Electronic locking isn’t one product, it’s a stack of decisions. Every door is a compromise among safety, convenience, code, power, and whatever cable you can actually snake through old walls without starting a fight with the building engineer. I’ve spent the better part of two decades wrestling maglocks that wouldn’t drop, strikes that hummed like a beehive, and card readers that went quiet every time the elevator motor kicked on. What follows is the playbook I wish I had at the start: how the wiring really works, how to size and protect power, where fail-safe and fail-secure belong, and how to keep the whole thing stable when you bolt it to a network full of unpredictable traffic.
How an electronic door actually works
Strip away the brand names and you’ll find the same core loop. A credential reader or request device signals a controller. The controller decides whether to grant access and drives a relay. That relay applies or removes voltage to an electronic lock. You add a few safety devices along the path, then keep everything powered and supervised so you know when the loop breaks. Tie it to your alarm panel or networked video, and security staff can see events and react faster.
A basic single-door topology has these elements: a reader on the unsecured side, sometimes a keypad or biometric sensor right next to it, a request-to-exit on the secure side, a door position switch in the frame, an electronic strike or maglock, and a control panel or door controller. The controller might live in a head-end closet or inside a small intelligent hub mounted near the door. Intercom and entry systems often ride alongside, handing off call signals and door release commands using a dry contact or a SIP-based instruction over the network. The whole assembly doesn’t care what your credential is, only whether an input should close a relay at the right moment.
When something misbehaves, trace the loop end to end. Does the reader have stable voltage at its terminals? Does the panel see the door position input change state? Does the relay actually flip? Does the lock receive the expected voltage and current, and does the lock’s internal coil draw look right? Force yourself to check with a meter instead of eyeballing. A five-dollar continuity tester has saved me more hours than any fancy software console.
Wiring schematics that survive the real world
Manufacturers publish pretty diagrams. They’re a starting point, but buildings aren’t lab benches. Conduits are crowded, and legacy copper likes to whisper your 12 volts into the intercom line next door. Draw your own job-specific schematic before you pull wire, and include every device, jumper, and jumper setting. One accurate drawing with terminal numbers beats a thousand guesses at 2 a.m.
For card reader wiring, the common language is Wiegand, still ubiquitous despite newer protocols. It uses two data lines, labeled D0 and D1, plus power and ground. Many readers also include LED and buzzer inputs. RS-485 readers for OSDP bring supervised, bidirectional comms over a differential pair, which is much friendlier for troubleshooting and tamper detection. If I get a say, I pick OSDP and home-run the pair to a controller that supports it. Fewer mystery failures.
Door position switches and request-to-exit devices are usually dry contacts. I favor normally closed for supervision so a cut cable looks like a fault, not a clean door. Run separate pairs for each input to avoid shared ground loops that make your controller log ghost openings. Elevator environments and older buildings with shared metallic raceways can inject transients, so a small TVS diode or an input module with built-in surge protection earns its keep.
Magnetic locks are heavy current loads compared to strikes. A 1200-pound mag rated at 600 mA at 12 VDC will draw more on inrush and can spike noise onto your low-voltage bus. Star your power distribution with home runs to a properly fused supply. Don’t daisy-chain a mag and a reader off the same unprotected feed. I’ve seen readers reboot every time the mag drops, which teaches staff to badge twice and jiggle the handle. That’s not behavior you want to normalize.
Security camera cabling often shares pathways with access control cabling in retrofits. If you must share, at least segregate power and data bundles and keep PoE runs for the IP-based surveillance setup away from high-draw lock power. Shielded CAT6 is your friend when long parallel runs are unavoidable. Ground shields at one end only, typically the head end, or you’ll create a hum loop that shows up as twitchy card reader wiring.
When integrating intercom and entry systems, treat them as peers rather than accessories. SIP intercoms want PoE and VLANs that look more like phones than cameras. If the intercom triggers the door, have it close a relay on the access controller, not directly power the lock. That way the controller still logs the event and can enforce schedules, and you don’t end up with two masters tugging on the same coil.
Power supplies, current math, and why batteries lie
Most flaky door systems come down to power that looked fine on paper and sagged under load. You need to account for worst-case simultaneous draw, line loss over distance, and the particular quirks of each device. Strikes often have lower holding current than inrush, so the first second after a relay flips is your stress point. Mags are simpler loads but can be unforgiving when voltage drops below spec.
