Solenoid Valve: DC/AC, Single/Double Energize

Solenoid Valve Fundamentals in Functional Safety

A solenoid valve is often the last electrically-actuated component before mechanical action occurs in a safety instrumented function (SIF). Everything upstream — logic solver, wiring, I/O cards — exists to get one decision (trip or don't trip) to this device. Get the solenoid valve wrong and the rest of the loop's SIL budget is academic.

Role as a Final Element in SIS chains

In a typical emergency shutdown (ESD) loop, the solenoid valve sits between the safety PLC's digital output and the actuator of a shutoff or control valve. It converts an electrical command into a pneumatic or hydraulic signal that moves the actuator to its safe position. Because it is a final element, its failure modes count directly against the safety function's probability of failure on demand (PFD), alongside the sensor and logic solver contributions. Architecture and energization choices made here are inseparable from valve body and actuator selection discussed in Final Element: Fail-Safe Valve Selection.

Electromagnetic actuation principles

A solenoid valve uses a coil wound around a plunger or armature. Energizing the coil generates a magnetic field that pulls the armature, opening or closing a pilot orifice. That pilot signal then strokes the main valve, either directly (direct-acting) or through amplified air volume (pilot-operated). The force available scales with ampere-turns and air gap; as the gap closes, holding force rises sharply — which is why inrush and holding current differ substantially, a detail that matters more for AC coils than DC.

Interaction with IEC 61511 design requirements

IEC 61511 treats the solenoid valve as part of the final element subsystem requiring a documented failure mode, a verified safe state, and a proof-test regime sufficient to detect dangerous undetected failures within the proof-test interval. The standard does not mandate DC over AC or single- over double-energize — it requires that whichever choice is made, the resulting PFD_avg and architectural constraints (hardware fault tolerance) are justified by data, typically from an FMEDA, documented in the safety requirements specification and signed off per Functional Safety Sign-off Documentation.

DC-Energized Solenoid Valves

Direct current coil design and response time

DC coils hold a constant current once at steady state, with response time governed by coil inductance and the mechanical mass of the armature. Typical direct-acting 24 V DC solenoid valves actuate in tens of milliseconds; consult the manufacturer's datasheet for the specific response time curve against coil resistance and supply voltage tolerance, since SIS logic solvers often run at 24 V DC with some sag under load.

Holding force and power consumption

Because DC current doesn't fluctuate with impedance changes the way AC does, holding power is stable and predictable — typically in the single-digit watts range for standard-duty coils. This steady power draw simplifies thermal design and makes continuous-duty (energized-to-run or energized-to-trip) applications straightforward.

Safety-critical advantages: predictable de-energization

The de-energization behavior of a DC coil is clean: when current is removed, the magnetic field collapses quickly and the spring return (in single-energize designs) drives the valve to its fail-safe position without the residual magnetism complications AC coils exhibit. This predictability is a major reason DC solenoids dominate SIS applications — the trip response is repeatable within a narrow time band, which matters when the safety function's required response time is a design input.

Typical SIS deployment scenarios

24 V DC solenoids driven directly from safety PLC digital output cards are the default for ESD valves, blowdown valves, and emergency depressurization systems where the logic solver itself is DC-powered and redundancy is achieved through voting output channels rather than AC switching contacts.

AC-Energized Solenoid Valves

Alternating current coil design and duty cycle

AC coils rely on a laminated core to limit eddy-current losses, and their impedance is dominated by reactance rather than resistance. Current draw is a function of frequency and the air gap, which changes as the armature moves — this is fundamentally different from DC behavior.

Inrush current and thermal management

An AC solenoid draws its highest current (inrush) at the moment of energization, when the air gap is largest and reactance is lowest; current drops once the armature seats. If the armature fails to seat fully — due to debris, worn guides, or mechanical binding — the coil remains in a high-current state and can overheat within seconds to minutes depending on coil rating, leading to burnout. This failure mode has no equivalent severity in DC coils and must be accounted for in thermal and reliability calculations.

Residual magnetism and fail-safe implications

After de-energization, AC cores can retain a small amount of residual magnetism, occasionally enough to delay full armature release in marginal designs. In a fail-safe, spring-return architecture this is rarely catastrophic but it does add variability to de-energization time — a parameter safety engineers should treat as a measured, not assumed, value.

Functional safety trade-offs in AC systems

AC solenoids are still used where plant power infrastructure is AC-native and DC conversion is impractical, but the inrush-driven burnout mode and less deterministic de-energization timing generally push SIL-rated designs toward DC coils or AC-to-DC converted outputs at the valve.

Single-Energize vs. Double-Energize Architecture

Single-energize: solenoid actuates, spring return on de-energize

The classic SIS configuration: the solenoid is energized during normal operation, holding the valve in its non-safe running position against a spring. On de-energization — whether commanded or due to loss of power/wiring fault — the spring drives the valve to its safe state. This is the textbook fail-safe-by-de-energization architecture and gives inherent fail-safe behavior on power loss, a key reason it's the default for SIL 2/SIL 3 shutdown valves.

