PD 7974-7-2019

PD 7974‑7:2019
BSI Standards Publication
Application of fire safety engineering

principles to the design of buildings –
Part 7: Probabilistic risk assessment

PD 7974‑7:2019 PUBLISHED DOCUMENT
Publishing and copyright information
The BSI copyright notice displayed in this document indicates when the document was last issued.
© The British Standards Institution 2019
Published by BSI Standards Limited 2019
ISBN 978 0 580 98926 1
ICS 13.220.20; 91.040.01
The following BSI references relate to the work on this document:

Committee reference FSH/24
Draft for comment 18/30362215 DC
Amendments/corrigenda issued since publication
Date Text affected
© THE BRITISH STANDARDS INSTITUTION 2019 – ALL RIGHTS RESERVED

PUBLISHED DOCUMENT PD 7974‑7:2019
Contents Page
Foreword ii
1 Scope 1
2 Normative references 1
3 Terms and definitions 1
4 Design approach 3
Figure 1 — Flowchart for demonstrating adequate safety of a design 5
Figure 2 — General flowchart for design assessment using PRA methods 6
Figure 3 — Consolidated flowchart for a design through PRA 8
5 Acceptance criteria 9
Figure 4 — One-dimensional representation of generalized consequence-frequency (FC) 9
Figure 5 — Generalized consequence-frequency (FC) diagram with indication of tolerability limit
and negligible limit 11
Figure 6 — Flowchart to determine the applicable PRA acceptance criteria for demonstrating
adequate safety 12
Figure 7 — FN diagram (cumulative exceedance frequency versus number of casualties) 13
6 Analysis methods 23
Table 1 — Summary of discussed methods and main characteristics 24
Figure 8 — Event tree analysis 26
Figure 9 — Fault tree analysis 26
Figure 10 — Example of typical uncertainty distribution 32
Figure 11 — Example of Tornado Chart Showing Contribution to Variance 33
7 Data collection for PRA 34
Annex A (informative) Acceptance and tolerability criteria 35
Table A.1 — Individual risk limits 35
Table A.2 — Parameters and valuation of benchmark proportionality constant SCCR1life 35
Annex B (informative) indicative probabilities 35
Table B.1 — Sprinkler reliability by occupancy based on USA experience 36
Table B.2 — Sprinkler effectiveness (%) by occupancy based on NZ experience 36
Table B.3 — Overall probability of fire starting in various types of occupancy 36
Table B.4 — Fire growth rate distributions 37
Table B.5 — Fire load energy density for various types of occupancy 37
Table B.6 — System effectiveness 38
Table B.7 — Extent of Damage in USA Fire Incidents, 1989-1994 38
Annex C (informative) Commentary on acceptance criteria 39
Figure C.1 — Acceptability criteria 39
Bibliography 44
Summary of pages
This document comprises a front cover, and inside front cover, pages i to iv, pages 1 to 45, an inside back cover and
a back cover.
© THE BRITISH STANDARDS INSTITUTION 2019 – ALL RIGHTS RESERVED i

Foreword
Publishing information
This Published Document is published by BSI Standards Limited, under licence from The British
Standards Institution, and came into effect on 31 March 2019. It was prepared by Technical
Committee FSH/24, Fire safety engineering. A list of organizations represented on this committee can
be obtained on request to its secretary.
Supersession
This Published Document supersedes PD 7974-7:2003, which is withdrawn.
Relationship with other publications

This Published Document is one of a series of documents published under the Fire Standards Policy
Committee, and is a supporting document to BS 7974, Application of fire safety engineering principles
to the design of buildings — Code of practice.
Other documents in the series are:
PD 7974-1: Initiation and development of fire within the enclosure of origin;
PD 7974-2: Spread of smoke and toxic gases within and beyond the enclosure of origin;
PD 7974-3: Structural response to fire and fire spread beyond the enclosure of origin ;
PD 7974-4: Detection of fire and activation of fire suppression systems;
PD 7974-5: Fire service intervention;
PD 7974-6: Evacuation;
Where appropriate, references to relevant standards are provided in order to assist the reader in
understanding the design methodologies presented and to compare different approaches or
sources of data. It is therefore important that PD 7974‑7 is not used in isolation and reference is
made to the relevant standards, particularly in relation to additional notes and subclauses
describing its application.
Use of this document

