Power over Ethernet changed how we build security infrastructure. A single cable can carry power and data to a camera, a card reader head with a small controller, an intercom station, or an edge door controller that runs an electronic strike. The simplicity is real, but so are the limits. Voltage drop sneaks up on long pulls. Patch panel hops and poor terminations eat margin. Some devices behave badly when supply dips only a little below spec. I’ve had doors that unlock intermittently at lunchtime because the reader backlight and the heater kicked on together. You don’t forget days like that.
Done right, PoE is rock-solid for access control cabling and security camera cabling, even when you mix in alarm integration wiring or intercom and entry systems. The trick is to respect power budgets, calculate cable loss with a little discipline, and know when to use a midspan injector or a local supply rather than forcing the switch to do everything.
What PoE really provides
PoE is not a single wattage. It’s a family of standards with defined power classes, conductor usage, and negotiation rules. You’ll see this breakdown in the field:
- 802.3af, often called PoE: up to 15.4 W at the port, typically 12.95 W available to the device after cable loss. Most fixed-lens IP cameras, basic intercom stations, and many low-power PoE access devices live here. 802.3at, or PoE+: up to 30 W at the port, roughly 25.5 W at the device end. PTZ cameras without heaters, small edge door controllers, and some biometric door systems run fine on PoE+. 802.3bt Type 3 and Type 4: up to 60 W and 90 to 100 W at the port, respectively, with 51 to 71 W typical available at the device. This tier supports multi-sensor cameras, PTZ with heaters and wipers, multi-door edge controllers, and intercom and entry systems with large touchscreens.
Those numbers assume Category 5e or better, solid copper, within the 100 meter channel length. They also assume good terminations and full conductor usage. 802.3af and 802.3at energize two pairs, 802.3bt can utilize all four pairs which halves current per conductor and reduces voltage drop. That matters when you push long runs or power-hungry loads like networked security controls with onboard relays.
A subtle point that trips people up: PoE delivers constant power, not constant voltage. The switch tries to keep the device fed at a negotiated class. The actual voltage at the device, after cable drop, floats within a range. Most devices are tolerant between roughly 37 and 57 V depending on the mode. But heaters, IR LEDs, strike coils, and readers with bright keypads have transient current spikes. Those spikes ride on top of the average draw and raise the effective drop. If you design to the steady-state number printed on the spec sheet, you invite mystery reboots at 3 a.m.
Cable, distance, and the truth about 100 meters
Manufacturers repeat the 100 meter rule because it fits Ethernet’s timing budget. It does not guarantee power availability to the full length. Think of 100 meters as the absolute ceiling for data, with power capacity that depends on current and cable properties.
Voltage drop on twisted pair is simple to estimate. Resistance for Category 5e copper is about 0.188 ohm per meter for a loop when using two conductors in parallel per polarity, which is how 802.3af/at deliver power across two pairs. If your device draws 0.3 A (about 15 W at 50 V), a 90 meter horizontal run drops around 5 volts before transients, assuming clean copper and standard temperature. Type 3 or 4 PoE spreads the current across four pairs, cutting drop roughly in half for the same load. That difference can save a marginal run.
Patch cables and consolidation points add both resistance and failure opportunities. A 5 meter stranded patch cable at the edge can add more drop than people realize. Stranded conductors have higher resistance than solid. When I know a camera is tight on budget, I keep the patch at the device short and solid copper where possible. If you must use stranded at the head, shave a few meters off the horizontal to compensate.
For access control cabling, the temptation is to pull one Category cable to the door header and split pairs for the reader, request-to-exit, and maybe even the lock. With PoE edge controllers this can work, but the lock should not ride PoE directly unless the device is designed for it. Keep the load on the controller’s supervised outputs, not on the cable pairs themselves. Electronic door locks draw high inrush. If the controller supports PoE and the lock rating sits inside its power budget, you’re fine. If not, plan for a local 24 VDC supply and reserve PoE for the controller and reader electronics.
How to estimate loss without a lab bench
A field-friendly approach beats perfect math. I use a quick method during design, then verify with a meter onsite.
First, capture honest device power. Skip the marketing brochure and check the installation guide. Cameras often list typical and maximum draw separately. A bullet camera might say 6 W typical and 12 W with IR on. PTZ might read 13 W typical, 25 W with motors moving, 40 W with heater. Edge controllers list their own consumption plus per-door allowances for readers and locks. Intercom panels with displays can spike above 20 W during call initiation because the backlight and codec both ramp.
Second, assume 10 to 20 percent headroom for transients. If the device specifies 12 W typical and 18 W peak, design for 18 to 20 W. If the document lists only typical, bump it by 30 percent for devices with heaters or IR, 15 percent for the rest. It’s cheap insurance.
