AXON ELM-GE — Elevator Master with Direct Controller Integration

The elevator master tier of the AXON platform. Ethernet and GSM uplinks for remote management, RS-485 BUS to readers, nodes and expansion modules locally, and a direct command path into the elevator controller — not a button simulator. Premium validation policies. Status: in development.

01 — What ELM-GE Does in the System

AXON ELM-GE is the brain of an elevator-class AXON deployment. Three communication domains meet on this board. Upstream, dual-path Ethernet and GSM connect the building to the central AXON platform for credential synchronisation, audit log offload, and remote management. Downstream, an RS-485 BUS reaches the per-floor reader nodes and the output expansion modules that handle landing-side hardware. Laterally, a direct integration path connects ELM-GE to the elevator's own controller and lets it issue destination commands as a first-class actor in the elevator's logic — not as a passenger pressing a fake button.

The distinction between direct controller integration and button simulation is the load-bearing design choice in this product. Button simulators close a contact across the floor-button input on the call panel, which works mechanically but is invisible to the elevator's higher-level features. Modern elevator controllers run group dispatch, destination dispatch, priority handling, VIP override and service modes above the button matrix. A simulator cannot use any of those features and cannot be logged as a real call event. Direct integration speaks the controller's command interface, so an access-driven call enters the controller's scheduler as a normal call and is treated identically to a manual destination request.

Operationally, the visible result inside the elevator lobby changes. With ELM-GE in place, the landing hardware reduces to a reader; the classic floor-button panel becomes largely redundant. A resident or staff member presents a card, ELM-GE validates against the access rules, and ELM-GE sends the destination directly to the elevator controller. Some buildings retain a small manual override panel for service and emergency cases, but the default flow no longer needs every floor to expose a full button matrix.

The validation tier is described as premium because multiple policy layers stack before any command is issued: credential identity, time window, per-credential floor list, per-credential priority, lockdown state, schedule overrides, and any active VIP or service flags. The master keeps an audit trail of every decision, including denials, so building managers and security operators have a continuous record rather than a silent system that only logs successes. The elevator interface itself remains subordinate to local life-safety codes — typically EN 81-20 for elevator safety and EN 81-50 for design and component rules in EU/EEA jurisdictions.

02 — Required Components

Part	Role	Notes
SoC / MCU	Master logic, validation engine, uplink stack	Sized for concurrent reader events, group commands, and dual-path uplink.
Ethernet PHY	Primary uplink path	Wired LAN to the building's network.
GSM / cellular modem	Fallback uplink path	Mobile data path for management and emergency traffic.
RS-485 transceiver	Downstream BUS to readers / nodes / expansion modules	Half-duplex with direction control.
Elevator controller interface	Direct command path to the elevator controller	Physical and protocol layer depend on the controller make.
Secure element / TPM (planned)	Key storage for uplink and bus authentication
Real-time clock with battery backup	Time-window validation, audit timestamps	Critical for time-of-day policy.
Local audit storage	Offline event buffer for uplink outages	So events are not lost when both uplinks are down briefly.
Power supply	Board power + watchdog

Why these specific parts

The two uplink paths exist because elevator-room Ethernet uplinks fail more often than they should and the failure mode strands residents. GSM as a fallback decouples access management from the building's LAN. The direct elevator integration block is purpose-built per controller make, because there is no single industry-standard "elevator command" interface — every major manufacturer has its own. The local audit storage exists so that an uplink outage during a busy event does not silently lose audit records. The RTC with battery backup is non-optional because time-window policy collapses without reliable time even across power cycles.

03 — How ELM-GE Works End-to-End

1. Credential read. A resident presents a card at a landing reader. The reader transmits the credential over the RS-485 BUS to ELM-GE.
2. Identity resolution. ELM-GE looks up the credential in its local cache, populated from the central platform via the Ethernet uplink (and GSM if Ethernet is down).
3. Policy stack. The master applies time-window, per-credential floor list, priority class, lockdown state, and any active override. Each layer either passes or denies.
4. Validation decision. If every layer passes, ELM-GE resolves the destination floor for that credential. If any layer denies, ELM-GE logs a denial event with the failing reason and does not issue a controller command.
5. Direct controller command. On a pass, ELM-GE issues a destination command to the elevator controller using the controller's own command interface — not a button simulation.
6. Reconciliation. ELM-GE supervises the controller's response. If the controller accepts the call and dispatches the cabin, the event is logged as a normal authorisation. If the controller rejects or ignores the call, ELM-GE logs the anomaly for operator review.
7. Audit propagation. The event — pass or fail — is buffered locally and pushed upstream over Ethernet (or GSM fallback) to the central platform.

