Why Impairment Is a Managed State and Not an Event

Why this matters

Every work management system a shop owns is built around events. A ticket opens, work happens, the ticket closes. That model is correct for almost everything a field service business does, and it is wrong for fire protection in one specific and expensive way: the ticket closes when the task finishes, and protection is not restored when the task finishes. It is restored when somebody proves it is back. The gap between those two moments is where multi-month unavailability lives, and it is almost never discovered by anyone in the building.

An impairment is a state. It has a moment it begins, a boundary of what is unavailable, something standing in for the missing protection, a person who owns it, and a moment it verifiably ends. Treat it as anything less and you get a log full of entries whose closure means nothing.

Event and state are different objects

The reason this bites here and not elsewhere is feedback. If a shop forgets to close out a compressor repair, the compressor tells somebody. An unavailable sprinkler system behaves exactly like an available one, on every day except one. The state model exists to substitute a record for the feedback the physical system cannot give.

The five properties of an impairment state

An entry missing any one of these is not a record of a managed impairment; it is a note that something happened.

1. A start timestamp, with a date and a time, not a date alone. Durations are the quantity that drives the compensating measure, and you cannot compute a duration from a date.
2. A scope, stated as what is unavailable and what physical area loses protection. "Sprinklers off" is not a scope. "Floor control valve, third floor east, 96 sprinklers, 19,200 square feet" is.
3. A compensating measure, matched to the scope and the expected duration, described concretely enough that somebody could execute it from the record alone.
4. A named owner, a person with authority to authorise the impairment and to end it, not a company and not a role with three people in it.
5. A verified end, meaning a timestamp plus what was checked to prove restoration. Valve proven open under its supervisory device, system pressurised, panel clear, main drain test result, device tested. The check is the closure; the timestamp is only its label.

Emergency and preplanned enter the same state

Two entry points, one state, and the difference is only in what you can do before it starts.

Preplanned is anything you chose: a head relocation, a valve replacement, a backflow test, a tenant fit-out, a panel upgrade. The compensating measure is arranged first, the notifications go out first, and the duration is estimated before the first tool comes out.

Emergency is anything that happened to you: a broken pipe, a failed device, a panel in trouble that will not clear, a supply loss. Everything the preplanned path does in advance now happens while the building is already unprotected, which is why the emergency path is written down before you need it rather than improvised.

The state is identical. An emergency impairment running six hours is not a smaller commitment than a preplanned one running six hours, and the record does not get to be thinner because the start was a surprise.

Compensating measures are matched to what was removed

This is where menu thinking does the damage. A fire watch is not the answer to every impairment; it is the answer to some of them, and it is a poor answer to others.

Match the measure to the specific capability that is gone:

• Suppression gone, detection intact. The building can still tell you there is a fire; it cannot control it. Measures lean toward the fuel and ignition side: stop hot work, relocate the highest-hazard storage out of the affected area, position hose and extinguishers, and keep the responding department informed of the area.
• Detection or notification gone, suppression intact. The building can control a fire and cannot tell anyone. Measures lean toward human detection and notification: a patrol with a defined route, a defined interval, and a working independent means of raising an alarm.
• Both gone. The measures compound rather than substitute, and this is where evacuation becomes a serious option rather than a dramatic one.
• Egress affected by the work itself. The one nobody logs. Blocking or propping a rated door, staging material in a corridor, or taking a stair out of use is a life safety impairment in its own right, and the federal floor applies directly: 29 CFR 1910.36 and 1910.37 require exit routes to be adequate, unobstructed and maintained during the work, and that duty runs to your employees regardless of what any code says about the building.

The commonly adopted editions of the water-based inspection standard put a duration threshold on this: an impairment expected to exceed 10 hours within a 24-hour period requires that the authority having jurisdiction be notified and that the affected area be evacuated or an approved fire watch be established. NFPA 25 owns that threshold, in the edition the authority having jurisdiction has adopted and amended, and the AHJ is a named role with legal authority over that adoption rather than a synonym for the inspector. Note the boundary carefully: an impairment to the fire alarm system is NFPA 72 territory in its adopted edition, not NFPA 25, and filing an alarm impairment under the water-based standard sends the notification list and the closure test to the wrong document.

Hazard control for the measure itself. A fire watch is a person, and assigning one creates duties rather than discharging them. Give the watch a defined patrol route, a defined interval, a working independent means of calling for help from where they are standing, and no competing duties, because a watch handed a second task stops being a watch at the moment they walk off the route. Do not have a watch open a door, move stock or investigate an odour alone in an area where suppression is down; their function is to detect and to call, and every additional function reduces the one that matters.