Third, choose the PoE tier and class based on the worst case, then check drop. On two-pair PoE, consider about 0.2 ohm per meter for the loop. On four-pair PoE, halve that. Calculate I = P/V, use 50 V for estimation, then Vdrop = I × Rloop. Keep Vdrop under 10 percent of supply for critical devices. If the math lands above that, either shorten the run, move to 802.3bt, improve cable gauge, or put a midspan closer to the device.
Here’s an example from a recent IP-based surveillance setup. A multi-sensor camera needed 28 W peak. The run measured 85 meters plus two 2 meter patch cords at both ends. Using PoE+ on two pairs, current is around 0.56 A at 50 V. Loop resistance across 89 meters of solid plus 4 meters of stranded patches is about 20 to 22 ohms total for the two energized pairs combined when you include the higher resistance of stranded. That yields a drop close to 11 V during peak draw, which is too much. We swapped to a 60 W 802.3bt midspan at a telecom room 40 meters from the device. With four-pair power and a shorter powered segment, the drop shrank to roughly 3 to 4 V at peak. The camera stopped rebooting when the heaters engaged.
When to use midspans and injectors
PoE switches are convenient, but they sit where the core or edge network lives, not always where your distances make sense. Midspans and single-port injectors let you place the power source closer to loads, trimming cable loss without relocating the switch.
I look at injectors for four situations. First, retrofits where the network switch is non-PoE or underpowered and we only need PoE for a handful of drops. Second, long runs approaching the 100 meter channel limit for devices with higher draw. Third, mixed power classes where a few cameras need 60 W but the switch only does PoE+. Fourth, segmented risk for life-safety doors where I want the access system on a separate UPS and breaker from IT.
Midspans come in flavors. Passive injectors that simply couple DC onto the line are not appropriate for standards-based installs. Stay with 802.3af/at/bt compliant gear that negotiates power and implements signature detection. Make sure the injector supports the exact class your device needs. If you have biometric door systems with readers that push 25 to 30 W during sensor warmup, a 30 W injector may work on paper but leave no margin. Pick the next tier when the peak load lands within 20 percent of the injector’s rating.
For intercom and entry systems with video, think about call bursts. The codec may spike, the LCD or OLED brightens, the camera IR might engage in low light, and the amplifier draws more current if the call station drives a local speaker loudly. I had an outdoor intercom freeze during rainy evenings because the panel heater and IR LED strip nudged the draw just over the injector’s limit. Replacing the 30 W unit with a 60 W bt injector solved it without touching the panel.
Access control specifics that affect power
Edge door controllers connected over PoE are compelling. Less copper, centralized monitoring, and easy moves-adds-changes. They also condense loads that used to be spread across a can full of modules. A four-door controller that runs two strikes, two maglocks, four readers, four REX sensors, and a couple of door contacts becomes a dynamic load profile.
Reader current is small individually, usually between 60 and 200 mA at 12 V on the reader side, but multiplied by four it adds up. Backlit keypads and biometric readers draw more. Electronic door locks are the big swing. A 12 VDC strike might draw 300 mA with 1 A inrush. Maglocks can run 300 to 500 mA steady. The controller’s outputs are rated, but the controller’s own PoE budget must account for those coils. If your controller supports PoE only for its electronics and expects a separate 12 or 24 VDC lock supply, respect that split.
For card reader wiring, stick to TIA guidelines. Twisted pair helps with Wiegand if you still deploy it, but RS-485 based readers for OSDP really benefit from controlled impedance and proper daisy chaining with termination. Keep reader cable away from high voltage and, when possible, keep it out of the same conduit as lock power to avoid transient coupling during coil collapse. If you must run both, use separate shielded pairs, bond shields at one end only, and add diodes or suppression across lock loads to tame spikes. Those spikes can momentarily sag the controller’s internal rail, which is not what you want when it’s powered by PoE and sitting at the edge of its budget.
For alarm integration wiring, dry contacts are trivial, but powered sensors are not. When you piggyback sensors that draw 20 to 60 mA each, two dozen of them can push a controller into trouble. Spread powered peripherals across panels, use local power where practical, and let PoE feed the brains.
Cameras: IR, heaters, and reality checks
Security camera cabling looks simple until winter arrives. A compact bullet camera might sip 5 to 6 W when the sun shines, then gulp 12 to 15 W with IR on. Dome cameras tucked under eaves can still kick their heaters when wind chills the dome. PTZ cameras swing their power during patrols. Multi-sensor panoramic units with built-in analytics chew through steady power all day.
