Access Control System Components Explained
A commercial access control system is built from six core parts: a reader, a controller, a credential, an electric lock, a power supply with backup, and the software. The reader scans the credential, the controller decides who gets in, and the electric lock opens the door. Understanding what each part does, how they talk to each other, and how they fail lets you make smarter buying decisions and catch installation shortcuts before they cost you.
The reader
The reader is the device mounted on the wall beside the door. It scans the credential and sends an ID signal to the controller. What most people do not realize is that readers differ significantly in how they communicate that signal.
Card readers use radio frequency (RF) to read a card or fob. Older proximity readers operate at 125 kHz and send an unencrypted number that can be intercepted with a cheap device. Modern smart-card readers operate at 13.56 MHz (the HID iCLASS SE and SEOS formats, for example) and use encrypted communication, which is far harder to clone.
Keypad readers accept a PIN code. Some combine a card reader and keypad for two-factor authentication.
Biometric readers scan a fingerprint, hand geometry, or face. Higher-end units store the biometric template on the reader itself, so no fingerprint data is ever transmitted across the network.
Reader quality matters long-term. Cheap outdoor readers fail faster in coastal California humidity. Look for IP65 or IP66 weatherproofing and IK08 vandal resistance on any exterior installation.
The controller
The controller is the brain of the system. It stores access rules, time schedules, and a database of valid credentials. When the reader sends an ID, the controller checks it in under a second and tells the lock to open or stay shut. It also logs every transaction.
Controllers range from single-door units (controlling one entry) to enterprise panels managing hundreds of doors from one box. In a networked system, multiple controllers communicate back to a server or cloud platform.
Communication protocols between reader and controller:
- Wiegand — the old standard, a simple one-way unencrypted signal. Still common, but it cannot detect if someone installs a skimmer on the reader wire.
- OSDP (Open Supervised Device Protocol) — the modern standard, bidirectional and encrypted. The controller can tell if the reader cable has been tampered with. Widely supported by HID, Allegion, and Mercury Security panels.
- IP/PoE readers — the reader connects directly to the network and communicates over TCP/IP. Simpler wiring, but requires network infrastructure at each door.
When replacing an existing system, confirm whether your new readers are Wiegand or OSDP compatible with the existing controller before purchasing hardware.
The credential
What a person uses to enter: a keycard, fob, PIN, mobile phone, or fingerprint. See the full breakdown in access control credentials compared.
The credential format must match the reader. A 125 kHz proximity card will not work in a 13.56 MHz smart-card reader. This is one of the most common upgrade mistakes — buying new readers without confirming credential compatibility.
The electric lock
The lock holds the door shut and releases it on command from the controller. Two main types:
- Electric strike — replaces the strike plate in the door frame. The door retains its normal latch. Strikes can be fail-secure (stay locked on power loss) or fail-safe (open on power loss).
- Magnetic lock (maglock) — an electromagnet on the frame and a steel plate on the door. While powered, holding force runs from 600 lb to 1,500 lb depending on the model. Always fail-safe by nature.
Which type belongs on which door is covered in detail in electric strike vs magnetic lock.
Power supply and battery backup
Access control hardware runs on low-voltage DC power, typically 12V or 24V. The power supply converts AC from the wall to the correct DC voltage and amperage.
Why this matters: undersized power supplies are a leading cause of intermittent lock failures. A single magnetic lock can draw up to 500 mA. Add a reader, a REX sensor, and a door contact, and you need a supply sized for the total draw plus a 25% headroom buffer.
Battery backup keeps the system running through an outage. Depending on the design:
- Fail-safe locks (maglocks, fail-safe strikes) will unlock when power is cut unless the battery maintains them.
- Fail-secure strikes stay locked without power — the battery keeps the controller and reader running so people can still badge in, but the lock holds without power.
A properly sized backup battery should maintain door function for at least 4 hours. California high-rises and hospitals often require 8-hour backup per fire and building codes.
Request-to-exit (REX) sensor and door position contact
Two supporting components that get overlooked:
Request-to-exit (REX) sensor: lets people leave from the inside without presenting a credential. The sensor detects motion or body heat near the door and tells the controller to release the lock for a brief window. Types include passive infrared (PIR), microwave, and push-button. Choosing the wrong type causes false triggers — microwave REX sensors, for example, can pick up motion through glass and release the door when no one is there.
Door position contact (DPS): a magnetic sensor that tells the controller whether the door is fully closed, open, or being held open. Without it, the system cannot distinguish a normal exit from a door being propped open or forced. Most access control platforms use DPS signals to trigger alerts after a configurable held-open time (typically 30 seconds).
The software or dashboard
The software is where you manage everything: add and remove users, set time schedules, review the entry log, and configure alerts. Two deployment models:
- Cloud software runs in a browser or mobile app. No local server needed. Updates happen automatically.
- On-premise software runs on a server you own and manage inside your building. No subscription fee, full local control.
See the full comparison in cloud vs on-premise access control.
What does one door need?
| Component | Purpose | Notes |
|---|---|---|
| Reader | Scans the credential | Match to credential format |
| Controller | Stores rules, decides access | Size for total door count |
| Electric lock | Holds and releases the door | Fail-safe or fail-secure per door role |
| Power supply | Converts AC to DC | Size for full load plus 25% |
| Battery backup | Keeps doors working in outage | Minimum 4-hour capacity |
| REX sensor | Free exit from inside | PIR for most interiors |
| Door contact | Tracks door open/closed status | Required for held-open alerts |
How components fail and what to watch for
Most access control failures trace back to four causes:
1. Undersized power supply — lock becomes intermittent under load, especially when HVAC kicks in and draws power. 2. Wiegand cable run too long — Wiegand signal degrades over distance (typically 500 ft max). Use OSDP or add a signal booster. 3. REX sensor misconfigured — false triggers unlock the door when no one is present. 4. Battery never tested — backup battery dies unnoticed; first outage reveals a door that does not behave as expected.
A licensed installer sizes each component correctly from the start and documents the load calculations and battery test schedule.
Frequently Asked Questions
What is an access control controller? The brain of the system — it stores the access rules and decides whether to unlock each door when a credential is presented. One controller can manage one door or dozens.
What is a request-to-exit device? A sensor that lets people exit from inside without scanning a credential. It detects motion or body heat and tells the controller to briefly release the lock.
What hardware do I need for one access-controlled door? A reader, controller, electric lock, power supply with battery backup, and a REX sensor at minimum. A door position contact is strongly recommended.
What is the difference between a strike and a maglock? A strike replaces the strike plate and keeps the door’s latch; a maglock uses an electromagnet to hold the door. Strikes can be fail-secure; maglocks are always fail-safe.
What is OSDP and why does it matter? OSDP is a modern encrypted communication protocol between reader and controller. Unlike the older Wiegand standard, OSDP detects tampering and protects credential data in transit.
Want the right components sized and installed correctly the first time? Golden Locks designs and installs commercial access control across Orange County. Call (714) 841-0141 for a free site assessment.
By Omar, Licensed Locksmith and Access Control Specialist — CA Lic. #LCO4446 / #988707.