Fail-Safe Action: Fail Open, Fail Close or Fail Last
When instrument air or power is lost, where does the valve go? That single question — decided by actuator style and bench set, not by the control system — defines the valve's fail-safe action. Getting it wrong is one of the most consequential mistakes in valve specification.
1. The three behaviours
- Fail closed (FC) — on air loss the valve shuts. Chosen when flowing is the dangerous state: fuel gas to a burner, letdown to a flare-less system, chemical feed into a batch.
- Fail open (FO) — on air loss the valve opens fully. Chosen when stopping flow is dangerous: cooling water to a reactor, vent lines, quench flows.
- Fail last (FL) — the valve freezes where it is. Used when the last position is the safest interim state, typically large double-acting actuators with volume tanks or locks.
2. How the mechanics deliver it
| Actuator style | Air loss behaviour | Notes |
|---|---|---|
| Spring-and-diaphragm, air-to-open | Spring pushes stem closed → FC | The classic "air-to-open, spring-to-close" (ATO/STC) — most common combination in process plants |
| Spring-and-diaphragm, air-to-close | Spring pushes stem open → FO | ATC/STO; air supply must overpower line pressure at shutoff |
| Double-acting piston, no spring | Stays where it is → FL (drift possible) | Needs volume tank + solenoid, or lock-up valves, to be genuinely fail-safe |
| Double-acting piston with springs | Spring side wins → FC or FO by plumbing | Bigger, costlier; used where piston thrust is mandatory |
| Electric actuator | Stays put → effectively FL | True FC/FO needs a battery, capacitor backup or spring-return addon |
Two vocabularies describe the same valve: fail action (what happens on air loss) and air action (air-to-open vs air-to-close). They are inverses of each other on a spring-and-diaphragm actuator — a "fail closed" spring-diaphragm valve is always "air to open".
3. The decision logic
- Ask HAZOP, not habit. The safe state comes from the process safety analysis of this service, not from what the neighbouring valve does.
- Consider air-loss cause. If air failure accompanies total plant upset, "fail last" may leave a mid-throttle valve in an unreviewed state — many specifications exclude FL for that reason.
- Check fire-safe behaviour. In fire, elastomers and diaphragms die. A spring outside the fire zone keeps its function; a volume tank may not.
- Verify the shutoff side. An FC spring must close against maximum line differential and still achieve the specified leakage class; an FO spring must drive open against it. Check the load at maximum P1, not normal.
4. Bench set and range
The bench set — the diaphragm pressure range that moves the stem full travel with no process load — is set on the workbench and encodes the fail action: an STC valve's bench set starts its spring range with zero air. If a positioner's calibration disagrees with the bench set, one of them is wrong; find out which before startup.