An access control system for a firefighting-aware facility is selected on three hardware-level facts: locks must drop power on alarm, a listed fire relay must sit between the FACU and the lock power supply, and the surrounding site must keep NFPA 1 geometry intact for responding apparatus [S1][S3][S5].
For 2026 builds, the decision is no longer "which credential," but which integration path: hardwired fire relay, PoE-based IP door adapter, or software override through the access control unit, each with different wiring distances, fail-safe behavior, and cost bands that a process engineer must price before the bid [S3][S5].
Selection Criteria: Lock Type, Fail-Safe Mode, and Power Drop
Fail-safe operation is the first hard filter, because fire codes require that all controlled doors unlock automatically during an alarm, freeing both egress and fire department entry [S3][S5]. Electromagnetic locks (mag locks) and electric strikes configured "fail safe" drop power to release, while fail-secure variants stay locked on power loss and are not acceptable on an egress path [S3].
Common lock voltages in the cited integration diagrams are 12 VDC and 24 VDC, with the fire relay or IP adapter selectable for either, and with mag locks drawing higher current than strikes so the relay contact rating must be sized to total lock current, not a single-door value [S3]. For readers and electrified hardware on a single cable, the Altronix Entrada2DMK IP access control adapter maintains PoE to the IP reader while dropping lock power, illustrating the two-rail topology many 2026 retrofits now use [S3].
Access-controlled doors in fire service doctrine are either stand-alone units on a single leaf or networked systems of hardware, wiring, and software that interconnect many openings, and the networked case is where fire relay integration is most often missed and most expensive to retrofit [S5][S8].
Credential Architecture: Card, Keypad, Biometric, and Mobile
The four credential families in common 2026 specification are card reader systems, keypad entry, biometric authentication, and cloud-managed mobile credentials, each with a different tradeoff in audit granularity, reader cost, and fire-department override method [S6][S7].
Card reader systems remain the workhorse for credential management because permissions are centrally revocable and each transaction generates an audit log that fire drills and post-incident investigations can replay [S4][S6]. Keypads are lowest cost per opening but produce only a shared PIN audit, so they fit best on low-traffic mechanical rooms and gate entries rather than office perimeters [S7].
Biometric readers (fingerprint, facial) raise the bar against credential sharing but add privacy and hygiene review, and they generally need a secondary PIN or card path for the AHJ's fire department access box or Knox-style override, since first responders will not enroll biometrics on arrival [S4][S7]. Cloud-based and mobile credential systems push permission changes to controllers over IP, which shortens the window between a fired employee and lost access, but they also depend on the same network path that a fire alarm may be using to drop lock power, so local fire relay autonomy is still required [S4][S7].
A common point of confusion: a mobile or cloud system is not a substitute for a listed fire relay, because the relay must function even if the access control server, controller, and network are all dark, so the relay sits electrically in series with the lock power supply, not in software [S3][S5].
Fire Relay Integration: Hardware Paths and Cost Bands
A fire relay is a switch between the fire alarm control panel and the lock power supply whose only job is to drop lock power on alarm, and it is typically installed inside or adjacent to the Access Control Unit (ACU) [S5]. Three wiring paths are documented in current integrator practice, and the choice drives both labor and AHJ acceptance [S3].
Path 1, direct relay wiring, uses the FACU's ground-triggered relay to interrupt 12/24 VDC from a central power supply feeding mag locks or fail-safe strikes, and is the lowest component count but requires a home-run to each power supply [S3]. Path 2, IP/PoE adapter (Entrada2DMK class), lets the FACU drop lock power over a dedicated network run while keeping the IP reader alive, which suits retrofits where pulling new power is harder than pulling CAT cable [S3]. Path 3, power supply controller (e.g. Altronix AL125UL with UPS battery backup), consolidates relay logic and lock power in one UL-listed enclosure and is preferred on new construction where a single battery-backed panel can serve a full floor [S3].
Software override through the ACU is documented as a fourth, easier path for facilities that already have networked controllers, but the cited integrator guidance still requires that locks be wired fail-safe so they open on power loss, regardless of whether the software command arrives, because network and server failure during a fire is the normal case, not the edge case [S3][S5].
