SIA DC-09: alarm event reporting over IP

SIA DC-09 is an open standard from the Security Industry Association (SIA) for reporting alarm events over the internet to a receiver at a monitoring centre. The sender sends each event as a short message over IP, and the receiver acknowledges it.

We use SIA DC-09 to send our own alarm signals, such as a device that has stopped answering, into your control room's monitoring software. To set it up, follow Alarm signals into your monitoring software.

The standard carries alarm events over IP

SIA DC-09 works over any connection that carries IP: fibre, mobile or another link. It is an open standard that panel makers, cloud services and monitoring centres implement, so equipment from one maker can report to a receiver from another.

The standard defines how a message is framed and sent. The events inside it use formats the monitoring industry already knew, such as SIA and Contact ID.

A message names an account and an event

At a high level, every SIA DC-09 message carries four things:

• An account number. It identifies the protected premises, usually the client's record in the monitoring software.
• A format token. It says how the event inside is written: SIA-DCS for SIA event codes, or ADM-CID for Contact ID.
• The event. In SIA format, a two-letter code such as a trouble or a restore, with a zone. In Contact ID, a digit for a new event (1) or a restore (3), a three-digit event code and a zone.
• A sequence number and a check value, so the receiver can tell messages apart and spot a damaged one.

Encryption is optional. When the sender and the receiver share an AES key, the event content is encrypted; without a key it is sent in the clear.

A sender can also send a short supervision message, often called a NULL message, at a set interval. It carries no event. It lets the receiver notice when messages stop arriving.

A receiver accepts and acknowledges each message

A receiver is the monitoring centre's front door for alarm traffic. It is usually software that listens on an internet address and port. When a message arrives, the receiver checks it and replies: an acknowledgement (ACK) when it accepts the message, or a negative acknowledgement (NAK) when it does not.

The sender waits for that reply. A sender that gets no reply can send the message again, or report that it has lost its connection to the monitoring centre.

The monitoring software files the event

The receiver passes each accepted event to the monitoring software, the program the control room's operators work in. The software matches the account number to the client's record and the zone to a device or area at the site. The operator then sees the event on screen with that client's details.

Each receiver input expects one format, SIA or Contact ID, over TCP or UDP. Most receivers use TCP.

How we use SIA DC-09

We send our alarm signals to your receiver over SIA DC-09, in SIA or Contact ID format, with the reason in the alarm text. A device that stops answering is "supervision lost" on that device's zone. A device fault is a trouble code. A site's network going down is its own code. A restore follows when the fault clears. Our signals use zones 700 and above, so your operators can tell them from the site panel's own zones.

In the portal you enter your receiver's address and port, choose TCP or UDP, and choose SIA or Contact ID. You can add an AES key, a backup receiver, and a link check: a supervision message every minute, every 90 seconds, every 5 minutes or every hour. A signal your receiver does not acknowledge is retried automatically, and the portal shows the last error.

Only our own alarm signals travel this way. Your sites' own alarms and camera video do not pass through us. The signalling is one way: an acknowledgement made in your monitoring software is not reported back to us. Alarm signals are part of the Relay + Alerts plan.

Something in this guide is wrong or missing? Tell us: hello@relayant.net.