Process Safety · Lesson 59 · 9 min read

A Fast Valve Closure Can Turn Flow Into a Pressure Surge

A liquid moving through a long pipeline carries momentum. If a valve closes faster than the system can absorb that change, a pressure wave travels through the line and can load hoses, flanges, supports and equipment above normal steady-state pressure. The protective action intended to isolate inventory can therefore create a second major-hazard threat unless its closure profile is engineered as part of the complete transfer system.

The hazard mechanism: flow stops, but momentum remains

During normal flow, pumps provide the energy that moves liquid and the pipework contains the associated steady pressure. Rapid valve movement changes velocity over a short time. Because liquid is only slightly compressible and the pipe wall is elastic, that change creates a travelling pressure wave. The wave can be amplified or reduced as it reflects through branches, vessels, pumps and closed ends.

Pressure surge is often called liquid hammer. The highest load may occur away from the valve and can still exceed the capability of a hose, gasket, support or instrument connection. A low-pressure wave may create vapour cavities whose collapse produces another damaging rise. Absence of an audible bang does not prove the transient was acceptable.

What authoritative guidance requires teams to consider

UK HSE guidance for bulk transfer of dangerous liquids and gases explains that rapid valve closure can establish a pressure wave in an enclosed liquid as flow is brought to a sudden halt. It identifies liquid density, valve number and type, closure time, pipeline length and geometry as relevant factors. Where assessment shows surge reduction is needed, the guidance describes measures such as reducing flow, increasing closure time—particularly near the end of travel—and using surge tanks or other relief devices.

HSE guidance on remotely operated shut-off valves also warns that valve closure must not be so rapid that it causes undue pressure surge. Long runs of larger pipework may require slower closure. That creates an important process-safety principle: emergency isolation speed and surge control must be designed together. “Faster” is not automatically safer when the moving liquid column, pump response and receiving system are not coordinated.

Official incident evidence: hydraulic shock can rupture large pipework

The U.S. Chemical Safety Board investigated a 2010 ammonia release at Millard Refrigerated Services in Alabama. Following a power interruption and an abnormal restart sequence, hot high-pressure gas and very cold liquid ammonia were brought together in a refrigeration system. Rapid condensation created a pressure drop that accelerated liquid, producing hydraulic shock. The CSB reports that roof-mounted 12-inch suction piping and an evaporator coil failed, releasing more than 32,000 pounds of ammonia. Thirty-two people were admitted to hospital and four were placed in intensive care.

This was an onshore ammonia-refrigeration incident, not an FPSO cargo-transfer event. Its relevance is the lesson that system state, valve sequencing and control logic can create transient loads far beyond normal operating pressure.

Hypothetical FPSO example: an offloading ESD demand

Hypothetical example—not a documented incident: An FPSO is transferring stabilised crude through a long liquid line. A receiving-side emergency shutdown signal commands an actuated valve to close while the cargo pumps are still delivering flow. The valve reaches the final part of its travel before pump speed has reduced. A short pressure peak appears upstream, followed by vibration at a supported bend.

The control-room team stops the operation under the approved abnormal-operations procedure and does not simply reopen the valve to clear the alarm. Operations, marine, maintenance and process engineering confirm the actual shutdown sequence, valve travel profile, pump trip timing and condition of the hose, flanges, supports and surge protection. Transfer resumes only after competent review shows that the system remains within its accepted transient design basis. This example does not prescribe a universal closure time, pressure limit or valve movement.

Critical controls

Transient design: analyse credible starts, stops, pump trips, blocked outlets, simultaneous valve actions and emergency-isolation demands. Include the entire flow path and the weakest connected component, not only the main pipe pressure rating.

Coordinated shutdown: define the relationship between detector or ESD demand, pump rundown, valve travel and receiving-side isolation. Where the safety case permits, an engineered closure profile can reduce inventory while avoiding an unacceptable surge.

Surge protection: maintain any accumulator, relief device, surge vessel, bypass or control function required by the transient study. Verify set points, pre-charge, availability, discharge destination and impairment controls using equipment-specific procedures.

Mechanical integrity: inspect hoses, supports, anchors, small-bore connections, valve actuators and joints for loads produced by repeated transients. A system that has not leaked is not proof that damaging fatigue or movement has not occurred.

Leadership actions

Leaders should assign ownership for closure-time settings and ESD sequencing. Changes to pumps, valve actuators, control logic, pipeline routing, hose type, transfer rate or receiving facilities require formal review against the transient basis. Testing must prove the complete function without creating an uncontrolled pressure event.

Repeated pressure spikes, pipe movement, actuator retuning or unexplained hammering are process-safety signals. Production pressure must not turn them into accepted operating noise. Record the evidence, apply operating restrictions where necessary and obtain competent engineering review.

Three practical actions

• Trace the sequence: confirm which pump and every isolation valve moves during normal stop, ESD and loss of power—and in what order.
• Protect the evidence: trend fast pressure data, valve travel and pump status; do not rely only on a slow control-room display.
• Control changes: revalidate surge assessment after changes to flow rate, actuator speed, control logic, hose, pipework or receiving conditions.

Official video: CSB “Shock to the System”

The CSB video below explains the Millard ammonia incident and hydraulic-shock mechanism. It concerns industrial refrigeration, not offshore liquid transfer, but it directly illustrates how an abnormal sequence can accelerate liquid and rupture connected pressure equipment.

Watch “Shock to the System” on the official CSB website.

Takeaway and team discussion

Key takeaway: an isolation valve is part of a dynamic system; its closure must stop hazardous inventory without imposing an unacceptable pressure surge on the flow path.

Discussion question: for our highest-inventory liquid transfer, what evidence shows that pump rundown, valve closure and surge protection remain coordinated for every ESD case?

Continue in the Process Safety hub, and connect this lesson with emergency isolation, reverse-flow control and trapped-liquid pressure.

Verified primary references

1. UK HSE: The bulk transfer of dangerous liquids and gases between ship and shore (HSG186), pressure-surge guidance.
2. UK HSE: Remotely operated shutoff valves for emergency isolation (HSG244).
3. UK HSE: Design codes—pipework, including pressure surge and operational transients.
4. U.S. CSB: Key Lessons for Preventing Hydraulic Shock in Industrial Refrigeration Systems.
5. U.S. CSB: Millard Refrigerated Services Ammonia Release investigation.

Published and sources checked 10 November 2026. Educational discussion only: apply the installation's safety case, transfer procedure, transient study, equipment limits and approved operating instructions.

Discuss this article in the comments →

Register interest in future HSSE email updates