HID PIVCLASS M2000 Operator's manual

hidglobal.com
PIVCLASS® AUTHENTICATION MODULE
MODEL M2000
INSTALLATION AND CONFIGURATION GUIDE
PLT-01628, Rev. D.2
January 2019

2January 2019
Copyright
© 2014 - 2019 HID Global Corporation/ASSA ABLOY AB. All rights reserved.
This document may not be reproduced, disseminated or republished in any form without the prior written
permission of HID Global Corporation.
Trademarks
HID GLOBAL, HID, the HID Brick logo, the Chain Design, pivCLASS, Seos, and iCLASS are trademarks or
registered trademarks of HID Global, ASSA ABLOY AB, or its affiliate(s) in the US and other countries and
may not be used without permission. All other trademarks, service marks, and product or service names are
trademarks or registered trademarks of their respective owners.
MIFARE DESFire is a registered trademark of NXP B.V. and are used under license.
Revision history
Contacts
For additional offices around the world, see www.hidglobal.com/contact/corporate-offices
Date Description Revision
January 2019 Updates implemented:
႑Section 1.1 Product overview. Updated FIPS and NIST references.
႑Section 2.1 Technical specifications. Updated specifications.
႑Section 3 Module description and Section 4 Installing the module. Updated
sections relating to supported PoE capability.
႑Section 6.3.2 Troubleshoot communication issues. Updated the “Green power
drop voltage” issue and the “PoE capable switch is being used” issue.
႑Section 7 Regulatory. Updated Regulatory statements.
D.2
Americas and Corporate Asia Pacific
611 Center Ridge Drive
Austin, TX 78753
USA
Phone: [phone]
Fax: [phone]
19/F 625 King’s Road
North Point, Island East
Hong Kong
Phone: [phone]
Fax: [phone]
Europe, Middle East and Africa (EMEA) Brazil
Haverhill Business Park Phoenix Road
Haverhill, Suffolk CB9 7AE
England
Phone: [phone]
Fax: [phone]
Condomínio Business Center
Av. Ermano Marchetti, 1435
Galpão A2 - CEP 05038-001
Lapa - São Paulo / SP
Brazil
Phone: [phone]
HID Global Technical Support: www.hidglobal.com/support

Contents
January 2019 3
Section 1: Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.1 Product overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.2 Scope of document . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.3 Assumed knowledge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.4 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
1.5 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Section 2: Specifications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.1 Technical specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.2 Cable specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Section 3: Module description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
3.1 Physical features. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
3.2 Security features. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3.3 Card Passthrough. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3.3.1 PAM operation without Card Passthrough . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3.3.2 PAM operation with Card Passthrough . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12
Section 4: Installing the module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
4.1 Checking the package contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
4.2 Installation preparation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
4.2.1 Creating a SD card image. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14
4.2.2 PAM firmware upgrade from pre 5.x to 5.x. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14
4.3 Enclosure installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
4.3.1 PAM mounting dimensions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15
4.4 Making jumper connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
4.5 Wiring connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
4.5.1 Connecting PAM to supported reader port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17
4.5.2 Connecting PAM to PACS panel reader port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17
4.6 Connecting to the network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
4.7 Connecting to the power supply. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
4.8 Applying power . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
4.9 Disabling power . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

