Access Control Upgrades Across Houston: Keep the Sound Parts, Fix the Weak Links

An upgrade is not a replacement, and the difference is money

An access control system is a stack of layers: credentials, readers, the cable between reader and controller, the controller itself, the management software, the locking hardware and the power supply behind it. Those layers age at very different speeds, which is why a well-planned upgrade usually beats starting over.

The cable inside the walls is the most expensive layer to redo and often the longest-lived. Door hardware in good mechanical condition can serve for many years. Credentials and reader technology go stale fastest from a security point of view, and management software on an office PC goes stale fastest of all. An upgrade replaces the fast-aging layers and keeps the slow-aging ones.

Signs an upgrade will work

• The controller is still supported by its manufacturer and can take current firmware.
• The controller is an open-platform board that more than one software vendor supports, so you are not locked to a single dealer.
• The reader cable is intact and includes a twisted pair that can carry a modern reader protocol.
• The complaint is specific: badges that can be cloned, no remote management, not enough doors, no audit trail.

Signs it is past upgrading

• The panel is discontinued, parts come from resellers, and no firmware has been released in years.
• Readers use a proprietary wiring scheme that only that manufacturer’s readers understand.
• The software will not run on an operating system that still receives security updates.

If your system lands in the second list, our Houston replacement page covers that path instead.

The five weak links we find in older Houston systems

1. 125 kHz proximity badges. A prox card has no encryption. It simply transmits a number whenever a reader powers it, and inexpensive handheld copiers can read that number from a few inches away and write it to a blank card. Standing next to someone in an elevator is enough. Older iCLASS legacy and MIFARE Classic cards also have published attacks. The fix is an encrypted 13.56 MHz credential such as MIFARE DESFire EV2/EV3 or HID Seos, or a mobile credential on the phone.
2. The 26-bit card format. The common H10301 format allows only 256 facility codes and 65,535 card numbers. In a multi-tenant building it is entirely possible for two companies to hold cards with the same numbers. Longer or custom formats remove that collision risk.
3. Wiegand reader wiring. Wiegand is one-way, unencrypted and unsupervised. A tiny sniffer spliced in behind a reader can record every badge that is presented, and the controller cannot tell whether the reader has been removed. OSDP with Secure Channel encrypts the traffic and reports tampering.
4. Management on one aging PC. We regularly find the access database on a desktop in a server closet, running an unsupported operating system, with one shared administrator login and backups nobody has ever restored. Former employees sometimes still have software accounts.
5. No door position switches. Without a contact on the door, the system cannot report a door held open or forced. Propped loading-dock and smoking-area doors go unnoticed for months.

What an upgrade looks like in different parts of Houston

Houston’s building stock is wide enough that the first upgrade changes from one district to the next. This table reflects the patterns we see most often.

We serve all of Houston from our Katy base. West-side work in the Energy Corridor, Westchase and Memorial is closest to us; for Downtown, the Medical Center and east-side sites we plan arrival windows around I-10 and 610 traffic and around each building’s loading-dock hours.

Moving everyone to a new credential without a lockout day

The badge swap is the part of an upgrade people worry about most, and it is the easiest to get right when it is staged.

1. Readers first. Multi-technology readers are installed that read both the old prox badges and the new encrypted ones. Nobody notices the change.
2. Badges in batches. New credentials are issued floor by floor or department by department, each enrolled before the old one is collected.
3. A defined overlap. Both technologies work for an agreed window, typically a few weeks, while stragglers are caught.
4. Shut the old door. The low-frequency side of every reader is disabled in configuration and old card numbers are deleted from the database. This is the step most projects skip, and an upgrade that leaves prox reading switched on has not closed the hole.

Mobile credentials turn the phone into the badge over Bluetooth or NFC, and some platforms place the badge in Apple Wallet or Google Wallet. They are convenient, but they are usually licensed per user on a recurring basis, they raise questions about personal phones, and every site still needs a few physical cards for visitors and dead batteries.

Lobby compatibility deserves a call to property management before anything is ordered. If the base-building turnstiles only read prox, the new suite credential may need to carry two technologies on one card.

Reusing reader cable when moving from Wiegand to OSDP

Wiegand readers were commonly wired with 6- or 8-conductor 22 AWG shielded cable: power, ground, two data lines, and lines for the LED and beeper. OSDP runs on RS-485 and needs power, ground and one twisted pair for data. Where the existing cable contains a twisted pair, reuse is often possible, which saves opening ceilings. Where it is untwisted composite cable, short runs may still perform, but we test rather than assume.

OSDP brings other practical gains. On suitable cable it reaches roughly 4,000 feet, compared with about 500 feet for Wiegand, and several readers can share one bus. The controller has to support OSDP on those ports, which may mean a firmware update or an interface module.

How EVOTECH runs a Houston upgrade

1. Inventory. For every door we record reader model and technology, lock type, door position and exit hardware, cable type at the reader, and the controller model, firmware and power supply with its battery date. We also note how many users and badges live in the database.
2. Test what is there. Battery load test, lock current draw, strike alignment and preload, and the fire alarm release on every electrified egress door.
3. A phased plan. Security weaknesses first, capacity second, convenience third, with an itemized quote for each phase so you can approve them separately.
4. Coordination. Building management, your IT team for ports and firewall rules, the fire alarm contractor if release relays are touched, the elevator contractor for cab readers, and your gate company for operators.
5. Door-by-door cutover. In towers this usually happens after hours. Each door is tested for badge read, request-to-exit, held and forced alarms and fire release before we move to the next.
6. Handover. Named administrator accounts instead of a shared login, an exported database backup, and a written door schedule showing what each opening does and when.

What moves the price of an upgrade

• How many readers are replaced and how many doors are added.
• Whether the existing reader cable passes testing or has to be re-pulled.
• Controller firmware or an interface module versus a new controller board.
• The number of badges and the credential type; mobile credentials add a recurring license.
• Cloud subscription versus a server license and the hardware it runs on.
• Lock hardware changes; converting a maglock to an electrified exit device is the most involved per-door change.
• Building requirements such as after-hours work, escorts, insurance certificates and freight elevator bookings.
• Elevator floor restriction, which needs the elevator contractor on site.

We do not quote from a phone call. We book an on-site estimate, inventory the hardware, and send an itemized, phased quote.

Upgrade shortcuts that bring an installer back

• Leaving 125 kHz reading enabled on multi-technology readers after the migration ends.
• Installing OSDP readers without turning on Secure Channel.
• Hanging extra locks on an existing power supply without recalculating the load and the battery standby time.
• Moving to a cloud platform without confirming the controllers keep making decisions when the internet drops.
• Touching lock power and not re-testing the fire alarm release.
• Issuing new suite badges that the lobby turnstiles cannot read.
• Migrating users but leaving old administrator accounts alive in the retired software.

Request an access control upgrade quote in Houston

Related services

Frequently asked questions