As a guide, this Published Document takes the form of guidance and recommendations. It should
not be quoted as if it were a specification or a code of practice and claims of compliance cannot
be made to it.
It has been assumed in the preparation of this Published Document that the execution of its
provisions will be entrusted to appropriately qualified and experienced people, for whose use it has
been produced.
This publication is not to be regarded as a British Standard.
Presentational conventions
The guidance in this Published Document is presented in roman (i.e. upright) type. Any
recommendations are expressed in sentences in which the principal auxiliary verb is “should”.
Commentary, explanation and general informative material is presented in smaller italic type, and does
not constitute a normative element.
Where words have alternative spellings, the preferred spelling of The Shorter Oxford English
Dictionary is used (e.g. “organization” rather than “organisation”).
ii © THE BRITISH STANDARDS INSTITUTION 2019 – ALL RIGHTS RESERVED

Contractual and legal considerations

This publication does not purport to include all the necessary provisions of a contract. Users are
responsible for its correct application.
Compliance with a British Standard cannot confer immunity from legal obligations.
© THE BRITISH STANDARDS INSTITUTION 2019 – ALL RIGHTS RESERVED iii

THIS PAGE DELIBERATELY LEFT BLANK

1 Scope
This Published Document provides guidance on probabilistic risk analysis in support of BS 7974.
It sets out the situations in which a probabilistic risk assessment can add value to traditional
deterministic analyses and outlines acceptance criteria for the assessment. Furthermore, common
analysis techniques of probabilistic risk assessment are summarily discussed.
This Published Document also includes data for probabilistic risk assessment based on fire statistics,
building characteristics and reliability of fire protection systems.
This Published Document does not contain guidance on techniques for hazard identification or
qualitative risk analysis.
2 Normative references
There are no normative references in this document.
3 Terms and definitions

For the purposes of this Published Document, the following terms and definitions apply.
3.1 As Low As Reasonably Practicable (ALARP)

where all reasonable measures are taken in respect of risks to reduce them further until the cost of
further risk reduction is grossly disproportionate to the benefit
3.2 assessment
undertaking of an investigation in order to arrive at a judgement based on evidence
3.3 availability
ability of a system to be in a state to perform a required function under given conditions at a
given instant of time or over a given time interval, assuming that the required external resources
are provided
3.4 conditional probability

probability of an event given the occurrence of a preceding event
3.5 consequences
severity of the outcome of an event
3.6 deterministic
based on physical relationships derived from scientific theories and empirical results that, for a given
set of initial conditions, always produce the same outcome
3.7 event
something happening or that has happened that can be made up of several but mutually
exclusive occurrences
3.8 failure mode

predicted or observed results of a failure cause on a stated item in relation to the operating
conditions at the time of the failure
© THE BRITISH STANDARDS INSTITUTION 2019 – ALL RIGHTS RESERVED 1

3.9 frequency
probability that an event will happen over a period of time
3.10 hazard
situation with a potential for undesirable consequences
3.11 individual risk

frequency at which an individual can be expected to sustain a given level of harm from the realization
of specified hazards
3.12 initiating event

event that leads to other events and one or more outcomes
3.13 maintenance
combination of all technical and administrative actions including supervision actions intended to
retain a product in, or restore it to, a state in which it can perform a required function
3.14 outcome
result of a chain of events
3.15 probabilistic model

methodology to determine statistically the probability and outcome of events
3.16 probability distribution

