This site being IP "VIDEO" Market info, everyone has a good understanding about ONVIF in the video context. You can use ONVIF to communicate with cameras. You can also use ONVIF to comunicate with VMS's from other software. Correct me if I'm wrong, but it seems to me that ONVIF support actually used in operation is almost entirely the talking-to-the-camera variety, and not so much the 3rd party software talking-to-VMS part. Thus the following statement:
In access control, the Control Panel is like the VMS, and the Reader/Door-position/Strike is like the Camera.
Much of the conversation about "why Access Control is so far 'behind' Video in terms of open standards", fails to appreciate this. ONVIF for cameras has been very successful because cameras are much more of a (...wait for it...) a comodity than VMS's are. What a camera does is more limited and easier to conform into a standard. In contrast, the VMS is where most of the value is added and where systems vendors have more freedom to differentiate, and as such, ONVIF has less traction at that level. How many integrated systems like OnGuard, C-CURE, etc., use ONVIF to talk to the VMS instead of the VMS's SDK?
Similarly, the Control Panel (or whatever provides the controlling logic), is where the value is added in an access control system. The reader/door-position/strike is, in and of itself, much more simply defined in what it does. OSDP is an appropriate standard at that level, as was weigand in the past. However, it is much harder to standardize that what the controller does, just as it is with what VMS's do, yet that seems to be the goal of ONVIF C.
To sum it up, ONVIF C, as an "open" alternative to controller protocols, will have about as much success as ONVIF S & G have as an alternative to VMS companies' SDKs: not much. If ONVIF C were appropriate for the Controller-to-reader communications, which it is not, it would compete with OSDP's giant head start.
Where ONVIF C and PSIA's Area Control profiles will find success is in data sharing between similar devices like climate-control systems, as well as global I/O, global anti-passback, etc., but for host-to-controller communications, I suspect SDKs will rule the day for a long time to come.