firesystemintegretyassurance.pdf

8/10/2019 firesystemintegretyassurance.pdf

1/36

Report No. 6.85/304June 2000

Fire system integrityassurance


2/36

P

ublications

Global experience

The International Association of Oil & Gas Producers (formerly the E&P Forum) hasaccess to a wealth of technical knowledge and experience with its members operatingaround the world in many different terrains. We collate and distil this valuable knowl-edge for the industry to use as guidelines for good practice by individual members.

Consistent high quality database and guidelines

Our overall aim is to ensure a consistent approach to training, management and bestpractice throughout the world.

The oil and gas exploration and production industry recognises the need to develop con-sistent databases and records in certain fields. The OGPs members are encouraged touse the guidelines as a starting point for their operations or to supplement their ownpolicies and regulations which may apply locally.

Internationally recognised source of industry information

Many of our guidelines have been recognised and used by international authorities andsafety and environmental bodies. Requests come from governments and non-governmentorganisations around the world as well as from non-member companies.

Disclaimer

Whilst every effort has been made to ensure the accuracy of the information contained in thispublication, neither the OGP nor any of its members will assume liability for any use madethereof.

Copyright OGP

Material may not be copied, reproduced , republished, downloaded, posted, broadcast or

transmitted in any way except for your own personal non-commercial home use. Any otheruse requires the prior written permission of the OGP.

These Terms and Conditions shall be governed by and construed in accordance with the lawsof England and Wales. Disputes arising here from shall be exclusively subject to the jurisdic-tion of the courts of England and Wales.


3/36

Fire system integrity assurance

Report No: 6.85/304

June 2000


4/36

These guidelines have been prepared for the OGP by the Fire & Explosion Hazard Management Subcommittee

Subcommittee membership

S Teeter Arco

D Catchpole BP Amoco

G Dalzell BP Amoco

R Daniels Conoco

P Rybacki Conoco

P Blotto ENI

R Di Dio ENIC Grounds ExxonMobil

D Sparrock ExxonMobil

L Waters ExxonMobil

N Jorgensen Mrsk

D Stirling Marathon

P Dennis Premier Oil

K Waterfall Shell

G Aanestad Statoil

J Goanvic TotalFinaElf

J Petrie UKOOA


5/36i


2000 OGP

1 Introduction1.1 Background..................................................................................................................................................1

1.2 Scope and objectives .....................................................................................................................................11.3 Health, safety and environmental management............................................................................................11.4 Hazard management and the role of fire systems ..........................................................................................11.5 Performance standards ................................................................................................................................. 2

2 Fire system integrity assurance (FSIA) process2.1 FSIA process steps ........................................................................................................................................3

3 Assessing potential fire events3.1 Introduction .................................................................................................................................................53.2 Fire hazard identification..............................................................................................................................5

3.3 Fuel inventory and pressure .......................................................................................................................... 53.4 Size, severity and duration............................................................................................................................ 63.5 Escalation.....................................................................................................................................................63.6 The Design Event......................................................................................................................................6

4 Setting fire system performance standards4.1 Performance standard definition................................................................................................................... 74.2 Overall role (goal) .....................................................................................................................................74.3 Performance specifications............................................................................................................................74.4 Component specifications.............................................................................................................................84.5 Codes of practice/manufacturers data/operational input..............................................................................9

4.6 Performance specification summary .............................................................................................................9

5 Typical critical performance criteria for fire systems5.1 Detection systems....................................................................................................................................... 105.2 Water systems............................................................................................................................................. 115.3 Foam systems .............................................................................................................................................125.4 Gaseous systems ......................................................................................................................................... 135.5 Passive protection ....................................................................................................................................... 155.6 Personnel response...................................................................................................................................... 15

6 Examination and testing of fire systems

6.1 Introduction ............................................................................................................................................... 176.2 Direct system testing .................................................................................................................................. 176.3 Indirect system testing................................................................................................................................ 176.4 Interpretation of results .............................................................................................................................. 186.5 Impact on maintenance regime .................................................................................................................. 186.6 Exercises ..................................................................................................................................................... 18

7 Record keeping7.1 Performance trends..................................................................................................................................... 19

8 AppendicesAppendix 1 Guidance on system inspection/testing procedures, schedules and record keeping.................... 20Appendix 2 Cost benefit analysis equations..................................................................................................24Appendix 3 Reference documents and contact addresses..............................................................................25Appendix 4 Abbreviations............................................................................................................................ 27

Table of contents


6/36ii

International Association of Oil & Gas Producers

2000 OGP


7/361


2000 OGP

1.1 Background

Experience has shown that fire detection and protec-

tion systems are not always designed or specified insufficient detail to ensure that they meet the perform-ance criteria necessary to reliably achieve their intendedrole. In some areas this role is not even clearly defined.The problem is compounded because often the systemdesigner/specifier has not the operational experienceor feedback necessary to ensure system practicability.Also, as fire systems do not provide a direct contribu-tion to production and revenue, they are sometimes notgiven the inspection or maintenance priorities that theydeserve. In any event it is impracticable to give them a

full performance test on site that truly reproduces thedesign fire event.

This situation can result in fire systems not providingthe performance required, when called upon to do so.

A structured approach from design phase through toimplementation is required for fire systems to ensurethat they have a clearly defined role with respect to firehazards, and that they provide appropriate levels of riskreduction.

1.2 Scope and objectives

This guidance document addresses the issues involvedin the assurance of fire system integrity, from develop-ment of appropriate performance criteria, through toroutine system testing and inspection to assess ongoingperformance against the original criteria. For the pur-poses of this document the term Fire System means afire detection system, passive fire protection or an activefire protection system such as waterspray, foam or gase-ous extinguishing system.

The objective of the document is to describe a struc-tured approach to Fire System Integrity Assurance andgive guidance on its application. In keeping with ahazard based approach to the provision of fire systems,the guidance is not intended to be prescriptive, but toact as a template to develop facility specific assuranceprogrammes appropriate to the levels of risk reductionprovided by the systems.

It is emphasised that this document is intended to give

guidance on the assurance process itself once it hasbeen decided from a risk assessment that a fire systemis justified. It is not intended to give any detailed guid-ance on the overall risk management process, other risk

reduction systems (such as Emergency Shutdown) orthe suitability of different types of fire system for differ-ent applications.

The Fire System Integrity Assurance (FSIA) process isdescribed in more detail in Section 2.

1.3 Health, safety and environmentalmanagement

Health, Safety and Environmental (HSE) managementsystems have, over the last ten years, become generally

accepted in the oil production and processing industryas part of overall business management.

The benefits have been recognised of having a clear HSEPolicy and proactively managing resources, organisation,procedures and risk/hazards, coupled with improvedmonitoring and audit of design, construction, commis-sioning, operations and maintenance.

Experience has shown that companies with a function-ing HSE Management System generally perform betterin the field of managing hazardous processes and pre-vention of fatalities and lost time injuries than those

with a less structured approach.

Additional information on HSE Management Systemscan be obtained from the OGP document, Guidelines

for the development and application of health, safety andenvironmental management systems.

1.4 Hazard management and the role offire systems

Central to an effective HSE Management System isthe way in which hazards are dealt with. Identification,assessment and management of hazards in all phases ofthe life of a facility are the keys to keeping HSE relatedrisks as low as reasonably practicable (ALARP).

Although terminology varies across the industry, firerisk reduction usually involves the following steps:-

Inherent safety (design out or reduce the hazards atsource)

Prevention (maximise plant and operational integ-rity measures to prevent failure and minimise thelikelihood of release - i.e. reduce incident fre-quency)

1 Introduction


8/362


2000 OGP

Control (install measures to reduce the severity ofpotential hazardous events, e.g. shutdown initiatedby fire detection)

Mitigation (stop escalation of potential hazardousevents, e.g. fires, and so protect personnel or theenvironment from their effects)

Assessment, feedback and review

Hazard Management should be focussed primarily oninherent safety and prevention in order to minimise thechances of hazardous events. However, incident miti-gation measures can still play an important part in anoverall hazard management approach. Also, many oper-

ating units processing or storing hydrocarbons weredesigned at a time when prescriptive requirements forhazardous event mitigation measures were the mainmethod of risk reduction; as a result, fire detection andprotection systems continue to have a key role in hazardmanagement to minimise risks as far as is practicable.

