We’re Tracking the Future of Security

Category: Articles & Analysis

Long-form guides, explainers, comparisons, analysis and sector assessments.

  • Blue Light Emergency Phone Towers: Campus Communication That Still Works

    Blue Light Emergency Phone Towers: Campus Communication That Still Works

    Blue light emergency phone towers — the tall poles topped with a blue strobe light and a direct-dial emergency phone, common on university campuses, parking structures and transit stations — predate smartphone safety apps by decades, and remain in wide deployment for a specific reason: they don’t depend on the person needing help having a charged, working phone with a signal.

    Why the Technology Persists

    A blue light tower’s core reliability advantage is its independence from the user’s own equipment. A phone with a dead battery, no cellular signal, or a user who is a visitor unfamiliar with a campus’s safety app is still able to reach help through a fixed, clearly marked tower simply by pressing a button, with no account, download, or prior setup required. This makes the technology particularly valuable for visitors, contractors, and anyone in a momentary crisis where fumbling with a smartphone app is a real practical barrier.

    How the Call Routes

    Most modern blue light systems route the call directly to campus police, security dispatch, or a monitored central station, often with the tower’s exact location automatically identified to the responder based on which unit placed the call — removing the need for a caller to describe their location verbally, which is a common source of delay and error in traditional 911 calls, particularly on large or unfamiliar campuses.

    Placement and Visibility Design

    Effective blue light tower placement follows sightline principles similar to other visible-deterrent security infrastructure: towers are positioned so that from any point along a typical pedestrian path, at least one tower is visible, creating both a practical response option and a psychological sense of monitored space. The strobe light itself serves two purposes — helping a person in distress locate the nearest tower, and helping responding officers quickly locate the caller once they arrive on scene.

    Integration With Modern Systems

    Newer blue light tower deployments increasingly integrate with campus video surveillance, automatically directing the nearest camera to the tower’s location when a call is placed, and with mass notification systems, allowing a tower activation to optionally trigger area-wide alerts for incidents that warrant broader awareness rather than just a dispatched response.

    Conclusion

    Blue light emergency towers remain relevant not because they’re more advanced than a smartphone safety app, but because their reliability doesn’t depend on the user’s device, connectivity, or familiarity with an app — a meaningful advantage precisely in the moments when a person is least likely to be in a position to troubleshoot technology. Most campus safety programs today run both systems in parallel, recognizing that different users and different emergencies call for different response paths.

  • Anti-Tamper Sensors: Protecting Security Equipment From Being Disabled

    Anti-Tamper Sensors: Protecting Security Equipment From Being Disabled

    A security system’s core promise is that it will detect and report threats. That promise is only as trustworthy as the system’s ability to also detect and report attempts to interfere with itself — without tamper detection, a disabled camera or cut sensor cable can simply go unnoticed rather than trigger an alert, defeating the system’s purpose at precisely the moment it matters most.

    Common Tamper Detection Methods

    Enclosure tamper switches, typically mechanical or magnetic, detect when a camera housing, control panel, or junction box has been opened without authorization, immediately generating an alert distinct from a normal operational event. Cable supervision, used on wired alarm and access control circuits, monitors for changes in electrical resistance along a cable run, detecting cuts, shorts, or unauthorized splices that would otherwise silently disable a sensor or door contact.

    Video Tamper Detection

    Modern video analytics platforms include tamper-detection algorithms that flag when a camera’s view has been obscured, defocused, redirected, or covered — distinguishing between a legitimate scene change (like a parked truck temporarily blocking part of a view) and a deliberate attempt to blind the camera, based on how abruptly and completely the change occurs. These algorithms are tuned to balance sensitivity against false alarms from ordinary environmental changes like fog, rain, or spider webs on the lens.

    Power and Communication Supervision

    Beyond the sensor itself, tamper resistance extends to the power and communication paths that keep a sensor reporting: battery-backed systems detect AC power loss and communication supervision detects when a device stops checking in on its expected schedule, both of which can indicate a device has been physically disconnected or its network connection deliberately severed rather than simply malfunctioning.

    Where Tamper Detection Gets Skipped

    Tamper detection is frequently the first feature dropped from a security system design under budget pressure, since it adds cost without providing any day-to-day operational benefit — it only demonstrates value in the relatively rare event that someone actually attempts to defeat the system. Facilities with genuine adversarial threat models, rather than purely accidental-event concerns, should treat comprehensive tamper detection as a core requirement rather than an optional add-on, since it directly addresses the threat scenario where a determined intruder specifically targets the security system itself before proceeding.