Run calculators are useful, but the field test is better. After install, pull telemetry from the switch port or injector. Many enterprise switches show per-port watts. If the device reports only class, use a clamp meter with a PoE inline adapter once, at least on representative drops, to see actual current during worst case. Then label the port with max draw. I started doing this a decade ago and it has saved me during later expansions. You’ll know which ports can share a switch power budget and which ones must sit alone.
Cable choice matters. Use solid copper, not copper-clad aluminum. CCA looks tempting on price, then bites you with higher resistance and brittle conductors. Outdoor runs need gel-filled or at least flood-coated cable in wet paths. Moisture wicks and raises resistance over time. I’ve seen cameras that worked fine on day one and started rebooting six months later as the resistance crept up from corrosion in a handhole.
Extending beyond 100 meters without regrets
Sometimes the building beats you. Wi-Fi bridges are a last resort for cameras, and I avoid them for access control devices. Wired extensions are safer. Two practical methods keep structure and code on your side.
First, place a small media cabinet or mini-IDF closer to the devices. Feed it with fiber or copper backhaul, then power an 802.3bt switch or midspan there. Back it with a UPS rated for at least 30 minutes. You turn one long run into two manageable runs, and you get local maintenance access.
Second, use a PoE extender that repeats Ethernet and re-injects power. Many extenders can push 200 to 300 meters over good copper with one or two hops, but check the downstream power budget. Every hop consumes overhead. If the far-end device draws 20 W and each extender burns 2 to 3 W, you’ll need a bt-class source at the near end to deliver enough at the far end. Also, count all connectors. Each keystone or coupler adds a little loss and a lot of potential trouble.
The interplay between data rate and power
Higher data rates mean tighter margins. 2.5GBASE-T and 5GBASE-T over existing Cat6 can coexist with PoE, but bundle heating and insertion loss increase. If you cram 48 PoE+ feeds into a fully populated 1U patch row and push multigig to every port, expect heat. Hot cable has higher resistance, which means more voltage drop at the same current. I aim for staggered cable management and ventilation, and I space high-draw ports across multiple switches when I can. If a camera truly needs 4K at high frame rate and analytics, verify the driver support for multigig on both ends and pay attention to the cable category and channel testing.
Bundling, heat, and safety
PoE classes above af put real heat into cable bundles. The standards address this, and reputable cable makers publish bundle ratings. Running 60 or 90 W across dozens of cables in one tight tray can push conductor temperatures beyond spec, especially in plenum spaces. Elevated temperature raises resistance, which invites more drop and a cycle of marginal performance. Use wider pathways, break large bundles into smaller groups, and consider Category 6A with larger gauge conductors for high-density bt deployments. The cost delta between Cat6 and Cat6A is smaller than a truck roll to replace cooked cable.
From a safety perspective, UL 62368-1 and Limited Power Source limits apply. Standards-based PoE is inherently current-limited and safe for typical building pathways. The danger shows up when someone mixes nonstandard high-voltage injectors or uses passive 24 V systems common in some legacy CCTV gear. Keep those worlds separate. If you have to integrate legacy 24 VDC cameras into a modern networked security controls environment, isolate with baluns or converters near the device, not at the core.
Grounding, surge, and outdoor runs
Outdoor cameras and door stations live hard lives. Lightning and static can wreck ports even when the strike is blocks away. Use shielded cable with proper drain bonding for exterior runs and add Ethernet surge protectors at building entry points. Bond shields at one end only, typically the headend, to avoid ground loops. If the device is mounted to a metal surface, verify isolation or use insulating washers to reduce sneak paths.
For gate intercoms and readers at fence lines, budget extra protection. A grounded surge unit on the PoE line plus MOVs or TVS diodes across lock outputs extends life. Keep the access control panel or PoE switch on a UPS with proper surge protection. I learned to carry spare PoE ports on small standalone injectors for gates. If a storm takes out a port, swapping a midspan is faster than re-terminating in a crowded core switch at midnight.
Planning power budgets so you don’t run out
Switches advertise a total PoE budget, often smaller than the arithmetic sum of all ports at max class. A 24-port PoE+ switch might have a 370 W budget. If you hang 20 cameras at 12 W typical and three intercom panels at 18 W peak, you are already near the edge once IR or cold weather hits. Leave 15 to 20 percent unused in design. If you cannot, split loads across two switches https://trentonzsax623.cavandoragh.org/alarm-panel-connection-fundamentals-power-signaling-and-supervision-explained or add a dedicated midspan for the heavy hitters.
Label the budget on the door. It seems silly, but future-you will thank past-you. I write the reserved watts, the largest single-port load, and the UPS runtime estimate right inside the cabinet. During expansions, that note stops casual port moves that tip a system over.
