We had simular concerns on a new coker built in 2007. We used Rotork actuators with MODBUS actuation from the DCS. The interlocks are not done through the MODBUS. We take valve postion contacts off the actuator and sent a descrete signal to the valve to the ESD input. This allows the valve to be locked out and can not be operatored from the MODBUS or from the local station. The only way to operate the valve when it is locked out is to engage the clutch and operate the handweel. The clutch has a key lock and chain on it so the operator must involk a lockout/tagout procedure to operate the valve. This requires a management signoff to do.
Our concern was the same. Operators were reluctant to accept valves where the power could not be turned off.. Their concern was that someone could operate the wrong valve locally if the valves were not powered down when not being operated. They were convinced this was acceptable only after we brought in a demonstration valve actuator and show them how it would work.
As a side note we have had some problems with the MODBUS. Occasionally the valve will freeze and can not be operated from the DCS. The only way to get it to work is to cycle power to the valve actuator. We are studing this issue to see how extensive it is.
