Access Control Installation: How a Controlled Door Gets Built

What Gets Installed at a Controlled Door

From the hallway, an access-controlled door looks simple: a small reader on the wall and a click when someone presents a badge. Behind that click sits a chain of parts, and an access control installation is the job of selecting, mounting, wiring and tuning every link in it.

• Reader or keypad. Captures the credential, whether it's a card, fob, phone or PIN
• Controller. Compares the credential with its user list and the door's schedule, then switches a relay
• Electrified locking device. An electric strike, maglock, electrified lockset or latch-retraction exit device that changes state when that relay switches
• Request-to-exit device. A motion sensor, push button or switch inside the hardware that marks a legitimate exit
• Door position switch. A magnetic contact that reports whether the door is truly shut
• Power supply and batteries. Filtered DC power for locks and readers, with standby capacity when utility power drops
• Software. Where users, schedules, alarms and event history live

Every one of those parts can be excellent and the door can still fail, because each depends on the others. A reader that grants access accomplishes nothing if the strike can't release against a door the wind is pushing. A perfectly tuned strike turns into a nuisance if the contact above it is misaligned and the system reports a forced door every afternoon. Good installations treat the opening as a single assembly, from hinges and closer to the software rules, instead of a reader bolted beside whatever hardware happened to be there already.

The Site Survey: Reading a Door Before Touching It

Nothing gets ordered until every opening has been inspected. For a small office that's a short visit; a campus takes longer. Either way, the survey answers questions that decide everything after it:

• Frame material and profile. Hollow metal, aluminum storefront, wood, or no frame at all on frameless glass
• Door construction, swing and hand, and whether it's a single leaf or a pair
• The existing lockset or exit device and its condition
• Fire rating labels on the door edge and frame
• Closer condition, hinge wear and how reliably the door latches unaided
• Ceiling type above the door and the likely cable path to the controller location
• Available 120-volt power and a network connection
• Exposure to sun, rain, wind and impact
• Who uses the door, at what hours, and how many credentials will be issued

Some findings change the plan entirely. A storefront jamb with no depth for a strike pushes the design toward latch retraction or a maglock. A label on a stairwell door limits choices to fire-listed products. A fire alarm panel in the building means any fail-safe lock must release on alarm, which brings the alarm company into the project. A concrete wall where everyone assumed drywall adds surface raceway to the scope.

The survey produces a door schedule: a table with one row per opening listing the lock, reader, exit device, contact, power source, cable path and notes. That one document becomes the quote, the installation checklist and, years later, the maintenance record.

Readers and Credentials: Prox, Smart Cards, Phones and PINs

The credential is the key of an access control system, and just like mechanical keys, some are far easier to copy than others.

Low-frequency 125 kHz proximity cards and fobs have been around for decades. They transmit a fixed number with no encryption, and cheap handheld copiers can read and clone them from a short distance. They still function, but we don't recommend them for anything new.

High-frequency 13.56 MHz smart credentials use mutual authentication and encryption. MIFARE DESFire EV2 and EV3, HID iCLASS SE and HID Seos are common choices. Older MIFARE Classic cards also run at 13.56 MHz, but their encryption was broken years ago, so frequency alone isn't the measure of security. Phone-based credentials using Bluetooth or NFC are supported by many current platforms and spare you from printing cards at all.

Keypads need no physical credential, which is both their convenience and their weakness, because codes get shared. Pairing card and PIN at a server room or medication room adds a second factor.

The wiring between reader and controller matters as much as the card. The long-standing Wiegand interface sends credential data in the clear and can't tell the controller when a reader has been pried off the wall. OSDP, the Open Supervised Device Protocol maintained by the Security Industry Association, runs over an RS-485 twisted pair, supervises the reader continuously and supports Secure Channel encryption. It also tolerates far longer cable runs. On new work, we specify OSDP wherever the controller supports it.

Placement follows accessibility rules. Readers belong on the latch side within the reach range the California Building Code allows, generally no higher than 48 inches to the operable part.

