On the Use of Risk Concepts in Fire Safety Engineering

Design for fire safety may be carried out by two generic approaches – a set of prescriptive rules or by a performance-based approach where analytical tools are used to verify fire safety towards a set of functional requirements and performance criteria given by the building code. Normally, these two methods are mixed when design fire safety within a building. The option to apply fire safety engineering to the design of buildings has been available during the last 20 to 40 years, depending on which aspect of fire safety being considered. Still, the fire protection of a building too often relies on general recommendations rather than scientifically-based solutions, due to a lack of standardised verification methods, acceptance criteria and procedures to ensure high quality fire safety design. The concept of risk, i.e. the combination of the probability of a fire and a quantified measure of its consequence, has been thoroughly investigated in several fire safety engineering applications over the last decades. Although there are techniques available that allow designers to evaluate fire risks, risk acceptance criteria are missing in general. Structural fire safety design is the exemption having defined target reliabilities. Although these criteria only address the likelihood of collapse of structural element and not explicitly the characteristics of the failure. Structural elements can be provided with fire resistance to control the spread of fire or to prevent structural collapse, or both and it is not uncommon to perform trade-offs between passive and active fire protection systems. But, very little effort has previously been made to understand the fundamental differences between these systems regarding their reliability and failure modes. Performance-based design of structural elements uses a heat exposure model to quantify the thermal load of the fire. The thermal load is characterised by the fire load (duration) and the intensity (air supply). Characteristic values of the fire load are found in various sources and commonly given in the building code, which ought to be used when designing for fire safety. A probabilistic approach was introduced in the 1980s where the probability of fire is expressed as a function of the probability of fire occurrence, the probability of a flashover and the probability of failure given a fully developed fire. Thus, the target probability of failure could be achieved by applying safety measures that alters the probability of any of these events. Currently, fire sprinklers do allow for a reduction in design fire load, but not other active safety system can be considered explicitly. Passive as well as active system for fire safety could both be considered as appropriate provisions to achieve sufficient safety. Even though there are support of trade-offs between passive and active provisions, current regulations, guidance as well as practise do not treat the different aspect of risk related to these systems. By only considering the probability of collapse, the design could deviate from overall societal requirements on avoiding catastrophes or principles of robustness stating that consequences should not be disproportionate to their cause. Traditionally, passive systems are assumed more robust. These findings are probably related to the concepts where target reliabilities are evaluated as the system is designed. Sprinklers are, on the other hand, assigned a probability of successful operation based on decades of statistics. This is an unfair comparison between the systems as a properly design sprinkler system always would prevent a fully developed fire, thus requiring no specific fire resistance on separating and structural elements. Naturally, this is not the path forward as the failure modes of both types of system must be treated and understood. Active systems could be argued to be more forgiven as the they do not care what mistakes are made to cause a fire, neither do they care if occupants act as planed or not. Passive systems are more sensitive to building use when e.g. doors are kept open. Future performance criteria and risk acceptance criteria should not focus solely on probabilities. Emphasis must be put on establish criteria that measure the risk of the unwanted event considering type of initiating event, number of barriers, expected consequence, possibility of damage control, etc. Not until such criteria are available the full potential of performance-based fire safety design cannot be utilised.

