A valve actuator fail position is the position the valve must reach, or deliberately hold, after a defined loss of utility to keep the process within an acceptable condition. The correct choice is not inherently fail closed, fail open, or fail in place. It depends on what happens to the process when instrument air, electrical power, a control signal, or several utilities are lost together.
A drawing notation such as FC, FO, or FL describes design intent under a stated failure condition. It does not prove that the installed final element will move as intended, reach the required travel position, or do so quickly enough. Select the required process response first, then verify the valve, actuator, solenoid, positioner, tubing, stored energy, and shutdown logic as one final-element assembly.
Start with the required process safe state
The starting question is not “Which actuator is safer?” It is: what valve position best controls the identified hazard after this particular initiating event? The answer should come from the process design basis and hazard review, not from the usual action of a valve type or an actuator already available in stores.
For an isolation valve on a line containing hazardous inventory, closing may limit further release or stop a feed source. For another line, opening may be necessary to preserve cooling-water flow, pump minimum flow, inert-gas purge, flare routing, depressurization, or a pressure-relief path. A valve that remains in its last position may be acceptable only if that condition has a defined and tolerable process outcome for the required duration.
The CCPS Process Safety Beacon on valve failure positions makes an important distinction: P&IDs commonly show the intended state following a named utility loss, but valves can fail for reasons other than utility loss and may not operate as intended. A fail-position label therefore needs to be tied to a credible process scenario and verified in the field under an approved procedure.
Before selecting an actuator action, collect the following process inputs:
- Fluid composition, phase, toxicity, flammability, corrosivity, and environmental release consequences.
- Normal, startup, shutdown, maintenance, and upset flow paths.
- Maximum and minimum operating pressure and temperature at the valve.
- Upstream and downstream inventory that could continue to flow after the valve moves.
- Cooling, purge, minimum-flow, vent, drain, relief, and flare requirements.
- Equipment limits, including pump deadhead limits, compressor surge controls, heat-exchanger cooling requirements, and vessel pressure limits.
- The required action time: the time from a utility-loss event until valve movement must begin and until the required position must be achieved.
- Other protective layers that are credited in the process-hazard analysis.
One process unit can require several different responses. A reactor feed valve may need to fail closed, an emergency cooling valve may need to fail open, and a depressurization valve may need to open. Treat each valve as a separate final element with its own duty, hazard, and required response.
Evaluate each utility-loss scenario separately
“Failure” is not one event. A valve may respond differently to loss of instrument air, loss of electrical supply, loss of a 4–20 mA control signal, loss of a distributed control system, a solenoid fault, or a common-cause event that removes both air and power. A useful design input is a utility-loss matrix that states the expected response for every credible scenario.
| Scenario | Question to resolve | Evidence to check |
|---|---|---|
| Loss of instrument air | Does stored spring force or separate stored energy move the valve? | Pneumatic schematic, actuator data, supply-pressure requirement, air receiver or accumulator data |
| Loss of actuator electrical power | Does the actuator stop, move using backup power, release a brake, or execute a programmed action? | Exact actuator manual, wiring diagram, backup-power design, control logic |
| Loss of solenoid power | What is the de-energized solenoid flow path, and what air pressure reaches the actuator? | Solenoid datasheet, pneumatic diagram, cause-and-effect chart |
| Loss of control signal | Does the positioner hold, vent, drive to a configured output, or respond to a separate trip signal? | Positioner configuration record, loop diagram, functional test procedure |
| Loss of control-system power | Are shutdown outputs independently powered, de-energize-to-trip, or dependent on the failed system? | Electrical one-line diagram, shutdown architecture, cause-and-effect matrix |
| Combined air and power loss | Does the intended response still occur when all supporting utilities are unavailable? | Hazard review, final-element design, approved integrated test procedure |
For a conventional spring-return pneumatic actuator, a spring provides the motive force for travel in one direction when air pressure is removed. Depending on the mechanical arrangement, the valve may fail open or fail closed. This must be confirmed for the complete assembly; “air-to-open” or “air-to-close” describes actuator action but does not by itself confirm process flow direction, actual valve closure, or required shutoff under differential pressure.
Double-acting pneumatic actuators normally require pressure to move in both directions. They may be configured to achieve a defined emergency action using a volume tank, accumulator, trip valve, quick-exhaust arrangement, or another stored-energy design. That capability is configuration-specific. It should not be assumed merely because the actuator is pneumatic.