I start with a real inventory. Count readers, controllers, strikes or mags, REX devices, and any auxiliary relays. Sum their current draw at the rated voltage, then add a safety factor. For small single-door panels and locks, I like 30 percent headroom. For cabinets feeding a dozen doors, 50 percent headroom keeps thermals sane in a closed telecom closet. If you plan to float-charge batteries in the same can, add the charger’s draw to your heat budget.
Cable length matters. A 200-foot run at 12 VDC on 22 AWG feeding a 500 mA strike will drop enough voltage to impair the lock on a hot day when resistance climbs. If you can’t shorten the run, bump to 18 AWG or move power local to the door with a smaller supply and bring only a control signal from the panel. Better yet, power at 24 VDC when the device allows and regulate down at the lock. Twice the voltage halves the current, and cable behaves better when it isn’t pushed.
Battery backup is not optional if your doors protect anything valuable. Size for the code-mandated duration, which is commonly four hours for access control, though AHJ preferences vary. Add what you know about your site. If the building loses power routinely, plan for eight hours. VRLA batteries advertise amp-hour figures measured at gentle discharge rates. Locks are not gentle. Use a derating factor. If the math says you need 12 Ah, pick 18 Ah and check the cabinet depth before you buy. I’ve seen people bend door hinges to cram in a second battery, which is funny until the day it shorts across the terminal block.
PoE access devices complicate the picture. A reader-controller combo might pull 7 to 12 W, which is fine for 802.3af. Add a heater for a cold-weather reader or a biometric door systems module with LEDs and a camera, and you might tip into 802.3at territory. Keep a spreadsheet of actual measured draws using an inline PoE meter. Switch data sheets promise a lot, but the POE budget is a real number in a real room with other gear breathing the same air.
Fail-safe vs fail-secure, and which one belongs on your door
This choice isn’t a taste preference. It determines what happens when the building goes dark or a wire gets cut. Fail-safe locks unlock when power is lost. Fail-secure locks remain locked without power and require mechanical means to open.
Fail-safe shines where life safety dominates. Stairwell re-entry, occupancy over a certain threshold, and doors that serve as part of an egress path typically want fail-safe locks, often magnetic. Tie them to the fire alarm so they drop on alarm and let people flow. The trade-off is obvious. Fail-safe creates a risk of unintended unlock during outages or sabotage. That means you need impact-resistant housings and some environmental awareness. On a public street door with a mag, I want a secondary barrier inside the vestibule so a pulled fire alarm doesn’t open the castle completely.
Fail-secure is the right choice when property protection matters more than convenience and when code allows. Electric strikes that hold the latch without power are the workhorse here. Pair them with levers that always permit egress from the inside. Test the mechanical path religiously. I’ve walked job sites where fail-secure strikes were installed on doors with stiff weatherstripping, and a small sag in the hinge meant the latch never fully seated. A power outage arrived and the door was effectively fail-ajar. That’s not security, that’s wishful thinking with a wire nut.
Some locks split the difference with dual coils or mechanical latch monitoring. Take advantage of that feedback. When a fail-secure strike doesn’t latch, you want a clear alarm event, not a shrug in the logs. Where budgets allow, I add a door prop timer that alerts security if a door is held open beyond a short window. Most unauthorized entries happen through a door that should have closed and didn’t.
Readers, credentials, and wiring choices that won’t haunt you
Legacy Wiegand works, but it’s blind to tampering and brittle over distance in noisy buildings. OSDP over RS-485 gives you encryption, device addressability, and supervision. It also simplifies access control cabling since one pair can serve multiple readers in a multi-drop topology up to a point. Do not pinch pennies on the cable. Use twisted, shielded 22/2 or 24/2 for OSDP, and adhere to the manufacturer’s max bus length. When in doubt, segment the bus and place small intelligent controllers closer to door clusters.
For biometric door systems, budget extra conductors and power. Fingerprint and facial readers often have built-in heaters or IR illumination. They draw more and are picky about voltage stability. They also need data backhaul. Some devices handle both reader signaling and network on the same head. If you run PoE to the reader, mind the bend radius and water ingress at the door frame. I like to drop a short service loop in the ceiling so I can replace a reader without repulling the trunk.
Multi-technology readers that handle 125 kHz prox and 13.56 MHz smart cards make migrations less painful. If you’re going to the trouble of rewiring, consider jumping directly to OSDP-capable readers and MIFARE DESFire EV2 or EV3 credentials, not just high-secure formatting of old prox. The cost difference per door is usually small compared to the labor.
