Pump Control and Water Hammer on Hygienic Process Lines

Water hammer is the pressure surge produced when liquid moving in a pipe is forced to change velocity quickly: a pump trips, a valve snaps shut, a check valve slams. On a hygienic food or beverage line the surge rarely bursts a pipe; instead it steadily destroys the seals, gaskets and instruments the line's hygiene depends on. Metromotion Controls is a control systems integrator based in Mount Waverley that writes pump and valve control across Melbourne, Victoria and Australia for dairy, beverage and food plants.

This article covers what water hammer does to a hygienic line and the control-system levers that prevent it. It is written for engineers deciding how a line should behave on start, stop and changeover, not only what hardware to bolt on.

What water hammer does to a hygienic line

The damage is rarely a burst pipe. It is the slow attrition of the parts that make the line hygienic: a facility that traced repeated failures to surge reported loud banging, line vibration, and frequent damage to valves, mechanical seals, gaskets and instrumentation (Crane Engineering). A pounded clamp gasket loses its set and starts to weep, creating a crevice that cleaning cannot reliably reach. A mechanical seal that sees repeated pressure spikes fails early. Pressure transmitter diaphragms and sanitary flow and level sensors fatigue under repeated shock, and when one drifts the loop that depends on it stops doing its job. So a surge problem shows up first as maintenance cost and instrument drift, and only later as a hygiene concern.

Sanitary clamp fittings and thin-wall stainless tube are not specified for repeated transient overpressure, so the answer is to stop generating the transient rather than to over-build the pipe.

Why the surge size is a control decision

When a moving liquid column is decelerated, its momentum converts to pressure. For a velocity change quicker than the pipe can relieve, the rise follows the Joukowsky relation: pressure rise equals fluid density times pressure-wave speed times the change in velocity. The wave speed for water in stainless tube is roughly 1,200 metres per second, so an instant stop from 1 metre per second adds a surge in the order of 12 bar on top of line pressure, and a 2 metre per second CIP velocity doubles that.

The full Joukowsky rise applies whenever the velocity change happens faster than the pipe period, the time 2L/a for the pressure wave to travel the length of the line and reflect back. On an 80 metre line that period is just over a tenth of a second, so any closure or trip quicker than that delivers the full surge. Stretching the velocity change over many pipe periods drops the peak into the gentler rigid-column regime, where the rise depends on the rate of deceleration rather than the wave speed.

Two practical conclusions follow. The surge scales with velocity, so a line that is safe at production flow can be far less forgiving at the higher velocities used for cleaning. And the surge scales inversely with how long the stop takes, so the single most effective lever is to make velocity changes slower. Both are set directly by the control system through drive ramps and valve timing.

Lever one: VFD ramps and soft starts on pump start and stop

A pump started across the line imposes a step change in velocity; a pump tripped without a deceleration ramp lets the fluid column coast and then arrest hard against the check valve. A variable frequency drive lets the control system ramp the pump over a set time on start and stop instead. On stop in particular, a controlled deceleration reduces the reverse-flow velocity the check valve has to arrest, one of the main slam mechanisms in a food and beverage system alongside fast valves and pump shutdowns (Crane Engineering).

The ramp times are a tuning decision, not a default. A ramp set for the easiest duty may still surge on a long transfer line or at CIP velocity, so tune the deceleration ramp on the worst case for the line and confirm it across the operating modes. A soft starter gives some of the start-side benefit but not the controlled deceleration, so where stop-side surge is the problem a VFD that ramps down under control is the better fit.

Lever two: valve-closure timing and profiling

The second major source is the valves themselves. An automated on-off valve that snaps shut against full flow stops the column abruptly, and the peak falls as the closure lengthens. Two refinements matter on a hygienic line:

• Closure time. Air-actuated sanitary valves can be slowed with flow controls on the actuator exhaust, and modulating valves can be given a controlled closing time in the logic. The closure has to be long relative to the pipe period to fall into the gentle, rigid-column regime rather than the abrupt Joukowsky regime.
• Closure profile. Most of the flow is shut off in the final part of travel, so that is where the surge is generated. A closure that moves quickly through the open range and slows near the seat reduces the surge without making the whole cycle slow (Pumps & Systems, on avoiding valve-closure water hammer): the closing characteristic in the logic for a modulating valve, a two-speed actuator for an on-off valve.

A flow diversion that stops one path instantly is a valve closure by another name, and it deserves the same closure profiling.

Lever three: pump-valve sequencing and interlocks

Even with good ramps and closure profiles, the order of operations matters. A pump that starts against a closed discharge, or a discharge valve that closes at full speed, creates stress that no ramp can absorb, so sequencing logic ties the pump and its valves together.

The sequencing is read straight off the P&ID: which valve serves which path, where the check valves sit, and what the line is doing at each step is what lets the logic start and stop flow in an order that keeps the fluid column under control. How that reading is done is covered in our guide to deriving control logic from a P&ID.