Structural elements can be provided with fire resistance to control the spread of fire or to prevent structural collapse, or both and it is not uncommon to perform trade-offs between passive and active fire protection systems. But, very little effort has previously been made to understand the fundamental differences between these systems regarding their reliability and failure modes. Performance-based design of structural elements uses a heat exposure model to quantify the thermal load of the fire. The thermal load is characterised by the fire load (duration) and the intensity (air supply). Characteristic values of the fire load are found in various sources and commonly given in the building code, which ought to be used when designing for fire safety. A probabilistic approach was introduced in the 1980s where the probability of fire is expressed as a function of the probability of fire occurrence, the probability of a flashover and the probability of failure given a fully developed fire. Thus, the target probability of failure could be achieved by applying safety measures that alters the probability of any of these events. Currently, fire sprinklers do allow for a reduction in design fire load, but not other active safety system can be considered explicitly.
Passive as well as active system for fire safety could both be considered as appropriate provisions to achieve sufficient safety. Even though there are support of trade-offs between passive and active provisions, current regulations, guidance as well as practise do not treat the different aspect of risk related to these systems. By only considering the probability of collapse, the design could deviate from overall societal requirements on avoiding catastrophes or principles of robustness stating that consequences should not be disproportionate to their cause.
Traditionally, passive systems are assumed more robust. These findings are probably related to the concepts where target reliabilities are evaluated as the system is designed. Sprinklers are, on the other hand, assigned a probability of successful operation based on decades of statistics. This is an unfair comparison between the systems as a properly design sprinkler system always would prevent a fully developed fire, thus requiring no specific fire resistance on separating and structural elements. Naturally, this is not the path forward as the failure modes of both types of system must be treated and understood. Active systems could be argued to be more forgiven as the they do not care what mistakes are made to cause a fire, neither do they care if occupants act as planed or not. Passive systems are more sensitive to building use when e.g. doors are kept open.
Future performance criteria and risk acceptance criteria should not focus solely on probabilities. Emphasis must be put on establish criteria that measure the risk of the unwanted event considering type of initiating event,

INTRODUCTION
Design for fire safety may be carried out by two generic approaches. The designer could follow a set of simple prescriptive rules, which are defined as general recommendations in building codes. Or, the designer chooses to employ a performance-based approach. Normally, these two approaches are mixed within the building where code compliant deemed-to-satisfy solutions are combined with unique solutions verified towards the functional requirements and performance criteria given by the authorities having jurisdiction (AHJ). The option to use a performance-based approach were introduced to structural fire safety in the 1970s and for fire safety in general some twenty years later. However, the current performance-based fire safety design process has been under scrutiny over the last few years. Still, both designers and AHJs, put too much emphasis on the prescriptive design concepts rather than fundamentally managing and understanding fire risk. Alvarez et.al. [1] identifies several challenges with the design process, fundamentally that generic guidance is applied to specific projects and that levels of performance are compared between an engineering solution and one based on prescriptive requirements. The latter is also identified, by a recent Nordic initiative [2], as one of the major implications why performance-based fire safety design have not been overly successful. The fire protection of a building too often relies on general recommendations rather than scientifically-based solutions due to a lack of standardised verification methods, acceptance criteria and procedures to ensure high quality fire safety design. Frameworks for a future risk-informed fire protection design process has been proposed [3], [4]. Both concepts put emphasis on introducing well-defined performance criteria.
During the last 25 years, the concept of risk, i.e. the combination of the probability of a fire and a quantified measure of its consequence, has been thoroughly investigated in several fire safety engineering applications [5]. Although there are techniques available that allow designers to evaluate fire risks, risk acceptance criteria are still lacking. The designer is forced to compare risk levels with prescriptive design solutions even if such are not applicable to the specific case. Absolute fire risk criteria would allow for a more transparent design process that strives towards an acceptable safety level and that does not give any favours to either a prescriptive nor a performance-based solution. Currently such criteria are non-existent, exempt for structural safety where a set of target probabilities are established in the Eurocode [6]. However, these criteria mainly address the likelihood of collapse of structural element and not explicitly the characteristics of the failure in terms of pre-warning, consequence, partial failure, etc.
Structural elements and compartmentation can be provided with fire resistance to control the spread of fire or to prevent structural collapse, or both. This paper will address the concepts of risk in fire safety engineering with a focus on requirements on fire resistance. One of the top-level fire safety objectives in a building code is that the building should be provided with fire resistance for a certain time. This time is not precisely defined and could be the time required for occupants to escape and the fire service to intervene, or the full duration of a fire [7]. The requirements on fire resistance for most public buildings are related to withstand a complete burnout. However, it is not uncommon to perform trade-offs between passive and active fire protection systems. Active systems such as fire sprinklers will control the fire development and reduce the likelihood of a fully developed fire. This reduction will normally allow for lower requirements on fire resistance. The idea is to balance the two systems achieving the same safety level as if the active system wouldn't be present. Although, there are fundamental differences between passive and active provisions and their characteristic failure modes that need to be addressed. Without an understanding of these inherent features, it is hard to accomplish a properly balanced fire safety design solution. The objective of this paper is to increase the awareness risk regarding fire engineering applications related to fire resistance. The aim is to allow for a more balanced use of active and passive provisions to prevent fire spread and structural collapse. The paper has been prepared with financial support by Brandforsk, the Swedish Fire Research Board.

