Board briefing · Decision-maker perspective · Published: October 9, 2026
Table of Contents
Key Takeaways
- Every actuated valve carries a contract with physics: when air, power or signal disappears, it must move fully open (FO), fully closed (FC), or hold its last position (FL). Choosing that contract is a process-safety decision, not a catalogue preference [1].
- Spring-return actuators remain the default fail-safe mechanism. The spring stores its energy mechanically, so a power outage, an air failure or a cut signal cable drives the valve to its defined safe state instead of stranding it mid-stroke [3][5].
- Air-to-open valves fail closed and air-to-close valves fail open. Electric actuators normally hold position when de-energized, so an electric fail position has to be engineered with springs, stored-energy devices or brakes [2][5].
- De-energize-to-trip — the design philosophy applied to final elements in safety instrumented functions under IEC 61511 practice — delivers its promise only when the spring direction matches the safe state the hazard analysis demands [3].
- Fail-last is the most misread option. It depends on trapped air, accumulators or a latching brake, and it belongs only where the safety review demonstrates that staying put is safer than moving [1][5].
- In water treatment the question becomes concrete fast: should a softener’s drain or chemical-feed valve open or close when the compressor trips? The answer follows the process consequence, and it is settled in the review, not at the parts counter.
The Question Every Actuated Valve Must Answer
If a plant loses instrument air at two in the morning, every actuated valve on site makes a decision on its own. That decision — the fail-safe position — is the position the valve moves to, or holds, when its motive power or control signal disappears [1]. Fail-open (FO) valves swing fully open, fail-closed (FC) valves shut, fail-last (FL) valves freeze where they were [1]. Nothing in those labels says which one is better. A valve that protects a boiler by closing would strand a filter backwash sequence if it closed; the same hardware can be built to do either. What matters is the process consequence of the movement.
Boards and plant managers rarely see this decision, because it usually hides in an instrument datasheet field labeled “fail action.” It deserves more attention than that label implies. The wrong fail position converts a utility interruption — an event the plant survives many times a year — into a flooded pit, an overdose of treatment chemical, a drained vessel, or a dead leg that breeds bacteria. The right one turns the same interruption into a non-event that the night shift logs and forgets.
The Three Positions at a Glance
| Fail position | How the valve gets there | Typical services | Watch-outs |
|---|---|---|---|
| Fail-closed (FC) | Spring-return actuator arranged air-to-open; the spring shuts the valve when air or power is lost | Emergency isolation, fuel gas and chemical feed shut-off, drains where uncontrolled flow is hazardous | Seat tightness in the failed position matters; a valve that keeps leaking closed is not fail-safe in fact [4] |
| Fail-open (FO) | Spring-return actuator arranged air-to-close; the spring opens the valve on energy loss | Cooling water, fire water, vent and relief paths, flush and seal lines | A valve that opens a line to atmosphere, or drains a vessel, may create a new hazard while solving one |
| Fail-last (FL) | Double-acting actuator with a lock-up valve or accumulator, or an electric actuator with a latching brake and backed-up control | Throttling duty where a sudden step disturbs the process, batch sequencing, boiler feedwater trim | Every stored-energy device carries its own failure modes and needs scheduled proof testing [5] |
That middle column is the conventional pairing of fail action and hardware [4][5], but it is a starting point for the hazard review — not a substitute for one.
How Each Position Is Engineered
Pneumatic spring-return actuators are the workhorses of fail-safe design. Air pressure moves the valve against the spring during normal operation; when the air is gone, the spring drives the valve to its rest position — open or closed, depending on which chamber the air acted on [2][5]. The energy source is mechanical and needs no compressor, battery, capacitor or logic, which is why functional-safety practice treats spring-return final elements as the reference design for de-energize-to-trip architectures [3]. When the logic solver cuts the output, a solenoid vents the actuator and the spring finishes the job even if the cable, the controller and the compressor have all failed at once [3].
Double-acting actuators have no spring. On loss of air they hold where they are — a true fail-last — unless hardware is added: a lock-up valve that traps the air inside the actuator, an accumulator that releases stored energy to drive the valve to a defined position, or a spring-return module bolted onto the actuator itself [5]. Fail-last achieved by friction alone is not accepted for safety duty. Electric actuators that must hold position through a power loss need a latching brake, a battery-backed control circuit, or a handwheel an operator can reach before the process drifts out of bounds [5].
Electric actuation changes the conversation in another way. A motorized valve that simply stops when power is lost behaves fail-last by default. If the hazard analysis demands open-on-failure or close-on-failure, the electric option must add a spring or a stored-energy return, which raises torque ratings, purchase cost and maintenance scope. It’s one reason plants with dependable instrument air keep pneumatic actuators on their most critical duty points even when the rest of the site has gone electric. Pneumatics cost air; electrics cost engineering to get the same safe state.
Choosing by Consequence: The Drain-Valve Question
Take a question that reaches every water treatment plant: when instrument air is lost, should the drain valve under a softener or filter open, close, or hold?
- Fail closed — the vessel keeps its inventory. Nothing drains to the sewer during the outage, chemical dosing upstream is not spilled into an empty line, and the operator restarts the sequence when air returns. The risk sits elsewhere: if the event that killed the air also created an overpressure or an overflow condition, a closed drain cannot relieve it, and the review must show that another path handles that case.
- Fail open — the vessel empties itself. Valuable in a flooding scenario, wasteful in every other one. A softener that discharges to the sewer through a two-hour air outage throws away brine and regenerated capacity, and it may dump water that a downstream process still needs.
