Gregory Asselta | Trident Actuators

Fail-Safe Philosophies

When a power failure occurs, a facility’s control architecture must seamlessly transition to a defensive state. This requires a clearly defined fail-safe philosophy for every critical asset. A fail-safe actuator automatically moves a valve or gate to a predetermined “safe” position upon the loss of power or control. The ideal mode depends on the specific application:

• Fail-closed: Primarily used to prevent back-flow. In pumping applications, a fail-closed action prevents mechanical damage if power is lost while fluid is being moved. Similarly, influent gates use this mode to isolate treatment facilities during flood events.
• Fail-open: Essential for emergency bypass and overflow scenarios. If a plant loses power during a storm, these gates divert floodwaters away from sensitive equipment and into designated channels.
• Fail-in-place: In specific distribution networks, the safest action is to lock the valve in its current position to maintain system pressure. This could be managed via a secondary control signal. This special design is referred to as “fail-on-command.”

To achieve these transitions during a power outage, actuators rely on stored energy systems. Spring-return mechanisms provide a mechanical solution, though they are subject to fatigue over time and are unable to accommodate nonlinear closing speeds. Hydraulic power units (HPUs), conversely, use accumulators to store high-pressure hydraulic fluid. Upon power loss, the accumulator acts as a reserve, releasing this fluid to drive the valve or gate to its fail-safe position without requiring external electricity.

Beyond Power Loss

Infrastructure resilience requires more than just electrical backup. Some of the most catastrophic failures occur when equipment is compromised by flooding, debris or corrosive environments. Designing for failure requires looking beyond power availability and ensuring the equipment itself can survive the harsh conditions that triggered the outage.

Actuators in valve vaults and treatment plants are increasingly facing challenges that exceed historical design assumptions. As a result, engineers are placing greater emphasis on environmental robustness, prioritizing flood protection, corrosion resistance and the elimination of vulnerable external support systems.

In many critical applications, self-contained, unitized electrohydraulic actuators have emerged as an effective approach to addressing these requirements. By integrating power, control and stored energy into a single sealed housing, these systems can eliminate reliance on centralized air or hydraulic infrastructure, which may itself become compromised during a disaster. When developing a fail-safe strategy, this level of integration—alongside stored-energy capability, maintenance accessibility and redundancy—can be as important as the operational logic itself.

Hurricane Sandy (2012) demonstrates the value of this approach. During the storm, self-contained electrohydraulic actuators at a major New York City wastewater pump station remained submerged under several feet of water for approximately ten days. Once the waters receded, these units were returned to service without requiring repair or replacement, and they are still in operation to this day.

This performance confirms why utilities now prioritize equipment capable of withstanding extreme disruptions: Because critical infrastructure is built to last for decades, designing for these high-consequence events is a baseline requirement, not an optional feature.

Design Consideration: Redundancy, Logic & Response Time

Designing for failure and integrating fail-safe actuators into the broader system requires a holistic approach to reliability. For critical applications, this foundation begins with the hardware itself. Relying on external support systems, such as centralized hydraulic supply lines or compressed air, introduces vulnerabilities.

To mitigate these risks, engineers are increasingly specifying self-contained, unitized electrohydraulic actuators. By integrating power, control and stored energy into a single, sealed housing, these units eliminate reliance on external infrastructure, ensuring the system remains operational even if the surrounding utility networks fail.

With that foundation in place, the supporting design elements must be equally robust:

• Intelligent control logic: Supervisory control and data acquisition (SCADA) integration must go beyond basic commands. The system should be intelligent enough to distinguish between localized component faults and grid-wide outages, triggering specific, reliable fail-safe protocols rather than a generic response.
• Calibrated response times: While emergencies often demand rapid action, valve closure speeds must be calibrated carefully. Closing too quickly on large-diameter or long-distance pipelines can trigger dangerous hydraulic transients, a risk that must be balanced against the need for immediate flow control.
• Hardware redundancy: For critical assets, redundancy is nonnegotiable. Utilizing dual power sources, backup pumps, independent control paths and redundant feedback devices ensures that no single point of failure can compromise the facility’s ability to respond during an emergency.

Mitigating Water Hammer

Designing for failure involves more than just defining a fail-safe position; it requires awareness and management of the resulting emergency action. When a valve closes suddenly, the kinetic energy of moving fluid is halted abruptly, transforming into a high-pressure shockwave known as water hammer (or hydraulic transient). This force can easily exceed pipeline pressure ratings, resulting in blown gaskets, ruptured pipes or catastrophic system failure.

To manage this risk, actuators must be calibrated to close the valve rapidly enough to mitigate flooding or pump back-spin, but slowly enough to dissipate pressure safely. Modern actuator systems allow for modulated, nonlinear closure rates. For instance, an electrohydraulic actuator can be programmed to close a valve rapidly 80% of the way to isolate the bulk of the flow, then gently taper off for the final 20% to safely manage the remaining momentum without requiring external input or auxiliary infrastructure, even during an emergency fail-closed scenario.

Shifting Perspective

Designing for failure requires a deliberate shift in perspective. When infrastructure fails, the costs are not merely operational—they are measured in expensive equipment damage, environmental degradation, heavy regulatory fines and risks to public safety. The difference between a manageable disruption and a catastrophic event often comes down to the actuator’s ability to perform under the worst possible conditions.

For many critical applications, electrohydraulic actuation offers a compelling approach to resilient infrastructure design. By reducing reliance on vulnerable external support systems and incorporating local stored-energy capability, these systems can help ensure fail-safe actions are executed when they are needed most—during the very events the infrastructure was designed to endure.

As climate volatility and aging infrastructure continue to challenge utilities, the question is no longer whether a system will experience disruption, but whether that system is designed to respond when it occurs. In that environment, fail-safe actuation is not an optional feature—it is the cornerstone of resilient, reliable infrastructure design.