Relays, REX, and the art of not annoying occupants
Request-to-exit devices come in three common flavors: passive infrared motion sensors, mechanical push bars with switches, and touchless or capacitive pads. PIRs are convenient, but they see what you didn’t expect. A warm air plume from a ceiling diffuser can trigger them. Aim carefully, shield as needed, and pair with a door position switch so the system knows that exit started and finished. If false triggers cause unlocks, people will start exploiting them.
Time the unlock period to human behavior, not spec sheets. A five-second strike release is usually enough for an office door with quick hardware. If the door has a closer set stiff or a heavy sweep, add a second or two. Watch traffic during a busy hour and tune it. Shorter is better for security, but only if people aren’t bumping the door with their hip to race the lock.
Use interposing relays when you mix logic voltages or when the lock’s back EMF might arc your controller contacts. Add a flyback diode across DC coils. For AC strikes, a snubber network helps. When a relay welds shut, you’ll be grateful if it’s a five-dollar cube in a socket rather than the relay inside a sealed controller.
Alarm integration wiring and event flow that makes sense
Alarm panels and access controllers should talk in both directions. The fire alarm usually has the highest priority. It sends a supervised signal that instructs the access system to drop power to fail-safe devices and unlock required egress. Don’t rely on software logic alone. Wire a physical relay from the fire panel that interrupts power. Most AHJs expect it.
For burglary or intrusion integration, feed door forced and door held events into zones on the alarm panel. In reverse, you can have the alarm arm status drive access behavior. When the panel says the site is armed, after-hours schedules lock down. When the alarm goes into entry delay, certain doors can unlock to avoid duress as people rush to disarm. Keep the coupling loose enough that a fault in one system doesn’t cripple the other. I prefer dry contacts with supervision over proprietary serial integrations unless the site demands advanced features.
Video ties it all together. In a networked security controls environment, the IP-based surveillance setup subscribes to door events and bookmarks footage. If a door forced alarm trips, the VMS pulls up that camera automatically for the operator. Keep your camera cabling clean and your switch ports labeled, and make sure your VMS machine clocks match the access control server. Nothing breaks an investigation faster than time drift between systems.
PoE access devices and when to trust the switch
There is a lot to like about door controllers that run on PoE. A single CAT6 to the door brings power, network, and sometimes a reader port and lock relay in one compact module. For small tenant buildouts, that saves hours. Treat the switch as a power supply, though, with all that implies. Budget per-port wattage and total chassis budget. If you have a 24-port switch with a 370 W budget and a dozen cameras already there, you don’t really have 15 W for every remaining port.
Cable distances and patch panel habits matter. A run that passes through two questionable punchdowns and a 20-foot patch in the ceiling can create marginal PoE link drops that look like software gremlins. Use certified runs. If the door is mission critical, consider a midspan injector on a UPS close to the closet. That way a switch reboot doesn’t momentarily drop the controller.
When a PoE reader-controller drives a lock directly, mind the output type. Many offer a relay but expect you to supply separate lock power. If they do source voltage on-board, check the current rating. A 300 mA rated output will not happily drive a 600 mA mag. In that case, a compact door-side power supply with battery is still the better choice.
Grounding, surge, and the quiet war against noise
A clean reference ground is the cheapest insurance you’ll buy. Tie metal frames, power cans, and controller grounds appropriately, and document where each bond lives. In older buildings with unpredictable utility grounds, use isolated power supplies for readers and maintain a single-point reference at the controller. If you see random reader reboots or corrupted OSDP chatter every time an elevator starts, install surge suppression on long runs and verify shield terminations. And if lightning is a concern, run exterior readers through listed surge protectors and leave a service loop so you can replace them after a strike without tearing the wall open.
I’ve solved hum bars in video and phantom door opens with nothing more than moving a CAT6 run six inches away from a high-voltage bundle. Distance is your friend. Crossing at right angles is your friend. Zip-tying low-voltage to a conduit that carries an air handler feed is not your friend.
Practical cabling choices across device types
- Access control cabling: For home runs to door controllers, 18/4 or 18/6 stranded for power and relays, plus a separate shielded 22/6 for readers keeps noise down and serviceability high. Label both ends, and leave 3 to 4 feet of slack in the ceiling. Card reader wiring: Shielded 22/6 for multi-LED and buzzer control, or 22/2 shielded for OSDP if LEDs and buzzers are controlled over the bus. Terminate shield at the panel end only. Security camera cabling: Solid copper CAT6, not CCA, with a minimum bend radius respected. For exterior runs, gel-filled or outdoor-rated jacket with proper drip loops and glands. Intercom and entry systems: Treat like a voice endpoint. Use shielded CAT where recommended. If the unit has a door release relay, wire it into the access controller rather than directly to the lock for audit trail consistency. Networked security controls backhaul: Keep controllers on a dedicated VLAN with QoS, NTP from a reliable source, and restricted routing. Document MAC addresses and port assignments so a switch swap doesn’t become a scavenger hunt.
