Breaking Into A Facility Using Canned Air Tested

By Brian Rhodes, Published Jan 28, 2020, 11:57am EST (Research)

****** ******* ** ******** ** **** doors **** ******, *** *$* *** ** ********** ****** ****** **.

**** ** ******* ********, ********* *** unlock ****** ***** *** **** ******* without ******** *** ******.

******, ** **** *** ******* *** examine:

  • *** ******* *** ****** ***** *** Be ******** ** ****** ***
  • *** ****** *** *** *** *** Problem's **** *****
  • *** *** *** **** ** **** Than ********
  • *** ***** *** *** ****** ** Properly ******
  • *** **** *** **** **************** *** Door ****
  • *********** ****** **** *****-**** ****** ************

Tricking *******-**-**** (***) ****** *******

******** **** ******* ******* ****** ***** tricks *** **** ****** ****** **** unlocking. ******* ****** **** **** *********** for *****, **** *********** **** **** *******.

** ***** ********, *** ******** ***** a ******, ****** ****** *** ** compressed *** (***** ****** '******') ***** nozzle ******* *****, *** *** **** of **** ******* ***** *** ****'********-**-**** ***:

*** ******* ****** ******* ******** ** a ****** **** ** *** ** open ****** ** **** *******, *** in **** *****, *** ******** ***** be **** ** **** ********* ** normal **** ******* *** **** *** frame.

IPVM **** *****

** **** *** ******* ***** ******* a ****** *** ********* ** ****** by ***** * ***** ***** ** cold ********** ***.:

Risky **** ******

*** *** ****** ****** **** ** our **** *** ***** ** *********** as * ******** **** ***** ********** *******-**-**** (***) ************* **********, *** ***** ******.

*** ***** ******** ** **** ****** is ******** ******** ****** ******* **** ***** ************* ****** ** building ********* ******** **** ** ****.

*** ********** **** *** *** **** is *********** *** **** ** **** for ****** ********* ****** *********, *** often *** ****** ** ********* *********** above ** ******* *** ***** ******** with * ***** ********* **** *********** to *** **** *********** * ****:

****** **** *** *** ****** ***** above, *** *** *** ******* **** leaves ** ********** ****** ** ***** an ******* ***** ******* *** ******** product ******.

Not **** *** ********

*********, ***** **** *** **** **** maglocked *****, *** **** *** *** limited ** **** ******** *** *** otherwise ** **** ** ******* '****** door' ****** **** *** ***** ******* by ******* ** ***** ***** ** access ******* *****.

Problem *********

***** ****** ******* ** ********** ******* the ******* ***:

  • **** *** *******
  • ***** **** ****************
  • ****-**** ****

** ******* **** ** ****** *****.

Mask *** *******

**** *** **** ******* ******* *** or ******* *** *********** ******** ***** as **** ** *** *******.

*** *******, *** ******** ******, *** ******** ************ ***** '****** probability ** ************ **** ******* ******* (like ******* ******) ** ******* *** the ****** *****', ************ ******* ** mask *** ********* ****(*) ******* *** potential *** ** ***** **** ** exploit ***** ** ****** *******:

*** ******** ** ******* ******* ** the ********* **** ** ******* *** smaller *** ******* ******** *** ******* from ***** ********* ****** ** ***** into ***** ****** *****.

*******, ****-****** ****** ********* ***** *** inexpensive, ***** **** **** ******** ****** lens ******** ** ********** ******, *** can **** ***** *** ******** **** more *********.

*******, ***** *** ***** ***** ****** installers *** **** ***:

Tight **** ****************

****** ******** *** *** **** **** door **************** ***** ** ********* ** poke *** ******** * ********** *** can's **** ****** **** *** *******.

** ******, **** ***** *** **** sweeps **** ** ********* ** **** substances **** ******** ** *******, ********* being ************* *** ****/****.