Actions on structures related to fire
The guidance on designing structures to achieve proper fire resistance is extensive and there are three different methods that could used to verify that fire resistance exceeds fire severity [7]. Verification could be carried out the time domain, the temperature domain or the strength domain. The time domain refers to a prescriptive approach where an element is subjected to a standardised test and either pass it or fails. Elements are provided with ratings, e.g. R 60, EI 30, etc. depending on the outcome of the performance in the test. This prescriptive approach is not regarded as fire safety engineering and will not be discussed any further. In the 1970s a new set of methods were developed which allowed for an analytical approach to the design of structural fire safety [8]. Thermal exposure could now be quantified based on the conditions of a fully developed fire determined by the combustion characteristics of the fire load, the ventilation of the fire compartment and the thermal properties of the enclosing structures. Later, so called parametric fire curves where derived based on these principles and included in the Eurocode [9]. These methods to express temperature within a fire compartment is referred to as the temperature domain. An element is considered to have a sufficient capacity if the temperature within the element or on the non-exposed side of a fire separating structure is less than the temperature that could cause failure, i.e. collapse or fire spread. The temperature domain is suitable to use for structures with an insulating or containing function and not for structural elements as it does evaluate structural performance in an adequate way [7]. Structural elements are preferably evaluated within the strength domain where the reduced load-bearing capacity of the heated element is compared with the applied load at the time of the fire. However, there is a strong link between the temperature domain and the strength domain as the outcome of the heat exposure estimated within the temperature domain is delivered as input to the assessment of sufficient load-bearing capacity in the strength domain. Heat exposure is primarily dominated by the available fire load (duration) and the air supply (intensity). Characteristic values on the fire load are given in the Eurocode [9] for diverse groups of occupancies such as dwellings, hospitals, hotels, offices and shopping centres and the design fire load is derived by multiplying a partial factor with the characteristic fire load. Normally, the partial factor is 1.0, i.e. the design fire load is equal to the characteristic value. A higher value of the partial factor would result in less likelihood that the actual fire load exceeds the design value. For tall buildings, a partial coefficient of 1.5 is used in Sweden to control risk as such buildings are considered to have a potential for a more catastrophic outcome in case of failure.

Probabilistic design approach
The CIB W14 undertook pioneering work on probabilistic design in the 1980s [10] and their definition of the probability that a fire-exposed structure fail is given in Eq. 1: Thus, for a structure to fail due to fire, first a fire is required, secondly the fire must become fully developed and finally, failure must occur. An acceptable value on the probability of failure could be met by reducing the probability that a fire occurs, by reducing the probability that a flashover occurs once a fire has started or by reducing the probability of a structural failure in the case of a fully developed fire. Proposed safety levels i.e. target probabilities only implicit consider the consequences of a collapse [6]. Structural elements are assigned different target probabilities related to their importance regarding maintaining structural stability and the severity of a collapse, i.e. the potential consequence is managed by the magnitude of the target reliability. No target probabilities are given for other fire safety objectives than maintenance of structural stability.
Traditionally, structural fire safety design has been primarily concerned with the design of structures exposed to fully developed fires. Although codes allow for some possibilities to apply measures that prevent fires from becoming fully developed as the presence of fire sprinkler can lead to less thermal exposure to the structure and motivate a less severe design fire load. This idea of trade-offs between passive and active fire safety provisions were introduced in the 1970s [11]. The arguments behind such trade-offs are essential statistical where the active fire safety measure reduced the likelihood of a severe fire and thus can the structures could be design for less heat exposure. The Natural Fire Safety Concept [13] took this a step further and introduced a procedure of modifying the characteristic fire load based on compartment size, building type and the different active fire safety measures such as smoke alarm, sprinklers, rescue service, etc. The concept is included in Eurocode [9], but it is not allowed in all EU member countries due uncertainties of its implications. However, a reduction of the design fire load with a partial factor of app. 0.6 when sprinklers are present is well recognised.