mathematical function expressing the probability attached to any value of a random variable
3.17 reliability
ability of an item to perform a required function under stated conditions for a stated period of time
3.18 risk
probability of occurrence of a hazard causing harm and the degree of the severity of the harm
3.19 safety
freedom from an unacceptable risk of harm
3.20 scenario
set of circumstances and/or an order of events in a fire incident that are feasible and
reasonably foreseeable
3.21 societal risk

relationship between frequency of occurrence and the number of people in a given population
suffering from a specified level of harm from the realization of specified hazards
3.22 stochastic
uncertain
NOTE the value of a stochastic variable could be analysed statistically but might not be predicted precisely
2 © THE BRITISH STANDARDS INSTITUTION 2019 – ALL RIGHTS RESERVED

4 Design approach
4.1 Objective and use of probabilistic risk assessment or analysis (PRA) in fire
safety engineering
4.1.1 General
The fire safety design aims to satisfy the fire safety objectives derived from the stakeholders’ fire
safety goals.
The acceptability of the design can often be demonstrated using deterministic design methods
described in other published documents. However, there are situations where explicit calculation of
risk by a PRA is necessary to demonstrate acceptability or where it would be of benefit to use a PRA,
e.g. a PRA can be used to rank the performance of design alternatives (whereas, potentially, no safety
preference could be identified through a deterministic analysis), which enables a better-informed
options appraisal.
These aspects are discussed in more detail in 4.1.2 to 4.1.4.
NOTE "Safety" is used as a generic term and applies to all fire safety objectives. An “adequately safe” design has
both an adequately low risk level and a range of possible consequences which are all either considered acceptable or
have negligible probability.
4.1.2 Safety basis of deterministic design methods

Most buildings constructed can be considered common in the context of typical fire safety
engineering design, with the design basis deterministic (i.e. absent of an explicit safety target).
The attainment of adequate safety is assumed to arise from the application of the method and
tools, either through the following of specific guidance, or through the satisfaction of performance
criteria adopted by the designer. Necessarily, the assumption of attainment of adequate safety for
deterministic designs can only be based on one or both of two fundamental “safety foundations”:
a) collective experience of the profession, i.e. continuous application of longstanding design
approaches has not resulted in observations of unacceptable performance in multiple fire events.
In this case, the absence of experiences of not fulfilling fire safety objectives is adopted as a proxy
for meeting fire safety objectives. Achieving adequate safety is through precedent and is assumed
to emerge from “corrective measures” when observed examples of performance are deemed
unacceptable by society; and/or
b) a large level of conservatism, i.e. conservatisms are introduced into one or more of the inputs,
scenarios and/or performance criteria, and the demonstration of performance under such
inputs/ conditions is considered to result in an adequate design. This safety foundation requires
that the physics of the fire and the basis of the performance criteria are understood. Due to the
highly nonlinear behaviour and complexity of many fire phenomena this is not always the case.
Consequently, a design based on a “large level of conservativeness” is considered as a special case
of a design based on the “collective experience of the profession” (i.e. relying upon engineering
judgement, either at an individual or collective level).
NOTE For further information, see Certain Uncertainty – Demonstrating safety in fire engineering and the need
for safety targets [1] and The need for hierarchies of acceptance criteria for probabilistic risk assessments in fire
engineering [2].
Large levels of conservativeness should be quantified or at least specified further.

As no explicit evaluation of the probability of each scenario is made, the actual risk or level of safety
remains unknown.

