The Maglock Door That Failed the Fire Inspection

Why this matters

An employee at a small office pressed the green exit button beside the back door, and the door stayed locked. She left by the front. Two days later the fire inspector pressed the same button with the access controller unplugged, and the door stayed locked again, and the inspection report listed the door as a violation. A magnetic lock on an egress door is only legal because of the release paths around it, and this one had been wired so that every release path ran through a small computer that could freeze. Nobody was hurt. The order of work that followed, make the door free first and diagnose second, is the part that matters.

The door

A single-story office of about fourteen staff, with a front entrance and a back door to the parking lot. The back door was the second exit from the open-plan work area. It carried an electromagnetic lock (maglock) at the head of the frame, powered from a 12 V DC access power supply, controlled by a single-door access controller with a card reader outside. Inside, the egress side had a motion request-to-exit sensor above the door and a green push button on the wall beside it labeled for exit. The building had a fire alarm system, monitored, maintained by a separate fire alarm contractor.

A maglock is fail-safe by nature: it holds only while it has power, and it releases the moment power is removed. That is why it is allowed on an egress door at all, and also why every release path has to remove its power, not ask permission to. See related: Electronic Strike vs Maglock, Fail-Safe vs Fail-Secure Selection.

First: make the door free

The dealer heard about it the morning the inspection report arrived. The service tech went the same day, and before diagnosing anything he made the door safe to use as an exit.

Remove lock power at the source. At the access power supply he disconnected the maglock's output conductors from the supply's output terminals and capped them, and put a tag on the supply reading that the lock was disconnected for an egress fault and by whom. The maglock released, leaving the door held only by its mechanical latch.

Confirm the mechanical hardware allowed free egress. The door had a lever lockset, locked on the outside and free on the inside, which allows egress with one motion. He pushed the door from inside, lever down, with no key and no special knowledge: it opened. Outside, the lever was locked, so the office kept basic security without the maglock.

Tell the owner, in writing, and leave it that way until it was fixed. The office manager signed the ticket noting the lock was out of service and the door secured by its lockset only. The access controller would now show the door forced on every opening, so he disabled door-forced alarming for that door in the controller and noted that too.

Hazard during the work: the access power supply's own input was 120 V, hard-wired into a junction box. He worked only on the 12 V output side. Any change on the input side would have gone to an electrician where local rules require one.

Then: what failed

With the door safe, the diagnosis took about twenty minutes.

 AS FOUND
 12 V PSU (+) --> controller lock relay
                  (closed = lock powered)
              --> maglock (+)
 12 V PSU (-) ------------------> maglock (-)

 push button ----> controller REX input
 motion REX  ----> controller REX input
 fire alarm  ----> (nothing connected)

 CORRECTED
 12 V PSU (+) --> fire alarm release contact
                  (opens on alarm, by FA tech)
              --> push button NC contact
                  (opens when pressed,
                   timer holds open 30 s)
              --> motion REX relay contact
                  (closed when powered; opens
                   on motion or sensor power loss)
              --> controller lock relay
              --> maglock (+)
 12 V PSU (-) ------------------> maglock (-)

 push button 2nd contact -> controller REX
                  (shunts door-forced alarm)

Every release ran through the controller. The push button and the motion sensor both landed on the controller's request-to-exit input. When either one triggered, the controller's software saw the input and opened its lock relay, which cut power to the maglock. That works only while the controller is running. When the controller froze, as it had two days before the inspection, the relay stayed in whatever state it was in. It was holding the lock powered, and no input could change that.

Nothing connected to the fire alarm. The building had a fire alarm, and nothing in the lock circuit responded to it.

The inspector's test was the right test. Unplugging the controller simulates exactly the failure that happened: the button has to release the lock with the electronics out of the picture. As found, it could not.

What the release paths have to do

The rules for this kind of door belong to the building and fire codes as adopted by the jurisdiction, and the owner card covers them. See related: Electrically Locked Egress Doors and the Maglock Rules. The section this inspector cited was the International Building Code's provisions for sensor release of electrically locked egress doors, in Section 1010 (the subsection number moved between editions; check the edition your jurisdiction has adopted). In substance, it requires:

• a sensor on the egress side that unlocks the door when it detects someone approaching, and unlocks it on loss of power to the sensor;
• the lock to unlock on loss of power to the lock;
• a manual unlocking device on the egress side, labeled for exit, mounted within a height band and a distance from the door that the section states, whose operation interrupts power to the lock directly, independent of the other electronics, and keeps the door unlocked for at least 30 seconds;
• activation of the building fire alarm or sprinkler system, where one is installed, to unlock the door until the system is reset.