For system events (lockdown, emergency unlock, schedule changes, credential revocations), the path flows the other direction: the central platform pushes commands down to ELM-GE, the master validates the command's authority, applies it locally to the access state machine, and reports the new state back. Local cache means a brief uplink outage does not stop access — the master continues to honour cached policy until either the uplink restores or a configurable offline grace period expires.

04 — Communication Architecture: Ethernet, GSM, and RS-485 BUS

Uplink: Ethernet primary, GSM fallback

Ethernet 10/100 Mbps (IEEE 802.3) is the primary uplink for credential sync, audit log offload and management. It is preferred because it is cheap, fast, and the same network the rest of the building services run on. GSM (or LTE-M, depending on the modem fitted, per the relevant 3GPP cellular standards) is the fallback. Its job is to keep ELM-GE reachable for management and emergency commands when the LAN is down — a more common occurrence in elevator machine rooms than network engineers like to admit, because riser-side cabling sees a lot of incidental contractor traffic.

The two paths are not symmetric. Ethernet carries the bulk of normal traffic; GSM is used sparingly for cost and bandwidth reasons. The master treats GSM as a management lifeline rather than a continuous data path.

Local: RS-485 BUS to readers, nodes, and expansion modules

Downstream of ELM-GE, the local bus is RS-485 (TIA-485-A) — the same physical layer used elsewhere in the AXON product family. Readers (URX-Secure, Wiegand-front-end adapters, AXON Node floor readers) and expansion modules (RBN-2 for two-channel output, SSR-32 for high-density output) all share this bus. Each device has an individual address; ELM-GE addresses them per the AXON BUS convention.

Lateral: direct elevator controller integration

The lateral path is the unique element. ELM-GE talks to the elevator controller using the controller's own command interface — destination command, floor lock-out, service mode entry, depending on what the specific controller exposes. The physical and protocol layer depend on the controller make: some controllers use a serial protocol, some use a dedicated CAN variant, some expose an Ethernet interface. The integration layer abstracts those differences so the access-policy side of ELM-GE is unaware of which controller it is talking to.

05 — Interface Layout (Target)

Interface	Role	Notes
Ethernet (RJ45)	Primary uplink	To building LAN.
SIM slot + GSM antenna	Fallback uplink	External antenna recommended in machine rooms.
RS-485 A / B / GND	Downstream BUS	Daisy-chained to readers, nodes, expansion modules.
Elevator controller terminals	Direct integration	Layout depends on supported controller make.
Power input	Board supply
Dry contact inputs (planned)	Fire alarm interlock, override panel	For life-safety inputs that must take precedence over access logic.
Status indicators	Uplink state, BUS activity, controller link state	For at-a-glance commissioning and triage.

The machine-room location of an elevator master deserves attention at install time. Heat, dust and EMI from the elevator drive are real. Mount ELM-GE in a sealed enclosure away from the drive, route its bus and controller-interface cables in their own trunking, and route the GSM antenna out of the machine room itself for usable signal.

06 — Security and Robustness

• Premium validation stack. Multiple policy layers (identity, time window, floor list, priority, lockdown, override) checked on every credential event, with explicit logging of which layer denied.
• Dual uplink path. Ethernet primary, GSM fallback, so a single LAN incident does not isolate the master.
• Cached policy and local audit. Brief uplink outages do not stop authorised access or lose audit records.
• Direct controller integration. Eliminates the brittle "fake button" attack surface; access events appear as real controller calls and are logged on both sides.
• RTC with battery backup. Time-window validation continues across power cycles.
• Life-safety subordination. When the elevator controller enters fire-service or emergency mode, it ignores ELM-GE commands by design — access control is always subordinate to life safety.
• Denial logging. Failures and denials are first-class log events, not silence.

07 — Real-World Deployment Scenarios

High-rise residential tower (Prishtinë)

A new 25-floor residential tower in Prishtinë's Bregu i Diellit area installs ELM-GE in the elevator machine room. Each landing has only a reader, no full button panel. A resident presents a card, ELM-GE validates the credential against the resident's authorised floors, and issues a destination command to the elevator controller. The cabin arrives, the destination is already selected, and the doors open at the authorised floor. Guests use temporary credentials issued from the central platform; staff use a separate priority class.

Mid-rise office (Tiranë)

A 14-floor office building in central Tiranë uses ELM-GE to enforce floor-by-floor access by tenant. Tenant A occupies floors 3 and 4, tenant B occupies floors 5 through 8, building services use floors 9 through 14. The same elevator serves all tenants, but ELM-GE ensures each credential can only call destinations on its authorised floors. Lockdown events from the central platform propagate in seconds: in a security incident, ELM-GE can be told to deny everything below a configured tier until cleared.

