Fail-Safe vs Fail-Secure Locks: How to Choose for Each Door

A fail-safe lock releases when power is removed. A fail-secure lock stays locked. Where egress depends on electrical release, select a permitted locking arrangement and hardware that releases under its required failure conditions; a fail-safe label alone does not make a door safe. Use fail-secure hardware where the door must stay secure without power and people inside can still leave by hand with a lever or panic bar. Fire-rated doors must retain positive latching: this often means a fire-listed fail-secure strike, but fail-safe electrified trim can release entry while leaving the latch engaged.

Definitions: what each lock does when power is lost

A fail-safe lock is sometimes called “power to lock”: current holds it locked, and removing current releases it. A fail-secure lock is “power to unlock”: it stays locked until current is applied. Both terms describe the secure (access) side of the door. On a code-compliant egress door, people must still be able to leave from the inside whatever the electric lock is doing, either mechanically or through a code-approved electrical release.

	Fail-safe	Fail-secure
Also called	Power to lock	Power to unlock
With power removed	Unlocked	Locked from the access side
Normal locked state	Energized continuously	De-energized
Current draw	Continuous while locked	During unlocking / held-unlocked operation; motor-driven models vary
Dry relay contacts (de-energized while locked; energizes to unlock)	COM + NC	COM + NO
Typical hardware	Maglocks, most drop bolts, fail-safe strikes and trim	Fail-secure strikes, electrified locksets, cabinet locks
During a power outage	Releases when lock power is lost; an approved battery arrangement may retain power	Entry stays locked; mechanical entry override if fitted
Main risk	Security gap during outages	Lockout, and trapping if no mechanical egress exists

NO and NC terminology, and why vendors disagree

NO (normally open), NC (normally closed) and COM (common) are relay-contact terms. They describe the contact when the relay is at rest, with its coil de-energized. On most access controllers, the lock relay sits at rest and energizes only for the unlock time after a valid credential or exit request.

The confusion starts when the same letters appear on locks. Some datasheets call a fail-safe lock “NO” because the door is open (unlocked) with no power. Others call it “NC” because it is closed (locked) in normal operation, or because it wires to the NC terminal. Fail-secure locks get the opposite labels, and not always consistently. Mix-ups are most likely with drop bolts and electric strikes, because both come in fail-safe and fail-secure versions.

In specifications and purchase orders, write the behavior rather than the letters: “locked with power applied, unlocked with power removed (fail-safe)”. For a dry relay that is de-energized while locked and energizes to unlock, wire by behavior:

• Fail-safe → COM + NC. Current flows at rest, so the door is locked. On a valid credential or exit request the relay energizes, NC opens and the lock releases.
• Fail-secure → COM + NO. No current flows at rest, so the door is locked. On a valid credential or exit request the relay energizes, NO closes and the lock releases.

A few controllers can be set to hold the relay energized at rest, which swaps the terminals, so check the relay mode before wiring. Powered and transistor outputs need their own diagrams. For example, on Altronix ACM powered outputs, COM is the negative return; the separate C terminal is the common for a dry-contact configuration. Never jumper positive power to a terminal solely because it is marked COM.

Which lock types are fail-safe, fail-secure or both

Lock type	Fail-safe	Fail-secure	Notes
Electromagnetic lock (maglock)	Always	Not possible	Holds only while current flows; no mechanical latch
Electric drop bolt	Common	On some models	Some models have a selectable mode; with no mechanical inside release, egress depends on power release
Electric strike	Available	Available; fire listings commonly require this mode	Check the exact strike listing and lockset; preserve mechanical free egress
Electrified mortise or cylindrical lockset	Available	Available	Controls the outside lever; the inside lever normally gives free egress
Electrified trim on an exit device (panic bar)	Available	Available	The push bar always gives mechanical egress
Cabinet and locker solenoid locks	Available	Common	For furniture and enclosures, not egress doors

The practical consequence: a maglock cannot be fail-secure. Battery backup keeps a maglock holding through a mains failure, but it releases when its DC supply stops. Any required power-interruption release must remove that battery-backed power as well. If a door must stay locked through a total power loss, choose a fail-secure strike or lockset with mechanical egress. Magnetic locks can suit doors with an accepted electrical egress-release arrangement. Electric bolt locks suit glass and double-swing doors, and you should confirm the fail mode of the exact model before ordering.

Life-safety, egress and fire alarm release considerations

For each door, identify its egress role, fire rating, required re-entry and the means of opening it from inside. Free egress generally cannot require a key, tool or special knowledge.

• Mechanical free egress. A suitable inside lever or panic bar retracts the latch independently of the entry-control electronics. Fail-secure entry control can work in this arrangement.
• Sensor-release electrical locking. The adopted code can require an approach sensor, release on specified power failures, a nearby labeled manual device that interrupts lock power independently for at least 30 seconds, and fire-alarm / sprinkler release. Confirm the required location, duration and reset behavior for the applicable edition.
• Door-hardware-release electrical locking. An obvious, readily operated lever or exit device directly interrupts lock power when operated. This is a separate permitted arrangement with its own conditions; a button that merely sends REX to a controller is not equivalent.

These are two common US arrangements discussed by ICC and UL, not interchangeable component lists. Delayed or controlled egress has additional restrictions. Specify the arrangement before buying a sensor, button or lock.

Required emergency release must also work on battery. Use the manufacturer’s approved release circuit or fire-alarm interface. It must remove power from the relevant power-to-lock outputs even with AC absent. A contact that opens on alarm can perform that function, but terminal names alone do not establish its alarm behavior: interfaces can accept NO, NC or a voltage trigger. Follow both the power-supply and fire-alarm design, then test the actual failure states.