Electric actuators often stop at, or are held near, their last position when power is removed, but this is not universal. Behavior can depend on motor control, gearbox friction, brake design, manual declutch mechanism, battery or capacitor backup, and programmed emergency operation. Confirm the exact model and supplied options against the manufacturer documentation and the project wiring design.
Compare fail open, fail closed, and fail in place by consequence
Fail open, fail closed, and fail in place are process decisions with mechanical consequences. Each has a potentially harmful opposite action, and each should be assessed against the actual upset progression.
Fail closed
Fail closed is commonly selected to stop feed, isolate a hazardous source, prevent overfill, or limit flow into an affected system. Its benefit is limited if downstream inventory remains large, if a valve cannot close against the expected pressure differential, or if closing creates another hazard such as pump deadhead, thermal expansion of blocked-in liquid, loss of cooling, or upstream overpressure.
Check the valve’s specified shutoff capability at the maximum differential pressure expected during the trip. The relevant condition may be much more severe than normal operating differential pressure. Confirm flow direction, seat design, allowable pressure differential, packing friction, and whether line pressure assists or opposes closure.
Fail open
Fail open can preserve cooling, purge, minimum recirculation flow, venting, depressurization, or a route to flare or relief disposal. It may also increase inventory transfer, fuel flow, emissions, or the spread of hazardous material if the line remains connected to a source.
The required open position should be explicit. “Open” may mean fully open, a defined travel percentage, or sufficient flow to meet a heat-removal, purge, or relief basis. If a partially open safe position is required, verify whether the actuator and control architecture can reliably reach it after the defined utility loss. A spring-return actuator generally drives to an end position, not an arbitrary intermediate travel point.
Fail in place
Fail in place means that the intended response is to retain the current travel position rather than actively drive open or closed. This may be considered when either full opening or full closure would worsen the upset, and the process can remain stable for a defined period at the existing flow condition.
It is not enough to assume that an electrically actuated valve “fails in place.” A loss of power may leave the valve stationary, but it may also affect position feedback, controls, brakes, ancillary solenoids, or associated equipment. Mechanical drift, leakage through the valve, or changing process differential pressure can also alter the process outcome even where valve travel does not change.
For all three choices, examine these two failure outcomes separately:
- The valve moves to the intended loss-of-utility position but the process response is still unacceptable.
- The valve does not move, moves only partially, or moves in the opposite direction.
A process hazard analysis, what-if review, HAZOP, or equivalent site method should evaluate both outcomes. Where a valve performs a safety instrumented function, the safe state, response time, test requirements, and assumptions must be consistent with the applicable safety requirements specification and lifecycle records. A component safety manual alone does not establish achieved SIL for an installed final element.
Confirm that the actuator has enough stored energy and travel capability
Once the required response is defined, translate it into mechanical and control requirements. The actuator must generate sufficient torque or thrust throughout the full stroke, under the actual failure conditions, not merely under normal modulating duty.
For rotary valves, review breakaway torque, running torque, seating torque, friction, stem and bearing condition, packing load, and process differential pressure. For linear valves, review thrust requirements, stem load, seat load, packing friction, travel, and pressure forces. The manufacturer sizing calculation should use the exact valve model, trim or closure member, actuator configuration, supply pressure, fluid service, temperature range, and required stroke time.
Spring-return actuators need enough spring torque or thrust at the limiting part of travel. The limiting condition may be breakaway from the normal position, final seating, or overcoming changing hydrodynamic forces. Air supply pressure affects movement in the powered direction and may affect the starting condition before a trip.
For double-acting pneumatic or hydraulic arrangements using stored energy, verify more than nominal vessel volume. The calculation should account for usable initial pressure, minimum actuator operating pressure, gas expansion or hydraulic supply behavior, tubing and restriction losses, other connected users, ambient temperature, leakage, and the required number of operations. A reserve that works on a simplified drawing may not provide sufficient energy after real piping losses or degraded supply conditions.
The Fisher FB valve safety manual illustrates that spring-return and double-acting configurations can be specified for different fail-open or fail-closed actions. This is product-specific documentation, not a general performance guarantee for other valve assemblies. Use the documentation for the supplied valve and actuator combination.
Accessories can alter the response materially. Review the function of the solenoid valve in both energized and de-energized states; quick exhaust devices; lockup valves; volume boosters; positioners; air sets; filters; manual overrides; handwheels; partial-stroke-test equipment; and any bypasses. A lockup valve, for example, may be intentionally used to hold actuator pressure after air-supply loss, but it can conflict with a requirement for a spring-return fail action unless the pneumatic architecture is designed accordingly.