4January 2019
PLT-01628, Rev. D.2
Section 5: PAM configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
5.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
5.2 PAM DIP switches. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
5.3 PAM Configuration application overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
5.4 Manual PAM configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
5.4.1 Panel API communication options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
5.4.2 Configure the PAM to communicate with the PACS Service . . . . . . . . . . . . . . . . . . . . . 24
5.4.3 Configure PAM in Reader Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
5.5 Automatic PAM configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
5.5.1 Panel API communication options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
5.5.2 Add automatically discovered PAM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Section 6: Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
6.1 LED activity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
6.2 Resetting to factory defaults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
6.3 Troubleshooting configuration problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
6.3.1 Troubleshoot pivCLASS Reader Services communication . . . . . . . . . . . . . . . . . . . . . . . 37
6.3.2 Troubleshoot communication issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
6.4 Swapping a PAM. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Section 7: Regulatory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Section 1
January 2019 5
1 Introduction
1.1 Product overview
The HID Global pivCLASS® Authentication Module (PAM) allows organizations to upgrade existing Physical
Access Control Systems (PACS) to full HSPD-12 compliance with all of the functionality defined in FIPS 201-2,
FICAM FRTC 1.3.3, and associated publications.
HSPD-12 compliance supports verification of the following card types:
႑Personal Identity Verification (PIV) card.
႑Personal Identity Verification-Interoperable (PIV-I) card.
႑Commercial Identity Verification (CIV) card (also known as PIV-C).
႑Common Access Card (CAC). Standard identification card for United States Defense personnel.
႑First Responder Authentication Credential (FRAC) card.
႑Transportation Worker Identification Credential (TWIC) card.
PAM validates the credentials at the time of access. This validation confirms the card is not counterfeited,
cloned, copied, lost or stolen. FIPS 201-2 and NIST SP 800-116-1 define specific authentication mechanisms
and their application to authenticate PKI based credentials for access to uncontrolled, controlled, limited, and
exclusion areas.
The PAM is installed between a PACS panel and a supported smart card reader. The PAM validates smart
cards at the assurance level set in the pivCLASS Reader Services or by the API. If the card is valid, the PAM
sends the card’s derived badge ID to the PACS.
1.2 Scope of document
This document provides information on the installation and configuration of the HID Global pivCLASS
Authentication Module (PAM).
1.3 Assumed knowledge
This document is aimed at experienced installers with knowledge of Physical Access Control Systems (PACS).

6January 2019
Introduction PLT-01628, Rev. D.2
1.4 Prerequisites
The following prerequisites are required:
1. Install hardware components, including the following:
႑PACS panels (if applicable)
႑Supported Smart Card readers:
႑pivCLASS (PIN, BIO or CAK)
႑Veridt Multimode
႑12 - 24V DC UL294 Access Control/Burglary Power Supply, capable of supporting power
requirements as specified in Section 2 Specifications.
2. Protect the hardware components in the enclosure. See Section 4.3 Enclosure installation.
3. Observe the necessary regulatory information. See Section 7 Regulatory.
4. The pivCLASS Reader Services software has been installed and configured.
5. Ensure Administrators and Users are familiar with PACS operating concepts.
1.5 Glossary
Term Description
BIO Biometrics
CAC Department of Defense Common Access Cards
CHUID Cardholder Unique Identifier
CIV Commercial Identity Verification credential or PIV-C
FRAC First Responder Authentication Credential
PAM pivCLASS Authentication Module
PKI Public Key Infrastructure
TPK TWIC Private Key
TWIC Transportation Worker Identification Credential

Section 2
January 2019 7
2 Specifications
2.1 Technical specifications
2.2 Cable specifications
1Minimum wire gauge depends on cable length and current requirements.
Parameter Specification
Dimensions 6.70 x 6.05 in (17 x 15.4 cm)
7.32 x 6.61 in (18.6 x 16.8 cm), including Enclosure
Power
Input: 12 V DC @ 1.2Amp, 24 V DC @ 600mA
(Note: PAM has a <10ms in-rush of ~2.2A on power on)
Output Reader Power: 11.5 V DC, 300 mA (each)
Relays (if equipped)
Dry Contacts
Coil: 5 V DC, 360mW
Contacts: 28 V DC, 5 Amp (resistive loads only)
Environmental 32° to 120°F (0° to 49°C)
0 to 85% RHNC, Indoor Only
Communication
Host: 10/100 Ethernet TCP/IP TLS (AES Encryption)
Smart Card Readers: Two (2) RS-485 FDX Serial Ports
Access Control System Reader Interface Module: Two (2) Wiegand Ports
Option Length Specification
Input Circuits1500 feet (152 m) 2-conductor, shielded, using Alpha 1292C (22 AWG) or Alpha 2421C
(18 AWG), or equivalent
Output Circuits1500 feet (152 m) 2-conductor, using Alpha 1172C (22 AWG) or Alpha 1897C (18 AWG),
or equivalent
Wiegand 500 feet (152 m) Alpha 1295C, 22 AWG, 5-conductor, stranded, overall shield
Ethernet 300 feet (91 m) Cat5, Cat5E, and Cat6
RS-485 500 feet (152 m) Belden 3108A or equivalent, 22 AWG, 6-conductor, stranded overall
shield

