16.1 Preventive/Corrective Maintenance, Calibration, Service Agreements & Warranties

Preventive/Corrective Maintenance, Calibration, Service Agreements & Warranties

Independent OpenExamPrep teaching for published PSP Domain 3 Task 5 knowledge is that an accepted system is not a finished countermeasure. Chapter 14 gave you a site-acceptance baseline. Domain 1 gave you a residual-risk pairing. This section is how hardware and firmware stay as-operated, not as-specified in a binder nobody opens after the warranty lunch.

Exam focus: Preventive maintenance preserves detection and delay. Corrective (break-fix) work starts after a hard failure. Calibration compares cameras, sensors, and readers to the original requirement. Service agreements buy response time and matching spares. Warranties are four different promises, and several owner habits void them.

Why lifecycle maintenance is a security control

Physical security electronics live in weather, vibration, dust, dirty power, and human handling. A camera that passed SAT at a recorded lux level with a clean dome will not detect the same walk test after a year of pollen, a failed dock luminaire, and a PTZ that crept two degrees. The network ping still succeeds. The SOC mosaic still shows online. Domain 1 residual risk assumed detection at the dock. What you actually have is a green icon.

Treat maintenance as part of the countermeasure, the same way you treat a lock cylinder’s key control. If you would not leave a perimeter gate without a closer, do not leave a video analytic without a scheduled walk test against the original script. Chapter 6 already warned that residual risk assumes treatments are operating, not merely installed. Lifecycle work is how you keep that verb honest.

Preventive versus corrective maintenance

Preventive maintenance (PM) is scheduled work that keeps devices inside their design envelope: cleaning, inspection, firmware from the approved list, battery replacement, UPS load tests, walk tests, and calibration. It is calendar-driven and metric-driven. The output of PM is not a stack of invoices. The output is a device that still meets the number written in the performance specification.

Corrective maintenance is repair after a fault: a dead reader, a RAID collapse, a blown power supply, a cut detection loop. It is event-driven. A break-fix only contract is almost all corrective work. It looks cheaper because it omits the labor that prevents silent degradation. Break-fix is a valid product for a printer in an office. It is a weak product for a camera that is supposed to detect a trailer hitch at 22:00.

Upgrades are not PM. An upgrade changes features, capacity, or security posture: a VMS major version, a controller generation, a move from Wiegand to OSDP, added analytics, a new credential format. Upgrades need change control, a regression test against the SAT script, and the people-training in 16.2. Loading unapproved firmware “to get a feature” is an upgrade done badly, and it is a classic warranty-void.

A useful field test for the exam: if the device still pings and still paints pixels, but no longer meets the original performance requirement, PM has already failed—even if no corrective ticket exists. Uptime is not detection. Online is not delay.

Calibration: cameras, sensors, and readers

Calibration in this chapter means comparing the device to the original performance requirement and restoring it. It is not twiddling until the picture “looks nicer.” Record the SAT method, lighting, target, and pass/fail number. Repeat that method. If you cannot find the SAT script, you cannot calibrate—you can only guess.

Cameras

On a fixed camera, PM usually includes dome or window cleaning; housing heater, blower, and desiccant checks; focus and iris confirmation; IR or white-light illuminator output; and a scene check against the as-built field of view. Confirm NTP time so video is evidence, not a guess. For PTZ units, verify home preset, tours, and that vibration has not walked the home position off the asset. For analytics (motion, line-cross, loitering), rerun the original walk or drive test after seasonal foliage, snow piles, and lighting changes. A sensitivity slider moved after a nuisance-rain week is not calibration unless you re-run the detection test and record the new number against the requirement.

Storage health belongs in the same visit: RAID status, failed disks, retention versus the advertised days, and recording completeness. A camera that live-views but has not written to disk for eleven days has failed as an investigative countermeasure even if the mosaic looks fine.