Electric Strikes: Types, Fit and Preload

An electric strike takes the place of the fixed strike plate in the frame. When the controller releases it, a pivoting keeper lets the latch pass and the door swings open with the lockset still latched. Because the lockset itself stays mechanical, anyone inside can leave by turning the lever, which is why strikes are the default on most framed doors.

Strikes are built around specific hardware:

• Cylindrical lockset strikes for standard lever sets in hollow metal or wood frames
• Mortise strikes with a longer keeper for mortise lock latches
• Surface-mounted strikes for rim panic devices, which avoid cutting the frame
• Narrow-profile strikes for aluminum storefront jambs, where depth is limited

Most current strikes can be set to 12 or 24 volts DC and switched between fail-secure and fail-safe in the field. Fire-rated openings require a strike listed for fire doors, and listed fire strikes operate fail-secure. Heavy-duty bodies such as the HES 1006 series are a familiar sight in hollow metal frames.

Fit is where installations succeed or fail. The latch must center in the keeper, and on locks with a deadlatch plunger, the plunger has to rest against the strike lip rather than drop into the keeper opening, or the latch can be slipped with a thin tool. Preload is the other trap. Door seals, wind, building air pressure and strong closers press the latch against the keeper, and many strikes jam when that force exceeds their rating. Strikes rated for higher preload handle it better, and adjusting the closer or seals often helps as much as the hardware.

Monitored strikes add switches reporting whether the latch is actually seated, which gives the controller a real locked status instead of an assumption.

Maglocks: Where They Work and What Code Requires

An electromagnetic lock is a coil mounted to the frame header plus a steel armature plate on the door. Energized, the pair resists hundreds of pounds of force, with 600 and 1,200 pounds the common ratings. Remove power and the door swings free, which makes every maglock fail-safe by design.

Maglocks solve problems strikes can't: frameless glass, double doors without a center mullion, pedestrian gates and openings where cutting the frame is impractical. The lock has no moving parts, so it shrugs off heavy traffic.

The tradeoff is egress. Because a maglock holds the door no matter what the inside lever is doing, building codes treat it differently. Under the sensor-release provisions used in California, an electrically locked egress door generally needs:

• A sensor on the egress side that releases the lock when someone approaches
• Automatic release if the sensor or the lock loses power
• A manual push-to-exit button 40 to 48 inches above the floor and within 5 feet of the door, signed for exit, that interrupts lock power directly, independent of the access control electronics, and keeps the door released for at least 30 seconds
• Automatic release when the fire alarm or sprinkler system activates, where the building has one

Certain occupancies restrict maglocks further, and local fire authorities interpret the details. Newer code editions also recognize door-mounted release, where listed exit hardware on the door cuts magnet power when pushed.

Mounting details matter. On an outswinging door, the magnet sits on the inside face of the header; an inswinging door needs a Z-bracket or a different lock entirely. Armatures should float on their mounting bolt so they seat flat, and a bond sensor can confirm the magnet is genuinely holding.

Electrified Locksets, Latch Retraction and Power Transfer

Sometimes the lock should be electrified instead of the frame. Electrified mortise and cylindrical locks contain a solenoid or motor that locks or frees the outside lever. The latch keeps working mechanically, so the door stays positively latched whether the trim is locked or free. That makes these locks a natural fit for fire-rated openings, offices that want a clean appearance, and wood or damaged frames that shouldn't be cut for a strike. Electrified versions of the Schlage L9000 and ND series and the Sargent 8200 are common examples, and Corbin Russwin and others offer comparable mortise lines.

Panic-bar doors have their own option: electric latch retraction. A motor or solenoid inside the exit device pulls the latch back when a valid credential is read or during scheduled unlock periods. Von Duprin, Sargent and other manufacturers offer it on rim, vertical rod and mortise exit devices. It's quieter than dragging a latch across a strike thousands of times, wears less, and pairs well with automatic door operators. These devices draw a high inrush current and generally need the manufacturer's matched power supply.

