A reader in the car identifies the passenger and the controller enables only the floor buttons that person is entitled to select.

Physically this is a relay per controlled floor, wired in series with the call button so that pressing it does nothing unless the relay is energised.

The reader is mounted in the car operating panel, which means the lift contractor is involved in the installation whether or not the access integrator wanted them to be.

A timer governs how long the buttons stay enabled after a valid read, and it needs setting so a passenger has time to choose without leaving the car open to the next person.

Floors that anyone may use - a lobby, a car park - are simply left unrestricted.

The audit trail records which floor was authorised, not necessarily which was selected, unless the lift provides that feedback.

The passenger declares their floor at a lobby terminal before boarding, and the system assigns a car - so access control integrates with the dispatch software rather than with call buttons.

There are no floor buttons in the car to control, which makes the relay-per-floor approach irrelevant.

Instead the credential is presented at the lobby terminal or turnstile, and the dispatch system offers only the floors that person may select.

It is faster for passengers and considerably tidier, and it rests wholly on the lift manufacturer providing an interface.

That interface is frequently a licensed, chargeable option, and the access platform must have a supported connector for it. Confirm both before designing around it.

Integrating turnstiles with dispatch so a single credential presentation both admits and assigns a car is the usual arrangement in high-rise lobbies.

Yes, always. When the lift enters fire service or emergency mode, floor restrictions are removed - and this is set by local code, not by the access design.

Emergency responders must be able to reach any floor. A lift that refused to stop somewhere because of an access rule would be dangerous and non-compliant.

The override is implemented by the lift controller, and the access system's relays are bypassed or ignored in that mode.

The requirement is defined in lift and fire codes that differ between jurisdictions, so the specific behaviour has to be confirmed locally.

It must be tested as part of the lift's own commissioning and periodic testing, with the access system live rather than isolated.

Any access control proposal that does not address this has not been reviewed by the lift contractor.

One per controlled floor per lift, which is what makes lift access control hardware-hungry in tall buildings.

A ten-storey building with four lifts and eight restricted floors needs thirty-two controlled outputs before anything else is counted.

Expansion boards or dedicated lift interface modules provide these in blocks, and they have to be housed and powered.

Where the count becomes unmanageable, a data interface to the lift controller replaces the relays entirely - the same principle as destination dispatch.

Count the floors that genuinely need restricting. Leaving public floors unrestricted reduces the hardware substantially.

Allow for the building's future. Adding a controlled floor later means another output and, if the board is full, another board.

Often, but the travelling cable is the constraint - a reader needs spare conductors, and older installations frequently have none.

The travelling cable carries every signal between the car and the machine room, and it is sized for the lift's own needs.

Spare cores may exist, may be occupied by something undocumented, or may not exist at all. This has to be established by the lift contractor before the work is programmed.

Replacing a travelling cable is a significant lift job with its own downtime, and it can dominate the cost of the whole access project.

Wireless car readers avoid the cable question and introduce their own: power in the car, radio reliability in a moving steel box, and the lift manufacturer's willingness to permit the installation.

Any modification to the car operating panel affects the lift's own certification, so it is the lift contractor's work regardless of who supplies the reader.

With a credential valid for that floor and expiring the same day, issued at reception and recorded against the host.

Hotels do this at scale: the room key authorises the guest floor and the leisure floors and nothing else, for the duration of the stay.

In offices, a visitor pass with a single floor and a same-day expiry is the equivalent.

Where a lobby turnstile is integrated with dispatch, the visitor's floor can be assigned at check-in and the car allocated automatically.

Escorted visitors are sometimes handled by giving the escort's credential a guest function rather than issuing anything at all.

Whatever the mechanism, the expiry must be automatic. An unreturned visitor credential that still selects a floor is exactly the failure lift access control exists to prevent.

The lift contractor, from the beginning - not after the access system has been specified.

Work inside the car, on the car operating panel and on the travelling cable is theirs, and it affects the lift's certification.

They also hold the answers that determine the design: whether an interface exists, whether spare cores exist, how fire service mode behaves, and what the manufacturer permits.

Interface licences and engineering time from the lift manufacturer have lead times measured in weeks or months and are frequently the critical path.

Access integrators who design lift control without that conversation routinely discover an unbudgeted lift project halfway through.

Agree the testing schedule too, since fire service override has to be proven with the access system connected and live.