Choosing cable and connectors with power in mind
Category is only part of the story. Conductor gauge and material matter more for PoE stability. Select cables with 23 or 24 AWG solid copper conductors for long runs. Avoid copper-clad aluminum entirely for PoE. Use keystones and jacks rated for the category and for repeated PoE make-break cycles. Some cheap connectors pit or discolor with arcing over time when plugging under load. The standard includes make-before-break behavior, but in the field people unplug live devices. Industrial-rated jacks survive better.
For security camera cabling outdoors, UV-rated jackets and gel help, but a small weatherproof junction near the device makes service cleaner. Leave a service loop. You will climb that ladder again.
Interoperability with building systems
Access and cameras often tie into alarms and building automation. When tying alarm integration wiring to PoE devices, isolate grounds and follow each manufacturer’s guidance for supervised inputs. Don’t power motion sensors or glass breaks from the same PoE-fed controller unless you’ve confirmed the total draw and ripple tolerance. Some sensors introduce noise when sharing a small onboard regulator. A tiny remote 12 VDC supply can stabilize a finicky zone for less than the cost of a second truck roll.
Elevator interfaces, fire alarm release for maglocks, and after-hours intercom call routing all add edge conditions that affect power. A maglock released by fire alarm will drop its load suddenly. Some controllers misbehave with abrupt load shedding if their internal regulation relies on that load for stability. Testing these events during commissioning catches issues early. Trigger a fire release, cycle power, initiate multiple intercom calls, run cameras at night with IR blasting. Watch port draws and device logs while you do.
A short field checklist for distance and injector decisions
- Measure or estimate worst-case device power including heaters, IR, readers, and lock inrush, then add headroom. Calculate voltage drop for the planned run length and cable type, favoring four-pair PoE on high draws. Verify switch total PoE budget and per-port class against the device mix, leaving margin. Decide on midspans or a mini-IDF when runs are long or loads are uneven, and keep injectors standards-compliant. Validate onsite with port telemetry or an inline meter during worst-case scenarios, then label the results.
A few edge cases worth anticipating
Door strikes on old frames can chatter and draw longer inrush periods, especially if alignment is off. That extra second of elevated current might be enough to sag a PoE-powered edge controller that also feeds the reader. Fix the mechanical issue, not the power, or you’ll chase ghosts.
Thermal domes exposed to direct sun sometimes run their internal fans at midday, adding a quiet two to three watt draw that isn’t obvious in documentation. When ambient is high, your cable is hot too, so your resistance is up. What worked in spring sunsets might reddrop in August noon. If the camera has a performance log, review it after a hot day.
Biometric readers with liveness detection can hammer the CPU and IR illuminators while also heating the sensor window in cold weather. If they reboot when people crowd the door during shift change, look at power first. A small 60 W injector local to the mullion often cures the issue without rewiring.
Bringing it together on a real project
A recent mid-rise job combined networked security controls for eight doors, twenty-eight cameras, and three exterior intercom and entry systems. The main IDF sat at the center of the floor plate. The longest camera runs reached 95 meters to corner soffits, and two were PTZ units with heaters. The initial plan put all PoE on two 48-port PoE+ switches with a 740 W aggregate budget.
We changed three things. First, we added a small bt midspan in a closet closer to the PTZs and the intercoms, fed by fiber and its own UPS. That cut the longest powered segments to about 55 meters and gave us 60 W per port for the heavy devices. Second, we moved four edge door controllers to a dedicated PoE+ switch fed from the security UPS, which separated door uptime from camera loads. Third, we pulled 23 AWG Cat6A for any run expected to carry more than 25 W or land near 80 meters, and we limited patch cords to 2 meters of solid at the device where we could.
During commissioning we forced worst-case: night mode on all cameras, patrol on the PTZs, continuous intercom calls, and we cycled multiple door strikes. Port telemetry showed the highest camera at 27 W, intercoms around 19 W on call, and the door switch peaking around 160 W total during active strike cycles. All devices stayed up, and the UPS runtime estimates held. That’s a system I don’t worry about on a holiday weekend.
Final thoughts from the field
PoE simplifies projects, but it’s not magic. When you treat the cable as a power conductor with resistance, the switch as a finite supply, and the device as a dynamic load, the design decisions become clear. Access control cabling wants clean separation of lock power and signal where required, proper reader wiring practices, and realistic budgets for PoE access devices. Security camera cabling benefits from honest power numbers, better copper, and an injector where the physics says you need one. Intercom and entry systems sit somewhere between, with display and audio transients that reward extra margin.
If you remember only one thing, let it be this: measure the worst case, not the average, and place power where distance and load say it belongs. The rest, from card reader wiring tricks to alarm integration wiring finesse, falls into place when the electrons have an easy path.