Taking a Fire Protection System Out of Service

Purpose

To take a fire protection system, or part of one, out of service and put it back with the building's protection accounted for at every minute in between. The deliverable is not the repair. It is a record showing what was unavailable, from when to when, what stood in for it, who authorised it, and what test proved it came back.

Scope

Any planned or emergency condition removing suppression, detection, notification or egress capability: control valve closures, fire pump shutdowns, alarm panel and initiating device work, opening protective and door work, and any work obstructing a means of egress. Applies whether the work is yours, a tenant's, another trade's, or a utility's. Does not cover impairment as a concept, which the impairment card owns.

Roles and responsibilities

Procedure

1. Establish that an impairment is actually required, then scope the smallest isolation that permits the work.

Not every job needs one. Replacing a sprinkler on a wet branch does; testing a device that reports without actuating anything may not. Where isolation is required, walk the valve tree upward from the work location and stop at the first valve that permits the work. Isolating higher than necessary is the most common self-inflicted expansion of an impairment, usually because the higher valve is easier to reach.

The exception, which changes the answer completely: if the valve itself is the work, you cannot isolate at it. You isolate upstream, and the impairment grows to whatever that valve serves. Discover this at step 1, not at step 6.

2. Estimate the duration honestly and test it against the notification threshold.

The commonly adopted editions of the water-based inspection standard require, for an impairment expected to exceed 10 hours within a 24-hour period, that the authority having jurisdiction be notified and the affected area evacuated or an approved fire watch established. NFPA 25 owns that threshold in the edition the AHJ has adopted and amended. For fire alarm work the governing document is NFPA 72 in its adopted edition, and its notification list is not the same.

Estimate against what goes wrong, not the clean case. If the estimate lands within an hour or two of the threshold, plan as though you will cross it, because the estimate error on this work runs in one direction.

3. Select the compensating measure matched to the capability being removed.

Suppression removed with detection intact is a different problem from detection removed with suppression intact, and the impairment card explains why. Match the measure to the gap, not to habit, and suspend hot work in the affected area. Where the work itself obstructs a corridor, a stair or a rated door, treat that as its own impairment: 29 CFR 1910.36 and 1910.37 require exit routes to be adequate, unobstructed and maintained for your employees throughout, and that duty does not pause for staging.

4. Notify, in order, and obtain authorisation.

Five parties, in this sequence: the impairment coordinator, who authorises; the supervising station, so expected signals are handled and real ones are not lost among them, since a station that is not told either dispatches on your test signals or learns to ignore that address for the day; the occupants of the affected area; the AHJ, where step 2 or local policy requires; and the insurance carrier, where the policy requires it. Record the time and the person for each.

5. Open the state in the register and hang the tag before anything is operated.

The register entry carries the five properties: start timestamp, scope, compensating measure, owner, and an empty verified-end field. The tag goes physically on the valve or panel, where the next person to touch it will see it. The register is the system of record and the tag is the interlock; neither substitutes for the other. Write the entry now rather than afterwards, because an entry reconstructed at the end records the time somebody remembers rather than the time the valve moved.

6. Isolate, and prove the isolation.

Operate the valve slowly, because a fast closure on a charged main produces a surge that damages the piping and devices you are not working on. Then prove it: drain the isolated section and confirm at both the gauge and the drain outlet that flow has stopped, because a charged branch stores enough energy to launch a fitting or a sprinkler at a face when the first joint is broken. Do not rely on handle position or a target window; the control valve card covers why both lie.

7. Do the work, and re-scope at the end of each day it spans.

If the job runs past a day, close what can be closed. Restoring protection to three of four floors overnight is worth the extra refill, and an impairment left open because that is easier becomes a 214-day entry.

Do the overhead portions from a properly set lift or platform rather than from stock or racking; fall protection selection belongs to the ladder and lift cards. Cutting or welding is hot work: it needs a permit, a designated hot work watch and a post-work monitoring period under NFPA 51B in the adopted edition, with the federal welding and cutting requirements at 29 CFR 1910.252 for general industry or 29 CFR 1926 Subpart J on a construction site. The hot work watch and the impairment fire watch cannot be one person, because the hot work watch stays at the work and the impairment watch walks a route.

8. Restore, and prove restoration.

Open the valve slowly. Vent air at the high point. Then run the proofs: the valve proven open under its supervisory device with the signal restored and timestamped at the panel, a main drain test compared against the previous recorded result, the panel clear of supervisory and trouble, and for alarm work the affected devices retested per the adopted edition of NFPA 72.

9. Close the state, remove the tag, notify the same five parties.

Same order, with the end timestamp and the test results. The tag comes off last, after the proofs, not after the tools are packed.

