Power is the layer everyone takes for granted until it fails. The security system has the same dependence on clean, conditioned, redundant power that the rest of the IT infrastructure has, plus an additional set of requirements driven by the security mission: doors that hold during a power outage, cameras that record through the generator transfer, intrusion panels that report through a 24-hour battery hold. Get the power layer right at design and the system holds through every foreseeable failure. Get it wrong and the first storm pulls the institution offline at exactly the moment the security record matters most.
Branch circuit sizing and dedicated security circuits
When the rule applies
Every power circuit feeding a security panel, security UPS, or security network device. Security loads are dedicated circuits; they do not share with general-purpose receptacles, with HVAC, or with any load that has an unpredictable duty cycle.
The spec
// DEDICATED SECURITY CIRCUITS Every security panel, UPS, and IDF gets a dedicated 120 V or 240 V branch circuit (no shared neutrals, no shared phases beyond what the panel itself draws) Circuit breaker sized at 125% of the calculated continuous load per CEC 8-104 Minimum 20 A branch circuit for any IDF with PoE switches Dual-cord equipment (servers, redundant switches) fed from two separate branch circuits on two separate panels where the institutional design supports it Receptacles dedicated to security: hospital-grade NEMA 5-20R or equivalent, marked with the system designation per chapter 06 Isolated-ground receptacles where the equipment manufacturer requires them (sensitive analytics, broadcast-grade video, some lab instruments) Receptacle marked with circuit number and panel designation on the faceplate Panel directory entry identifies the receptacle’s served device, not just “security”
Field note
Breaker locks on security circuits
When the rule applies
Every breaker feeding a security load. The breaker can be tripped intentionally or accidentally during maintenance on adjacent loads; a breaker lock prevents the wrong breaker getting flipped and brings the system down at an unscheduled moment.
The spec
Lockable breaker handle on every security circuit at the source panel Lock keyed to the security install’s key system (separate from the building’s general electrical key system) Padlock-style lock with hasp accepting the project standard padlock (matched to the institution’s key control) Lock kit listed by the breaker manufacturer for the specific breaker type; field-fabricated locks not acceptable Lock removed only by the security integrator or by maintenance staff acting on a documented work order Breaker number, served load, and lock identifier recorded on the panel directory
Field note
Eaton BLPK series breaker locks for Eaton panels, sized to the breaker frame. For non-Eaton panels, the breaker manufacturer’s own lock kit; do not field-fabricate. Padlocks keyed to the institution’s key control programme; do not use a vendor master key.
Surge and transient protection
When the rule applies
Every security panel and every outdoor camera or device fed by copper conductor. Lightning strikes, utility transients, and load-switching surges all enter the system through the power feed, through outdoor copper conductors, and through any conductive cable crossing the building envelope.
The spec
Type 1 SPD at the service entrance (typically installed by the electrical contractor as part of the main electrical infrastructure) Type 2 SPD at every security distribution panel, with audible alarm and dry-contact reporting to the security management system Type 3 SPD at the point-of-use for any sensitive equipment (head-end servers, recording servers, central UPS): combined PDU and surge protection in a single rack-mount unit simplifies the installation Coax surge protection on every outdoor IP camera line at the transition between exterior and interior (chapter 07) Cat 6A surge protection on every copper pair entering the building from outdoor (chapter 07) Consumer surge strips not used on production installs; joule rating decreases with every transient absorbed and there is no indication when protection is exhausted
Field note
Eaton SPD Series Type 2 SPDs at the security distribution panel with audible alarm and dry-contact reporting. Eaton ePDU G3 with integrated surge protection at the rack point-of-use (combines PDU and SPD in a single 1U or 2U unit). For outdoor coax and Cat 6A, a CSA-listed in-line surge protector sized to the line; verify the protector’s response time and clamping voltage match the cable’s signal characteristics.
UPS sizing and runtime calculation
When the rule applies
Every security install with a head-end server, with IDF switches, with a central recording platform, or with any access control panel where the institutional spec calls for battery hold-over. The UPS sizing math is straightforward; the failure mode is most often that nobody did the math at all.