** *******, **************** ***** *** ****** down **** ****, ** ******** ********** and *********** ****** ** ***** ** a **** *********** ********. ** *******, the ***** *** ******* ****** ** made ** ******* ****** ** ************ ** ************ **** **** ********* ****.

*** **** ** *********** ************ *** sweeps *** ***** **** ~$** - $150 ********* ** **** ******, *** often *** **** ** ****** *** energy ******* ** ******** *** ************.

Dual-Tech ****

**** *** ****** ******* **** *** a ****** ****** **** (***) ** detect ******, *** *** *********** ** being *********** *** ******** ***** ** a **** **** ****** *** ****** use.

*******, **** ****** **** *** ******* sensor **** (*.*. ********* ** *** light) **** **** **** ** ********* in ***** ** ****** *** ****.

****** ******* ****** ********** ******** *** weakness ** *** **** ***** *********, but ******* ** * ****** **** sensor.

*** *******, *** ********** ****** *** Bosch ****** *** * ****** ***** of ~$**, ***** * **** **** GES **** ~$**:

Are *** ********* ***** **** ***** ***** **********?

****:

Comments (53)

Always love your articles, Brian. While the vulnerability exists, design practice should prevent this. Ideally. In a perfect world...

My question is: with GE / Interlogix out of the mix, who actually manufactures a dual-tech request to exit now?

Agree: 8
Disagree
Informative: 2
Unhelpful
Funny

My question is: with GE / Interlogix out of the mix, who actually manufactures a dual-tech request to exit now?

This is an interesting question. There are microwave RTE sensors, but I'll dig and put together a list of others who offers dual-tech REX.

Agree
Disagree
Informative: 3
Unhelpful
Funny

In Canada one of the popular ones is Kantech's T-Rex

https://kantech.com/Products/exit_trex.aspx

We use this one and we see it everywhere in Toronto. Similar to DS-150 except connections are made to terminals.. not harness like the Ds-150 (not sure if this is still the design but it was for years))

Agree
Disagree
Informative: 1
Unhelpful
Funny

Unfortunately, Kantech's units are single-tech. They're not bad units, but like the DS150, they only use infrared with additional signal processing to help reduce inadvertent contact closures.

Dual-tech, such as the Interlogix RCR-REX, use both radar and infrared simultaneously to help avoid false positives. It still can be spoofed from outside the door with some red-team tricks, but it's not quite as easy.

Agree
Disagree
Informative: 1
Unhelpful
Funny

Bosch actually makes one with terminals (ds-160) and one without (ds-150). I hate the ones with the wire whips but sales guys love to save 8 dollars of material i guess.

Agree
Disagree
Informative: 1
Unhelpful
Funny: 2

Any joy on finding other dual-tech RTEs? I did some searching myself, and my Google-Fu is master level. Nonesuch to be found. Best I could find was laser or active IR. Neither is optimal for maglocks, nor our typical installation. We have given some thought to masking a typical security dual-tech motion, but they just don't have the inputs nor outputs that a RTE motion has...

Agree: 1
Disagree
Informative: 1
Unhelpful
Funny

None yet, although the response from many PIR sensor suppliers is slow/strained given the disruption in China per the virus pandemic, so it may take longer than normal to get firm answers.

Bosch commented they offer nothing now, but that can change:

A dual REX is not currently on our roadmap, but we are looking into the possibility for a future development.

Agree
Disagree
Informative
Unhelpful
Funny

I've mentioned stuff like this to my colleagues multiple times. Their take on it was, "Yeah, but most people aren't as smart as you." Their idea is that we're trying to protect against the "dumb" criminals: the drug addicts, the mentally unstable, the teenagers. For the criminals like these, a glass window is all they need to get in, so why bother worrying about the REX sensors. The smart people should be a) rarer, and b) smart enough to get in another way, anyway. So just make sure you have CCTV footage to hand to the police afterwards.

I'm not sure if I agree with the argument, but it's hard to refute, at least for smaller customers (obviously federal jobs and defense contractors draw a different sort of criminal). But some part of me is going, yeah, they may be small, but a vulnerability is a vulnerability....