Verify the complete final element, not just the nameplate
Verification should compare the installed assembly with the approved design documents and should be performed under a site-controlled commissioning, maintenance, or proof-test procedure. Do not initiate a live loss-of-air, loss-of-power, or shutdown test on operating equipment without approved isolation, personnel protection, communication, and restoration arrangements.
Before functional testing, check:
- As-built P&ID, valve datasheet, cause-and-effect matrix, loop diagram, wiring diagram, and pneumatic schematic.
- Valve tag, body and trim identification, actuator model, spring package or actuator action, solenoid model, and positioner configuration.
- Valve travel direction and local indication: verify that indicated open and closed positions correspond to actual process flow isolation or opening.
- Solenoid de-energized function and its air-routing consequences.
- Instrument-air supply pressure, regulator set point, tubing condition, drain condition, and restrictions.
- The state of bypass valves, manual overrides, lockup devices, partial-stroke-test hardware, and any temporary commissioning connections.
- Valve position feedback, limit switches, trip alarms, and event records.
The test method should simulate the specific scenario named in the design basis. A loss-of-control-signal test is not necessarily evidence of behavior during complete electrical power loss. Likewise, venting a local actuator line may not represent a plant-wide instrument-air failure if an accumulator, lockup valve, or alternate air path remains in service.
Record the initial process state, utility conditions, commanded action, observed valve direction, achieved travel, action time, final indication, and any abnormal noise, sticking, leakage, or incomplete travel. Compare results with the approved acceptance criteria, not with a generic expectation that a valve should move quickly. If the valve is safety-critical, retain dated commissioning or proof-test records and process corrective actions through the site’s engineering and maintenance system.
The CCPS guidance recommends identifying safety-critical valve failure positions and observing actual valve operation so problems can be reported. That observation should be planned around site safety procedures and manufacturer operating limits, particularly where pressure, hazardous fluids, moving linkages, or energized electrical equipment are involved.
Document assumptions and use formal review for safety-critical changes
The final specification should state the required valve position and required action time for each credible utility-loss case. Avoid an unqualified note such as “fail closed” when the intended condition is actually “fail closed on loss of instrument air, provided the emergency solenoid de-energizes and the actuator spring remains installed.”
A practical record for each critical valve includes the process safe state, initiating scenarios, utility dependencies, valve travel direction, actuator action, accessory configuration, required response time, sizing basis, test method, acceptance criteria, and responsible approval roles. References should point to the current valve datasheet, cause-and-effect chart, shutdown narrative, P&ID, and applicable hazard-review record.
Use management of change and design review when any factor that can alter failure behavior changes. Typical triggers include a new actuator type, changed spring package, valve trim replacement, altered packing, solenoid replacement, revised instrument-air arrangement, added positioner or partial-stroke-test device, changed control logic, modified electrical supply, or changed process duty.
The bounded selection rule is simple: choose fail open, fail closed, or fail in place only after defining the process-safe response to each credible loss-of-utility scenario. Then demonstrate, through reviewed calculations, correct configuration, and controlled functional testing, that the complete final element can achieve and maintain that response within the required time. Where the valve is safety-critical, the process-safety and design authorities should approve the decision before procurement, modification, or return to service.
Frequently asked questions
Is fail closed always the safest valve actuator fail position?
No. Fail closed can prevent hazardous feed or inventory transfer, but it can also remove cooling, block a relief route, deadhead a pump, or create overpressure elsewhere. The required position must follow the process hazard assessment and the response of connected equipment.
What is the difference between fail in place and a valve that simply loses power?
Fail in place is an intentional process requirement: holding current valve travel is judged acceptable for a defined scenario and duration. A valve that simply loses power may remain stationary, but that behavior may be uncontrolled, unverified, or altered by brake, gearbox, positioner, solenoid, or backup-power configuration.
Can a double-acting pneumatic actuator provide a defined fail position?
Potentially, but not from actuator type alone. A double-acting actuator normally needs pressure for both travel directions. A defined emergency action may require a separately engineered accumulator, volume tank, trip valve, or other stored-energy arrangement. Verify the exact pneumatic circuit and available energy under the specified loss scenario.
How do you verify that a valve will reach its fail position after instrument-air loss?
First review the approved cause-and-effect chart, actuator sizing basis, pneumatic schematic, and manufacturer instructions. Then use a site-approved functional test that safely represents the defined air-loss scenario. Confirm actual travel direction, final position, action time, indications, and restoration steps, and compare the results with documented acceptance criteria.