The as-found wiring met only the second outright. The first worked only while the controller was running, and the third and fourth failed.

The corrected circuit

The tech returned two days later with the parts and a fire alarm contractor booked for the same morning.

The push button breaks lock power directly. He replaced the single-contact button with a push-to-exit button that has two contacts and a built-in adjustable timer. Its normally closed contact went in series in the positive lock conductor, so pressing it opens the circuit to the maglock regardless of what the controller is doing. The timer holds that contact open for a set time after release; he set it to 32 seconds, a margin over the 30-second minimum so a timer drifting slightly short still passes. The button's second contact went to the controller's request-to-exit input, so the controller still knew the door was opened from inside and did not raise a forced-door alarm.

The motion sensor breaks lock power directly too. The code section requires the sensor to unlock the door on detection and on loss of its own power. Left on the controller's input, it could do neither while the controller was frozen, so he moved it into the series chain on the relay contact that is closed while the sensor is powered: motion opens it, and so does a dead sensor. Its second contact, where it has one, can still report to the controller for logging. This matches the shelf's install card and rules card, which put every release in the lock power path.

The fire alarm release breaks lock power too. The fire alarm contractor provided a relay contact from the fire alarm control unit that opens on any alarm and stays open until the fire alarm system is reset. The access tech wired that contact in series at the head of the positive lock conductor, upstream of everything else. Programming the fire alarm side, choosing which events operate the relay and testing it on the fire system were the fire alarm contractor's work: fire alarm systems follow NFPA 72 in the edition as adopted, and that work is often separately licensed. See related: Combination Fire and Burglary Panels and the License Line.

Lock power on, last. Only after every series contact was in place, and with staff told the back door would lock again, did he reconnect the maglock to the supply and remove his tag. The tests below came before the door was handed back; until the button had released it with the controller unplugged, the tag's warning still applied.

The finish test

Each path was tested on its own, with the condition the code cares about.

• Push button, controller running: door released, measured 0 V at the maglock terminals while the timer ran, relocked at 33 seconds by stopwatch (the controller's own unlock time ran slightly past the button's timer).
• Push button, controller unplugged: the inspector's test. Door released, 0 V at the maglock, relocked at 32 seconds. This is the test that failed before.
• Motion sensor, approaching from inside at a walk, controller running and then unplugged: released before the hand reached the door both times; with the sensor's own power disconnected, the door also released, and it relocked once the sensor was reconnected and the approach was clear.
• Loss of lock power: the access supply's 120 V input switched off at its circuit breaker by the office manager. Door released. Power restored, the supply's output came back, and the lock held again.
• Fire alarm release: the fire alarm contractor placed the fire alarm account on test with its central station, confirmed it, and activated a manual pull station. The door released and stayed released, past one minute, until the fire alarm system was reset, then held again. The contractor confirmed the alarm signal had been received at the station, then took the fire account off test and confirmed it was back in service.
• Card from outside: released normally.
• Free egress through the lever with the lock unpowered: confirmed, as on day one.

He re-enabled door-forced alarming in the controller, opened the door with a card and from inside with the button to confirm neither raised a forced alarm, and recorded every reading on the ticket with the times.

The re-inspection and what went on file

The owner requested a re-inspection. The inspector repeated the controller-unplugged test, pressed the button, timed the release and asked the fire alarm contractor to show the release on alarm. The door passed. The owner's file got the as-built wiring sketch, the timer setting, the fire alarm relay location and the contractor's test record, so the next technician to touch the door knows which contacts are life safety and which are convenience.

Why it had been wired that way

The original installer was not careless so much as convenience-minded. Landing the button on the controller is the standard wiring for a fail-secure electric strike on a door where egress is mechanical, and it gives a clean audit trail. Carried over to a maglock on an egress door it removes the one path that has to work when everything else has failed. See related: How to Install a Maglock with Request to Exit and Fire Release.

References

• International Building Code Section 1010 (the electrically locked egress provisions), as adopted; check the current edition
• NFPA 72, National Fire Alarm and Signaling Code, in the edition as adopted, for the fire alarm side of the release
• See related: Electrically Locked Egress Doors and the Maglock Rules
• See related: How to Install a Maglock with Request to Exit and Fire Release
• See related: Combination Fire and Burglary Panels and the License Line