AXON W2R-N — Wiegand to RS-485 Bus Converter Node

The migration bridge that brings legacy Wiegand 26/34 readers onto a modern, encrypted, addressable RS-485 BUS without ripping out wall plates or replacing working hardware.

01 — What W2R-N Does in the System

AXON W2R-N solves a problem every retrofit access-control project hits sooner or later: the readers on the wall still work, but the central panel they connect to does not meet the modern requirement set — no central management, no encryption on the bus, no audit trail, no integration with newer software. Pulling out the readers themselves is expensive: wall plates, cable runs, painting, installation labour. W2R-N keeps the readers and replaces the part that needs replacing — the panel and the bus.

Physically, W2R-N is a small board installed behind each existing reader, typically in the same flush box or back box. The reader's existing Wiegand wiring (D0, D1, V+, GND) — the de-facto two-wire signalling described in the Wiegand interface reference for 26-bit and 34-bit formats — terminates on W2R-N rather than on a long run back to the legacy panel. From the W2R-N onward, the credential travels on an RS-485 BUS, signalled per TIA-485-A, shared with other W2R-N units (and other AXON nodes like URX-Secure), back to an AXON controller. The controller sees each W2R-N as an addressed endpoint and treats the legacy reader behind it as if it were just another reader on the bus.

This solves two problems at once. The single-cable Wiegand topology, where every reader needs its own dedicated cable back to the panel, becomes a multi-drop RS-485 topology where many readers share the same pair. And the plaintext Wiegand transport, where the credential is visible to anyone who taps the wire, becomes a short Wiegand stub inside the wall box plus an encrypted RS-485 path everywhere else — the attack surface for cleartext credential capture drops to the few centimetres inside the back box.

W2R-N also has a Simple Node mode for cases where it is being used as a standalone addressable bus node rather than as a Wiegand converter. The hardware is the same; the firmware mode is configured at commissioning.

02 — Required Components

Part	Role	Notes
AXON W2R-N module	Converter / bus node	One per legacy reader being brought onto the AXON RS-485 BUS.
Existing Wiegand reader	Credential capture	Any standard Wiegand 26 or 34-bit reader; custom formats on request.
AXON controller	Authorisation logic	Typically AXON ICM-GE for buildings or AXON ICM-LR for distributed sites.
RS-485 cable plant	Bus to controller	Shielded twisted pair, shared across many W2R-N units.
12 V DC supply	Power	Usually shared with the existing reader supply at the same location.
Short Wiegand stub	Reader to W2R-N	Centimetres inside the back box, not metres along the wall.
Optional pass-through cable	Legacy panel side	Only needed during phased migrations where the old panel stays online temporarily.

Why these specific parts

The point of W2R-N is to add as little as possible to the existing installation. There is no new reader, no new wall plate, no new conduit. The W2R-N fits in the existing back box, takes 12 V from the existing reader feed, and uses a pair of new RS-485 wires that can be pulled along the existing bus path back to the new controller. The pass-through option exists specifically because retrofit projects almost never get a "flag day" — the old panel and the new controller have to coexist during the transition.

03 — How W2R-N Works End-to-End

A read at a W2R-N-converted door:

1. Card presentation. A user presents an RFID card to the legacy Wiegand reader on the wall. The reader behaves exactly as it always has.
2. Wiegand pulse capture. The reader emits the Wiegand bit stream on D0 (logic 0) and D1 (logic 1). The W2R-N, wired directly behind the reader, captures the pulses on its Wiegand input.
3. Frame validation. W2R-N validates the Wiegand frame (parity for 26/34-bit standard formats; vendor-specific rules for custom formats configured at commissioning).
4. RS-485 packaging. The validated credential is packaged as an addressable RS-485 BUS message containing the W2R-N's network address and the credential payload.
5. Bus transmission. The message is transmitted on the shared RS-485 BUS to the AXON controller.
6. Controller decision. The controller (ICM-GE or ICM-LR) looks up the credential, applies policy, and decides whether to grant access.
7. Output action. The controller energises the door relay through its own driver or through a paired I/O node at the door.
8. Optional pass-through. In the pass-through variant during a phased migration, the W2R-N additionally forwards the original Wiegand stream to the legacy panel for parallel processing.

In Simple Node mode, steps 2 and 3 are replaced with whatever I/O the node is configured to do (digital input read, relay drive), and the rest of the flow is the same — an addressed RS-485 endpoint reporting state to the controller.

