How to Protect a Steam Coil From a Freeze You Can Predict

Why this matters

Almost every steam coil that splits was protected. There was a low-limit on it, there was a valve with a failure position, there was a damper interlock, and the coil still burst. What is missing in those buildings is not a device, it is proof that any one of the devices does what the drawing says it does. Freeze protection is a stack of independent layers, each one blind to the failures the others catch, and a layer nobody has ever proven is not a layer. It is a line item.

This procedure establishes five layers on one air handler and proves each one separately. It takes most of a shift per unit the first time and under an hour on the annual repeat, and it is the difference between finding the hole in October and finding it at six on a January morning with water running out of the mechanical room door.

Before you open anything

Steam at any usable pressure is a severe burn hazard and the first stretch of a leak out of a split tube is invisible, so a suspected leak is never located by hand, by feel, or by reaching toward the sound. If a coil is suspected of having burst, close the steam supply valve from outside the air handler, stop the supply fan, keep people away from the diffusers that unit serves, and leave the access doors shut until the coil has cooled, because the plenum behind that door is at supply temperature and opening it vents the plenum into your face.

Any step below that breaks a joint - fitting a gauge, pulling a strainer, opening a trap union - requires isolating the steam supply and the condensate return, letting the assembly cool, draining it to a point piped away from any walkway, and confirming zero on a gauge that you have just seen read something else. That is the isolation of stored pressure energy required by 29 CFR 1910.147 for general industry work, and it is the same energy whether or not the boiler is firing, because a closed hot line holds its pressure. Where a step below requires reaching into a damper or fan section, the fan is locked out under that same standard before a hand goes past the plane of the housing.

Step 1: Establish drainage at the lowest load the unit will run at

This is the only layer that prevents a freeze rather than reacting to one, and it is the one that is almost never checked, because it is arithmetic rather than a device.

A trap can only move condensate when the pressure inside the coil exceeds everything downstream of the trap. Add three things to get that requirement: the pressure in the return main, the vertical rise from the trap outlet to that main converted at 2.31 feet of water per psi, and an allowance for friction in the return line. That sum is the total back pressure, and the coil must hold above it before one drop leaves.

The proof is a gauge reading, not a calculation. Read the coil's own steam gauge with the unit running in mild weather, when the control valve is throttled and the coil is at its lowest pressure of the year. If that reading is at or below the total back pressure, the coil is not draining at that condition, and it will not drain at any milder one either. If the gauge reads below zero, the coil is under vacuum and cannot drain even into an open drain, because atmospheric pressure is holding the water in.

What this layer is blind to: a control failure that shuts the valve entirely, and any loss of steam supply. Drainage that works perfectly still leaves a dry coil frozen by outdoor air if the steam goes away.

Step 2: Confirm vacuum relief exists and is open to the room

A modulated coil goes below atmospheric pressure at low load, and once it does, no amount of trap capacity drains it. A vacuum breaker admits room air into the top of the coil when the coil goes sub-atmospheric, restoring a gravity path.

Prove three things by inspection, from a position beside the device rather than in front of its port, since a leaking seat vents live steam at head height: that a vacuum breaker is fitted at the top of the coil header on the steam side, that its port is open to the room rather than plugged with a fitting somebody added to stop a hiss, and that it is not piped into the return, which defeats it entirely.

What this layer is blind to: any positive back pressure. A vacuum breaker does nothing about a return main at 3 psig or a five foot lift, and it is the most common wrong answer to a stalled coil for exactly that reason.

Step 3: Prove the low-limit stops the fan, not just the graphic

The low-limit, commonly called a freeze-stat, is the reactive layer: it shuts the unit down when the coil face has already gone cold. Two things have to be true and they are tested separately.

First, the wiring. Trace the low-limit contacts to where they land. A low-limit hard-wired in series with the fan starter's safety circuit removes the fan regardless of what the building controller is doing. A low-limit landed on a controller input as an alarm point only is not a safety layer at all, because a controller in hand, a failed point, or a communications loss removes the whole protection silently, and nothing on the graphic changes to tell you.

Second, the response. Test to the manufacturer's method with a cold pack applied to a short section of the capillary element, and confirm both that the fan stops and that the alarm annunciates somewhere a person actually looks. That test stops air to the space the unit serves, so it is scheduled with the building operator, announced to the occupants, and not run at all on a unit whose space cannot lose ventilation without a written plan, which includes any space with a pressurization requirement.

What this layer is blind to: everything that happens above its setpoint, and any part of the coil face its element does not cross.

Step 4: Prove the failure positions on loss of power and loss of air

Every actuator in the freeze path has a position it goes to when its signal disappears, and the drawing's word for that position is not evidence.