Sensors

Intrusion sensors drift. Passive infrared (PIR) and dual-technology PIR-plus-microwave heads need a walk test at the specified range and speed, including the edges of the pattern—not only the center of the hallway. Magnetic contacts need the magnet-to-contact gap and position checked after door sag, closer failure, and weatherstripping changes. Glass-break sensors need a manufacturer tester at the specified distance; a knuckle rap on the pane is not a test. Fence-mounted vibration or fiber sensors need seasonal sensitivity checks after ice, new vegetation, and nearby construction. Photoelectric beams need power and height checks after frost heave. If a sensor sits in a wash-down bay or a freezer vestibule, environment is part of calibration, not an excuse after the warranty fight.

Nuisance floods are a calibration signal. Operators who disable a zone “until someone looks at it” have already taken that sensor out of the Domain 1 treatment. Log the disable as a residual-risk change, then fix the device or the environment.

Readers

Access readers need a read-range check with the specified credential at the specified presentation. Confirm bit format, facility code, and encryption mode still match the panel. Mullion and weather-exposed readers fail from UV, water, and vandals long before the panel fails. After a firmware push, verify that mobile or Bluetooth credentials still present at the designed distance and that tamper circuits still report. A reader that “usually works if you tap twice” has already left the performance requirement. That is a tailgating gift and an after-hours lockout waiting to happen.

Service agreements: SLAs, response, spares, after-hours

A service agreement converts “call the integrator” into measurable restoration. PSP-style items punish owners who bought a phone number and thought they bought a countermeasure. Read four clauses before you praise a low annual price.

Service level agreement (SLA) priorities. Life-safety interlocks, perimeter detection, and the main entrance on a 24-hour site are not the same priority as a lobby camera that covers a decorative plant. Write priorities in the statement of work. A single “next business day” clause is a daytime office product, not a warehouse product.

Response time versus restore time. Mean time to respond is when a qualified technician acknowledges or arrives. Mean time to restore (MTTR) is when the countermeasure works again—verified by a retest, not by a ping. Owners lose arguments because they bought response and thought they bought restore. If the technician arrives in two hours with no spare, you have a fast visit and a still-open dock.

Spare stocking. Require like-for-like field-replaceable units with matching firmware and licenses at a named location: site attic stock, a regional depot, or vendor bonded inventory. A “we will order it” spare is a lead time, not a spare. Chapter 14 already turned over specified attic stock at acceptance. The service agreement must keep that stock rotated, tested, and version-matched. A spare camera on last year’s firmware that cannot join this year’s VMS is a paperweight.

After-hours. Night and weekend coverage needs a named on-call roster, a way to authenticate at the gate, escort rules, technician badges or keys, remote-diagnostic rights, and a clock that starts at the alarm—not at sunrise. After-hours coverage without site access is theatre. After-hours coverage that forbids remote diagnosis on a panel you already allowed onto the network is also theatre, just in the other direction.

Credits and penalties belong in the same reading. An SLA credit that pays $200 when a dock camera is dark for a week does not restore detection. Use credits as a signal that the contractor failed, then fix the spare and the priority—not as a substitute for the countermeasure.

Warranty types

Warranties are not SLAs. A warranty is a defect promise. An SLA is a restoration promise. You usually need both. Mixing them on the exam is a common trap: “the unit is still in warranty” does not mean a technician is rolling tonight.

Manufacturer warranty covers defects in materials and workmanship for a stated term (often one to five years depending on the product class). It commonly covers parts, not integrator labor, and it commonly excludes consumables, abuse, and environment. Read the RMA process: advanced replacement versus repair-and-return changes MTTR even when coverage is real.

Installation / workmanship warranty is the integrator’s promise that the install was done per the contract: torque, sealing, labeling, programming, cable support, weather heads. A camera that dies because the housing was never gasketed is often a workmanship claim, not a factory imager claim. This warranty is typically measured from acceptance, not from the day the box left the OEM.

Replacement-parts warranty covers a repaired or advanced-replaced field unit for a short term (often 90 days). It does not restart the original system warranty unless the contract says so. Do not tell a CFO that swapping one PSU bought three new years on the entire NVR.

Extended warranty is a purchased extra term. Read whether it includes advanced replacement, overnight shipping, labor, firmware support, or only a parts depot. “Extended” that still ships in three weeks is a longer calendar, not a better restore. Some extended products are third-party insurance wrapped around an OEM; those documents exclude even more environment and firmware adventures than the factory sheet.

