Blog

Fail-safe means a device unlocks when power is lost, and fail-secure means it stays locked when power is lost. The choice is a life-safety and security decision made per opening, not per building. One rule resolves most doors: fire, egress, and stair doors that must release on alarm are fail-safe, while perimeter and secured interior doors are fail-secure, because a fail-secure door still allows free mechanical egress from the inside through the lever or panic bar even while it stays locked to the outside. Maglocks are the exception, because they have no mechanical override, so a maglock is always fail-safe and always needs a separate code-compliant release. This guide gives the fail-mode decision for every common electrified device, explains the fire-door rule that overrides preference, and shows how fail mode drives the power supply you order.

What fail-safe and fail-secure actually mean

Fail-safe (fail-unlocked): no power means unlocked. Used where the door must release for egress or fire response. Fail-secure (fail-locked): no power means locked. Used where security must hold through a power failure. The trap is assuming fail-secure means people get trapped. On a door with an electric strike or electrified lock, the inside lever or panic bar always retracts the latch mechanically, so egress is free regardless of fail mode. Fail-secure only controls the outside access and what happens to the powered element. The only devices that truly lock egress on power loss are maglocks, which is exactly why they carry extra code requirements.

Fail mode by device class

This table sets the default fail mode for each common electrified device, the reason behind it, and what happens to egress when power is lost.

Device	Default fail mode	Why	Egress on power loss
Electric strike (most)	Fail-secure	Door stays locked outside; inside lever frees the latch mechanically	Free (mechanical lever)
Electric strike (fire-rated frame)	Fail-secure required	Fire doors must stay positively latched	Free (mechanical lever)
Electrified mortise / cylindrical lock	Field-selectable	Set per opening; most secured doors fail-secure	Free (inside lever always)
Electromagnetic lock (maglock)	Fail-safe (always)	No mechanical override, so it must release	Requires REX and power-loss release
Electric latch retraction (panic)	Fail-secure (latch re-projects)	Exit device always allows push-bar egress	Free (push bar)
Delayed egress maglock	Fail-safe with timer	Releases after 15s or on alarm/power loss	Free after delay or alarm
Electrified exit device trim	Fail-secure	Outside trim locked; inside bar always exits	Free (push bar)

The pattern is clear: anything with a mechanical inside lever or push bar is usually fail-secure, because egress is already guaranteed mechanically and fail-secure preserves security through outages. A Trine 3258 fail-secure electric strike holds the door locked through a power loss while the inside lever still exits. By contrast, a Schlage ND96 fail-safe electrified storeroom lock unlocks the outside on power loss for doors that must release. Anything that physically holds the door shut with power (maglocks) must be fail-safe and needs an independent release. For the electric strike side, see how to choose an electric strike and electric strike vs maglock detailed comparison. For electrified locks, see the electrified mortise lock complete guide and electrified cylindrical locks specification guide.

The fire-door rule, which overrides preference

Fire-rated openings must remain positively latched to contain fire and smoke, and that forces two requirements:

• Electric strikes and electrified locks on fire doors must be fail-secure. A fail-safe strike on a fire door would unlatch on power loss and defeat the rating.
• Maglocks are generally not permitted as the latching mechanism on fire-rated doors, because they hold the door rather than latch it.

This rule is non-negotiable, and it is part of why annual inspection matters. See NFPA 80 annual fire door inspection for the compliance context, and the BHMA A156 series cheat sheet for the broader standards map.

Why a maglock is always fail-safe

Where access control is handled by an electromagnetic lock, the device holds the door shut only while it is powered, so on power loss it must release. That makes a maglock always fail-safe. Because the door is then held only by an electromagnet, codes (IBC, NFPA 101) require redundant, immediate egress on every maglock door:

• A request-to-exit (REX) device or motion sensor that drops power on approach.
• A push-to-exit button that cuts power directly to the magnet, not just a request to the panel.
• Power-loss and fire-alarm release, so the magnet drops on alarm and on loss of power.

