Access Control Fundamentals and System Architecture
Objective. Students will correctly classify the components of an access control system, explain how credential data travels from reader to controller to locking device, and describe the difference between standalone, networked, and cloud-managed topologies.
This lesson, its worked examples and its practice questions has not yet been verified by a credentialed professional in the field or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.
VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.
What Is Access Control?
Access control is the practice of allowing only authorized people to pass through a specific door or entry point at a specific time. In commercial and institutional settings, this replaces a traditional keyed lock with an electronic system that can log who entered, deny entry outside business hours, and revoke a lost credential instantly — without recutting a single key.
Every access control system, no matter how simple or complex, performs the same three-step logic: identify the person presenting a credential, decide whether that person is authorized, and act by releasing or holding the locking device.
Core Components and the Signal Path
Understanding how a credential travels through the system is fundamental to installation and troubleshooting.
Reader — The reader is the input device mounted at the door. It captures credential data from a card, fob, PIN pad, biometric scan, or mobile device and converts it into a digital signal. Common reader technologies include Wiegand (a legacy protocol that transmits a simple binary code), OSDP (Open Supervised Device Protocol, a newer bidirectional standard that supports encryption and reader status reporting), and proprietary formats used by some manufacturers.
Controller (Access Control Panel) — The controller is the decision-making brain. It receives the credential data from the reader, compares it against its stored database of authorized credentials and time schedules, and sends an output command. Controllers range from single-door units to enterprise panels managing hundreds of doors. The controller also monitors door status and logs every event with a timestamp.
Power Supply — Access control hardware requires dedicated, conditioned DC power, often 12 V or 24 V. Power supplies include battery backup to maintain security during a commercial power outage. Sizing the power supply correctly — accounting for the locking device's inrush current plus all readers and ancillary devices — is a critical installation step.
Electric Locking Device — The controller's output energizes or de-energizes the locking hardware. Two common types are the electric strike, which releases the strike plate to allow a mechanical latch to retract, and the electromagnetic lock (magloc), which holds the door shut magnetically when energized. Fail-safe devices unlock on power loss; fail-secure devices remain locked. Life-safety codes govern which type may be used on egress paths — always verify local fire and building code requirements before specifying a locking device.
Request-to-Exit (REX) Device — The REX sensor detects when someone on the secure side wants to leave, triggering the controller to unlock the door and — critically — suppressing a door-forced alarm. REX devices are typically passive infrared motion sensors or push buttons.
Door Position Switch (DPS) — A magnetic contact sensor mounted on the door frame monitors whether the door is open or closed. The controller uses DPS data to generate door-held-open or door-forced alarms and to confirm that a lock command was actually carried out.
Signal flow summary: Credential presented → Reader encodes and transmits data → Controller validates and decides → Controller sends unlock signal → Locking device releases → DPS confirms door state → Event logged.
System Topologies
Standalone Systems — A standalone keypad or card reader contains its own credential database and decision logic in one housing. There is no network connection. Programming is done locally through a keypad sequence or a short-range interface. Standalone systems are low cost and simple to install on one or two doors but offer no centralized logging and require on-site reprogramming for every credential change. Typical scenario: a small storage room or a single-tenant suite with a handful of users.
Wired Networked Systems — Controllers are wired to readers (commonly with 22 AWG or 18 AWG shielded cable) and connected back to a head-end server or software workstation via Ethernet or RS-485. The software provides centralized credential management, real-time monitoring, and event reporting across many doors. Wired networks are robust and low-latency but require structured cabling and server infrastructure. Typical scenario: a mid-size commercial building, a school campus, or a facility that requires detailed audit trails.
Cloud-Managed Systems — Controllers or intelligent readers connect to the manufacturer's cloud platform via the site's internet connection. Administration, credential management, and reporting are done through a web browser or mobile app with no on-site server required. Cloud systems lower IT overhead and support remote management but depend on internet availability and the vendor's platform continuity. Typical scenario: a multi-site business where an administrator manages all locations from one dashboard, or a small business without dedicated IT staff.
Credential Technologies
Common credential types include PIN codes (knowledge-based, low cost, shareable), proximity cards and fobs (125 kHz passive RFID, widely deployed but cloneable), smart cards (13.56 MHz, support encryption and mutual authentication — examples include HID iCLASS and MIFARE DESFire), mobile credentials (Bluetooth Low Energy or NFC on a smartphone), and biometrics (fingerprint, iris, or facial recognition used where high assurance is required). Many modern systems support multi-factor authentication, combining two or more credential types.
Safety Considerations
Before working on any access control installation: verify that cutting power to a locking device will not trap occupants or block an egress path. Coordinate with the building owner and, where required, the authority having jurisdiction (AHJ) before disabling any door. When pulling cable above ceilings or in wall cavities, follow all applicable electrical codes for plenum-rated cable in air-handling spaces. Use appropriate PPE — safety glasses when drilling, gloves when handling metal door hardware, and arc-flash awareness when working near electrical panels. Never defeat a fire alarm door-release interface without confirming that it is properly restored and tested before leaving the site.
Key terms10
Materials: Commercial access control block diagrams (manufacturer-supplied or instructor-drawn), spec sheets for at least three current product lines (e.g., HID, Schlage, Honeywell or equivalent), blank diagram worksheets, whiteboard, ALOA study materials covering electronic access control, ESA CAT candidate handbook
Check: Students score at least 80% on a 20-question in-class quiz covering component identification, signal flow, topology trade-offs, and credential technology definitions; any score below 80% triggers a one-on-one review before the next lesson.
Practice check8
Answer each question, then check it. Nothing is recorded; this is your own practice.