Whilst the focus of risk reduction is towards life safetyand environmental issues, the fire systems can also playan important role in reduction of risk to ongoing busi-ness and assets. As such, the risk based cost effectivenessof the fire protection system should be assessed using a

form of Cost Benefit Risk Assessment (CBRA) or CostBenefit Analysis (CBA). This needs also to consider thesystems effectiveness. Formulae such as those given inAppendix 2 should be used in this assessment.

1.5 Performance standards

To be demonstrably effective in reducing risks, firedetection and protection systems need their role and per-formance to be matched to the potential consequencesof the hazard release they are intended to manage. Afacility Fire Hazard Analysis (FHA) or Fire Risk Assess-ment (FRA) is essential, and fire systems deemed to berequired should be designed with a performance stand-ard that permits them to be effective in detecting ormitigating potential fire events.

Experience has shown that while these fire system per-formance standards may be visible enough in design,their purpose can be lost during subsequent construc-tion, commissioning and longer-term operation of a

plant, particularly if the fire hazards are not well under-stood or communicated.

Installation contractors often leave a site without dem-onstrating whether the system they have installed will

perform as envisaged in design and hence provide thenecessary level of risk reduction. Once operations havestarted, detection systems are sometimes locked out

when they appear to compromise continuous opera-tions, thus affecting risk reduction arrangements.

Fire detection and protection systems are usually classedas HSE Critical Systems. Maintenance regimes, how-ever, are often not clearly focused on making sure thatthe performance standards for these fire systems are notcompromised over time; this results in them becomingless effective when called upon to manage hazardousevents.

Many regulatory authorities worldwide have changed

from prescriptive legislation requiring the provision ofspecific detection and protection systems, to a require-ment for the assessment and understanding of firehazards, and the implementation of an effective man-agement system for them and the risks they present. TheUK PFEER regulations are a good example; these regu-lations are supported by detailed guidance on Fire andExplosion Hazard Managementpublished by UKOOA.Although written for the UK offshore sector, the prin-ciples described apply to fire and explosion hazards uni-versally. Guidance is also available in the ISO document

ISO 13702, Control and Mitigation of Fire and Explo-sions on Offshore Installations.


9/363


2000 OGP

2 Fire system integrity assurance (FSIA) process

Fire System Integrity Assurance (FSIA) is the process ofidentifying fire system performance standards decidedupon in design, and checking they are appropriate to

foreseeable hazardous events (fires). FSIA then dealswith ensuring that these standards are not compromisedin the later phases of the life of a facility, particularlyinstallation, operations and maintenance, and confirm-ing that they meet the requirements on an ongoingbasis.

This guidance note links documents such as theUKOOA hazard management guidance to the fire sys-tems hardware level and looks at how fire system integ-rity assurance can be achieved, and the benefits thataccrue from implementing it.

The FSIA process and its part in overall Fire HazardManagement is shown in Figure 1. The actual point atwhich FSIA starts is really after the decision from theRisk Assessment that a fire system is required and itsrole is specified. However, in practice the precise pointis not so well defined because the decision to provide aFire System is an iterative process involving the reviewof potential fire incidents, defining the role required ofany fire systems and the selection of appropriate systems.Having selected the system type it may subsequently be

found that it cannot practicably meet the required per-formance criteria that are developed. It would then benecessary to revisit the iteration loop and review alterna-tive methods of achieving the required levels of HazardManagement.

2.1 FSIA process steps

The FSIA steps are: -

Set performance standards to clearly define exactlywhat measurable criteria the system must meet.

Develop component specifications which arerequired to meet the performance criteria.

Develop relevant test, inspection and maintenanceprocedures through which ongoing performancecan be assured.

Implement and keep records of the test, inspectionand maintenance programme.

The following sections of this document give guidanceon all the steps within the FSIA process, as well as gen-eral aspects of the overall Fire Hazard Managementprocess of which FSIA is an integral part.


10/364


2000 OGP

Process Issues Inputs

Iteration loop

FSIA Process

Review potential fireincidents as part of Risk

Assessment

Fire/explosion modellingProcess engineeringIncident database

Fire typeFire size

Fire durationFire products

ConsequencesProbabilities

Define role required of firesystems in risk reduction

Cost benefit analysisFire systems engineering

Detection?Control/mitigation?

Extinguishment?

Select appropriate systemtypes

Fire systems engineering

Detector type?(gas, heat, sm oke, flam e, etc.)

Active protection?(w ater, foam , gaseous, etc.)

Passive protection?(coatings, claddings, etc.)

Set performance standards

Fire systems engineeringCodes of practice

Incident experienceSystem experience

FunctionalityAvailability

Survivability

Develop componentspecifications

Fire systems engineeringCodes of practiceSystem experience

MaterialsFlow rates

Standardisation, etc.

Develop test, inspectionand maintenance

procedures and schedules

Fire systems engineeringCodes of practiceSystem experience

Performance tolerancesIndirect testingDirect testing

Implement test, inspectionand maintenance


Competency standardsMaintenance programmes

TrainingRecord keeping

Figure 1 Fire System Integrity Assurance


11/365


2000 OGP

3 Assessing potential fire events

3.1 Introduction

Assessment of the consequences and frequency of poten-

tial fire events is essential to the identification of appro-priate fire prevention, control and mitigation measuresnecessary to reduce risk to acceptable levels. If the poten-tial fire scenarios have not been thoroughly assessed aspart of a Risk Assessment it is not possible to match theoverall role or the detailed performance of fire systemsto the risk reduction required. For example, it wouldbe pointless specifying a smoke detection system for anarea where the potential fire event was a methanol orhydrogen fire which burn with a clean flame.

The identification of potential fire events should com-mence at the early stages of design and address allforeseeable fires and explosions. In its own right theassessment and quantification of fire events is not partof FSIA but it is an essential step prior to it, as it leadsto the selection of an appropriate fire system to managethe hazard.

Additional information on fire/explosion assessment canbe found in the UKOOA Guidelines and the Hand-book for Fire Calculations and Fire Risk Assessment inthe Process Industry.

The first stage in the assessment is to divide the instal-lation into discrete areas and to consider the hazardswhich may exist in each. Having done so, fire and explo-sion events can be identified and scenarios developedaccording to the hazardous material involved and theconditions relevant to the system and inventory.

In selecting the fire scenarios for analysis, probability orfrequency of incidents should be considered as well asconsequences.

3.2 Fire hazard identification

Typical fire and explosion events include: -

Cellulosic fires (involving wood, paper, etc.)

Electricalfires (involving cables or control panelsetc.)

Pool fire (combustion of flammable liquid pool)

Spray fire (pressurised or flashing liquid spray fire)

Jet fire (gas fire)

Flash fire or deflagration (combustion of flamma-ble gas, insufficient flame speed to result in damag-ing overpressures)

Explosion (combustion of flammable gas/vapourresulting in damaging overpressures)

BLEVE (Boiling Liquid Expanding Vapour Explo-sion - a rapid ignited release of flammable, pressu-rised gas/vapour resulting in heated vessel failure,blast overpressure, missiles and fireball)

It is also important to consider external fire sourceswhich may not be immediately obvious. Potential initia-tors of fires and explosions not related to plant/processesmay include collisions, such as helicopter crashes ortanker incidents.

Each identified hazardous event will be associated with

a range of possible scenarios. The most important sce-narios are those in which the initial release and igni-tion are likely to cause the most significant damage topersonnel, the environment or production.

