Commercial Master Key System Setup

Purpose

A master key system is a paper design that happens to end in brass. Every decision that matters - which chambers progress, how far apart the depths sit, how much of the space stays unassigned - is made before a pinning kit is opened. A system pinned reactively, a master wafer dropped into whichever cylinder the property manager complained about this week, gets discovered by a tenant whose change key opens the suite next door.

That discovery is not recoverable by re-pinning one cylinder, because the tenant who found it now knows the system leaks, and the building's answer is usually to replace every cylinder in it. Designing on paper, verifying the interchange in writing, and leaving most of the bitting space unassigned is what buys three years of tenant churn without a redesign.

Scope

Design, pinning, installation and commissioning of a new conventional pin-tumbler master key system for a commercial building: one top master key over a small number of masters over change keys.

Excludes small-format interchangeable core (SFIC) systems, which carry a control key and a separate control shear line and pin to a different discipline; electrified openings (see the electronic access control SOP); blank custody, stamping policy and issuance on a restricted keyway (see the key blank and key control SOP, which owns key control as a subject); and expanding a system whose bitting list is lost. That last is not an expansion - without the list you cannot know which combinations are live, so it is a full system rekey, and quoting it as an add-on is how a shop gives away a redesign.

Roles and responsibilities

The first handoff is the one that fails. A designer who lets the schedule keep moving while the bench pins produces cylinders that no longer match the list, and the mismatch surfaces at commissioning, in front of the customer.

Procedure

Step 1: Get a signed door schedule before any design work. Number every opening and record for each its function group (suite, common, mechanical, exterior), who must pass it, the cylinder type and mounting, and the named person who signs for keys at that level. Acceptance: every opening carries exactly one group and one named signer, on a sheet the customer's signer has signed. Wrong looks like a group written as "the offices", which hides two suites sublet to a different tenant. Stop rule: no signed schedule, no design - a system designed off a verbal walkthrough gets re-cut, and the re-cut is on the shop.

Step 2: Pull the current bitting specification for the keyway you are actually using. You need the number of chambers, the depth range, the increment, and the maximum adjacent cut specification (MACS), which is the manufacturer's limit on how far two neighbouring cuts may differ before the key cannot be cut or will not enter. Schlage publishes the C keyway as six chambers, depths 0 through 9, .015 in increments, MACS 7; Kwikset publishes KW1 as five chambers, depths 1 through 7, .023 in increments, MACS 4. Acceptance: the spec sheet for your keyway in front of you with the MACS number on it. Wrong looks like progressing from memory of the last system. Stop rule: no current spec, no progression - MACS differs by platform, and a violated MACS is discovered at the key machine, after the cylinders are pinned.

Step 3: Design the bitting list on paper, using two-step progression. Choose the top master key bitting, then choose which chambers progress and leave the rest constant. Within each progressed chamber, change key depths sit at least two increments from the master's depth and from each other, and no change key may carry the master's depth at a progressed chamber. Two-step spacing is not tidiness: the master wafer that gets pinned into that chamber is exactly as tall as the depth difference, and a one-increment wafer is a disc thin enough to tip in the chamber and jam the plug at the worst moment. Acceptance: every generated change key passes MACS against its own neighbours, every master wafer is 2 increments or taller, and no change key repeats the master's depth in a progressed chamber. Wrong looks like a clean-looking list with one combination whose neighbouring cuts differ by more than MACS. Stop rule: a MACS violation is a redesign of the constant chambers, not a key you try anyway.

   left: change key only     right: change key + master

   spring                    spring
   driver pin                driver pin
   ==== shear line ====      ==== master shear ====
   key pin                   master wafer
                             ==== change shear ====
                             key pin

Step 4: Run the interchange check in writing before anything is pinned. Each master wafer adds a second shear point, so a cylinder with wafers in three chambers accepts 2 x 2 x 2 = 8 combinations: the change key, the master, and six unassigned ones. Those six are phantom keys, harmless only while none of them equals a change key assigned to another door. List them per group and compare against the assigned set. Acceptance: a written check showing zero collisions between any cylinder's phantom set and another group's change keys. Wrong looks like skipping it because the progression rule "should" prevent collisions, which holds right up until someone hand-adds a master later. Stop rule: a collision sends that change key back to redesign, never resolved by reassigning the door.

Step 5: Reserve most of the space. Count the change keys the design generates against the number the schedule assigns, assign no more than about half on day one, and record which blocks are held back. That is a shop rule rather than a manufacturer limit, and it is what lets a building split a suite in year two without touching an existing cylinder. Acceptance: assigned count at or under half the generated count, reserve blocks written on the list. Wrong looks like a system that assigned every combination because the customer asked for spares. Stop rule: if the schedule genuinely needs more than half the space the platform is too small - move to a keyway with more depths, or add a progressed chamber, before pinning.

