Quick Summary:
- The fail-safe position of an automated valve — whether it should move to open, closed, or stay in its last position on loss of power or instrument air — is one of the most consequential decisions in process safety design, and it must be driven by a systematic hazard analysis rather than convention or convenience.
- Spring-return pneumatic actuators provide the most reliable and fastest fail-safe action because the spring stores energy independently of any power or air supply — making them the default choice for safety instrumented system (SIS) valves where fail-safe response to instrument air failure is the primary concern.
- Fail-last (hydraulic lock or electronically latched) configurations are appropriate only where neither open nor closed is demonstrably safe, but this designation carries a higher SIL burden because the valve’s safety function depends on position maintenance rather than an inherently safe direction of travel.
Why the Fail-Safe Position Is Not a Minor Detail
In the safe design of process plants, the concept of “fail-safe” is central. A fail-safe design is one that defaults to a safe state when a component or system fails. For valves, this means specifying the position the valve should adopt on loss of its actuating medium — loss of instrument air for pneumatic actuators, loss of power for electric actuators, loss of hydraulic pressure for hydraulic actuators.
Getting the fail-safe position wrong can have catastrophic consequences. Consider a control valve on the feed to a distillation column: if it should fail closed (shutting off feed and preventing overpressure), but it’s specified as fail-open (which would continue feeding an already overpressured column), the consequence of instrument air failure in a high-temperature scenario could be severe. This isn’t a theoretical concern — incorrect fail-safe specification has been a contributing factor in real process incidents.
The fail-safe position must be determined by process hazard analysis (PHA) — specifically HAZOP or equivalent — where every failure mode is systematically considered. The valve position on failure is one output from this analysis. It is not appropriate to default to “fail-closed because that seems safer” without analysing the consequences of closure. In many services, closure is more dangerous than opening: a cooling water supply valve that fails closed during a runaway reaction is far more hazardous than one that fails open.
Fail-Closed (FC): When Closure Is the Safe State
A fail-closed valve moves to the closed position on loss of actuating medium. For a spring-return pneumatic actuator, this means the spring pushes the valve closed when instrument air pressure falls. The designation FC (fail-closed) is standard on P&IDs and in instrument data sheets.
Fail-closed is appropriate when closing the valve prevents escalation of the hazardous scenario. Common examples include: fuel gas supply to a combustor (close to prevent uncontrolled fuel feed), chemical feed to a reactor (close to prevent uncontrolled dosing), and high-pressure gas supply to a downstream low-pressure vessel (close to prevent overpressure).
For a spring-return pneumatic actuator in fail-closed service, the spring must generate sufficient force to close the valve against maximum differential pressure — the worst case being instrument air failure coinciding with maximum line pressure against the valve seat. Actuator sizing for FC service must be calculated at the maximum spring-force-to-valve-torque ratio. A common mistake is to size the actuator based on normal operating conditions without checking that the spring can close against maximum pressure.
Fail-Open (FO): When Opening Is the Safe State
A fail-open valve moves to the open position on loss of actuating medium. For a spring-return pneumatic actuator, the spring pushes the valve open; instrument air is used to close or throttle it. The designation FO appears on P&IDs.
Fail-open is appropriate when opening the valve prevents escalation. Common examples: cooling water to a reactor or heat exchanger (open to maintain cooling on loss of instrument signal); vent or pressure relief bypass valve (open to ensure venting if the primary relief is unavailable); turbine trip valve (open to allow steam to exhaust safely).
Specifying a valve as fail-open on loss of instrument air means it must be actively held closed or partially closed in normal service — the instrument air overcomes the spring to hold the closed position. This has implications for air consumption: a fail-open valve uses instrument air to hold it closed, meaning continuous air consumption in normal operation. For large valves in remote locations with limited air supply, this can be a significant consideration. Check that the instrument air supply system can sustain the constant consumption from all FO valves simultaneously.
Fail-Last (FL or Lock): When Neither Direction Is Safe
Some applications genuinely cannot tolerate either full opening or full closure on failure. A control valve on the coolant flow to a batch reactor where full open would cause thermal shock (and vessel damage) and full closed would cause overtemperature — both outcomes being unacceptable — is a case where neither FC nor FO is the right answer.
In these cases, fail-last (also called “lock-in-place”, FL or LIP designation) is specified. The valve is designed to maintain its last position on loss of actuating medium. For pneumatic actuators, this is achieved by trapping air in the actuator chamber using a solenoid-operated lock-up valve that closes on loss of instrument signal, preventing air from escaping from the actuator. The actuator stays pressurised at its last operating pressure, and the valve stays at its last position.
Fail-last has a critical vulnerability: it depends on the integrity of the pneumatic lock-up system to maintain position. Any leak in the air circuit will cause the valve to drift from its last position as the trapped air pressure decays. It also means that if the process condition changes significantly after the failure event, the valve is stuck at a position that was appropriate for the pre-failure condition but may not be appropriate for the post-failure condition.
For Safety Instrumented System (SIS) valves, fail-last is generally discouraged unless rigorously justified by HAZOP. The IEC 61511 safety lifecycle standard requires that safety function failures be diagnosed, and a valve that has failed to a position that appears normal is much harder to detect than one that has moved to an end stop. The SIL capability of a fail-last final element is inherently lower than an equivalent fail-open or fail-closed design for this reason.
Spring-Return Pneumatic Actuators: The Reliability Standard
Spring-return pneumatic actuators are the standard choice for safety instrumented system final elements. The reason is simple: the spring is a purely mechanical energy store that requires no power, no control signal and no instrument air to deliver the safety action. The spring works by itself. In a scenario where both the process has deviated and the instrument air system has failed — a realistic worst-case that all SIS designs must consider — the spring still provides the fail-safe function.
