Access Control Door Won't Unlock? How to Troubleshoot Readers, Locks and Controllers

When a door will not open, the quickest route to the cause is to stop thinking of "the access control system" and treat it as a chain of five links: the credential, the reader, the controller, the power and relay that drive the lock, and the lock and door themselves. Each link has one job and a simple test.

This guide walks the chain from the easiest check to the hardest, so you know which link has failed before anyone starts replacing hardware. It applies to any brand. For a turnstile, speed gate or barrier, see access control gate not working.

Symptoms: what the door and reader are doing

Find the row that matches. The last column says where to look first.

Step 1: Read what the reader is telling you

The reader's response is the best clue you have, and it costs nothing to read.

• No light, no beep. The reader has no power, or its cable is broken. Measure the supply at the reader's terminals (12 V DC on most).
• Beep and green, or "verification successful" on a terminal. The credential was accepted and the decision has been made. The fault is downstream, so go to Step 2. On a standalone terminal that switches the lock itself, the terminal is the controller.
• Red, or "access denied". The system understood the credential and refused it. Go to Step 6.
• Beeps but never gives a verdict. The reader cannot reach its controller. Go to Step 5.
• Reads only sometimes. A metal plate, box or door frame behind the reader detunes it. A card of the wrong frequency (EM at 125 kHz versus Mifare at 13.56 MHz) will not read at all, and a damaged card reads unreliably. Try a known-good card, then try the reader on a plastic spacer.

Then do the click test. Present a valid credential while a second person stands at the controller. Many controllers click and light an LED when the relay operates.

• Click and LED, but the lock does not move: the controller made the decision. The fault is in the relay contacts, the wiring, the lock's power or the lock. Steps 2 to 4.
• No click: the controller never got, or never accepted, the request. Steps 5 and 6.

Use a second known-good credential, such as a fresh card enrolled as a super user, to separate a one-person problem from a whole-door problem.

Step 2: Measure power at the lock, under load

Set a multimeter to DC volts and measure across the lock's two wires while someone presents a valid credential, not at the power supply and not at rest.

A supply that reads a healthy 12 V with nothing connected can collapse under load, and what matters is the voltage that actually reaches the lock.

Know your lock. A fail-safe lock, most magnetic locks, needs power to stay locked and releases when power is cut. A fail-secure lock, most electric strikes, stays locked without power and needs power to release. The label gives the rated voltage, 12 V or 24 V DC, and the current. A single-door magnetic lock typically draws somewhere between 0.25 and 0.5 A, but read yours.

Rule of thumb: if the voltage at the lock drops more than about 10% below the supply's output when the lock switches, one of four things is wrong: the cable is too thin or too long, the supply is overloaded, a connection has high resistance, or the supply is failing.

Cable is a frequent culprit, and the numbers are worse than most people expect. For a 12 V lock drawing 0.5 A on a 50 m run:

These use the resistance of copper at 20 °C. Conduit in a sun-baked riser or roof void runs much hotter, and copper resistance rises with temperature, so real losses are higher.

Two consequences follow. First, thin alarm cable is fine for a reader and wrong for a lock. Second, a 24 V lock of the same power draws half the current, so it loses half the volts and about a quarter of the percentage on the same cable. That is why 24 V is the better choice for long runs.

Then check the supply itself:

• Capacity. Add up every lock, reader and controller on the supply and keep a healthy margin. A shared supply that dips each time a lock energises will reset the reader or controller, and the symptom is "the reader reboots every time the door unlocks". Give the lock its own supply.
• Load test. A supply can read correctly unloaded and fail with the load connected. Measure at the supply with everything attached.
• Joints. If the voltage collapses only at the instant the lock switches, wiggle every crimp and screw terminal. A single high-resistance joint gets hot and is a classic cause of intermittent faults.
• Backup. A battery or UPS on the lock supply stops power dips from opening or locking doors at random.

Step 3: Check the relay and the lock wiring

The controller's relay is normally a dry contact: a switch, not a source of power. The lock's power comes from its own supply and runs through the relay's terminals.

• COM, NO, NC. Wire a fail-safe lock (a magnetic lock) through COM and NC, so power is on at rest and cut when the relay operates. Wire a fail-secure lock (a strike) through COM and NO, so power arrives only when the relay operates. On the wrong contact the door does the opposite of what you want, or nothing.
• Relay rating. Check the relay's rated current and voltage on the datasheet. Some readers and terminals carry a small relay. A lock that draws more, or a long cable, can damage it. Drive an interposing relay instead.
• Suppression. A lock coil throws a voltage spike when its current is cut. Without a diode across a DC lock's terminals (cathode toward the positive side) or a varistor on an AC one, the spike arcs across the relay contacts, welds them or resets the controller. Fit the suppression that came with the lock, close to the lock. A relay that clicks but never passes current, or sticks on, may have been through this.
• Exit button. Confirm whether the button is normally open or normally closed and that the controller's input is set to match. Reversed, it either holds the door open or never triggers.
• Door contact. A reed sensor wired the wrong way round gives "door held open" or "door forced" alarms, and on systems that re-lock only when the door reads closed, the lock never re-arms.
• Fire-alarm link. If the lock supply runs through a fire-panel relay, check that relay's contacts. Do not jump them out to make a door work.

Step 4: Check the lock, the door and the frame

Take the controller out of the picture. Hold the door open first, disconnect the lock's wires, and power the lock directly from a supply of its rated voltage and polarity.

• The lock fails the bench test: replace it.
• The lock works on the bench: the fault is on the control side. Go back to Steps 2 and 3.

