Risk calculation and fire safety.

How do we evaluate the (fire) risks that threaten us?

A risk can be defined as the unwanted occurrence with damaging results. It can be characterised by the probability of occurrence and the severity of the consequences.

The probability can also be subdivided into two factors:

• The frequency of occurrence of the undesirable fact, such as the start of a fire in a building
• The duration of exposure to the effects of this fact (how long do we stay in the building?)

The severity can also be divided into two factors:

• the seriousness of the consequences ( nuisances, small injuries, major damage, death)
• the number of possible victims ( one person, a group, everybody)

People accept risks even with deadly consequences if the combination of probability and severity is low enough. For this reason, risk calculation expresses often this acceptable risk level as a number that combines a frequency rate with a severity degree. One can also visualise risk in a profile with two axes: one to measure the probability or frequency, the other to indicate the level of the consequences. However, there is no fixed boundary between acceptable and unacceptable risks.

Sometimes people are obliged to accept a risk because they do not have the means to protect themselves or because they consider these risks as inherent to life. In this way, people accept in some countries floods or earthquakes as part of their living conditions.

One tends to reduce the probability of occurrence when the consequences are more severe, when more people are exposed to the risk at the same time, and when the duration of exposure is lengthy.
A risk is considered less acceptable when the consequences are readily visible.

A risk is more easily accepted when the consequences are reversible, of short duration or repairable, when there is a visible benefit in taking the risk, and when one thinks to have control of the causes of the undesirable event.

When all these elements are taken into account one can perfectly explain why a lot of people prefer travelling in their own car above flying, even when the air travel is cheaper: A serious car accident will eventually give 5 deaths, a aeroplane crash will cause a hundred of victims; during a car trip, the danger is only perceived for short moments, but one will fear for the crash during the whole flight. In our car, we think that we have control of the situation as we choose the course of our trip. In such a situation, an air voyage must be much safer than a car trip to give us the same perception of safety.

An unknown or hidden risk will be less acceptable. In this way, we have more fear of a fire during the night than during daytime, although the probability is much higher when we do all kind of things, then when we are at rest.

There are plenty of statistics available to indicate us what level of frequency and severity of accidents are existing and what are the socially accepted levels of safety. The probabilistic approach of risk is widely used in the chemical and nuclear industry and for work accidents, but is almost unknown in approach of safety of buildings.

The existing safety or acceptable fire risk level.

As there are very few people that are worried about the existing fire risk in our society and as there is no public discussion on unacceptable situations in this field, one can suppose that the present level of fire safety complies with the expectations of our citizens: We consider that the available level of fire safety in our (West- European) society is acceptable.

So, what level of safety do we have reached?

Usually the basic acceptable level of risk is defined in a situation of permanent exposure, i.e. that the danger and the risk are always together. Such a risk will be accepted when the probability of an accident with one death is less than 1 per million of persons per year, or 1.10^-6 / person*year.

Some studies and evaluation methods indicate that the acceptance of risk is reduced by the square of the number of possible victims: for 3 deaths, the acceptability is 10 x less, for 10 victims, it is 100 x less, and for a 100 deaths, it is 10.000 x less. This explains easily the much higher safety requirements imposed on nuclear industry and aviation, and makes it understandable why our safety rules are less stringent for low buildings compared to high rise buildings, that are less easily evacuated. For an accident with serious but reversible consequences (people injured), the acceptance level is about 1 per 10.000 persons per year, or 100.10^-6/ person* year.

If there is a direct benefit in taking the risk, the acceptance is at least 10 x higher. This explains e.g. the existing tolerance for road accidents, for Belgium almost 1000 deaths per year in 2002-2008 (= 100.10^-6 /person*year).

If the exposure is not permanent, the risk will be more easily accepted. Such is the case for the fire risk: In most European countries, the number of deaths by fire is per million habitants per year. This level of 5 * 10^-6 deaths per person* year is 5 times higher than the basic level of permanent exposure but 40x lower than the road traffic risk.