Worked example: the artifact, filled in

Five-story office, 96,000 square feet, 19,200 per floor, 480 sprinklers, 96 per floor. The floor control valve on the third floor is weeping at the stem and is being replaced. Grooved mechanical connections both sides, so no hot work.

Step 1 result. The work is the valve itself, so isolation at the valve is impossible. The next valve upstream is the riser control valve, serving all five floors. Scope becomes 96,000 square feet and 480 sprinklers, the whole building, not the one floor. Recorded at step 1, not discovered at step 6.

Step 2 result. Work estimated at 6.0 hours, plus 1.0 hour to drain and 1.5 hours to refill and vent: an estimated window of 8.5 hours. That is 1.5 hours under the 10-hour threshold, a margin of 18 percent, inside the ordinary error of a valve change where one seized fastener adds hours. Decision: plan as though the threshold will be crossed, so AHJ notified and a fire watch arranged from the start.

The tag, as hung on the riser control valve:

• System impaired: wet pipe sprinkler, sole riser, all floors
• Scope: 96,000 sq ft, 480 sprinklers, floors 1 through 5
• Impairment start 06:40. Estimated restoration 15:10.
• Compensating measure: continuous fire watch, all five floors, 30 minute patrol interval, cell phone plus lobby phone as independent means of alarm; hot work suspended building-wide
• Authorised by: impairment coordinator, named, on site
• Do not operate this valve. Contact the coordinator.

The register entry at close of the day:

• Start 06:40. End 16:25. Duration 9.75 hours.
• Verified end: riser control valve opened slowly and proven open by restoration of its supervisory signal at the panel, timestamped 16:11. Air vented at the fifth floor high point. Main drain test at 16:18: static 74 psi, residual with the drain fully open 58 psi, a drop of 16 psi. Previous recorded test: static 73 psi, residual 57 psi, a drop of 16 psi. Panel clear of supervisory and trouble at 16:22. Fire watch stood down at 16:25, after the proofs, not before.

Reading the main drain comparison correctly. The comparable quantity is the 16 psi drop, not the 74 against the prior 73. Each test's gauge carries an accuracy specified as a percentage of full scale, a fixed systematic offset with a full-scale basis, so it cancels within a single test's static-minus-residual difference and does not shrink at low readings. It does not cancel across two tests unless the same gauge was used for both, so the absolute statics from different visits are not comparable and the drops are. Equal drops mean the flow path is as it was.

Narrating what actually happened. The window ran 9.75 hours against an 8.5 hour estimate, a 15 percent overrun from one seized bolt. It did not cross the 10-hour threshold; it finished 0.25 hours, or 15 minutes, inside it. Had the fire watch been declined on the strength of the 8.5 hour estimate, the building would have run 9.75 unprotected hours with the decision resting on a 15 minute margin nobody was tracking. That is the argument for step 2.

Sibling-rule check, run against this artifact before it ships:

• The control valve card's rule that a valve is proven by its supervisory device and by flow evidence rather than by handle position: applied at restoration, using both the tamper restoration and the main drain test.
• The control valve card's exposure arithmetic, area removed multiplied by time removed: applied at step 1, which is why the scope reads 96,000 square feet rather than 19,200.
• The impairment card's five properties: all five appear in the register entry, the verified end carrying what was checked and not only when.
• The impairment card's rule that an alarm impairment is NFPA 72 territory and not NFPA 25: applied at steps 2 and 8.
• No rounding runs in the flattering direction: the 9.75 hours is reported as a near miss rather than as comfortably under.

Verification

Audit three things after any impairment, on the record rather than from memory.

Did the state open before the valve moved? Compare the register start timestamp against the first thing operated. If the entry was written later, the duration on file is shorter than the real one and every future estimate built on it is optimistic.

Does the verified-end field name a test? A timestamp alone closes an event. A test closes a state.

Did the compensating measure actually run? Patrol logs with times, not a name on a form. A watch recorded as established and never patrolled is worse than none, because it satisfied the paperwork that would otherwise have forced a harder decision.

For anything spanning more than one day, check it against the end-of-day rule at step 7: an entry left open overnight when part of it could have been restored gets its reason recorded, or the next one repeats it.

References

• NFPA 25, in the edition the authority having jurisdiction has adopted and amended, for the impairment procedure, the tag, the 10-hour threshold and the main drain test.
• NFPA 72, in the adopted edition, which governs impairment and restoration testing of fire alarm systems.
• NFPA 51B, in the adopted edition, where the work requires hot work, together with 29 CFR 1910.252 for general industry or 29 CFR 1926 Subpart J on a construction site.
• 29 CFR 1910.36 and 29 CFR 1910.37, the federal exit route requirements applying to your employees whenever the work obstructs or alters a means of egress.
• See related: the impairment card for the state model, and the control valve card for the exposure arithmetic.