You may be interested in this video by Deviant Ollam. This covers ways to hack REX sensors, door fitments, crash bars, thumb turns, and much more. Be warned it's 45 minutes long.

Agree
Disagree: 1
Informative: 11
Unhelpful
Funny

Thanks for sharing that! Deviant Ollam really does a good job of emphasizing the importance of dead latches in that video.

The 'thumb turn flipper' is rad.

IPVM covers a number of points/vulnerabilities he discusses, including:

His presentation reminds me there are many more topics/weaknesses we could do posts on!

Agree
Disagree
Informative: 3
Unhelpful
Funny

Not sure if the code is the same in the US as in Canada, but a RTE motion at a fire rated egress door would not be approved by code unless the door is equipped with a mechanical means of positive latching. (A panic bar exit device) in which case a RtE switch inside the panic bar would be employed to activate and release the maglock when pushing the bar

There are virtually every conceivable type of mechanical panic exit devices available , even decorative types for glass entry doors which would provide a much safer means to secure doors with both electronic maglocks and mechanical latches.

Agree
Disagree
Informative
Unhelpful
Funny

I see you attended one of DO's classes. Scary, isn't it. He points out it's the temperature gradient, so the cool hacker teams have a tall smoker take a long hit on a (tobacco) vape and exhale through the gap in the doors. I would hope these next-gen sensors you all are talking about can handle that.

Agree
Disagree
Informative: 1
Unhelpful
Funny

Watching his videos have added a new aspect when I order locks, as anything i order i now put on a bench for a few hours and find any ways to manipulate them and create tools/defense against them. With saying that, I hate the thought of using any Adam's rite lock, aside from just the commercially available tools out there, I've developed a handful of tools for each of their lock, including the 4500 and 4900 series, I cant belive how poorly they designed to not withstand covert entry (simple tools that can be made in the field without machining equipment in less than a few minutes)

It was quite eye opening for our company on how easy this can all be done.

Agree
Disagree
Informative: 2
Unhelpful
Funny

The only time this should ever be an issue is for mag locks. One more reason to avoid using them.

For anything other than mag locks, (or odd-ball stuff like this), I try to always use a lockset or exit device that provides a mechanical means of free egress. I also try to get the lockset or exit device specified with an integrated REX switch, so that a PIR REX is not needed. If that is not possible and I have to use a PIR REX, I specify that the REX should only signal an exit to the Access Control System (vs a "door forced" condition). The PIR REX should never unlock the door.

(Not meant to imply that lever locksets and exit devices don't have their own, different vulnerabilities.)

Agree: 12
Disagree
Informative: 2
Unhelpful
Funny

Several codes exist which require a maglock to fail-safe upon power failure to a component to the access control system. In the case of maglock, power should be wired through the REX relay to break the circuit if the REX was to lose power. (normally open, non energized state).

I see various interpretations of this in local building codes of large municipalities. It's often wordly badly and appears to be based on IBC, but I believe the intent to be the same.

*and yes, you seem to be implying the the REX signal only with non-maglock but wasn't clear.

Agree
Disagree
Informative
Unhelpful
Funny

I wasn't worried until I saw this article! I never knew this was on option but it actually seems painfully obvious.

This is now my favorite article of all time.

Agree: 3
Disagree
Informative: 4
Unhelpful
Funny: 2

"This is now my favorite article of all time."

i second that motion.

I am a road guy - which means I do not work out of my companies home office.

However, I have to show up at HQ (sometimes late at night) to set up equipment for the next days presentation.

While I now possess the appropriate credential to get in to HQ, this was not always the case.

Although I never thought to purchase a $5 can of air, I was (and still am) able to use the separation between glass doors at the main entrance to make a paper airplane and push it 7/8ths of the way through the gap, then shove it to get some lift to the paper airplane and get it to trigger the PIR motion sensor and unlock the door at 11:52pm on any given night that I need to get in.

If you can't think like a criminal, how can you expect to prevent criminals from victimizing you and your customers?

