Elevator Access Control Examined

Doors are certainly the first thing that comes to mind when thinking about electronic access control. However, EAC can also be very valuable for controlling elevators. Keeping unauthorized riders out of elevator cars or off certain floors is a significant security benefit. In this note we examine this, breaking down the two main methods of control, how to integrate access control for each, plus how to deal with the key risk of tailgating.

Two Methods

Securing control of an elevator system has two options depending upon the desired level of control. Determining which method is best depends on which of the following two is more important:

• Unauthorized access to specific floors, or
• Unauthorized use of the elevator?

For example, if keeping people from 'nuisance calling' the elevator or to prohibit anyone except credentialed personnel from using the lift, controlling the call buttonsis often the best solution. However, if administrating access to specific floors is required, then the car must be equipped with a controller that interfaces access levels with the elevator's mechanical systems.

The two methods vary broadly in cost of equipment and integration; points we examine in the following sections:

Interrupt the Call Buttons: Of the two options, this level of integration is simpler and inexpensive, but only provides "all floors, or nothing" control. This involves wiring the power of the call button keypad to be switched on according to credential reads of an adjacent reader. In order to activate the call buttons to request a car, the controller closes relay contacts between the call button's power supply and keypad. Only a card granted access to the elevator is eligible to use the elevator, but once the elevator arrives, the user is able to key access to any floor the elevator normally has access to; potentially all floors in a building.

The biggest advantage afforded by this method is how inexpensive and quickly it can be installed. The process of integrating call button power to a controller often requires an external relay of some type, but otherwise it schematically installs and performs like access through any other opening, except with outputs routing power to buttons rather than door locks.

The second method is more challenging.

Controller Onboard: This method requires deeper integration, specialized equipment, and higher configuration costs, but results in a greater degree of control to specific floors rather than the car itself. Take this manufacturer's example schematic below:

With this type of integration, the position of the car relative to a floor is fed back into the controller, typically installed on the cab itself, or connected to the cab via the travelling 'control cable' networking the car to its mechanical control system. Users are configured access to specific floors; for example, a rider may be able to call an elevator from 'Floor 1' and only be able to ascend to 'Floor 3' based on access rights, bypassing 'Floor 2' altogether.

This method requires interfacing the access control system with the elevator control system, and may require coordination with the elevator company's service technicians.

Traveling Cable: Another complicating feature of onboard control is networking components like readers and controllers to the 'head end'. Mounting the controller onboard the car is not often required, but is done to mitigate the need of running expensive, maintenance hungry elevator cables to connect components. As we noted in our "Elevator Surveillance Tutorial", networking devices in a moving car is prone to a host of cabling issues complicated by the notorious difficulty in coordinating work with Elevator Service Technicans.

Tailgating Risk

Regardless of the method chosen, access control is endangered by 'tailgating', that is, an unauthorized person passing through a controlled opening before it is closed and relocked after a valid credential read. In the case of either elevator control options above, an unauthorized person can both enter a car before the doors close, or exit into a restricted floor when someone else leaves.

Elevator safety interlock controls [link no longer available] always incorporate some manner of keeping doors from automatically closing and potentially crushing or moving before occupants are completely onboard. One characteristic of these controls are the slow closing speed of the opening, a variable that cannot be addressed by the EAC system. Because of the life/safety risk, ensuring access control can only be achieved via limiting occupants in a car to a single passenger or expanding access controls to doors beyond the elevators.

Because of the tailgating risk, some end-users question the security value of access controlling elevators. Rather, the strongest benefit of controlling elevators comes in the form of restricting use, leading to increased car availability for VIPs and lowering the occurrence of vagrancy inside elevator cabs.