To ensure a source of power during an emergency, double-acting, energize-to-trip piston actuator requires a pneumatic reserve tank.
To minimize the probability of a spurious trip, add a reserve tank to the spring return actuator.
The reserve tank should be (a) sized to cycle the valve three times, (b) connected to the pressure source with double check valves and also have bleed valves for checking.
A pressure switch on the pneumatic supply line to the tank warns the operator of a problem with the source of pressure. Pressure gages can also be placed on the reserve tank and at the pressure switch.
To provide a fail-safe, double-acting piston actuator, add another pressure switch which will move the valve automatically to the failure position when the pressure in the reserve tank drops below a critical level.