Everything to install and run both apps.

Overview

Missing Features is a single app that adds analytics, automation and integrations to an Axis camera. Everything runs on the camera itself, with no cloud service and no separate server, and the whole thing is served through the camera web page, so there are no extra ports to open and nothing new to expose on your network.

Each capability is a feature you switch on when you need it. After you open the app you see a grid of feature cards. Turn on the ones a site needs, open a card to set it up, and it starts running on the camera. Each feature has its own part of this manual:

• Flow, a visual automation builder, with its dashboard, its node library and connectors to systems such as Milestone XProtect™, Modbus, OPC UA, SQL and any HTTP service.
• License plate list and Parking management, built on the AXIS License Plate Verifier.
• Gauge reader, which turns an analog dial into a live number.
• Spot color detection, which reads a signal lamp or a coloured indicator.
• Scene analysis trigger, which reacts to where detected objects move.
• SD card tools: a file explorer, event triggered image capture and a timelapse builder.

Whatever a feature detects is written into the camera event system as a standard Axis and ONVIF event. That means you can drive recordings, outputs, video overlays and any VMS with results from Missing Features using the tools you already have.

Install

Missing Features installs like any other camera app.

1. From the Download page, get the .eap file that matches your camera type (aarch64 or armv7hf). If you are not sure which one, the camera model page tells you the architecture.
2. In the camera web page open Apps, choose Add app, and upload the file.
3. License the app before you start it. On the Apps page, open the app's three dots menu and either activate online with your license key, or upload a license file generated on the Axis license key registration page. The Download page has both routes written out in full.
4. Start the app, then choose Open to reach the Missing Features home page with the feature grid.

The first time you open the app you accept the license terms. After that, the home grid is where you turn features on and off. Links to short video tutorials and this documentation sit in the header of the home page.

Getting started

Missing Features is licensed per camera. One license covers one camera, and you enable the features you want from the home grid. Each card has a switch to turn the feature on or off, a short description, and an Open button once it is enabled.

Your first feature

1. Open the app and find the feature you want on the grid.
2. Flip its switch to turn it on.
3. Press Open on the card to configure it. Most features show a live view from the camera so you can set them up against the real scene.
4. Save. The feature now runs on the camera in the background and raises camera events as things happen.

You can enable as many features as a site needs. Analytics features such as the gauge reader and spot color detection stream their live results to the browser while you have the page open, and keep running on the camera after you close it.

If something is not there

Two things account for nearly every "I cannot find it". A feature card that is missing altogether is not licensed on this device yet, since only licensed features appear on the grid. A switch or a field that is greyed out belongs to a permission your account does not have, so ask an administrator for a role that includes it. Each feature has its own troubleshooting further down this page.

General settings

The Settings page holds everything that applies to the whole app rather than to one feature: who may sign in and what they may touch, how the app logs and looks, and how you get a copy of the configuration off the device. It has six tabs.

Users

The user list shows each account with its role and whether it is active or disabled. Add or edit an account with these fields:

The built-in admin account is protected: its username and role cannot be changed and it cannot be deleted, so the device can never end up with no way in. Give day to day operators their own account with a narrower role instead of sharing the admin password.

Roles and permissions

A role is a named set of permissions, and the Roles tab is a matrix: permissions down the side, one column per role, a checkbox where they meet. Permissions are grouped by what they cover, the groups fold away, and the search box filters the whole matrix, which is how you find one right among many.

Create a role with Add Role, or use Duplicate Role on an existing one when the new role is mostly like an old one, then untick what it should not have. The admin role always holds every permission: its checkboxes are locked and it cannot be duplicated or deleted.

Permissions are fine grained, and features split viewing from changing. That is what lets you build, for example, a gatehouse role that opens the Parking management Live tab, manages vehicles and triggers a barrier, but cannot touch zones, rules or the plate list. Tabs and buttons a role does not have simply do not appear.

Server

Sets the log level, which controls how much detail the app writes to the device log. Leave it at the normal level for daily running, and raise it while chasing a problem: the parking detection path in particular logs each decision it makes at debug level. Lower it again afterwards.

Overlay

Controls the overlay service that draws graphics onto the video stream.

• Enable overlay rendering: switches the service on or off. The status chip next to it shows whether it is running, and the Apply button restarts it with the settings you changed.
• Allow untrusted TLS certificates for remote images: only affects remote image URLs inside SVG overlays. Turn it on when those images come from a server with a self-signed or private certificate, and leave it off otherwise, because it switches off certificate checking for those requests.

UI

Where the little confirmation messages appear on screen and how long they stay. Purely cosmetic, and it applies to the whole app.

Backup and restore

A backup is a single zip file holding the device's configuration. Everything you have built lives in it: users and roles, feature settings, flows and composites, parking zones, rules and records, the plate list, and the custom TLS certificate if you uploaded one.

Create Backup Now makes one immediately and the card above it shows when the current backup was taken, how big it is, and whether it was made by hand or automatically. Download saves it to your computer, which is the part that matters: a backup sitting on the device does not survive the device.

Automatic backup runs once a day at the time you set, in 24 hour form, 03:00 by default. It replaces the previous automatic backup rather than piling files up, so download one now and then if you want a history.

Restore takes a backup zip and puts the device back into that state. It replaces the configuration, the users, roles and permissions, the flows and the parking data, then restarts the app and reloads the page by itself. Because it replaces the accounts as well, you sign in afterwards with the credentials that were valid when the backup was made.

Flow automation

Flow is a visual automation builder. Instead of writing code or wiring together several separate tools, you drag blocks called nodes onto a canvas and connect them to describe what should happen. A camera event or a live value comes in on one side, passes through logic, timers, math and rules, and drives an action on the other side. Flows run on the camera, not in the browser, so they keep working after you close the page.

The canvas

The canvas is where you build. Press the space bar to open the node picker, which groups nodes by category and has a most used list and a search box. Drag a node onto the canvas to add it. Select any node to open its settings on the right, and open its built in help to see exactly what its inputs and outputs do.

Wiring nodes together

• Every node has input handles on the left and output handles on the right. Drag from an output to an input to create a connection.
• Connections are typed by the shape and color of the handle, so you always join compatible values (a yes/no signal to a yes/no input, text to text, numbers to numbers). Each input accepts one connection.
• When a flow is running the connecting lines light up with the live value, green for true and red for false on yes/no signals, so you can watch your logic work in real time.

Triggers and edges

Many action nodes only fire on a rising edge, which means the moment a signal turns from off to on rather than the whole time it stays on. This is what lets you say "do this once, when this happens" instead of repeating an action continuously. Nodes such as Edge, Debounce and the timers give you fine control over exactly when things fire.

Running and organizing flows

• Save writes the flow to the camera. Start runs it and animates the live values. Stop halts it.
• Any node that has a problem shows an error on the canvas, and an error count is shown so you can jump straight to it.
• Keep several separate flows as tabs. Import and export a flow as a file to back it up or move it to another camera.
• Group a set of connected nodes into a single reusable block, so a pattern you use often becomes one tidy node.
• Named channels let one flow share a value with another. A Channel Publisher writes to a channel and a Channel Subscriber in any flow reads it, so flows stay independent and never block each other.

Flow dashboard

A flow is a good place to compute something and a poor place to look at it. The Flow dashboard is the other half: a screen you lay out yourself, where each widget shows a live value taken from a point inside a flow. It is a separate feature with its own switch on the home grid, and it needs at least one flow running to have anything to show.

How a widget is bound

Every widget points at one place in one flow: you pick the flow, then the node, then the port on that node whose value the widget should follow. From then on the widget updates as that value changes, with no polling and nothing to refresh. Widgets that send values back into the flow, the button and the text input, work the same way in reverse: the flow reads them as an input.

Each widget also carries a name that can be shown or hidden, its own padding, and whatever settings its type needs, such as the range on a gauge or the columns on a table.

The widgets

Edit mode and live mode

In edit mode you place, size and configure widgets on a grid. In live mode the layout is fixed and only the values move, which is the mode to leave a wall screen in. You can build several dashboards, switch between them as tabs, and set one as the default a given user lands on.

Who sees which dashboard is part of the user account, not of the dashboard: an account can be limited to certain dashboards and given one to open first. See General settings.

Flow node library

Flow ships with a large library of ready made nodes, grouped below by what they do. You will rarely need all of them, but between them they let you build almost any rule without writing code. Where a whole family of connector nodes exists (Milestone, OPC UA, Modbus, HTTP and SQL) the Connectors section covers them in more depth.

Sources and triggers

These bring information or a starting signal into a flow.

• Analytics Metadata: streams the camera's live object detection data, including tracked objects, boxes and classes.
• Metadata Event Subscribe: connects to an Axis device and receives its metadata events.
• Webhook: opens an HTTP or HTTPS listener so another system can push data into the flow.
• TCP Server: listens on a port and emits the text of each message a device sends.
• Button: a push button you press in Live mode to fire a manual trigger or test.
• Bool, Integer, Float and String Input: emit a single fixed value you type in.
• Data Table: holds several constant values in one node, one output each, instead of scattering them around.
• Enable: always outputs on, a simple permanent enable signal.