Commissioning that doesn’t leave sharp edges
Power up in stages. Verify the supply with no loads. Add the controller, watch current draw. Add the reader, check data integrity. Finally add the lock. Log events during each step so you have a baseline. Train your ear. A humming strike means AC on a DC coil or an alignment problem. A mag that thuds instead of clicks might be misaligned, or the armature plate isn’t floating on its bushings.
Test fail modes deliberately. Kill main power and see what happens. Pull the fire alarm line. Pop a reader off its base and watch the controller’s response. If the system has PoE devices, reboot the switch. Better you find the edge case on day one than the facilities team at midnight in a thunderstorm.
Keep a small kit on-site for the first week: spare readers, a relay module, a couple of strikes, fuses, diodes, and pre-crimped pigtails. Nothing keeps a project moving like fixing a surprise in ten minutes instead of waiting three days for a shipment.
Common mistakes that cause the worst headaches
The single worst offender is mixing lock power with reader power on the same pair. The second is sizing a power supply to the sum of nominal currents without considering inrush or cable loss. A close third is assuming a device’s advertised protocol will work over any wire at any length. OSDP across a daisy-chained 26-gauge security cable that also carries REX will betray you eventually.
Another frequent misstep is forgetting the door hardware. You can design perfect wiring and still fail if the mechanical door closer is too aggressive or the latch strike alignment is off by a couple of millimeters. Coordinate with the locksmith early. Stand at the door with a square and a flashlight. If a door doesn’t close beautifully before you electrify it, all you’ve done is automate a bad hinge.
Finally, watch your naming and documentation habits. If panel input 7 is “REX East Hallway” in the software, but the cable label says “DH-2 DPS,” you’ve already planted a landmine for the next technician. Keep a live as-built drawing that matches the software config. If you change something, change it in ink and pixels the same day.
When to go IP at the edge and when to centralize
Door controllers have trended smaller and smarter. You can hang one above a ceiling tile and serve two to four doors off a PoE drop. For small suites or dispersed https://johnnyyint531.lucialpiazzale.com/low-voltage-cabling-solutions-that-support-high-density-networks doors across a campus, this keeps cable runs short and lets you expand organically. The trade-off is that every controller becomes a network node you must patch, monitor, and secure.
Centralized panels in a secure IDF, with home runs of reader and lock wiring, can be easier to protect and power. They centralize maintenance and battery backup. They also demand more copper and more planning in the riser. In buildings with strict fire partitions, pulling dozens of low-voltage runs across floors is often harder than placing micro-controllers near the doors and feeding them with existing network paths.
I tend to blend the two. Core doors at the main lobby and data center might home-run to a beefy panel on conditioned power with ample batteries. Tenant doors get compact controllers near their space, on a controlled VLAN, with PoE UPS coverage.
A note on codes, inspectors, and the judgment calls
No two jurisdictions read the same sentence the same way. One AHJ may require a push-to-exit bar and a door strike to release on fire alarm, while another insists on a mag with a physical exit button and a motion sensor. Some require a mechanical key override on every fail-secure door. Others focus on delayed egress timings down to the second. Bring the inspector into the conversation early. Show product sheets for your locks, present your wiring schematics, and agree on the life-safety tie-ins before you order hardware.
When you face a clash between best practice and the letter of a local requirement, document the compromise and build in an upgrade path. I’ve had to install a mag on a door that really begged for a strike because the frame wouldn’t take one without major carpentry. We added better door position monitoring, a sturdy exit device, and a clear service note to revisit when the frame was replaced a year later.
Putting it all together
Design the door like a small system with clear responsibilities. Reader talks to controller over a supervised protocol. Controller decides and logs. Lock does exactly what the controller tells it, powered by a supply that doesn’t blink. Safety devices override correctly and predictably. Alarm integration wiring adds context and a backstop. Cameras and intercoms enrich the operator’s picture without undermining the lock’s authority. Every wire is labeled, every relay is fused, and every failure mode has been rehearsed.
If you build to that standard, you’ll spend less time chasing gremlins and more time improving the experience for the people who live with these doors every day. That might mean a faster unlock on a busy stairwell, a shield moved to quiet a reader, or a smarter schedule that matches the building’s pulse. The details matter. They’re the difference between a door that merely buzzes open and a system that makes a whole property feel well run.