For the risk of damage to our homes, we can make the following calculation: Of the average of 13.000 fires per year in Belgium, about 10.000 are residential fires. With an average surface area of homes is 160 m², and 400 million m² total habitable area of Belgian homes, the probability of a residential fire in Belgium is 25. 10^-6 / year.m². This numbers is also valid in various other European countries. With an average of 4 persons per house, the probability of a person threatened by a home fire is = 1 /1000 per person per year. With 5 victims per million inhabitants, this means that the probability that one cannot escape from a residential fire is about 0.5 % of the incidents.

In Bern, Switzerland, the property insurance is mandatory with the Canton insurance, which collaborates tightly with the fire brigades. Because of this particular situation, detailed statistics are available. These indicate that in 40 % of the cases the fire is already extinguished before the arrival of the fire brigade, for 90 % the fire is limited to the room of origin and only in 8 % there is a developed fire (flash-over), which is still controlled by the fire brigade in 2/3 of the cases. We can estimates that the situation is not significantly different In Belgium, and therefore conclude that the accepted level of property damage (total destruction of a house of 160 m²) is about 40 10^-6 /year. This level is equivalent to 40 % of what is usually accepted for a risk with heavy but repairable consequences (= 100. 10^-6). This higher level of requirements can be explained by the direct nuisance caused by a residential fire.

In summary, we can conclude that we are using the following levels of safety for our houses:

• the probability of death shall be less than 5.10^-6/person.year

• the probability of total destruction shall be less than 40. 10^-6 /year

The levels of acceptable risk are not identical for the people and for the property, which is easily explained as the impact is different.

More usual safety levels.

As indicated in the previous observations it is possible to deduct additional safety levels for other fire scenarios, using a distinct reasoning for the safety of property and people. One can imagine that the required level of safety is higher for an apartment building due to the presence of more people. In the same manner, the reduced mobility and awareness of people in a school or a hospital will increase the required safety level, as a fire could result in more victims. A scenario with 10 victims is perfectly imaginable; reducing the acceptable risk by a factor is 100.

The risk level must also be much lower when the users of the building have no control on the danger such as in buildings accessible to the general public, but, on the contrary, it can be higher if the fire risk is largely linked to the presence of the users, such as in offices and factories. The risk of fire in buildings without people in it is directly linked to the importance it has for its user and to the exposure to adjacent buildings.

The authorities shall take care of the interest of the neighbourhood: No one should suffer damage from a fire on other premises. They shall formulate their requirements in such a way that propagation of fire is prevented, that there are no victims to be expected with the users or the fire services, and that no irreversible damage shall be done to the environment.

The authorities will in the first place try to guarantee safe exit of the fire zone to all users. When there is no threat to the neighbours, or when is also no compelling need for the fire brigade to extinguish a fire, the authorities can in practice accept that occasionally a building is completely destroyed by fire.

If there is no direct threat for the neighbourhood, because of safety distances and fire walls, but there is a necessity for the fire brigade to stay for a short time inside the building, e.g. for checking an evacuation, the mandatory requirements will have to guarantee the safety of the firemen during that operation.

But when there is a direct threat for the neighbours, such as in an urban zone, or when the fire brigade has to operate for a longer time inside a building, to organise rescue operations or to control an environmentally dangerous fire, the level of safety required will be very close to what is expected for single family homes.

The owner or user of a building can agree with the safety requirements of the authorities or choose a higher safety level to cover better his own wishes to maintain and protect his property and/or (business) activities.

One can imagine that the expression of the required safety levels, based on the probability of occurrence, the degree of exposure to the risk and the magnitude of the potential consequences, will be a significant step forward on the way to performance based requirements.

There is however, a major problem with statistics, which are in some way incomplete, and prone to different interpretations. Some countries will group residential buildings and offices in one category, other will have them separated. Some consider storage and manufacturing as a single activity, while others make the distinction. The source of information will colour the data: Fire brigades count the number of calls and victims, insurance the number of cases they will have to pay for, excluding the minor incidents.