Logic and flow control

The building blocks for decisions, memory and sequencing.

• Logic: the standard boolean gates (AND, OR, NOT, XOR and their inverses) to combine or invert signals.
• Flip Flop: a one bit memory with Set and Reset that holds its state until told otherwise.
• Edge: emits a single pulse the moment a signal rises or falls.
• Debounce: ignores a flickering signal until it stays steady for a set time.
• Value Changed: pulses only when a value actually changes.
• Value Latch: captures and holds the last value until you reset it.
• Value Selector: forwards one of two inputs depending on a select signal.
• Value Passthrough: copies its input straight to its output, with a chosen data type.
• Value Duplicator: sends one value to several outputs at once.
• Move: passes a value while enabled and holds the last one while disabled.
• Multiplexer: picks one of many inputs by an index number.
• Step Sequencer: turns on one output at a time, stepping forward on each pulse.
• FIFO / LIFO buffer: stores values and releases them later as a queue or a stack.
• Impulse Storage: queues pulses and releases them once a condition allows.
• Edge Value Mux: watches trigger and value pairs and forwards the value of whichever trigger just fired.
• Next Cycle: delays a pulse by one cycle to break feedback loops.
• Lua: runs your own small Lua script when a single node cannot express the logic you need.

Math and comparison

• Math: add, subtract, multiply or divide two numbers.
• Advanced Math: single functions such as absolute value, square root, sine, cosine, tangent and sign.
• Compare: tests two values with an operator and outputs true or false, for numbers or text.
• Counter: counts up or down on pulses, with a reset back to zero.
• Random Number: generates a random whole number or decimal within a range.
• Bit Add: combines several on/off inputs into one whole number.

Numbers and conversions

Convert a value from one type to another so nodes fit together.

• Bool to Int and Int to Bool: switch between an on/off signal and a number.
• Int to String and Float to String: turn a number into text for display or logging.
• String to Int and String to Float: read a number out of text, with a separate output for bad input.

Strings and text

• String Concat and String Join: stitch pieces of text together.
• String Split: break text into parts on a separator.
• String Trim: remove surrounding spaces.
• String Upper and String Lower: change the case of text.
• String Replace: swap one piece of text for another.
• String Is Empty: check whether a piece of text is blank.
• Regex Match, Regex Find All and Regex Replace: match, extract or rewrite text using patterns.
• Base64 Encode and Base64 Decode: convert to and from the Base64 text format used by many web systems.

Time and timers

• Timers (On Delay, Off Delay, Pulse and Pulse Generator): introduce delays, stretch a signal, or produce a single or repeating pulse.
• One Shot Pulse After: emit one pulse a set time after a trigger.
• Timer Sequence: run several timers back to back in a repeating loop.
• In Time: on when the current time is inside a daily window on the weekdays you choose, including windows that cross midnight.
• Date String: the current date and time as text, in a format you pick, plus Unix time.
• Measure Time: measure how long passes between two triggers.

Lists

Work with ordered lists of values.

• List Create: start a new empty list.
• List Push and List Pop: add to or take from the end of a list.
• List Get At, List Set At, List Insert At and List Remove At: read or change the value at a position.
• List Index Of: find where a value sits in a list.
• List Length: count the items.
• List Contains: check whether a value is present.
• List For Each and List Iterator: step through a list one item at a time.

Maps and sets

• Map Create: start a new empty key and value map.
• Map Set, Map Get and Map Remove: store, read or delete a value by its key.
• Map Keys and Map Values: list all the keys or all the values.
• Map Contains Key: check whether a key exists.
• Map Merge: combine two maps.
• Set Create, Set Add, Set Remove and Set Contains: keep a collection of unique values and test membership.

JSON, XML and structured data

Read and build the structured data that web services and integrations use.

• JSON Parse and JSON Validate: check that text is valid JSON before you use it.
• JSON Get, JSON Set and JSON Remove: read or change a value deep inside a JSON document by its path.
• JSON Array Selector: pull one item out of a JSON list by position.
• JSON To Flat and JSON To Node: split a JSON document into one output per value or per top level key.
• JSON List: keep a running list of JSON records and expose each column.
• Placeholder JSON and Placeholder XML: fill a template with live values to build a request body.
• XML Get and XML Set: read or change a value in XML.
• CSV Row Builder: assemble a comma separated line, ready to append to a file on the SD card.

Key-value and storage

Remember values and read or write files and databases on the camera.

• Key Value Store and Cache: keep values in memory by name, with an optional expiry time.
• SD Card Write, Read and Append File: save, read back and add to files on the SD card.
• SD Card Remove File, File Exists and List Files: manage files on the card from within a flow.
• SD Card Status and SD Card Usage: report whether a card is present and how full it is.
• SQL Connection: open a database (a local file on the SD card, or a remote database) and share it with the other SQL nodes.
• SQL Query, Insert, Update and Delete: read and change rows with your own statements.
• SQL Table and SQL Table Read: create a table and store or read rows visually, without writing SQL.

Image and media

• Image Snapshot: grab a fresh still image from a camera for use later in the flow.
• JPEG Viewer: show a captured image on the canvas.
• Image Cache Info and Image Cache Delete: check on and clear the store of captured images.
• SVG Overlay: draw live graphics and values onto the camera image, so a number or a shape appears in the video and in recordings.
• RTMP Stream: push the camera's video to a streaming destination such as YouTube.
• WebRTC Stream: stream the camera live with low latency, on the local network or over the internet.

Camera, Axis and outputs

• Axis Output: switch the camera's physical output ports on or off.
• Axis Parameter: read a value from the camera's own configuration.
• Axis RTSP Stream: show a live video stream from an Axis device on the canvas.
• Metadata Event Create: raise your own camera event, with your own fields, that rules and any VMS can see.
• Syslog: write a message to the camera's system log.

Connectors and integration

Reach out to the other systems on your network. See the Connectors section for details.

• Milestone Connection, Event Subscribe and Event Trigger: listen to and act inside a Milestone XProtect™ VMS.
• HTTP Request: call any web service and read its response.
• Modbus: read and write a Modbus device such as a PLC or a meter.
• OPC UA Client, Read, Write and Subscribe, plus multi item versions: exchange data with industrial OPC UA servers.
• TCP Sender: send a line of text to another device over the network.

License plate and parking

These work together with the AXIS License Plate Verifier, which does the actual plate reading at the camera.

• License Plate List: check a plate read by the Axis Verifier against your allow and block list, and output whether it is known, allowed or blocked, along with its tags.
• Plate Mux: merge several ANPR camera inputs into one plate stream, ready for the License Plate List node.
• Parking Monitor: track vehicle entry and exit, work out parking duration, and spot overstays, saved to a database so it survives a restart.
• Vaxtor Cloud ANPR: send a camera snapshot to the Vaxtor cloud plate recognition service as an alternative reader.

Cross-flow and organization

• Channel Publisher and Channel Subscriber: share a value between separate flows by name.
• Teleport: carry a value across the canvas without drawing a line, to keep a busy flow tidy.
• Composite: bundle a group of nodes into one reusable block.
• Text: a plain note you place on the canvas to label and explain your flow.

Debug and visualization

See what a flow is doing while you build and tune it.

• Bool Debug, String Debug and IO Debug: show live signal values right on the canvas.
• JSON Viewer and XML Viewer: display structured data in a readable, formatted way.
• Oscilloscope: plot several signals over time to spot glitches and trends.
• Speedometer and Seven Segment: show a number as a dial or a digital readout.
• System Stats: monitor the camera's CPU and memory use.

Connectors

Connectors let a flow talk to the systems you already run. Use one as a source to pull information in, or as an action to push results out. Each connector is one or more Flow nodes.

Milestone XProtect™

Missing Features turns an Axis camera into the logic layer for a Milestone XProtect™ VMS. It can listen to any XProtect event, apply real computation on the camera, and fire the result back into Milestone as a native event that your existing alarms, rules and operator workflows already understand.

The three nodes

• The Connection node signs in to the XProtect server and shares that connection with the other Milestone nodes. It renews its own login in the background and retries after a dropout. You give it the server address, a user name and password, an option to accept a self signed certificate, and a timeout. A test button checks the server before you go live.
• The Event Subscribe node turns the XProtect events you select into flow signals. It covers events from any source Milestone knows about, including third party integrations such as access control, intrusion and ANPR, so the camera can reason about far more than just video. It resumes after short outages and flags if it was down long enough to miss events.
• The Event Trigger node acts inside XProtect: raise a user defined event, start or stop recording, switch an output, or create a bookmark with text built live from your flow.