When multiple design options are being considered (where all options achieve the deterministic
acceptance criteria), no risk-based preference exists. Any preference between the designs is then
solely determined by considering criteria, e.g. ease of maintenance, aesthetics, without understanding
the relative level of risk associated with each option.
4.1.3 Objective and use of PRA
4.1.3.1 General
There are two main objectives for using PRA:
a) to demonstrate adequate safety; and
b) to rank design alternatives with respect to safety performance.
4.1.3.2 Use of PRA to demonstrate adequate safety

In specific cases it might not be possible to assume adequate safety through a deterministic
evaluation. For example, the uniqueness of the proposed design or the use of a new building material
might make it impossible to rely on the experience of the profession, or application of a large level
of conservativeness in the scenario assumptions might impose undue restrictions or cost. In those
situations, PRA can be used to explicitly demonstrate adequate safety, by taking into account the
uncertainties associated with the design and fire scenarios.
It is possible to combine deterministic approaches and PRA in the overall fire safety strategy, i.e.
probabilistic fire risk assessment can be used as part of the analysis of any or all of the sub-systems.
This is clarified further in 4.2.
4.1.3.3 Use of PRA to rank design alternatives

A second (optional) object of PRA is the comparison of design alternatives with respect to their safety
performance and reliability. Whilst a deterministic evaluation could result in two candidate designs
achieving the acceptance criterion, a PRA can enhance the assessment by taking into account the
associated probabilities. In these cases it is possible that two designs with the same deterministic
performance level are found to have a very different reliability; the safety level of the more reliable
design is higher.
In a more extensive PRA the full range of possible consequences of a fire event and their associated
probabilities can be assessed. This gives the stakeholders a much better understanding of the fire
safety performance of the design and could highlight trade-offs between low-probability high-
consequence events and low-consequence higher-probability events.
4.1.4 Note on deterministic — PRA hybrid approaches

PRA can be used to select input data for further deterministic analysis. It is important to emphasize
that the achievement of adequate safety in these cases is, at least partially, founded on the explicit
probability evaluation; therefore all (apparently) hybrid methods should be classified as PRA.
4.2 Steps in a PRA and layout of this published document

4.2.1 General
PRA can be used to demonstrate adequate fire safety of a design with respect to specific or all
identified fire safety design objectives. In this case, PRA fits into the overall design strategy as
indicated in 4.2.2, based on the SFPE Engineering Guide to Performance-Based Fire Protection [3]. The
steps in the specific analysis for the design objective with PRA methods are indicated in 4.2.3.
Where PRA is used to rank the performance of different acceptable design alternatives, the analysis
steps discussed in 4.2.3 directly apply.

4.2.2 Flowchart for demonstrating adequate safety of a design

Figure 1 gives a flowchart illustrating how PRA fits in the design process. The need to apply PRA
follows directly from the observation that either:
a) the acceptability of the proposed trial design cannot be based on the experience of the
profession, or
b) use of a large level of conservativeness results in an undue design.
The designer can choose to use a PRA in situations where the acceptability of the design is sufficiently
demonstrated with deterministic methods. The PRA generates additional information regarding
the performance of the design that could be useful, e.g. ranking of design alternatives, stakeholder
information.
Detailed discussion on the different steps relating to PRA is included in this Published Document.
NOTE See 4.2.4 for the layout of this published document and its relation to the flowchart in Figure 1.
Figure 1 — Flowchart for demonstrating adequate safety of a design
NOTE With reference to the SFPE Engineering Guide to Performance-Based Fire Protection [3].

4.2.3 Flowchart for analysis of trial design using PRA methods

The general sub-steps in the analysis of a trial design with PRA methods, i.e. sub-steps to Step 6B
in the general flowchart of Figure 1, are listed in Figure 2. The specifics depend on the analysis
methodology used.
NOTE The comparison of the calculated risk indicator with the PRA acceptance criteria is part of the larger
design process given in Figure 1.
Figure 2 — General flowchart for design assessment using PRA methods
4.2.4 Layout of this Published Document

Figure 3 applies for a design fully assessed by PRA, and identifies the specific aspects within the
scope of this Published Document.
NOTE 1 A hybrid deterministic and PRA-based design is possible.
Clause 5 provides guidance on acceptance criteria for PRA. The definition of acceptance criteria
is especially important and care should be taken to ensure that the concepts listed in Clause 5 are
critically applied.
Clause 6 provides guidance on the following steps in the PRA analysis:
a) common methods for calculating probabilities, see 6.2;
b) specific aspects regarding consequence modelling, see 6.3;
NOTE 2 6.3 includes the relationship between probabilities and consequences. The models used for the
evaluation of specific consequences are outside the scope of this Published Document.