It is a logical to guess that the probability of a fire will be higher in industry than in residential buildings, because of the higher fire loads and the higher number of ignition sources available in industry. Yet, the number of calls to the fire brigade per m² de area is lower in industry, and on the other hand there are as much calls for storage as for homes, even if the number of ignition sources in storage is very low. One possible explanation is that in industry a large number of small fires is controlled by own means, without calling the fire brigade, while in storage the threat of a large fire is such that nobody hesitates to call in the public service.

It is therefore not easy to define an absolute and reliable risk level based on statistics alone, but is it is much easier to define a relative safety level, comparing any given situation with the residential risk which is well known and accepted.

The acceptable risk level for a residential fire is based on a fire scenario that happens in a house of incombustible construction in an urban zone:

The probability of a fire is low. At the start, the fire will develop slowly and can be rapidly be detected and signalled to the fire brigade. The public service can attack the fire before flashover has occurred and they can limit the damage to the room of origin in 90 % of the fires. The occupants have a 99.5 % chance to escape from the fire by their own means or to be rescued by the fire brigade.

This scenario does not consider any provision for preventive or protective measures, but does not consider either aggravating circumstances, such as access difficulties, etc.

The required safety level in other conditions can then be defined by applying correction factors that take into account:

• the relation between frequency and severity
• the subjective perception of risk
• the available degree of protection

Risk evaluation methods

Checklists are not well suited for risk quantification. Just think of a workplace which complies with 18 of 20 fire safety items, but fails to comply with the code requirements for the electrical installation and for the use of flammable liquids: The 18/20 score does not mean a "good risk". Some British checklists are therefore complemented by weighing factors to obtain some kind of risk classification in a point system, with or without a benchmark for satisfactory performance.

The FiRE- tECH WG6 report describes ranking methods as follows:

An advantage of fire ranking methods is their simplicity, they are considered as very cost effective tools. Another advantage of this method is the structured way in which the decision making is treated. This facilitates understanding of the system for persons not involved in the development process and makes it easier to implement new knowledge and technology into the system.

Ranking systems have their disadvantages too. They are usually linked to a specific type of occupancy, so that they can only be used for a limited group of buildings. If they are linked to national code requirements, they will not be applicable for similar risks in other countries.

I wish to draw attention to an ethical issue connected to this type of code linked systems like the NFPA 101A Fire Safety Evaluation System. This method uses a different (lower) benchmark for existing and for new buildings. This is based on the legal situation that backward application of new standards is not accepted. But, should the fire protection engineer design for less if he has the tools to design for equivalent levels of safety in new buildings and existing buildings?

Some ranking systems, e.g. the weighing and grading system proposed by FiRE-tECH WG8, enter the stakeholders' appreciation in the calculation, which may result in a recommendation they want to receive, different from what they ought to hear from a professional adviser.

The WG6 report had the FRAME and Gretener methods classified as point systems, but this does not justice to these methods. Point and ranking systems combine the weighed parameters in a SUM, where FRAME (and Gretener) combine weighed factors in a PRODUCT, which puts them in the category of probability based quantification methods.

Probability based methods start from the observation that unwanted vents like fire have a variety of outcomes. Most methods are not specifically developed for fire risks and need some kind of interpretation to be used for fire risk assessments. The existing methods can be classified as two-dimensional or three-dimensional evaluation of risks.

Two-dimensional methods were developed by the nuclear, chemical and aviation industry where the hazard exposure is continuous or exists over long periods. They express the risk as a combination of a probability of occurrence or frequency and a magnitude of the consequent loss or severity.

Three-dimensional methods use Exposure, Probability and Severity for risk quantification. This type of risk evaluation is practised in those areas where the exposure to the hazard is not continuous, such as workplace risks, machinery defects, and fire.

Both types often use a product or a sum of products of the risk dimensions to obtain a single risk value, which can then be used in comparisons between protection alternatives of in relation with a benchmark value.

The "American school" of fire protection engineers uses mostly two-dimensional risk quantification schemes, based on the technique described in NFPA 551, Guide for the Evaluation of Fire Risk Assessments.

A simple two-dimensional method is the risk profile, a graphical method where different levels of probability and severity are given on a x/y graph. This method is usually based on U.S. MIL-STD-1629A, "Procedures for performing a Failure Mode, Effects and Criticality Analysis" which indicates severity levels from Minor to Catastrophic, and probability levels from Frequent to Extremely Unlikely.