Modbus

A Modbus TCP client for talking to PLCs, meters and industrial equipment. You set the device address, port and unit id, then list the items you want to read and write. Each item gets its own read trigger, write trigger and value on the node. Items can be coils (on/off), whole number registers, decimal values that span two registers, or short text. The node reads everything on connect and reconnects on its own.

OPC UA

Exchange data with OPC UA servers such as PLCs and SCADA systems. A Client node connects to the server and shares that connection, then the read, write and subscribe nodes use it against the address of a value on the server.

The nodes

• Read fetches a value when you trigger it.
• Write sends a value to the server when you trigger it, converted to the right type.
• Subscribe receives updates automatically whenever a value changes on the server, with no polling, and rebuilds itself after a reconnect.
• Multi item versions of read, write and subscribe handle several values at once in a single request.

HTTP request

Call any web service and, unlike a one way notification, read the answer back and act on it. Choose the method (GET, POST, PUT, PATCH, DELETE), the body (none, a form, JSON, raw text, XML, or a captured camera image), headers, query and path values, and authentication (basic, digest or bearer). Query and path values can come from live flow data. The node reports whether the call succeeded, the status code, and the response body, so you can branch on what came back.

SQL database

Read from and write to a database inside a flow. A query pulls rows in when triggered, and insert, update and delete push data out, so events and analytics results can be recorded in, or checked against, your own database. The database can be a local file on the camera SD card or a remote server, and simple table nodes let you store and read rows without writing any SQL.

Events and integration

Missing Features is built around the camera event system, so its results plug straight into recordings, outputs, overlays and any VMS using the tools you already have.

Results become camera events

Analytics features raise standard Axis and ONVIF events in the background. The gauge reader and spot color detection each raise an event when a value changes, a startup event with the first value, and a combined event carrying every value at once. Rules that have an on and off state raise both a held event (active until the condition clears) and a momentary event at the moment it changes. In Flow, the Metadata Event Create node lets you publish your own event, with your own yes/no, number and text fields, either as a brief pulse or as a state that stays on until reset.

Reacting to events

You can also start a feature or a flow from an event. Triggers are chosen from the camera's own event catalog: you pick a topic and then match on its fields, or choose to react to it every time. In Flow, the Metadata Event Subscribe node connects to a device, subscribes to the topics you choose, and outputs a connected flag, a pulse for each new event, and the full event details.

Sharing values between flows

Inside the app, Channel Publisher and Channel Subscriber nodes share values between separate flows by name. A subscriber keeps the last value it received even if the source flow stops, so flows stay loosely coupled and never block each other.

Troubleshooting

• A connection will not join. The two handles must be compatible types, and each input takes only one connection. Match the handle shapes and colors.
• A node shows an error on the canvas. The error count in the toolbar jumps you to it. A flow will not do useful work while a node is in error, so clear those before looking anywhere else.
• An event this flow creates is not listed in the camera rules or the VMS. Start the flow that defines it. The event only exists while that flow is running.
• An action fires repeatedly when it should fire once. Most action nodes act on a rising edge, the moment a signal turns on. If yours is following a signal that stays on, put an Edge node in front of it.
• A dashboard widget shows nothing. Its flow is stopped, or the node and port it was bound to no longer exist. Check the flow is running first.
• Milestone events stop arriving. The connection renews its login hourly and resumes after short outages. Confirm XProtect 2023 R3 or later with the Event Server running.
• An HTTP request reports a negative status. That is an internal error such as a timeout or a name that would not resolve, not a real web response. Check the address, the network path and the TLS settings.
• Values do not reach another flow. Channel names have to match exactly between the publisher and the subscriber. A subscriber keeps the last value it received, so a stale reading usually means the publishing flow stopped.

Plates, tags and matching

The license plate list is the app's register of vehicles: which plates you know, what they are called, what they are allowed to do, and for how long. It does not read plates. The reading is done by the AXIS License Plate Verifier on the camera, and this list decides what a read plate means to you.

It is one list, shared by everything that deals with plates: the parking zones use it to admit or refuse a vehicle, the Flow plate nodes check a read against it, and the parking console shows it as its own tab so an operator can add a vehicle without leaving the screen. A change here applies to the next detection everywhere.

Plates

The searchable table of plates, with Add, Import and Export. Each plate carries:

In Parking management you can also add a plate straight from the Plate Log with Add to Plate List, which carries the plate over and asks only for a name and tags. That is the fast way to admit a vehicle standing at the barrier.

Tags

The catalogue of tag names. A tag created here is what you drag into a parking zone's Allowed or Time-Limited area, and what an event rule can filter on, so keep the set small and meaningful: staff, tenant, visitor, delivery. A tag with no plates and no zones does nothing, and removing a tag removes the access it granted.

Matching and cleanup

Import and export

The list imports and exports as CSV, which is the practical way to load a tenant list or hand one over. The columns are plate, name, from_date, to_date, tags, ignore, blocked, and the header row is optional. Only the plate is required, dates may be left empty, and the format helper in the app shows a worked example.

The list itself raises no events. It supplies the names, tags and decisions that Parking management and the Flow plate nodes act on.

Overview and requirements

Parking management turns license plate reads into a working car park: who came in, who is still here, how long they have been here, who may not come in at all, and what should happen at the barrier. It runs on one Axis device and keeps its own records, so there is no server and no cloud service behind it.

Missing Features does not read license plates. The reading is done by the AXIS License Plate Verifier running on the cameras that watch your lanes. Parking management subscribes to those cameras over the network and acts on what they report.

What you need

• An Axis device running Missing Features, licensed, with the Parking management feature switched on in the home grid.
• One or more Axis cameras running the AXIS License Plate Verifier, licensed and already reading plates reliably in their lane. Get that working in the Axis application first, because everything here depends on it.
• Network access from the Missing Features device to those cameras, with a user name and password for each. HTTP or HTTPS, basic or digest.
• An SD card in the Missing Features device, if you want entry and exit snapshots.
• An SMTP server, if you want email notifications.
• An output port on an Axis device, if you want to drive a barrier or a gate.

How it stays connected

Parking management opens one metadata connection per camera and subscribes to the plate events the Verifier publishes. The connection is re-established on its own after a network drop or a camera reboot, and every camera is shown as online or offline in the Live tab. A camera used by several zones is still only connected to once, and its reads are offered to each of those zones.

What it records

Each vehicle becomes one record: which zone, which camera, when it arrived, when it left, how long it stayed, which tag admitted it, what the vehicle looked like, and the snapshots if they are enabled. Live vehicles appear in the Live tab, finished ones in History, and everything can be exported as CSV. Records are pruned automatically on the retention period you set, so the device never fills up.

Setup

The short version: add the cameras, fill the plate list, build a zone, then watch the Live tab while a car drives past. In order:

1. Switch the feature on. On the Missing Features home grid, flip the Parking management card on and press Open. The console opens on the Live tab.
2. Add the lane cameras. Press Devices in the toolbar and add each camera running the Verifier: address, port, HTTP or HTTPS, user name and password. These devices are shared with the rest of the app, so a camera you added for Flow is already here. A device cannot be deleted while a zone lane or an output action still uses it, and the message names what is holding it.
3. Prepare plates and tags. On the Plate List tab, create the tags you want to grant access with (for example staff, tenant, visitor) and add the plates that should be admitted, each with one tag. Skip this step if the zone will run in free flow.
4. Create the zone. On the Zones tab press Add Zone, then drag your cameras into the Entry, Exit or Both lane and drag the tags into Allowed or Time-Limited.
5. Configure the zone. Open the gear icon and set the capacity, the detection timing for your lane layout, the snapshots and any custom fields. See Zones for every field.
6. Wire up the barrier and notifications. On Access & Events create an output action for the barrier, then a rule that runs it on the Entry event, and an email profile if you want to be told about refusals or overstays.
7. Test it. Back on Live, check that every camera shows online, then drive a vehicle past. The read appears in the Plate Log within a second, with the outcome next to it, and an admitted vehicle appears in the Parked Vehicles list.
8. Register the cars that are already there. Anything parked before you started is unknown to the system and would otherwise be logged as leaving without ever arriving. Add each one with Add Parked Vehicle in the Live tab.

Devices and plates

A zone needs two things that live outside it: the cameras it watches, and the plates it admits. Both are configured from inside Parking management, and both are shared with the rest of Missing Features, so a camera you added for Flow or a plate list you already maintain is used here as it is.

Devices

The Devices button in the toolbar opens the shared device list, where you add every camera and every device with an output port you want to use. It is available on the Zones and Access & Events tabs.

Only the address, protocol, port, credentials and authentication are needed for plate events. The RTSP port, channel and frame rate matter only for the live picture in the Live tab. A device that is still assigned to a zone lane or used by an output action cannot be deleted, and the message names what is holding it.

Plate List

The Plate List tab is the License plate list feature shown inside the parking console, so you can grant somebody access without leaving the screen. It is the same list, so a plate added here is the plate every zone and every flow node sees. Changes take effect on the next detection.