Drop control power at the unit disconnect, with the building operator's agreement and after confirming the unit is not serving a space that requires continuous ventilation, and watch what moves. The steam valve should drive open, the outdoor air damper should drive closed, and both should complete travel without the controller. On a pneumatic actuator, the same test is done by bleeding the control air rather than by dropping power.

The valve failing open matters more than it sounds. A valve that fails shut on a power blip leaves outdoor air crossing a coil with no steam in it, and a preheat coil in that state can freeze in the length of an outage nobody logged.

What this layer is blind to: a valve that fails to the right position but is stuck partly closed by scale or a bent stem, which is why the stroke is watched rather than assumed from a single end position.

Step 5: Prove the outdoor air path actually closes

The last layer is the one that decides whether the coil sees freezing air at all when the unit is off. Close the outdoor air damper through the control system, then look at it. A damper commanded closed that shows daylight around the blades, or one whose linkage has slipped so the blades stop short, admits enough cold air on a windy night to freeze a coil that has been sitting idle with condensate in it.

Confirm the end switch, if there is one, actually makes at the closed position rather than at ninety percent of travel, and confirm the fan interlock sequence: damper proven closed before the fan is permitted to stop is a different sequence from damper commanded closed as the fan stops, and only the first one is a layer.

Do not put a hand into the damper section to check blade seal with the fan available to start. Lock the fan off first, under 1910.147, then look.

Worked example: one hundred percent outdoor air unit, five layers, one hole

A 12,000 cfm makeup air unit with a steam preheat coil, design steam 10 psig, feeding a shop floor. No freeze history, which is why nobody had looked.

Layer 1, drainage. The return main gauge read 0 psig, so the receiver is vented, which is the good case. Tape measure from the trap outlet to the return main: 6 feet, which at 2.31 feet per psi is 2.6 psi. Add 0.5 psi for return line friction. Total back pressure 3.1 psig. On a 40 F morning with the unit running, the coil gauge read 1.5 psig. That is below the 3.1 psig required, so the coil was holding water that morning and every milder morning of the year. It happened to be above freezing outside that day, which is the only reason nothing had split yet. This layer failed.

Layer 2, vacuum relief. A vacuum breaker was fitted at the top of the coil header, port open to the room, not piped anywhere. This layer passed, and it is worth noting what it bought: it lets the coil drain when the coil goes below atmospheric, and it does nothing about the 3.1 psig found in layer 1. Passing layer 2 did not rescue layer 1.

Layer 3, low-limit. The element was serpentined across the face, which is correct, and the cold pack test tripped it. Then the wiring trace: both contacts landed on controller inputs. The fan stop was a software interlock. The unit had been left in hand at the controller twice in the previous year according to the operator's own notes. This layer failed, and it failed in the way that leaves the graphic looking healthy.

Layer 4, failure positions. Control power dropped, valve drove open, damper drove closed, both completed travel. Passed.

Layer 5, outdoor air path. Damper closed tight, end switch made at the stop. Passed.

Three of the five passed and the two that failed are the two that matter most, because layer 1 is the only preventive layer and layer 3 is the last catch. The unit had no freeze history and no protection worth the name. The order of repair follows from what each layer does: the low-limit rewiring is a same-visit fix that restores the last catch, and the drainage correction is a piping change that removes the exposure, so the rewire happens first because it is fast and the exposure continues while the piping is scheduled.

The drainage fix is chosen against the mechanism, not the price. Here the return is already vented, so the whole 3.1 psig is the six foot lift plus friction, and the answer is to drain the coil by gravity into a vented receiver set below the coil and pump from there, which removes the lift from the trap's problem entirely. If the return main had been pressurized instead, the lift correction would not have been enough and the device would have to supply its own motive pressure.

How to verify the stack after the work

Repeat the two failed proofs, not the whole procedure. Read the coil gauge on the next mild running day and confirm it sits above the recomputed total back pressure, which after a gravity drain to a vented receiver is a fraction of a psi rather than 3.1 psig. Then drop the low-limit again with the cold pack and confirm the fan stops with the controller deliberately placed in hand, which is the exact condition that made the old wiring worthless.

Record the five results with the date and the numbers behind them, because next year's walk is a comparison, not a rediscovery. The failure mode of this procedure is doing it once, writing "freeze protection verified" with no readings under it, and giving the next tech a sentence they cannot check.

References

• 29 CFR 1910.147, the OSHA general industry standard for the control of hazardous energy, for isolating stored steam pressure and locking out a fan before any layer is opened or reached into
• Coil and air handler manufacturer documentation, which is the authority for the low-limit test method, the element routing across the coil face, and the actuator failure positions on that specific unit
• Saturated steam tables from any engineering handbook, for the pressure and saturation temperature pairs behind the drainage check
• See related: What a Steam Coil Does and Why It Freezes; What Stall Is and Why the Equipment Goes Cold at Part Load; What a Vacuum Breaker Is For