Implications with current design practice
A comprehensive review of current design practice states that criticism has been raised regarding the heat exposure model being too unrepresentative of real fire conditions and the design practice being consequenceorientated rather than risk-informed [13]. Heat exposure is strongly dependent on the fire load. However, most fire load data are 40-50 years old and it is necessary to address the relevance of this data in relation to the fire loads today, given the increasing use of combustible materials in furnishing and construction. Fuel type and opening configuration also have a major influence on the temperature-time relationship in the fire compartment and large deviations between the parametric fire curve and full-scale tests have been observed [14], [15], [16].
Risk is mainly controlled by applying different partial factors to the characteristic fire load. However, current practice in Sweden offers two safety levels both related to heat exposure. Either the design fire load equals the characteristic value, or the characteristic value is increased by 50% for buildings taller than 4 stories. However, fire sprinklers are considered to sufficiently cover for the additional risk that an increased building height result in. Design fire load in a tall building with sprinklers has the same value as the design fire load in a lower, non-  [9]. Risk is also controlled by assigning different target values for the probability of failure based on the importance of the structural element. Although, the target value is the same for most buildings. A reference value of the maximum individual risk is app. 10 -6 per year [6]. Note that the target reliability is related to the system as designed, i.e. not built. Failure due to human error or ignorance and failures due to non-structural causes are not covered. Such failures are supposed to be covered by design review and other quality assurance procedures. Controlling risk only by changing the design fire load is strictly a probability-based approach that does not consider other aspects of risk than the likelihood of collapse. Neither the magnitude of the consequence nor when failure occurs is considered, which is insufficient in common practise of risk control [17].

RELIABILITY OF PROVISIONS FOR PREVENTING FIRE SPREAD AND COLLAPSE
The reliability of an active system, e.g. fire sprinklers is considered explicitly in the current design approach. Passive systems are, however, always assume to perform as intended. E.g., neither any ageing effects of sprayed passive protection nor the variability in performance of a board system are considered. Furthermore, doors are assumed to be closed and dampers to shut. The probability that a passive system operates as intended is assumed to be 100%, which of course is not true. Thus, there is an inherent imbalance within the system when performing trade-offs that favours passive provisions in front of active that needs to be addressed in future methodology development.
Passive provisions have other failure modes than active provisions in terms of how failure occurs. E.g. delayed or partial failure is more likely than complete failure of the barrier. Even if a building element cannot withstand the design thermal exposure and fail prior its design requirements are met, there is a likelihood that the capacity will be sufficient due to the variability in fire load. If a structural element is protected by other means than overdimensioning, e.g. by spray-on systems, paint or by boards, there is increased uncertainty that the system will protect the structure with sufficient reliability. Intumescent paint is being exposed to ageing effects with a significant decrease in thermal resistance during the first service years [18]. Intumescent coating also performs differently depending on fire development [19]. The standardised test will produce results on the safe side for slower fires, but unsafe results for more rapid fires. Gypsum boards used to protect both structural and separating elements are also subject to uncertainty in terms of performance. E.g. loss of attachment due to heat exposure is hard to predict in general terms and need to be specified by the manufacturers [20].
Active provisions for fire safety, e.g. sprinklers show great record in minimising fire damage. Literature state a reliability of the system from a minimum of 70% to a maximum of 99.5% with most likely values in the range of 90% to 95% [21]. The U.S. experience with sprinklers states that flame damage was confined to the room of origin in 96% of fire when sprinklers were present, compared to 71% of fire without sprinklers [22]. Thus, sprinkler systems do account for a statistical proven reduction in the probability of a severe fire that could be used when balancing active and passive safety provisions. From a design point of view, a passive system would fail to operate if it does not withstand the pre-determined fire exposure. But, the performance might still be sufficient for escape and rescue service intervention. Hence, the failure might only be partial. This is not unique to passive systems as both fire sprinklers and smoke management system could fail partially having reduced performance compared to their design criteria. But, the performance still might be sufficient to control the fire and limit the upper layer temperature. Although, sprinkler systems are more likely to have complete failure as the dominant cause for sprinklers fail to operate is the water supply being shut off [22].