c) specifics on the quantification of the risk indicator, see 6.4;

d) uncertainty and sensitivity analysis, see 6.5; and
e) special topics, including a discussion on the identification of variables featuring
uncertainty, see 6.5.
Although denoted as special topics, the issues highlighted in 6.5 should be clearly understood by the
engineer applying PRA as they can have significant influence on the acceptance criteria, and on the
PRA modelling.
Clause 7 details special attention for the collection of data, considering its importance for PRA.
Annex A provides acceptance and tolerability criteria.
Annex B provides statistical reference data.
Annex C provides further commentary on the acceptance criteria (see also Clause 5).

Figure 3 — Consolidated flowchart for a design through PRA

5 Acceptance criteria
5.1 General
5.1.1 Introduction and background to the definition of acceptance criteria
Acceptance criteria should be defined for each of the fire safety objectives considered in the PRA
(see Figure 3). The acceptance criteria are set such that the risk is acceptably low and an adequate
safety level is obtained (see Figure 4, which illustrates the principle of risk and different levels of
acceptability).
The acceptance criteria depend on the specific fire safety objectives, and should, in principle, be
defined through a consultation with the stakeholders.
a) The fire safety objectives can relate to purely private considerations, e.g. to limit the downtime
in a production facility after a fire. In these cases the acceptance criteria are freely determined
through discussion with the private stakeholders.
b) Most fire safety objectives relate to societal requirements, e.g. the fire safety objectives of life
safety, environmental protection, heritage protection.
c) The fire safety objective of property protection often has a societal dimension, resulting from
indirect damages, as well as a private consideration.
Figure 4 — One-dimensional representation of generalized consequence-frequency (FC)
NOTE Image courtesy of the Health and Safety Executive [4].
5.1.2 Societal requirements and private decision-making

For a given fire safety objective, private stakeholders are in principle free in their subjective
evaluation and preferred safety investments. Societal requirements impose a lower bound (i.e.
minimum requirement) to the investment level. In all situations the private safety investment is

allowed to exceed the societal requirement, as long as the increased investments do not infringe on
other societal requirements.
5.1.3 Risk perception and societal risk acceptance

Risk perception is fundamentally subjective.
A vision zero strategy, where safety investments are made irrespective of costs and efficiency, is
not tenable as it puts undue strain on limited societal and private resources. Requiring inefficient
safety investments results in a net loss of life when more efficient safety investments are available.
Therefore every building or facility has a residual risk level even after all required fire safety
measures have been implemented.
This residual risk level cannot be expected to satisfy the subjective expectations of all individual
members of society.
NOTE 1 For further information, see Reducing risks, protecting people [5].
The acceptance criteria are defined to provide an adequate safety level for societal acceptance.
NOTE 2 For further information, see Laws of Fear. Beyond the Precautionary Principle [6].
5.1.4 Fundamental basis underlying the definition of acceptance criteria for fire safety
The acceptance criteria aim to maximize societal welfare through a balancing of risks across domains,
whilst acknowledging societal risk preferences. Applied to the fire safety objective of life safety, the
acceptance criteria aim to maximize the number of lives saved across domains, under a constraint of
societal tolerability.
5.2 General framework for the definition of acceptance criteria

5.2.1 Introduction and hierarchy of acceptance criteria
A risk that exceeds the tolerability limit (see Figure 5) cannot be justified irrespective of the
associated benefits. Adequate safety necessarily implies that the risk is not intolerable.
Designs which are tolerable are only acceptable if the risk is “As Low As Reasonably Practicable”
(ALARP), unless the risk is “negligible”.
a) A design is acceptable in accordance with the ALARP criterion when all reasonably practicable
risk reduction measures have been implemented. A risk reduction measure can be considered
not to be reasonably practicable if the factors in terms of time, difficulty of implementation or
other would be grossly disproportionate to the risk reduction (or safety benefit).
When the risk is negligible, no further justification is required.
NOTE 1 The HSE refers to these risks as being “broadly acceptable” [4].
b) Additional measures could be implemented, e.g. by following ALARP principles.