Zones

A zone is one parking area with its own cameras, its own rules and its own occupancy count. Everything else in Parking management hangs off a zone. Entries and exits are recorded per zone, capacity and time limits are set per zone, and every camera event raises that zone's events. Create one zone per barrier, floor or yard you want counted separately.

Zones are built on the Zones tab. Each zone is one card, and the card itself is where cameras and tags go. Everything else sits behind the gear icon in the card header, in the Zone Configuration dialog.

Camera lanes

Cameras come from the device list, which you reach with the Devices button in the toolbar. Drag a camera from the Cameras row of the zone card into a lane. The same camera may serve several zones, and it is still only connected to once no matter how many zones use it.

• Entry: a camera that only sees arrivals. Every read counts as a car coming in.
• Exit: a camera that only sees departures. Every read counts as a car going out.
• Both: one camera covering a single access point used in both directions. Direction is not taken from the camera. A plate that is not currently parked in the zone is treated as an arrival, and a plate that is already parked is treated as a departure.

Tags

Tags are how a zone decides who may park. They are defined once in the License plate list and dragged from the Tags row of the zone card into one of two areas.

• Allowed: plates carrying one of these tags may park with no time limit.
• Time-limited: plates carrying one of these tags may also park, but with a maximum stay. Click the minutes badge on the tag to set it, from 1 to 10080 minutes (one week). Passing the limit raises the zone's Overtime event and flags the vehicle in the Live list. It does not remove the vehicle.

If a zone has no tags in either area, any plate that is in the License plate list may park there. As soon as one tag is placed, only plates carrying a placed tag are admitted.

Changing a tag's limit applies to vehicles that arrive afterwards. Cars already parked keep the limit they were given on arrival, which you can still change per vehicle with Extend Time in the Live list.

Zone Configuration

The gear icon in the zone card header opens the Zone Configuration dialog. It is grouped into five sections and nothing is applied until you press Save in the dialog.

General

Access

How a plate is judged in plate mode is covered in Access decision.

Detection timing

These three windows exist to stop one physical car being counted twice. Each one only appears when the zone's camera layout can actually produce that problem.

Snapshots

Two switches, On entry and On exit. Each captures a still from the camera that made the detection and stores it on the SD card, where it can be opened from the Live and History lists and attached to notification emails. Snapshots need a working SD card, and they are removed together with their history entry.

Custom fields

Extra information a person fills in per vehicle, for example a delivery number or a destination. Fields are defined per zone and their values show in the Info column of the Live and History lists, in the CSV export, and can be filtered on in History.

• Label: what the field is called. Required, and it has to be unique inside the zone.
• Type: Text, Number or Dropdown. A dropdown needs at least one option.
• Recommended (the asterisk button): flags the field when it is left empty. It never blocks saving.

Values are set when a vehicle is added by hand and can be changed later with Edit info in the Live list. Renaming a field label keeps the values that are already stored, deleting a field hides them.

Saving and deleting

Cameras and tags dropped on the card save themselves a moment after the change. The Configuration dialog applies when you press Save in it, and the toolbar Save button writes the whole configuration. Every save restarts the feature, so the cameras reconnect and there is a short gap of a few seconds in which detections are not processed. Save when traffic is quiet.

Deleting a zone asks for confirmation and warns you how many vehicles are parked in it. Those vehicles are closed out to history with the exit camera shown as Zone removed, so the occupancy count does not keep counting a zone that no longer exists. History rows keep the zone name they were written with.

Access decision

Every plate a camera reports is judged against the zone it belongs to, and the answer is one of three: allowed, denied or blocked. The whole decision runs on the device in the moment the plate arrives, before any barrier moves.

The three outcomes

• Allowed: the vehicle is recorded as parked, the zone's Entry event fires, and any rules attached to it run, which is what opens a barrier.
• Denied: the plate is unknown, expired, or carries no tag the zone accepts. Nothing is parked. The attempt is written to history as an unauthorized record, the Unauthorized event fires, and rules attached to it run.
• Blocked: the plate is in the list with the Blocked switch on. Treated as denied, and shown as Blocked in the Plate Log so it is clear this was deliberate rather than an unknown vehicle.

Denied and blocked reads are repeated for as long as the car sits in front of the camera, so the zone's Reject dead time suppresses the repeats. Only the first refusal fires events, rules and emails.

Ignored plates

A plate with the Ignore switch on in the plate list is skipped entirely. No entry, no exit, no refusal, no rules. The sighting still appears in the Plate Log marked IGNORE, so you can see the camera is working. Use it for your own service vehicles, or for a neighbouring lane the camera happens to catch.

Reading errors

Plate recognition is not perfect, and a plate can be read slightly differently on the way in and on the way out. Two separate settings deal with that.

• In plate mode, the tolerance comes from the License plate list itself, where you can require an exact match or allow a one or two character difference. Missing Features honours the same tolerance when the car leaves as it did when the car arrived, so a vehicle admitted on a slightly misread plate can still be matched to its own record on the way out.
• In free flow there is no list to match against, so the zone's own Plate match drift decides how far the exit read may differ from the entry read.

Where a read could match two different parked vehicles equally well, no match is made rather than guessing which car is leaving. The safest setting is exact matching, with drift used only where misreads are common enough to be a nuisance.

While a car is still in front of the camera its plate can also be corrected upwards: a later read of the same vehicle replaces the stored plate only when it is recognised with higher confidence. That appears in the Plate Log as REFINED.

Vehicles that were never seen arriving

An exit read with no matching parked vehicle is recorded as an exit without entry. It does not create a parked record and does not affect the occupancy count. It is a normal thing to see just after the app is set up, when cars are already standing in the car park. Register those vehicles once with Add Parked Vehicle in the Live tab and the following exits match normally.

Detection behaviour

A car driving past a camera does not produce one plate read, it produces a stream of them, and the same car can be seen by two cameras at once. Almost everything in this section exists so that one physical vehicle becomes one record.

One vehicle, many reads

The Verifier follows a vehicle while it is in view and reports it repeatedly. Parking management groups every read of the same tracked vehicle and acts on it once. The rest are shown in the Plate Log as DUP and are hidden until you press the duplicates button. The grouping is held for as long as the vehicle is still being reported and is forgotten roughly fifteen seconds after the last read, so a car that genuinely comes back later is treated as a new arrival.

Plate refinement

The first read is rarely the best one. If a later read of the same vehicle is recognised with higher confidence, the stored plate is corrected and the Plate Log shows REFINED with the old and new text. A correction only ever rewrites the record that this detection created, so a misread that briefly resembles another car's plate cannot rename that car's record.

Windows that prevent double counting

On a single lane with a camera on each side of the barrier, both cameras see every car: one from the front as it approaches, the other from behind as it drives away. Without a guard, one car entering would be booked in and straight back out again. The zone's Lane traversal window closes that hole.

Two other windows do the same job in different layouts:

• Re-entry grace applies to a Both camera. Because that role infers direction from whether the plate is already parked, a second read moments after the arrival would look like a departure. Within the grace period, a re-read is treated as the same arrival. The default is ten seconds, which is enough for a car waiting for the barrier to lift.
• Reject dead time applies to refusals. A driver who is not admitted tends to sit in front of the camera, and every read would otherwise fire the events, the rules and the emails again. After the first refusal, further refusals of that plate are suppressed for the configured time, thirty seconds by default.

Cases you will meet in the Plate Log

• Already parked: the plate is admitted but the zone already holds it. Nothing changes, so the count stays correct.
• Zone full: the vehicle is still recorded and the Zone Full event fires. Parking management counts and reports, it does not physically stop the car, so use a rule on the Zone Full event if the barrier should stay down.
• Exit without entry: an exit read for a vehicle with no parked record. Nothing is closed out and the occupancy count is untouched. Common right after commissioning, and a sign of a missed entry read afterwards.
• Waiting and timeout: shown while a camera has not yet confirmed a direction, and if that confirmation never arrives.

Vehicle lifecycle

Every vehicle record is in exactly one state, and only a few things move it between them.

Mark as exited and Delete Entry are not the same thing. Mark as exited keeps the vehicle in history with the current time as its exit, which is what you want for a car whose exit was missed. Delete Entry removes it altogether. Neither one opens a barrier or sends an email, so correcting the records never moves the gate.

Live tab

The Live tab is the operator screen: what is standing in the car park right now, and what the cameras are seeing this second. It updates by itself, there is nothing to refresh. The Fullscreen button in the toolbar makes it a wall display.

Status bar

• Parked: vehicles currently in all zones. Click it for the breakdown per zone.
• Today: arrivals since midnight in the device's own time. Refused reads are not counted as arrivals.
• Avg: average time the vehicles now parked have been standing.
• One chip per zone with a capacity, showing occupancy against that capacity.
• Overtime: vehicles past their time limit, shown only when there are any.
• Utilization: occupancy across every zone that has a capacity, as a percentage.