    Conclusion

    Anti-tamper capability doesn’t make a security system detect more events; it makes the system harder to defeat without detection, which is a fundamentally different and, for adversarial threat models, equally important property. Evaluating a security system’s tamper resistance alongside its detection capability gives a more complete picture of how the system will actually perform against a determined attempt to disable it, not just against routine events.

  • Security System Commissioning: Why ‘Installed’ Is Not the Same as ‘Working’

    Security System Commissioning: Why ‘Installed’ Is Not the Same as ‘Working’

    A security system that has been physically installed and one that has been properly commissioned are not the same thing, even though the distinction is often glossed over in project timelines. Commissioning — the structured process of verifying that a system actually performs as designed, under real conditions, before it’s handed over as operational — is where a surprising share of real-world security-system failures actually originate, not in the equipment itself.

    What Commissioning Actually Tests

    Proper commissioning goes beyond confirming that a camera powers on and a door reader beeps. It verifies specific, documented functional requirements: that each camera’s field of view matches the design intent, that access control doors correctly enforce their intended schedules and credential rules, that alarm points report correctly to the monitoring platform, and that integrations between subsystems — video triggered by access denials, for instance — actually fire as designed rather than merely being wired correctly.

    Acceptance Testing as a Formal Gate

    Acceptance testing is the formal process, typically involving the client or an independent commissioning agent, of systematically verifying each functional requirement against a written test procedure and signing off only once each item passes — rather than accepting a system based on a general walkthrough. Skipping a documented acceptance test in favor of an informal handover is one of the most common ways a system defect goes unnoticed until it matters during an actual incident, months after installation.

    Integration Testing Gaps

    Individual subsystems frequently pass their own isolated tests while the integrations between them remain unverified — a camera can correctly record video and an access control panel can correctly log an event, while the specific integration point where an access denial is supposed to trigger a camera preset or alert goes untested because no one owns responsibility for testing across the subsystem boundary. Commissioning plans need to explicitly assign ownership for testing cross-system integrations, not just individual components.

    Documentation as a Commissioning Deliverable

    A commissioning process that isn’t documented is difficult to repeat and impossible to audit later. As-built drawings, device schedules, test results, and configuration backups produced during commissioning become the baseline reference for every future service call, expansion, or incident investigation — their absence is a common reason later troubleshooting takes far longer than it should.

    Conclusion

    The gap between “installed” and “working” is exactly what commissioning and acceptance testing are designed to close, and the discipline to run that process formally — rather than treating it as a formality to rush through before handover — is one of the more reliable predictors of whether a security system will actually perform when it matters.

  • IP and IK Ratings Explained: What Weatherproofing Codes Actually Mean for Security Equipment

    IP and IK Ratings Explained: What Weatherproofing Codes Actually Mean for Security Equipment

    IP66, IK10, and similar alphanumeric codes appear on nearly every outdoor camera, access control reader, and enclosure datasheet, but the codes are frequently treated as a simple pass/fail badge rather than what they actually are: specific, testable claims about resistance to particular hazards, with real limits on what they do and don’t cover.

    IP Codes: Ingress Protection

    The IP (Ingress Protection) rating system, defined by IEC 60529, uses two digits: the first indicates protection against solid objects and dust, on a scale from 0 (no protection) to 6 (fully dust-tight); the second indicates protection against water, from 0 (no protection) to 9K (protection against high-pressure, high-temperature washdown). A camera rated IP66 is dust-tight and protected against powerful water jets from any direction — a common and reasonable standard for outdoor security cameras, though it does not guarantee protection against submersion, which requires an IP67 or IP68 rating instead.

    IK Codes: Impact Protection

    The IK rating system, defined by IEC 62262, measures resistance to mechanical impact, on a scale from IK00 (no protection) to IK10 (resistant to a 20-joule impact, roughly equivalent to a 5kg mass dropped from 40cm). IK ratings matter most for equipment mounted in publicly accessible locations at ground level or within reach, where vandalism-resistance is a practical concern rather than a theoretical one; a camera mounted 4 meters up a pole has a much lower practical need for a high IK rating than one mounted at head height in a public corridor.

