Every access-controlled door has an answer to one question: when the power dies, does it hold or does it release? Choosing wrongly produces either a door that traps people or a building that unlocks itself, and the decision is frequently made by whoever installs the lock rather than by anybody thinking about it.
One caution before the detail: escape-route requirements are a life-safety matter governed by your fire clearance and local requirements. Nothing here replaces that — confirm every escape door against the authority that signs off your building.
What the two terms actually mean
Fail-safe (also called fail-open) means the lock needs power to stay locked. Cut the power and it releases. The name refers to human safety: people can always get out.
Fail-secure (fail-closed) means the lock needs power to release. Cut the power and it stays locked. The name refers to asset security: the door holds.
The confusion is that both names sound reassuring, so they get used interchangeably in conversation and occasionally on quotes. Insist on which mode is specified per door, in writing.
Escape routes decide it, not security
On any door forming part of an escape route, the requirement is that people can leave without power, without a credential and without instructions. In practice that means either a fail-safe lock, or a fail-secure lock combined with mechanical free egress — a push bar or handle that always opens from the inside regardless of the electronics.
This is not a security-versus-convenience trade-off to be negotiated. It is a life-safety requirement, and it is also the aspect most likely to be raised when your fire clearance is inspected. Decide it against the escape plan for the building, then let security requirements arrange themselves around it.
The practical consequence: on escape doors, controlled entry is what you are buying. Exit is always available.
Where fail-secure belongs
Doors that are not on an escape route and protect something specific:
- Stores, spares and finished-goods rooms, where a power cut should not open the room.
- Server and control rooms, for the same reason.
- Cash-handling and document rooms.
- External gates and perimeter doors not designated for escape.
On these, fail-secure is correct precisely because a mains failure is a plausible prelude to an intrusion attempt, and a lock that opens on power loss is a lock that can be defeated by pulling a fuse.
The failures that catch sites out
- A fail-secure lock on an escape door with no mechanical egress. The serious one. It can trap people, and it is the configuration most likely to be found non-compliant.
- Fail-safe locks throughout, chosen for simplicity, which means the whole building unlocks in an outage — frequent in this region.
- No integration with fire detection. Where the design requires doors to release on a fire alarm, that link is a physical interface that must be installed and tested, not a setting somebody assumes.
- Backup that protects the controller but not the locks, so the system reports itself healthy while doors behave as if unpowered.
- Nobody testing it. The only way to know what your doors do on power loss is to cut the power deliberately and walk them. Almost no site has done this since handover.
What to confirm on every controlled door
Ask for a door schedule — one line per door — stating:
- Whether the door is on an escape route
- Lock mode: fail-safe or fail-secure
- Means of free egress, if fail-secure
- Whether it releases on fire alarm, and how that link is made
- Whether the lock is on backup power, separately from the controller
- When the power-loss behaviour was last physically tested
That document is worth more than any specification sheet. It is also the thing an inspector, an insurer or a new facilities manager will ask for, and the site that has it is the site that knows what its own doors do.
Common questions
Which mode is safer overall?
Neither, in the abstract - they answer different questions, and a building normally needs both. What is unsafe is not knowing which mode each door is in. The correct approach is a door-by-door decision driven by the escape plan first and asset protection second.
Do access-controlled doors have to unlock in a fire?
Where a door forms part of an escape route, occupants must be able to leave without power or a credential - achieved either by the lock releasing or by mechanical free egress. The specific requirements and any fire-alarm interface come from your fire clearance and local rules, so confirm the design against them rather than relying on general guidance.
How do we test what our doors currently do?
Deliberately, on a planned window: isolate the supply and physically walk every controlled door, from both sides, recording what happened. It takes an hour or two on most sites and it routinely finds at least one door behaving differently from what the drawings say.