04 — Communication Architecture: Wiegand In, RS-485 Out

Wiegand input — the short, contained leg

Wiegand was never designed for long, unprotected cable runs in modern threat models. It is a two-wire pulsed signal with no addressing, no encryption and no error checking beyond a couple of parity bits. In a traditional installation that signal runs metres or tens of metres from the reader to the panel — every centimetre of which is exposed to inductive tapping with cheap hardware. The W2R-N architecture bounds the Wiegand exposure to the few centimetres inside the back box, behind the reader, where physical access already requires removing the wall plate.

RS-485 output — the addressable, encrypted path

From the W2R-N onward, the credential travels on RS-485. Multiple W2R-N units share the same bus pair, each individually addressed. The AXON BUS protocol on RS-485 includes encryption and per-message addressing, so a tap on the long bus run no longer yields cleartext credentials. The controller treats each W2R-N as a distinct endpoint, so it can distinguish "front door reader" from "garage door reader" even though both are on the same pair of wires.

Pass-through (optional variant)

The RS-485 + Pass-through variant exists for transitions. In phased migrations the new AXON controller comes online while the old panel is still doing real work. W2R-N forwards Wiegand to both: RS-485 to the new controller, original Wiegand to the old panel. Once the new system is validated and the old panel is decommissioned, the pass-through is disabled and only the RS-485 output is active. The variant matters because a "flag day" cutover is rarely acceptable on a live building.

05 — Interface Layout and Wiring

Line	Function	Notes
D0 / D1 (Wiegand input)	From legacy reader	Short stub from the reader inside the back box.
V+ / GND (reader power)	To legacy reader	Pass-through from the local 12 V supply.
A / B (RS-485)	To AXON controller	Twisted pair, multi-drop bus shared with other W2R-N / nodes.
D0 / D1 (Wiegand pass-through)	To legacy panel (optional)	Active only in the RS-485 + Pass-through variant.
12 V DC input	Power	Shared with reader supply where possible.
Address selector	Network address	Per-unit address for bus identification.

For the RS-485 cable plant, run a single shielded twisted pair across all W2R-N units in a linear bus, with 120 Ω termination at both physical ends only. Keep the Wiegand stub inside the back box short — measured in centimetres, not metres. Where the existing Wiegand cable to the panel is being retained for pass-through, route the new RS-485 pair separately rather than reusing the same cable, to avoid coupling between the legacy and new paths.

06 — Security and Robustness

W2R-N's security improvements are architectural rather than cryptographic:

• Bounded Wiegand exposure. The cleartext Wiegand path is reduced from a long building run to a stub inside a back box. Physical access to read the cleartext credential now requires opening the wall plate, not just tapping the riser cable.
• Encrypted bus path. From W2R-N to controller, the credential is on the encrypted AXON RS-485 BUS, with anti-replay counters defeating record-and-replay.
• Individual addressability. Each W2R-N has its own address, so a credential read at the back door cannot be confused for one at the front door at the controller layer. This eliminates a class of integrity attack possible on unaddressed Wiegand panels.
• Centralised audit at the controller. The controller logs which W2R-N produced each event, giving a per-door audit trail that legacy Wiegand panels generally do not produce.

What W2R-N does not do is upgrade the security of the card itself. If your existing cards are MIFARE Classic UIDs, a sniffer at the reader still works at the contactless layer. For full end-to-end security improvements, pair the W2R-N migration with a card population upgrade to DESFire, or replace the highest-risk readers with URX-Secure entirely. W2R-N is a migration step; URX-Secure is the destination.

07 — Real-World Deployment Scenarios

Apartment building retrofit in Prishtinë

A 1990s apartment building has 24 Wiegand readers across entrances and floors, all wired to a single panel cabinet that is end-of-life. The building manager does not have budget to replace all 24 readers — and the readers still work fine. W2R-N units are installed behind each reader in the existing back boxes; a single new RS-485 bus is pulled through the existing conduit; an ICM-GE replaces the legacy panel. Residents notice nothing on day one (their cards still work); the manager gets centralised user management, audit logs and lockdown capability that the old panel never had.

Mid-rise office migration in Tiranë

A six-floor office with mixed Wiegand and proximity readers is migrating to AXON during a planned IT modernisation. W2R-N units (RS-485 + Pass-through variant) are installed during the migration period: the new AXON ICM-GE comes online and validates against the same card population as the legacy panel for two weeks before the old panel is decommissioned. Pass-through means tenants experience zero downtime; once cutover is complete, the pass-through is disabled and the legacy panel is removed.