In selecting scenarios, a balance must be struck betweenconsidering larger, less frequent events causing seriousdamage to the installation, and smaller, perhaps morefrequent events, which could cause local damage andlead to escalation. Due consideration should be given tothe likely design features of the plant, failure modes andresulting sizes, shapes, arrangements and location of

releases/failures in order to ensure that any fire systeminstalled is appropriate.

3.3 Fuel inventory and pressure

When identifying hazards the factors which determinethe type of fire/ explosion event should be addressed.

Parameters relating to the stored inventory include: -

System pressure

System temperature

Fuel composition, density and flashpoint

Combustible load

Potential release points

Degree of isolation/quantity of isolated inventory.

Presence of oxidising agents

Auto-ignition temperature

Location of ignition sources


12/366


2000 OGP

3.4 Size, severity and duration

Estimates of the size, severity and duration of a fire/

explosion event are necessary to provide informationabout the effects of exposure to personnel/plant andsafety systems (collectively, Consequence Analysis),so that a decision can then be made regarding thefire systems required. (Validated Fire Modelling soft-ware packages are available to assist in this exercise).Research on fires and explosions is an ongoing exerciseso additional information becomes available on a regu-lar basis.

For fires, the necessary information may include: -

Type

Hydrocarbon pool, jet, etc.

Size

Fire spread, diameter, flame length, shape, etc.

Products of combustion

Smoke, heat, flame. In the case of smoke, the particularcharacteristics are required - particle size and tempera-ture - because different types of smoke can be detected

more efficiently by different types of smoke detector.For example an incipientfire in cabling or printed cir-cuit boards will give off a smokewhich is relatively coldand have very small particle size. Such smoke would notbe detected by conventional point detectors located atceiling height.

Severity

Internal/external heat flux, smoke concentration, toxic-ity and travel. Of particular importance is the incidentseverity and its effect on life safety.

Location

Location of release or fire and degree of impingement.

Duration

Change in above characteristics with time plus theoverall duration of the event can affect selection andperformance criteria of fire systems. (e.g. If the fuelinventory and fire size is such that it burns out withina very short time without escalation, then an active fireprotection system would not be justified.)

In the case of explosions, consideration should be givento the extent of the flammable gas cloud, degree ofconfinement/congestion and the damaging effects of

overpressures brought on as a result of high flame speedcombustion.

3.5 Escalation

In addition to the initial effects of a fire or explosion,consideration should be given to whether and how anevent can escalate to endanger personnel, the environ-ment or an adjacent plant.

The effects of escalation on the installed safety systemsshould also be determined to give an indication of howthis may affect subsequent escalation.

Escalation analysis can be carried out using Event Treesor some other form of Consequence Analysis to showthe sequences of events which need to occur to resultin a particular level of risk. Using such analyses enablessystem designers/operators to add further risk reduc-tion measures (including fire systems), or enhance thosealready in place.

3.6 The Design EventThe scenarios which are selected from the risk assess-ment as meriting risk reduction measures due to theirconsequences and/or their frequency are sometimesknown as Design Events.

Facility specific selection of Design Events dependson several factors. The type of considerations that arerequired as part of the overall risk assessment include: -

Do you designfor the event at all? (e.g. pipelinefractures).

What ESD time is used for Design Events?

What hole sizes are to be used for design releases?

Do you design for the ultimate catastropheor isthe main intention to control the smaller events?


13/367


2000 OGP

4 Setting fire system performance standards

This section outlines the principles of setting fire systemperformance standards. Section 5 gives examples of thetypical performance criteria that should be considered

for different types of fire system.

4.1 Performance standard definition

A performance standardis a statement, which can beexpressed in qualitative or quantitative terms, of theperformance required of a system, item of equipment,person or procedure, and which is used as the basis formanaging the hazard - e.g. planning, measuring, con-

trol or audit - through the lifecycle of the installation.

4.2 Overall role (goal)

The first step in specifying an appropriate and relevantfire system is to define its role in risk reduction. Broadly,the overall role of a Fire System can be split into threecategories: -

1 detection

2 control/mitigation

3 extinguishment

Examples: -

(i) Passive Fire Protection, such as cladding, wouldbe seen as a control/mitigation measure; it doesnot actually extinguish the fire but it does limit itsconsequences.

(ii) Waterspray systems may be designed to providecontrol or extinguishment. (If the role was con-

trol, the intention would be to limit fire spreadby cooling structures or equipment for sufficientlength of time for the fire to burn out or be extin-guished by other means and so prevent escala-tion.)

The role of a fire system is usually complementary tothat of others to form effective hazard management.For example, passive protection will have a finite dura-tion in a given fire incident and so meeting its overallrole will probably be dependent on effective process iso-

lation which, in turn, is dependent upon effective inci-dent detection.

In practice the overall role does need some qualificationin the form of definition of the relevant incident and

the goal in terms of qualitative or quantitative objec-tives.

Example: -The role of passive fire protection could be: -

To prevent the catastrophic failure of vessel VXXXwhen directly exposed to crude pool fires for 60 min-utes or jet/spray fires for 30 minutes.

4.3 Performance specifications

This section is intended as an overview only of the prin-ciples of Performance Specifications. If additional, moredetailed guidance is required, the UKOOA Guidelinesfor Fire and Explosion Hazard Management which givesadvice on format as well as content should be used.

Once the overall purpose has been determined, it isnecessary to define more specific performance require-ments. These can be broken down into 4 categories,collectively known as FARS: -

FunctionalityAvailability

ReliabilitySurvivability

It is important to emphasise that performance mustbe defined for an overall system as well as individualcomponents, and as such, may include system controlfeatures and competency requirements for system oper-ators. For example, in an automatic foam spray systemthere will be performance requirements for the firewa-ter system valve actuators, foam proportioning system,control system, and of course, the detection system thatinitiates the foam spray discharge as well as the dis-charge devices themselves. Also there may be a need todevelop minimum competency standards for personnelresponding to back-up the system.

The performance standards are the minimum standardwhich must be achieved throughout the working life ofthe system. They are not as newbut more the perform-ance levels below which remedial action is required.As newstandards should therefore have a tolerance toallow for deterioration with time. This emphasises theneed for a measurable criteria against which the ongo-

ing performance of a system can be checked.It is advisable initially to concentrate on definition of theoverall system performance rather than that of individ-ual components. These can be specified at a later stage


14/368


2000 OGP

and tend to require more specific engineering detail,which may be best presented in the form of detaileddata sheets.

4.3.1 Functionality

Functionality performance requirements are thoseparameters required for the system to meet its definedoverall role in a manner appropriate to the scenariofor which it is intended. They define what needs to beachieved, not how to achieve it.

4.3.2 Availability and Reliability

Availabilityis a measure of the systems state of readi-ness to operate at any given time.

Reliabilityis the systems ability to operate and performits intended function when called upon to do so.

The combination of availabilityand reliabilityis thusthe proportion of the hazard occurrences when thesystem is available to operate and fulfil its defined role.

It is important that some quantification is made of theavailability and reliability required to ensure the desiredlevels of hazard management. 100% availability is not

normally necessary or, indeed, possible. The level ofreliability required will depend on the criticality of thesystem.

The UKOOA document Fire and Explosion HazardManagement gives guidance on the categorisation orranking of hazard management systems using a safetyintegrity level approach. In turn, this references theInternational Electrical Committee (IEC) code (IEC1508), which quantifies bands of reliability and avail-ability appropriate to safety integrity levels. It is notedthat although the specific levels of availability described

may not be appropriate, the concept can be adapted tosuit hazardous events and systems within the oil indus-try.

Systems may not be available due to maintenance, test-ing, repair, breakdown or impairment while other unre-lated activities are being carried out. There should beclearly defined limits for the periods when a system maybe out of commission.