Formally the ALARP requirement still applies, implying that known reasonably practical measures
which are available should be implemented.
NOTE 2 Whilst this might seem anomalous, some approaches can be implicitly assumed to be ALARP (without a
need for an explicit ALARP analysis).
NOTE 3 A flowchart indicating possible acceptance criteria is given in Figure 6. An overview of the acceptance
criteria AC1-AC5 is given in Annex C. Application to the fire safety objective of life safety is given in 5.4.
This clause assumes that the design’s performance with respect to different fire safety objectives can
be assessed for each fire safety objective independently. If stakeholder consultation indicates that
this assumption cannot be maintained, a multi-dimensional assessment is required (although the
concepts in this clause can still be applied).

The necessary parameters, e.g. tolerability limits, absolute (approximate) ALARP thresholds,
are dependent on the fire safety objective and should be determined through discussion with
the stakeholders. For some safety objectives, e.g. environmental emissions, commonly accepted
thresholds might exist. For others, e.g. heritage protection, an elaborate elicitation is required.
Figure 5 — Generalized consequence-frequency (FC) diagram with indication of tolerability limit and negligible limit
NOTE Designs which are situated in the intolerable region cannot be justified irrespective of benefits. Designs
in the ALARP region need to fulfil the ALARP criterion for safety investments. Designs in the negligible region
are readily acceptable.

Figure 6 — Flowchart to determine the applicable PRA acceptance criteria for demonstrating adequate safety
5.2.2 Tolerability limit

The tolerability limit is defined as the combinations of possible consequences and associated
occurrence frequencies which are at the upper limit of possible societal acceptance. A conceptual
visualization is given in Figure 5. A design which exceeds the tolerability limit is in the “intolerable
region” and cannot be justified irrespective of the associated benefits. For the fire safety objective of
life safety, the tolerability limit refers to both a societal tolerability limit and an individual tolerability
limit, see 5.4.2.
The tolerability limit recognizes societal aversion to low-probability, high‑consequence events as well
as high-probability, low-consequence events. The tolerability limit (dependent on application, e.g. see
Figure 7) can also reflect that very high consequences are considered unacceptable irrespective of the
probability; in those situations the tolerability requirement should be interpreted as a requirement
to implement safety measures up to the point where the probability of occurrence of the high-
consequence event is reduced to negligible values.
NOTE In Figure 5, the FC curve shows the more dominant contributors to the total risk, e.g. the expected value
risk indicator, in terms of whether they are high or low frequency or high/low N, or a combination of both. This can
form the basis to review development plan proposals to reduce potential risks.

Figure 7 — FN diagram (cumulative exceedance frequency versus number of casualties)
NOTE Tolerability limit and negligible limit as listed in Guidelines for Developing Quantitative Safety Risk
Criteria [7].
5.2.3 Negligible limit

The negligible (or de minimis) limit is the upper limit of combinations of possible consequences and
associated occurrence frequencies which are considered broadly acceptable.
NOTE See Figure 5 for relationship with the tolerability limit.
As indicated in Figure 6, the negligible limit does not need to be defined in order to demonstrate
adequate safety for the design.
5.2.4 The ALARP criterion
5.2.4.1 General
When a design is tolerable, but incurs a higher risk than readily accepted through the negligible limit,
the design is in the ALARP region indicated in Figure 5. In the ALARP region, safety measures should
be implemented to reduce the risk to ALARP; the design is then considered acceptable.
The traditional formulation of the ALARP criterion states that mitigation measures can be waived
only if there is a gross disproportion between the risk and the costs required to mitigate it.