Agree: 5
Disagree
Informative: 3
Unhelpful
Funny: 7

You can also apparently vape your way past an RTE equipped door. Unless you're using JUUL, that is...

Agree
Disagree
Informative: 3
Unhelpful
Funny: 2

If you can't think like a criminal, how can you expect to prevent criminals from victimizing you and your customers?

Agree
Disagree
Informative
Unhelpful
Funny: 3

the funniest thing about this whole ad series is the extra B in Robbert.

Agree
Disagree
Informative
Unhelpful
Funny: 1

On doors with electric strikes, we will program the rex to log the exit event but not to fire the strike. You need to turn the handle to exit but it is much more secure.

Agree: 2
Disagree
Informative: 1
Unhelpful
Funny

exactly right. or a push button or some such thing to exit.

maybe OG Brian can weigh in on rules for egress and having to press a button or turn a handle....

when you use two things - like PIR detection and handle turn - granting access (or egress by practice) becomes reliant on a 'conditional event' vs a normal event... which is exponentially more powerful in practical security applications - and can be used to overcome weaknesses in single-sensor generation of events..

i.e. with conditional events set up, you can use different boolians depending on what your application calls for - like, 'this AND that' - or 'this and NOT that' etc as the engine to fire any event.... which gives you much more granularity when configuring events on any system.

Agree
Disagree
Informative
Unhelpful
Funny

maybe OG Brian can weigh in on rules for egress and having to press a button or turn a handle....

The 'rules' vary according to which type of Building Occupancy Code and type of opening it is, but I think to your point IBC generally says:

Door operations (2018, 2015: 1010.1.9; 2012, 2009:
1008.1.9; 2006, 2003: 1008.1.8)

  • Unless otherwise allowed within this section, egress doors must always be openable from the egress side without using a key, special knowledge or effort
  • Operating devices on doors required to be accessible shall not require tight grasping, tight pinching or twisting of the wrist to operate
  • Door handles, pulls, latches, locks and other operating devices shall be installed 34 inches (864 mm) minimum and 48 inches (1219 mm) maximum above the floor
    (From Lori Greene's handbook, our emphasis)

Other superceding codes (like ADA for example) may further clarify the rules in specific occupancies.

Agree: 1
Disagree
Informative
Unhelpful
Funny

twisting of the wrist

so you can turn a handle as long as you don't have to twist your wrist in doing so.

zoinks.

Agree
Disagree
Informative
Unhelpful: 1
Funny: 1

This is why AHJs are some of the most resented people on a jobsite. They are responsible for clarifying and to what degree an install is code compliant.

The whole no 'twisting of the wrist to operate' is generally understood to be Exit Devices, where you just sort of can lean on or run into the hardware to retract the latch.

Agree
Disagree: 1
Informative: 2
Unhelpful
Funny

Hi Brian,

While that may be one interpretation, levers do not require twisting the wrist. Just a downward push. Easiest way that I often explain this to people is to ask them to open a door with their elbow - no hand or wrist usage allowed. After they've done that once or twice, this whole conversations goes much more easily.

Agree
Disagree
Informative
Unhelpful
Funny

I was aware of this vulnerability and always specify dual-tech REX sensors. It is a fairly easy fix since the cost is $10 more for radar which needs to see an object moving towards it or ignores it. Many pentesters/redteams will looks for low tech solutions like a can of air, door lever "flippers", and simple solutions. Ironically, most RFID credentials are vulnerable to copying with a $10 device off amazon. If someone is willing to spring for a Proxmark tool, most cards can be copied. I am recommending Mifare DESFire EV2 for credentials to customers to avoid issues, and certainly do not use default keys.

Agree
Disagree
Informative: 2
Unhelpful
Funny

Good report Bryan, thanks

When presenting to an end-user, an integrator will gain points by informing the end-user of technology risks such as this. Most integrators don't think of this (or even realize the weakness of PIR-based REX sensors).

