Blog

RFID is the default credential technology in commercial access control. The technology itself is not complicated. A credential carries a chip and an antenna, a reader energises that chip and receives an identifier back, and a controller decides whether that identifier opens the door. What is complicated is everything that follows from the specification choices around it: which frequency, which reader, how many doors on one controller, and which lock the controller actually drives.

Those choices are where projects go wrong. A system specified with the wrong card frequency cannot be fixed by changing the reader. A controller sized for four doors on a site that grows to nine becomes three controllers with three separate databases. A lock chosen without reference to the fire strategy fails inspection after installation. Each of these is expensive to unwind and cheap to get right at the specification stage.

This guide covers the four decisions in the order you need to make them.

1. Credential frequency: the decision that locks in everything else

Choose the frequency first. Everything downstream depends on it, and it is the hardest decision to reverse because it is embodied in physical cards already in people’s wallets.

125 kHz proximity

Low frequency proximity, sometimes called EM or EM Marin, reads at roughly 3 to 5 cm. The card holds a fixed identification number and nothing else. There is no encryption and no capacity for stored data, which means a 125 kHz credential can be cloned with inexpensive equipment by anyone who can get within a few centimetres of it.

That sounds disqualifying, and for a data centre or a cash room it is. For a warehouse turnstile, a staff car park or a time attendance terminal where the credential only proves that a known employee was present, it remains a reasonable and widely used choice. The technology is mature, the readers are simple, and the failure mode of a cloned warehouse badge is not the same as the failure mode of a cloned server room badge.

Vantage supplies 125 kHz readers, cards, wrist bands and other available formats.

13.56 MHz MIFARE and DESFire

High frequency credentials read at a similar short distance but work completely differently. It’s more secure with mutual authentication between card and reader, encrypted sectors, and space for stored data. MIFARE DESFire EV1 and EV2 use AES encryption and are not practically cloneable in the way a 125 kHz card is.

Specify 13.56 MHz where the credential controls access to something whose loss would matter, where the same card also needs to carry a cashless payment purse or a locker allocation, or where the client has any form of security accreditation to satisfy. The additional cost per credential is small relative to the cost of reissuing an entire site after a cloning incident.

One practical point that catches people out: MIFARE cards must be encoded before issue. Budget for it at specification stage rather than discovering it during commissioning.

Passive UHF for long range

Passive UHF operates in the 860 to 960 MHz band and reads at 3 to 20 metres depending on the reader, the antenna and the environment. It is the technology for vehicle gates, barrier lanes and any situation where the credential holder should not have to stop, wind down a window or present anything.

Two things matter when specifying UHF. First, the band is allocated regionally. ETSI territories use 865 to 868 MHz and FCC territories use 902 to 928 MHz, and a tag supplied on the wrong allocation will read poorly or not at all. Always confirm the band on both the tag and the reader before ordering. Second, stated read ranges are always conditional. A figure quoted without the reader it was measured against and the mounting conditions is close to meaningless, because metal, glass coatings and antenna orientation all move the number substantially.

Passive UHF is available as a thin card, as a windscreen vehicle tag and as an anti-vandal adhesive sticker for asset and vehicle marking.

Active 2.4 GHz, which is a different technology entirely

Active tags are frequently listed alongside passive UHF and are frequently confused with it. They are not the same thing. An active tag contains its own battery and transmits rather than merely reflecting, which is why it reaches 20 to 100 metres against the max 20 metres of a passive tag. Battery life on a well-designed active tag runs beyond two years in normal use.

The critical point, and the one most often missed: an active 2.4 GHz tag will not read on a passive UHF reader. Different frequency, different protocol, different receiver hardware. If a specification mixes passive credentials for pedestrians with active tags for vehicles, it needs two distinct reader types and the budget has to reflect that. Confirm the matched receiver at the point of quotation.

2. Reader selection

Once frequency is fixed, the reader choice is mostly about form factor and what else the reader needs to do.

• Entry and exit readers. The standard wall mounted unit either side of a controlled door, connected to a controller by Wiegand or RS485. The commonest configuration in commercial fit-out.
• Readers with keypad. Adds a PIN, which turns the credential into two factor authentication. Worth specifying on any door where a lost card would matter, because a card alone is something you have and a PIN is something you know.
• QR code and hybrid readers. Read a code from a phone screen or printed QR alongside a physical card. The practical application is visitors and contractors, who can be sent a time limited code by email rather than issued a card that then has to be recovered.
• Biometric hybrid readers. Fingerprint or face alongside RFID. Useful where a small number of high security doors sit within a wider card based system, because the same controller and software handle both.
• Long range UHF readers. Integrated reader and antenna units for barrier lanes and vehicle gates.
• Desktop enrolment readers. A USB unit at the security desk for registering credentials into the software. Every system needs one and it is routinely left off bills of quantity.