Specify all three on every maglock egress door. See how to choose a magnetic lock (maglock), how to choose a request-to-exit device (REX), and what is magnetic locking and how does it work. The delayed-egress variant of this control is specified on cash-handling perimeters in bank and credit union door hardware and on wander-risk units in senior living and behavioral health door hardware.

How fail mode drives the power supply spec

Fail mode changes the current-draw profile and therefore the power supply you order. Fail-safe devices draw power continuously to stay locked, while fail-secure devices draw power only to release, so the two have very different continuous loads. On fail-safe doors you must size for continuous hold current plus battery backup, because the door has to stay locked under normal conditions and release cleanly on outage. See how to choose an access control power supply for sizing the supply to the load.

Common fail-mode mistakes

1. Fail-safe strike on a fire door. It defeats positive latching and fails NFPA 80. Use fail-secure.
2. Maglock on a fire-rated door as the latch. Not code-compliant. Use a fail-secure strike or electrified exit device.
3. Maglock without independent push-to-exit. A REX request through the panel is not enough; egress must cut magnet power directly.
4. Assuming fail-secure traps occupants. The inside lever or push bar always frees the latch mechanically, so egress is independent of fail mode.
5. Undersizing the power supply for fail-safe loads. Continuous hold current plus battery backup must be calculated, not guessed.

How fire alarm and access control drive fail mode

Fail mode is not just a property of the lock, it is a behavior the building triggers. Under NFPA 72 and NFPA 101, any fail-safe opening on a path of egress must release the moment the fire alarm signals, because the alarm interface drops power to the device. That is why electrified hardware on stair doors and cross-corridor doors is usually fail-safe: it has to allow stairwell re-entry and free movement during an alarm. A fail-secure opening on a non-egress side can stay locked, but it still must never trap an occupant on the egress side.

On the access-control side, fail mode lives next to two signals. A request-to-exit (REX) device releases the door for someone leaving and suppresses a forced-door alarm, and a door position switch tells the panel whether the door is actually closed and secured. Reading those two signals together is what keeps the audit trail honest, regardless of whether the lock is fail-safe or fail-secure.

Listings and voltage to put on the schedule

Two UL listings belong on the hardware schedule. UL 294 covers access-control system units and is the listing to look for on electric strikes, electrified locks, and controllers. UL 1034 covers burglary-resistant electric locking, which matters where the opening is also a security boundary. Most electrified hardware runs on 12V or 24V DC, and the voltage, current draw, and fail mode together drive the power supply and battery-backup sizing, so all four belong in the same line of the spec rather than scattered across sheets.

FAQ

Is fail-safe or fail-secure safer?

Neither is universally safer. They solve different problems: fail-safe protects egress and fire response, while fail-secure protects security through outages. The code and the door role decide, not preference.

Does fail-secure mean people get locked in?

No. On strikes and electrified locks, the inside lever or panic bar always retracts the latch mechanically, so egress is free. Fail-secure only governs the powered, outside side. Only maglocks, which have no mechanical override, require a powered release for egress.

Can I use a maglock on a fire door?

Generally no, not as the latching mechanism. Fire doors must positively latch, which maglocks do not do. Use a fail-secure electric strike or electrified exit device instead.

Why is my maglock fail-safe when I want it secure?

Maglocks have no mechanical latch, so they must release on power loss for life safety. If you need a device that stays locked through a power loss, use a fail-secure electric strike or electrified lock rather than a maglock.

How do I document fail mode on a hardware schedule?

Note the fail mode per opening alongside the device type, the egress method (mechanical lever, push bar, or REX), and the release triggers. Doing it per opening prevents the building-wide assumptions that cause code failures.

Next step

Set fail mode per opening: fail-secure for secured interior and perimeter doors with a mechanical inside lever or panic bar, fail-safe (with REX, push-to-exit, and alarm or power release) for maglocks, and fail-secure for any fire-rated opening. Browse electric strikes, keypad and proximity locks, and panic exit devices. Our commercial desk sets fail mode per opening and sizes the access-control power supply to match.