Access control systems

A design starts at the door, not the terminal. A 280 kgf magnetic lock holds the leaf only while current flows: lose power and the door is open. On an escape route that is mandatory fire-safety behaviour; on a server room or cash office it is a hole, closed with an electromechanical lock that stays shut unpowered, or a UPS on the lock circuit. That choice is made door by door and written into the design explicitly.

A complete access point is more than a reader and a lock. Without a closer the leaf never latches and the system dutifully reports a forced entry. Without a position sensor there is no telling "opened on a card" from "propped open all morning". And without an emergency release on the fire alarm signal, no inspector signs the building off.

• Lock chosen per door: magnetic (opens without power) or electromechanical latch (stays locked)
• Closer, leaf position sensor, exit button, sealed emergency release
• All escape-route points released on a fire alarm signal
• 12 V supply with battery: a 280 kgf lock draws roughly 0.4-0.5 A continuously — calculated, not guessed

The cheapest credential, the 125 kHz EM-Marin fob, is cloned at any market stall in minutes. Mifare Classic looks more serious, but its Crypto1 cipher has been publicly broken since 2008. If access control is meant to control anything, use Mifare DESFire EV2/EV3 or Mifare Plus in secure mode, with a diversified key per card.

The layer nobody mentions is the reader-to-controller link. Wiegand-26 sends the card number in clear text down four wires: prise the reader off the unsecured side of the door and you have it. OSDP v2 with Secure Channel encrypts that link and notices when a reader is removed, so on external points we specify it.

Biometrics beat cards on one thing: you cannot hand your face to a colleague. Face recognition resolves in under a second, whereas fingerprints fail routinely on industrial sites — oil, cement, cuts, dry winter skin — so there we fit face terminals and keep a card as the fallback.

Two lines are genuinely supported and stocked for spares in Tashkent. ZKTeco: fingerprint and face terminals on the ZKBio CVSecurity platform, where personnel, access, attendance and visitors share one web interface. Hikvision: MinMoe face terminals in the DS-K1T range, DS-K2600 controllers and HikCentral Access Control — which wins where Hikvision CCTV already exists, since the pass event and its video land in one system.

An entrance is sized by throughput, not looks. A tripod turnstile passes roughly 20-30 people a minute and costs least, but a pushchair will not fit through it. A speed gate gives 30-40 and a wide lane, at the price of lobby space and budget. Full-height turnstiles belong where nobody is watching: perimeters, yards, warehouses.

Two constraints wreck schedules when forgotten. PoE to 802.3af delivers about 12.95 W at the device: ample for a terminal, nowhere near enough for a lock, so lock power runs on its own pair. And climate: under a canopy on a south-facing facade a Tashkent summer runs far hotter than the shaded reading, so external readers need headroom on temperature and dust ingress.

The real difficulty sits between "the system logs passages" and "payroll closes the month on this data". A raw log is a stream of time, person, door. A timesheet needs rules: tolerated lateness, breaks, night and averaged shifts, business trips, the card left at home. Those rules come from you, not the vendor, and someone in HR must own the exceptions.

Without anti-passback the timesheet collapses on contact with reality: one card walks two people in, no exit is recorded, half the shift ends with an open session — so we enable it strictly from day one, not after the data goes wrong.

Export to 1C Payroll and HR, or 1C Accounting for Uzbekistan, is a connector, not a manual dump into Excel: scheduled exchange, its own service account, an error log, retries on failed batches.

A fingerprint and a face template are biometric personal data under the Uzbek law on personal data (ZRU-547). When localisation rules were relaxed in spring 2026, the obligation to keep data inside Uzbekistan was retained specifically for biometrics. So the access control server lives in Uzbekistan, on your premises or in a local data centre, not in a vendor cloud abroad.

From that follow the things cheaper to build in than to retrofit under inspection: written consent from staff, storing the mathematical template rather than the photograph, a defined retention period for logs, and a card or PIN alternative for anyone who declines. Have the legal side confirmed by your own counsel; our job is that the architecture does not contradict it.