Fail-Safe vs Fail-Secure Electric Locks: What Happens When the Power Goes, and How to Specify It

A fail-safe electric lock unlocks when its power is removed. A fail-secure electric lock stays locked when its power is removed. That is the whole definition, and both terms describe the secure side of the door: the outside lever, the strike or the magnet that keeps people out. Neither term says anything about whether people inside can get out; on a correctly specified opening they always can.

The choice is made per opening, not per building or per product line. A perimeter door, a stair door, a server room and an office corridor door in the same project can each need a different answer, and the answer depends on what must happen during a power cut and what must happen during a fire alarm, which are not always the same event.

What each one does when the power goes

The row that matters most in practice is the fourth. A fail-safe device draws current for as long as it is locked, which is most of its life. A fail-secure device draws current only while it is being released, unless the system holds it unlocked through business hours. That decides the size of the power supply and the battery backup, and it is one reason the mode is not something to change casually on site.

Which devices come in which form

Electric strikes. The strike replaces the fixed keeper in the frame, and the lock in the door stays mechanical. Strikes are made in both modes, and many can be switched between them in the field. A fail-safe strike lets go of the latch when the power drops, so the door can be pushed or pulled open from outside. A fail-secure strike keeps holding the latch, and the door stays shut unless someone uses a key or the inside lever.

Magnetic locks. An electromagnet on the frame holds a steel armature plate on the door. The holding force exists only while current flows, so a magnetic lock is fail-safe by its nature; there is no fail-secure magnetic lock. It also has no latch, so the instant it releases nothing holds the door at all. That is why magnetic locks on escape routes come with additional release means, such as a sensor or push button on the inside and a connection to the fire alarm, and why many jurisdictions regulate them separately.

Electrified mortise and cylindrical locks. The latch and the inside lever are mechanical, as on any lock. The electricity controls whether the outside lever retracts the latch. Both modes are made, and on many products the mode is set inside the lock body before delivery, so it has to be stated on the order. The inside lever retracts the latch whatever the power is doing.

Electrified exit devices. Panic and fire exit devices are electrified in two different ways that are easy to confuse. Electrified trim does the same job as on a lock: it decides whether the outside lever works, and it comes fail-safe or fail-secure. Electric latch retraction pulls the latch in so the door can be pushed from inside or pulled from outside without operating anything, the electric equivalent of dogging. When its power drops the latch projects again and the door latches on its next closing; whether the outside is then locked depends on the trim. The bar on the inside opens the door in every case.

Why fail-secure does not lock anybody in

The usual objection to fail-secure is that it traps people during a power cut. On a lock with mechanical free egress it does not, because the electricity never acted on the inside. The solenoid or motor sits between the outside lever and the latch. The inside lever, or the push bar of an exit device, is linked to the latch mechanically and retracts it every time it is operated. Losing power changes what happens to someone outside the door and changes nothing for someone inside.

So on an escape door fail-secure is not a compromise. The outside stays locked, which is what a perimeter door or a storeroom needs during a power cut, and the inside stays free, which is what the escape route needs. What fail-secure does need is a mechanical key override on the outside: without one, nobody can open the door from outside until the power comes back. The device that cannot work this way is the magnetic lock, or anything else that holds the door with no mechanical release on the inside. Its egress depends entirely on the power being cut, which is why it can only be fail-safe.

Fire doors, stair doors and the fire alarm

A fire door has a different job from an escape door. An escape door must let people out. A fire door must stay closed and latched during a fire, because a leaf held only by a closer against a frame that is distorting in the heat is not a barrier. So on a fire door the question is not only whether the outside is locked but whether the latch is still engaged.

This is where a strike and a lock behave differently. A fail-safe strike releases the latch when the power fails, and the power often fails in a fire, so the door is left unlatched at the moment it most needs to latch. Strikes intended for fire doors are therefore generally fail-secure, with the lock in the door providing egress. A fail-safe electrified lock is different: only the outside lever is freed, while the latch keeps projecting and the door keeps latching. That is how a fire door can be fail-safe and still latch.

Stair doors show why this matters. Many codes allow stair doors to be locked from the stair side so people cannot wander onto other floors, but require them to unlock on fire alarm or power failure, so that someone in a stair filling with smoke can get back onto a floor. The usual answer is a fail-safe electrified lock: the latch stays engaged, and on alarm the stair-side lever is released. The exact rule, and which floors it applies to, comes from the local code and the authority having jurisdiction, not from the hardware.

The fire alarm is the other release path. In a typical installation the alarm signal cuts power to the fail-safe devices on the escape routes, and the same signal releases electromagnetic hold-opens so that fire doors close. A battery backup keeps a fail-safe lock locked through an ordinary power cut, which is often wanted on perimeter doors, but the fire alarm must still be able to cut the lock's power, so the two are wired with that priority. Fail-secure devices do not respond to a power cut, so on those doors responders need a key or another means of entry. In Europe, a door that is locked electrically and released electrically on an escape route falls under EN 13637, the standard for electrically controlled exit systems; where electricity only controls the outside or monitors the door and the inside opens with a mechanical bar or lever, the device remains an EN 1125 or EN 179 device.

How to state it on an order

Voltage deserves its own sentence. Electrified hardware is commonly made for 12 or 24 volts DC, some of it dual voltage, and the figure on the order must match what the power supply delivers to the door. Current draw is published per product, and the supply has to be sized for every device it feeds at once, including the fail-safe devices that draw current all day.

Getting the wire into the door

Apart from strikes and magnetic locks, the electrical component sits in the door leaf, and the leaf moves. The cable has to cross the hinge side of the gap without being pinched or flexed to failure. There are three common ways: an exposed door loop, an electrified hinge, or a concealed power transfer device. Our EPT01 is of the last kind. Its record describes a 316 stainless steel unit that mounts in the edge of the door and the frame, with a flexible steel conduit protecting a cable bundle up to Ø5/16 in (8 mm). It is non-handed, finished in satin stainless steel 630/US32D, and its record names butt hinges, continuous hinges and pivot hinges with an offset under 3/4 in (19 mm). With the door closed it is out of sight; with the door open, the conduit shows in the gap. A power transfer device carries wires and nothing more. It does not decide fail-safe or fail-secure and it does not make a lock electrified. Count the conductors the lock, its monitoring switches and any request-to-exit switch need, and check that the bundle fits the transfer device before the order goes in.

Common mistakes

Three questions per opening settle most of this: what must the outside do when the power fails, what must happen when the fire alarm sounds, and is it a fire door. Answer those three on the schedule and the device, the mode and the order line follow from them.