An electronic access control system identifies a person at a door, decides whether they are allowed in at that time, releases the lock if they are, and records the result. A controller near the door makes that decision in a fraction of a second using rules sent from central software, and keeps doing so even if the network goes down.
The four jobs of an access system
Every access system, from a single door to a campus of thousands, does four things:
- Identify. A reader takes a credential: a card, fob, phone, PIN or fingerprint.
- Decide. A controller checks the credential against its rules: is this person allowed through this door, at this time, today?
- Act. If yes, the controller releases the lock for a few seconds. If no, it stays locked.
- Record. Every grant, refusal and door alarm is logged with the time, door and credential.
It also watches the door itself. A switch in the frame tells the controller whether the door is open or closed, which is how the system knows when a door has been forced or propped open.
The parts at a door
A controlled door needs several devices working together. The diagram shows a typical single door from the outside.
- Reader: reads the credential and sends its number to the controller. Some readers include a keypad or biometric sensor.
- Electrified lock: an electric strike in the frame, an electrified lockset or exit device in the door, or an electromagnetic lock. Which one is used depends on the door, the fire rating and egress rules.
- Door position switch: a magnetic contact that reports whether the door is closed.
- Request-to-exit (REX): a motion sensor or switch in the exit hardware that tells the controller someone is leaving, so it does not raise a forced-door alarm and, with some lock types, releases the lock.
- Controller and power supply: usually above the ceiling or in a nearby telecom or electrical room, with battery backup.
What happens when you present a card
The decision and the door monitoring follow a fixed logic. Understanding it makes alarms and complaints much easier to diagnose.
The controller's check usually covers several conditions at once: is the credential valid and not expired or reported lost, does this person's access group include this door, and does the current time fall within the group's schedule? Doors can also follow their own schedules, for example unlocking the front entrance during business hours and returning to card access after hours.
Door alarms
Forced-door and held-open alarms are where the security value lies, and where most nuisance alarms come from. A forced-door alarm that fires every time someone leaves usually means the exit sensor is badly aimed or missing. A held-open alarm that fires constantly usually means the door is slow to close, the timer is too short for deliveries, or the door is being propped. Each of these has a hardware or setting fix, and fixing them matters: operators who see dozens of false alarms a day stop responding to the real ones.
Groups, schedules and special rules
Good systems are managed by role rather than by person. Access groups such as staff, cleaners, IT or Tenant A define which doors and times apply, and each person is placed in one or more groups. When someone changes role, you move them between groups instead of editing door by door.
Beyond the basics, systems support rules such as:
- Two-factor entry: card plus PIN or biometric for sensitive rooms.
- Anti-passback: a card used to enter an area cannot be used to enter again until it has been used to exit, which stops cards being passed back to someone else.
- Two-person rule: two valid credentials are needed within a short time before the door opens.
- Lockdown: one command locks selected doors against entry, used in schools, clinics and similar sites, while still allowing exit.
- Elevator control: a reader in the cab limits which floors a credential can select.
Where the intelligence lives
In most modern systems, the server or cloud service holds the master database and the user interface, but each controller keeps its own copy of the rules for its doors. That design means doors keep working if the network fails.
The catch is that changes made at the server, such as cancelling a lost card, only reach a controller that is online. Monitoring controller communication and fixing outages quickly is part of running the system well. Access controllers belong on a segmented network; see VLANs and network segmentation.
Power and the fire alarm
Controllers and lock power supplies run from building power with battery backup. What each lock does when its power is removed, whether it unlocks (fail-safe) or stays locked (fail-secure), is chosen door by door. On many doors the building and fire codes require locks to release on fire alarm, which is done through a relay from the fire alarm system. Our guide on access control, door hardware and safe egress covers these rules in principle, and access control credentials covers the choice of card, phone or biometric.
Keeping it working
Access systems fail quietly. A door that no longer latches, a reader that stopped reporting or a battery that will not hold a lock for long all look fine until the day they matter. A simple routine catches most problems:
- Walk the controlled doors periodically: check that each closes and latches on its own, the reader responds and the door contact reports correctly.
- Review the alarm log for doors that raise frequent forced or held-open alarms, and fix the cause.
- Check controller communication status and investigate any controller that drops offline.
- Test backup batteries in controllers and lock power supplies on the manufacturer's schedule, and replace them before they reach end of life.
- Confirm with the fire alarm contractor that release on alarm is tested during the annual fire alarm inspection.
- Keep software and controller firmware on a supported version.
Review your user list. The most common weakness in a working access system is not the technology. It is credentials that were never cancelled when people left, contractors finished or cards were lost. Review active users against HR and contractor records on a regular schedule.
How ehZee can help
We design access control systems door by door, coordinate electrified hardware and fire alarm interfaces, and review existing systems for nuisance alarms, unsupported equipment and gaps in user management. Drawings for permit are sealed by a licensed professional engineer where required, and installation is done by licensed electrical contractors and qualified integrators. See our access control systems service.
Common questions
Can access control work with our cameras?
Usually. Integration lets an alarm or a refused credential bring up video from the nearest camera, and lets investigators jump from an access event to the matching footage.
Does every door need a reader on both sides?
Rarely. Most doors read on entry only and use an exit sensor or exit hardware on the inside. Reading on both sides is used where anti-passback or tracking who is inside an area is needed, and exit must still never be prevented where codes require free egress.
How long should access logs be kept?
Long enough to investigate incidents, and no longer than your privacy policy and the law that applies to your organisation allow. Set the retention period deliberately rather than leaving the default.