Every permit-to-work system in industrial operations rests on a single foundation: the assumption that the isolation it specifies actually isolates. An operator who closes a valve, applies a lock, and issues a permit to work on the downstream system has made a decision — conscious or not — that the valve will hold. If the valve does not hold, the permit-to-work system has not failed. It has been defeated by the maintenance programme that allowed the valve to reach that condition.

Valve integrity is not a maintenance topic at the periphery of process safety. It is the physical basis on which isolation assurance — and therefore safe work execution — depends. This is a forensic account of what an industrial valve integrity programme requires, why isolation valves fail to isolate, and what the consequences are when a permit assumes positive isolation that does not exist.

Valves as Safety-Critical Assets

Not all valves carry the same integrity obligation. A general service valve on a low-pressure water line has a different risk profile from a block valve on a high-pressure hydrocarbon line that will be relied upon to isolate a vessel during maintenance entry. The programme must make this distinction explicitly — because a programme that applies the same maintenance standard to both will under-maintain the critical valve and over-maintain the non-critical one.

Valve Classification by Integrity Obligation

  • Safety-critical isolation valves — Valves that are relied upon to achieve positive isolation for permit-to-work purposes: block valves on vessels, equipment isolation valves, emergency shutdown valves (ESDVs), and blowdown valves. These valves require a proof-of-closure testing programme, documented condition assessment, and a defined maximum allowable passing rate (leakage past the closed seat).
  • Process control and regulation valves — Control valves, throttling valves, and regulating valves. Primary failure mode is loss of control function rather than loss of isolation. Require stroke testing, actuator maintenance, and positioner calibration on a documented programme.
  • General isolation valves — Block valves not relied upon for positive isolation in safety-critical applications. Require condition monitoring and lubrication on a scheduled basis. Seat leakage is a process efficiency concern rather than a safety-critical failure mode.
  • Emergency and fire-safe valves — Fire-safe valves, deluge valves, and fire isolation valves. Require proof-of-function testing against their emergency design case — not just routine open/close exercise. A valve that operates normally under process conditions but fails under the fire-safe design condition has never been tested for its intended function.

The Governing Standard Set

Governing Standards — Industrial Valve Integrity

  • ASME B16.34 — Valves: Flanged, Threaded, and Welding End — Design and pressure-temperature rating standard for industrial valves. The baseline against which valve condition assessment and fitness-for-service determinations are made. A valve operating beyond its B16.34 pressure-temperature rating is a pressure-retaining failure, not a maintenance issue.
  • API 598 — Valve Inspection and Testing — Shell hydrostatic test, seat closure test, and backseat test requirements for new and repaired valves. Defines the acceptance criteria for valve seat leakage by valve type and pressure class. The standard that repair and testing facilities must work to — and that the programme must verify they are applying.
  • API 6D — Pipeline and Piping Valves — Governs ball valves, gate valves, and check valves in pipeline service. Relevant for transmission and distribution assets and for high-pressure process valves in oil and gas service.
  • IEC 61511 / IEC 61508 — Functional safety standards for safety instrumented systems. Govern ESDVs and other valves that form part of a safety instrumented function (SIF). These valves require proof-test intervals determined by the safety integrity level (SIL) of the function they serve — not by a general valve maintenance schedule.
  • ISO 45001 — Occupational Health and Safety — The safety management system standard that governs the permit-to-work process and the isolation management requirements within which valve integrity plays a direct role.
  • TSSA O. Reg. 220/01 — Ontario regulatory obligations for pressure-retaining components including valves in pressure equipment service.

What an Execution-Grade Valve Integrity Programme Requires

  1. Valve Register — Safety-Critical Valves Identified Every valve in the facility registered with tag number, valve type, size, pressure class, service fluid, B16.34 rating, location, and — critically — safety criticality classification. Safety-critical isolation valves flagged in the register and subject to enhanced maintenance and testing requirements. A safety-critical valve that is not identified as such will receive the same maintenance treatment as a general service valve — which is inadequate for the duty it is being asked to perform.
  2. Proof-of-Closure Testing for Safety-Critical Isolation Valves Safety-critical isolation valves tested for seat tightness on a documented interval — not assumed to be closed because they are in the closed position. API 598 defines the acceptance criteria. A valve that exceeds the allowable seat leakage rate is not a closed valve. It is a passing valve. A permit-to-work that relies on a passing valve for isolation has no isolation. The testing programme is the only mechanism that distinguishes between the two conditions.
  3. Actuator and Stem Seal Maintenance Valve packing and stem seals inspected and replaced on a scheduled basis. Stem seal failure is the primary external release mechanism on valves in process service — a slow seep that accumulates into a significant emission source, particularly on valves in hydrocarbon or toxic service. Actuator maintenance — including manual override function verification — ensures the valve can be operated under emergency conditions when the normal operating mechanism is unavailable.
  4. ESDV Proof-Test Programme — SIL-Aligned Intervals Emergency shutdown valves tested for full stroke function on intervals determined by the SIL demand of the safety instrumented function they serve. Partial stroke testing (PST) acceptable as an intermediate check between full stroke tests where engineering justification supports it. PST does not replace the full stroke test — it supplements it. A programme that substitutes PST for full stroke testing without a documented SIL-based justification has not demonstrated that the ESDV will fully close on demand.
  5. Double Block and Bleed Verification Protocol Where double block and bleed (DBB) arrangements are used as the isolation method for permit-to-work purposes, the programme must verify that both block valves achieve the required seat tightness standard and that the bleed connection between them is confirmed open and confirmed clear before the permit is issued. A DBB arrangement with one passing block valve is a single block arrangement with an assumed second block. It is not positive isolation.
  6. Valve Condition Assessment at Shutdown Planned shutdown windows used to assess the internal condition of safety-critical valves that cannot be tested or inspected in service: seat and disc condition, body wall thickness where corrosion is a mechanism, stem and packing condition, and actuator function. Condition findings from shutdown inspections fed back into the valve register and used to update maintenance intervals. A shutdown that opens valves for replacement without recording condition data has wasted the opportunity to improve the programme.

