Local Control-Valve Air Failure — Fail-Open vs Fail-Closed Surprise

A single air-operated control valve loses its air or signal and goes to its spring fail position — but that position turns out to be wrong for the current operating mode, dumping feed forward or blocking an outlet with the pump still running.

CCPS documents a real incident where different fail positions under loss-of-signal vs loss-of-air over-pressurised very large vessels during shutdown, with loss of containment near an occupied building ; guidance stresses identifying the correct fail position for every safety-critical valve, and warns a "fail-open"…

1. Predict where the valve went on loss of air (know its fail action for the current mode).
2. Catch the resulting transient early (pressure, level, or flow diverging).
3. Take manual action — block/bypass the valve, cut the pump, or open a relief path.
4. Verify the system is rebalanced and the relief path stayed clear.

LOPA practice treats a BPCS instrument-loop/control failure as ~1×10⁻¹ per year per loop (dangerous failure rate ≥1×10⁻⁵/hr for non-IEC-61511 BPCS) (HAZOP360 LOPA initiating-event guidance,…

Over-pressurisation of vessels, blocked-outlet transients, runaway feed-forward flow, and loss of containment near occupied areas (CCPS China 2014 incident paper).