Summary

Physical security systems are often evaluated as single devices: a door lock, a maglock, an access controller, or an alarm interface.

In real infrastructure, however, these components do not exist in isolation. They operate as interdependent layers of mechanical, electrical, and control systems — each with distinct failure modes and override paths.

The physical attack domain is therefore not just about access to devices, but about understanding how layered physical defence systems can be bypassed through their interconnections and fallback states.

The Core Engineering Problem

A single-door system is rarely a single system.

A typical secure entry point may include:

• primary electromechanical lock (strike or motorised deadbolt)
• secondary maglock (independent retention layer)
• separate power supplies for each locking mechanism
• access control controller (logic layer)
• mechanical override key system (manual bypass layer)
• emergency egress logic (life safety compliance layer)

Each layer is designed for a specific purpose — but also introduces a distinct failure or override behaviour.

Multi-Layer Physical Defence Model

A properly engineered physical security door is not “locked or unlocked”.

It is a state machine composed of layered constraints:

1. Primary Mechanical Lock Layer

• often fail-secure (deadbolt, mortice, or electromechanical latch)
• provides baseline physical resistance
• remains functional without power

2. Secondary Retention Layer (Maglock)

• typically electrically controlled holding force
• often on separate PSU and battery backup
• may be configured fail-safe depending on safety requirements
• acts as a redundancy or anti-tailgating layer

3. Control Logic Layer

• access control system (credentials, schedules, permissions)
• determines lock/unlock state transitions
• dependent on power and controller integrity

4. Power Domain Separation Layer

• independent PSUs for different locking components
• battery-backed operation for continuity under outage
• introduces asymmetry in failure timing between systems

5. Mechanical Override Layer

• physical keys for emergency or authorised bypass
• typically bypasses electronic control entirely
• represents the ultimate deterministic fallback path

Fail-Safe vs Fail-Secure — The Critical Design Conflict

A key tension exists between:

Fail-Secure Systems

• default state = locked when power is lost
• used for perimeter security doors
• relies on mechanical retention (deadbolt, latch, strike)

Fail-Safe Systems

• default state = unlocked when power is lost
• used for life safety / fire egress compliance
• typically applies to maglocks and controlled releases

Engineering Conflict Point

When both systems are combined:

• fail-secure mechanical lock remains engaged
• fail-safe maglock releases under power loss
• resulting state is partially secured, partially released

This creates a non-intuitive hybrid state, not a simple open/closed condition.

The Secondary Maglock Problem

Adding a secondary maglock introduces a new structural layer:

• independent power supply (often battery-backed 12V PSU)
• independent cabling route
• independent control relay or trigger logic

This creates a decoupled failure domain:

• controller offline ≠ maglock offline
• mains failure ≠ immediate loss of all retention
• partial power loss ≠ predictable lock state

In practice, this means the system may remain secure longer than expected — or enter an unintended intermediate state depending on sequence of failures.

Override Keys as a Parallel Control System

Mechanical override keys are often underestimated in system design.

They represent:

a complete bypass channel that operates outside electrical and logical control domains

Characteristics:

• immune to power failure
• immune to controller state
• independent of network or software logic
• deterministic physical access path

From a systems perspective, override keys are not a backup — they are a parallel authority layer.

Real-World Failure Behaviour

Under fault conditions (power loss, controller failure, PSU instability), the system does not fail cleanly.

Instead:

• primary lock may remain engaged (fail-secure behaviour)
• secondary maglock may release (fail-safe behaviour)
• control system may lose state visibility
• access state becomes time-dependent rather than binary
• override path becomes the only deterministic recovery mechanism

This creates what can be described as:

a layered partial-failure security state

Why Single-Layer Thinking Fails

Most security designs assume:

• lock = secure
• unlock = insecure

But layered systems behave differently:

• one layer may fail secure
• another may fail safe
• another may lose state entirely
• another may remain mechanically locked

Result:

security is not a state — it is a composition of interacting constraints

Engineering Principle: Defence in Physical Depth

A robust physical security design is not about adding stronger locks.

It is about ensuring:

• no single failure mode creates full compromise
• each layer fails in a different direction
• power, control, and mechanical systems are decoupled
• override paths are controlled but intentionally independent
• recovery paths are deterministic under uncertainty

This is defence in physical depth, not just redundancy.

Key Insight

The most important structural reality is:

physical security systems are defined by their failure order, not their normal operation

Understanding:

• which layer fails first
• which layer remains active last
• which layer provides deterministic recovery

is more important than the nominal security rating of any individual component.

Conclusion

The physical attack domain is not simply about external access to devices.

It is about understanding how layered mechanical, electrical, and control systems interact under failure conditions.

Secondary maglocks, independent power systems, fail-safe logic, fail-secure mechanics, and override keys are not separate features.

They are:

interacting components of a multi-layer physical defence architecture whose security is defined by its failure sequence, not its design intent.