Hospital phased upgrade in Pejë

A regional hospital is upgrading access control ward by ward. Wards that have been migrated are on the new AXON ICM-GE with W2R-N converters at each ward door. Wards still on the legacy system are unaffected. The W2R-N approach lets the migration happen one ward at a time over a budget cycle rather than as a single capital project.

Logistics yard with mixed reader vintages near Prishtinë

A logistics operator has reader equipment of different ages at different gates — some recent, some from a previous generation. Standardising the panel side onto AXON without standardising the reader side is exactly the case W2R-N was designed for. Each gate gets a W2R-N regardless of reader vintage; the ICM-LR (LoRa, because the gates are spread across the yard) sees a uniform fleet of addressable RS-485 endpoints behind a heterogeneous reader population.

08 — Installation Requirements

• Mounting: inside the existing reader back box where possible. Where the back box is too shallow, an extension ring may be required.
• Power: 12 V DC, low draw. Sharing the existing reader supply is the common pattern; verify the supply has the headroom for the added load.
• Wiegand wiring: keep the reader-to-W2R-N stub as short as practical. Do not route the Wiegand stub outside the back box.
• RS-485 bus: shielded twisted pair, multi-drop, 120 Ω termination at both physical ends only. Test 60 Ω across A/B with all devices off.
• Pass-through: only enable if the legacy panel is staying online during a phased migration. Disable once cutover is complete.
• Addressing: assign each W2R-N a unique bus address during commissioning. Plan the addressing scheme up-front so the per-door audit trail at the controller maps to building floor plans.
• Surge protection: in retrofits where the legacy cable plant has poor earthing, consider adding surge protection on the RS-485 bus at the controller end — old cabling is often a poor electrical environment.

09 — Recommended Topology

The standard topology with W2R-N:

1. One W2R-N per legacy reader, installed locally at the reader.
2. One linear RS-485 BUS sweeping past all W2R-N units, terminated at both physical ends only.
3. One AXON controller at the bus head, holding policy and audit.
4. Local 12 V supply per W2R-N, typically shared with the reader supply already present.

For mixed sites with both W2R-N converters (legacy readers) and URX-Secure readers (new doors), the two share the same RS-485 BUS to the same controller. The controller does not care which kind of endpoint is at which address — each one is just another addressed bus participant.

Common mistakes: running the Wiegand stub outside the back box (defeats the security improvement); terminating every W2R-N on the bus (drops bus impedance below specification); using existing legacy bus cable without verifying its electrical condition (old cable is often the cause of the new "intermittent" complaints).

10 — Troubleshooting Guide

The controller does not see any reads from one W2R-N

Three usual suspects, in order: (1) the W2R-N's RS-485 wires are reversed or the unit's address is not provisioned at the controller; (2) the Wiegand stub from the reader to the W2R-N is mis-wired (D0/D1 swap, no ground); (3) the unit has no power. Confirm power LED on the W2R-N, swap A/B as a quick test on the RS-485 side, and check the reader is actually emitting Wiegand pulses on a scope.

Reads work but every event appears as "denied" at the controller

The credential is reaching the controller fine but the user lookup fails. Check that the card population is correctly enrolled in the controller's user database — a common gotcha in migrations is that the controller's facility code is set to one value while the legacy cards encode another. Adjust the controller's facility code mask or re-enrol cards.

Intermittent reads only at some times of day

Usually electrical noise: HVAC compressors starting, elevator motors moving, fluorescent ballasts cycling. RS-485 is tolerant but not immune. Check that the bus shield is bonded at one end only (not both), that the cable is twisted pair (not parallel), and that the cable is not running parallel to mains feeders.

Pass-through is configured but the legacy panel does not see reads

The pass-through is either disabled or wired incorrectly. Verify the pass-through variant is the one installed (not the basic RS-485-only variant), confirm the Wiegand pass-through wires actually reach the legacy panel, and check the legacy panel itself is healthy — sometimes commissioning of a new system reveals that the legacy panel had been failing quietly for months.

Multiple W2R-N units share the same bus and one is "noisy"

One node mis-addressed (so it answers when another is being polled) or one node with a marginal RS-485 transceiver (so its bus driving is intermittent). Walk the addresses by disconnecting nodes one at a time. The unit that, when disconnected, restores the bus to clean operation is the culprit.