On the right, Cameras shows how many of the assigned cameras are online. Open it to see each one with its zones and role, and click an online camera for a live picture, with that camera's output actions underneath it. Actions lists every output action so you can trigger a barrier by hand.

Parked Vehicles

Everything currently parked, across all zones, with the duration counting up live. Two layouts, switched with the view button: a compact list, or a grid of cards showing the entry snapshot.

Above the list: search by plate, filter by zone, camera or tag, and a bell that narrows the list to overtime vehicles only. The columns are Time and Plate (always shown), then Name, Zone, Camera, Tag, Type, Color, Country, Region, Parking and Info, each of which can be switched off in General settings. The Parking column shows the elapsed time, and a progress bar against the limit when the vehicle has one.

The menu at the end of a row offers:

• View Image: the entry snapshot, if one was captured.
• Extend Time: add 1 to 1440 minutes to this vehicle's limit and clear its overtime flag. Only for vehicles that have a limit.
• Edit info: fill in or change the zone's custom fields for this vehicle.
• Mark as Exited: close the vehicle out to history with the current time. No gate, no rule, no email.
• Delete Entry: remove the record completely, including from history.

Adding a vehicle by hand

The plus button above the list registers a vehicle the cameras never saw, which is how you account for cars that were already parked when the system went live. The dialog asks for:

There is no field for the time limit. It comes from the zone and the tag, so a manually added vehicle behaves exactly like a detected one. Adding a vehicle by hand never opens a barrier or sends an email.

You can also add straight from a Plate Log row with Add to Parked Vehicles, which carries the plate, zone, tag, type and color over for you. That is the quick fix when a known car was refused because its tag is not allowed in that zone, or when a visitor should be let in once.

Plate Log

Every detection from every camera, newest first, up to the last hundred. It is a live view for commissioning and fault finding, not a record: it is not stored, and it starts empty when you open the page. History is the permanent record.

The header has buttons to show or hide duplicate reads, enlarge the panel, clear it, and open a short explanation. The panel itself collapses.

Columns are Time, State, ID (the camera's own tracking number for that vehicle), Plate with an arrow for the direction, Tag, Zone, Camera, Type, Color, Country, Region, Size (the plate in pixels, a rough quality cue), Act, Img and Conf. Confidence is green from 80 percent up and orange below. Time, Plate and Act always show, the rest can be switched off in General settings.

The Act column is where you react to a read: an unknown plate offers Add to Plate List and Add to Parked Vehicles, a known plate whose tag is not accepted here offers Add to Parked Vehicles, and a blocked plate shows a blocked marker with no actions. Img opens the plate crop the camera sent.

History and export

History is the stored record: every completed stay, everything still parked, and every refused attempt, for as long as your retention period keeps it. It is also where you answer the question "which car was here on Tuesday afternoon".

Filters

The buttons next to the filters clear them, export what is currently filtered as CSV, and switch between the table and a card grid with entry snapshots. The Activity Chart above the list plots arrivals against departures for the same filtered range.

The list

Columns are Plate and Entry Time (always shown), then Name, Zone, Exit Time, Duration, Status, Tag, Type, Color, Country, Region, Info, Overtime and Snapshots. The camera icons open the entry and exit images. Rows show 25 at a time by default and the page size is selectable; a very large range is capped at a thousand rows per page.

Two details that look like gaps but are not. A record you deleted by hand stays visible and marked DELETED until the retention period removes it for good, so a removal is never silent. And an exit without entry shows no entry time and no duration, because the vehicle was never seen arriving and any number there would be invented.

CSV export

The export contains exactly the rows your filters produced, with the full set of columns regardless of which ones are hidden on screen: id, plate, name, entry time, exit time, duration in minutes, zone, status, tag, vehicle type, color, country, region, overtime, entry camera, exit camera, deleted at, and then one column per custom field, headed with the field's label. Times are written in full date and time form for spreadsheets and reporting.

Access and events

This tab is where parking events turn into something happening: a barrier lifting, a light switching, an email going out. It has three parts, output actions, rules that run them, and the shared email profile.

Output port actions

An action switches an output port on an Axis device. Define it once, then any number of rules can run it, and operators can trigger it by hand from the Live tab.

The Test button on an action runs it immediately. Use it before wiring any rules, so a barrier that does not move can be ruled out early.

Event rules

A rule says: when this event happens, in this zone, for this tag, do this. Rules are the only thing that makes a barrier move automatically.

A tag filter left empty matches every vehicle, including ones with no tag at all. Set it when only one group should trigger something, for example an email when a delivery vehicle arrives.

Zone Full Rising and Zone Full Falling fire on the crossing, not continuously:

Email notifications

One profile, shared by every rule whose action is an email. Switch it on with the toggle in the section header.

The Test button sends a message with the settings on screen. The mails themselves are short and readable: a coloured header naming the event, the plate, and the facts that matter for that event, so an exit mail carries entry time, exit time, camera and duration, while an overtime mail carries the duration against the limit. Subjects are written to scan in a phone notification, for example Overparking: AB1234 in Visitor Parking.

General tab

The parking console's own General tab: three retention settings, a storage overview, and the choice of which columns each table shows. It is not the same as the app-wide General settings page, which holds users, roles and backup.

Delete All History removes every record at once and cannot be undone. Vehicles currently parked are deliberately spared, so the occupancy count survives and their eventual exits still match.

Storage Info on the right shows how many records exist and how they split between parked, exited and stale, the size of the database and the free space where it lives, and the size of the snapshot folder against the free and total space on the SD card. Check it before raising the retention period.

Displayed Columns chooses which columns appear in the Plate Log, the Parked Vehicles list and History. A few columns carrying identity, time and actions are always shown and cannot be switched off. The setting is device-wide, not per user, and the CSV export always contains everything regardless.

Events for a VMS

Every zone publishes its own standard Axis and ONVIF events, so a VMS, a camera rule or any other subscriber can act on parking without knowing anything about this app. The events appear once the zone exists, named after it: a zone called Visitor Parking publishes Parking Management - Visitor Parking Entry and so on.

The first six are also the events you can pick in an event rule. Count Changed and Detection are published for other systems only and are not offered in the rules list: Count Changed fires on every single movement, which is useful for a live occupancy display and useless for a barrier, and Detection is the one to subscribe to when an external system wants every decision with its plate crop in a single feed.

On the Detection event, allowed is true only for an admitted vehicle, while state separates the two kinds of refusal, 0 for not allowed and 2 for deliberately blocked, and inList says whether the plate is known at all.

Reference

Who can do what

Tabs and buttons appear according to the rights of the signed-in user, so an operator can be given the Live tab without the ability to change any configuration.

Record states

• Parked: on site now, counted against the zone capacity.
• Exited: left, with an exit time and a duration.
• Stale: never seen leaving and past the stale timeout. Out of the count, with no exit time.
• Unauthorized: refused entry. History only, never counted.
• Exit without entry: seen leaving with no record of arriving. History only, never counted.

What runs in the background

• Detection grouping is tidied every few seconds, and a vehicle is forgotten about fifteen seconds after its last read.
• Stale marking runs every minute, together with a check that closes out vehicles whose zone was deleted.
• Time limits are checked every minute, so an Overtime event follows the limit within a minute of it passing.
• Retention and the snapshot cap run when the app starts and once an hour after that.

Limits

• Zone capacity 0 to 9999, 0 meaning unlimited. There is no limit on the number of zones.
• Time limits 1 to 10080 minutes, extensions 1 to 1440 minutes at a time.
• Plates up to ten characters when added by hand.
• The Plate Log holds the last hundred detections and is not stored.
• History pages are capped at a thousand records at a time. The CSV export is not.

Troubleshooting

• A camera shows offline. Check the address, port, protocol and credentials in the Devices dialog, and that the camera is reachable from the Missing Features device. The connection retries by itself, so a camera that came back after a reboot turns green without you doing anything.
• Cameras are online but nothing appears in the Plate Log. The plates are read by the AXIS License Plate Verifier, so check on the camera itself that the Verifier is installed, licensed and recognising plates in its own view. Nothing reaches Parking management until it does.
• A plate is read but refused. Look at the Tag column in the Plate Log. Unknown means it is not in the list, an orange tag means it is in the list but that tag is not accepted in this zone, and Blocked means the plate is deliberately blocked. Expired validity dates also refuse a plate that otherwise looks correct.
• One car is booked in and straight back out. The two cameras on the lane are seeing the same vehicle. Set the zone's Lane traversal to about the time a car needs to cross, or the Re-entry grace if a single Both camera covers the lane.
• The barrier keeps re-firing at a refused car. Raise the zone's Reject dead time so the repeated reads while the driver waits are suppressed.
• Vehicles pile up as parked and never leave. The exit reads are not landing. Check that an exit camera is assigned and online, and look for exit without entry rows in History, which mean the exits are arriving but not matching an arrival. Close out the stuck records with Mark as exited.
• Exit without entry right after setup. Normal. Those cars were already parked before the system knew about them. Register them with Add Parked Vehicle.
• The occupancy count looks too high. Vehicles whose exit was missed stay parked until the stale timeout. Lower it, or close the records out by hand.
• No snapshots. Snapshots need the zone switches on and a working SD card in the Missing Features device. Check the SD card figures in General settings.
• No emails. Confirm the profile is switched on, use the Test button, and check that a rule with the Email action actually exists for the event you expect. A rule with a tag filter only sends for vehicles carrying that tag.
• The live picture of a camera stays blank. The preview decodes video in the browser, which browsers only allow on a secure connection. Open the app over HTTPS. Everything else on the page works either way.
• A device will not delete. It is still assigned to a zone lane or used by an output action. Remove it there first, the message tells you which one.
• The Plate Log is empty after reopening the page. Expected. It is a live view and starts fresh each time. Use History for anything you need to keep.

