11

Control Valve Position on

Instrument Air Failure

One of the critical decisions that the Process Control Engineer must make is
which way a control valve will move upon loss of instrument air pressure.
When creating the P&IDs (process & instrumentation diagrams) for a plant,
the control valves should be labeled as follows:

• APO—Instrument air pressure failure will cause the control valve to

close. (APO means air pressure opens the valve.)
• APC—Instrument air pressure failure will cause the control valve to
open. (APC means air pressure closes the valve.)

The final position of the control valve when there is a total loss of instru-
ment air pressure is a vital safety consideration. For example, in the event of
a failure of the instrument air supply, the fuel gas regulator valves to a fired
heater must fail in a closed position (APO).
Figure 11-1 shows a control valve arranged within an instrument air supply
that opens the valve. A length of ¼-inch copper tubing supplies air pressure
on the underside of the diaphragm. There are some rare exceptions to this rule
relating the valve action to the air tubing location. But 95+% of the time,
Figure 11-1 does apply. The same control valve can be connected with the air
supply above or below the diaphragm, so that it can fail in either position.
To change a control valve from APO to APC is a simple procedure. If you
feel the current situation is unsafe, mechanically it is simple to change the

Troubleshooting Process Plant Control, by Norman P. Lieberman

Copyright © 2009 John Wiley & Sons, Inc.

93
94 CONTROL VALVE POSITION ON INSTRUMENT AIR FAILURE

Figure 11-1 A control valve that will fail closed on loss on of instrument air

action of a control valve. But this must involve a formal HAZOP review with
plant management and operating personnel.

Nitrogen Backup
Of course, it would be best not to lose instrument air pressure in the first place.
I accomplished this objective at one refinery by connecting the instrument air
supply to the plant nitrogen system. Note that plant air is not a suitable backup
for instrument air, as the plant air has not been chemically dried.
There is a potential hazard with the use of nitrogen as a temporary replace-
ment for instrument air. Pneumatic panel board instruments use several cubic
feet per minute of instrument air. It is entirely possible to displace air from a
control room with nitrogen when the instrument air compressor trips off. Lack
of oxygen does not cause any breathing discomfort but does cause death
without prior notice. The manager of the refinery observed that this was not
one of my better ideas.

Levels
The vessel bottoms level control valve shown in Figure 11-2 will fail in a closed
position. If it were to fail in an open position, high-pressure fuel gas would
blow through into the storage tank. On the other hand, when this valve fails
closed, and the feed to the vessel may continue, the vessel would fill with liquid.
Then the liquid would be carried overhead into the fuel gas system. This is
also undesirable, but not as bad as fuel gas possibly overpressuring the storage
tank.

CONTROL VALVE ON DISCHARGE OF PUMP

Let us assume that we have an inline booster centrifugal pump. On the dis-
charge of this pump there is a control valve. Should we specify APO or APC?
 CONTROL VALVE ON DISCHARGE OF PUMP 95

Figure 11-2 Level control valve fails safely in a closed position

In the event of a loss of instrument air pressure, the APC valve would open.
The pump discharge flow would increase until the pump suction pressure
became too low.
This would cause the pump to cavitate, and the resulting vibration would
damage its mechanical seal. The ruined pump mechanical seal would then
allow hazardous process fluid to escape from the pump case into the
environment.
Alternately, in the event of a loss of instrument air pressure, the APO valve
would shut. The pump discharge flow would also stop. The pump internal
components would gradually overheat. The pump’s seal faces would dry out
and damage the softer carbon face. This is also bad. However, cavitation ruins
seals much faster than overheating. If this control valve is designed for APO,
it gives the operators more time to safely shut off the pump than if the control
valve was APC.
Instrument air failure is always going to be bad news. However, we must
select the path of least evil, which in this case is to have the control valve close
upon loss of instrument air pressure, that is, APO. We do not need to be con-
cerned about overpressuring the piping downstream of the centrifugal pump,
as by law the piping downstream of the pump must be rated for the maximum
possible pump discharge pressure (see API Boiler Code).
If we are dealing with a positive displacement pump, I would draw a differ-
ent conclusion. A gear type or reciprocating pump can develop extremely high
and destructive pressures once the discharge control valve is closed. For such
an inline booster pump, an APC valve is preferred. I have seen a reciprocating
pump lose suction pressure. It made a clanging sound, but no immediate
damage was apparent.
96 CONTROL VALVE POSITION ON INSTRUMENT AIR FAILURE

