At a wellhead, the last line of defence against an abnormal pressure is often not a computer but a small pneumatic device with no electronics at all. High and low pressure pilots watch the flowline pressure and, if it strays outside a safe window, they vent the control signal that holds the surface safety valve open, letting the valve slam shut. This guide explains how high/low pilots sense pressure, how they bleed the control line to fail the valve safe, how they are arranged per API 14C, and how modern SCADA and RTU panels now supplement or replace them.
High/Low Pilot in one line: A high/low pilot shutdown uses two pneumatic pressure pilots at the wellhead - one sensing high pressure and one sensing low - to trip the surface safety valve when flowline pressure leaves its safe window. Each pilot connects to a sense line off the flowline; when pressure goes too high or too low, the pilot bleeds off the pneumatic control signal holding the valve open, and the valve fails safe to the closed position. It is a self-contained, non-electronic wellhead safety function used in API 14C surface safety systems.
The logic of a high/low pilot shutdown is a pressure window. A flowing well has a normal operating pressure, and pressure that climbs too high can signal a downstream blockage or overpressure, while pressure that falls too low can signal a leak, a rupture, or loss of flow. Two pilots guard the edges of that window: a high-pressure pilot set above normal operation and a low-pressure pilot set below it. As long as pressure stays between the two set points, both pilots stay satisfied and the safety valve is held open.
Each pilot is a purely mechanical device - a spring balanced against process pressure acting on a diaphragm or piston. When the sensed pressure overcomes the spring setting on the high pilot, or falls below the setting on the low pilot, the pilot changes state. There is no power supply, no signal wiring, and no controller involved; the physics of the spring and the process pressure do the sensing and the deciding. That self-contained simplicity is exactly why pilots have guarded wellheads for decades in places where reliable power and instrumentation were never guaranteed.
The pilots connect to the flowline through sense lines - small-bore tubing teed off the process so each pilot feels the real flowline pressure. The set-point window between the low and high pilots defines the band of pressures the well is permitted to operate in, chosen wide enough to avoid nuisance trips on normal fluctuation but tight enough to catch a genuine excursion before it becomes dangerous.
The surface safety valve is a fail-safe device: it is held open by pneumatic or hydraulic pressure in a control line, and it closes automatically the moment that pressure is lost. This is the key to how pilots trip it. The pilots are plumbed into the control line so that, in normal operation, they let the control pressure through and the valve stays open. When a pilot trips, it does not push the valve closed - it bleeds the control line to atmosphere, dumping the pressure that was holding the valve open.
With the control signal gone, the valve's own spring or the stored energy in its actuator drives it to the closed position, and the well is shut in. Because the safe action is loss of pressure rather than application of pressure, a broken sense line, a leaking pilot, or a cut control line all fail toward closing the valve rather than defeating it. The whole arrangement is energy-to-open and de-energize-to-trip, which is the essence of fail-safe design at the wellhead.
This bleed-to-trip behaviour also means the pilots act as a simple hardwired logic: any one pilot tripping is enough to vent the control line and close the valve, the pneumatic equivalent of a series-connected trip circuit. It needs no separate logic solver, which is what makes the high/low pilot a complete, standalone safety function suitable for the most remote and unpowered wellheads.
High/low pilots are woven into the surface safety system that API 14C prescribes for offshore and many onshore wellheads, where the flowline safety device closes the surface safety valve on abnormal pressure. In their classic form the pilots are the entire safety function, and their strength is that they need nothing but process pressure to work. Their weakness is visibility: a purely pneumatic pilot tells nobody offsite that it has tripped, and its set points are adjusted by hand in the field.
Modern wellhead panels increasingly pair the pilots with electronic sensing. Pressure transmitters on the same flowline feed an RTU or wellhead controller that can enforce high and low trip limits electronically, drive the solenoid that vents the control line, and report pressure, valve position, and trip status back over a communications link. In some designs the electronic panel supplements the pneumatic pilots as an independent layer; in others it replaces them, with the pilots retained only as a mechanical backup. Either way the goal is the same fail-safe closure of the surface safety valve, now with a signal that reaches beyond the wellhead.
A cloud SCADA platform such as Merobix reads the pressure, valve position, and trip status from that RTU or wellhead controller and presents them in a browser, so an operator can see that a well has shut in on high or low pressure without driving out to a remote pad. The pilots or the electronic trip logic still perform the safety function locally at the wellhead; the cloud layer adds the remote awareness that a purely pneumatic pilot never had, turning a silent mechanical trip into an alarm someone can see and respond to.
The surface safety valve is held open by pressure in a control line and closes when that pressure is lost. Each pilot is plumbed into the control line, and when flowline pressure goes too high or too low the pilot bleeds the control line to atmosphere. Losing that control pressure lets the valve's spring or actuator drive it closed, shutting in the well. The action is loss of pressure, so leaks and broken lines fail toward closing the valve.
The sense line is small-bore tubing teed off the flowline that carries process pressure to the pilot, so the pilot feels the real pressure it is protecting against. Each high and low pilot has such a connection to the flowline. The set-point window between the low and high pilots defines the pressure band the well is allowed to operate in before one of them trips the safety valve.
Sometimes. Modern wellhead panels use pressure transmitters and an RTU or controller to enforce high and low trip limits electronically and report status over a communications link. In some designs this electronic layer supplements the pneumatic pilots as an independent trip; in others it replaces them, with pilots kept only as a mechanical backup. The goal remains fail-safe closure of the surface safety valve, now with remote visibility the pilots alone could not provide.
This page references the standards, specifications, and official documentation published by the organizations below. Editions, product capabilities, and documentation change over time - confirm current requirements and specifications directly with the source.
Last reviewed: July 27, 2026. Merobix is not affiliated with, endorsed by, or sponsored by these organizations; their names are used only to identify the standards and products discussed.
Merobix reads your field devices into a cloud SCADA - the real thing behind these terms, live in days from any browser.