    What the Ratings Don’t Cover

    Neither IP nor IK ratings say anything about temperature range, UV resistance, or long-term material degradation from sun exposure — a housing can be IP66/IK10 rated and still fail prematurely in a hot, high-UV climate if its plastics weren’t formulated for that environment. Buyers evaluating outdoor equipment for extreme climates need to check operating temperature range and UV/weathering certifications separately from the IP/IK codes.

    Matching Ratings to Real Deployment Conditions

    Over-specifying ratings has a real cost: higher IP/IK-rated enclosures are typically more expensive and sometimes bulkier, so specifying IK10 vandal-resistant housings for equipment mounted well out of reach, or IP69K washdown ratings for equipment that will never face pressure-washing, adds cost without adding real-world protection. The right approach is matching the specific rating to the specific hazard actually present at each deployment location, rather than defaulting to the highest available rating across an entire project.

    Conclusion

    IP and IK ratings are precise, testable engineering specifications, not marketing shorthand for “rugged.” Reading the actual digits, and understanding what hazard each one certifies protection against, lets security teams specify equipment that matches real deployment conditions instead of over-paying for protection against hazards that were never present at the site.

  • Emergency Lighting and Egress Path Marking: Seeing the Way Out

    Emergency Lighting and Egress Path Marking: Seeing the Way Out

    When smoke and power loss combine during a fire, the difference between an orderly evacuation and a dangerous one often comes down to a simple factor: whether occupants can actually see the path to an exit. Emergency lighting and egress path marking exist specifically to guarantee that visibility under exactly the conditions when normal lighting and clear sightlines are most likely to fail.

    Emergency Lighting Fundamentals

    Emergency lighting systems are designed to activate automatically on normal power loss, typically drawing on battery backup or a dedicated emergency circuit, and are required by code to maintain a minimum illumination level along designated egress paths for a specified duration, commonly 90 minutes. The requirement isn’t just that lights come on, but that they provide enough even, sustained illumination for occupants to navigate stairwells and corridors safely, which is why emergency lighting placement and photometric calculations are a distinct design discipline from normal architectural lighting.

    Photoluminescent Path Marking

    Photoluminescent (glow-in-the-dark) egress markings — strips along stairwell handrails, door frames, and floor-level path indicators — provide a passive backup that requires no electrical power at all, instead absorbing and storing ambient light during normal conditions and releasing it as visible glow during an outage. This makes photoluminescent marking particularly valuable in high-rise stairwells, where it has become a code requirement in many jurisdictions following incidents where smoke obscured even functioning emergency lighting.

    Why Smoke Defeats Lighting Alone

    Emergency lighting alone can be rendered nearly useless in a smoke-filled space, since dense smoke scatters and absorbs light in a way that clear air does not — a working light fixture overhead may be effectively invisible to someone at floor level in heavy smoke. Low-level, floor-mounted path marking (whether photoluminescent strips or low-level electric lighting) addresses this specifically, since smoke stratifies with the clearest air typically near the floor, making low-mounted markings visible even when overhead lighting is obscured.

    Directional and Exit Sign Requirements

    Beyond general path illumination, exit signage itself is subject to specific requirements for size, contrast, and illumination, including directional arrows at points where the path to the nearest exit isn’t immediately obvious. Codes typically require exit signs to remain legible and illuminated under the same emergency power conditions as the egress path lighting itself, since a sign that goes dark exactly when it’s needed most fails at its core purpose.

    Testing and Maintenance

    Like fire alarm and suppression systems, emergency lighting requires regular functional testing — typically monthly brief tests and annual full-duration tests — to confirm batteries hold sufficient charge and fixtures actually illuminate to code-required levels. A system that passes its initial installation inspection but is never tested again can degrade silently over years of battery aging until it fails exactly when called upon during an actual emergency.

    Conclusion

    Emergency lighting and egress path marking address a failure mode that is easy to overlook until it matters: an evacuation route that is structurally sound and code-compliant on paper but effectively invisible under the smoke and power-loss conditions an actual fire creates. Designing for that specific scenario, rather than for normal power-on visibility, is what separates an egress system that works on paper from one that works when it counts.