Overview

The gauge reader turns an analog dial into a live number. Point a camera at a pressure, temperature, level or speed gauge, mark the dial on the picture, tell it what the scale means, and the needle position becomes a reading in real units that the camera publishes as an event. Nothing is wired to the gauge and nothing is modified on it, which is the point: it brings instruments that were never meant to be networked into a system, including ones a warranty or a certification forbids you to touch.

It reads the needle from the video, so what the camera sees is what you get. In practice that means a straight-on view of the dial, the whole face in frame, the needle clearly distinguishable from the background, and lighting that does not swing between glare and darkness. A reflective glass cover pointed at a window is the usual reason a gauge will not read.

Profiles

A profile is one video stream plus the gauges on it. Up to four run in parallel, each with its own channel, resolution and frame rate, and each holding as many gauges as fit in the picture. Use separate profiles when the gauges are on different sensors or need different stream settings, and one profile with several gauges when they sit on the same panel.

Setting up a gauge

Press Add Gauge and the gauge appears as an overlay on the live picture. Setting it up is entirely done by dragging that overlay onto the dial: you are telling the reader where the needle turns, how far the printed scale runs, and which band of the dial to look at.

The handles

• Pivot, the yellow dot: the point the needle turns around. Drag it onto the centre of the needle, and drag it again later to move the whole gauge.
• MIN and MAX, the cyan and amber chips: the start and the end of the printed scale. Put them on the first and last graduation, not on the edge of the dial.
• Inner and outer, the two green dots: the size of the scanned ring. Keep the inner dot clear of the pivot hub and the outer dot inside the needle tip.

Handles only appear on the gauge that is active, so click a gauge on the overlay to work on it. Name it with the tag button: that name goes into the event it publishes, so Boiler pressure is worth the few seconds over Gauge 1.

The scale

The handles say where the needle can point. The scale says what those positions mean.

Reading the needle

Finding the needle in a ring of pixels can be done in several ways, and which one works depends on the dial. A black needle on a white face, a red needle on a busy scale and a thin pointer over printed numbers are genuinely different problems, so the reader offers five modes.

Checking what it sees

Show what the algorithm sees paints the pixels being treated as the needle. That single view answers nearly every setup question: the painted shape should look like the needle and nothing else. If it catches the hub, push the inner radius out. If it catches the rim, pull the outer radius in. If it catches printed numbers, switch to Contour.

The diagnostics panel alongside it reports how many pixels were examined, how many were taken as needle, how well the colour matched, and how long the frame took. The status banner only appears when something needs attention, so a quiet panel means a healthy reading. Keep the per-frame time under the budget your frame rate implies, which the panel states for you.

Output and events

A raw needle position jitters, because video is noisy and a needle vibrates. Two settings turn that into something a system can use.

What is published

Events are named after the profile and the gauge, so Boiler pressure in a profile called Plant room appears as Plant room Boiler pressure Reading, and the combined one as Plant room All Gauges Reading. Renaming a gauge or a profile renames the events, so any rule pointing at the old name has to be re-pointed.

raw_angle is the measured angle before it is mapped onto your scale, and confidence says how sure the reader is about the needle it found. A rule that acts on a threshold is worth pairing with a confidence check, so a momentarily obscured dial cannot trigger it.

Troubleshooting

• No reading at all. Turn on Show what the algorithm sees. If nothing is painted, the ring is in the wrong place or the mode does not suit the dial. Check the pivot sits on the needle's centre first, since everything else is measured from it.
• The value is wrong but stable. The scale is wrong, not the detection. Check that MIN and MAX sit on the first and last graduation and that the direction matches the way the dial actually runs.
• The reading jumps around. Look at what is being painted. The hub, the rim or printed numbers being taken for the needle is a geometry problem, so pull the ring in around the needle. Genuine noise is what smoothing is for.
• It reads in daylight and fails at night. Lighting. A dial lit only by a window changes contrast completely after dark. Add steady lighting, or use Auto so a mode that copes can take over.
• Too many events. Raise the change threshold. A gauge that wanders by a few tenths does not need to announce every tenth.
• Processing time is too high. Raise the analysis interval, lower the resolution, or move from Auto to the single mode that Auto-calibrate picked.
• The event vanished from a rule. Renaming a gauge or a profile renames its events. Point the rule at the new name.

Overview

Spot color detection watches small patches of the picture, works out what colour each one is, matches that against a palette you name yourself, and reacts when the answer changes. It is how you read a machine that reports its state with a lamp: a signal tower, a status LED, a warning beacon, a painted indicator. The camera is doing the reading, so nothing is wired to the machine and no output is taken from it.

It also answers questions about the thing being watched rather than the machine watching it: whether a product on a line is the right colour, whether a bay is occupied by a coloured pallet, whether a valve handle painted red is in the closed position.

Profiles

A profile is one video stream with its own regions, palette and rules. Up to four run in parallel, each with its own channel and resolution, so one device can watch four separate panels.

Regions and palette

Drawing a region

Two shapes, added with Add Circle and Add Rect. A circle suits a round lamp or an LED, a rectangle suits a bar, a panel or a painted label. Drag a shape to move it, click it to make it active, then drag its handles to resize. Name each one with the tag button, because that name goes into the events.

Keep a region inside the thing you are measuring, not around it. A circle that includes the dark rim of a lamp housing averages the rim into the reading and pulls every colour towards black. A region smaller than roughly 500 pixels is flagged as too small to be reliable.

The active region shows its live detected colour, the palette name it currently matches, and a plus button that adds the exact colour it is seeing to the palette. That button is the fastest way to build a palette that matches your own equipment under your own lighting.

The palette

The palette is the list of colours the reading can produce. It ships with fifteen: Red, Green, Blue, Yellow, Orange, Purple, Cyan, Magenta, White, Black, Gray, Traffic Red, Traffic Yellow, Traffic Green, and Off/Dark. Add your own by hex value or by sampling what the camera sees, rename them to match how your site talks about them, and reset to the default set at any time.

Two rules of thumb. Keep the palette small, because every extra colour is another answer the matcher can pick and another way for a reading to wobble. And keep Off/Dark in it: a lamp that is off is a state worth naming, and without it an unlit lamp gets matched to whichever colour it is least unlike.

Rules and events

Rules

A rule gives a name to a state you care about. It watches one region and fires on up to four palette colours, so Machine stopped can cover both Red and Traffic Red. Several rules may watch the same region, which is the normal way to model a signal lamp: one rule for Stop on red, one for Go on green. A profile holds up to twelve rules.

Events

The held and momentary pair is the useful part. Use the held event to drive something that should last as long as the condition does, such as a recording or an overlay, and the momentary one to do something once, such as sending a notification when a machine goes into alarm.

Troubleshooting

• The colour flickers between two names. Raise the hysteresis threshold, and remove palette colours that are close to each other. Two similar reds mean the matcher has to choose between them every frame.
• Everything reads as Black or Off/Dark. The region is probably picking up a dark border or the lamp is genuinely unlit. Shrink the region into the bright part.
• It works by day and fails at night. The light on the panel changed, so sample your palette colours again under the light the panel actually has at that hour, or fix the lighting.
• A rule never fires. Check which colour the region reports live: the rule can only fire on colours in its list, and the matcher may be reporting a neighbouring shade you have not included.
• A region will not delete. A rule still points at it.

Overview

The scene analysis trigger works on the camera's own object detection rather than on raw pixels. The camera already knows that something in the picture is a person, a car or a truck, and where it is from frame to frame. This feature reads that stream, lets you draw areas and lines over the video, and reports when a detected object is inside an area or crosses a line.

Because it is built on detection rather than motion, it does not react to a moving shadow, a swaying branch or a change of light. And because it consumes analytics the camera is producing anyway, it costs very little to run.

The live view draws every detected object as a box labelled with its class, its confidence as a percentage, and any area or line it is touching. The colour of the box tells you what the object did: entered, exited, sits inside an area, or was filtered out. Setting this feature up is mostly watching those boxes and adjusting the shapes until only the traffic you care about is being reported.