Both approaches require power on a moving door. The tidiest method is an electric power transfer device or an electrified through-wire hinge, which carries conductors across the hinge edge out of sight. An armored door loop costs less and works where appearance and tamper resistance matter less. Getting wire through a hollow metal door means drilling and fishing past internal reinforcements, and on labeled fire doors the prep must stay within the listing. That's why factory-prepared doors and hinges are the better route in new construction.

Fail-Safe Versus Fail-Secure, Door by Door

These two terms describe what a lock does when power disappears, and the right answer changes from one door to the next.

Fail-secure hardware stays locked without power. Fail-safe hardware unlocks. One detail trips people up: the terms describe the outside of the door. With a fail-secure strike or electrified lockset, anyone inside can still leave with the lever or panic bar. The opening is secure against entry, not a trap.

How the choice usually plays out:

• Exterior perimeter doors. Fail-secure, so an outage or a cut wire doesn't leave the building open. A mechanical key override is essential.
• Fire-rated doors. The latch must stay engaged. Strikes are fire-listed fail-secure; electrified locksets may be fail-safe because the latch still latches with the lever free.
• Maglocked openings. Always fail-safe, with the egress devices code requires.
• Stairwell doors in taller buildings. Codes may require re-entry from the stair side or remote release during an emergency, which often means fail-safe trim.
• Interior offices and storage. Usually fail-secure, with a key override for managers.

Power planning follows from those decisions. Batteries carry a system through a typical outage, but a long one, such as a planned public safety power shutoff during fire weather, can outlast them. At that point fail-secure doors stay locked and credential holders need keys, while fail-safe doors release and the building relies on mechanical hardware alone. Designing for that outcome on paper is far better than discovering it during the first extended blackout.

Request-to-Exit Devices and Door Position Switches

Two small devices determine whether a system's alarms can be trusted.

A request-to-exit device, or REX, tells the controller that an opening is someone leaving. Without one, every exit looks like a forced door. The common types are:

• Passive infrared motion sensors mounted above the door on the secure side
• Switches built into electrified locksets and exit devices that close when the lever or bar moves
• Push buttons, including the pneumatic or electronic timer buttons used on maglock doors

On strike doors with mechanical free egress, the REX usually just shunts the forced-door alarm. On maglock doors, it also drops the lock, and code adds the separate push button described earlier.

Motion sensors deserve careful aiming. A sensor that sees the door gap can be tripped by someone outside sliding a thin object or blowing air through that gap. We aim the detection pattern down and away from the door, mask its edges, and on higher-security openings prefer a switch inside the hardware over motion detection.

The door position switch is a magnetic contact, ideally recessed in the frame head with its magnet set into the top of the door. It enables:

• Relock the instant the door closes, rather than on a timer
• Held-open alarms when someone props the door
• Forced-door alarms when it opens without a valid credential or exit request

Gap matters. Steel doors and doors that have settled can pull the magnet out of range and generate phantom alarms. Matching the contact to the frame material, then checking it again after the closer is adjusted, keeps the alerts meaningful.

Power Supplies, Cabling and Pathways

Most electrified locks run on 12 or 24 volts DC. A dedicated access control power supply converts building power, fuses each output and charges sealed batteries for standby. Sizing starts with the combined current of every lock and reader on that supply plus headroom, and battery capacity follows from how long doors must keep working during an outage. Latch retraction devices and some electrified locks need supplies designed for high inrush. Where fail-safe locks are present, the supply typically includes a fire alarm input that removes lock power when the alarm activates.

Coils create voltage spikes when switched off. A diode or metal oxide varistor across each strike or magnet protects the controller's relays, and many locks include one internally. Leaving that protection out is a quiet cause of failures months down the road.

A typical controlled door needs:

• Reader cable. Shielded multi-conductor for Wiegand, or a twisted pair plus power for OSDP
• Lock power. Two conductors, heavier gauge on longer runs
• Door position switch. Two conductors
• Request-to-exit. Two to four conductors

Composite cables bundle all of these under one jacket. Cable in an air-handling plenum ceiling must be plenum-rated, and vertical runs between floors need riser-rated cable. Exterior and underground runs belong in conduit with wire rated for wet locations. Penetrations through fire-rated walls get sealed with listed firestop material.