  • Data Center Physical Security Tiers: What Uptime Institute Standards Actually Require

    Data Center Physical Security Tiers: What Uptime Institute Standards Actually Require

    Data center operators and vendors frequently reference “Tier III” or “Tier IV” certification when describing physical security posture, but the Uptime Institute’s Tier Classification System is fundamentally a redundancy and uptime standard for electrical, mechanical and cooling infrastructure — not a prescriptive physical security checklist. Understanding what Tier ratings actually certify, and what they don’t, matters for anyone evaluating a data center’s real security posture.

    What Tier Ratings Measure

    The four Tier levels (I through IV) describe increasing redundancy in power and cooling infrastructure, from Tier I’s single, non-redundant delivery path to Tier IV’s fully fault-tolerant design with multiple independent, physically isolated distribution paths that can sustain a single equipment failure or planned maintenance event without disrupting operations. Higher Tiers correlate with higher available uptime, but the certification itself is an engineering-infrastructure standard, not a security-controls audit.

    Where Physical Security Fits

    Physical security controls — perimeter fencing, mantrap entries, biometric access control, video surveillance coverage, security staffing models — are typically evaluated separately, through frameworks like SOC 2 Type II audits, ISO 27001 certification, or customer-specific due diligence questionnaires, rather than through the Tier system itself. A facility can hold a high Tier rating for its infrastructure redundancy while having comparatively modest physical security controls, and vice versa; the two certifications answer different questions.

    Layered Physical Security in Practice

    In practice, most colocation and hyperscale data centers implement a layered physical security model regardless of Tier rating: perimeter fencing and vehicle barriers, a staffed and monitored entry point, mantrap or interlocking doors preventing tailgating into the data hall, cabinet-level locking for individual customer environments, and comprehensive video coverage of all these layers with defined retention periods. The specific combination and rigor of these layers varies significantly by operator and customer tier of service, independent of the facility’s Uptime Institute rating.

    Reading Vendor Claims Correctly

    When evaluating a data center provider, treating “Tier III” or “Tier IV” as a proxy for security maturity is a common but mistaken shortcut. The more relevant questions for security due diligence are what specific physical security controls are documented and independently audited, what the incident history looks like, and whether the facility’s actual physical security implementation has been validated by a third party — none of which the Tier rating itself certifies.

    Conclusion

    Tier ratings remain a useful, standardized way to compare infrastructure redundancy and expected uptime across data center providers, but they should not be treated as a substitute for evaluating physical security controls directly. Organizations selecting a data center for security-sensitive workloads need to request and review security-specific certifications and documentation separately from whatever Tier rating the facility advertises.

  • Exit Devices and Delayed Egress: Balancing Life Safety and Security at Emergency Doors

    Exit Devices and Delayed Egress: Balancing Life Safety and Security at Emergency Doors

    Every secured door creates a quiet tension: the same barrier designed to keep unauthorized people out is also a door that occupants may need to pass through quickly in an emergency. Exit devices and delayed-egress hardware exist specifically to manage that tension, and getting the configuration wrong is both a security gap and a life-safety liability.

    Panic Hardware and Life Safety Codes

    Panic hardware — the horizontal crash bars found on many commercial exit doors — is designed so that a single motion, pushing against the bar, releases the latch regardless of how the door is otherwise secured from the outside. Life safety codes in most jurisdictions require unobstructed, immediate egress from assembly and high-occupancy spaces, which generally means panic hardware cannot be paired with any locking mechanism that could delay a building occupant’s exit during an emergency.

    Delayed Egress as a Controlled Exception

    Delayed-egress locking is a specific, code-recognized exception to immediate-egress requirements, used where a facility has a legitimate security reason to briefly deter unauthorized exit — retail loss prevention, infant-abduction prevention in maternity wards, or controlling movement in a secure facility. A delayed-egress device allows the door to remain locked for a defined period, typically up to 15 seconds, after someone pushes against the exit hardware, accompanied by a local alarm, after which the door releases automatically whether or not the person is still pushing.

    Codes governing delayed egress are specific about what triggers immediate release: an active fire alarm or sprinkler activation must override the delay entirely, since the exception exists for security deterrence, not for overriding actual emergency egress needs.

    Access-Controlled Egress vs. Delayed Egress

    Access-controlled egress hardware is a related but distinct category, used on doors where free egress is required but the facility wants to log or monitor who is leaving. Unlike delayed egress, these doors release immediately on request-to-exit motion detection or a push, without an enforced delay, while still generating a monitored event for the security system.