Specifications PLT-01628, Rev. D.2
This page is intentionally left blank.
8January 2019

Section 3
January 2019 9
3 Module description
This chapter describes the physical and security features of the pivCLASS Authentication Module (PAM).
3.1 Physical features

10 January 2019
Module description PLT-01628, Rev. D.2
Physical features include:
႑Console: For internal use.
႑SD Card Socket: Insertion point for the SD Card with PAM Firmware.
႑Power Connector: Connects the PAM to the power supply.
႑Ground Connector: Connect the PAM to Earth ( ) using the lug built onto the PAM.
႑Wiegand 1 and 2 Connector: Connects the PAM to the PACS.
႑GP I/O: General Purpose I/O. Reserved for future use.
႑Relay 1 and 2 (if equipped): Customer configurable for auxiliary purposes.
႑Tamper Monitoring: Enables the system to monitor a normally closed or open (NC/NO) tamper line
wired to the case. This sends a log message back to Reader Services if the tamper line is activated.
Typically, this monitoring is done by the PACS.
႑Power Failure Monitoring: Enables the system to monitor a normally closed or open (NC/NO) power
fail line. This sends a log message back to Reader Services if the power fail line is activated. Typically,
this monitoring is done by the PACS.
႑DIP Switch: Configures the mode on which the PAM is running.
႑Reader 1 and 2 Connector: Connects to the supported reader.
႑Termination Resistor Jumpers: Located inboard from the Reader 2 Connector and includes RS-485
ports. Use when connecting Reader 1 and 2.
႑Ethernet: Connects the PAM to the Network.
Note: If using a Rev A PAM (91000ANNNN or 91000ABNNN), some Gigabit Ethernet Switches may
require setting the port to 100 Mbps or 10 Mbps.
႑RS-485: A serial port reserved for future use.
PIN Assignment
1TMP
2GND
PIN Assignment
1PFL
2GND
CAUTION
Do not use relays for access control, this voids UL certification.
WARNING
It is recommended to disable POE power on the port the PAM is connected to if the switch
is a POE switch.
If using a Rev A PAM (91000ANNNN or 91000ABNNN), the POE power must be turned off
to prevent damage to PAM or switch; or use a non-POE switch.