In some cases it may be appropriate to shutdown haz-ardous operations or take other temporary risk reduc-

tion measures when systems are not available.Overall availability can be improved by duplication ofcritical components or complete systems. Unreliabilitycan arise from the use of poor quality or unsuitable

components, poor system design or installation; or fail-ure to understand, commission, test or maintain thesystem. This emphasises the need for a Fire Systems

Integrity Assurance approach. Following the processdescribed in this document should improve reliability.

There is always a need for an appropriate testing andinspection regime to check ongoing system perform-ance and thus help maximise reliability.

4.3.3 Survivability

Survivabilityis the systems capability to withstand theeffects of an incident prior to, and during, its opera-tion. For example, the discharge nozzles and pipework

of a waterspray system may be exposed to an overpres-sure due to an explosion preceding a fire for which thesystem is intended. In such cases the exposed compo-nents must withstand the overpressures and the effectsof the event itself until the system is fully operationaland for the designed duration of system operation. Fac-tors that affect survivability include strength of materi-als and the speed of actuation of any control systems.

Typical features that are considered in survivability per-formance specification are: -

Resistance to overpressure from explosion scenar-ios

Resistance to cold shock from initial contact withspilled vaporising liquids, such as LPG

Resistance to heat radiation or directflame impinge-ment prior to actuation of system

4.4 Component specifications

In order to back up overall system performance criteriait may be necessary or convenient to develop systemcomponent specifications including such informationas materials of construction, flow rates, certificationrequirements etc. It is important to ensure that suchsystem component specifications are complementary tothe overall performance criteria and designed to ensure,based on practical experience or theoretical calculations,that the component will play its part in ensuring thatthe overall performance is met. Component specifica-tions can be particularly valuable when they confirm

suitability for Designfire characteristics.


15/369


2000 OGP

4.5 Codes of practice/manufacturersdata/operational input

It is important that system operational knowledge andexperience forms a major input into system perform-ance specifications and, indeed, individual componentspecification. It is not sufficient to rely on system manu-facturers or design engineering houses having sufficientexperience to ensure that systems will be suitable for thehazards or meet performance requirements in a practi-cable way. This is because there is, unfortunately, verylittle feedback to them from operators of the systems onthe practical issues that arise on site.

Codes of Practice such as those published by NFPA arenot usually, in their own right, sufficient as performancestandards although they can form a useful part of them.This is because such documents tend to be generic informat and therefore cannot provide sufficient detail tosuit all specific site conditions and requirements and somay not be appropriate to the particular hazard. It istherefore essential that any Code of Practice used in per-formance criteria development is reviewed to confirmthat it is appropriate to the type of fire, combustion,operating and environmental conditions in question.

For example, the NFPA Code of Practice for foam sys-tems describes several different methods of proportion-ing foam concentrate into the water supply; final choiceof the type chosen must take into account specific localrequirements.

4.6 Performance specification summary

Overall it should be recognised that it is not possible

to be prescriptive regarding the features that shouldbe included in a performance specification. Instead, aprocess such as Fire Risk Assessment is required to con-sider and develop system specific requirements froman understanding of the systems role in a specific inci-dent scenario. This demands a full understanding ofpotential fire events, their characteristics and their con-sequences. The disciplines and tools that can be used asinputs to this process are shown in Figure 1.


16/3610


2000 OGP

5 Typical critical performance criteriafor fire systems

The justification for any particular system should havebeen developed from the Fire Risk Analysis and sub-

sequent Fire Hazard Management Strategy. Once thesystem has been justified, it is important that per-formance standards are directly relevant to the facility-specific requirements derived from the risk assessmentprocess. It is therefore not possible to provide a uni-versally applicable list of the features that should beconsidered for different types of fire system in the devel-opment of performance criteria. However, experienceon site has shown that some particular critical per-formance criteria are not developed at design stage or,if they are, are not carried through to installation, com-missioning and routine testing/maintenance. In somecases it may be that any generic system data availablefor development of performance criteria is not appropri-ate and it becomes necessary to carry out fire tests toobtain specific relevant information.

This section gives guidance on these critical criteriathat should be addressed to ensure appropriate perform-ance. It is not intended as a comprehensive list of cri-teria but to highlight those that are most important.Most of the issues would fall into the functionalitycategory although some have an impact on availability

and survivability.

5.1 Detection systems

The most important performance consideration for afire detection system is matching the type of detectorand its response time to the type of combustion productthat is developed in a potential incident. This, again,highlights the necessity of analysing fire scenarios andunderstanding their consequences and effects.

Functional standards to be met for detection systemstherefore include: -

Type of sensor according to combustion producttype - smoke, CO, UV or IR radiation, tempera-ture, temperature rate of rise

Sensitivity to fire size to be detected

Speed of response to the given fire size/type

Coverage of detector/location of fire

Control actionsFire detection can be broadly categorised as flame,smoke or heat detectors. Some guidance is given belowon the achievement of these standards and considera-

tions for design relative to all types as well as to theindividual categories.

All detection types

Response time to the products of combustion ofthe design events.

Recognised international standards are finally real-ising the importance of this and demanding differ-ent detector head testing techniques more relevantto real fires. For example EN54 - Fire Detectionand Fire Alarm Systems now describes 6 differenttests relevant to different fires: - Cellulosic, smoul-dering pyrolysis, glowing pyrolysis, open plastics,

heptane and methylated spirits. Such tests can bedemanded for individual detector heads to ensurethat they are suitable for the hazards.

Performance under different potential operatingconditions.

This is particularly true for smoke detectors becauseair conditioning, rotating machinery and environ-mental conditions can have a considerable effect onsmoke travel. It is also important, however, for othertypes of detection. For example, presence of hotrotating equipment can affect the performance offlame detectors and, of course, it is important thatheat detectors are calibrated to actuate at a temper-ature higher than any normal operating environ-ment temperature.

Commissioning and routine regular testing shouldinclude total system testing using a methoddirectly relevant to the fire type.

As an example, the tests described in EN54 can beadapted for use for total system testing. Tests shouldbe carried out under different operating conditions.

Additional guidance is given under the sections onindividual detector types.

Detection should have well defined relevant sen-sitivity or adjustable sensitivity capability so thatsite adjustment can be made if necessary to suitactual conditions.

Normally some type of voting from detectorswould be required prior to automatic executiveaction to assure system reliability.

If this is the case, it may be necessary to increase

the number of detectors considerably in order tomaintain the response time required.

Control Panels and power supplies must bedesigned to conform with overall system reliability


17/3611


2000 OGP

requirements such as those described in ISO 61508- Functional Safety of Electrical/Electronic Pro-grammable Electronic Safety Related Systems.

Fire alarm control panels are often purchased as aspecialist item. The requirements for power supplyintegrity, component reliability and failure modeand effect analysis need to be specified to anappropriate level consistent with criticality of thesystem.

5.1.1 Smoke detection

Smoke travel tests should be required usingsmokerelevant to the applications.

Testing should be relevant to the particular hazardand combustion conditions and the overall purposeof the system. The characteristics of smoke andsmoke travel vary greatly according to the materialbeing burned and the operating conditions. Thetests described in EN54 can be adapted as men-tioned previously for many smoke detection sys-tems. However, for incipient fire smoke detectionsystems, the test method that has become a recog-nised standard is the hot wire test described inBS6266 - Code of Practice for Fire Protection of

Electronic Data Processing Installations. This testis appropriate to situations where the smoke hasvery small particle size and is relatively colddue toit being produced at a very early stage of fire devel-opment. OGP document Incipient Fire Detectiongives additional guidance on the use of detectors ofthis type.

Individual detector head testing is not usually suf-ficient to assure system integrity.

5.1.2 Flame detection

Line of sight to all potential design fire areasmust be provided for at least the number of detec-tors required to bring about automatic executiveactions.

Flame detectors generally have a cone of vision.Very often, when systems are designed on paper,the fire areais obscured in practice due to equip-ment or structural elements in the area. Commis-sioning and routine testing should include use ofan appropriate device (such as a UV flashlight) to

check both sensitivity and line of sight. Suitability for relevant fuels and operating envi-

ronment.