    Fail-Safe vs. Fail-Secure at Exit Doors

    Whether a given exit door should fail safe (unlock on power loss) or fail secure (remain locked on power loss) depends on the specific occupancy and code requirements at that opening — a decision that has to be made door-by-door rather than as a blanket facility policy, since a single building often has doors serving genuinely different life-safety and security roles.

    Conclusion

    Exit hardware sits at the exact intersection of security and life safety, which is why its configuration is more heavily code-regulated than almost any other access control component. Facility and security teams designing or auditing exit-door hardware should treat local fire and building code requirements as the binding constraint, with security objectives implemented within whatever margin those codes actually allow.

  • CCTV Lens Optics: Focal Length, Varifocal and Fixed Lenses Explained

    CCTV Lens Optics: Focal Length, Varifocal and Fixed Lenses Explained

    Surveillance system discussions tend to focus on sensor resolution and AI analytics, but the lens sitting in front of that sensor determines what the camera can physically see before any of that processing happens. A high-resolution sensor paired with the wrong lens for its mounting distance and coverage goal will underperform a lower-resolution camera with correctly specified optics.

    Focal Length and Field of View

    Focal length, measured in millimeters, determines a lens’s field of view and magnification: shorter focal lengths (wide-angle) capture a broader scene at lower magnification, while longer focal lengths narrow the field of view and magnify distant subjects. The tradeoff is fundamental — a lens cannot simultaneously deliver a wide field of view and high magnification of distant detail, which is why sites often deploy a mix of wide-coverage and narrow-focus cameras rather than relying on one lens type throughout.

    Fixed vs. Varifocal Lenses

    Fixed lenses have a single, unchangeable focal length, set at manufacture or installation. They are simpler, generally cheaper, and often produce sharper images since there are fewer moving optical elements, but they lock in a specific field of view that cannot be adjusted after mounting without physically swapping the lens.

    Varifocal lenses allow the focal length to be adjusted within a range, either manually at installation or, on motorized varifocal models, remotely after the camera is mounted. This flexibility is valuable when the exact mounting distance and required coverage area aren’t known until the camera is physically installed, or when coverage requirements might change over the life of the deployment.

    Aperture and Low-Light Performance

    A lens’s maximum aperture, expressed as an f-number, determines how much light it can gather, which directly affects low-light image quality independent of sensor sensitivity. A lower f-number (a “faster” lens) admits more light, generally producing a brighter, less noisy image in low-light conditions, though very wide apertures can reduce depth of field, narrowing the range of distances that remain in sharp focus simultaneously.

    Matching Lens to Application

    Wide-angle lenses suit broad-area overview coverage — parking lots, open yards, retail floor overview — where identifying individual faces at distance is less important than tracking overall activity. Narrower, longer-focal-length lenses suit identification-critical points like entrances, cash registers, or license plate capture zones, where enough pixels-on-target are needed to resolve fine detail rather than broad context.

    Conclusion

    Lens selection is a design decision that has to happen alongside camera placement planning, not after it — a camera mounted at the wrong height or distance for its lens’s focal length will underperform regardless of sensor quality. Getting the pairing right, informed by the actual mounting distance and the specific identification-versus-overview goal of each camera position, is what turns a high-resolution sensor into genuinely useful footage.

  • Two-Person Integrity: Dual Authorization Access Control for High-Consequence Areas

    Two-Person Integrity: Dual Authorization Access Control for High-Consequence Areas

    For most secured spaces, the security question is simply who should be allowed in. For a narrower category of high-consequence areas — pharmaceutical controlled-substance vaults, cash-handling rooms, weapons storage, sensitive server rooms, certain industrial control rooms — the more important question is whether any single individual should ever be able to gain access alone at all. Two-person integrity (2PI) access control exists to enforce that no single person can act unilaterally in these spaces.

    The Core Principle

    Two-person integrity requires two separately authorized, distinct individuals to be simultaneously present to gain and maintain access to a controlled area, rather than one person’s credential being sufficient on its own. The underlying goal isn’t distrust of any specific individual; it’s structural risk reduction — removing the possibility that a single compromised credential, a single coerced employee, or a single person acting alone can result in unauthorized access to the most consequence-sensitive spaces in a facility.

