What "access control" covers here
Local searches are practical — akses për ashensor, akses për dyer, akses për garazh, akses për rampë — and behind them is an elevator company asked to restrict floors by card, an integrator wiring a new block, or a building manager with an old Wiegand panel and no audit trail. One system should cover all four physical situations:
| Access point | Hardware | Decision made on |
|---|---|---|
| Elevator cabin, floor selection | In-cabin reader + CCU-32, one relay per floor button | CCU-32 |
| Entrance, stair or apartment-block door | Landing reader + AXON Node + ICM-GE | ICM-GE |
| Garage gate or barrier | Reader + Node, RBN-2 relay next to the barrier motor | ICM-GE |
| Remote ramp or gate without cabling | Reader + relay node on RS-485, linked by ICM-LR LoRa | ICM-LR |
The same reader board and firmware serve every one of these points; only the bus address differs.
How the system is organised
Subsystem A, the cabin. The CCU-32 reads encrypted card events from the in-cabin reader over RS-485, checks the card against its own local table, and pulses one of 32 relay outputs for 3 seconds so the passenger can press the matching floor button on the original panel. The elevator's call-button wiring is not redesigned. Ethernet with LTE-M / NB-IoT fallback carries only database sync, logs and firmware; no floor decision waits for the network.
Subsystem B, the building. The ICM-GE is the master for everything outside the cabin. Below it, one AXON Node per floor or door hangs on one of two independent Classic CAN buses at 250 kbit/s — up to 120 access points per port, 240 per master. Each Node polls its landing reader over RS-485, re-wraps the authenticated event for the CAN backbone and pulses its two relays only when the master grants. No verdict within 800 ms means deny — fail-closed.
Readers. The URX-Secure is a 13.56 MHz DESFire EV3 reader on half-duplex RS-485 at 115200 bps. Every frame is encrypted with AES-CTR and tagged with a CMAC and a per-direction counter, so a replayed or forged frame is dropped. It never opens anything on a UID alone.
Outputs. RBN-2 (two isolated 5 A relays), SC-E (two-relay add-on) and the SSR-32 32-channel solid-state board (in development) sit on the RS-485 bus and switch the load within a metre of it. Wire-level detail: Node deep-dive, RS-485 vs CAN vs Ethernet.
Elevator access: what an elevator company installs
- Mount the CCU-32 in or on the cabin, on 12–24 V DC.
- Fit one URX-Secure reader in the car operating panel, wired to the CCU-32 on RS-485.
- Wire relay outputs in parallel with the floor buttons that need gating; free floors are simply not connected.
- Load the card database from the AXON dashboard once; from then on the board decides by itself.
The controller and its EN 81-20 certified safety circuits are not touched. For older cabins the PBC-Bridge (in development) taps the existing push-button lines instead of rewiring every button; where the vendor exposes a digital command channel, the ELM-GE (in development) issues a real destination call. The full sequence is in How Elevator Access Control Works.
Entrances, doors, garages and ramps
- Residential tower, 20+ floors. One Node and reader per landing; lower floors on CAN port 1, upper floors on port 2, each segment terminated with 120 Ω. A resident's card carries per-node permission bits and the master grants from its local database.
- Complex with several entrances and a garage. Each entrance and the gate gets a Node with a URX-Secure. A legacy Wiegand reader at the ramp can stay behind an AXON AMS converter, which turns its D0/D1 output into an addressed RS-485 message inside the same back box. One master decides for all of them; see Multi-Entrance Buildings.
- Remote gate or visitor parking a few hundred metres away. Trenching often costs more than the equipment. ICM-LR carries the encrypted request and verdict over 868 MHz LoRa — up to about 1 km line-of-sight, confirmed by site survey — while a local RS-485 stub drives the reader and barrier relay.
Credentials: why DESFire EV3
The cheapest cards sold locally are MIFARE Classic, and a Classic UID can be copied onto a writable card in seconds; any panel that grants on UID is open to that. AXON readers select the AXON application on a DESFire EV3 card, derive its key from the UID with AES-CMAC and run a DESFire AuthenticateAES. A copied UID, a Classic clone or a foreign DESFire card fails and, by default, produces no reaction. Because the reader-to-master link is also encrypted, there is no cleartext stage on the wire — the weakness of Wiegand D0/D1 runs. See DESFire EV3 vs MIFARE Classic and Anti-Cloning RFID.
When the internet drops
Kosovo buildings lose fibre, power and mobile coverage more often than a datasheet assumes. Both masters keep the full card database on board and decide locally — the ICM-GE with a design target of under 2 ms per lookup, the Node measured under 10 ms tap-to-verdict. The uplink is best-effort: Ethernet first, cellular fallback (LTE Cat-1 on the ICM-GE, LTE-M / NB-IoT on the CCU-32); with both down, decisions continue and events wait in a local log. Firmware updates land in a two-slot layout, so a failed update rolls back.
Scoping a deployment in Kosovo
Every project is scoped against what already exists (working Wiegand readers stay behind an AMS converter; an old controller keeps its buttons and gets CCU-32 relays), the supply rails on site (masters and most modules accept 12–24 V DC) and any point beyond cable reach (ICM-LR, sized from a site survey). AXON supplies modules from local stock in Kosovo and can size the CAN backbone, communication module and reader configuration for a specific elevator, entrance or campus; typical lead time for stocked configurations is one to two weeks. Boards marked in development can be planned and piloted, but their electrical ratings should not be pinned in a tender until the production datasheet is out.
Frequently asked questions
Does AXON work with our existing elevator controller? Yes, in the relay model. The CCU-32 pulses a relay in parallel with each gated floor button; the controller sees an ordinary press. No controller firmware or safety circuit is modified.
Can we keep the RFID cards we already issued? MIFARE Classic or UID-only cards can be read but not authenticated, and AXON does not recommend granting on them. New credentials should be DESFire EV3; existing DESFire cards can be personalised with the AXON application.
What happens if a master board fails? Nodes and readers fail closed — no verdict, no grant. A replacement master re-synchronises its database from the cloud.
How many doors or floors can one system handle? One ICM-GE serves up to 120 access points per CAN port across two ports — 240 per master; one CCU-32 unit gates 32 floors and units chain for taller cabins. Larger sites combine masters, so there is no cap on floors or access points.
Where do we start? Send a floor count, entrance list and photos of the existing cabinet to Contact AXON, or browse boards in the AXON Store.