Impairments accumulate, and the second one is the dangerous one

Each impairment is assessed against the building as it would otherwise be, and that assumption breaks the moment two overlap. A floor with its sprinklers isolated is one exposure. A floor with its sprinklers isolated while the alarm panel sits in trouble on the same zone is a different exposure, and neither entry read alone describes it.

Nothing detects this except a single register showing every open state at once. Two contractors working from two systems, one for water-based and one for alarm, each correctly assess their own impairment against a building they believe otherwise intact. That is the argument for one register per building rather than one per discipline.

Reading a year of records backwards

A property manager asks for a review of the last twelve months of impairment records for a five-story building. The log has 9 entries. No fire occurred, so nothing here was discovered by consequence; it was all discovered by reading.

Sorting the 9 entries by completeness: 6 carry all five properties. 2 carry a start, an end and a scope but no compensating measure. 1 carries a start and no end at all. That accounts for all 9.

The entry with no end. Opened 214 days ago, scope recorded as "sprinkler head replacement, second floor storage". The work order system shows the matching job closed the same day at 2.5 labour hours. Physical check today finds the branch charged, the zone valve open and proven under its supervisory device, and the panel clear. So the protection was actually restored 214 days ago and the state was never closed.

That is the important finding, and it is not the comfortable one. The building was fine; the log is not. An impairment register with a stale open entry cannot distinguish an entry that is open because protection is down from an entry that is open because somebody went home. Every future open entry in this log now has to be physically verified before it can be believed, which converts a two-minute read into a site visit. The record was the only instrument this building had, and it has been decalibrated.

The two entries with no compensating measure. Durations of 3 hours and 26 hours. The 3-hour entry sits below the 10-hour threshold stated above, so the missing field is a record defect rather than a breach. The 26-hour entry is 2.6 times that threshold and required, under the standard as adopted, that the AHJ be notified and that the area be evacuated or a fire watch established. Nothing in the record shows either. Reported as a breach rather than as an omission, because it is one.

The annual picture. The 8 closed entries total 61 impaired hours. Excluding the 26-hour entry, the remaining 7 total 35 hours and average 5.0 hours each. The single 26-hour entry is therefore about 43 percent of the year's total impaired time, and it is the one entry with neither a compensating measure nor a notification. The distribution is the finding: the exposure is not spread across the log, it is concentrated in the entry that was managed worst, which is what you would expect if the long ones are exactly the ones that outrun the plan somebody made at the start.

Sibling-rule check, run against this review before it ships:

• The control valve card's rule that a shut valve's cost is area removed multiplied by time removed, with the bound rather than the average used for safety exposure: applied. The 26-hour entry is scored on its full duration, not on an average.
• The control valve card's rule that a valve is verified by flow evidence and its supervisory device, not by handle position: applied to the physical check on the 214-day entry.
• The standpipe card's statement that an impairment entry closed without verification is not actually closed: used unchanged, and it is the rule under which the 214-day entry is treated as open until today's physical check closes it.
• Count check, run last mention first: 6 plus 2 plus 1 is 9, matching the stated 9 entries; 8 closed entries at 61 hours less the 26-hour entry leaves 7 entries at 35 hours, and 35 divided by 7 is 5.0; 26 of 61 is 42.6 percent, stated as about 43 percent.
• Five properties are stated in the general section and all five are used as the sorting criteria here, with none introduced or dropped.

How to verify you got this right

Test your own register the way this review did: pick the oldest open entry and go stand in front of the equipment. If the entry is stale, you have learned something more valuable than whether that one system is up.

Check that closure entries record what was checked, not just when. "Restored 14:20" and "Restored 14:20, valve proven open under tamper, main drain test run, panel clear" are the same length on a screen and one of them is evidence.

Reconcile the register against the work order system quarterly rather than annually. The two diverge in one direction only, because tasks close and states do not, so the reconciliation is a search for open states with closed tasks.

Count the registers. If a building has more than one, it does not have one.

References

• NFPA 25, Standard for the Inspection, Testing, and Maintenance of Water-Based Fire Protection Systems, in the edition the authority having jurisdiction has adopted and amended, for impairment procedures, the tag, and the duration threshold above which notification and a fire watch or evacuation are required.
• NFPA 72, National Fire Alarm and Signaling Code, in the adopted edition, which owns fire alarm system impairment rather than the water-based standard.
• 29 CFR 1910.36 and 29 CFR 1910.37, the federal exit route requirements that apply to your employees during any work that obstructs or alters a means of egress.
• See related: the control valve card for the exposure arithmetic, and the SOP for taking a fire protection system out of service in this category.