Areas and lines

Two shapes, and the difference between them is the question they answer. An area answers "is something in here", a line answers "did something go past, and which way".

Areas

An area is a polygon of three or more points. Shape it by dragging a corner, click an edge to add a point, drag inside it to move the whole shape, and right-click a point to remove it. It never drops below three points. Name it with the tag button, since the name goes into the event.

Draw the area around the ground the object stands on rather than around the object itself. A gate area drawn high up will be entered by the roof of a lorry before the lorry is anywhere near the gate.

Lines

A line has a start and an end, both dragged into place, and a direction:

• Enter: fires when an object crosses one way.
• Exit: fires when it crosses the other way.
• Both: fires on either.

Direction is relative to how the line is drawn, so if a line fires on the wrong direction, swap its two ends. A line placed across a doorway with Enter and a second line with Exit is the usual way to get a simple in and out count into a flow.

Filters and events

Filters

Filters apply before the shapes are considered, so an object that fails a filter cannot enter an area or cross a line. Start with filtering off, watch the boxes for a while, then tighten it: it is much easier to see which detections you want to lose than to guess a threshold in advance.

Events

Each area and each line publishes its own camera event when its condition is met, named after the shape, so they can be picked out individually in a camera rule or a VMS. The event carries what the camera knew about the object: its track, its class, its confidence, its position, and which shapes it touched.

The track identifier is the useful field for anything more involved than a single alert. It stays with one object for as long as the camera keeps following it, so a system can tell one lorry crossing three lines from three different lorries.

SD explorer

A file manager for the device's SD card, with a folder tree on the left and a searchable file list on the right. A chip in the header shows how full the card is. If no card is fitted it says so plainly and browsing is disabled.

It exists because everything else that writes to the card writes there in the blind: parking snapshots, captured images, files a flow appended. This is where you go to see what is actually on the card, take a copy off it, and clear space.

Browsing

• Move with the folder tree, which is searchable, or with the breadcrumb trail across the top.
• The file list shows name, size, and the modified and created times, fifty files to a page, with its own search box.
• Refresh reloads the current folder.

Working with files

• Create a folder, upload a file with an optional name to save it as, rename an item, or delete one or many at once.
• Download a single file directly, or download a folder or a multiple selection as one zip.
• Preview images in place (JPG, JPEG, PNG, GIF, WEBP and BMP), then close or download from the preview.

There is nothing to configure. If the list stays empty, confirm a card is inserted, mounted and healthy on the device itself.

Image to SD card

Saves a still image to the SD card whenever a camera event fires, keeps the collection inside limits you set, and lets you browse it by date. It is the simple way to get a time stamped record of a site, a process or a building project without a recorder in the loop.

Setup

1. Set the storage limits and the channel the pictures come from.
2. Choose the trigger event. Pick a camera event, then either match on its source and data fields or ignore all fields so it fires on every occurrence.
3. For pictures on a schedule rather than on an event, first create a Pulse schedule in the device's own event system, then select it here as the trigger.
4. Save. Saving becomes available once an event is chosen.

Both caps apply, so whichever is reached first starts the pruning. Set them deliberately: a trigger that fires every few seconds fills a card faster than most people expect.

Browsing and storage

The Images section browses what has been captured, over a From and To date range, in a paged grid of eighteen pictures with an adjustable column count from 2 to 12. Zoom a picture, download it, or delete it. The Storage Info panel shows a usage bar with the space used, the oldest and newest image, and the total count.

Timelapse

Turns the images captured over a date range into a single MP4. It lives inside Image to SD card as the Video Generator and works on the same From and To range, with a live count of how many images will go into the video.

1. Set the date range in Image to SD card and check the image count.
2. Set the frame rate and the output size.
3. Press Generate and watch the progress bar as the frames are encoded.
4. Preview the result, then press Download MP4.

The video is built in your browser, not on the device, and nothing is uploaded anywhere. That keeps the encoding off a device that has better things to do, and it means the finished file is only ever on your own computer.

Overview

Trustlix brings zero trust network access to Axis cameras. It runs on the device as a single ACAP application and combines three subsystems: an authentication server that authorizes switch ports using 802.1X (RADIUS with EAP-TLS), full certificate management (CAs, templates and X.509 issuance), and an EST enrollment server (RFC 7030). Devices join the network with certificates instead of static passwords, and their certificates renew themselves before they expire.

• Web UI: behind the camera reverse proxy (HTTP on loopback, TLS terminated by the camera).
• RADIUS authentication server: udp/1812, reachable by your switches.
• EST enrollment server: tcp/22224 by default, reachable by enrolling cameras.

Install

Install Trustlix like any other ACAP application:

1. Download the .eap that matches the camera architecture (aarch64 or armv7hf) from the Download page.
2. In the camera web UI open Apps, choose Add app, and upload the file.
3. License the app before you start it. On the Apps page, open the app's three dots menu and either activate online with your license key, or upload a license file generated on the Axis license key registration page. The Download page has both routes written out in full.
4. Start the app. Trustlix checks its license on start, so if you start it unlicensed it logs the reason and leaves the RADIUS and EST listeners closed until you license it and start it again.
5. Open the app. The UI loads at /local/trustlix/trustlix through the camera, so there is nothing extra to expose.

First run

Opening Trustlix for the first time seeds the device: a Trustlix root CA, four certificate templates, the authentication server certificate and configuration, and the default EST server certificate and profiles. This runs once.

It then offers two steps, in order. Both exist for the same reason: the certificates Trustlix issues are signed by a root nobody trusts yet, so until you install that root your browser keeps warning you.

Step 1: trust the root CA

Trustlix generates its own root CA on the device. Install it into the trusted root store on the computer you browse from, not on the camera. Click Download certificate in the dialog to save Trustlix-Root-CA.crt, then on Windows:

1. Double-click the file, choose Install Certificate, pick Local Machine and approve the administrator prompt.
2. Choose Place all certificates in the following store, then Browse and select Trusted Root Certification Authorities.
3. Click Next, then Finish. Windows confirms with The import was successful.

Without local administrator rights, pick Current User instead of Local Machine and confirm the extra security warning with Yes. Current User trusts the certificate for your account only; Local Machine covers every user on that PC.

Step 2: prepare the device certificate

Out of the box the camera serves its own web page with the factory AXIS Device ID certificate. No browser trusts that root either, which is why the camera warns you even before Trustlix is involved. This step replaces it with a certificate issued by the root you have just trusted, so the padlock appears.

Click Secure device now and wait. Trustlix issues the certificate, uploads it to the device, points the web server at it, and then waits until the device confirms it is actually serving it. The device restarts its web server as part of this, so the page goes quiet for a few seconds and reconnects on its own. Nothing is lost if it takes a while.

When it finishes, the dialog gives you one instruction and the address to return to. There is no reload or switch button, because neither would reliably work: your browser has already made up its mind about the old certificate, and about the root CA you imported while it was running, and it keeps that verdict for as long as the process lives.

When the step does not appear

The device certificate step is offered only when there is something to do and it is safe to do it. It stays hidden when:

• The device already serves a certificate issued by Trustlix.
• There is no local root CA to issue from.
• The device serves a certificate from another authority, for example your own corporate PKI. That is treated as a deliberate choice and is never overwritten.

You can also postpone it with Later. It reappears the next time you open the app.

Authentication server

The authentication server authorizes switch ports using 802.1X (RADIUS with EAP-TLS). A client presents its certificate, the server validates the chain against the CAs you trust, and the switch opens the port. The server is always on, and saving its configuration applies the change and restarts the listener.

Certificates

The server certificate is what the server presents in the TLS handshake. Pick one whose private key the app holds, or generate one signed by your root CA with a single click. Client CA trust decides who may connect:

• Trust all managed CAs accepts clients issued by any CA you manage. This is the simplest choice.
• Trust specific CAs restricts connections to clients whose chain roots in the exact issuers you select. Any other client is rejected.

The server certificate and the trusted CAs are independent: one proves the server identity, the other decides who may connect.

A client whose certificate you have revoked is refused even though its chain still validates. See Certificates for what revoking does and does not do.

Switches

Register every switch that forwards 802.1X requests by its IP address and a shared secret known to both the switch and the server. Requests from an address that is not registered are dropped, so at least one switch must be added before any client can authenticate.

Expert settings

Under expert settings you can harden the TLS handshake and tune session behavior:

• Minimum and maximum TLS version. The defaults are a TLS 1.2 floor and a TLS 1.3 ceiling. TLS 1.0 and 1.1 are marked insecure.
• Cipher suites. Move suites between the available and assigned lists to set which are offered and in what order.
• Session timeout and maximum sessions per port bound how long a handshake may run and how many concurrent sessions one switch port may open.
• Send reject on timeout makes the switch fail a port quickly instead of waiting when a session times out.