BALANCING FIRE RISK WITH PASSIVE AND ACTIVE PROVISIONS
Passive as well as active provisions for fire safety are both considered to be appropriate techniques to achieve sufficient safety, supported by the approach outlined in the Fire Safety Concepts Tree [24] where the two fire safety objectives on the top level are to prevent fire ignition and to manage fire impact. The fire impact could be managed by either managing the fire (e.g. with active system) or managing the exposed (e.g. with passive systems). The sprinkler system reduces the probability of a fully developed fire and this increase in safety opens for an optimisation of other measures, such as reduced capacity of structural and separating elements. By applying Eq. 1, one realises that the probability of failure given a fully developed fire could be increased with the same factor as the probability of flashover given fire is decreased. However, this approach does not consider the consequence of a failure any other way than that a failure occurs. From a societal point of view, it is of interest to extend Eq.1 with additional variables describing the effect of the failure. Such variables could be the probability that failure occur prior to successful escape or the probability that occupants and rescue service personnel will be notified on the upcoming failure in due time. The sensitivity of the design solution to common error could also be considered. Normally, active provisions are subject to more frequent inspections than passive provisions. Less effort is taken to ensure that self-closing doors are not blocked and that services passing through compartment walls or floors are adequately fire-stopped. One other aspect that Eq. 1 not explicitly consider is the number of barriers in place to prevent an initiating event from progressing to an unwanted event, e.g. failure of a structural element. Fig. 1. illustrates two safety system. The first safety system has one barrier with a probability of failure of 0.001. The second safety system has three independent barriers each having a probability of failure of 0.1. The second safety system thus has the same total probability of failure as the first (i.e. 0.1 3 = 0.001). But, could the performance of the two safety systems in Fig. 1 be considered equal? If measuring only the probability of failure, the answer is yes. A failure of 0.001 with one barrier is equal to the failure of three barriers having the same combined probability of failure. But if evaluating e.g. the time until failure, the result could differ a lot. If the barrier in the single barrier system is of on/off type, then it either operates with 100% effectiveness or it does not operate at all. Compare such a barrier to the multiple barrier safety system, where failure does not occur until all three barriers have failed. Such a system has a failure time that most likely is longer than what the single barrier system would have. From this point of view, these systems are not equal, despite having the same probability of failure. The possibility to reduce ratings on load-bearing structures in sprinklered buildings is a question like the one discussed above. In a building without fire sprinklers, the load-bearing structure will keep its capacity for the complete fire duration with a certain probability. When the capacity of the element is reduced in a sprinklered building there will be two different scenarios. When the sprinkler system operates effectively will have infinite load-bearing capacity as there is no heat exposure. But, when the sprinkler system fails the load-bearing capacity will be more sensitive to the actual fire load. Currently, there is no straightforward answer on how to decide on the required capacity in case of sprinkler failure.

CONCLUSIONS
Passive as well as active system for fire safety should both be considered as appropriate provisions to achieve sufficient safety. Even though there are support of trade-offs between passive and active provisions, current regulations and guidance as well as practise do not treat the different aspect of risk related to these systems. By only considering the probability of collapse, the design could deviate from overall societal requirements on avoiding catastrophes or principles of robustness stating that consequences should not be disproportionate to their cause.
Traditionally, passive systems are assumed more robust. These findings are probably related to the concepts where target reliabilities are evaluated as the system is designed. Sprinklers are, on the other hand, assigned a probability of successful operation based on decades of statistics. This is an unfair comparison between the systems as a properly design sprinkler system always would prevent a fully developed fire, thus requiring no specific fire resistance on separating and structural elements. Naturally, this is not the path forward as the failure modes of both types of system must be treated and understood. Active systems could be argued to be more forgiving as the they do not care what mistakes are made to cause a fire, neither do they care if occupants act as planed or not. Passive systems are more sensitive to building use when e.g. doors are kept open.
Future performance criteria and risk acceptance criteria should not focus solely on probabilities. Emphasis must be put on establishing criteria that measure the risk of the unwanted event considering type of initiating event, number of barriers, expected consequence, possibility of damage control, etc. The full potential of performancebased fire safety design cannot be utilised until such criteria are available.