Hotel with staff-only floors (Pejë)

A hotel in Pejë reserves the top two floors for back-of-house staff areas. ELM-GE refuses to call those floors for any guest card while normally serving guest-accessible floors. Cleaning staff have a priority class that authorises the staff floors only during their shift windows. The audit log captures every authorisation and every denial — including the policy layer that denied each one.

Hospital with controlled wards (Mitrovicë)

A hospital in Mitrovicë uses ELM-GE on its main elevator block to enforce ward-by-ward access. Medical staff, administrative staff, cleaning and contractors each have their own credential class with distinct floor lists and time windows. Family visiting is enabled by a time-window policy that opens and closes the visiting floors automatically. Because ELM-GE integrates directly with the elevator controller, the controller's group dispatch features (cabin selection, wait-time optimisation) continue to operate even though access is filtered upstream.

08 — Installation Requirements

• Mounting. Sealed enclosure in or adjacent to the elevator machine room, mechanically isolated from the drive cabinet.
• Power. Dedicated DC feed sized for the board plus margin for GSM modem peak draw.
• Ethernet. Patched to the building network with a switch port that survives building network maintenance — not behind a shared printer hub.
• GSM antenna. External antenna routed out of the machine room. Signal strength in machine rooms is often poor; verify with a survey before commissioning.
• RS-485 BUS. Shielded twisted pair running through the building riser, daisy-chained to landing readers and any output expansion modules. 120 Ω termination at the two physical ends only.
• Elevator controller cable. Per the integrated controller's specification, run in its own trunking separate from access bus and mains.
• Time source. NTP via Ethernet, with the RTC battery-backed for power-cycle continuity.
• Local audit storage capacity. Sized for at least the realistic worst-case uplink outage duration at peak event rate.

09 — Recommended Topology

The ELM-GE topology has three legs and one cabinet:

1. Uplink leg. Ethernet to the building LAN with a documented path back to the central AXON platform. GSM antenna with verified signal strength at install location.
2. Downstream BUS leg. Linear RS-485 backbone running through the riser, short stubs to each reader and expansion module, 120 Ω termination at the two physical ends only. Avoid star topology; avoid termination at every device.
3. Elevator controller leg. Short, direct cabling from ELM-GE to the elevator controller using the controller's command interface. Treat this cable as life-safety-adjacent — label both ends, route in its own trunking, do not splice in the field.
4. Single cabinet for the master. ELM-GE, its power supply, its GSM modem and any local audit storage in one enclosure for serviceability. The cabinet has its own override panel for emergency manual control.

10 — Troubleshooting Guide

Cards are read but the elevator does not move

Check the controller-link indicator on ELM-GE first. If the link is up, look at the master's last decision log — a valid card on an unauthorised floor produces a logged denial, not a controller command. If the master did issue a command and the cabin did not move, the issue is on the controller side: it may be in service or fire mode, the floor may be locked out at the controller, or the controller-link cable may be damaged.

Ethernet uplink is down, system seems offline

Check whether GSM has taken over. If the master is reachable via GSM, the policy continues to operate from cache and access still works locally. Restore Ethernet at the building network layer; GSM exists to keep management traffic alive during exactly this scenario.

Some floors authorise, others do not

Almost always a policy issue — a credential's authorised-floor list does not include the requested floor, or a time window is closed for that floor. Check the central platform's view of the credential, then the master's local cache (it may be stale if the uplink was briefly down at the moment of a credential update). Re-sync if needed.

Audit log gaps in the central platform

Most likely both uplinks were briefly down. Local audit storage on the master buffers events for offline replay. Check ELM-GE's offline event buffer and the most recent successful upload timestamp. If the local buffer was full, that is itself an event the master logs.

Reader on one floor is unresponsive

BUS-side issue, not master-side. Check that floor's reader power, then the bus segment continuity between the master and the failed reader. The rest of the bus segment may continue to function; the master logs the missing reader.

11 — How ELM-GE Compares to Alternatives

• Button-simulator products. A small box that closes a contact across a floor-button input on a valid card. Cheap and quick to install, but invisible to the elevator's higher-level features (destination dispatch, group control), brittle when the call panel changes, and unable to be properly logged on the elevator side. ELM-GE replaces this with a direct controller command path and a real call event.
• Generic IP access controllers retrofitted to elevators. Often use Wiegand at the reader and dry contacts at the elevator. They work, but they reduce the elevator to a binary "go / no-go" floor by floor, losing the controller's dispatch intelligence. ELM-GE preserves the controller's intelligence because it talks to the controller properly.
• Manufacturer-OEM access modules. Some elevator manufacturers offer their own access-control module that integrates natively with their controllers. These are usually expensive, manufacturer-locked, and tied to their own credential platform. ELM-GE is brand-agnostic on the credential side and integrates per controller make on the controller side.
• No access control at all. The default in many older buildings. ELM-GE is the controlled-floors retrofit that respects how modern elevator controllers work, rather than forcing the building to choose between "no access control" or "destroy the elevator's dispatch logic with a button simulator".

