An ESD valve is not a valve type. It is a duty imposed on an ordinary quarter-turn valve: sit open for years, then close on command — on loss of signal, power or instrument air — inside a stated time, against full differential, and after a fire has burned around it. That duty makes the valve the final element of a safety instrumented function, which is why the actuator, solenoid and paperwork matter as much as the casting. Partial stroke testing keeps it believable between proof tests.
What an ESD valve actually is
The full form is emergency shutdown valve, tagged ESDV on most P&IDs: a fail-safe on/off isolation valve driven by a shutdown system — a trip relay on a skid, a safety PLC on a refinery unit. It has two legitimate positions. Nobody throttles an ESD valve, and one that sits part-open on process demand is not an ESD valve however the tender labels it.
Most ESD service in Indian oil and gas, city gas distribution, refinery and defence lands on a trunnion-mounted API 6D ball valve above roughly 4" or Class 300, a double-offset butterfly valve on large low-pressure lines, or a forged floating ball valve for fuel-gas isolation. The trunnion versus floating decision matters more here than in general service: actuator size follows torque, and torque follows construction.
ESDV, SDV, BDV, XV — the tag prefix is not decoration
An ESDV isolates inventory at a battery limit, wellhead or station boundary. An SDV shuts down within a process unit. A BDV is a blowdown valve that fails open to flare. An XV may carry no safety credit at all. Read the tag before you specify the actuator: a recurring RFQ error is a BDV given a fail-close spring copied from the ESDV line above.
Choosing the fail-safe action
The fail safe valve actuator is where the safety function lives. Spring-return means stored mechanical energy: cut the air, the signal or the 24 V DC to the solenoid and the spring strokes the valve to safety unaided. Double-acting actuators with a receiver and lock-up valve are defensible on large bore, but every added component carries a failure rate into the loop calculation. Where a spring will do, use a spring.
| Service | Fail action | Reasoning |
|---|---|---|
| Battery-limit or wellhead isolation (ESDV) | Fail close | Stopping inventory is the safe state; the spring closes on loss of air. |
| Blowdown to flare (BDV) | Fail open | Safe state is to relieve inventory; the air header may be what failed. |
| Fuel gas to a fired heater | Fail close, double block and vent | Burner management practice: two valves in series, vent between. |
| Transmission pipeline sectionalising valve | Fail in place, gas-over-oil or hydraulic | Spurious closure of a live line is itself a hazard; closure is commanded. |
Closure time is the parameter most often left blank and most often argued at commissioning. Pipeline specifications tend to start from a rule of thumb of one second per inch of size, but the real figure comes from the surge study — a valve that slams faster than the line can absorb has only moved the hazard from fire to water hammer. If the time is tight, reach for a quick-exhaust valve, not a bigger spring.
SIL, PFDavg and the proof-test interval
IEC 61508 and its process-sector application IEC 61511 define a safety integrity level as a band of average probability of failure on demand. The number belongs to the loop — sensor, logic solver, final element — not to any single part. The final element usually dominates that budget, which is why ESD valve procurement deserves engineering attention rather than a copied line item.
| SIL | PFDavg band | Risk reduction factor | Typical application |
|---|---|---|---|
| SIL 1 | 0.01 to 0.1 | 10 to 100 | Utility trips, non-critical isolation |
| SIL 2 | 0.001 to 0.01 | 100 to 1,000 | Most refinery, CGD and terminal ESD loops |
| SIL 3 | 0.0001 to 0.001 | 1,000 to 10,000 | HIPPS, wellhead, high-consequence duty |
| SIL 4 | 0.00001 to 0.0001 | 10,000 to 100,000 | Effectively unused in process plant |
The phrase SIL rated valve fills tenders and means nothing on its own: no valve carries a SIL by itself. A competent supplier offers an FMEDA with a dangerous-undetected failure rate, a systematic capability statement, and an assessment from a body such as TUV or exida confirming the device suits a SIF to a stated level. Ask for those by name; "SIL 3 certified" with no FMEDA behind it is marketing.
For a 1oo1 final element the arithmetic is unforgiving: PFDavg is roughly the dangerous-undetected failure rate times the proof-test interval, halved. Double the interval, double the risk contribution. A plant wanting a five-year turnaround on a loop sized for annual full-stroke testing can accept a lower SIL, add redundancy, or buy diagnostics — the third is partial stroke testing.
What partial stroke testing actually buys you
A partial stroke test valve arrangement moves the valve through 10% to 20% of its travel with the process online, then returns it fully open. If it moves, a family of dangerous-undetected failures becomes detected: a seized stem, a corroded scotch yoke, a varnished solenoid spool, a bearing rusted up over four monsoons.