Neither answer is wrong; each is right for a different consequence. The decision rule used in hazard reviews is to trace what the movement does to people, environment, equipment and product — in that order — and to pick the position that moves the process toward its safe state [1]. Industry convention supplies the starting vocabulary: shut-off duty on fuel and chemical lines typically closes, cooling and fire-water supplies typically open, and throttling services that would be shocked by a sudden step typically hold last [4]. Convention proposes; the consequence analysis disposes.
Two refinements matter. First, loss of air and loss of signal are different events with different likelihoods, and the intended behavior must be defined for each — a valve can hold on signal loss yet still close on air loss, depending on solenoid and positioner plumbing [2]. Second, the safe direction can differ between valves on the same header, so each tag number needs its own entry. Writing the intended fail position on every datasheet, and verifying it in the field with the solenoid de-energized, is the cheapest audit a plant can run [2].
De-Energize-to-Trip and the Double-Failure Question
Safety instrumented functions — the loops that take a process to a safe state when a hazard demand appears — are normally built on a de-energize-to-trip philosophy: remove power from the final element and it travels to its safe state [3]. The architecture is deliberately simple because its failure modes are benign: a cut cable, a blown fuse or a dead controller all end with the spring moving the valve [3]. For a board reviewing capital plans, the practical implication is that spring-return hardware on final elements is not a luxury item. It is the mechanism that makes the safety case credible.
The philosophy has a boundary worth understanding: it guarantees a safe response to a single energy loss. The double-failure question — power and air both gone, or an air failure during a fire that also severs the tubing — gets answered in the hazard review, not by the actuator. Reviews handle it with dedicated spring-return hardware, fire-safe trim and proof-test intervals, and they record the intended fail position for each energy vector separately. When a supplier presents a valve package, the question that earns respect is not “what does it fail to?” but “what does it fail to for each failure mode, and who proved it?”
What Goes in the Spec Line
A datasheet that leaves the fail position ambiguous transfers the decision to whoever happens to fill in the form. Specify, per valve: the fail position on air loss, the behavior on signal loss, the behavior on electrical power loss, the shutoff class required in the failed position, and the proof-test method that verifies all of the above. Suppliers who publish flow coefficients, pressure ratings and torque curves openly make this easy to check. Those who make you ask for the numbers usually have a reason.
This is also where valve sourcing connects back to the safety review. A replacement valve on an existing header must arrive with the same fail action the original logic assumed — drop-in compatible, same port size, same flow, same footprint — because a swap that silently turns a fail-open installation into fail-close has just rewritten the plant’s safety case without telling anyone. Shanghai ChiMay publishes fail action, connection sizes and flow data with its softening and filtration control valves precisely so that this line of the datasheet survives procurement, and the same valves can be configured for electric or hydraulic actuation where the review requires a defined rest position rather than a hold.
The Water-Treatment Short List
For managers of softening, filtration and RO pre-treatment plants, the practical summary is short. Feed and chemical-injection valves: fail closed unless the review says otherwise, because an uncontrolled dose is harder to undo than a stopped one. Cooling, flush and sample lines: fail open, because killed flow fouls membranes and starves analyzers faster than a temporary overshoot harms anything. Drain and vent valves: follow the consequence analysis — the drain under a filter usually closes to hold inventory, while a vent on a line that can gas-bind may need to open. Softener control valves and multiport valves: confirm what the sequence does on power loss; most modern controllers hold their cycle position and resume, which is a form of fail-last with a built-in clock, and the review should treat it as such. Every actuated valve gets its intended fail position written on the datasheet, verified at commissioning, and re-verified after every rebuild. None of this costs much. All of it pays the night the compressor stops.
References
- Merobix — Fail-Open vs Fail-Closed Valve. Definitions of fail-open, fail-closed, and fail-last action, and why the safety case rather than convenience drives the choice for each valve. https://www.merobix.com/blog/what-is-fail-open-vs-fail-closed-valve
- Fabrico — Control Valve Fail-Safe Position: Air-to-Open vs Air-to-Close. Air-to-open fails closed and air-to-close fails open; how process safety reviews set the position; loss of air versus loss of signal as distinct events; why fail-last appears on boiler feedwater. https://www.fabrico.io/blog/control-valve-fail-safe-air-to-open-vs-air-to-close/
- InstruNexus — IEC 61511 Functional Safety: Top 50 Questions and Answers. De-energize-to-trip (“fail-safe”) architecture: removing power or air drives the final element to its safe state through spring return, so outages and cut cables fail benignly. https://instrunexus.com/iec-61511-functional-safety-top-50-question-and-answers-you-must-know/
- Projectmaterials — What Is Fail-Safe Valve? Configuration table mapping fail-close, fail-open, and fail-in-place to typical applications such as fuel-gas shut-off, cooling water supply, and throttling service. https://blog.projectmaterials.com/quick-answers/valves/what-is-fail-safe-valve/
- Vajra Industrial Solutions — Valve Actuator Fail-Safe Action: Fail-Closed, Fail-Open, and Fail-Last. Spring-return versus double-acting actuators; lock-up valves, accumulators, and backup energy sources for fail-last duty. https://www.vajravyuh.com/blog/valve-actuator-fail-safe-action-guide
- Shanghai ChiMay Tech — softener control valve product overview. Softener and filtering control valves engineered for drop-in integration with installed softening and filtration systems, with published specifications. https://www.chimaycorp.com/tagdetail/1913159411433308160.html
About the author: Written by the Shanghai ChiMay Technical Editorial Team — editors working alongside Shanghai ChiMay’s softener and filtration control valve line, covering valve specification, fail-safe position review, and OEM customization programs for water treatment integrators and plant operators.