The full reader range, covering 125 kHz, MIFARE and UHF, sits in the RFID, MIFARE and UHF readers category.

3. Controller architecture

The controller is the part of the system that actually makes access decisions, and it is the part most often undersized.

Architecture	Typical scale	Specify when
Standalone reader controller	1 door	A single door with no requirement for central reporting or remote management.
Two door controller	2 doors, two way	A small office or a floor with entry and exit control on a small number of doors.
Four door controller	4 doors, two way	The standard building block for commercial fit-out. Networked over TCP/IP to central software.
Networked multi-controller	Unlimited, one database	Multi-building or multi-site estates. All controllers report to one server so credentials and reports are unified.
Elevator controller	Multi floors	Floor level restriction in residential towers, hotels and mixed-use buildings.

 

Two functions worth specifying explicitly rather than assuming.

Anti-pass back prevents a credential being used to enter twice without an intervening exit, which is what stops one card being passed back through a turnstile to admit a second person. It requires readers on both sides of the controlled point, so it has to be designed in at the reader count stage, not enabled later in software.

Door status feedback tells the system whether the door is actually closed, as distinct from whether the controller believes it granted access. Without it, a door propped open reports as secure. It requires a lock or a contact that provides the signal and a controller input to receive it, and it is the difference between an access control system and an access logging system.

Cloud or on premise

	On premise server	Cloud managed
Data location	Client infrastructure	Provider infrastructure
Access from off site	VPN required	Browser or app
Ongoing cost	Maintenance and IT overhead	Subscription
Multi-site management	Requires network design	Native
Operates during internet outage	Yes	Controllers continue on cached credentials; management is offline
Best fit	Single site, existing IT team, data residency requirements	Distributed estates, facilities managed remotely, limited on-site IT

 

Neither is better in the abstract. Data residency obligations, which apply to a growing number of regulated sectors, frequently settle the question on their own.

4. Lock hardware, and why it is a fire decision

The lock is chosen last and matters most, because it is the component with life safety implications.

Fail-safe and fail-secure

A fail-safe lock unlocks when power is removed. A fail-secure lock stays locked when power is removed. This is not a preference, it is determined by the door’s role in the escape strategy.

Electromagnetic locks are inherently fail-safe: the magnet holds only while energised, so cutting power releases the door. That property is exactly why they are specified on escape routes, and it is also why they must be tied into the fire alarm so that an alarm condition drops power to the lock. A maglock on an escape door that is not interlocked with the fire panel is a serious defect, not a configuration detail.

Bolt locks, strike locks and electric rim locks are available in both configurations, and the variant is not always obvious from the model number. Confirm which one is being quoted for each door, against the fire strategy for that door, before ordering. Getting this wrong is one of the few access control errors that can fail a building inspection outright.

Selecting by door type

Lock type	Typical application	Specification note
Single door electromagnetic, 600 lbs	Standard internal and office doors	Surface mounted with an armature plate on the leaf. Z, L or U brackets for inward opening and glass doors.
Double door electromagnetic, 1200 lbs	Double leaf doors and main entrances	Two magnets on one power supply. Check current draw against the supply rating.
Electromagnetic bolt lock	Sliding doors, frameless glass, narrow stiles	Where there is no face for a magnet and plate to meet.
Electric strike lock	Timber and metal framed doors with an existing latch	Retrofits into the frame and keeps the mechanical lock in use.
Electric rim lock with cylinder	Gates and secondary doors	Retains a mechanical key override, which suits doors that must open when the system is down.

 

Holding force figures deserve one caution. 600 lbs and 1200 lbs are magnetic holding force ratings and they describe electromagnetic locks. Bolt and strike locks resist force by a different mechanism and are properly rated on shear or static strength, so a holding force figure quoted against a bolt or a strike should be queried rather than compared directly against a maglock.

Exit hardware belongs in the same conversation. A request to exit device is required on the inside of most controlled doors, and the choice between a mechanical button, a touchless infrared sensor and an emergency break glass release depends on hygiene requirements, vandalism exposure and whether the door needs a mechanical override on the escape side. The full lock and exit device range sits in the electronic locks category.