CONTROL VALVE ON THE DISCHARGE OF A COMPRESSOR

Let us assume we have a motor-driven, fixed-speed centrifugal compressor.

On the discharge of the compressor there is a control valve. Should we specify
APO or APC? If the instrument air pressure is lost, the APO valve would shut.
The compressor discharge pressure would rise sharply, and the flow would
stop. From some very nasty personal experience at my Alkylation Unit, at the
Amoco Refinery in Texas City, I know what will happen. The compressor will
start to surge (see Chapter 15, “Centrifugal Compressor Surge vs. Motor Over-
Amping”). Surge is a destructive phenomenon that will, in the following
sequence:

• Damage the rotor’s thrust bearing.

• Cause the rotating wheels to hit the stationary case elements called the
labyrinth seals.
• Break off a piece of the rotor that will blast through the compressor
case.

Control valves on the discharge of centrifugal compressors ought to fail in

an open position (APC) upon loss of instrument air. This will lead to an unfor-
tunate loss in suction pressure, which is also bad, but not as bad as the sudden
surging that happens when blocking in the compressor discharge.
In the case of a positive displacement reciprocating compressor, I would
also have a control valve on the discharge fail in an open position (APC), so
as to avoid overpressure of downstream piping. This could cause a piping
flange to blow out or cause the downstream pipe to rupture. A ruptured pipe
looks just like someone has sliced the pipe open along its length, like a peeled
banana.
I cannot think of any good reason for the Process Control Engineer to
locate a control valve on the discharge of any compressor or blower. Correct
design uses suction throttling and/or spillback control valves (as per Chapter
15). Regardless, control valves on the discharge of compressors are not uncom-
mon. If used, they ought to be shown on the P&IDs as APC, so as to fail open
upon the loss of instrument air pressure.

PRESSURE CONTROL OF VESSELS

Typically a backpressure control valve on a vessel should fail in an open posi-

tion (APC). However, as shown in Figure 11-3, this is not always true. Here
the feed valve fails closed upon the loss of instrument air pressure. The feed
to V-1 stops. Let’s assume that the backpressure control valve on V-1 opens
on air pressure loss (APC). Then the pressure in V-2 may get quite low. Since
naphtha is being condensed, the temperature and vapor pressure in V-2 could
become very low, even subatmospheric. Then the pressure in V-1 would fall to
 FUEL GAS TO HEATERS 97

Figure 11-3 Pressure control valve failure position depends on feed control valve failure
position

a partial vacuum. Unless V-1 was designed for such vacuum conditions, which
would be unusual, V-1 could collapse. I’ve seen this ugly event.
Let’s now assume that the backpressure control valve on V-1 closes on air
pressure failure (APO). Then the pressure in V-1 is just the vapor pressure of
the liquid in V-1. Of course, the possibility of overpressuring V-1 does increase
if the backpressure control valve is APO. But V-1 is protected, as shown in
Figure 11-3, by a relief valve from overpressure damage. However, V-1 is not
protected from collapse due to excessive vacuum.
This example is a good illustration as to why the Process Control Engineer
ought to be careful to think through each control valve failure position in
relation to the other control valve failure positions upon the loss of instrument
air pressure. This is exactly the sort of discussion that should take place during
HAZOP meetings and P&ID review sessions.