The suitability for the environment must be con-firmed. Not all fuels give off UV and/or IR radia-tion. It is therefore important to ensure that the

flame detector chosen is suitable for the type of fuel.Also, other contaminants such as silicones, ice oroil mists can affect detector response as well as, inthe case of IR detectors, hot/rotating equipment.

5.1.3 Heat detectors

Location and number of detectors to allow suffi-ciently fast response.

Heat detectors are often used as a reliable back upto other detection, recognising that they are often

slower to respond than other types.It is important to ensure that the actuation tempera-ture and the location of the detectors are appropriateto a performance requirement. This is particularlytrue where point detectors are used in open areas.Air movement can mean that temperature levelstake a long time to increase sufficiently to activatethe detector.

5.2 Water systems

The potential role of water systems includes: -

Prevention of escalation

Prevention of catastrophic rupture

Prevention of structural failure

Control of smoke and/or flame movement

Combustion interaction/reduction of flame tem-perature, heat flux and size

Extinguishment

Functional parameters relevant to the performance ofwater systems include: -

Speed of response and time to full flow condition

Application rate

Coverage (in some cases this might be generalarea coverage, in others, specific vessel or supportstructure coverage)

Nozzle location and characteristics (droplet pro-

file and velocity)

Application duration


18/3612


2000 OGP

Guidance on these issues can be found in standardssuch as NFPA 15 - Waterspray Fixed Systems and ancil-lary publications such as NFPA 20 - Fire Water Pumps.

However, it is important to ensure that the guidanceis directly relevant to the actual applications. If not,theoretical calculations or even experimental validationmay be required. (It is important to note that NFPA 15should only be considered applicable to pool fire situa-tions and not to gas/spray fires.)

Application Rate should be specified in litres/min/m2 of wetted surface (gpm/ft2) to achievethe desired level of cooling or extinguishment.

The system should be such that coverage of all

areas is achieved at the required Application Rateunder all potential operating conditions takinginto account windspeeds and directions.

Water droplet size and density will also affect areacoverage in that they must be such that the flame ispenetrated and the water reaches the area where itis required. This can often be addressed by requir-ing an independent certification of the dischargenozzle, making sure that the certification is directlyrelevant to the application.

The time to full flow must be such that escala-tion of the incident to unacceptable levels doesnot occur and the distribution system must notfail before water starts to flow.

This feature is also dependent on actuationmethod.

The system run time must be directly relevantto the incident duration including any extendedcooling time required.

Manual actuation devices should be in accessibleand safe locations.

Water application and any fuel spill should becontained or drained off in a controlled manner.

In many cases waterspray systems have beendesigned and specified without recognising thatvery large quantities of water will be applied and itis essential that run off is controlled. In the worstcase, if this is not done, then fires can actually beescalated by fuel being carried to other areas.

Reliability of water supply to a water based systemmust be considered in the overall system design.

This requires due consideration of redundancy ofwater supply, pumps, and firewater system distri-

bution sections according to the frequency of thedesign events. For example, lower levels of redun-dancy might be acceptable for less frequent events.

Water Mist systems are not at the same stage of devel-opment as waterspray systems and it is interesting tonote that the relevant NFPA Code (NFPA 750) is morein the style of a performance setting standard than aprescriptive one.

5.3 Foam Systems

Foam is one of the most important extinguishing mediafor hydrocarbon contained liquid pool fire incidents,yet it is an area where poor understanding, specificationor testing often leads to ineffective system performance.It should be noted that foam is generally not effectiveagainst pressurised liquid fires.

Guidance can be sought on many aspects of systemdesign from NFPA 11 - Foam Systems, but it is impor-tant to ensure that the guidance is directly relevant tothe application. For the special area of aviation relatedincidents (helidecks and airstrips), ICAO documents

CAP 168 and CAP 437 are of more direct relevance.Considerable amounts of research work have been car-ried out on foam systems for the special application ofLNG/LPG spill vapour suppression and fire control.Standards are currently being developed for these appli-cations.

Functional parameters relevant to the performance offoam systems include: -

Response time

Application method

Foam quality produced: -

Expansion

Drainage time

Proportioning rate concentration

Application rate

Foam coverage/spread

Duration of discharge

Vapour suppression capability

The foam concentrate must be of a type suitable forthe application


19/3613


2000 OGP

There are many approval testsfor foam concentrates.It is very important to select one directly relevant tothe application. Many national standards organisations

have, in the past, developed their own standards onfoam.

An ISO Standard (ISO 7203 - 1 - Fire ExtinguishingMedia - foam Concentrates) is also now available. How-ever, this is intended for generic applications rather thanany specific hazard.

The most relevant foam system standards for the oilindustry applications are: -

LASTFIRE Group

Test method developed to assess a foams capabilities intank fire scenarios.

UL 162

Underwriters Laboratories test method for foams in dif-ferent types of systems. This would be relevant to gen-eral use of foam in handlines but is also relevant tofoam spray systems.

ICAO

International Civil Aviation Organisation documentsCAP 168 and CAP 437 give guidance and test methodsfor foam concentrate for helideck and airstrip applica-tion.

CEN

CEN document EN 12065 (draft) gives guidance ontesting a foams capability in the suppression of LNGfires.

It should be recognised that in some cases system spe-cific tests may be required, especially those involving

fuels other than hydrocarbon.To ensure these criteria are met, the following must beconsidered: -

Acceptable accuracy of the foam concentrate pro-portioning rate must be specified over the entirerange of possible system flows.

In many cases several foam systems are fed fromone centralised proportioning unit. Therefore, theremay be different operating flow rates for the propor-tioner. Also, an individual system will have differ-

ent flow rates according to operating pressures, useof supplementary equipment from the same systemand blockage of some outlets. It is important that

the proportioner can provide accurate proportion-ing over the complete flow range. If no more spe-cific information is available, then NFPA 11 should

be used for guidance. This essentially allows +30%,-0% from the nominal proportioning rate for mostapplications.

The application rate of foam solution reaching thefuel surface must be sufficient to gain control andextinguishment under all operating conditions.

NFPA 11 can be used for guidance on this subjectas it quotes minimum application rates for dif ferentsituations based on previous experience. However,the rates are those required to reach the fuel surface

so allowances must be made for losses due to wind,thermal updraughts, etc.

Foam quality (stability, flowability, etc.) must beappropriate to the hazard.

Foam quality is usually measured by means of anexpansion rate and a drainage time for 25% of thefoam solution to drain from the foam. In some casesa large tolerance can be accepted without majorloss of performance, but in some cases, such as sub-surface injection, these parameters are very critical.Although standards such as NFPA give guidance on

this subject it is not definitive and in some cases itis necessary to resort to manufacturers data, check-ing that the data is based on sound operating expe-rience.

The system run time must be sufficient to ensureextinguishment and develop a foam blanket tominimise possibility of re-ignition.

Guidance for many situations can be found inNFPA 11 which includes minimum system runtimes for a variety of applications.

5.4 Gaseous systems

With the recognition of the contribution of Halons tothe breakdown of the Earths protective ozone layerand the subsequent reduction in their use, alternativeagents have been developed and fast trackedinto serv-ice without as much testing as may have been liked.Under these circumstances it is even more important todevelop system specific performance criteria.


20/3614


2000 OGP

Functional parameters relevant to the performance ofgaseous extinguishing agent systems include: -

Safety features regarding personnel exposure to theagents, their by-products or low oxygen concentra-tions

Concentration of agent or levels of oxygen depletionachieved to ensure extinguishment for the fuel(s)in question

Speed of system response and time to achieve thedesign concentrations throughout the protectedvolume

Retention time for the design concentration to be

maintained Agent quality

Supporting control actions

Enclosure integrity/venting

Guidance can be obtained from documents such asNFPA 2001 - Clean Agent Systems, BFPSA Code ofPractice for Gaseous Fire Fighting Systems and OGPdocument Inert Gas Fire Extinguishing Agents.