Fire-rated doors must retain positive latching. Many fire-rated electric strikes, including the HES 1500 series, are fire listed only in fail-secure mode. Confirm the specific strike, door assembly and permitted preparation. Fail-safe electrified trim or a lockset can free the outside lever while its latch remains engaged, including on stair doors requiring re-entry. A maglock provides no positive latch and cannot replace required fire-door latching.

In Europe, EN 179 and EN 1125 address mechanical emergency / panic exit devices; EN 13637 addresses electrically controlled exit systems. Fire-door changes must match the assembly’s applicable test and certification evidence, including EN 1634-1 where specified. In North America, request the exact product listings required by the adopted code and arrangement; UL 294 and UL 1034 have different scopes, and current model-code provisions can permit either for specified locking equipment. The AHJ must accept the complete door arrangement, not just one component’s certificate.

Door-by-door decision table

Door	Usual choice	Why
Main entrance on an egress route (glass or aluminum storefront)	Fail-safe lock with an approved electrical release arrangement, or a fail-secure strike or exit device trim with mechanical free egress	Depends on how the door opens from the inside
Fire-rated stair or corridor door	Fail-secure strike or electrified lockset listed for fire doors; fail-safe trim where re-entry is required	The door must stay latched in a fire
Server room, cash office, pharmacy store or stock room	Fail-secure strike or lockset with key override	Stays secure during outages; occupants leave by the inside lever
Interior office door (not fire-rated)	Either; a fail-secure strike draws less power	Decide on security need and existing hardware
Frameless glass door	Fail-safe glass-door drop bolt, or maglock with a glass-door bracket	Check that the complete electrical egress arrangement is permitted
Outdoor pedestrian gate	Fail-secure with mechanical egress hardware on the inside, plus battery backup	Stays secure during outages; confirm whether it is an egress path
Cabinets, lockers and key boxes	Fail-secure solenoid lock	Not an egress path

Power supply and battery backup implications

The two fail modes put very different loads on the power supply.

• Fail-safe locks draw current all the time. Size the supply’s continuous rating for every fail-safe lock plus the controllers and readers on it. Suppose, as an illustration, a lock draws 0.5 A and the controller and reader together draw 0.3 A: a 7 Ah battery then gives roughly 8–9 hours in theory, and less once you allow for battery age and temperature. Use datasheet values for your own figures. When the battery runs out, fail-safe doors release.
• Fail-secure locks draw current only while unlocked. A door held unlocked on a schedule becomes a continuous load, though, so check that the strike or lockset is rated for continuous duty. Battery backup keeps readers working in an outage, and without it, entry depends on a key override.
• Where fire-alarm release is required, interrupt the battery-backed lock output, not just the AC input.
• Use individually fused or PTC-protected lock circuits within the supply manual’s limits, and measure the voltage at the lock while it is energized. Long, thin cable runs can drop a 12 V DC lock below its rated voltage.
• Follow the lock’s suppression instructions. Do not automatically add a diode: Securitron M32/M62/M82B locks use internal circuitry and explicitly reject a parallel reverse diode because it interferes with quick release.

Our access control power supplies cover typical lock loads. For the full calculation, see how to size an access control power supply and battery backup.

Wiring differences, with diagram

The diagram compares basic dry-relay contact logic for a relay that energizes to unlock. It is not a complete egress design: the selected release arrangement, monitoring and any required independent release paths must be added using the equipment manuals.

Three details matter more than the diagram suggests:

1. REX is not the independent release. A controller REX input can log an exit request and shunt an alarm. Where a direct timed power interruption is required, use an approved release device / circuit; an ordinary momentary button or controller unlock timer does not establish the required independent duration.
2. The controller’s relay is a dry contact. Lock current flows through the relay contact but comes from the lock supply. Check that the lock current is within the relay contact rating. Networked door controllers list this rating per relay.
3. Test the complete door. Verify free egress, each required sensor / hardware / manual release, lock-system power failures and any required alarm release, including operation on battery. Test the specified relock and reset behavior as well.

For complete maglock, exit button and reader wiring, see our magnetic lock wiring diagrams.

Pre-installation checklist

• List every door, and mark whether it is on an egress path and whether it is fire-rated.
• For each door, record how occupants open it from the inside: mechanically, or by electrical release only.
• Specify the fail mode in words on the schedule and the purchase order, not as “NO” or “NC”.
• On electrically released egress doors, document the accepted arrangement and all of its release / failure conditions; distinguish REX signaling from independent release.
• On fire-rated doors, preserve positive latching and use hardware permitted by the assembly and the exact product listing.
• Check dry versus powered output terminals, relay logic and contact ratings before selecting NC / NO.
• Size the supply for operating and simultaneous peak loads, charging and temperature limits; calculate the specified battery standby load separately.
• Verify that every required release interrupts battery-backed lock power.
• Apply only the suppression specified for the exact lock and controller.
• Test each door’s required release and failure states, on AC and battery, with relock / reset supervision.

Next steps

Send us your door schedule with the door type, fire rating, egress direction and lock voltage for each door. We will match fail-safe or fail-secure locks, brackets, exit buttons and power supplies to it, and confirm compatibility before we quote. Request a quote or samples, and we will reply within 24 hours.

Sources

• ICC: electrically locked egress arrangements and UL: locking configurations and code editions.
• HES: fail-safe versus fail-secure and 1500 series fire listing.
• Securitron M32/M62/M82B installation manual, sections 5.3.1–5.3.3; Altronix ACM manual: powered / dry outputs and fire-alarm interface.
• BSI: EN 13637 scope; EN 1634 series.