Double-energize (pilot-operated): redundant energization paths

Double-energize architectures use two solenoids, each requiring energization to move the valve in a given direction (open-to-close and close-to-open), with neither spring-biased to a default state. These are chosen when the process cannot tolerate a spurious trip from a single solenoid fault — for example, where nuisance trips are more costly than a slightly longer fault-detection window. The trade-off is that loss of safe-state determinism on power failure must be compensated by other means (dual power supplies, backup pilot accumulators).

Fail-safe state mapping for each architecture

Diagnostic monitoring and proof-testing considerations

Double-energize designs need explicit position feedback (limit switches, pilot pressure switches) because the valve no longer "proves itself" by defaulting to safe state on fault. This diagnostic burden must be reflected in the FMEDA per FMEDA for SIS Component Reliability, since diagnostic coverage credit cannot be assumed without instrumented proof.

Selection Criteria for SIS Application

Safety Integrity Level (SIL) target and redundancy needs

A SIL 3 shutdown function with a single final element typically requires either a proven single-energize solenoid with high diagnostic coverage or a 1oo2 voted pair of solenoids. The selection directly affects the achievable hardware fault tolerance (HFT) per IEC 61511 Part 1 Table 5/6 — solenoid architecture isn't a footnote, it's an input to the HFT calculation.

Process pressure and flow rating alignment

Coil force must overcome pilot pressure plus any differential pressure across the orifice at worst-case process conditions; undersized coils stall rather than fail cleanly, producing an ambiguous failure mode that's hard to diagnose remotely.

Response time constraints vs. safety function demand rate

If the process safety time (PST) requires valve stroke completion within, say, 2 seconds of solenoid de-energization, the sum of solenoid response time, pilot volume fill/exhaust time, and actuator stroke time must fit inside that budget with margin — verify this against the SRS, not the solenoid datasheet alone.

Environmental factors: temperature, vibration, corrosion

Coil insulation class, enclosure rating (NEMA/IP), and vibration-resistant mounting all affect long-term reliability; a coil rated for 40°C ambient in a desert-sited compressor station is a latent failure waiting for summer.

Failure Modes and Diagnostic Coverage

Solenoid coil degradation and open/short circuits

Coil winding insulation breaks down over thousands of thermal cycles, eventually producing an open circuit (loss of actuation — usually safe in single-energize) or a short circuit (potential overcurrent, nuisance trip of the output card, or in rare cases weld-and-stick of a relay contact).

Pilot pressure loss in double-energize designs

A blocked or leaking pilot line in a double-energize system can leave the main valve stranded mid-stroke without affecting coil current at all — a failure invisible to simple current-loop diagnostics and detectable only via pilot pressure switches or position feedback.

Valve spool stiction and mechanical wear

Spool valves accumulate varnish, debris, or corrosion that increases the force needed to shift, sometimes enough that the rated coil can no longer move it within the SIF's response time window even though electrically the solenoid is healthy.

How architecture choice affects diagnostic coverage in FMEDA

A single-energize solenoid with no position feedback typically achieves low diagnostic coverage for "fails to actuate on demand," because the only detection path is a full-stroke proof test. Adding a limit switch or partial-stroke test capability raises the diagnostic coverage used in the DC calculation described in Diagnostic Coverage (DC) Calculation, which in turn can reduce the required proof-test frequency for the same PFD_avg target.

Integration with PLC/DCS/SCADA Logic and Proof-Test Strategy

Output module requirements and voting logic

SIL-rated digital output cards for solenoid drive typically support line monitoring (open/short detection on the field wiring) and, for 1oo2 or 2oo3 voted solenoid pairs, de-energize-to-trip logic coordinated across redundant channels to avoid common-cause failure from a single card fault.

Periodic proof-testing: manual vs. automated cycles

Manual proof tests require physically cycling the valve and confirming full stroke and timing, usually during a planned shutdown. Automated partial-stroke testing (PST) exercises the valve a few percent of full travel under process conditions, detecting stiction and coil degradation without interrupting production, though PST alone does not substitute for a full-stroke test's diagnostic coverage.

Valve status feedback and cross-check validation

Position switches, pilot pressure transmitters, or current-signature analysis on the coil feed let the PLC cross-check commanded state against actual state continuously rather than only at test time, closing much of the gap left by single-energize architectures with no native feedback.

Documentation of test intervals per IEC 61511

The proof-test interval used in the PFD_avg calculation must match the interval actually implemented in the maintenance management system, and any PST credit claimed must be justified with the same rigor as the base proof test — this traceability is exactly what gets audited during functional safety sign-off.

A worked sanity check: for a single-energize DC solenoid with no feedback, DC = 0% for "fails to de-energize," proof-test interval 12 months, and a failure rate λ_D from the FMEDA — the contribution to PFD_avg is approximately (λ_D × TI) / 2. Doubling the proof-test interval to 24 months roughly doubles that term, which is often the single largest lever available to bring a borderline SIL 2 loop back into compliance without hardware changes.