19.3 Programming, Access Codes, Bypass, and Hours of Operation

19 NYCRR 195.1 names programming or reprogramming of access codes, system protocol, bypass features, and hours of operation inside installation (195.1(c)), maintaining (195.1(d)), and servicing (195.1(e)). Assisting (195.1(f)) includes having access to or knowledge of those same items, plus on-line or off-line condition, on-site or off-site. Independent OpenExamPrep teaching for Module 5.V is the operational layer: who holds which code, what a duress code does, when bypass is an impairment, why opening/closing schedules are hours of operation, why swinger shutdown and communicator test times are protocol, and why a combination panel's fire partition is not a burglary partition.

Changing bypass or hours is licensed work. An office employee who "just knows the codes" is assisting and needs the Chapter 3 identification-card and fingerprint package. Leaving the manufacturer default installer password in the panel is both a security failure and a 19 NYCRR 195.12 confidentiality problem waiting to happen. This statewide sitting is still not an FDNY Certificate of Fitness course; local fire-marshal inspection under GBL §69-z does not make keypad programming unlicensed.

Installer codes versus user codes

An installer (dealer, master, or programming) code reaches the panel's programming menus: zone types, partition maps, communicator account numbers, test timers, bypass authority, and schedules. A user code arms, disarms, and — if you grant it — may bypass certain security points. Do not give the receptionist the installer code. Do not print the installer code on a sticker inside the keypad door.

Authority levels (manufacturer names vary) typically separate:

• Arm/disarm only
• Arm/disarm plus security bypass
• Manager codes that add or delete user codes but still cannot enter installer programming
• Installer or programming access

Creating, changing, or deleting those codes is 195.1 programming. Doing it from a laptop at the shop is still programming. 195.1(f) assisting includes off-site participation and knowledge of the codes. A central-station operator who holds the installer code to place the system on test is assisting. If that person is the licensee's employee, 19 NYCRR 195.2(d) still requires a Secretary of State-form identification card, and 195.8 still requires fingerprints and the 24-hour employee-statement filing taught in Chapter 3. "She never pulls wire" is not an exemption from assisting.

Duress

A duress (ambush) code is a user code that appears to disarm or to operate the keypad normally while it sends a silent holdup or duress event to the central station. It is a specialty initiating method implemented in software. Programming it is licensed. Teaching the owner which code is duress is user training (Section 19.2). 195.12 forbids employees from divulging work information except to the employer or as required by law — a duress code is exactly the kind of information that sentence is about.

Do not map duress to an audible burglary siren. Do not use the same code for "oops, cancel" and for duress. Test duress only with the central station on a planned test so you do not create a real police response.

Bypass, inhibit, and hours of operation

Bypass (also taught as inhibit, disable, or point disable depending on the panel) takes a point or function out of service. On a security partition, a user with bypass authority might shun a warehouse overhead door for a late delivery. That is still programming of a bypass feature. Granting that authority, setting which points may be bypassed, and changing the rule later are licensed.

On a fire system, disabling a smoke, a waterflow, or a notification-appliance circuit is an impairment of required protection. Commonly taught NFPA 72 practice is to notify the AHJ and the supervising station before you disable required fire protection, tag it, limit the time, restore, and notify again. A receptionist user code should not be able to bypass required fire detection. Walk-test is a listed test mode, not a standing bypass (Chapter 18).

Hours of operation in 195.1 are the opening and closing schedules: when a burglary partition auto-arms, when opening/closing reports are expected, and when a late-to-close signal should hit the central station. Changing the store from 6 p.m. close to 8 p.m. close is reprogramming hours of operation. It is installation under 195.1(c) when you set it up, maintaining when you adjust it to prevent problem signals, servicing when you fix a failed scheduler. It is not a secretarial courtesy. A remote change of the schedule is still licensed; knowledge of the schedule is assisting.

Swinger shutdown (Chapter 12) disables a security zone after repeated trips in an arming period so one bouncing contact cannot flood the police. Changing the swinger count is system protocol programming. Do not apply burglary swinger shutdown to required fire initiating devices to quiet a dirty smoke. Repair or clean the fire device (Section 19.2).

Communicator test times are protocol. Set them to the commonly taught fire or burglary interval that Chapter 10 taught for that path. Verify them on the maintenance visit (Section 19.1). Do not stretch a fire single-path timer to 24 hours because the burglary partition also lives in the box.

Fire versus burglary partitions on combination panels

A combination control often holds a fire partition (or fire area) and one or more burglary partitions.

Programming a smoke detector into a burglary zone so the owner can shut it off at night is a protocol error and a life-safety error. Programming waterflow as a burglary interior motion is how the fire department never comes. Event codes, partition maps, and who may bypass are system protocol.

Default passwords and 19 NYCRR 195.12

Manufacturer default installer codes are published in every stolen manual. Leaving them in a New York panel means anyone with a keypad and a search engine can change bypass maps and hours. Change defaults at commissioning. Change them again when an employee who knew them leaves. Document the change in the system record (Chapter 17.3) without taping the new code to the can.

195.12(a): any person who is or has been an employee of a licensee shall not divulge to anyone other than the employer, except as required by law, information acquired during employment about the assigned work. Access codes, bypass maps, hours of operation, and duress codes are that information.

195.12(b): if the employer believes someone violated that rule, the employer must divulge the known facts to the Secretary of State (or the designated Department of State person). Confidentiality is not optional, and reporting a leak is not optional.

Employees who assist — including those who only know the codes from the office — still need 195.11 identification cards and 195.8 fingerprints when they are employees of the licensed alarm business. "She only knows the bypass" is the definition of assisting, not an exemption.

In practice

A strip-mall combination panel still has installer code 1234, a fire smoke on the same partition as the motion detectors, a 24-hour burglary test timer on the fire communicator, and a cashier who bypasses the warehouse smokes when the dock is busy. Every one of those facts is a 195.1 programming failure. The fix is licensed work: unique installer code, fire partition 24-hour and not user-bypassable, fire test interval restored, user codes without fire-bypass authority, 195.12 silence about the new codes, and identification cards for everyone in the firm who now knows them.

On the exam

Traps treat hours-of-operation changes as unlicensed secretary work, treat knowledge of codes as outside assisting, leave defaults because the owner wanted it simple, put swinger on a fire smoke, or skip identification cards for office staff who know the bypass. Choose licensed programming, assisting includes knowledge, no manufacturer defaults, fire partitions stay 24-hour, and 195.12 confidentiality.