Certificates

Trustlix manages the whole X.509 lifecycle on the device. A Trustlix root CA is seeded on first run, and from the certificate pages you can build a hierarchy, issue certificates, and export them. For what the terms on these pages mean, see Learn: certificates and PKI.

Creating certificates

• Create a certificate from scratch, from a template, or upload an existing PEM.
• Four templates are seeded: Auth Server, 802.1X Client, Webserver, and Milestone. Templates carry the subject fields, key type and size, validity, and key usages, and use a %hostname placeholder that is filled in at issue time.
• Set Subject Alternative Names (IP addresses and DNS names) so server certificates satisfy browser and VMS requirements.

Local versus external CAs

A local CA is one whose private key the app holds, so it can sign new certificates. An external CA is imported as a certificate only: it is a trust anchor but cannot sign anything. Trustlix ships with the Axis device ID root CAs pre-installed as external anchors, so the server can validate genuine Axis devices out of the box. When you generate a server certificate or an EST profile, only local CAs appear as possible issuers.

PKCS#12 export

Certificates can be exported as PKCS#12 (P12) bundles protected by a password. Change the export password from the certificate page using the key action. For security the current password is never sent back to the browser in clear text, so the change dialog opens empty and you type a new one.

Revoking a certificate

Revoking cannot be undone. There is no reinstate action, by design, so the revoke action disappears from a certificate once it has been revoked. A revoked certificate is refused at 802.1X authentication, and it can no longer enroll or renew over EST, so the device it belongs to needs a new certificate before it can get back on the network. The device keeps the file it already has: revoking takes away its acceptance, not its copy.

Revoking a CA invalidates every certificate underneath it, including the ones its intermediates issued. The confirmation dialog lists exactly which certificates go with it before you confirm, so the reach of the decision is visible rather than discovered afterwards.

EST Enrollment

The EST server implements RFC 7030 so cameras can enroll and renew their own certificates over mutual TLS. It listens on tcp/22224 by default with a TLS 1.2 minimum, and exposes the standard labeled routes:

https://<server>:22224/.well-known/est/<profile>/cacerts
      https://<server>:22224/.well-known/est/<profile>/simpleenroll
      https://<server>:22224/.well-known/est/<profile>/simplereenroll

Because a camera re-enrolls before its certificate expires, EST-issued certificates renew automatically without an operator.

Certificates and trust

Like the authentication server, the EST endpoint has a server certificate it presents to enrolling cameras and a client CA trust setting (trust all managed CAs, or only specific ones). The trust pool is rebuilt on every handshake, so changing it takes effect without a restart. With trust all managed CAs, the pre-installed Axis device ID roots let genuine Axis devices enroll immediately.

Revoked certificates

A camera presenting a revoked certificate is refused, and so is one whose chain contains a revoked issuer. This matters because a camera renews unattended: without the check, a revoked certificate would simply be exchanged for a fresh valid one at the next renewal and the revocation would undo itself. Revoking an intermediate CA therefore stops every device beneath it in one action.

Profiles

A profile (also called an EST label) is one enrollment endpoint. Its name becomes the URL segment after /.well-known/est/, and it carries every signing decision for the certificates it issues: the issuing CA, validity, key type and size, the extended key usages (server auth, client auth), and SAN enforcement. Two profiles named https and dot1x are seeded ready to use. A disabled profile still exists but rejects enrollment.

VLAN and MACsec

VLAN policy

VLAN policy places an authenticated client onto a VLAN based on the CA that issued its certificate. Each policy maps one issuing CA to one VLAN ID (in the range 1 to 4094), so a client lands on the VLAN of whichever CA signed its certificate. A CA can map to only one VLAN, and a CA that already has a policy is disabled in the picker.

MACsec

MACsec adds optional IEEE 802.1AE encryption on the link between the switch and the authentication server. Leave it off unless your switches are set up for MACsec on that link. When it is on:

• Dynamic CAK derives the connectivity association key from the EAP session automatically. This is preferred because there is no key to distribute.
• Static CAK and CKN are used when dynamic CAK is off. The CAK is the key and the CKN is its name, and both must match the switch exactly.

Fleet Deployment

The deployment wizard scans the network for cameras and pushes configuration and certificates to many devices at once, so a whole fleet can be brought onto the secured network from one place.

Scan and credentials

Trustlix discovers cameras on the network (using mDNS and WS-Discovery) or across a CIDR range. Store one or more sets of scan credentials (a username and password, kept encrypted on the device) that the wizard uses to log in to discovered cameras. Devices it cannot identify are listed separately as unsupported.

What you can push

• HTTPS certificate for the camera web server.
• 802.1X client certificate plus the trusted CA certificates and the EAP identity. Choose a unique certificate per device (issued from a template) or one shared certificate for many devices, and pick how the EAP identity is formed (last IP octet, full IP, MAC address, certificate common name, or a custom string).
• EST enrollment by binding profiles to camera services (WEBSERVER for HTTPS, NETAUTH for 802.1X, and RTSPS). The camera then enrolls and renews those service certificates itself.
• NTP so the target camera has correct time, which 802.1X and certificate validity both depend on.

EST enrollment and one-shot HTTPS or 802.1X certificate deployment are mutually exclusive: EST owns the lifecycle for the services it manages. EST deployment is Axis only and requires AXIS OS 12.10 or later on the target, and a camera caps the number of active EST profiles at two.

Events, Activity and Logs

Camera events

Trustlix publishes its activity as native camera events, so anything you enable appears in the device event system and can drive action rules, recordings, or ONVIF notifications. Each event carries data fields (identity, certificate name, reason) so a single event type can be filtered per device. The available events are:

• Authentication rejected and accepted for 802.1X logins (accepted is off by default because it can be high volume).
• EST denied and EST issued when a device is refused or granted a certificate.
• Certificate expiry, a stateful event that stays active while a certificate is inside its warning window or already expired. A default warning window applies, and per-certificate rules can set a tighter window for a specific certificate.

Activity

Authentication activity (802.1X sessions) and enrollment activity are stored on the device, so they survive a reload and every operator sees the same list. New entries still appear live as they happen. Both views are capped: the oldest entries are removed automatically once the limit is reached, and the newest are always the ones kept.

Opening one authentication shows the full picture behind it: the certificate chain the client presented, the cipher suites it offered, the negotiated TLS version, and the reason for a rejection. For a rejected authentication you can also download the RADIUS traffic capture as a .pcap to open in Wireshark. Captures are kept for rejections only, since that is what you troubleshoot, and the download button is disabled when there is no stored capture.

Activity retention

General Settings sets how many records each of the two activity views keeps. The defaults are 100 authentications and 500 enrollments, and either can be set between 10 and 10000.

Rejected authentications carry a traffic capture of roughly 8 KB each, so the authentication limit is the one that drives storage use. Enrollment records are a few hundred bytes, so a high limit there costs very little. On a switch that reauthenticates often, a low limit covers only a short period, so raise it if you need to look further back.

Lowering a limit deletes the surplus records as soon as you save, and that cannot be undone. The page warns you before you save when the value you have typed will delete something.

Storage

The dashboard shows what the activity database currently occupies, how many records each view holds against its limit, and how much free space is left on the device. It is the quickest way to confirm a unit is healthy, and to see the effect of changing a retention limit.

Logs

A logs page shows the on-device log buffer with a level filter. Trustlix also writes to the Axis syslog under the tag trustlix, which is the place to look when the app itself will not start.

Troubleshooting

• The UI will not open. The app is served through the camera at /local/trustlix/trustlix, and the reverse proxy requires an administrator session, so sign in to the camera first.
• The app starts but the servers are down. Trustlix checks its license on start (app ID 415997); an invalid license keeps the RADIUS and EST listeners closed. Check the Axis syslog under the tag trustlix for the reason.
• A switch cannot authenticate clients. The switch IP must be registered with the matching shared secret. Requests from unlisted addresses are dropped, at least one switch must exist, and RADIUS on udp/1812 must be reachable from the switch.
• A camera cannot enroll. The EST port (default tcp/22224) must be reachable, the camera must run AXIS OS 12.10 or later, the profile must be enabled, and the camera certificate must chain to a trusted CA.
• The browser still warns about certificates. Install Trustlix-Root-CA.crt into the Trusted Root store on the PC you browse from, as prompted on first run.
• Generating a server certificate fails with no CA available. You need a local CA that holds a private key. The pre-installed Axis device ID roots are external (certificate only) and cannot sign, so create a local CA first.
• 802.1X or certificate validation fails intermittently. Confirm the devices have correct time. Push NTP during deployment so certificate validity windows line up.
• A device stopped working after a certificate was revoked. That is the intended effect: a revoked certificate is refused at authentication and cannot renew over EST. Revoking cannot be undone, so issue the device a new certificate and deploy it. If several devices stopped at once, check whether a CA was revoked rather than a single certificate.
• Older activity entries have disappeared. Both activity views keep a fixed number of records and drop the oldest automatically. Raise the limit in General Settings if you need to look further back, and check the dashboard for the space that costs.