This is not true of electric actuators. An electric actuator relies on power (for a motor-driven actuator) or stored energy in capacitors or batteries (for an electrically-powered fail-safe version) to deliver the fail-safe stroke. If the power supply fails simultaneously with the process event, a motor-driven electric actuator without backup power cannot deliver the safety function. Battery-backed electric actuators address this but introduce a battery maintenance requirement and a battery failure mode — both of which must be addressed in the SIL analysis.
Spring sizing for fail-safe actuators must account for: the torque required to move the valve at maximum differential pressure; the friction torque in the valve stem packing and bearings; the dynamic torque from fluid velocity effects on the trim; and an adequate safety factor (typically 1.25 to 1.5) above the worst case. Undersized springs are a common finding in actuator audits — the actuator was sized for normal operating conditions rather than worst-case fail-safe conditions, leaving inadequate spring torque margin.
Double-Acting vs Spring-Return: When Each Is Appropriate
Double-acting actuators apply air pressure to both sides of the piston (or both chambers of a rotary actuator) to produce both opening and closing motion. They provide higher torque in both directions than a spring-return actuator of equivalent size, and they consume air only when moving rather than continuously. They’re widely used for non-safety-critical control valves where fail-safe position on loss of air is provided by a separate fail-safe positioner or solenoid valve system.
For safety valves, the question is: how is the fail-safe action achieved with a double-acting actuator? Several approaches are used. A spring accumulator can be added — a separate air reservoir and check valve arrangement that stores enough pressurised air to drive the valve to the safe position even when the main supply has failed. A spring cylinder can be added inline in the fail direction. The positioner can be equipped with a fail-safe function that vents one chamber and supplies the other on detection of instrument air failure. Each approach works, but each introduces additional components and potential failure modes that must be included in the SIL assessment.
For most safety valve applications in the SIL 1-3 range, the simplicity of a spring-return actuator with a fail-safe positioner is preferred. The fewer components in the safety function path, the fewer failure modes, and the simpler the proof test procedure. Double-acting with added fail-safe provisions should be reserved for cases where the valve torque genuinely exceeds what a practical spring-return actuator can provide — which, with modern high-torque scotch yoke and rack-and-pinion designs, is rarer than often assumed.
Solenoid Valves in Fail-Safe Systems
The solenoid valve is the interface between the SIS logic solver and the pneumatic actuator. It receives a digital signal from the logic solver — energise to hold the process valve in service position, de-energise to release the instrument air and allow the fail-safe spring to operate. This “de-energise to trip” philosophy means that loss of power to the solenoid itself produces the safe action — the solenoid valve spring pushes the pilot valve to the venting position, instrument air is released, and the process valve spring drives to the safe position.
The solenoid valve is a critical safety component. Its failure modes — failure to de-energise (coil stuck energised), failure to vent (pilot valve stuck), body leakage — must all be included in the SIL analysis. Proof test procedures must specifically verify that the solenoid can de-energise and properly vent the actuator. A common mistake is proof testing the logic solver output but not verifying the full chain through the solenoid to the actuator and back to the process valve position.
Partial Stroke Testing: Maintaining SIL Without Full Operation
For safety valves that are normally open in service (fail-closed valves that are held open in normal operation), proof testing by full closure represents a process disruption — you have to shut the process down, or at least isolate the valve circuit, to close the valve fully and verify its operation. For many applications, this is impractical on a frequent basis, limiting the achievable proof test interval and therefore the achievable SIL.
Partial stroke testing (PST) addresses this by moving the valve a defined partial stroke — typically 10-30% — during normal operation. This verifies that the valve can begin to move from its service position and that the actuator spring is functional, without requiring full closure. It detects mechanical seizure, solenoid valve failures and other dangerous failures without taking the process offline. PST coverage — the fraction of dangerous failures detected by the partial stroke test — is included in the SIL calculation, effectively allowing a higher proof test interval while maintaining the required SIL.
PST can be manual (an operator initiates the test from a local panel) or automatic (the digital positioner or smart valve controller initiates the test automatically on a defined schedule without operator intervention). Automatic PST is increasingly standard on critical SIS valves and is particularly valuable in unmanned or remotely operated facilities.
Documentation and the Safety Case
Every design decision in the fail-safe specification of a valve must be documented and justified. The fail-safe position comes from the HAZOP or SIL assessment. The actuator selection — spring size, actuator type, solenoid valve selection — comes from a sizing calculation that addresses worst-case conditions. The proof test procedure is defined and documented before the valve is installed, not developed ad hoc during maintenance.
For IEC 61511 compliance, the entire safety instrumented function (SIF) — sensor, logic solver and final element — must achieve the specified SIL, and the final element’s contribution to this must be quantified. The failure rate data for the valve, actuator, solenoid and positioner comes from validated databases (OREDA, exida) or manufacturer data that is justified by field experience. Using default OREDA failure rates without considering whether they are conservative or optimistic for the specific application is a common but potentially non-conservative shortcut.
Summary
The fail-safe position of an automated valve is a safety-critical engineering decision that must be derived from systematic hazard analysis, sized to work under worst-case conditions, and verified through a traceable proof test procedure. Spring-return pneumatic actuators remain the gold standard for safety valve applications because their reliability is inherent in their simplicity. Specify fail-safe positions in the HAZOP, design actuators to the worst case, test the complete safety function from logic solver to process valve position, and document everything. Valves that fail safe are one of the most effective barriers between normal plant upsets and serious accidents — treat them accordingly.