Step 6: Pin on the bench, one group at a time, and test four ways per cylinder. Work with a plug follower so drivers and springs stay in their chambers, wear eye protection because a released spring launches a driver pin, and label each cylinder to its opening number as it leaves the bench. Test every cylinder with its change key, its master, the top master key, and a change key from another group that must NOT turn. Acceptance: three keys turn smoothly and the fourth does not turn at all, on every cylinder. Wrong looks like a cylinder that turns on the foreign key, which means a wafer went into the wrong chamber or is off by one increment. Stop rule: a foreign key that turns stops the group - dump the plug, re-pin against the list, and re-test the cylinders either side of it, because a mis-set kit tray usually damaged more than one.

Step 7: Stamp for the system, never for the door. Keys carry the system code and level (top master, master, change designation), never the suite number or the address, because a key stamped "Suite 210" is a found key with directions on it. Stamp the cylinder shell or tag with the same code so a future technician can match brass to list. Acceptance: every key and cylinder carries the list code and no key carries a door number. Wrong looks like a helpful marker pen on a tenant's key ring. Stop rule: a mis-stamped key is destroyed rather than re-issued, and the destruction is logged against its count.

Step 8: Commission with the signer, opening by opening. Walk the schedule in order, testing the change key, the assigned master, the top master key, and one negative with a neighbouring group's change key, and have the signer initial each line as it passes. Acceptance: a signed walk sheet carrying a positive and a negative result at every opening. Wrong looks like spot-checking a few doors and calling the rest good, which is how a mis-installed cylinder reaches a tenant. Stop rule: a failed opening stops issuance of that group's keys until it is re-pinned and re-walked; the rest of the building may go live.

The record this produces

The bitting list is the artifact: system code, top master key bitting, each master with its group, every change key with its bitting, its opening number and its holder, the master wafer heights per chamber, the phantom-set check, and the reserve blocks held back.

Alongside it: the signed door schedule, the walk sheet with the positive and negative result at each opening, the issuance count by level, and the stamp codes used. The office holds the master copy under controlled access; the truck carries a working extract and nothing more. Readers later: the technician doing the year-three expansion, the property manager reconstructing who held a key after a departure, and, if it goes badly, the shop's insurer.

Worked pass: fourteen openings on a six-chamber platform

Schedule: eight suites, two common doors, one mechanical room, three exterior doors. Exterior and common take the master; suites and mechanical take change keys, so eleven are needed.

Design: six chambers, depths 0 through 9, MACS 7. Chambers 2, 4 and 6 progress; 1, 3 and 5 stay constant at depths 3, 0 and 5. Two-step progression gives usable depths 0, 2, 4, 6 and 8 per progressed chamber. The master takes depth 4 at all three, leaving 0, 2, 6 and 8 for change keys: 4 x 4 x 4 = 64 generated. Wafer heights come out at 4, 2, 2 and 4 increments, all at or above the two-increment floor, and at .015 in per increment the thinnest is .030 in.

Step 3 fails. Checking MACS against the constants, chamber 2 sits between chamber 1 at depth 3 and chamber 3 at depth 0. A change key taking depth 8 at chamber 2 differs from its chamber 1 neighbour by 5, which passes, but from its chamber 3 neighbour by 8, which exceeds the MACS of 7. Depth 8 is therefore uncuttable at chamber 2 under these constants, and the generated set silently drops to 3 x 4 x 4 = 48.

Stop rule taken: redesign the constants rather than ship a list containing keys that cannot be cut. Moving chamber 3 from depth 0 to depth 2 fixes it. Depth 8 at chamber 2 is now 6 away from chamber 3 and 5 away from chamber 1; depth 0 at chamber 4 is 2 away from chamber 3 and 5 away from chamber 5; nothing in the set exceeds 7. The generated count returns to 64.

Step 4's check then passes by construction: no change key carries depth 4 at a progressed chamber, so no phantom mixing a cylinder's own depths with the master's lands on another assigned change key. It still gets written out, because that guarantee dies the day someone adds a master by hand.

Step 5: eleven change keys against 64 generated is about 17 percent of the space, well inside the half-the-space rule, with the unassigned blocks recorded. Step 6 pins in four groups; the mechanical room's first cylinder turns on a suite key, and is dumped and re-pinned before the group is released. Step 8 walks all fourteen openings with the property manager initialling each line.

References

• Manufacturer bitting specification for the keyway in use (chamber count, depth range, increment, MACS), which governs over any figure here; the Schlage C and Kwikset KW1 values above are the published specs and should be confirmed against the current sheet
• ALOA Security Professionals Association master keying instruction and terminology, which is where change key, master, top master key, cross-keying and phantom key are defined consistently for the trade
• See related: Key Blank and Key Control Inventory SOP (owns blank custody, stamping policy and issuance), Rekey and Lock Change SOP, Electronic Access Control Commercial Install SOP