Voltage drop is the most common electrical problem on long runs: a lock receiving too little voltage hums but won't release. The cure is heavier wire, a higher system voltage or a local supply near the door, and every one of those is easier to plan than to retrofit.

Programming, Testing and Handoff

Programming turns hardware into policy. During setup we build:

• Users and groups, with a name attached to every credential
• Door schedules for unlocked business hours, after-hours access and holidays
• Access levels combining doors and times for each group
• Alarm behavior for forced and held doors, and who gets notified
• Relock settings tied to the door position switch

Then every door is tested under conditions that resemble real use. A valid credential releases the lock and the door opens without force. An invalid one is denied and logged. Walking out doesn't trigger a forced alarm. Propping the door triggers the held alarm after the set delay. Opening it without a credential triggers the forced alarm. With AC power removed, batteries carry the load and each lock behaves as designed. Where present, the fire alarm input releases fail-safe locks. Mechanical overrides open fail-secure doors.

Handoff covers the parts people tend to skip. The administrator learns to add and remove users, cancel a lost credential, change a schedule and read the log. The owner receives admin credentials for the software and any cloud account in the company's own name, along with a door schedule showing model numbers, wiring notes and power supply locations. Override keys are counted and assigned to named people.

After a few weeks of real traffic, small adjustments are normal: a closer speed tweaked, an exit sensor re-aimed, a schedule shifted by half an hour. We expect that follow-up visit and plan for it from the start.

Where a Locksmith's Work Ends: Contractors, Permits and Licensing

Julian's Locksmith holds California locksmith company license LCO7891, issued by the Bureau of Security and Investigative Services, and you can verify it at search.dca.ca.gov. California locksmiths work under the Locksmith Act in the Business and Professions Code, and the door hardware at the center of every access-controlled opening is our daily work.

Other pieces of a project belong to other licensed trades, and an honest installer tells you which:

• New 120-volt circuits for power supplies require an electrician
• Building-wide low-voltage cabling, especially as part of a larger contract, may call for a contractor holding a C-7 low voltage systems or C-10 electrical license from the Contractors State License Board
• Fire alarm interfaces are connected and tested at the panel by the fire alarm company
• Elevator access control is coordinated with the elevator contractor
• Vehicle gate operators involve gate specialists and their own safety standards
• Automatic door operators are typically serviced by operator companies

Permits and plan review depend on the jurisdiction and the scope. Maglocks on egress doors, delayed egress hardware, stairwell door changes and modifications to fire-rated assemblies are the items most likely to draw a fire authority's attention. In leased buildings, written landlord approval comes before any drilling, and many buildings require tenant systems to match their standard.

We confirm authorization on every project: the business owner or an authorized manager, a tenant with landlord sign-off, or an HOA board or management company acting for the association. Access control changes who can enter a property, so that authority is documented before work starts.

Southern California Conditions, Costs and Scheduling

Regional conditions shape hardware choices. Inland summer heat bakes west-facing readers and keypads and shortens battery life in unventilated closets. Santa Ana winds load doors against strikes and slam gates, so preload ratings and closers with backcheck matter. Warehouses and repair shops bring dust and grease that call for sealed readers and keypads. Foothill properties face fire-weather power shutoffs that test battery planning. Older downtown buildings add plaster, solid wood and little ceiling space.

We don't publish flat prices, because two access control projects rarely match. A quote reflects:

• The number of doors and their construction
• The locking hardware chosen for each opening
• Cable distance and building structure
• Platform, licensing and credential type
• Code items, permits and coordination with other trades
• Any door repair needed before electrification

You receive a written, door-by-door quote after the survey, and nothing is installed until you approve it.

Julian's Locksmith is a mobile service based in San Bernardino. We install access control across the Inland Empire, the San Gabriel Valley, the Pomona Valley, north Orange County and southeast Los Angeles County. Our hours are 6:30 a.m. to 11:30 p.m., seven days a week. That includes weekends. Early starts let work happen before staff arrive, and evening slots keep busy storefronts open during the day. Call (951) 903-3193 to schedule a site survey.