Appropriate measures must be specified to ensure

personnel are not subjected to potentially danger-ous levels of gas or their breakdown products.

Several of the gases used for extinguishing systemshave potential to cause harm to individuals either bytoxicity of the gases themselves or their breakdownproducts or by oxygen depletion. It is thereforeessential to provide safety features, the performancecriteria of which are such as to prevent exposureof harmful levels to personnel. Such facilities caninclude lock out devices, time delays and post dis-charge ventilation systems.

Agent concentration must be sufficient to gainextinguishment.

Concentration required will depend on the fuel andfire type. Test work may be required to develop spe-cific criteria for some situations. Normally a safetyfactor over the minimum concentration would alsobe required.

The time to achieve the design concentrationthroughout the relevant area must be sufficientlyfast to prevent excessive escalation.

The acceptable maximum time to achieve designconcentration should be assessed from the reviewof potential fire events. If no other relevant infor-mation is available, the BFPSA guidance is for liq-

uefiable gases to be discharged within 10 secondsand non-liquefiable within 60 seconds. The needto achieve distribution throughout the area will

normally require a validated flow analysis and noz-zle-sizing program to be used along with post instal-lation discharge testing for confirmation.

Agent quality

It is obviously essential that the gas used in thesystem be of the correct quality. Colour coding ofcylinders should be in accordance with local regula-tions to minimise the possibility of using the incor-rect gas. Quality requirements for different gasesare given in NFPA 2001 and the BFPSA document

referenced above. Retention time should be such that the extin-

guishing concentration is maintained for suffi-cient time to ensure that the fuels have cooled sothat re-ignition will not occur and/or the requiredsystem post-discharge back-up response can beachieved.

Retention time will depend upon the amount oflosses due to leakage, ventilation, etc. as well asamount of gas discharged. Therefore, the perform-ance criteria must include information on enclosure

integrity. It may be necessary to demand an enclo-sure integrity test and NFPA 2001 gives guidanceon this. It should be remembered that the gas con-centration must be retained to at least the heightof the highest combustible/flammable materials inthe area.

Enclosure integrity and/or venting arrangementsshould be such that the overpressures developeddo not jeopardise the enclosures integrity.

Different construction types can withstand differ-

ent levels of overpressure. Any level of overpressurecan be accommodated by means of venting and/orstructure strength. This requirement will normallydemand use of validated software to calculate over-pressures and assess venting requirements. Enclo-sure integrity tests will normally be required toassess actual vent conditions. Another aspect ofenclosure integrity is the prevention of gas migrationto other areas where it may become a hazard. Integ-rity test methods are described in NFPA 2001.


21/3615


2000 OGP

5.5 Passive protection

Functional parameters to be considered for passive pro-

tection include: -

Fire type and characteristics: -

Heat flux

Temperature

Erosion resistance for jet/spray fires

Substrate/protected item threshold temperature

Durations of protection required

Performance changes over the lifetime of the facil-

ity

The passive protection must be suitable for the typeof fires identified during the risk assessment

Standard fire tests assess a material or structures capa-bility of maintaining its integrity and preventing heattransfer to items on their coolside. Normally this isdone by specifying a maximum cool side temperatureduring a test sequence. Standard fire tests can be usedto define this criterion provided the test represents theactual on-site situation.

Different fire tests are available, such as BS 476 or UL1709 to identify the capability of a material to with-stand heat flux and insulate facilities on its coolside.It is important to ensure that the test method specifiedis directly relevant to the application. In the case of cel-lulosic material fires and hydrocarbon pool fires this isrelatively straightforward as the tests do reproduce thetemperature rise curves and heat fluxes of such fires.

However, in the case of jet fires, the effects on passiveprotection can vary considerably according to fuel type,

flow rate and pressure. Therefore, standard jet fire testscan only be used as guidance and correlation withactual conditions or a specific test has to be used toassess performance. The document OT1 95-634 JetFire Resistance Test of Passive Fire Protection Materi-als, published by the UK Health and Safety Executivedescribes a test that has become accepted as an assess-ment method for passive protection in this type of fire.

Other considerations for passive fire protection are: -

The time for which the passive protection main-tains its integrity and its ability to prevent heat

transfer to the desired level should be specified fol-lowing the assessment of potential fire incidentsand their duration.

For example, if the maximum fire duration is 90minutes, the passive protection would typically berequired to meet its performance criteria for insu-

lation and integrity for a period in the order of 2hours. Standard fire tests tend to test materials andcertify them for 15, 30, 60 or 120 minutes. It isconceivable that passive protection may have multi-ple roles - e.g. to withstand a jet fire for 30 minutesand a pool fire for 60 minutes.

The ongoing capability of passive protection toachieve its insulating properties should be rele-vant to the lifetime of the facility.

Ongoing performance of passive protection will

depend on a number of factors including exposureto physical damage and environmental conditions.It should be proven by long term exposure or firetest. Samples can be made at the time of installa-tion and tested after specific durations such as 5,10 or 20 years. Site conditions must be reviewedand relevant performance criteria established. Per-formance in these aspects is usually indicated byweathering tests, impact tests, elevated temperaturetrials, etc. Often it is necessary to review manufac-turers data and check that the test methods usedand results are directly relevant to the application.

In the case of vapourising liquids, such as LPG,resistance to initial cold and shock.

5.6 Personnel response

All fire systems require some form of response in termsof operators and/or professional firefighters carrying outsome actions during the time the system is operating

or immediately after it. This response may be simplyto check that the system is performing correctly andachieving its design intent or it could be more onerous.It is important to ensure that performance criteria areavailable and met for the responders. Critical functionalparameters for personnel response include: -

Availability of personnel

Numbers of personnel

Speed of response

Competency/ongoing training


22/3616


2000 OGP

Considerations must be made of the following: -

Responder competency

This not only involves the formal technical capa-bility of the responder but also his ongoing train-ing and his access to and opportunity to trainagainst preplanning procedural documentation onhis response role to the scenario.

Protective clothing and equipment available tofacilitate safe response

Post incident procedures

In order to ensure that systems are allowed to per-form their role it is necessary to provide, as part of

the system documentation and responder training,the procedures to adopt after the system has beenactuated. An obvious example of this could be theneed to allow a gaseous agent system to soakforsufficient time to meet performance criteria priorto opening enclosure doors and thus releasing andreducing gas concentrations.

Ownership of response preplan

It is important to ensure that ownership of the pre-plan is firmly established so that responsibility forits maintenance is fully understood. It should also

be recognised that a preplan should be regarded notpurely as a firefighter response aide-memoire butalso as one for an operator whose response roles mayinclude initiating or confirming shutdown actionsi.e. the preplan should ideally be an integrated doc-ument recognising both operator and fire responderactions.

Maintenance of personnel response

Whilst training of individuals in their role inresponse is important, it is essential also to have

regular exercises to demonstrate the completenessof the response capability. In some parts of theworld it is becoming a legal requirement to dem-onstrate this understanding and implementation ofresponse capability by the holding of regular majorincident exercises involving both process operatorresponse and firefighter response.


23/3617


2000 OGP

6 Examination and testing fire systems

6.1 Introduction

It is an unfortunate fact that fire systems, because they

make no direct contribution to ongoing production,often tend not to get tested as frequently as they should.Consequently, failures may go undetected for sometime. Commissioning of systems to demonstrate thatthey meet their performance requirements when ini-tially installed, and subsequent routine testing to checkthat they meet it on an ongoing basis, are essential,especially when the system is intended as a risk manage-ment measure for personnel safety.

Therefore a programme must be developed to carry outthese tests, detailing the test procedures, the schedulesand a record keeping system.