With a maglock, a push-button REX should always be used instead. The REX motion detector should be used to bypass the door contact on exit when using a door strike - I don't think it should ever be used to unlock the lock

Agree
Disagree: 1
Informative: 2
Unhelpful
Funny

With a maglock, a push-button REX should always be used instead. The REX motion detector should be used to bypass the door contact on exit when using a door strike - I don't think it should ever be used to unlock the lock

In areas where IBC is enforced, if a REX is used a manual pushbutton must be installed too:

"Sensor release of electrically locked egress doors (prior to the 2015 edition this section was called Access controlled egress doors) (2018: 1010.1.9.9; 2015: 1010.1.9.8; 2012: 8.1.9.8; 2009: 1008.1.4.4; 2006, 2003: 1008.1.3.4)

(The) means of egress doors in all use groups except group H (updated in 2018) may be equipped with an electrical locking system released by a sensor, when installed and operated in accordance with all of the following:

  • Sensor on egress side must detect an occupant approaching the door and door must unlock by a signal from or loss of power to the sensor
  • Loss of power to locking device must unlock the door
  • Door shall unlock by a readily-accessible manual unlocking device (push button) marked “Push to exit”, located 40 inches (1016 mm) to 48 inches (1219 mm) above the floor within 5 feet (1524 mm) of the door
  • Manual unlocking device must interrupt power to the lock, independent of other electronics, door must unlock for 30 seconds
  • Fire alarm and/or sprinkler system must unlock the door until system is reset
  • System must be listed per UL 294"

(From Lori Greene's handbook, our emphasis)

Agree: 4
Disagree
Informative: 2
Unhelpful
Funny

I occasionally see some installs where people allow the rex to unlock a door with fail secure hardware. I always think “what noob team installed this?”.

I fail to see how one could reasonably assume that a fail safe locking device would be considered secure. They are inherently disadvantaged in that regard.

Most customers i see these days say they want security but when it comes to access control they just like the convenience of issuing cards and tracking usage after the fact. Rarely does any customer i encounter even look for forced door alarms let alone have some action for when there space is intruded upon outside of business hours. I think we all know that good security is a layered approach but the customer absolutely has to be a part of instilling a secure culture within their workplace.

Agree: 1
Disagree
Informative
Unhelpful
Funny

I think about the only time I’d use RTE detectors at every door is if there will be a guard station monitoring the events of the access control system. If no responding guard or similar, then perhaps that negates the DPS as well 🤷‍♂️

I think it is ridiculous to release a lock with RTE on a door with mechanical free egress (meaning door strikes, ELR or mortise lockets)

Agree: 1
Disagree
Informative
Unhelpful
Funny

I don’t quite understand your pictorial about wiring two detectors so that either detector would release the door. It seems as though to increase security and reduce the canned air vulnerability, we should connect so both detectors would have to see motion before door releases therefore increasing the difficulty of defeat.

if RTE circuit is N/O, then both detectors relays would have to be series together. If RTE circuit is N/C, then both detectors relays would have to be parallel together.

Also, can you cite a model number of the dual technology RTE detector?

Thank you

Agree
Disagree
Informative
Unhelpful
Funny

Hello, this image is Bosch's, not ours:

The instructions recommend installing the (included) sensor mask tabs in order to reduce/block the number of zones each sensor can detect, in this case 'zones A,B' and 'zones H,L'.

The logic of the wiring is not a part of the image, if that helps clarify.

The dual-tech RTE shown above is: the Interlogix RCR-REX.

Agree
Disagree
Informative: 1
Unhelpful
Funny

Thanks sir.

Agree
Disagree
Informative
Unhelpful
Funny

Great article and feedback!

The RTE defeat is just one of the reasons that Access Control for Security is broken :( Low frequency card copying and the BLE attack on Wiegand coupled with this defeat render Access Control to about the same security level as a queuing Ribbon at a coffee shop. It keeps good people mostly in line.

