A properly specified controller keeps making decisions from its local cache; a server-dependent one stops the doors working.

Distributed architectures push the rules and the cardholder list down to the controller so it can decide alone. Central architectures keep the decision at the server. Only the first survives an outage.

Cache size is the practical limit. A controller holding fewer records than the site has people starts turning away legitimate staff at exactly the moment nobody can help them.

Event storage matters equally. Offline events must be buffered and uploaded when the link returns, or the audit trail has a hole covering the incident.

Some systems degrade to a permissive mode - accepting any credential of the right format - which is a decision that should be made deliberately rather than discovered during the outage.

Test it at commissioning: pull the network cable and try the doors. The answer on the datasheet and the answer in the building are not always the same.

Small enough that one failure is tolerable - and constrained in practice by cable distance from the panel to the doors.

Per-door cost falls as panel size rises, which is why quotations favour large panels. The saving is real but so is the concentration of risk.

Every door on a controller shares its power supply, its processor and its enclosure. A fault takes them all.

Put doors that must not fail together on different controllers: the main entrance and its alternative, the two ends of an escape route, the server room and the building entrance.

Cable distance limits the geography anyway. Reader and lock circuits have maximum runs, so a large panel serving a large building rarely works even when the port count allows.

Leave spare capacity. Retrofitting a door onto a full panel means a new panel, a new supply and a new enclosure for one door.

Enough to run the controller, every reader and every lock it drives, plus standby for the duration the site's risk assessment or local rule requires.

The calculation is additive and frequently underdone: controller quiescent current, reader current per door, lock holding current, and the inrush when several locks release together.

Maglocks draw continuously while holding. Electric strikes draw only when operated. A panel of maglocks and a panel of strikes have completely different standby requirements.

Standby duration is usually set by the local fire or security standard, or by the insurer. Size the battery for end-of-life capacity, not for the figure on a new one.

Batteries fail quietly. A scheduled replacement cycle and a supply that reports battery condition are both worth having, because the alternative is discovering it during the outage.

Where locks are fail-safe, remember that losing power unlocks them - the standby supply is a security requirement as well as an availability one.

Inside. A controller in an unsecured area can be opened, and opening it usually gives direct access to the lock wiring.

The controller drives the lock. Anyone with the lock output terminals in front of them can open the door without a credential at all.

That makes panel location a security decision rather than a convenience one. Put panels inside the area their doors protect - a plant room, a riser or a locked cupboard.

Tamper switches on the enclosure report opening, but only if the input is monitored and somebody responds.

Where a panel must sit in a semi-public area, use a locked enclosure with a monitored tamper, conceal the cable entries, and consider a lock controller mounted inside the door frame instead.

The same logic applies to the exit-side wiring: a request-to-exit device that can be reached and shorted from the insecure side defeats the door.

An edge controller serves one or two doors and mounts near them, usually on the network; a panel serves many doors from a central enclosure.

Edge devices reduce cabling dramatically because each one sits by its own door and connects to the nearest network point, often taking power from it.

That suits retrofits, distributed buildings and sites with good structured cabling, and it contains the failure domain to a single door.

Panels concentrate the hardware, which makes power, standby and maintenance simpler and keeps the electronics in one secure place.

The security consideration reverses: an edge controller sits near the door it protects, so its mounting position and tamper protection need more thought.

Network dependency also differs. Edge devices are network-attached by definition, so their offline behaviour and the resilience of the switch and its power supply become part of the door's reliability.

By treating them as the embedded devices they are: a separate network segment, changed default credentials, current firmware, and no exposure to the internet.

Access controllers are computers with a lock relay attached, and they have the security posture of embedded equipment rather than of a maintained server.

Put them on a dedicated segment or VLAN with tightly controlled routing. There is rarely any reason for a general user device to reach a controller at all.

Default passwords are the most common finding in any access control audit. Change them at commissioning and record where they are held.

Firmware needs a maintenance plan. Vulnerabilities in access hardware are published like any other, and a controller installed and forgotten is unpatched by definition.

Remote access for the integrator should be through a controlled path that the customer can switch off - not an open port and not a permanent tunnel nobody remembers authorising.

Every door, every cable, the power supply and battery dates, and the panel's own address on the system - because the next person to open it will not be the one who installed it.

Door numbers on the terminal blocks, matching the numbers used in the software and on the drawings, save hours on every future fault.

Cables should be identified at both ends. A reader cable found in a ceiling void with no marking is a cable that gets replaced rather than reused.

Record the battery installation date inside the door. It is the only reliable way anyone knows when it is due.

Note the controller's network address and its identity in the management software, so a panel found in a riser can be matched to its entry on the system.

Keep a copy of the as-built inside the enclosure. It survives staff changes and contractor changes better than any document management system.