January 2019 11
PLT-01628, Rev. D.2 Module description
3.2 Security features
Security features include:
႑All TCP ports are closed except for a single port that only accepts authenticated requests from the
pivCLASS Reader Services. The default port is 10200.
႑Communicates with the pivCLASS Reader Services by way of 256-bit AES encrypted over Ethernet
TCP/IP.
႑Web interface for initial PAM configuration (or enabling SSH). Accessed with a DIP switch setting on the
PAM.
႑FIPS 140-2 certified.
႑Cryptographic firmware.
3.3 Card Passthrough
The PAM, through version 5 of the PAM firmware, controls the reader in slave mode. With the reader in slave
mode the PAM controls all of the functions of the reader, this includes:
႑when the reader polls (looks for a card in the RF field and contact if equipped).
႑how it polls (what technologies it polls for).
႑all of the Audio Video (AV) feedback to the end-user.
These polling operations are usually requested from the PAM in 100ms - 200ms intervals.
When operating in a PIV/TWIC - PKI only mode, the PAM will issue a command to the reader to poll the High
Frequency (HF) range of the reader to detect a card. Once a card is found, the PAM will determine the card
type. If the card is a PIV, TWIC, PIV-I, CIV, or FRAC card, the PAM will then process the data and perform
validations per the current configuration. If the card is determined to not be a PIV, TWIC, PIV-I, CIV, or FRAC
card, it will flag the card as a non-vaild card and stop processing it.
When Card Passthrough is enabled on the PAM, the PAM will poll for the PIV/TWIC (or like card) as described
above, and will then issue an additional command for the reader to autonomously poll. When the reader
preforms an autonomous poll, the reader will poll for any technology that it is configured for and then
process the card internally in the reader. The processed data is then sent down to the PAM. The PAM will
recognize the data as not being from a PIV/TWIC (or like card) and then pass it through to the panel (hense
the "Passthrough"). This allows the reader to poll and process technologies such as iCLASS, Seos, Prox,
Mifare, DESFire, etc.
3.3.1 PAM operation without Card Passthrough
The PAM polling cycle when not in Card Passthrough mode is performed completely in slave mode. The PAM
will issue a command to scan the HF field and then to scan the contact slot interface:
1. Scan for PIV or like card
2. Get Response
3. Scan for contact card
4. Get response
5. Disconnect (this step may not be needed)
6. Get response
7. Start over

12 January 2019
Module description PLT-01628, Rev. D.2
3.3.2 PAM operation with Card Passthrough
When Card Passthrough is enabled, the PAM will direct the reader to perform an autonomous poll and
process using a scan and process command. This can be sent at any point after receiving the response from
the previous command to the reader. Current implementation has it after the HF poll.
Example process of PAM with Card Passthrough enabled:
1. Scan for PIV or like card
2. Get Response
3. Send Scan and process command
4. Get response
5. Scan for contact card
6. Get response
7. Disconnect (this step may not be needed)
8. Get response
9. Start over

Section 4
January 2019 13
4 Installing the module
This chapter describes installing, connecting and powering the pivCLASS Authentication Module (PAM).
4.1 Checking the package contents
Before installing the PAM, unpack the contents of the shipping container and make sure that you have the items
listed.
4.2 Installation preparation
Carry out the following:
1. Obtain an Ethernet cable or switch to connect the PAM. The choices are:
႑Crossover cable connects to the pivCLASS PACS Service Application (for configuration).
႑Straight-through cable connects to a hub or switch.
2. Prepare the UL294 Listed Enclosure.
3. Remove the PAM from its packaging.
Note: Ensure the SD Card is correctly seated.
Item Quantity
pivCLASS Authentication Module (PAM) 1
Secure Digital (SD) Card with PAM Firmware
(Note: Depending on configuration this may be pre-installed in the PAM) 1
Jumpers 6
Termination Resistors (118 ohm) 4
CAUTION
ELECTROSTATIC SENSITIVE DEVICES
Observe precautions for handling