Sadly most architects don't see a secure door as a Beautiful Door so we are in a bad spot right from the get-go.

rbl

Agree
Disagree: 2
Informative
Unhelpful
Funny: 1

In more challenging spaces, I have used a bosch tri-tech motion to trigger events in the access control software software that effectively enable the REX motion at the door. I can set the event to be active long after the tri-tech times out. The goal is just to validate that someone is on the secure side before the REX above the door is enabled. Takes a few steps in the software events, but then all the timing is configurable remotely with out rewiring anything.

Agree
Disagree
Informative: 1
Unhelpful
Funny

So I still don't see anything in a dual-tech RTE other than the Interlogix RCR-REX.

We have mag locks on the exteriors all over our campus and they are not going away. We were looking at the RCR-Rex but then Interlogix was UTC'd away from us so is there another option?

Agree: 1
Disagree
Informative
Unhelpful
Funny

[UPDATE: Bosch Response]

Bosch sent this response to the above post, citing a feature in the DS160 that permits another input to be used that qualifies a signal from the RTE REX:

"Bosch has two Request to Exit PIRs, the DS150i and the DS160. Both are very popular, but the DS160 has a feature that was designed specifically to eliminate the possibility of surreptitious entry, such as by blowing cold air or placing an object through a crack in the door that the detector is being used to open.

The Sequential Logic Input allows the detector to be configured so that it requires a separate input to allow it to open the door. This can be used to disable the detector unless someone is actually approaching the door in the correct method.

The Sequential Logic Input can be activated in a variety of ways. One is to use another motion detector mounted inside the area where the DS160 is mounted, and where an occupant must first pass through this second detector before activating the DS160. If the DS160 is mounted inside a vestibule, a door contact activated by the inside door of the vestibule is an option for this as well.

Another way to activate the Sequential Logic Input is to use an output from the intrusion alarm system that only allows the detector to activate when the area it is mounted in is disarmed, or during certain times of day. This method ensures that the detector will only activate when the area it is mounted in is meant to be occupied.

Other installation methods, such as mounting the DS160 away from the door opening, where it cannot be reached by blowing cold air or by placing an object through the crack in the door, can be effective in these instances as well. For example, mounting the detector near the hinged side of the door and aiming the coverage across the door opening or mounting the detector on the ceiling a few feet from the door.

Both the Sequential Logic Input and mounting location methods are described in our installation manual."

Agree: 1
Disagree
Informative: 3
Unhelpful
Funny

Great article, Brian. So what REXs are out there that don't have this exploit? I know there was the Interlogix RCR-REX that has the dual-tech that was not vulnerable to this, but the are out of business. Suggestions anybody?

Agree: 1
Disagree
Informative: 1
Unhelpful
Funny

Hello Brian:

It's been surprisingly tough to find other 'dual tech' sensors. As mentioned above, Optex sells microwave RTE sensors, and I have asked Bosch and others about filling the Interlogix void.

Agree: 1
Disagree
Informative
Unhelpful
Funny

Excited to hear what you find!

It seems like an obvious fit for them given their existant Tri-tech motions, and a continued market differentiator for them. (...in case you're reading, Bosch!)

Agree: 2
Disagree
Informative: 1
Unhelpful
Funny: 1

Maybe use a dual-tech motion sensor from your alarm supplier.

Agree
Disagree
Informative
Unhelpful
Funny

Here is another video of this exploit, tested on Coastal Fire Training, LLC YouTube page:

This video is informative because it shows how this exploit is used on single hollow metal doors.

Agree
Disagree
Informative: 1
Unhelpful
Funny

Does not work if the sensor is only used to indicate that someone is exiting, never only use a PIR as an exit releasing device. Only connect to the system to indicate that someone is leaving and use a RTX button or crash bar to open the door.

