Most buildings with a lockdown capability acquired it the same way. A button appeared on a wall behind reception, a line item appeared on an access control quote, and a paragraph appeared in a binder. Somewhere in that sequence the building started describing itself as having a lockdown plan.
Very few of those plans have ever been examined. Not tested — examined. Nobody has sat down with the door schedule and the staff list and worked out what would happen if the button were pressed at four on a Thursday afternoon, or at nine at night when the office is empty and the cleaners are in.
This article is that examination, reduced to three questions. They are deliberately unglamorous, and they decide whether what you own is a plan or a purchase.
We are not going to describe an incident to make the case, and you should be wary of anyone who does. Fear is a selling technique, and a plan bought under it tends to be a plan nobody inspected. The argument stands without it: a building-wide function that changes the state of every door deserves the scrutiny any other system gets when it can hurt people by misbehaving.
Question one: who can trigger it, and from where
Start with the trigger, because every other part of the plan is downstream of it. The common arrangement puts it in one place — a button under the reception desk, a software control on one workstation, a key switch in the security office. It is what an integrator proposes by default: simplest to wire, easiest to explain. It also has a failure built into it. It assumes the person who needs the lockdown is standing next to the trigger and is able to use it.
Work through the states your building is actually in. The reception desk is unstaffed at lunch. The security office is locked at night. The one manager trained on the software control is on vacation, or at the far end of the building, or is the person the lockdown is meant to protect. In each of those states the building has the same equipment and no capability.
So the question is not "do we have a trigger?" It is:
- Who is authorized to trigger it? Name roles, not people, because people leave. If the answer is one role, ask what happens on the day that role is absent.
- From how many places? A single physical point is a coin flip on geography. A second point elsewhere in the building, or a trigger carried by whoever is on shift, turns a location problem into a coverage problem — the better problem to have.
- Does triggering need a credential the person will have on them? A trigger requiring a password nobody has memorized under pressure, or a fob left in a drawer, is a trigger in the drawing only.
- What stops it firing by accident? A trigger easy enough to reach in a hurry is easy enough to lean on. Whatever protection you use — a cover, a hold-to-activate delay, a confirmation step — has to be chosen knowing it will be operated by someone who is not calm.
Underneath all four sits the deeper one. Who decides? In many buildings nobody has been given that authority, so whoever is standing there hesitates — not because they cannot reach the button, but because they are not sure it is theirs to press. Write down who may decide, and write down that they will not be second-guessed for deciding wrongly in good faith. That sentence does more work than the hardware does.
Question two: what actually happens when it fires
Ask a building owner what their lockdown does and you get a one-word answer: it locks the doors. Ask which doors and the answer stops. The honest response is usually "we would have to ask the integrator" — itself a finding, because it means the behaviour of your building in its most consequential state is held in someone else's memory.
What you need, per door, is what the lockdown does to it:
- Exterior doors — do they stop admitting credentials entirely, or keep admitting some? Locking out the staff who are outside is a different design from letting a supervisor back in. Both are defensible; not knowing which one you bought is not.
- Interior doors along the route people take — the ones owners forget, because they do not feel like security doors. A door between a work area and the corridor is part of how people move.
- How emergency services get in — responders arriving at a building in lockdown need a way through the perimeter that does not depend on finding the one person with a fob. Write it down before it is needed.
- Doors that must not change at all — because their job is something other than access control. A door in a fire separation is holding a compartment together, and that job does not pause because another system changed state. The BC Building Code deals with door latches and positive latching in a fire separation at Article 3.1.8.15; a lockdown that leaves such a door standing off its latch has broken something to fix something.
- What the doors do to a person on the inside — the subject of the next part.
Then ask the half almost nobody asks: does anyone in the building know which is which? A lockdown changes the rules of a space people have learned by habit, and if your staff discover that by pulling on a door, the plan has failed at the only moment it was going to be used. Whatever the scheme is, it has to be simple enough to state in one sentence to a new employee on their first day.
The part that is not a preference: getting out
Here is the tension at the centre of this topic, stated plainly rather than smoothed over. Lockdown wants doors held shut. Egress law wants people able to leave. These pull in opposite directions, and there is a temptation — visible in a lot of lockdown marketing — to treat the resolution as a matter of how much security the owner wants. It is not. It is governed.
The BC Building Code sets the free-egress requirement in two parallel places, and which reaches your door depends on where the door sits. Division B, Sentence 3.4.6.16.(1) covers a principal entrance door to a building and every exit door: those doors must have release hardware permitting the door to be readily opened from the inside "with not more than one releasing operation and without requiring keys, special devices or specialized knowledge of the door-opening mechanism." Doors within a floor area — a suite door onto a corridor, a door on the route toward the stairwell — are governed instead by Article 3.3.1.13, which requires a door in an access to exit to be readily openable in travelling to an exit, again without keys or specialized knowledge, and openable with not more than one releasing operation. The two tests are near identical, which is why the distinction is easy to miss and worth getting right.
What follows is the sentence this article exists to deliver: a lockdown scheme that prevents a person from leaving by an exit route is not an aggressive security choice. It is a code problem. It does not become acceptable because the owner accepts the risk, because the scheme is active for only a few minutes, or because an integrator can configure it. Nobody in the supply chain has the authority to trade that requirement away, and one who offers to is telling you something about the rest of their work.
The resolution is not a setting. It is a conversation with the authority having jurisdiction — your local building and fire officials — about your building, your occupancy and the specific doors involved, ending in an answer you keep in the file. Bring a door list and you get a specific answer.
Two related points. Electromagnetic locks are permitted subject to conditions, at Sentences 3.4.6.16.(5) and 3.4.6.16.(6); we deliberately do not recite them — see electromagnetic locks and the BC Building Code for why a lock that satisfied its conditions on commissioning day can quietly stop satisfying them. And a door's power-loss behaviour is a separate axis from its lockdown behaviour; the two get confused constantly, and fail-safe vs fail-secure is the piece to read first.