9.2 Biometrics, Electrified Locks, Anti-Passback & Mantraps

Biometrics as a Door Factor, Not a Magic Identity

Biometric readers measure a body trait and compare it to an enrolled template. Fingerprint, face, iris, and hand geometry each have different spoof stories, hygiene issues, and throughput. For PSP design, three rates matter more than brand names.

False reject rate (FRR) is the share of genuine attempts the system refuses. High FRR produces queues, propped doors, and a receptionist who waves people through. False accept rate (FAR) is the share of impostor attempts the system accepts. High FAR is an unlocked door with an audit log that looks clean. Failure to enroll (FTE) is the share of people who cannot produce a usable template: worn ridges, injuries, some eye conditions, religious face coverings, or a sensor that only likes one lighting setup. FTE is not "the same as FRR." Those people still need a documented alternate factor.

Thresholds trade FAR against FRR. Tighten the match score and FAR usually falls while FRR rises. Loosen it and the opposite happens. There is no single "PSP number" for an acceptable FAR. Cash vaults, data halls, and a 400-person cafeteria turnstile do not share a threshold. Capture the operational question in the design narrative: are you stopping credential sharing, or are you trying to replace a card because cards were lost?

Presentation attacks (spoofing) use photos, video replay, lifted fingerprints, or silicone samples. Liveness detection and challenge-response (blink, turn) raise the cost of cheap spoofs; they do not make biometrics immune. High-assurance doors still combine biometrics with a card or PIN so a copied face or a lifted print is not enough.

Privacy is part of the control. Store templates, not souvenir face databases, and restrict who can export them. Several jurisdictions treat biometric identifiers as sensitive personal data (BIPA-style rules in the United States, GDPR-style rules in Europe, and employer-notice laws elsewhere). If the workforce has not consented where required, the reader can be a legal failure even when FAR is excellent. Template encryption, retention limits, and a deletion path at termination belong next to the wiring diagram.

In Practice: The Warehouse Time-Clock Face Reader

A site replaces badges with face readers at the man-door to stop buddy-punching. Outdoor sun and a dusty vestibule drive FRR up; supervisors prop the door. An adversary holds up a printed photo and, if liveness is off, FAR becomes a YouTube clip. A better pattern keeps the card (or mobile token) and adds the biometric as a second factor on the cash office, not as the only factor on the high-throughput door.

Electrified Locks: Strikes, Maglocks, Mortise, Delayed Egress

The lock is where access control meets the fire inspector.

Electric strikes replace or modify the keeper so a controller can release the latch without unlocking the trim on the inside. Many strikes are fail-secure: loss of power leaves the keeper locked, which suits storerooms and interior rooms that are not the required egress path in that direction. People can still leave if the mechanical lever retracts the latch from the inside. Strikes fail in the field when the door and frame are out of square, when the latch barely reaches the keeper, or when someone uses a maglock power supply on a strike that wants a different duty cycle.

Magnetic locks (maglocks) clamp an armature to an electromagnet. They are typically fail-safe: no power, no clamp. That is why they appear on glass doors and why they attract life-safety attention. There is no mechanical latch unless you add one. Bond sensors can report that the magnet is holding; they do not prove the door is not being levered. Maglocks on free-egress doors generally need a fire-alarm release, a REX that occupants can actually use, and often listed delayed-egress or access-controlled egress hardware rather than a homemade relay stack.

Electrified mortise (and electrified panic devices / electrified cylindrical locks) put the solenoid or motor in a real lock body. You can specify fail-secure for perimeter rooms that must stay locked on power loss, with mechanical egress from the inside. These are often the better exterior door than a maglock, provided the closer, strike, and frame can take the abuse.

Delayed egress hardware, in the NFPA 101 / IBC tradition, typically delays unlock for a listed interval (commonly 15 seconds, 30 seconds only where the AHJ allows), sounds an alarm, and unlocks immediately on fire alarm. Signage is not optional. Delayed egress is occupancy- and use-specific; it is not a universal "security upgrade" for every rear door. If a stem mentions behavioral health, maternity, or retail theft control, delayed egress may be in play—and so is the AHJ.

ADA, Accessible Egress, and Maglocks

Accessibility rules (ADA Standards in the United States, and parallel accessibility codes elsewhere) constrain operating force, reach ranges, closing speed, and the ability of a person using a wheelchair, crutches, or limited grip to operate the hardware. A motion REX aimed at standing chest height can miss a seated person; the maglock then holds a required egress door. Push-to-exit buttons must be obvious and reachable. Delayed-egress announcements must be usable. None of this is a "security versus ADA" choice. If the door is on an accessible egress route, the electronic hardware has to let people out without a secret knock.

Fire-alarm interfaces that drop maglocks must be tested. A controller programmed to ignore the fire panel, or a maglock on a separate power supply that does not release, is a failed commissioning item. Battery standby for security must not convert a fail-safe lock into an unintended fail-secure lock during a fire-alarm power transfer. Write the fail mode in the sequence of operations: normal, power loss, fire alarm, and request-to-exit.

Anti-Passback: Hard, Soft, and Timed

Anti-passback (APB) exists because a card shared through a fence or a tailgater who never badged will desynchronize "who is inside."

Hard anti-passback denies a second entry (or an out-of-sequence read) until a valid exit or a supervisor reset is recorded. It is strict and it strands people when a reader fails, when a vehicle tailgates through a gate, or when someone follows through a door without swiping. You need IN and OUT readers, a process for resets, and a plan for fire muster that does not depend on a jammed APB state.

Soft anti-passback logs the violation and still unlocks. It is an investigative control. Use it where denying entry would create a safety or production incident, but where you still want a report of credential sharing.

Timed anti-passback blocks reuse of a credential at the same reader (or area) for a programmed interval. It is useful at parking gates and turnstiles where a full area model is too heavy. It does not prove the person left; it only rate-limits the token.

Nested or area APB tracks zones (yard, building, vault). It collapses if any portal in the loop lacks a reader in the correct direction. Wireless locks that do not report immediately will desynchronize APB just as they desynchronize revocation.

Mantraps, Portals, and Interlocks

A mantrap (security portal, airlock-style vestibule) is two or more doors that are interlocked: door B will not unlock while door A is open, and often vice versa. Occupancy sensors, weight sensors, video, or biometric confirmation may be added so two people cannot share the vestibule. Control rooms, vaults, pharmacies, and data halls use portals to stop tailgating that a single card reader will never see.

Interlocks more generally include dock doors that must not open while a radiation door is open, or a fence gate that must not open while the man-door is unlatched. The logic lives in the controller or a listed interlock module. Document emergency release: fire alarm, power loss, and a clearly marked override that does not require a trapped person to call the SOC on a dead phone.

Portals collide with accessibility and life safety when both leaves lock, when the vestibule is too small for a wheelchair and an attendant, or when the override is a keyed cylinder on the wrong side. Specify clear floor space, automatic operators if needed, and a sequence of operations the fire inspector can watch.

Name families without copying tables: UL 294 still applies to the access control unit; lock and panic hardware listings (for example UL 10C fire-door testing, UL 305 panic hardware in North American practice) sit beside it. European electronic lock and access programs often point at EN 14846 or EN 60839-11 depending on the product. The exam item is whether fail mode, interlock, and egress still make sense together—not whether you can recite a clause number.