Controller Programming, Credential Management, and Time Zones

Controller Programming, Credential Management, and Time Zones

Access control systems do more than lock and unlock doors — they create an auditable record of who entered where and when. Commercial systems accomplish this through a management software database that ties together four core objects: cardholders, credentials, access levels, and time zones. Understanding how these objects relate to each other is the foundation of this lesson.

The Database Structure

Most commercial access control platforms (such as Lenel, Genetec, CDVI, and similar products) organize their data in a hierarchy:

• Cardholders are the people in the system — employees, contractors, and visitors. Each cardholder record holds name, ID number, and status (active or inactive).
• Credentials are the physical tokens (proximity cards, key fobs, PIN codes, mobile credentials) assigned to cardholders. A single cardholder can carry more than one credential. Every proximity card has two identifying numbers: the facility code and the card number. Together these form the credential's identity as read by the controller.
• Time zones define windows of time — for example, Monday through Friday, 7:00 a.m. to 7:00 p.m. Time zones are reusable building blocks referenced by access levels and door schedules.
• Access levels link cardholders to specific doors during specific time zones. Access level "Office Staff" might grant access to Door 1 and Door 2 during business hours only, while access level "Manager" grants access to both doors at any hour.
• Door schedules / auto-unlock schedules tell the controller to release a door latch automatically at a set time and relock it at another time, independent of any credential swipe.

Facility Code and Card Number

When you enroll a proximity card using a desktop enrollment reader, the software captures two values. The facility code (sometimes called a site code) identifies the batch or organization the card belongs to. The card number is the individual identifier within that batch. Both values are stored in the cardholder's credential record. If either value is entered incorrectly, access will be denied even for an authorized user — a common programming error to watch for during testing.

Programming Access Rules Step by Step

Step 1 — Create time zones. Before assigning access, build the time windows the system needs. A business-hours time zone might be defined as Monday–Friday, 8:00 a.m. to 6:00 p.m. A 24/7 time zone already exists in most platforms as a default.

Step 2 — Create access levels. Define which doors each level covers and which time zone applies. Keep access levels as broad as needed but as narrow as practical — the principle of least privilege limits exposure if a credential is lost or stolen.

Step 3 — Add cardholders and assign credentials. Enter each person's name and ID, then assign the enrolled credential (facility code + card number) to that record. Activate the record only when the person is ready to use it.

Step 4 — Assign access levels to cardholders. Link each cardholder to one or more access levels. A manager who needs all-hours access receives the 24/7 access level; standard employees receive the business-hours level.

Step 5 — Configure door schedules. For any door that must unlock automatically (a main entrance, for example), set an unlock schedule tied to a time zone. The controller will drive the door to the unlocked state at the start time and return it to secured at the end time without any credential swipe.

Step 6 — Download to the controller. Changes made in the software must be sent to the physical controller. Most platforms do this automatically over the network; USB-connected or offline controllers may require a manual download step. Verify the download completed before testing.

Generating and Reading an Access Report

The transaction log is the system's audit trail. Each event record typically contains a timestamp, door name, cardholder name, credential number, and result code. The three result codes you must recognize are:

• Access granted — valid credential, correct time zone, door opened.
• Access denied — valid credential but outside permitted time zone, or unknown credential.
• Door held open — the door remained open beyond the configured held-open timer, which may indicate propping or a slow-closing door.

When you export a report, scan for denied events first — they often reveal misconfigured access levels or a card that was enrolled with a wrong facility code.

Safety Considerations

Access control work involves both data and physical hardware. Keep these points in mind:

• Electrified hardware: Doors with electric strikes or magnetic locks carry low-voltage DC power, but associated power supplies can present hazards at the input side. Confirm power is off and follow lockout/tagout procedures before wiring or rewiring door hardware.
• Fail-safe vs. fail-secure: Know which mode the door operates in before working on it. A fail-safe door unlocks on power loss; a fail-secure door stays locked. In an emergency-egress path, fail-secure locks must always allow free egress from inside regardless of credential status. Verify egress hardware is functional after any programming change.
• Data integrity: Never delete an active cardholder record without authorization. Accidental deletion can lock an authorized person out of a secured area. Use deactivation instead of deletion when in doubt.
• Privacy: Access logs contain personal movement data. Handle exported reports according to your employer's data privacy policy and applicable state law.

Connecting to Your Credentials

The ESA Certified Alarm Technician exam includes access control programming and troubleshooting. The ALOA Certified Registered Locksmith exam covers electronic access hardware and credential types. Mastering the database structure and the logic of time zones and access levels prepares you for both credential exams and for state licensing practical assessments.