If the lock is fine but the door still will not open or hold, look at the mechanics:

• Magnetic locks. The armature plate must sit flat and square against the magnet. A sagging door, a bent plate or a gap weakens the hold, and a plate that clings after power is cut (residual magnetism) needs its spacer or mounting adjusted.
• Electric strikes. If the door is pushing on the latch (preload), the strike cannot release. Adjust the door closer, the latch or the keeper so the door sits free before the strike energises.
• Door sag and closers. A door that has dropped on its hinges misaligns every lock type. Check the closer's speed and latching action.
• Door loop. The cable that crosses the hinge to a lock or a reader on the door leaf frays after thousands of swings. An intermittent fault that changes when you move the door is a common sign of this.

Step 5: Check the reader link

The reader talks to the controller in one of two ways.

Wiegand

• Length. Wiegand is limited to about 150 m (500 ft) on 18 AWG cable, and to much less on thinner cable. Keep runs short and use shielded cable away from mains wiring.
• Format. A reader and controller set to different formats (26-bit, 34-bit, 37-bit) can talk perfectly and still show the card as unknown, so the reader beeps and the door stays shut. Match the format on both ends.
• D0 and D1. If cards read as the wrong number or not at all, try swapping the two data wires. It will not damage anything.
• No supervision. Wiegand is unencrypted and unsupervised, so a cut cable looks like a dead reader with no alarm.

RS-485 and OSDP

• Daisy chain, not a star. Run one cable from the controller to the first reader, on to the next, and so on. Stubs and star wiring cause reflections and dropouts.
• Termination. Put a 120 Ω resistor across the bus at each of its two physical ends, the controller and the last reader, and nowhere else. Missing termination on a long or noisy bus causes intermittent dropouts. A resistor at every reader loads the bus and weakens the signal, which gives the same symptom.
• Cable. Use twisted-pair, shielded cable, with the shield grounded at one end only. OSDP supports a bus of up to about 1,200 m (4,000 ft) on 24 AWG.
• Addresses. Each reader on a bus needs its own address. Many readers ship at the same default address, so two new readers on one bus collide and one or both drop out.
• Settings and polarity. Baud rate and protocol must match on both ends. A and B swapped gives silence, and vendors label the pair differently.
• Secure channel. An OSDP reader that has learnt one controller's key will not talk to another. A replacement or swapped reader needs the manufacturer's reset or install-mode procedure first.

The isolation test: take the suspect reader off the field cable and connect it to the controller with a short bench cable. If it works there, the problem is the run: cable, termination or noise. If it still fails, the reader or its settings are at fault.

Some designs keep the door decision away from the door. ZKTeco's inBIO controllers take FR1300 RS-485 readers, and Suprema's BioEntry R2 is an OSDP reader with no relay of its own. There the reader link carries the whole door decision, so a wiring fault takes the door down. Our card and RFID reader range lists what we supply.

Step 6: Rule out permissions, schedules and anti-passback

If the reader gives a red or "denied" verdict, or only some people are affected, the hardware is probably fine.

• Access group and door. The person must be in an access group that includes this door. New people can fail to arrive on the controller. Each platform has its own way to check: see the guides for Hikvision iVMS-4200, ZKTeco BioTime and Suprema BioStar.
• Validity and card status. A contractor's validity date may have passed, or the card may be disabled, blocklisted or reported lost.
• Schedules and holidays. A time window that has ended, or a holiday group that applies an "all day denied" template, locks everyone out for the day. In the UAE, check the Eid and Ramadan templates.
• The controller's clock. Controllers judge schedules by their own clock. If the clock or time zone is wrong (UTC instead of GST, which is UTC+4), an 08:00 to 18:00 window is applied four hours out and people are locked out in the afternoon.
• Anti-passback. Anti-passback rejects an "in" swipe when the system thinks the person is already inside, for example after they followed someone through a door. Reset the person's status, or use a timed setting that clears it.
• Door mode. Check that the door is not set to normally closed, lockdown or first-person-in, and that the fire-alarm and emergency inputs read inactive. An input wired the wrong way round can hold a whole door group released or locked.
• Offline controllers. Most modern controllers and terminals keep working from the last database they received. An offline one usually still opens for people already on it, but it does not know about changes.

Step 7: Rule out heat, damp, dust and power quality

If the fault follows the time of day or the weather, look at the site before the software.

• Heat. A power supply in a sunlit or unventilated enclosure derates and ages faster, and a fault that appears in the afternoon and clears overnight is the classic sign. Shade it, ventilate it and leave margin on its rating.
• Humidity and condensation. Car parks, coastal buildings and plant rooms suffer. Look for green or white corrosion on terminals, water in junction boxes and unsealed conduit ends. Use IP-rated glands, drip loops and sealed conduit. Outdoors, choose an IP-rated reader such as the IP65 Hikvision DS-K1T805BFWX or the IP66 ZKTeco G5.
• Dust and sand. They foul optical sensors and gum up strikes and bolts. Clean them and shield them from wind.
• Insects. Ants and other insects can nest in warm junction boxes and enclosures and short out terminals.
• Power quality. Voltage dips, for example when large air-conditioning loads start, can reset controllers. A UPS and surge protection on the controller and lock supplies are cheap compared with repeat call-outs.

Step 8: Know when to stop and what to send

Stop and call an engineer when the bench test is inconclusive, the relay or supply looks damaged, a whole group of doors is down, or the work moves to mains voltage. A few facts make a remote diagnosis quicker:

1. The models of the controller, reader and lock, and the door type.
2. Photos of the controller wiring and the lock terminals.
3. Your readings: the voltage at the lock idle and during a read, and the supply's output.
4. One door or many. Several doors failing together points to a shared cause.
5. When it started and what changed: a new lock, cable work, a power cut, a software or firmware update.