Distinguishing fail-safe from fail-secure behavior

What you should be able to do

State the power-loss behavior of an identified locking function without confusing it with egress, a general equipment failure or loss of building AC.

Teaching Narration

For the locking functions addressed here, fail-safe means the electrically controlled side is unlocked when power to the locking device is removed. Fail-secure means that side remains locked without that power. Name the device, function and side when using either term.

These names do not describe every possible failure. A jammed mechanism, damaged door, misaligned latch or controller fault is not the same test condition as removing power from a specified device. Avoid the vague phrase "when the system fails" if the intended condition is loss of lock power.

Entry security and exit operation are separate questions. Manufacturer guidance explains that many fail-secure entry products still permit mechanical free egress. The word secure does not automatically mean people are trapped inside. Likewise, the word safe does not certify the complete opening or prove compliance with all required releases. Confirm the actual inside hardware and approved function.

Power architecture matters. Building AC can be absent while a battery-backed supply continues powering the device. A locked door during that event does not, by itself, identify a fail-secure function. Establish which power source and observation point the record refers to.

Model And Configuration

Do not infer a function from appearance or family name. The HES5000 product page, for example, describes a field-selectable fail-safe/fail-secure unit. That supports the need to verify configuration; it is not an instruction to convert a device. Changing a function can affect the approved opening design and requires authorized review.

Some products and systems have operating behaviors outside this introductory two-column comparison. Use the exact model and function documentation rather than forcing every electronic lock into an assumed pattern. Document what the manufacturer specifies and what the approved test actually observed.

Worked through

A fictional record says, "AC off; door still locked; therefore fail-secure." The drawing shows a backup supply, but the record does not say whether the lock remained energized.

Correct the conclusion to unknown from the available evidence. The observation may simply show continued operation from backup power. Identify the missing evidence and refer the test plan to the supervisor. Do not disconnect a live building's backup source to settle a classroom question.

A second training record identifies a particular entry-side function as fail-secure and an independent inside mechanical release. Those facts can coexist. The learner should be able to describe both: entry remains secured on removal of lock power, while the documented inside hardware permits the required mechanical operation. Actual compliance still depends on the complete opening and applicable requirements.

Supervised Practice

Use manufacturer documentation and an isolated trainer approved for the exercise. Before any demonstration, record the model, function, configuration and expected de-energized behavior. Label the controlled side and separately identify the inside release.

Have the instructor demonstrate the approved condition and restoration sequence. Record the observed physical response, not just a relay click or software icon. Keep hands clear of moving hardware and follow the trainer's instructions. Do not alter occupied openings, defeat releases or change model settings for this exercise.

Classify each statement:

1. "The outside electrically controlled function unlocks when its power is removed." Fail-safe for that specified function.
2. "The controlled side remains locked without its electrical power." Fail-secure for that specified function.
3. "The controller is offline but the lock supply is healthy." Insufficient information to infer a power-loss function.
4. "Inside egress remains available." A separate observation, not a fail-safe/fail-secure classification by itself.

Record Template

Opening / trainer identifier: Manufacturer / model / exact function: Controlled side: Configuration and approved document reference: Power condition and observation point: Expected response: Observed response and evidence: Inside egress function: Untested conditions / unresolved issue: Supervisor review and restoration record:

Knowledge Check

Sources