14 January 2019
Installing the module PLT-01628, Rev. D.2
4.2.1 Creating a SD card image
If your PC has a SD card reader/writer, you can create an SD card consisting of the latest release PAM
Firmware by downloading the SD card image from the software distribution web site.
1. Install the following tools:
႑7-zip from: http://7-zip.org/download.html
႑HDD Raw Copy Tool from: http://hddguru.com/software/HDD-Raw-Copy-Tool
2. Open a web browser and enter the address of the pivCLASS software distribution site.
Note: This was provided in the entitlement email from HID Global and usually takes the form of:
http://www.pivcheck.com/<folder>
3. From the firmware directory download the desired SD card image file, for example:
firmware_A.B.C.D.dd.bz2 (where A.B.C.D is the release number).
4. Unzip the .bz2 file using 7-zip. The file size will be approximately 2 GB.
5. To create the SD Card Image, launch the HDD Guru HDD Raw Copy Tool.
6. Double-click on File to browse to the location containing the .dd file.
7. Select the file and click Continue.
8. Select the SD card as the destination and click START to begin the sector copy.
9. When complete, the SD card can be removed and is available for use in a PAM.
Note: After booting, the PAM will be returned to factory defaults.
4.2.2 PAM firmware upgrade from pre 5.x to 5.x
To upgrade to 5.x PAM Firmware, the upgrade must be treated as a new installation by creating an SD card
consisting of the latest release PAM firmware by downloading the SD card image from the pivCLASS software
distribution web site.
Note: Make sure to utilize the SD cards shipped from HID Global. Do not use SD cards acquired through other
means.
Note: Make sure to verify the power supply is minimally compliant to the specifications listed in
Section 2 Specifications. Early versions of PAM had lower power requirements resulting in possible
power supply issues for existing installations.
To perform the Firmware upgrade perform the following steps:
1. Power down the PAM.
2. Remove the cover from the PAM.
3. Remove the SD card from the PAM (located on the top right). This will require removing or loosening
the retaining screws.
4. Update the Firmware on the SD card by performing the procedure in Section 4.2.1 Creating a SD card
image.
5. Once the firmware has been updated on the SD card replace the card in the PAM.
6. Re-secure the PAM and reinstall the cover and power up the system.
Configure the PAM with the necessary settings and within the Reader Services, see Section 5 PAM configuration.

January 2019 15
PLT-01628, Rev. D.2 Installing the module
4.3 Enclosure installation
Install the PAM in a UL 294 Listed enclosure. Furthermore, install the PACS and appropriate power supply
(not supplied by HID Global) according to the manufacturer's instructions.
4.3.1 PAM mounting dimensions
Use the dimensions below to mark the drilling holes on the enclosure (the illustration is not to scale) .
WARNING
Connecting pivCLASS Authentication Modules while power is applied may result in
damage.

16 January 2019
Installing the module PLT-01628, Rev. D.2
Note:
႑The mounting hole diameter is 0.14 inch.
႑The recommended mounting screw size is #6 (Imperial) or M4 (Metric).
႑The recommended clearance around the sides of the PAM is least 1 inch to allow for wiring
and access to the SD card.
႑The recommended clearance between the PAM and the chassis is at least 1 inch for
adequate ventilation.
႑Unless already provided by the PACS system, connect a tamper switch (default is Normally
Closed) to monitor the enclosure.
4.4 Making jumper connections
The PAM includes jumper locations (TR1, R1, TR2, R2, TR3 and R3) identified as Termination. They apply to the
RS-485 port terminations (the two reader connections and the RS-485 port - intended for future use).
By default, the jumpers are set to OFF.
If your installation uses long wires between the PAM and the readers (for example, 200 feet or greater), or if
there is significant EMF interference, you must install the jumpers. Jumpers need to be installed on the
Termination pins found on the PAM, located above the Reader 2 port (refer to the diagram in Section 3.1
Physical features).
Jumpers are configured in the following pairs:
႑TR1 and R1 for Reader 1
႑TR2 and R2 for Reader 2
You must install a resistor (typically 120 ohm, +/- 2 ohm) across the RS-485 terminals of the connected reader
(labeled RXA & RXB for the TR+ & TR- pair and TXA and TXB for the R+ & R- pair on a pivCLASS reader).

