Fail-safe and fail-secure electrified locksets differ by one decisive function: whether removing power releases the secure side of the door.
Fail-safe hardware requires continuous power to remain locked, while fail-secure hardware requires power to unlock, making the correct choice an opening-level life-safety and security decision.
Power-State Logic and Egress Behavior
A fail-safe lock releases when electrical power is removed, permitting entry from the secure side without a credential or key; power is required to hold it in the locked state [S1][S3]. A fail-secure lock remains locked when power is removed and requires power to retract its locking element [S1][S3].
Fail-safe and fail-secure describe the state of the secure side, not necessarily the direction of occupant egress [S2]. Most electric strikes and electromechanical locksets retain independent mechanical free egress, so the outside or secure-side behavior must not be confused with the inside release path [S2].
All electrified locking devices use either power-to-lock or power-to-unlock architecture [S4]. A fail-safe magnetic lock can be described electrically as using a normally closed circuit or continuous energization to remain locked, while a fail-secure electric strike uses a normally open arrangement that unlocks when the access-control circuit is completed [S4].
Decision Criteria for Electrified Hardware
Fail-safe is appropriate where loss of the access-control or building-power system must not prevent movement along an egress route, such as stairwell re-entry doors, corridor doors serving exit stairs, and some healthcare patient-room openings [S3]. It is also used where a fire-alarm relay must release the lock automatically [S3][S4].
Fail-secure is appropriate where an interruption must not create unauthorized entry, including server rooms, IT closets, data centers, pharmacy and medication storage areas, utility rooms, and high-value back-of-house spaces [S3]. It also fits openings where controlled medication or equipment storage must remain locked independently of the building power supply [S3].
The comparison is straightforward: fail-safe prioritizes free passage and requires continuous power to maintain security, while fail-secure prioritizes perimeter control and requires power to grant access. Neither mode alone settles the specification. The opening's egress function, exposure, alarm interface, and local approval determine the result [S3].
Use architectural hardware terminology consistently on the schedule, but do not treat fail-safe and fail-secure as interchangeable product categories. The schedule and submittal should identify the required power-loss state for the secure side separately from the required inside egress operation.
Fail-Safe, Fail-Secure, and Free Egress
Fail-safe does not automatically mean safe egress, and fail-secure does not automatically mean blocked egress. An electric strike can be either fail-safe or fail-secure while the operating lockset or panic hardware continues to provide free egress from the inside [S2].
Double-cylinder institutional-function locksets do not provide free egress, whether mechanical or electromechanical, and should not be used on doors required for egress [S2]. A classroom-security configuration with two key cylinders can still provide free egress, so cylinder count and institutional function must be reviewed separately from the lock's power-failure state [S2].
For a power-to-unlock electromechanical lock, a power failure leaves the secure side locked, but a separate mechanical egress function can still release the inside handle. This configuration can therefore combine fail-secure perimeter behavior with free inside egress [S2][S3].
Fire-Rated Doors and Alarm Interfaces
Electric strikes on fire-rated doors must be fail-secure because a fail-safe strike does not provide the positive latching and listings required by NFPA 80, Standard for Fire Doors and Other Opening Protectives [S2]. Fire-door hardware selection should therefore be coordinated with the complete opening assembly, not treated as an isolated access-control decision.
Fail-safe locks may be designed to release on a request-to-exit input, a fire-alarm signal, or loss of power [S4]. A fail-secure lock remains locked until the access controller completes the unlocking circuit following a remote command or valid entry attempt [S4].
Fail-safe and fail-secure terminology does not override the applicable authority having jurisdiction. The local fire marshal and the adopted building, life-safety, and fire-door requirements must be checked before ordering a magnetic lock or electric strike [S4]. A power interruption can therefore produce a deliberate release, while an alarm interface adds a separate, controlled release path that must be tested as part of the installed system.
Operational Tradeoffs and Maintenance
Fail-secure locks generally require less maintenance and can cost slightly less to operate than fail-safe alternatives [S6]. The more important lifecycle variable is electrical state: fail-safe hardware depends on continued energization to maintain its locked condition, whereas fail-secure hardware maintains its secure state without power.
Fail-safe selection should include a power-quality review, standby-power strategy, and a coordinated power-loss test. Relevant failure inputs include a tripped branch circuit, fire-alarm relay operation, and loss of the lock power supply [S3]. A UPS or standby supply can address ride-through requirements, but it does not change the underlying power-to-lock architecture.
Fail-secure selection should account for controlled release and responder procedures because a power or system failure leaves the secure side locked [S3]. For critical rooms, the access-control sequence, audit trail, emergency override, and mechanical key procedure should be documented before the hardware is approved. Hospital access-control planning can be coordinated through hospital architectural hardware guidance.
Specification Checklist for the Opening
Specify the desired state on loss of power as fail-safe or fail-secure, then identify the secure side, inside egress method, opening classification, and alarm interface [S1][S2]. For an electric strike, state whether the independent mechanical egress function remains available. For an electromechanical mortise lock, state whether the inside lever or handle provides free egress.
On a fire-rated opening, document the positive-latching requirement and the applicable listed assembly. The electric strike on that opening must be fail-secure under the guidance cited for NFPA 80, and the complete door assembly still requires coordinated review [S2].
For a controlled-area opening, record what happens on power loss, fire-alarm release, request-to-exit activation, and access-controller failure. The final submittal should also identify whether the lockset is fail-safe or fail-secure, rather than relying on generic references to electric hardware.
The trackable decision is the opening schedule: each row should show one power-loss state, one egress method, and one alarm response. A mixed schedule with no specified secure-side state leaves the installer to infer a function that determines both power consumption and emergency behavior.