12.3 Access Control

19 NYCRR 196.8 gives access control 1.75 hours in Module 3 — more time than CCTV and more than false-alarm prevention. The written exam uses that time on one legal fork and a handful of hardware ideas. The legal fork is 195.2(b)(2) versus 195.2(c)(6). The hardware ideas are electromagnetic locks, request-to-exit, delayed egress, fail-safe versus fail-secure, and the difference between unlocking a door and releasing a fire-door holder. This Independent OpenExamPrep section teaches that fork first, because a perfect maglock install on the wrong side of 195.2 is still unlicensed work.

The license fork: 195.2(b)(2) versus 195.2(c)(6)

195.2(b)(2) requires a security and fire alarm installers license for the installation, maintenance, or servicing of electrical entry systems which detect and/or provide notification of intrusion, break-in, theft, movement, sound or fire regardless of the number of entry points.

Two phrases do the work. Detect and/or provide notification means the entry system is not only unlocking for a valid card. If a forced door, a held-open door, a request-to-exit shunt that is really an alarm point, a door contact, or a reader-offline event is used to detect or notify of intrusion, break-in, theft, movement, sound, or fire, you are on the licensed side. Regardless of the number of entry points kills the “it is only one door” defense when detection or notification is present. One door that reports a burglary alarm still needs the installer license.

195.2(c)(6) is the matching exemption: a license is not required for a single-door, card-access entry system that does not detect and/or provide notification of intrusion, break-in, theft, movement, sound, or fire.

Every word in (c)(6) is a test item. Single-door — not a floor, not a suite, not “each door has its own little controller.” Card-access — the exemption is written for that architecture. Does not detect and/or provide notification — if you add a door contact that reports intrusion, a forced-door alarm to a central station, or any of the listed conditions, the exemption is gone. A twelve-door office with no alarm reporting is not described by (c)(6). A one-door reader that also trips a burglary zone is described by (b)(2), not by (c)(6).

195.1(g) again puts access on the same network definition as video and alarm detection. Programming access codes, bypass features, and hours of operation is installation, maintenance, or servicing under 195.1(c)–(e). “I only programmed the reader” is not a safe story.

Maglocks, request-to-exit, and delayed egress

An electromagnetic lock (maglock) is a magnet in the frame and an armature on the door. Energized, it holds. De-energized, it releases. Maglocks are typically fail-safe: loss of lock power unlocks the door. That is why they are common on interior egress doors and delayed-egress openings where the code goal is that people can get out if power dies. They have no mechanical latch of their own, so egress depends on dropping power — by a request-to-exit device, a listed switch in the hardware, a fire-alarm relay, or a power failure.

A request-to-exit (REX) device tells the access system that someone is leaving legally. It may be a passive infrared detector over the door, a touch bar, or a switch in the listed hardware. REX shunts the door position switch so a valid exit does not look like a forced door, and it releases a maglock. A REX aimed at the corridor so that passersby constantly shunt the door is a false-alarm and security hole. A missing REX on a maglocked egress door is a life-safety hole. The exam cares that REX is part of the electrical entry system, not a motion detector you ignore because “this is access, not burglary.”

Delayed egress locking delays unlocking after an occupant applies force to the egress hardware. Under the New York Uniform Fire Prevention and Building Code (which adopts International Building Code delayed-egress rules), the delay is commonly not more than 15 seconds, or 30 seconds where the authority having jurisdiction approves. An audible signal at the door sounds during the delay. Signage in the usual form tells occupants to push until the alarm sounds and that the door can be opened in 15 seconds. Delayed egress must deactivate immediately — free egress, no timer — upon actuation of the automatic sprinkler system or automatic fire detection system, and upon loss of power to the lock. Occupancy limits and sprinkler or detection prerequisites apply; delayed egress is not a universal add-on for every storefront. Rearming the delay after it has dropped out is a manual action, not an automatic relock that traps people during an alarm.

Delayed egress is not the same function as fire-alarm door release. Remember the two verbs. Unlock means occupants can open an access-controlled door and leave. Release in the fire-alarm sense usually means electromagnetic door holders drop out so a listed closer shuts a fire door to restore a barrier. Hold-opens are fail-safe in the opposite operational direction: power holds the door open; alarm or power loss lets it close. Chapter 15 (emergency control functions) is where elevator recall, HVAC shutdown, door release, and suppression release are taught in full. Preview it here so you do not wire a maglock unlock and a door-holder release as if they were one relay with one purpose.

Fail-safe versus fail-secure

Fail-safe (fail unlocked) means removing power unlocks the lock. Maglocks are the textbook example. Use fail-safe where loss of power must not trap occupants or must drop a delayed-egress lock. Fail-secure (fail locked) means removing power leaves the lock locked against entry. Many electric strikes on entrance doors are fail-secure so a power failure does not leave the front door electrically unlocked from the outside. Occupants still leave through mechanical egress hardware — a lever or panic bar that mechanically retracts the latch — unless someone has illegally double-cylinder locked the means of egress. Fail-secure is not “safer” as a slogan. It is safer against unauthorized entry during a power loss and more dangerous if someone uses it to electrically lock people in without a mechanical way out.

In practice

A clinic wants a maglock on the waiting-room door, a card reader inbound, a REX outbound, a door contact, and a delayed-egress function on a rear corridor, all reporting forced door to a central station. That electrical entry system detects and notifies. 195.2(b)(2) requires the installer license regardless of door count. The single-door exemption does not apply. The maglock must drop on fire alarm and on power loss. The delayed-egress door must drop immediately on fire alarm, not after 15 seconds. The fire-door holders on the smoke-barrier doors are a door-release function for Chapter 15, not a second maglock. If the owner instead wants only one interior reader that unlocks a storeroom and never reports intrusion, break-in, theft, movement, sound, or fire, 195.2(c)(6) may take that single door out of the installer license — and only that fact pattern.