The spec
Calculate the worst-case continuous load: sum the nameplate VA of every device on the UPS, including the inrush worst-case for any device that cycles (PoE switches in particular cycle PoE ports during reboot) UPS rated VA = continuous load × 1.25 (sizing factor) × 1.10 (future expansion margin) UPS rated wattage = UPS rated VA × power factor (typically 0.9 for institutional-grade online UPS) Runtime at full load calculated against the manufacturer’s runtime curve at the actual measured load, not the nameplate load; validate the calculation against the manufacturer’s published runtime table at the actual percentage load Minimum runtime targets:: 30 minutes for general security loads (cameras, access panels, IDF switches) 4 hours for life-safety-related access (egress controllers, sallyport interlocks, detention) 24 hours for intrusion detection panels per ULC-S304 Until generator transfer for any load on the building emergency bus (typically 15 minutes minimum) Online double-conversion (Class VFI) UPS for security loads; line-interactive (Class VI) acceptable only for non-critical loads UPS monitoring: network card with SNMPv3 and email alerts to the institution’s NOC or facility management system Battery test scheduled monthly via the UPS’s self-test feature, full battery discharge test annually
Worked example
An IDF with one Cat 9300-48UXM PoE++ switch drawing 1400 W maximum, one access control panel drawing 75 W, and one camera midspan injector drawing 60 W has a continuous load of 1535 W. Applying the sizing math: 1535 × 1.25 × 1.10 = 2110 W. At a 0.9 power factor, the UPS needs to be rated for 2110 / 0.9 = 2345 VA, so a 3000 VA online UPS is the appropriate size. At 70 percent load, a typical 3000 VA online UPS gives 12 to 15 minutes of runtime; for 30-minute runtime, add an external battery pack matched to the UPS series.
Field note
Eaton 9PX series online double-conversion UPS for IDF and head-end work, 1000 VA through 11 kVA in rack-mount and tower form factors. Lithium-ion option available on 9PX Li-Ion variants for extended service life (10-year battery vs. 3 to 5 years for VRLA). Eaton 5PX series for smaller IDFs or non-critical loads. Eaton’s Intelligent Power Manager software gives the SNMP and email alerting that institutional NOCs need. For larger head-end installations, Eaton 93PM modular UPS scales from 30 kW to 200 kW with hot-swappable power modules.
Voltage drop on door power circuits
When the rule applies
Every door power circuit from the supply to the lock. Voltage drop math is easier with a table than a calculator on every door; the values below are computed for copper at 25°C ambient, two-wire round trip, 5% maximum drop at the load.
The spec
// CONDUCTOR SIZE FOR DOOR POWER (5% MAX DROP) 12 VDC, 0.5 A load :: 30 m one-way: 18 AWG minimum 60 m one-way: 16 AWG minimum 12 VDC, 1.0 A load :: 30 m one-way: 16 AWG minimum 60 m one-way: 14 AWG minimum 12 VDC, 2.0 A load :: 30 m one-way: 14 AWG minimum 60 m one-way: 12 AWG minimum 24 VDC, 0.5 A load :: 60 m one-way: 18 AWG minimum 24 VDC, 1.0 A load :: 60 m one-way: 16 AWG minimum 24 VDC, 2.0 A load :: 60 m one-way: 14 AWG minimum 120 m one-way: 12 AWG minimum Round up conductor size where the run exceeds 60 m at 12 VDC or 120 m at 24 VDC Consider 24 VDC supply for any door more than 30 m from the panel; the conductor savings often justify the supply cost
The inrush calculation
// SIZE FOR INRUSH, NOT STEADY-STATE Steady-state current is the published holding draw. Inrush current at energising is two to four times the holding value for the first 50 to 200 ms. Size the conductor and the supply for the inrush, not the steady state, on any project where multiple locks energise simultaneously (panic release, fire alarm interface, mass unlock). A bank of eight 700 mA maglocks on a single supply pulls 5.6 A steady-state and as much as 22 A on simultaneous release. Verify the supply can handle the inrush peak without folding into current-limit, or the doors release at different times during the cascade.
PoE budget for IP security devices
When the rule applies
Every PoE-powered device on the install. Switches publish a total PoE budget that is the sum of every port’s draw across the switch. Run over budget and the switch starts cutting power to lower-priority ports in port order until the budget balances.
The spec
// POE CLASSES AND PER-PORT BUDGETS Class 0 / Type 1 / 802.3af : 0.44 to 12.95 W at the device, 15.4 W reserved at the portClass 4 / Type 2 / 802.3at (PoE+) : up to 25.5 W at the device, 30 W reserved at the portClass 6 / Type 3 / 802.3bt : up to 51 W at the device, 60 W reserved at the portClass 8 / Type 4 / 802.3bt : up to 71.3 W at the device, 90 W reserved at the portTypical fixed IP camera, indoor: Class 3 or 4 (12 to 25 W) PTZ outdoor with heater: Class 6 or 8 (50 to 90 W) Switch budget design at 75% maximum aggregate across all ports Per-port priority assigned by VLAN: cameras and access readers high priority, building wireless and general-purpose lower Worst-case PoE budget summed at design (chapter 11) and verified at commissioning (chapter 22)
Field note
Cisco Catalyst 9300-48UXM for 48-port PoE++ at 1.4 kW budget. Aruba CX 6300M 48-port PoE Class 6 at 1.4 kW budget. Both deliver Class 6 (60 W) on every port simultaneously up to the switch budget. For IDF closets with mixed PoE and non-PoE devices, native PoE on every port is the field default; mid-span injectors are not used at scale because they complicate the documentation and the spare-port budget.