The test procedures should be based on ensuring thatthe critical performance criteria are met, and the sched-ules based on ensuring that any system problems willbe identified within a reasonable time. Thus the proce-dures and schedules should reflect consideration of thereliability of system components and the levels of riskreduction that the system is designed to provide (i.e. alife safety critical system may require a more rigoroustesting regime than a similar system designed purely for

asset protection.) Any system testing should be relevantto the role of the system and either a direct measure ofthe functional performance standard or a measurementof a parameter which will demonstrate that the func-tional performance can be achieved.

If no other information is available, initial schedulesmay be based on manufacturers recommendations andcodes of practice such as the NFPA document Fire Pro-tection Systems - Inspection, Testing and MaintenanceManual.

6.2 Direct system testing

Clearly, it is not normally practicable to carry out actualfire tests on site or to simulate exact fire conditions thatmay be experienced for the identified hazards. The typeof system and the design parameters should be con-firmed by cross correlations to previous experience orresearch and development fire testing.

Direct system testing is the testing of the complete

system including, where applicable, discharge of extin-guishing agent. For example, with detection systemsthe hot wire test described earlier would be considereda direct system test in a computing or control room

because it simulates the condition that the system inits entirety is designed to detect. Testing of individualsmoke detector heads using an aerosol spray would not

be direct testing, because aerosols do not reproduceactual smoke particle characteristics, and the methodonly tests an individual component and, possibly, thecontrol panel, but not the ability of the entire system toachieve its performance criteria.

Direct testing of the complete system must be carriedout at commissioning and at regular intervals if combi-nations of indirect tests are not sufficient to guaranteethat the performance criteria continue to be met. Therelative infrequency of direct tests may mean that theexpertise required to carry it out and interpret it prop-erly are not developed in-house.

In general, insufficient direct testing is carried out atfacilities. There are many cases where direct testing ofsystems such as foam systems is not carried out on theexcuse that clean up is a problem or the discharge causescorrosion or operational upsets. If such issues are genu-inely a problem they should be addressed in perform-ance criteria and the system design modified or systemcomponents chosen to minimise the problem. A sched-ule for direct testing should be developed during detail

design.

6.3 Indirect system testing

Indirect system testing is the regular component test-ing that helps to demonstrate that the overall system isstill likely to perform as designed. For example, simu-lating detector inputs into a control panel can be usedto demonstrate that the panel will actuate the relevantalarms and executive actions. As much of the completesystem should be tested as possible. For example, adeluge system fitted with a full flow test line should betested by actuation of the relevant detectors, thus testingdetectors, control logic, firewater pump start, ringmainintegrity, pump capacity and deluge valve operation.With careful thought going into individual componenttesting and ensuring that all components are subjectedto the testing regime, it may be possible to demonstratesystem availability meets the relevant performance crite-ria with relatively large intervals between direct testingexercises. However, it is unlikely to do away completely

with the need for direct testing.


24/3618


2000 OGP

6.4 Interpretation of results

The results of a direct test can, in theory, be relatively

easily compared with performance criteria if sufficientthought has been put into the criteria and they includerealistic quantified minimum performance data. If thesystem does not meet the criteria during the test, thenremedial action is required. However, direct testing mayrequire special skills or test equipment not normallyavailable to in-house maintenance personnel. In theevent that the system does not perform as required, thenspecialist expertise will probably be required to identifythe cause of the problem. This is particularly true in thecase of foam systems where any one of several faults can

produce the same apparent foam quality failure, and agreater depth of interpretation may be required to iden-tify the key problem.

The results of indirect testing require more analysisbecause they only demonstrate whether or not discreteparts of the system are functioning correctly. In fact, atesting regime that relies to a large extent on indirectsystem testing tends to demand a more rigorous andcumbersome record keeping system because the numberof tests required to give adequate reassurance of overallsystem capability is greater.

Note: - The long term testing of passive fire protection isparticularly difficult and manufacturers should be con-sulted to determine the parameters and indicators of systemdeterioration.

6.5 Impact on maintenance regime

Indirect testing is often the type of testing that is rou-tinely carried out by a maintenance regime which canfollow prescriptive procedures without having to have afull understanding of the systems performance criteria.For example, the functional aspects of a control panelcan be tested under an instrumentation maintenanceregime. Direct tests require a greater understanding ofthe performance criteria of the system and thereforespecialist fire system knowledge is normally required.This, therefore, means that the competency of thosepersons carrying out the test work has to be appropriateand relevant.

A common solution to this issue is the use of an in-house maintenance department to carry out routineindirect tests, but the use of fire system specialists tocarry out and interpret the less frequent direct tests.The direct tests therefore become as much a specialist

inspection as a maintenance matter. If competent exter-nal specialists are used then this also results in an inde-pendent audit trail of system performance as required

by legislation in some countries.

If this approach is used it is still important that acommon, integrated test regime is developed and imple-mented. The most important element is that the peopletesting the system should be competent, understandthe system, have, if necessary, specialist or vendor train-ing and certification, and they must understand therole and importance of the system in hazard manage-ment. They should also understand the interface withother systems, such as shutdown. In many systems thiswill require an understanding of both mechanical andinstrumentation aspects of system operation.

6.6 Exercises

As part of the integrated approach to system operation,the system testing of personnel response aspects shouldnot be forgotten. To assess these it is normally necessaryto develop and implement a programme of regular exer-cises simulating personnel response as well as system

response to an incident.

This integrated approach needs clear identification ofsystem ownership so that all aspects of system function-ality assessment can be co-ordinated, and any lessonslearnt or faults identified during tests and/or exercisescarried through to audited remedial action.


25/3619


2000 OGP

7 Record keeping

As it is quite possible, as described in Section 6, thatmore than one department is involved in the testingand maintenance of fire systems, it is important to

ensure that record keeping is co-ordinated by the systemownerand that personnel with full understanding ofthe system performance criteria review it on a regularbasis and assess ongoing system capability.

7.1 Performance trends

For performance criteria it is often the case that a singlevalue for a certain requirement is set at design stage.

In fact, for operational purposes, a range of acceptablevalues should be set as described in Section 4.3 so thattest results can be quickly accepted or rejected. Settingof the acceptable range normally requires input fromsystem specialists having the ability to assess the effecton overall system performance of the change in value ofparticular parameters.

Performance trends can then be analysed and remedialaction taken prior to the system performance movingoutside of an acceptable range. In some cases it mayonly be possible to set the acceptable range of param-

eter values after initial commissioning and a set of basevalues have been measured. For example, with foamsystems, the initial performance specification wouldinclude acceptable values for expansion and drainagetime. During commissioning and acceptance trials theseparameters would be measured. New tolerances couldthen be set, recognising tolerances in the base valueswhich do not affect the overall system performance toan unacceptable level.

Any future test results falling within the tolerance rangewould then be acceptable but this does not mean to saythat any drifts within the tolerable range should not beanalysed in order to see if there is a trend that could leadto early failure.


26/3620


2000 OGP

Appendix 1Guidance on system inspection/testing procedures,

schedules and record keeping

a case historyThe most appropriate method of demonstrating theprinciples of Fire Systems Integrity Assurance is todescribe, in a summary form, an example of the processthat was carried out in practice.

A major international oil company operating in theUK sector of the North Sea recognised that the pro-cedures to assess ongoing performance of its helideckfoam system were not adequate to demonstrate that thesystems would perform as required. It should be remem-

bered that the legislative regime involved demands risksto be ALARP and that an auditable track of the per-formance of safety critical systems is apparent. Helideckfoam systems are seen as critical systems for life safety.Also, ICAO have a set of performance based standardswhich are generally considered to be the most appropri-ate available for this type of facility.

The production of a new platform gave the opportunityfor the operator to develop improved performance cri-teria and integrity assurance procedures.

It must be recognised that the following example is onefor a particular situation considered to be a very criti-cal one. The example is given for guidance on principlesonly, not as a prescriptive recommendation for all foamsystems or even, indeed, all helideck foam systems.