12 — Current Implementation Status

To set integrator expectations honestly:

Current status: in development

• Architectural role, capability set and integration philosophy are stable: dual-path uplink, RS-485 downstream BUS, direct controller integration, premium validation stack.
• Specific elevator-controller integrations are completed per supported make; full supported list is part of the in-development scope.
• Uplink security details (TLS profile, key storage, mutual-auth scheme) are being finalised.
• Production timelines, pricing, and lead times will be published with the production release.
• Photographs of the development unit are kept confidential during this phase.

Confirmed at this stage

• Dual uplink: Ethernet + GSM.
• Downstream BUS: RS-485 to readers, nodes, expansion modules.
• Direct elevator controller integration — not button simulation.
• Per-credential priority based on functions the elevator controller supports.
• Architecture designed for expansion with further AXON modules.
• Premium-grade validation policies.

Not yet finalised (do not pin in tender documents)

• Full supported elevator controller matrix.
• Final TLS / mutual-auth profile on the uplink.
• Cellular standards supported (2G / 4G / LTE-M).
• Exact MCU / SoC, supply voltage, dimensions, certifications.
• Local audit storage capacity and offline grace policy.

13 — Key Takeaways

14 — Frequently Asked Questions

What does direct elevator controller integration actually mean?

ELM-GE talks to the elevator controller using the controller's own command interface and issues real destination calls. It does not close a contact across a floor-button input on the call panel. That distinction matters: real calls are visible to the controller's dispatch logic, button simulations are not.

Why dual-path uplink with Ethernet and GSM?

Ethernet is primary and cheap; GSM is the management lifeline when the building LAN fails. Elevator machine rooms see more incidental LAN disruption than people expect, and the consequence of an isolated master is residents waiting on a floor. GSM closes that gap.

Why is button simulation worse than direct integration?

Button simulation is invisible to the elevator's higher-level features (destination dispatch, group control, priority) and cannot be logged as a real call. It also fights the elevator's own panel diagnostics. Direct integration is logged on both sides and respects the controller's logic.

Are floor buttons still needed?

In a full ELM-GE deployment they become largely optional. Most buildings keep only readers visible on the landings; an override panel may remain for service and emergency. The default access flow no longer needs every floor to expose a full button matrix.

What does premium validation mean?

Multiple policy layers stacked on every event: identity, time window, per-credential floor list, priority class, lockdown, override. Denials are logged with the layer that denied. The master reconciles the controller's response to its own command and flags anomalies.

What does ELM-GE talk to on the RS-485 BUS?

Landing readers, floor nodes (AXON Node), output expansion modules (RBN-2, SSR-32), and any future AXON expansion node. The BUS is the local control fabric inside the building.

Which elevator controllers does ELM-GE integrate with?

Per-controller integration work; the supported list is part of the in-development scope. For a specific project, share the elevator controller make and model with AXON to confirm the integration path before specifying ELM-GE.

What happens during fire or emergency events?

The elevator controller takes precedence — it enters fire service mode and runs its own emergency program. ELM-GE logs the transition and stops issuing access-driven calls. Access control is always subordinate to life safety.

Is ELM-GE shipping today?

No — it is in development. The role and capability set are defined, controller integrations are being completed make by make, and production timelines will be published with the production release. Pilots can be arranged for planned installs.

What happens if both uplinks are down?

The master continues to operate from local policy cache and buffers audit events locally. When either uplink is restored, queued events upload to the central platform. A configurable offline grace policy defines how long cached policy continues to be honoured before degraded behaviour engages.

15 — Related Guides and Products

16 — Pilot the AXON ELM-GE on Your Project

Planning a high-rise residential, hotel, hospital, or mixed-use office install in Kosovo or the wider region where the elevator must respect access policy without losing its own dispatch intelligence? We can scope the integration with your specific elevator controller, plan the BUS topology, and arrange a pilot integration as ELM-GE completes validation. Production availability follows validation completion.

17 — References and Standards

• EN 81-20 (Safety rules for the construction and installation of lifts — Lifts for the transport of persons and goods)
• EN 81-50 (Safety rules for the construction and installation of lifts — Examinations and tests / design rules)
• IEEE 802.3 (Ethernet 10/100 Mbps physical and data link layers)
• TIA-485-A (RS-485 differential multi-drop electrical interface)
• 3GPP (Cellular standards body — GSM / LTE / LTE-M specifications)