5. Where RFID is the wrong answer

A guide that only argues for the technology is a brochure. Three situations where RFID should not be the primary credential:

Where the requirement is proof of identity, not proof of possession. An RFID credential proves that whoever presents the card holds the card. If the security requirement is that a specific person was present, biometric is the correct technology, because a card can be handed over and a fingerprint cannot.

Where credential turnover is very high. Sites with large contractor populations and short engagements spend more on issuing and recovering cards than the access control saves. QR or mobile credentials, which can be issued and expired remotely at no marginal cost, fit better.

Where 125 kHz would be specified for a genuinely sensitive area on cost grounds. This is the common failure. If the budget will not stretch to 13.56 MHz on a door that warrants it, the right answer is fewer controlled doors on the better technology, not more doors on a credential that can be cloned in a corridor.

	RFID card	Biometric	Mobile credential
Proves	Possession	Identity	Possession of enrolled device
Credential can be shared	Yes	No	Rarely in practice
Issue and revoke	Physical	Enrolment session	Remote, instant
Works when hands are dirty or gloved	Yes	Fingerprint no, face yes	Yes
Suits high visitor turnover	Poorly	Poorly	Well
Cost per additional user	Card cost	None	Licence

 

Most real estates end up mixed: cards for permanent staff, biometric on a short list of critical doors, mobile or QR for visitors and contractors, all on one controller platform. That is a sensible outcome rather than a compromise.

6. Two applications worth calling out

Elevator floor control

Restricting which floors a credential can select is standard in residential towers and hotels, and it is handled by a dedicated elevator controller wired to the lift’s floor buttons rather than by the door controllers. Two questions decide the specification: how many floors the building has, and whether the controller reaches that count natively or requires an expansion board. The distinction matters because an expansion board is additional hardware, additional installation and an additional point of failure.

Hotel locking

Hotel guest room locks are RFID but sit apart from the rest of the access control system. They are usually battery powered and offline, holding their own access schedule rather than querying a controller, with the guest card encoded at check-in for the room and the dates of stay. Encoding integrates with the property management system, so the PMS interface is a specification item in its own right. Energy saving switches, which require the guest card to be inserted for room power, are typically specified alongside.

Frequently asked questions

What is an RFID access control system?

An RFID access control system uses radio frequency credentials, most often cards or tags, to identify people at a door. A reader energises the credential and passes its identifier to a controller, which checks the identifier against permissions and time schedules and then releases the lock. The system logs every attempt, granted or denied, which is what separates it from a mechanical key.

What is the difference between 125 kHz and 13.56 MHz cards?

125 kHz proximity cards carry a fixed number with no encryption and can be cloned with inexpensive equipment. 13.56 MHz cards, including MIFARE and DESFire, use mutual authentication and encrypted storage and are not practically cloneable. The two are not interchangeable: a 125 kHz reader cannot read a 13.56 MHz card, so the frequency decision has to be made before any credentials are issued.

How far can an RFID reader read a card?

It depends entirely on frequency. 125 kHz and 13.56 MHz both read at roughly 3 to 5 cm, so the card must be presented. Passive UHF reads at 3 to 20 metres, which suits vehicle gates. Active 2.4 GHz tags reach 20 to 100 metres but require their own receiver and will not work with a passive UHF reader.

How many doors can one controller manage?

Standalone units handle one door, and two door and four door controllers are the standard commercial building blocks. Four door controllers networked over TCP/IP to a single server are the usual approach for larger sites, because that keeps one credential database across the estate. Sizing for the building’s eventual door count rather than its current one avoids splitting the database later.

What does an RFID gate access control system need for vehicles?

A long range UHF reader at the lane, passive UHF tags on the vehicles, and an interface from the controller to the barrier or gate operator. Confirm that the tag and reader are on the same regional frequency allocation, and that the mounting position on the windscreen suits the antenna. Where longer range is required than passive UHF provides, active tags are an option but need a matched active receiver.

Is RFID access control suitable for the UAE and wider GCC market?

Yes, and it is the dominant credential technology across commercial buildings in Dubai, Abu Dhabi, Riyadh and the wider region. Two regional considerations apply. Confirm the UHF band allocation for the territory before ordering vehicle tags, and check the fire strategy requirements with the relevant civil defence authority, as escape door lock configuration and fire alarm interlocking are inspected in most GCC jurisdictions.