Risk assessment and selection of fire systems

Figure 2 summarises the procedure. The initial stepsincluding review of potential scenarios and selection offire systems were relatively straightforward as it is gen-erally recognised from experience that the use of foam

monitors by competent personnel is the most practica-ble method of providing appropriate risk reduction.


The critical performance criteria for such a system areconsidered to be: -

Foam concentrate quality

Time to full operation

Application rate of foam solution

Produced foam quality

Area covered by foam application

Duration of system discharge

Appropriate values for these criteria have been estab-lished by ICAO and published in their series of codes ofpractice. As the operator considered that ICAO codes ofpractice were applicable to this situation and were basedon sound specialist knowledge, they were adopted asthe basis for the performance specifications.

Develop component specifications

It was recognised that in order to meet the critical per-

formance criteria in a reliable and practicable way therewas a need to provide detailed foam concentrate andhardware specifications including, in the case of theconcentrate, the basis of a testing regime.

Foam concentrate is one of the most critical componentsof a foam system. To ensure that it is fit for purpose andcontinues to be so, it is necessary to specify a relevantfire test standard and physical property checks that canbe used as indirect testing parameters on site.

The performance specifications addressed the following

issues: - Application for which concentrate was intended

Fuel types involved

Facility environmental conditions

Legislative regime

Containers to be used for delivery

Container to be used for long term storage on site

Type of proportioning system to be used

Fire Test standard to be used (CAP 168 Level B asdefined in ICAO documentation) (and witnessedindependently)

Physical property tests required

The supplier was required to provide the following:-

Physical property test results and tolerance

Physical property test methods

Fire test results

Proportioning rate correction factor (to allow indi-

rect testing with water of the proportioning accu-racy on a regular basis)


27/3621


2000 OGP

Figure 2 Fire System Inte grity A ssuran ce exam ple: helideck foam system

Process Result/solution

Review potential fireincidents as part of Risk

Assessment

Liquid spill fires with potential loss of life if not rapidlycontrolled

Define role required of firesystems in risk reduction

Rapid control of fire to allow safe evacuation or rescueof personnel

Select appropriate systemtypes

Foam monitors operated by trained, competentpersonnel


Relevant ICAO standards used as a basis for systemperformance in terms of time to operation, application

rate and coverage

Develop componentspecifications

ICAO standards used for performance of foamconcentrate. System operational experience used for

hardware specifications

Develop test, inspectionand maintenance


Direct and indirect testing programme developedincorporating ICAO guidance and system specific

procedures

Implement test, inspectionand maintenance


Training in system testing provided w ith guidance on

perfomance trend acceptability. Specialist testprogramme developed including concentrate

properties comparison against retained samples


28/3622


2000 OGP

For information, the physical property tests included:-

Specific gravity

pH

Viscosity at 20C and -15C (the operating temper-ature range of the facility)

Refractive index

Film formation speed

Surface tension

Interfacial tension

Spreading coefficient

Sediment content

Some parameters were directly relevant to performanceothers indicative of changes occurring in the concen-trate which could affect performance.

Similar levels of detail were specified for the hardwareaspects of the system.

Develop test, inspection and maintenanceprogramme

The acceptance of the foam concentrate included pro-

vision of some test data, the most important of whichwas the performance based fire test. This was carriedthrough to a routine test programme as described later.

Performance based commissioning tests were carriedout as follows:-

Time to full operation

Flow rate achieved

Foam coverage under different wind conditions

Foam quality and proportioning rate accuracy

System run time

The opportunity was also taken to take measurementsof other parameters which could be used as indirect testparameters allowing performance to be assessed on anongoing basis without the need for foam discharge onevery occasion.

These included:-

Pressure at monitor outlet

Proportioning rate calibration factor

Implement test, inspection and maintenanceprocedures

The programme developed for routine inspectionincluded both direct and indirect testing.

The indirect testing included: -

Daily movement of monitors and valves to checkease of operations

Testing of concentrate physical properties and com-parison against original values and tolerances on aquarterly basis

Testing of proportioning accuracy on a weekly basisusing water only and the calibration factor derived

during commissioning

Weekly confirmation of pressures achieved at mon-itors and time to achieve them

5 yearly fire test of foam concentrate

The direct system testing included:-

Annual full system test, independently witnessedby specialists, to assess the critical performance cri-teria using actual discharge of foam

It was considered that this programme, coupled withdaily visual equipment checks, represented a cost effec-tive and environmentally acceptable method of ensur-ing the safety critical system met its critical performancecriteria on a continuing basis. It is emphasised thatthis testing schedule was developed specifically for thesystem in hand. In this particular case, the foam con-centrate proportioning system had been chosen to pro-vide inherent reliability (such as no moving parts) andso annual testing was considered sufficient. Other typesof system may require more rigorous testing schedulesto meet availability/reliability requirements.

Full written test procedures were prepared along withguidance on acceptable/ unacceptable results. A docu-mentation package was developed specifically for recordkeeping, as in this particular case it was consideredthat the inspection and testing would be carried outby system users rather than a maintenance depart-ment, with the maintenance department only becom-ing involved if repairs or modifications were required tothe system following unacceptable test results.


29/3623


2000 OGP

Personnel competency standards

As well as system hardware performance criteria, com-

petency standards were developed for two personnelinvolved in two aspects of the system: -

(i) System use

The competency requirements included system specificoperation as well as helicopter incident fire fightingtechniques.

(ii) Testing/maintenance

Competency profiles were developed for the personnelcarrying out the routine on-site foam concentrate androutine system tests. In practice, the testsprocedureswere very straightforward and the system operatorswere also tasked with carrying out the tests.

The annual system test witnessed by an external special-ist was also used as an opportunity for the specialist toreview the system test results and re-assess competencylevels of personnel carrying out the test and operatingthe systems. Regular refresher training was required inhelicopter incident response techniques at specialisedfirefighting schools.

Commercial issues

While, at first sight, the performance specification proc-ess, the testing regime and the training requirementsmay appear onerous and therefore expensive, in realitythe overall FSIA process resulted in an auditable trackto clearly demonstrate ongoing compliance with regula-tory requirements for safety critical systems. This facili-tated rapid certification of the installation. The detailedperformance based specification also assured reliabilityand lower maintenance costs.

Another interesting aspect of the whole programme of

testing was the requirement for samples of the originalfoam concentrate to be retained by both manufacturerand facility with permanent labelling showing the phys-ical property values and acceptable drifts. Part of thecommercial requirements included as part of the per-formance specifications was a long term (20 year) guar-antee. The retained samples were for use in the eventof unacceptable changes in the physical properties ofthe concentrate. They would be used to help assesswhether the deterioration was caused by contaminationor misuse at the facility, or if it was caused by general

degradation of the product, which would be the respon-sibility of the supplier.

The well-documented and thorough FSIA processclearly demonstrated the potential commercial value ofsuch a process as well as its contribution to risk reduc-tion.


30/3624


2000 OGP

Appendix 2Cost benefit analysis equations

A risk reduction opt ion is cost b ene ficial if:

{(Cwithout

without

)-(Cwith

with

)} Prcontrol

> cost of implementation

where:

Cwithout = expected cost of incident w ithout opt ion in place

Cwith

= expected cost of incident w ith opt ion in place

without

= expected statistical frequency of the initiating event if opt ion is not implemented

with

= expected statistical frequency of the initiating event if opt ion is implemented

Prcontrol

= probability that opt ion w ill perform as required

Incident cost elements may include:

life safety

environmental damage

asset value

downtime

public image

legislative repercussions

insurance repercussions

A simplified equation for a mitigation measure is as follows:

A fire hazard management measure is cost effective if:

(Cwithout

- Cwith

) Fi P

c > C

fhm

where:

Cwithout

= cost of incident w ithout measure

Cwith

= cost of incident

firesystemintegretyassurance.pdf

Documents