Cost discipline matters: the cited integrator reports fire relay installation quotes ranging from $1,500 to "thousands of dollars" per site, with the largest variance coming from whether the existing fire system already exposes a spare relay, so the practical move is to verify a spare fire relay during the building survey and to fold a new relay into the GC's fire alarm bid on new builds, not into the access control low-voltage bid [S5].
Site Geometry Under NFPA 1: What Firefighters Actually Need to Reach the Door
Even a perfectly integrated access control system fails the response if the apparatus cannot reach the door. NFPA 1, Fire Code, Chapter 18, requires fire apparatus access roads within 50 ft (15 m) of at least one exterior door and within 150 ft (46 m) of all exterior portions of the first story, extended to 450 ft (137 m) when the building is fully sprinklered [S1].
Road geometry is fixed: unobstructed width not less than 20 ft (6.1 m), vertical clearance not less than 13 ft 6 in. (4.1 m), and a turnaround required on any dead-end segment greater than 150 ft (46 m); these are the numbers an AHJ will measure, so they belong in the site civil drawings, not as comments on the security plan [S1]. Building address numbers must be visible from the street per NFPA 1 §10.11, which is the cheapest leg of identification and the most often missed on warehouse and industrial yards where the office sits 200 ft behind the gate [S1].
Fire hydrant envelopes are also part of the access story: a clear space of not less than 36 in. (914 mm) must be maintained all around any hydrant, with 60 in. (1524 mm) of clear frontage when the hydrant has a connection greater than the standard outlet, and the FACU (fire alarm control unit) needs a similar minimum 36 in. (915 mm) of clear access so the responding crew can read and operate it [S1].
Where the perimeter is fenced, the gate must be openable by the fire department via an approved device, typically a Knox box or an AHJ-listed access box, mounted at the front entrance or on/near the gate, and this box is also the practical place to store the access control override card if the AHJ accepts that model [S1][S8]. Forcible entry is the documented fallback when no override device is provided, which damages doors and frames and is a measurable cost that the spec should price, not absorb [S1][S8].
Comparison of the Main Integration Options
For an engineer choosing between the three hardware integration paths on a 2026 build, the decision is dominated by four criteria: fail-safe autonomy, retrofit disruption, AHJ familiarity, and installed cost band. [S4]
The selection rule of thumb: pick direct relay or power supply controller on new construction with civil work already open, pick the PoE adapter on occupied retrofits where pulling new power is the schedule killer, and require fail-safe lock wiring on every option including the software path [S3][S5].
Limitations, Failure Modes, and What to Verify Before Bid
Three failure modes dominate post-install punch lists. First, fail-secure locks specified by mistake on an egress door, which will not unlock on power loss and will fail the AHJ's first test [S3][S5]. Second, the FACU has no spare relay, so the access control low-voltage contractor cannot land a fire relay drop and the integrator's quote balloons into the thousands, a known surprise on tenant-improvement projects [S5]. Third, the access-controlled door is also part of the perimeter fence, so the fire department needs both an in-building Knox box and a gate-side override, and either can be omitted because the access control and the site security scopes were bid by different trades [S1][S8].
Before signing a fire-protection integrator, verify: a spare fire relay in the existing FACU or a budgeted new one in the GC bid; fail-safe (not fail-secure) hardware on every egress and delayed-egress opening; a 36 in. (915 mm) clear envelope around the FACU and around every yard hydrant; a 20 ft (6.1 m) clear, 13 ft 6 in. (4.1 m) high apparatus road within 50 ft (15 m) of an exterior door; and a Knox box or AHJ-listed access box at the principal entrance, with a documented policy for what the fire department gets (key, card, code) [S1][S3][S5].
For a 2026 warehouse or industrial build, the relevant related reading is Warehouse Access Control Selection: Credential, Zone, and Audit Map for 2026 Builds, which extends this credential and zoning logic to the indoor side, while site electrical and explosion-proof constraints for hazardous areas are covered in Explosion-Proof Electrical Selection for Construction Sites: Spec Map. The mechanical layout of the yard, including gates, hydrants, and the apparatus road envelope, is one of two integration points that decide whether the system passes first response, the other being the access control head-end itself.
Component reference pages worth checking: access scaffold, and haulage access vehicle.