FUEL GAS TO HEATERS

Figure 11-4 shows four control valves associated with a fired heater and their
failure positions in the event of a loss of instrument air pressure:

• The heater outlet temperature control valve would fail in a closed position
since the valve is opened with air pressure (APO). With a loss in unit
controllability, the first and most important control objective is to imme-
diately reduce heat input to the process equipment.
98 CONTROL VALVE POSITION ON INSTRUMENT AIR FAILURE

Figure 11-4 Example of air failure valve positions for heater

• The heater feed flow control valve would also fail in a closed position.
The flow is typically coming from a centrifugal pump. As previously dis-
cussed in this chapter, the pump discharge flow would be shut in to pre-
serve the integrity of the pump’s mechanical seal.
• The velocity steam flow control valve would fail in an open position since
the valve is closed by air pressure (APC). With a loss in feed flow the
maximum flow of velocity steam is critical to clear residual hydrocarbons
from the heater tubes. The furnace refractory lining radiates heat for many
minutes. This radiated heat could promote coke formation inside the
furnace tubes due to the thermal cracking of the residual hydrocarbons.
• The boiler feed water (BFW) control valve would also fail in an open
position (APC). The residual radiant heat released from the refractory
walls in the radiant section could damage the convective section. Continu-
ing the BFW circulation would keep the convective section reasonably
cool.

The general objective is to minimize the heat input and maximize the heat
extraction from process equipment during a plant emergency such as loss of
instrument air pressure. For a distillation tower, as shown in Figure 11-5, we
would cause the following control valves to close (APO) during such an
emergency:

• Steam flow to the reboiler to minimize heat input to the tower

• Bottoms level to avoid high pressure vapor in the tower from blowing
into a storage vessel
 AVOID LOSS OF AIR PRESSURE 99

Figure 11-5 Example of air failure valve positions for a distillation tower

• Reflux drum level to prevent high-pressure vapor from blowing into a

storage vessel
• Hot vapor bypass valve would also close (APO) to maximize the con-
denser heat removal.

The reflux pump flow control valve would, on the other hand, fail in an open
position (APC). The reflux would be partly revaporized by the heat in the
tower. Continuing the reflux as long as possible would maximize the potential
to extract heat from the tower and to pass this heat on to the overhead con-
denser. The revaporization of flowing reflux would help prevent the reflex
pump from cavitation for some reasonable period of time before the operators
manually shut down the reflux pump.

AVOID LOSS OF AIR PRESSURE

Instrument air failure on a process unit is one of the most dangerous aspects
of process plant control. I’ve always tried to avoid this by:

• Providing a backup source of nitrogen as discussed above

• Having several air compressors, each only partly loaded
100 CONTROL VALVE POSITION ON INSTRUMENT AIR FAILURE

• Making very sure my air dryer desiccant was in good physical condition.
I learned this ugly lesson at Texas City in 1974 during an unusual freeze.
Water in my instrument air lines froze up and remained so for two full
days.
• Having a backup diesel generator to supply electricity to the instrument
air compressor in case of a plantwide electric power failure
• Only use the instrument air supply for instrument purposes. Do not permit
the “temporary use” of instrument air to power tools or run other air-
operated equipment.
• In the Coastal Refinery in Aruba, 90% of the instrument air supply was
lost to leaks. Find and fix such leaks before the instrument air pressure
becomes marginally low.
• Never connect other utility systems to the instrument air supply. At the
Three Mile Island Nuclear Power Plant failure, the operators connected
a water hose to an instrument air line, which precipitated the emergency
and almost catastrophic shutdown of this power plant.

In summary, the Process Control Engineer should discuss his plans for
control valve position failure with unit operators. Thinking the problem
through carefully ahead of time can convert a deadly situation into an incon-
venience. Anticipating problems is the essence of good engineering. The worst-
case scenario is that failure mode that creates a positive feedback loop. The
most infamous and deadly example of this in world history is the nuclear
power plant fiasco at the Soviet #3 power station in Chernobyl in 1986. This
was the perfect example of Process Control Engineering at its worst. It directly
led to the demise of the communist system in Russia and of the USSR’s
empire.