What voids a warranty

Three owner habits show up on exam-style items and in real RMA denials.

Unapproved firmware. Loading a community build, a “performance” fork, or a third-party analytic that replaces the OEM operating system typically voids manufacturer hardware coverage—even if the later failure looks like an imager or a power board. A skipped OEM security patch can become a dispute if the failure looks like a software-induced lockup. Change control belongs on firmware the same way it belongs on a door schedule. Keep a rollback image. Keep the approved list in the CMMS, not in a technician’s memory.

Poor environment. Specification sheets list temperature, humidity, ingress, and power quality. A “vandal dome” in a wash-down bay without the wash-down rating, a DVR closet at 40 °C with no HVAC, or a reader on dirty power with no surge protection or UPS is an environment problem. Corrosion and condensation are not mysterious. They are logged in the PM photos you should have taken. If you never photographed the inside of the housing, you will lose the argument about whether water was present at install.

No required PM. Many manufacturer and extended warranties condition coverage on documented preventive maintenance. If you cannot produce cleaning, filter, and inspection records, the RMA may die even when the part looks like a factory defect. “We would have cleaned it if it had failed” is not a PM record.

Other frequent voids: unauthorized repair that breaks seals, non-OEM power supplies, relocating a device without the listed procedure, and using a camera housing as a step. The exam does not need the full exclusion list. It needs you to recognize that warranty is a contract with conditions, not a vibe that surrounds any broken camera.

Worked example: camera PM versus break-fix that quietly kills detection

Site. North Basin Distribution operates 48 outdoor and dock cameras and a VMS with motion and line-cross analytics on Dock-3 and the trailer yard. Domain 1 residual risk for trailer theft was treated with lighting, a crash-rated gate, watched video, and an alarm on the personnel door. SAT recorded a scripted walk: a 1.0 m/s walk along Dock-3 at 22:00 with 15 lux on the pavement produced detection on 19 of 20 passes (95 percent) and a SOC acknowledge within 25 seconds.

Contract A — PM schedule (defensible). Quarterly exterior clean of housings and domes; monthly recording-health and RAID check; semiannual PTZ home and tour verification; seasonal analytic retest using the SAT walk script; annual IR and illuminator output check; firmware only from the OEM approved list with a rollback image; attic stock of two like-model cameras with matching firmware and licenses; P1 restore of a dock camera in 8 hours including after-hours, measured to a repeated walk test, not to a ping.

Contract B — break-fix only (cheap, quiet failure). The integrator comes when a camera is “down,” defined in the contract as no ping or a black screen. No cleaning, no walk test, no illuminator check, no firmware discipline. Spares are ordered as needed. After-hours is next business morning. The monthly report shows 100 percent camera uptime for a year. Leadership is pleased.

What happens by month 18 under Contract B. Spider silk and dust coat three dock domes. A high-pressure wash fogged one housing because the gasket was never a PM item. A forklift strike rotated Camera 12 two degrees off the trailer kingpin. A dock luminaire failed; lux at the SAT mark is now 4. Analytics were turned down after a rain-nuisance week and never restored. Every camera still pings. The SOC dashboard is green. A repeated SAT walk now detects 9 of 20 passes (45 percent). Domain 1 still lists video detection as a treatment. Residual risk has grown while the maintenance KPI—percent online—looks excellent. A theft crew does not need a black screen. They need a camera that no longer sees the hitch.

What Contract A would have caught. The quarterly clean and the seasonal walk test would have shown the lux drop and the field-of-view creep before peak theft season. The spare camera would have replaced Camera 12 the same night. Firmware would still match. MTTR would be a restore to the SAT number, not a restore to a ping.

The exam trap is treating uptime as detection. Break-fix protects uptime. PM protects the countermeasure. If PM is unfunded, write the residual risk back up in the Domain 1 file. Do not leave a false residual on the assessment because the cameras still glow.

The diagram maps PM, break-fix, upgrades, and the warranty stack. The chart shows how detection decays under the two contracts when only one of them retests the original walk.