10.4 Actuators and Failure Modes

Motive power is a safety decision, not a catalog preference

Topic 3.D is actuators and failure modes. The PE Control Systems 2027 exam supplies ISA-5.1 (2024) — so you can read fail-closed, fail-open, and actuator symbols on a P&ID — and IEC 61511-1 (2018) — so you know that a safety instrumented function has a defined safe state for its final element. Valve $C_v$ standards are still not supplied. You must already know how a spring-diaphragm differs from a piston, why bench set is not installed thrust, and which way a steam valve should fail when the air header goes flat.

free practice setPractice questions with detailed explanations

---

Pneumatic spring-diaphragm versus piston

A spring-diaphragm actuator is a large diaphragm, a single air chamber, and a spring. Air on one side works against the spring. Stroke is limited (a few inches). Thrust is diaphragm area times (supply pressure minus spring load). The spring is the fail-safe energy store: lose air, and the valve goes to the spring’s position. That is why this style dominates analog BPCS globes. It is a poor match for long-stroke dampers or for rotary valves that need thousands of pound-inches at the seated position.

A pneumatic piston (cylinder) uses a sliding piston, much higher pressure on a smaller area, and optional springs or volume tanks. Double-acting pistons need air to move either direction; without a spring, trip valve, or stored-volume scheme they fail in place (or drift with process unbalance). Spring-return pistons still fail to a defined end but can be bulky. On rotary valves the usual mechanism is a Scotch-yoke or rack-and-pinion: yoke geometry puts maximum torque at the ends of travel, which is exactly where a butterfly or ball needs it to seat and unseat.

---

Electric and hydraulic

Electric actuators (motor, gearbox, sometimes a servo) give precise positioning without instrument air. Loss of electrical power typically leaves the valve where it was (fail-in-place) unless you buy a spring-return pack, a UPS, or a designed battery/air backup. They are slower than pneumatic for many emergency strokes. Plants without air, or with modulating dampers that need high stiffness, use them. They are not automatically “safer”: IEC 61511 cares whether the safe state is actually achieved, not whether the motor is modern.

Hydraulic actuators deliver very high force for large pipeline valves, big dampers, and some turbine valves. Fail position depends on solenoid dump valves and accumulators. A double-acting hydraulic cylinder with no accumulator fails in place (plus creep). Do not write “hydraulic = fail-closed” on the exam.

---

Fail-open, fail-closed, fail-in-place

Name the flow path, not the stem:

• Fail-closed (FC): loss of motive power stops flow. Typical for fuel gas, steam to a heater that can overheat, and many feeds that would overpressure or overflow a downstream vessel.
• Fail-open (FO): loss of motive power establishes flow. Typical for cooling water, quench, and vents whose hazard is overpressure or over-temperature if the valve sticks shut.
• Fail-in-place (FL / fail-locked): the valve stays at last position. Typical for double-acting pistons and electric motors without a spring. Useful when either fully open or fully closed is worse than “leave it,” and dangerous when the process needs a defined trip.

IEC 61511-1 (2018): the safety function states the safe state (for example, close the fuel valve, open the vent). A SIS final element is designed, tested, and bypass-managed to that state. A BPCS air-fail position should not contradict the same process hazard, but a BPCS globe with a 3–15 psi spring is not a SIL-rated SIF just because it fails closed.

ISA-5.1 (2024) is how that fail action appears on the drawing (FC/FO notes, actuator balloons). If the P&ID and the narrative disagree, the exam item is testing whether you notice.

---

Air-to-open versus air-to-close

Air-to-open (ATO): increasing air opens the flow path. A fail-closed spring opposes that air. Loss of air → closed. Many push-down-to-close globes are arranged this way (air under the diaphragm lifts the stem off the seat).

Air-to-close (ATC): increasing air closes the flow path. A fail-open spring opposes that air. Loss of air → open.

Never assume “up is open.” A push-down-to-open globe reverses the stem story. Always specify fail position of the process stream. Positioners, solenoid dump valves, and lock-up relays can modify the air-fail behavior (fail-in-place on supply loss if a lock-up is installed). Read the accessories, not just the actuator outline.

---

Bench set versus installed: stiffness against unbalance

Bench set is the spring range on the shop bench with no process forces — for example 3–15 psig or 6–30 psig to stroke 0–100% travel. It is a spring preload, not a guarantee that the valve will move in the line.

Installed, the stem sees packing friction plus unbalance: roughly $\Delta P \times$ unbalanced area (seat area for an unbalanced single-port, much less for a balanced cage). Example: 2 in seat, area $\approx 3.14$ in², shutoff $\Delta P = 200$ psi → about 630 lbf of unbalance. A 50 in² diaphragm with only 6 psi of net air margin above the spring produces 300 lbf — not enough to seat. The valve will float off the seat or refuse to open, even though bench set was “3–15 psi.”

Stiffness is the actuator’s effective spring rate (and, with a positioner, the closed-loop stiffness of the stem-position loop). Process unbalance is a load. A soft actuator lets ΔP push the plug until the spring catches up — installed characteristic distorts, and a loop without a positioner hunts. A positioner drives air until the stem is where it should be, but it cannot invent force above supply pressure times effective area. You still size the actuator for shutoff ΔP, not for the smaller flowing ΔP from 10.3.

Balanced trim exists specifically to cut that unbalance so a spring-diaphragm remains practical. If you cannot balance the trim (rotary ball, tight butterfly), you buy thrust: a piston.

---

Worked: heater steam versus cooling water

A reactor jacket has a steam valve and a cooling-water valve. Instrument air fails.

• Steam fail-open continues to heat. Temperature and pressure rise; the PSV may lift; the batch cooks. Steam must fail-closed (ATO with closing spring, or equivalent).
• Cooling water fail-closed removes the heat sink. The same over-temperature occurs from the other direction if reaction heat or residual steam is present. Cooling water must fail-open (ATC with opening spring, or a spring that drives the water valve open).

If both fail closed, you lose cooling and you may still have heat capacity in the metal — still the wrong pair. If both fail open, you flood the jacket with water and steam, which may be a different hazard (water hammer, sewer load) but is usually less severe than a runaway heat-up. The exam wants the temperature/pressure hazard answered first: steam FC, cooling FO.

A SIS high-temperature trip that closes steam and opens water is an IEC 61511 function. It may use separate trip valves. Do not assume the BPCS modulating pair is the SIF.

---

Worked: why a piston on a high-thrust rotary

A 24 in Class 300 butterfly used for tight shutoff has a published seating torque of, say, 15,000 lbf·in at the design ΔP, plus a dynamic-torque peak while the disk is cracking open (butterfly torque is not monotonic). A spring-diaphragm rotary kit that delivers 4,000 lbf·in at the shaft will not break the disk free after sitting shut, and it will not hold the seat. A Scotch-yoke piston on 80–100 psig air produces high torque at the yoke’s ends of travel — seating and unseating — which is why pistons (or electric/hydraulic) are chosen for large tight-shutoff rotaries even when a diaphragm would have been fine on a 2 in globe.

---

Fail position versus process hazard

Exam trap: copying “cooling water fail-open” onto a steam valve, or assuming every electric actuator fails closed. Fail position is a hazard answer. Actuator style is a force and fail-energy answer. ISA-5.1 documents the choice; IEC 61511 governs it when the valve is a safety final element.