The Five Failure Modes That Compromise Isolation Assurance

Failure Mode 01 — Seat Degradation in High-Cycle Service

Gate valves, globe valves, and ball valves in frequent cycling service develop seat wear that progressively increases seat leakage. In general process service, this presents as a throughput or efficiency loss. In isolation service — where the valve is closed and relied upon to prevent flow to a work area — it presents as isolation failure. A valve that has been cycled thousands of times in production service without condition assessment may have seat leakage that exceeds the API 598 acceptance criterion by an order of magnitude. It will close. It will not isolate.

A valve in the closed position and a valve that is closed are not the same thing. One is a mechanical position. The other is a verified condition. The permit-to-work system issues permits against positions. The integrity programme is the only mechanism that verifies conditions.

Darryl Mohammed — Principal, Rock Industrial Solutions Limited

Failure Mode 02 — Stem Packing Bypass Not Identified as Isolation Risk

Degraded valve stem packing in a safety-critical isolation valve creates a bypass path around the valve body — a path from the upstream pressure side to the downstream work area that exists regardless of whether the valve disc or ball is in the closed position. In most facilities, a weeping valve stem is treated as a fugitive emission issue and placed on a packing replacement backlog. It is not identified as an isolation integrity issue. The permit-to-work system is never informed. The valve continues to be used for isolation while bypassing around its own seat.

Failure Mode 03 — ESDV Not Proof-Tested on Demand Frequency

Emergency shutdown valves tested on calendar intervals that are not aligned to the SIL demand rate of the safety instrumented function they serve. IEC 61511 requires the proof-test interval to be determined from the SIL target and the valve's probability of failure on demand (PFD). A valve that is tested annually when its SIL obligation requires a six-month proof-test interval is accumulating unrevealed failure probability between tests. The test demonstrates it was working at the moment of the test. It says nothing about whether it would have operated during the period before the test — which is the period when it was needed.

Field Observation — The Trusted Valve

In field reviews, the most dangerous isolation valves encountered are not the ones that are known to be in poor condition. They are the ones that have been in service for 20 years, have never caused a problem, and have never been proof-tested. They are trusted because they have not failed visibly. They have not been tested because they are trusted. The valve register shows no deficiencies. The permit-to-work system issues isolation against them without question. Their actual seat condition is unknown. Their isolation function has never been verified. They are assumed barriers — and assumed barriers are no barriers at all.

Failure Mode 04 — DBB Arrangement with Unverified Second Block

Double block and bleed isolation relied upon for confined space entry or hot work permits where one of the two block valves has a known or suspected seat leak that has not been assessed against API 598 acceptance criteria. The arrangement is labelled DBB in the isolation register. The permit is issued. The second block valve has not been verified to hold. The bleed between the two valves shows flow — which means the first block valve is passing — but the permit is not withdrawn because the DBB arrangement is assumed to provide adequate protection regardless of the condition of the individual valves. This is a system that has confused the architecture of isolation with the verification of isolation.

Failure Mode 05 — Valve Lubrication and Exercise Not Scheduled

Normally-open isolation valves that are never exercised in service. Gate valves and globe valves that have been in the open position for years without being operated. When a process upset, emergency, or maintenance isolation requires these valves to be closed, the stem has corroded into the packing, the threads have seized, or the handwheel has been removed and never replaced. The valve cannot be closed. The isolation cannot be achieved. The plant continues to operate because the alternative — an isolation that cannot be executed — is not a safe shutdown option. A valve exercise programme — quarterly or annual full stroke operation of all infrequently-used valves — costs almost nothing and prevents this outcome entirely.

Isolation Assurance as a System

Isolation assurance is not a valve maintenance topic. It is a system that connects the physical condition of isolation equipment to the permit-to-work process that relies on it. The three components of that system — the valve integrity programme, the isolation management procedure, and the permit-to-work system — must be connected. A facility with a functioning permit-to-work system but no valve integrity programme has built the administrative layer of isolation assurance on a foundation it has never verified.

Every fatality in industrial history that has occurred because an isolation failed was preceded by a period — sometimes years — during which the valve that failed to hold was used for isolation, passed periodic inspections that did not test its seat condition, and appeared in no deficiency register. The permit-to-work system worked exactly as designed. The isolation did not exist.

Commission a Valve Integrity and Isolation Assurance Audit

If your safety-critical isolation valves have not been proof-tested against API 598 acceptance criteria, your permit-to-work system is issuing permits against assumed isolation. RISL identifies the gap before it becomes an incident.

Request an Engagement

About the Author

Darryl Mohammed — Principal, Rock Industrial Solutions Limited

Red Seal Industrial Millwright (433A) • NBIC Certified • CMRT • First Line Leadership (Academy for Nuclear Training) • TPM Certificate (Marshalls Institute). 38 years of high-consequence industrial operations across Power Generation, Oil & Gas, Utilities, Mining, and Manufacturing. RISL engagements are benchmarked against SMRP Best Practices, ISO 55001, ISO 45001, ASME B16.34, API 598, API 6D, IEC 61511, and TSSA O. Reg. 220/01.