Each identified risk will be shown by a point on the risk profile. On that graph profile, three distinct zones can be defined: The green zone shows the acceptable risks with a low value for the product severity * probability, the red zone the unacceptable risks and the yellow zone those risks that give concern for corrective action.

An other two-dimensional risk assessment method is the ETA or event tree analysis.

The outcome of a hazardous event often depends on more than one condition. This can be visualised and explained with event networks or event trees, which show the cause, effect and interaction between various events.

An event tree is a graphical logic model that identifies and quantifies possible outcomes following an initiating event. The tree structure is organized on a time scale. Probabilities can be calculated from the tree, and consequences are typically assigned to the end states but may cumulate along the tree.

In an ETA, the analyst has full control of input and output, which means that any ETA needs an external check by an equally expert person or organisation as the analyst. Solving fire risk problems with ETA techniques do require professional skills in fire modelling and risk analysis. If this skill is not available in the organisation, external assistance is appropriate.

The Canadian FiRECAM™ (Fire Risk Evaluation and Cost Assessment Model) is a computer program that makes a combination of fire modelling and ETA. To undertake the evaluation of life risks and fire costs, FiRECAM simulates for six design fires the ignition of a fire in various locations in a building, the development of the fire, smoke and fire spread, occupant response and evacuation, and fire department response. These calculations are performed by nine sub-models interacting with each other in a loop.

The outcome of the FiRECAM calculation is an Expected Risk to Life (ERL) of the occupants, defined as the expected number of deaths over the design life of a building, divided by the population of the building and the design life of the building.

For the property risk FiRECAM uses a Fire Cost Expectation (FCE) defined as the expected total fire cost which is the sum of capital costs of the passive and active fire protection systems , Maintenance cost of the active fire protection systems and expected losses as a result of all probable fire spread in the building , divided by the cost of the building and its contents.

The FiRECAM program includes a visual representation of the building and graphical reports, but gives no clear answer to the basic question: "is it good enough?" It is limited The fact that the program is based on Canadian data, including response time for fire services and building costs, is appreciated in Canada, but is a major drawback for its use outside the Canadian market.

For property damage assessments, the probability and severity combination is preferred by the stakeholders, as they will need to compare the investment costs for protection with the expected cost of risk during the useful life of the building.

For life safety, a combination of severity and exposure is more often used in the risk assessments which are presented to the AHJ for the approval of a design which is not made according to the prescriptive fire codes. For these risk assessments, fire growth and evacuation modelling software is often combined.

The fire protection community has spent a lot of efforts in the development of such software. The international survey of computer models made in 2002 by Olenick and Carpenter mentioned almost 50 zone models, 18 fields models and some 20 egress models, but only a few risk assessment models.

Methods based on a combined evaluation of exposure, probability and severity offer a better approach for fire, which is a non-continuous hazard and basically a rare but unwanted event. This approach fits better to the intuitive way of making fire risk assessments and to the reasoning underneath code requirements.

One of the oldest and widespread methods for workplace risk assessment was developed back in 1976 by Kinney, Wiruth e.a. and is widely used for the analysis of workplace hazards. The approach is known as the Kinney or ESP method.

A similar approach can be found in the standards for the safety of machinery, such as EN-ISO 14121-1:2007 and the older EN 1050 and EN 954-1 standards.

Kinney uses 3 non linear numerical scales for severity, probability and exposure. The proposed values for each factor are situated on a non-linear (semi-logarithmic) scale, and the calculated risk factor is compared with the following "decision table". The non-linear scale represents the risk aversion phenomenon, i.e. the human attitude to reject high severity / low probability risks more than low severity / high probability risks. A decision table categorizes the identified risks and allows establishing an priority program for risk reduction.

The result can be visualised as a three-dimensional parabolic field; all risks located below this limit being acceptable, those above need correction.

