Fail-secure and fail-safe describe what a door’s locking hardware does when electrical power is removed — by a power failure, by a fire alarm control panel relay output activating on alarm, or by a deliberate access control system command. The terms are used correctly in some security specifications and swapped inadvertently in others. The consequence of getting them wrong is not a programming error that can be fixed in software. It’s a door that traps occupants during a fire or a door that unlocks all night because a relay de-energized at midnight.
The definitions — what each hardware state actually does
A fail-secure door remains locked when power is removed. The credential-controlled device — electric strike, magnetic lock, or electrified mortise lock — holds the door closed without power. This is the preferred configuration for perimeter security doors, server room entries, and access points where unauthorized entry is a greater risk than the possibility of occupant entrapment. Fail-secure hardware keeps intruders out even when the power fails.
A fail-safe door unlocks when power is removed. The locking device releases without power. This is required for doors in the means of egress — any door that serves as the path for building occupants to exit — because the life-safety requirement is that occupants must be able to leave regardless of system state. An egress door that locks occupants in during a power failure is a life-safety violation under IBC Section 1010 and NFPA 101 Section 7.2.1.
Code requirements by door type and egress path
IBC Section 1008.3 and NFPA 101 Section 7.2.1.6 both address electrically controlled egress doors. The governing requirement: any door in the required means of egress that uses electrical hardware to control the locked/unlocked state must either fail safe on loss of power, or be equipped with a fire alarm system interface that releases the door on alarm — or both. The code does not prohibit fail-secure hardware on egress doors; it requires that fail-secure egress doors have a supervised fire alarm interlock that unlocks the door when the alarm activates.
In practice, the code creates three categories for access-controlled egress doors:
- Fail-safe hardware, no interlock required: The door unlocks on power loss. No separate fire alarm connection is needed because the door will always be passable in an emergency.
- Fail-secure hardware with fire alarm interlock: The door remains locked on power loss but releases when the fire alarm activates. This requires a supervised relay connection from the fire alarm control panel to the locking device. The FACP, not the access control panel, controls the unlock state during alarm.
- Fail-secure hardware with local release only: Permitted in certain low-occupancy exceptions under IBC Section 1008.3. Rare in commercial construction; requires AHJ review.
The fire alarm interlock for a fail-secure egress door is a supervised circuit from the fire alarm control panel to a relay that controls power to the locking device. When the FACP goes into alarm, the relay releases and the door unlocks. This circuit must be supervised — the FACP must continuously monitor the connection and report a trouble condition if the circuit is open or shorted. An access control panel relay is not an equivalent: it does not have the supervised circuit integrity required by NFPA 72 for life-safety signal path wiring. This means every fail-secure door on an egress path needs a dedicated fire alarm relay, not just an ACS-controlled output, for code-compliant interlock.
Hardware types — what each one does on power loss
| Hardware type | Default fail behavior | Can be reversed? | Common application |
|---|---|---|---|
| Electromagnetic lock (mag lock) | Fail safe — releases on power loss | No; inherently fail-safe by design | Lobby doors, egress vestibules |
| Electric strike, fail-safe model | Fail safe — unlatches on power loss | Yes; fail-secure models are a separate SKU | Low-security interior doors, egress points |
| Electric strike, fail-secure model | Fail secure — stays locked on power loss | Yes; fail-safe models are a separate SKU | Server rooms, secure offices, exterior perimeter |
| Electrified mortise lock | Fail-secure typical; fail-safe available | Yes — must be specified at order time | High-cycle exterior doors, secure areas |
| Electrified panic device (REX integrated) | Egress always available; lock varies | N/A — mechanical egress release always works | Exit-only stairwell doors, exit corridors |
The specification error that creates change orders
The specification error that creates a change order is specifying “electric strike” at an egress door without specifying fail-safe or fail-secure — or specifying “fail-secure throughout” without identifying which doors are on egress paths and therefore require either fail-safe hardware or a fire alarm interlock. A bid that doesn’t account for the FA interlock wiring, relay hardware, and FACP programming at every fail-secure egress door is missing a real cost item. The installing contractor will price it as a change order after award.
The fire alarm interlock coordination also affects panel I/O capacity. Every fail-secure egress door that requires a supervised relay adds a supervised output to the fire alarm control panel’s I/O count. The access control panel capacity post covers how I/O demands affect panel sizing at design time. The same principle applies to the FACP: if the relay outputs for egress door interlocks exceed the panel’s standard I/O capacity, an expansion module is required — a cost that must be in the design, not the change order log. The parallel to anti-passback and tailgating detection — two requirements that look similar but require different hardware — is covered in the anti-passback vs tailgating detection post: hardware requirements that aren’t separately specified and separately priced become change orders.
Magnetic lock specific requirements — request-to-exit devices
Fail-safe doors with magnetic locks have an additional requirement: the locking device must have a request-to-exit (REX) device — typically a PIR motion sensor or a push-button release — that allows occupants to exit without a credential. IBC requires that egress doors with electrified locking hardware be openable from the egress side without a key, credential, or special knowledge. A mag lock with no REX sensor creates the same life-safety problem as a fail-secure door with no fire alarm interlock. The REX sensor, its power source, its connection to the access control panel, and its positioning within the detection zone of the door are all required to be correctly specified and installed for the egress configuration to be compliant.
Coordination between access control and fire alarm specifications
For buildings where access control and fire alarm are specified together — which covers most new commercial construction and major renovations — the interface between the two systems at every egress door should be explicitly coordinated in the specifications and confirmed in the submittal review. The fire alarm contractor’s scope includes the supervised relay wiring and FACP programming for the interlock. The access control contractor’s scope includes the door hardware, the reader, the wiring to the relay, and the ACS programming. Neither scope alone covers both sides of the interface.
Our access control services for Atlanta and Southeast commercial buildings include the fire alarm interface specification that ensures every fail-secure egress door has the correct supervised relay, the correct REX configuration, and the correct FACP programming before the commissioning test that the AHJ witnesses. Our fire alarm services cover the supervised relay wiring and panel programming that the access control contractor’s scope typically excludes. Coordinating the two scopes at specification time prevents the gap that becomes a CO hold when commissioning reveals missing interlock wiring.
Specifying access control with fire alarm interlock in Atlanta or the Southeast?
We design and install access control and fire alarm systems for commercial buildings in Atlanta and the Southeast — including the egress door hardware specification and fire alarm interlock coordination that ensures every fail-secure door is code-compliant before the AHJ commissioning test.