Engineering explained · FAIL

One spring decides
whether everybody goes home.

A control valve is a spring fighting compressed air. Cut the air and the spring wins, all the way to its end, and that end is not built into the valve. It is built into the actuator. Here is the actuator drawn in section with a switch that moves the air to the other side of the diaphragm, the loss-of-signal case that nobody draws, the seven minutes a screen read open over a valve that was shut, and the calculation that only matters when every valve in the plant fails at once.

Reflux Student drives your own Aspen Plus from plain English, and the fail-position layer is what we are building on top of it. Try it free on Aspen Plus →, or jump straight to the actuator.

Out now

Try Reflux Student free on Aspen Plus

Reflux Student drives your own Aspen Plus V14 from plain English. You type what you want, it opens the case, makes the change in Aspen, runs it, reads the result back and tells you what it verified. Aspen does the math. You keep the judgment. Windows, your own licence, and three free runs to start.

Try it free on Aspen Plus →

Enter your email on the next page and the download link lands in your inbox, so you can open it on the Windows machine Aspen lives on. Windows will say it does not recognise the app the first time: click More info, then Run anyway. The certificate is new and Windows trusts it by reputation, which takes downloads to build. Nothing is wrong with the file.

Book 30 minutes with me → Straight off my calendar. I do the install with you and show you how to point Reflux at the work you actually do. No charge.

Not on Aspen Plus? Tell me which simulator you use → and you hear the day your build exists.

01 A spring fighting compressed air 02 Two letters under the valve 03 Loss of signal is not loss of air 04 What the screen said 05 Every valve at once 06 Check your own drawings

A spring fighting compressed air.

Instrument air, usually a 3 to 15 psig signal from a 20 psig supply, pushes on one side of a diaphragm. A spring pushes on the other. The stem sits wherever the two balance, and the plug sits wherever the stem puts it. That is the whole machine.

Move the air to the other side of the diaphragm and you have the same valve, the same spring and the opposite fail position. Try it. Then cut the air.

Air under the diaphragm lifts the stem against the spring, so air opens the valve. Lose the air and the spring drives the plug onto the seat: air-to-open, fail closed.

airon, 9 psig

springbalanced

plugmid travel

Note what the switch did not change. The body, the seat, the plug and the spring are the same parts in both drawings. Fail position is a property of the actuator's plumbing, which is why it is written on the P&ID and not cast into the valve.

Two letters under the valve.

ANSI/ISA-5.1 puts the answer under the symbol: FC fails closed, FO fails open, FL fails locked in its last position, which needs a lock-up valve on the actuator and its own air reservoir to mean anything. Fuel gas to a burner is drawn FC, so the fire goes out. Cooling water to an exothermic reactor is drawn FO, so the reactor stays cold.

The same symbol twice: a diaphragm actuator over a globe body. The letters are the only thing on the drawing that says what happens at two in the morning.

Service	Usual fail position	Why
Fuel gas to a burner	FC	No air, no fire.
Cooling water to a reactor jacket	FO	Heat removal must survive the failure.
Steam to a reboiler	FC	Stop putting heat into a column nobody is controlling.
Reflux to a column	FO	Keep the top of the column cold and wet.
Level control on a drum outlet	FC	Do not empty a vessel into the next one.
Compressor anti-surge recycle	FO	The machine must never be left dead-headed.

Every one of those is a judgment about the process, not a property of the valve. The same globe valve can carry either letter, and a HAZOP that never asked which one is a HAZOP with a hole in it.

Loss of signal is not loss of air.

The first drawing left out the positioner. A real valve has a 4 to 20 mA signal coming into a positioner on the yoke, and the positioner has its own air supply that it meters into the diaphragm case. Two failures that sound the same are not: the air can fail while the wire is fine, and the wire can fail while the air is still on.

The wire is broken and the 20 psig supply is still lit. A positioner reads 0 mA as a command, not a failure: it drives the actuator to whichever end its action puts at low signal. On a reverse-acting loop that end is wide open, on a valve whose letters say FC.

That is not hypothetical. A 2014 case taught by the Center for Chemical Process Safety describes a fuel-gas control valve that was fail-closed on loss of air and drove open on loss of signal, because the two failure modes had been designed separately and nobody had drawn the second one.

The check is one line per loop: what does the positioner do at 0 mA, and does that agree with the letters under the valve? If it does not, the fix is a solenoid or a change of positioner action, and it costs less than the afternoon you will spend finding it after the fact.

What the screen said.

A reactor's cooling-water valve was designed to fail open. For seven minutes the control room screen read 100 percent open while the reactor temperature climbed. The linkage between the actuator stem and the valve stem had snapped: the actuator went to its open end, the position feedback followed the actuator, and the plug sat shut on its seat the whole time.

The actuator side is at its open end and the travel pointer says OPEN. Below the broken coupling the plug is seated. Fail position is what the spring does to the plug, and a screen that reads the actuator is reporting on the wrong half of the machine.

The lesson the CCPS Beacon draws from it is mechanical, not procedural: position feedback that matters for safety comes off the valve stem, not the actuator, and a valve that is important enough to alarm on is important enough to have its position confirmed by something other than the thing that moves it, such as a flow that should have changed.

Every valve at once.

The simulator knows a valve as a flow coefficient and an outlet pressure. It does not know which way the valve fails, because that lives on the P&ID. The calculation that matters is the utility-failure case: instrument air is lost plant-wide, every control valve goes to its fail position in the same second, and the relief system has to swallow whatever that does to every drum and column at once.

Six valves on one small plant, each at its fail end. Steam to the reboiler is shut, so the column stops boiling. Reflux is wide open, so the drum drains. The feed valve is shut, so the drum stops filling. Relief from the drum and the column runs down the header to the flare, and the flare load is the sum of every one of those, not the worst single one.

This is the scenario relief studies call general instrument air failure, and it is the one most likely to size the flare header, because it is the only case where everything moves together. Doing it by hand means re-running the heat and material balance with every valve pinned, and it is the layer we are building on top of the simulator: read the fail positions off the drawing, set every valve to its end, and re-run the balance to see what reaches the flare.

Check your own drawings.

Six questions, one per control valve, in the order they bite.

Are the letters there? Every control valve on the P&ID carries FC, FO or FL, and FL only counts with a lock-up valve and an air reservoir drawn.
Does the actuator agree? Air-to-open with the spring above the diaphragm is FC; air-to-close with the spring below it is FO. The datasheet says which one was bought.
What does the positioner do at 0 mA? Direct or reverse acting decides where the valve goes on loss of signal, and it is allowed to be the opposite of the loss-of-air end.
Is there a solenoid, and what does it vent? A trip solenoid in the air line is the one thing that makes loss of signal and loss of air land on the same end.
Where does the position feedback come from? A switch or transmitter on the valve stem tells you about the plug; one on the actuator tells you about the actuator.
Has the plant-wide case been run? Every valve to its fail end at once, then the relief load, then the flare header. If the number on the flare datasheet came from single failures only, it is a smaller number than the real one.

None of this is hard. It is all invisible on a normal day, which is the actual problem: a plant that has never lost its air looks exactly like a plant that would land safe if it did.

Reflux reads the drawing as well as the simulator.

It drives your own Aspen Plus V14 from plain English, and the layer we are building carries what the simulator cannot: the fail position on every valve, so the utility-failure case is a sentence rather than a week. Three free runs to start, on your own licence.