Dual-cord PDUs and rack power distribution
When the rule applies
Every rack in every IDF and the head-end equipment room. Rack power is the layer below the equipment power supply; the rack’s PDU is what every device plugs into.
The spec
// RACK PDU CONFIGURATION Two separately-fed PDUs in every rack, each fed from a separate branch circuit on a separate panel where the institutional design supports it PDU outlet count sized to support the maximum equipped rack PDU plus 25% spare outlets PDU outlet type matched to equipment plug types: NEMA 5-15R and 5-20R for general 120 V equipment, C13 / C19 for IEC-cord equipment, C13 / C19 for high-current servers Vertical (0U) PDUs preferred for new installs to save rack U-space for active equipment Per-outlet metering and remote switching where the institutional NOC manages power remotely Per-PDU current monitoring with alarm threshold at 80% of the PDU rating Each PDU labelled with the source circuit and the served equipment (chapter 06)
Field note
Eaton ePDU G3 metered or switched, depending on the institutional requirement. Metered for monitoring without remote switching. Switched for remote outlet-by-outlet control from the institutional NOC. Vertical 0U form factor in 42U racks. Eaton ePDU Basic for non-monitored applications where the institution does not require per-outlet visibility.
Generator and emergency-power coordination
When the rule applies
Buildings with emergency or standby power. The institution’s emergency power design dictates which loads transfer; the security install confirms the right loads land on the right bus and tests the transfer at commissioning.
The spec
// GENERATOR-CONNECTED LOADS Security loads on the emergency or standby bus identified in writing in the design narrative Head-end servers, central UPS, IDF switches, and door power supplies on the emergency bus where the project includes one Cameras on the emergency bus only where institutional policy requires it; otherwise on the building UPS Transfer time: ATS transfer to generator typically 8 to 12 seconds; head-end UPS sized to ride through with margin Generator-side breaker coordination: security panel breakers sized so generator overcurrent protection does not trip the security panel during normal transfer Generator-fed circuits identified on the panel directory with an orange “GEN” sticker per chapter 06 Transfer test at commissioning: simulate utility loss, observe ATS transfer, verify every security device rides through, verify UPS does not exhaust, verify return transfer when utility restores
The load-shed mismatch
// THE MOST COMMON GENERATOR DEFECT Security UPS sized for the building outage but not for the transfer time, plus one of the IDFs accidentally fed from a non-emergency panel. The generator transfer happens, the building lights come back, but the IDF in the basement was never on the emergency panel and stays dark for the full duration. Cameras in that pathway go offline and the recording for the incident has a 30-minute gap. Verify every IDF, every camera midspan, every door supply against the emergency-power schedule at the design review.
Power identification at the receptacle and panel
When the rule applies
Every receptacle, every panel, every breaker that serves a security load. Identification is the difference between fast restoration and an hour of finding the right breaker during an outage response.
The spec
Every security-dedicated receptacle labelled at the faceplate with panel designation and circuit number Every breaker entry in the panel directory identifies the served device (not just “security”) UPS-fed circuits identified with a green sticker or coloured nameplate on the receptacle and in the panel directory Generator-fed circuits identified with an orange sticker Surge-protected circuits identified with an SPD note in the panel directory Lockable breakers identified in the panel directory with the lock identifier Receptacle colour convention (one-time choice per institution, then consistent across all projects):: Standard 5-20R: ivory or white (general) Hospital-grade: green dot on face Isolated ground: orange triangle on face UPS-fed: red receptacle body (some institutions) Generator-fed: orange receptacle body (some institutions)
// THE PRACTITIONER POSITION Power is the foundation. Dedicated circuits, breaker locks, point-of-use surge protection, sized UPS with documented runtime, dual-cord PDUs from separately-fed circuits, generator coordination verified at commissioning, and every receptacle and breaker labelled. Eaton is the field default across most of the categories, UPS, receptacles, ePDU, breaker locks, surge protection, and the parts integrate cleanly because they come from one manufacturer. Get this layer right and the security system rides through every foreseeable failure. Get it wrong and the first storm pulls the institution offline at exactly the moment the security record matters most.