It Off