11 — How W2R-N Compares to Alternatives

• Rip-and-replace with new encrypted readers. Cleanest end state, highest up-front cost: every reader, wall plate, back box and cable. W2R-N preserves the readers and replaces only what needs replacing — appropriate when budget is a real constraint.
• OSDP retrofit (if reader supports it). If the legacy reader happens to support the SIA Open Supervised Device Protocol (OSDP), a direct OSDP-to-controller wiring is a viable alternative — OSDP is the industry's modern replacement for plaintext Wiegand and adds supervision and Secure Channel encryption on the same RS-485 physical layer. Most installed-base readers in the region do not support it, so W2R-N is the only option that does not require reader replacement.
• Wiegand repeaters / extenders. Solve the cable-length problem but not the cleartext, unaddressed-bus, or audit-trail problems. W2R-N solves all three at the same time.
• Standalone networked reader gateways. Some vendors sell a per-reader IP gateway. Same problem as IP-per-door controllers: requires structured cabling to every reader location. W2R-N's RS-485 bus uses a single shielded pair across all readers.

12 — Current Implementation vs Roadmap

W2R-N is in production and in stock as the standard migration bridge.

Shipping today

• Wiegand 26 / 34-bit input.
• RS-485 BUS output to AXON controllers (ICM-GE, ICM-LR).
• Optional RS-485 + Pass-through variant for phased migrations.
• Converter Mode (Wiegand to RS-485) and Simple Node mode (standalone addressable bus node).
• Per-unit network addressing for individual reader identification at the controller.
• 12 V DC input, low power consumption.

On the roadmap

• Per-W2R-N firmware update over RS-485 from the controller, propagating signed updates across the bus during scheduled windows.
• Expanded custom Wiegand format library covering more regional reader vendors out of the box.
• Hardware-rooted device identity for the W2R-N itself, allowing the controller to revoke an address if a unit is removed without authorisation.
• OSDP input variant for sites that have a mix of Wiegand and OSDP readers and want both kinds to land on the same AXON RS-485 BUS.

13 — Key Takeaways

14 — Frequently Asked Questions

What does AXON W2R-N actually do?

Captures Wiegand pulses from a legacy reader behind it and forwards them as addressable RS-485 BUS traffic to an AXON controller. The reader keeps working as it always has; the panel and bus side are modernised.

Why not run Wiegand straight to the controller?

Because Wiegand is unaddressed (one cable per reader, expensive) and plaintext (the credential is on every wire). RS-485 is multi-drop and encrypted under the AXON protocol.

What is the difference between Converter Mode and Simple Node mode?

Converter Mode is Wiegand in, RS-485 out — the typical migration use case. Simple Node mode operates as a basic addressable bus endpoint for custom integration scenarios.

Which Wiegand formats are supported?

26-bit and 34-bit out of the box; custom Wiegand formats per project. Share a sample capture during quoting if your readers emit a non-standard format.

How is each W2R-N addressed?

Each unit has a unique network address for bus identification, assigned during commissioning.

Does W2R-N pass Wiegand through to a legacy panel?

Yes, in the RS-485 + Pass-through variant, intended for phased migrations where the legacy panel stays online during cutover.

How does W2R-N compare to URX-Secure?

URX-Secure is a new encrypted reader (end-to-end protection from card to master). W2R-N is a bridge that keeps an existing Wiegand reader and moves the rest of the path onto encrypted RS-485. Use URX-Secure for new doors; use W2R-N to preserve working legacy readers.

What power does W2R-N need?

12 V DC at low power; usually shared with the existing reader supply.

Can W2R-N integrate with non-AXON controllers?

Designed and validated for AXON controllers using the AXON RS-485 BUS protocol. Compatibility with third-party panels using their own protocols is not promised.

Is W2R-N shipping today?

Yes, in stock. Lead time from local stock is typically one to two weeks for standard variants.

15 — Related Guides and Products

16 — Get a W2R-N Quote for Your Migration

Have a building, hospital, hotel or logistics site running on Wiegand readers and an end-of-life panel? We can survey the existing reader population, design the RS-485 bus to match the existing conduit routes, quantify the migration in phases, supply W2R-N units from local stock, and support commissioning. Typical lead time is one to two weeks for standard 26/34-bit variants.

References and Standards

• Wiegand interface — overview of 26-bit and 34-bit reader signalling formats
• TIA-485-A — Electrical Characteristics of Generators and Receivers for Use in Balanced Digital Multipoint Systems (RS-485)
• SIA OSDP — Open Supervised Device Protocol (industry replacement for Wiegand)