    How It’s Implemented

    The most common implementation requires two independent, valid credential presentations within a defined time window before an access control system will unlock a controlled door, with the system explicitly rejecting a second scan from the same credential to prevent a single person defeating the control by badging twice. More rigorous implementations pair this with biometric verification for each individual, video confirmation that two distinct people are actually present, and logging that records both individuals’ identities against the access event, not just the fact that “two-person” access occurred.

    Handling the Exit Side

    Two-person integrity is often designed asymmetrically: exit typically doesn’t require the same dual authorization as entry, both because life-safety egress requirements generally take precedence and because the security concern is usually about who can initiate access to the controlled area, not who can leave it. Facilities implementing 2PI need to explicitly define this asymmetry rather than assuming it, since an overly rigid two-person requirement on egress can itself become a life-safety problem during an emergency.

    Where It Breaks Down in Practice

    The most common practical failure of two-person integrity isn’t a technology gap but a workflow one: when staffing is tight, employees under pressure to get a task done sometimes badge a colleague in and then leave, defeating the “simultaneous presence” requirement the control depends on. Facilities that rely on 2PI for genuinely high-consequence areas need staffing models and monitoring that make the control practically sustainable, not just technically correct on paper.

    Conclusion

    Two-person integrity is one of the more demanding access control patterns to implement well, because it depends as much on staffing discipline and monitoring as on the underlying credential technology. For the narrow set of areas where the consequence of a single unauthorized entry is severe enough to justify the operational overhead, it remains one of the more effective structural controls available — but only when the workflow around it is designed as carefully as the access control logic itself.

  • Smoke Control and Stairwell Pressurization: How Buildings Manage Smoke During a Fire

    Smoke Control and Stairwell Pressurization: How Buildings Manage Smoke During a Fire

    In most building fires, smoke inhalation rather than direct burns is the primary life-safety threat, which is why modern fire protection engineering treats smoke control as a distinct discipline from fire suppression. Sprinklers and fire-rated construction address the fire itself; smoke control systems address keeping escape routes usable while that fire is being dealt with.

    Why Smoke Is the Primary Threat

    Smoke spreads faster than fire, traveling through stairwells, elevator shafts, and HVAC ductwork well beyond the room of origin, and can rapidly make normally survivable spaces impassable due to reduced visibility and toxic combustion products. In high-rise buildings, where full evacuation to ground level can take significant time, keeping stairwells and refuge areas smoke-free during that evacuation window is often more operationally critical than the fire suppression response itself.

    Stairwell Pressurization

    Stairwell pressurization systems use dedicated fans to maintain the stairwell at a higher air pressure than the adjacent floor spaces, so that when a stairwell door opens during an evacuation, air flows outward from the stairwell into the fire floor rather than allowing smoke to flow into the stairwell. This positive-pressure design is what keeps a high-rise egress stairwell usable even on a floor where a fire is actively burning nearby.

    Getting pressurization right is a balancing act: too little pressure fails to keep smoke out, while excessive pressure can make stairwell doors difficult for occupants, particularly those with limited mobility, to physically open against the pressure differential during an evacuation.

    Smoke Zones and Compartmentation

    Large-footprint and high-rise buildings are typically divided into smoke zones, with smoke barriers, dampers and dedicated exhaust systems designed to contain smoke within the zone of origin rather than letting it spread building-wide. On fire alarm activation, building automation systems can trigger dedicated smoke-zone exhaust fans to actively remove smoke from the affected zone while supply fans elsewhere maintain pressure differentials that keep smoke from migrating into unaffected areas.

    Elevator Smoke Control

    Elevator shafts present a particular smoke-control challenge, since they can act as a chimney, rapidly drawing smoke through the building via stack effect. Elevator lobbies in modern high-rises are frequently designed with their own pressurization or smoke-purge systems, both to keep elevators usable for firefighter access during an incident and to prevent the shaft itself from becoming a smoke-distribution pathway to upper floors.

    Conclusion

    Smoke control engineering rarely gets the visibility that fire suppression systems do, but it is frequently the difference between a stairwell that remains usable throughout an evacuation and one that becomes impassable within minutes. Building code requirements for smoke control scale with building height and occupancy specifically because the failure mode — a filled, unusable egress route — is one of the most consequential outcomes a fire protection system is designed to prevent.