How the test is run
Three implementations dominate. A solenoid-pulse test energises and de-energises the trip solenoid for a controlled interval — cheap, crude, dependent on tight timing. A mechanical or hydraulic travel limiter blocks further movement: robust, but needs resetting. A smart positioner logs a pressure-versus-travel signature; read against the commissioning baseline, it exposes rising breakaway torque long before the valve sticks. Whichever route, the logic solver must abort the test and shut the valve the instant a real demand arrives.
The limits of a partial stroke test
- Seat leakage. The valve never nears its seat; only a full closure and leak measurement proves tightness.
- Seating torque. Breakaway from full open is not the load needed to seat a ball against differential pressure.
- Obstruction further down the travel. Scale, hydrate, weld spatter or a mispositioned stop sits outside the tested band.
- Spring at the closed end. A spring-return actuator delivers least torque where seating load is highest, and PST barely loads it.
- Process risk. Every test perturbs a live line; on compressor suction or fired-heater fuel, weigh the gain against the upset.
PST is typically credited with detecting roughly two thirds of dangerous failures. Treat that percentage as a claim until the FMEDA backs it: the figure feeds straight into the loop calculation, and inflating it is the easiest way to make a marginal SIL 2 design look compliant. Used honestly, PST stretches the proof-test interval out to the turnaround cycle while holding the target PFDavg — the whole commercial case for the hardware.
Specifying the valve itself
Start from API 6D for pipeline and hydrocarbon isolation: full bore where pigging or pressure drop demands it, anti-static device, blowout-proof stem, drain and vent connections, locking provision — our API 6D ball valve selection guide covers it line by line. State the seat tightness too: API 6D asks for no visible leakage across a resilient seat, while metal seats are allowed a measured rate against an ISO 5208 class. ESD duty adds two more.
- Fire-safe design. Soft-seated quarter-turn valves are tested to API 607 or ISO 10497; API 6FA covers valves built to API 6D and 6A — see our note on API 607 versus API 6FA. Demand the certificate for the exact design, size range and class.
- Material fitness. A216 WCB or A105 for sweet hydrocarbon; A350 LF2 with impact testing where the design minimum temperature drops, as on blowdown lines; NACE MR0175 hardness control wherever H2S is credible; duplex F51 where chlorides and CO2 combine.
On a large-bore, low-pressure line — cooling water, seawater, LP fuel gas headers — a double-offset butterfly valve with a spring-return actuator is usually right, and costs less than a ball valve of the same bore. It is no substitute in gas-tight hydrocarbon isolation, where the trunnion valve's double block and bleed decides it.
Actuator, solenoid and the accessory list
Size the actuator against the maker's published break-to-open and end-of-travel torque at maximum differential, with a margin of 25% to 50% — ESD duty belongs at the top of that band, since the valve may have sat untouched for years. A scotch yoke gives its highest torque at the start and end of travel, matching a ball valve's demand; a rack and pinion gives constant torque and suits butterflies. The actuator sizing and torque guide works it through.
- Solenoid: 3/2-way, energise-to-hold so de-energising trips the valve, NAMUR mounted, low-power coil for IS loops, certified for the zone and gas group. Redundancy cuts both ways: 1oo2 so either solenoid can vent and trip the valve, 2oo2 where a spurious trip costs more than a missed one.
- Feedback: open and closed proximity switches, plus a position transmitter where PST signatures are trended.
- Thermal protection: a fusible-link plug venting actuator air on fire exposure, so the valve trips even if the tubing survives.
- Mounting and air: a correctly sized ISO 5211 pad with a machined bracket and coupling, and dry filtered air. Field-fabricated brackets and wet air are why ESD valves fail to seat.
Documentation and Indian tendering realities
In India the ESD package is judged on its file as much as its hardware. City gas networks follow the PNGRB technical standards; refineries and terminals follow OISD standards and an EIL or client datasheet naming the actuator make. Hydrocarbon ESD duty sits outside the IBR regime, which governs steam — if an enquiry mixes an ESD skid with boiler-side isolation, split the scope. Agree the list below before the purchase order, not at inspection.
- EN 10204 3.1 MTCs for body, bonnet, ball and stem; 3.2 where the client's inspector must countersign.
- Shell and seat test reports to API 598 or API 6D plus the air seat test, traceable to serial number.
- Fire-test certificate for the exact design, plus hazardous-area certificates for every electrical accessory.
- FMEDA and SIL suitability assessment for valve, actuator and solenoid, with PST diagnostic coverage stated.
- Signed torque and actuator sizing calculation, plus a FAT stroke test with the actual solenoid and positioner: closure time recorded, baseline PST signature handed over.