January 2019 17
PLT-01628, Rev. D.2 Installing the module
4.5 Wiring connections
This section explains wiring the PAM to the PACS panel and supported reader(s).
4.5.1 Connecting PAM to supported reader port
Using a small flat-head screwdriver (1/8 inch or smaller), connect the Reader 1 or Reader 2 connector on the
PAM to the supported reader(s) according to the following table.
4.5.2 Connecting PAM to PACS panel reader port
Using a small flat-head screwdriver (1/8 inch or smaller), connect the PAM Wiegand 1 or Wiegand 2
connector (or both) to the PACS Panel Reader port. Reader 1 corresponds to Wiegand 1 and Reader 2
corresponds to Wiegand 2. See table below.
Note: Ensure connecting the correct connectors, since Wiegand 2 and 1 are flipped compared to Reader 1
and 2. See Section 4.3.1: PAM mounting dimensions.
Note: Some PACS may have multiple LED wires, for example, red/green.
The PAM checks for a constant signal on the LED input (Green LED) indicating access granted by the PACS
after Wiegand is sent. If this signal is not received within one second of sending the Wiegand card number
and PIN then it will be considered access denied (this is the default setting for time-out and is configurable
for each PAM in the pivCLASS PACS Service). Any type of blinking or flashing signals from the panel are not
supported.
PAM Connections (READER 1 or 2) Reader (Pigtail) Reader (Terminal)
TR+ Red/Green GPIO1 (P2-7)
TR- Tan GPIO2 (P2-6)
R+ Gray GPIO4 (P2-1)
R- Pink GPIO3 (P2-2)
GND (Ground) Black GND (P1-3)
VO (Voltage Out) Red +VDC (P1-4)
PAM Connections (WIEGAND 1 or 2) PACS Panel Connections (READER 1 or 2)
GND GROUND
D0 DATA0/DATA
D1 DATA1/CLOCK
BZR BEEPER
LED GREEN LED
WARNING
Do not apply VDC to any connector from the reader other than +VDC.
Applying 12 V DC or greater to the GPIO lines may result in damage to the reader.

18 January 2019
Installing the module PLT-01628, Rev. D.2
Some PACS panels may signal on the LED input (Green LED) when access is not granted. In these cases BZR
should be wired to another output from the PACS panel (most likely the red LED). The PAM will ensure that
the BZR input is not signaled and the LED is signaled in order to interpret the PACS as having provided
access. No configuration change is necessary for this so it is important that the wiring is done with
consideration for the behavior of the PACS panel.
4.6 Connecting to the network
Connect the Ethernet cable between the Ethernet port and the PC, hub or switch. There are two LEDs for the
Ethernet connection; one indicates speed (SPD) and the other indicating Activity (ACT). The ACT LED
(LED5) blinks when there is network activity.
Note:
႑For Rev A of the PAM (91000ABNNN or 91000ANNNN): Some Gigabit Ethernet Switches may
require setting the port to 100 Mbps or 10 Mbps and/or disabling Energy Efficient Ethernet/”Green”
capability of the port. If the switch is a PoE switch and the PoE port must be used, PoE capability
must be disabled.
႑For Rev B of the PAM (91000BNNNN or 91000BBNNN): It is still suggested to disable POE capability
on the port used, however is not required. No other restrictions from Rev A apply.
4.7 Connecting to the power supply
Using a small flathead screwdriver (1/8 inch or smaller), connect the Power connector on the pivCLASS
Authentication Module to the power supply.
Connect only to a Listed Access Control / Burglary Power - limited power supply.
Important: Connect the PAM to a power supply having a battery backup or which is plugged into an
Uninterruptable Power Supply (UPS). Power loss during normal operation might result in the
loss of data or, in extreme cases, might render the SD card unbootable.
Install in accordance with NFPA70 (NEC) Local Codes, and authorities having jurisdiction. Follow all National
and Local Codes.
The following table provides the power supply connections for each power connector.
Connect the PAM to Earth Ground ( ) using the lug built onto the PAM.
PIN Power Connector DC Power Connections
1DC +
2 Not Used
3 GND -
CAUTION
Do not connect to AC. PAM does not support POE Power.

January 2019 19
PLT-01628, Rev. D.2 Installing the module
4.8 Applying power
After attaching all PAM connections apply power and configure the PAM (see Section 5 PAM configuration).
4.9 Disabling power
For powering off the PAM, ensure all processes are complete and remove power.
For PAM Configuration and setup, see Section 5 PAM configuration.
CAUTION
Do not remove power to reboot, unless it is absolutely necessary, as data corruption on the SD
card may occur.

Installing the module PLT-01628, Rev. D.2
This page is intentionally left blank.
20 January 2019