Check valves: what the control system can and cannot do

A check valve slams when it is still open as flow reverses. A swing check has to travel through its full arc to close, so on a fast deceleration reverse flow is established before the disc reaches the seat, and the valve arrests that reverse velocity almost instantly. That is the bang heard at pump stop. Spring-assisted and nozzle check valves close before significant reverse flow develops, which is why they suit duties where the column decelerates quickly.

The control system cannot change a check valve's closing behaviour, but a controlled deceleration ramp lowers the reverse-flow velocity the valve has to arrest, so a good stop sequence and an appropriate check valve work together. Where surge persists despite good control, the fix is a different check valve or a surge-protection device rather than more logic, and a control engineer should say so plainly rather than chase it in software.

Centrifugal versus positive-displacement: different protection

The pump type changes what protection is needed, because the two families fail in different ways against a closed valve.

A centrifugal pump is forgiving because its discharge pressure is capped by the pump curve. A twin-screw or lobe pump moves a fixed volume per revolution, so against a closed discharge it keeps raising pressure until something gives. Ramps still help with surge, but on a PD duty they come second to two non-negotiables: a relief path sized to take full pump flow, and interlocks that refuse to start the pump unless a discharge path is proven open and trip it if the path closes. Deadhead protection on a positive-displacement pump is a safety function, not a nicety.

Priming and flush-volume control for clean, air-free transfers

Surge is worse, and transfers dirtier, when the line holds air. A pump that starts into a partly empty line accelerates liquid against trapped air pockets, and when a pocket collapses or the liquid hits a restriction the result is a surge and a poor transfer. Priming control brings the pump up with a low-speed fill stage that clears air from the suction, confirmed by a level or pressure signal before the main ramp. Flush-volume control meters the volume of water used to push product through or clear the line, keeping the transfer air-free and the product interface sharp, ended on a measured result in the same way an endpoint-driven CIP rinse ends on conductivity rather than a timer.

Column separation and surge on long transfer lines

Long transfer lines bring a more severe failure mode. When a pump trips on a long line, the deceleration can drop the local pressure far enough for the liquid to vaporise and form a vapour cavity, usually at a high point. When flow reverses and the cavity collapses, the two liquid columns rejoin at speed and produce a spike that can exceed the original surge. This is column separation, a real risk on long food and beverage transfer runs.

The control-side mitigation is the same lever applied harder: a deceleration ramp slow enough that line pressure never falls to vapour pressure at the high points. Where the hydraulics make that impossible, an uncontrolled trip on power failure for example, the fix is hardware, a vacuum breaker or surge vessel at the vulnerable point, and the risk should be identified during design rather than found in commissioning.

Tuned differently for CIP versus production

In production a line carries product at moderate velocity and the priority is gentle, accurate flow. In CIP it carries water and chemical at higher velocity to scour the pipe. Because surge scales with velocity, a closure or trip that is gentle at production flow can produce a much larger surge at CIP velocity, so the line should not run one set of pump and valve parameters for both.

The practical answer is separate ramp times and valve-closure timings for each mode, selected by the recipe or operating state. Reusing one set of parameters is a common reason a line that behaves in production starts banging during the wash.

A worked example (illustrative)

The following is illustrative and is not measured on any Metromotion Controls installation. Consider a centrifugal transfer pump moving chilled product through roughly 80 metres of 50 mm sanitary tube to a filler balance tank, with a swing check valve near the pump. The same line is also used as a CIP supply, where it runs faster to reach scouring velocity. The symptom is a bang on CIP shutdown and a pressure transmitter that has drifted twice in a year.

Reading the line, the cause is a stop sequence that trips the pump and lets the higher-velocity CIP flow reverse into a slow swing check valve. The control-side changes are a deceleration ramp that is longer in the CIP state than in production, an interlock so the discharge valve cannot close until the pump is below a low-speed threshold, and confirmation that the check valve suits the reverse-flow rate rather than relying on logic to fix a slow valve. The pressure rise falls because the velocity change is lengthened; the value is in the order of operations and in matching parameters to each mode.

Where this work lives

Preventing water hammer on a hygienic line is mostly control logic: ramping pumps on start and stop, profiling valve closures, sequencing pumps against their valves, protecting positive-displacement duties with relief and interlocks, and holding separate parameters for production and CIP. For food and beverage and agricultural processing sites in Melbourne and across Australia, the fastest path to a quieter, longer-lasting line is usually the control system that runs the pumps and valves, tuned to how the line behaves rather than to a drive's defaults.

References

Sources for the failure modes and prevention practice described above:

• Preventing costly water hammer failures in a food and beverage facility: damage to valves, seals, gaskets and instrumentation, and the role of fast valves, slow swing check valves and pump shutdowns, Crane Engineering.
• How to avoid valve-closure water hammer: closure timing and profiling, Pumps & Systems.