“The pendulum of the mind alternates between sense and nonsense, not between right and wrong.” — Carl Jung
I’ve been taught, and have taught others, that you can’t take credit for a fire suppression system in a Layer of Protection Analysis (LOPA). Why not? Because a fire suppression system doesn’t kick in until a fire is already underway, and a safeguard can only be recognized as an independent layer of protection (IPL) if it prevents the incident when it works as designed.
Fire suppression systems don’t prevent fires, so they are not IPLs, which means there can be no credit for them in LOPAs.
Something about that logic never made sense, and I’ve learned over the years that if something doesn’t make sense, it’s because it’s nonsense.
Preventing Incidents
Experts all agree—to the extent that a group of experts are able to agree on anything—that the rules of LOPA do apply to scenarios where a fire is not the incident of concern, but the cause of the incident of concern. If the fire can be extinguished before the incident occurs, then fire suppression is, in fact, a preventative measure.
The most obvious example of this is the scenario where an external fire around a vessel or tank causes the vapor pressure of the contained liquid to exceed the burst pressure, so the vessel ruptures catastrophically. That is, it explodes. This is generally known as the “blocked in and external fire case” and is specifically mentioned in the American Petroleum Institute’s standards: API 521 for pressure vessels (≥ 15 psig) and API 2000 for atmospheric and low-pressure vessels (< 15 psig).
The fire is not the incident; the explosion is the incident. And fire suppression prevents it.
Another example is the scenario where the external fire causes a reaction or decomposition in the vessel that produces gases, which in turn increases the pressure. Again, fire suppression prevents the reaction or decomposition.
Commonly, the first IPL that a team chooses will be appropriately sized pressure relief devices. However, fire suppression is another preventative measure for which there might be credit.
How Much Credit?
Many organizations simply do not allow credit for fire suppression systems. When organizations allow credit, it is typically one order of magnitude for aqueous systems, which include foam systems as well as sprinkler systems. This is consistent with research done by the National Fire Protection Association (NFPA).
In a recent study, the NFPA determined that sprinkler systems operated in 92% of the fires large enough to activate them, and when activated, sprinkler systems successfully suppressed the fire 97% of the time. Overall, then, the sprinkler systems are only ineffective in fires large enough to activate them about 10% of the time.
In the case of a fire large enough to cause an incident like a vessel explosion, it is reasonable to expect an aqueous fire suppression system to reduce the likelihood by one order of magnitude.
What about non-aqueous systems? These include dry chemical fire suppression systems, carbon dioxide systems, and Halon systems (which, since the ban of Halons because of their ozone-depleting attributes, use substitutes like HFC-227ea, a hydrofluorocarbon, and FK-5-1-12, a fluoroketone). Because of their highly-engineered design and more rigorous maintenance, these systems are more effective than aqueous fire suppression systems, but are also used in much smaller applications. When they are used, however, it is reasonable to reduce the likelihood of the resulting incident by two orders of magnitude, i.e., 0.01.
Reducing Consequences
It is the nature of LOPA to consider measures that reduce likelihood. In other words, to consider preventative measures. But risk is the product of likelihood and anticipated consequences. When considering likelihood, we consider the incident caused by the fire—the vessel explosion, the decomposition reaction—and take credit for fire suppression reducing the frequency at which such events occur. When the incident is the fire itself, however, fire suppression does not reduce the likelihood. But does it reduce the consequences—the impact severity—of the fire?
Because risk assessment is about estimating the frequency of events and then anticipating the consequences of those events, there is necessarily a fair amount of speculation involved in risk assessments. In order to minimize the variability of that speculation from one risk assessment team to another, many organizations will stipulate in their risk assessment policies and procedures the consequences of certain types of events. For instance, it is common for risk assessment policies and procedures to stipulate fatalities as the impact severity for personnel within the blast radius of a catastrophic vessel failure, a pressure vessel explosion.
Some organizations also stipulate the impact severity of a process fire. Again, risk assessment policies and procedures typically stipulate a fatality as the impact severity for personnel within the fire zone.
The data, however, shows that fire suppression systems reduce consequences. The same NFPA study showed that the fatality rate in facilities with an automatic extinguishing system (AES) is 90% lower than it is in facilities without an AES. The injury rate is also less, but not by an order of magnitude.
For both facility personnel and first responders, the study showed around a one-third reduction in injury rates—a half order of magnitude reduction. A meaningful reduction, but not enough to credit in an order-of-magnitude risk assessment like LOPA.
Consequence reduction as the result of an AES is not limited to safety and health impacts, however. Fire suppression also reduces the amount of property damage. The NFPA study indicates that property damage from fires in facilities with an AES is 55% less than the property damage from fires in facilities without an AES. More than the half-order of magnitude reduction observed for injury rates, but still not enough to credit in an order-of-magnitude risk assessment like LOPA.
Take Credit for Your Fire Suppression Systems
If fire suppression systems did not reduce risk, there would not be much use in installing them. But they do reduce risk. For scenarios where the incident of concern is caused by an external fire, a fire suppression system reduces the likelihood that the event will develop into an incident of concern. For incidents like the “blocked in and external fire case”, the amount of credit to take for a properly designed aqueous fire suppression system is one level, i.e., 0.1.
For incidents that occur in small system protected by non-aqueous fire suppression systems, like an external-fire triggered decomposition in a pilot plant, the amount of credit to take for the non-aqueous fire suppression system can be as much as two levels, i.e., 0.01.
Even in risk assessments where the fire itself is the incident of concern, there is credit to be taken for fire suppression systems. No, the fire suppression system will not reduce the likelihood of the fire, but it will reduce the impact severity. If the stipulated consequence severity is a fatality, a fire suppression system will reduce that by an order of magnitude.
When you have gone to all the trouble of installing and maintaining a fire suppression system, take credit for it. To do otherwise is nonsense.