Agree
Disagree
Informative
Unhelpful: 1
Funny

The sensor (in most occupancies) should always unlock the door per code:

"Sensor release of electrically locked egress doors (prior to the 2015 edition this section was called Access controlled egress doors) (2018: 1010.1.9.9; 2015: 1010.1.9.8; 2012: 8.1.9.8; 2009: 1008.1.4.4; 2006, 2003: 1008.1.3.4)

  • Sensor on egress side must detect an occupant approaching the door and door must unlock by a signal from or loss of power to the sensor

(From Lori Greene's handbook, our emphasis)

Agree
Disagree
Informative: 1
Unhelpful
Funny

In our jurisdiction the building inspectors put a 6’ radius on the floor around the door with painters tape then walk very slowly within that area every way possible making sure the REX trips, making it nearly impossible to mask a Rex. And we are not allowed to field design multiple devices together unless they are factory assembled as a UL listed assembly. So no two sensors to verify someone walked to a door. All has to happen in the 6’ radius, and every part of that radius. Two days after I passed building inspection a bad guy grabbed a blade of tall grass from the landscaping and squeezed it thru the double door gap (I did not spec the doors or magnets) and triggered the REX. Once in the building he busted thru 8 tenant wood doors causing 10,000 damage to the building plus what he stole. Since then I take that video and show architects that the idea of framelesss glass doors without a mechanical strike on the top header with a vertical rod panic device (I like the $3000 units from C.R. Laurence Co., Inc. as they have a mechanical strike with door contact) are not a security solution. We need a UL listed rex that meets the code but also cannot be defeated with a blade of grass.

Agree: 1
Disagree
Informative: 2
Unhelpful
Funny

Thanks for the interesting first comment!

Which REX are you using most often?

Some include an option to adjust sensitivity. Is that an option the ADJ might support?

Agree
Disagree
Informative
Unhelpful
Funny

Bosch REX, sometimes Honeywell if existing and repurposed... Considering one inspector did his 6' test walking so slowly, moving in slow motion - I actually had to max out the sensitivity to make him happy. I told him what he was doing was unrealistic and he said the rules are the rules and no one was going to die in a fire because of him... The owner's manual instructions of focusing the rex on the handle of the door work great for REX purposes, but not for the AHJ in terms of unlocking the door. (The permit desk told me someone did die in a fire where the maglock did not release, and that is why they are so strict).

Agree
Disagree
Informative: 2
Unhelpful
Funny

this is also a problem where outdoor temps are low, on doors secured by maglock from the top, that allow enough flex to pull the bottom away from the door frame.

this generates a small gust of air into the conditioned space, blowing across the detection zone of the REX, with the same end results of releasing the door.

we found that in one installation, once homeless population in the area became aware of the exploit, it became a recurring thing.

masking or angling the REX higher risks missing egress attempts by shorter or wheelchair bound occupants.

you end up remounting hardware to reduce the flex, or raising the REX angle which requires setting a longer release time, and can't be used where you bring into range unintended foot traffic inadvertently triggering the exit request.

Agree
Disagree
Informative
Unhelpful
Funny

Numerous vendors are currently promoting these as "contact free" solution to egress. Yet large 'mushroom' style buttons are just as easily elbow-operable (or your butt or a swift spinning jump kick when nobody is looking).

Agree
Disagree
Informative
Unhelpful
Funny

Also, pouring warm water under a door can also trigger the REX if it is viewing the base of the door.

Two Points:

1) A REX Motion should rarely unlock an Access controlled door, it is designed to indicate to the access control that this is a valid exit from the secure side of the door. Unlocking a door is simply is not smart.

2) The Proper installation of a Rex is to install it on the hinge side of the door and mask it to view only the area where the door knob or exit paddle is located directly at the door. That way the motion does not see the area below the door and it is very difficult to trip with air or warm water. This is Best Practice if you unlock the door or not.

Overall a Maglock door should only be unlocked via an exit button. Sometimes we add a REX and schedule it to unlock the doors during high traffic times (when security is often lower) and use the Door release button all other times.

A Note, in Canada it is illegal to install a Maglock with out a direct disconnect Fire Alarm Pull Station at every door in the fire egress route (plus numerous other conditions). You also have to get a Building Permit in most jurisdictions.