The EN1050 defines the decision process which leads to 5 risk classes, based on the 3 characteristics of the unprotected risk:

The EN 954-1 norm defines five levels of protection (B, 1, 2, 3, 4), related to 5 risk classes, related to 3 characteristics of the unprotected risk:

These requirements are founded on a number of axioms and principles:

• The probability of occurrence of the danger is more or less constant: The majority of the machines is conceived for a certain lifetime and has thus a built-in failure probability.
• The reliability of system elements will be improved by tests, overseeing, and "fail-safe" design.
• One can differentiate the situation when the victim can escape or not from the risk. A fast warning is essential.
• If the protection is reliable, the real occurrence of the accident will be reduced.
• Protections (safety systems) can be made reliable by checks, self-surveillance and redundancies.

An important remark is that protection is only the second defence, prevention is always first.

The duty of preventing risks is a priority. Risks must be reduced at the source and dangerous situations replaced where possible by more safe situations. The application of the general prevention principle means in practice that the residual risk will be found in the lower classes, which require less elaborate protection measures.

Classifying risks and protections in 5 classes and 5 categories is a mere decision tool. In practice, there is a wide variation of possible damage and a large spectrum of available protection systems. The variety of influence factors is so large that a more gradual approach of risks and protections is advisable. It is this detailed evaluation of a large number of factors that makes the FRAME attractive for fire risk assessment.

FRAME is built around a logarithmic scale and the relative weight of the factors complies well with the known acceptance level and failure rates.

E.g. the protection degree D calculated for a "standard " protection with a manual alarm system, an intervention by a professional fire brigade within 10 minutes after the call, and an adequate water supply is D= 2, which means a failure rate of 1/100. This fit with the statistical data for the number of fires in housing that are not controlled by the fire brigade.

A lack of adequate water supplies will give a water supply factor W=0.32, which means a failure rate of 48 %, or in other words, if there is no water available, there is only one chance in 2 that the fire brigade can control the fire with the means of their vehicles.

Risk communication.

The output of a risk assessment has to be communicated to the stakeholders in a way they can reach informed decisions. Ranking systems with a benchmark, like NFPA 101A FSES, are therefore much appreciated by the inexperienced observer.

The outcome of an ETA can also be presented in a risk profile or matrix. The fire risks located in the lower left corner (green area) are below the average frequency / severity and are considered acceptable, where those in the upper right corner (red area) are certainly unacceptably high.

The weakness of such a risk matrix is that extremely severe incidents with a very low frequency can remain unnoticed, as they are located nearly on the x-axis of the diagram. The ETA itself will not yield any decisions. The stakeholders will have to decide on the extent of the green and red zones on the distribution diagram, or select a benchmark to define an acceptable risk. The national fire death rate can e.g. be the proposed reference.

Probability and severity combinations, like 5.10-6 deaths / million hours are understandable by scientists but mean very little for decision makers, unless compared with some benchmark, e.g. national averages. A loss potential calculation in thousands of Euros or dollars will not ring a bell for an insurance broker, but a correspondingly high fire insurance premium rate will do.

Some models like FiRECAM include a fire cost estimate; This looks interesting but is debatable. The cost of fire protection measures will vary considerable whether applied for new projects or for renovation or upgrades of existing buildings. Material and labour costs vary also from one region to another, and variations in inflation, finance and insurance costs will further increase the variance fork of the estimates. The result of the assessment becomes very sensitive to the input data used.

The cost estimate becomes even more complicated when the costs are unevenly distributed among the interested parties. A particular complex situation is e.g. a large warehouse where the owner of the building, the owner(s) of the content and the user of the building are different companies, with competing interests.

A loss potential calculation is therefore more useful. The FRAME benchmark " In a well protected building, the 3 risk valuse shall equal or less than 1" is easily understood by all stakeholders. For those wanting more specific knowledge, the FRAME results can be transformed into a) a fire loss estimate as % of the compartment; b) an insurance premium rate; and c) a relative probability of victims, compared to a residential fire risk. Most managers are happy with this kind of information that is easily understandable and still gives them the freedom of decision making.

Authorities do not like risk assessment results that can twist their arm for an "automatic grant" of a permit or approval of equivalency, so it is almost impossible to obtain a straightforward official approval of FRAME or of any other risk assessment method.