What happens to your access control when the power goes

Fail-safe and fail-secure

Fail-safe means the lock unlocks when power is lost. That is what an escape route requires: whatever else goes wrong, people must be able to get out.

Fail-secure means it stays locked. That is what a store room, a server room or an external gate requires: an outage should not become an open door.

The names are confusingly similar and the consequences are opposite. Getting them the wrong way round produces either a building standing open during every interruption, or people trapped behind a door that will not release. Where keys have stopped scaling, access control systems are usually the answer.

It is a per-door decision, not a per-building one

A single setting applied across a premises is almost always wrong somewhere. The correct approach is to walk the doors and classify each one by what it is actually for.

Escape route, or not? Does anything of value sit behind it? Is it on the building's perimeter? Those three questions resolve most doors quickly, and the ones that do not resolve quickly are exactly the ones worth discussing properly.

Battery backup covers the gap, not the principle

Most controllers accept a battery that carries the system through a short interruption, which handles the majority of everyday cases.

But a battery is a delay, not an answer. It has a service life, it degrades quietly, and it eventually fails to hold. The fail mode is what governs behaviour once the battery is gone, which is why it still has to be right even in a building with backup. Keypad and app-controlled hardware is covered under digital and smart locks.

The mechanical override

Whatever the electronics are doing, people must be able to leave. That normally means a release on the inside that works regardless of power, credentials or system state.

It is also worth keeping a mechanical key path on doors where you can, so that a dead controller is an inconvenience rather than a crisis requiring an emergency callout.

Compliance is not ours to certify

Fire and occupational safety requirements apply to escape routes and vary by building and use. A locksmith can fit hardware appropriate to what a door is for and flag anything that looks wrong.

The formal compliance position for your specific premises should be confirmed with your fire officer or a building consultant. We would rather say that plainly than imply an approval that is not ours to give.

Test it before you need it

Kill the power deliberately, during working hours, with someone at each door, and see what actually happens. Buildings routinely discover the configuration is not what the documentation says.

Do it annually. Controllers get reconfigured, doors get added, and batteries age.

The question nobody asks until it is too late

Every electronic lock has an answer to one question, and most owners do not know what their answer is: when the power goes, does this door lock or does it open?

Fail-secure means the door stays locked without power. It protects whatever is inside and it requires a mechanical override so the people inside are not trapped. Fail-safe means the door releases, which protects people and leaves the premises open until the power returns. Where the real question is how many keys exist, that is a lock change rather than anything more.

Both are legitimate, and a single building often wants both — fail-safe on a fire escape route, fail-secure on a store room. What is not legitimate is nobody having decided, which is the situation in a surprising number of offices around Rivonia and Woodmead.

Batteries are not the whole answer

A battery back-up sounds like it settles the question and it does not, for two reasons.

The first is duration. A back-up sized for a short interruption behaves differently across a long outage, and the failure arrives at the end of it rather than at the start — which is precisely when nobody is watching for it. The second is that batteries age. A unit installed four years ago and never tested is a component nobody has verified since the day it went in.

So the honest arrangement is a back-up that is specified for the real outage length, tested on a schedule, and combined with a mechanical override that works when everything electronic has stopped. The override is the part that actually saves the day.

Where the override key must live

This sounds too obvious to write down, and it is the single most common mistake we find on electronic installations.

The mechanical override key must not be inside the door it opens. Not in the office, not in the reception drawer, not in the safe that also needs power. It lives with a person, or in a key safe on the outside of the building, and more than one person must know where it is.

Test it. An override that has never been tried is an assumption, and overrides seize like any other mechanism — particularly ones on outward-facing doors that spend their lives in Highveld dust and never get used.

What to specify on a new installation

Ask for the failure direction of each door in writing before anything is installed, and ask for it door by door rather than as a general statement about the system.

Ask what happens on restoration too. A system that comes back locked with no credentials loaded, or one that has lost the day's access log, is a system that has failed in a slower way. And ask how the door behaves in the seconds while power is switching, because a badly configured installation can cycle at exactly that moment.

Then ask who is responsible for testing it and how often. An access system that has never been through a planned test is a system whose behaviour is a matter of opinion, and that is worth knowing before the first real outage rather than during it. All of this belongs in the handover for any access control installation.

The low-tech half of the answer

Electronics are not the only thing on the door, and in this country it is worth keeping the mechanical half of the arrangement in good order for exactly this reason.

A door with a sound mechanical lock and a working key is a door that behaves the same at any hour, in any outage, forever. That is not an argument against access control — it is an argument for keeping the mechanical fallback maintained rather than letting it seize because nobody has used it in three years.

For most small premises the sensible arrangement is electronic access for daily convenience and control, and a mechanical lock underneath it that is checked and lubricated once a year like any other lock repair item.

Testing it before you need it

An access system that has never been through a deliberate test is a system whose behaviour is a matter of opinion, and opinions are unreliable at nine on a Wednesday evening in Johannesburg, Gauteng.

The test is short. Switch the supply off at a time you choose, with somebody inside and somebody outside, and watch what each door actually does. Then try the mechanical override on each one, because an override that has never been used is an assumption rather than a fallback.

Do it annually and after any change to the system. What it usually turns up is not a dramatic failure but a small one that would have been expensive in the dark: a battery that no longer holds, an override key nobody could find, or a door that behaves differently from the one next to it.

Writing it down for the people who come after you

The person who specified your access system will not be there forever, and most of what matters about it lives in their head rather than in a file.

So the handover document is the deliverable. Which way each door fails. Where every override key is kept. Who administers credentials and who deputises. What the battery back-up is rated for and when it was last replaced. Which doors are on the fire escape route and therefore must fail safe. If you are shut out while reading this, it is a house lockout and it is worth phoning rather than reading.

One page, kept with the lease and the alarm details rather than inside the office it describes. It costs an hour once and it is the difference between a system that survives a change of staff and one that quietly becomes a mystery — which is as true of access control in Rivonia as of any other infrastructure.

What households should do about it

Most of this is written for premises, but the same question applies to a house with an electric gate, an intercom or any electronic lock on a pedestrian gate.

The answers are simpler at home. Make sure the driveway gate's manual release is accessible and that somebody in the household knows how to use it in the dark. Make sure a pedestrian gate can be opened with a key rather than only by a keypad. And keep the mechanical locks maintained rather than letting them seize because nobody has used them in three years.

That last one is the common failure. A gate that has been electric for five years usually has a mechanical lock that has not been touched in five years, and it is the fallback everybody assumes will work — which is ordinary lock repair in Rivonia rather than an electronics problem.

The one-page handover

Everything on this page fits on a single sheet, and that sheet is what keeps a system working after the person who commissioned it has moved on.

Which way each door fails when power drops. Where every mechanical override key is kept, and it must not be inside the door it opens. Who administers credentials and who deputises. What the battery back-up is rated for and when it was last replaced. Which doors sit on a fire escape route and must therefore fail safe.

Kept with the lease rather than in the office it describes, and reviewed once a year with a deliberate power-off test. Without it, an access system becomes a mystery, and mysteries are expensive during an outage — as is any emergency locksmith call that starts with a door nobody can open.