A pet peeve of mine is why do integrators program REX's to unlock strike doors when there is a handset to open the door from the secure side? Is it really that important to unlock the door so the person doesn't have to turn the knob? Also, if there is a person on the other side of the door who you don't want in, when you walk up to the door you unlock it for them....

Agree
Disagree
Informative
Unhelpful
Funny

Is it really that important to unlock the door so the person doesn't have to turn the knob?

Yes, it is. Knobs typically don't meet ADA regardless, and International Building Code states that “the unlatching of any door or leaf shall not require more than one operation.”

NFPA 101 states that the releasing mechanism on the door must not require more than one releasing operation, with the exception of residential dwelling units. NFPA 101 has required one releasing operation since the 1988 edition.

Twisting the knob and then pushing to open is classified as at least two actions (some AHJs consider it three due to the gripping action first).

So RTE sensors used on a door with hardware (that may not meet code otherwise) can be a critical part of compliance.

Agree
Disagree
Informative: 1
Unhelpful
Funny

Yes, it is. Knobs typically don't meet ADA regardless, and International Building Code states that “the unlatching of any door or leaf shall not require more than one operation.”

If it is an ADA Door does it not have a Power Door Operator which should be integrated into the Access control and the need to turn a door handle is mute?

NFPA 101 states that the releasing mechanism on the door must not require more than one releasing operation, with the exception of residential dwelling units. NFPA 101 has required one releasing operation since the 1988 edition.

How is this relevant when exiting an access controlled door from the secure side or any door? You turn the knob and exit the door. If it has a strike, access control or if it is unlocked automatically (so you don't have to turn the knob). I am confused, is a typical door with out access control not meet NFPA 101 or are you only referencing ADA power operated doors?

If a door is power operated and when exiting the building a person presses the door opener button the door opens (access control or not). If you integrate the operator into the access control you have it send the REX output to the system for a valid exit. The REX doesn't need to see the person at the button and doesn't have to activate the door (very unsecure). If the button is not used the REX (installed properly at the door) activates when the person turns the handle or pushed the exit paddle to open the door manually. Either case the REX does not have to unlock the door and create an environment where someone can walk up to a door and have it automatically unlock or someone from outside tripping it with water, air or anything else.

Some people make integrating into power operated doors so complicated. They are not. Just keep it simple, let the door operator control the door and the lock. The access control will tell the door operator when to enable the secure side door operator button (with a valid credential, schedule, etc.) If the person used the button the door opens if they don't the door stays closed and the door operator unlocks the door and they open the door normally. Simple and secure.

Agree
Disagree
Informative
Unhelpful
Funny

If it is an ADA Door does it not have a Power Door Operator which should be integrated into the Access control and the need to turn a door handle is mute?

ADA applies to an opening regardless if it is fitted with an Operator or not.

How is this relevant when exiting an access controlled door from the secure side or any door? You turn the knob and exit the door. If it has a strike, access control or if it is unlocked automatically (so you don't have to turn the knob). I am confused, is a typical door with out access control not meet NFPA 101 or are you only referencing ADA power operated doors?

Turning a knob requires multiple actions, while running into/depressing an exit device crashbar requires one to both unlatch and swing the door open.

Strikes can be made (and often are) installed to 'Fail Secure' so they remain locked upon power failure. However, 'free egress' required by code is typically satisfied by the mechanical door hardware hung on the door, and in that case RTE isn't used for egress at all - but to squelch the potential nuisance alarms of 'forced door' events.

Does that help? I hope I understand your questions, and if not just reask them and I'll clarify. Thanks for asking them!

Agree
Disagree
Informative
Unhelpful
Funny
Subscribe to IPVM Research to read the full report.
Why do I need to subscribe?
The IPVM Research Service includes products tests and shootouts plus competitive and financial analysis, helping decision-makers better evaluate purchasing, partnering, developing, and/or competing against companies in physical security.
Already have an account?
Loading Related Reports