Thus the ALARP principle recognizes that beyond a certain point risk reduction measures are unduly
costly to implement; this can be mathematically represented by Equation (1):
∆C
≤ D⋅a (1)
− ∆RI
where:
ΔC is the cost of the investigated safety feature;
ΔRI is the associated change (<0) in a scalar risk indicator;
a is the proportionality constant; and
D is the disproportionality factor.
Therefore, only safety investments which satisfy Equation (1) are required for demonstrating
adequate safety.
Considering Equation (1), it is not the risk level which is directly deemed acceptable but the efficiency
of the safety measure. Consequently, the safety measures required as part of the ALARP assessment
depend on the specifics of the building or facility, and the resultant risk level (or “fire safety”)
generally differs between buildings.
5.2.4.2 Aspects of the ALARP criterion
5.2.4.2.1 Cost-benefit analysis (CBA)

The ALARP criterion constitutes a balancing of the costs of safety investments, ΔC, with the obtained
risk reduction benefits, ΔRI.
The costs and benefits of a fire safety measure are incurred stochastically over the lifetime of the
safety measure. To allow for a comparison, cost and benefits need to be discounted to a common
point of reference, annualized or equivalent. Thus, concepts of cost-benefit analysis (CBA), also
known as lifetime cost optimization (LCO), should be used.
For reasons of equity, the need to discount costs and benefits also applies to immaterial effects.
NOTE For further information, see Affordable Safety By Choice: The Life Quality Method [8].
5.2.4.2.2 Societal requirement

The ALARP criterion defines the societal minimum requirement for safety investments,
corresponding with society’s capacity to pay for risk reductions. Investments that exceed society’s
capacity to pay result in a net loss to society. Safety investments should be prioritized based on their
effectiveness. Applied to the fire safety goal of life safety, preferring inefficient safety measures over
efficient ones would result in a net loss of lives. Similar considerations apply to other fire safety goals.
As the ALARP requirement relates to society’s capacity to pay, the costs and benefits need to be
assessed from a societal perspective. This implies that:
a) the CBA is based on direct and indirect costs and benefits of safety measures to society; and
b) costs and benefits are discounted using a societal discount rate. The societal discount rate can be
set equal to the long term growth rate.
NOTE For further information, see ISO 2394. See also, Societal decision-making for optimal fire safety [9].
In most situations the investment cost of the safety measure is borne by a private investor. The
investment cost can be assumed to be transferred to society through indirect pricing effects.
Additional costs borne by the investor for private reasons should not be taken into account, e.g.
increased cost for subjectively more aesthetic sprinkler systems.
As stated, both direct and indirect costs to society should be taken into account. This is in agreement
with statements by the Health and Safety Executive [5], pointing out that the safety investment

should be balanced against the total detriment to society if the hazard were realized. Thus, follow up
consequences of a fire need to be taken into account.
As stated in 5.1.2, the ALARP requirement imposes a lower bound on private safety investments.
Private decision-makers are always allowed to invest beyond the ALARP requirement for private
reasons. When applying CBA methods in the private decision analysis, this implies a freedom in the
private valuation of cost and benefits, and in the applied discount rate.
5.2.4.2.3 Proportionality constant, a

“Costs” and “benefits” are not necessarily monetary and can, amongst others, relate to risk to human
lives, environmental impact, effort, practicability, and heritage value.
The proportionality constant, a, in Equation (1) considers costs and benefits in the application of
the ALARP criterion. Application of the proportionality factor brings all evaluated costs and benefits
to a common reference unit. Commonly, a monetary reference unit is applied, although other units,
e.g. live-years-saved, can be applied as well.
With respect to intangibles, the proportionality constant values the reduction of risk to the intangible
and not the “value” of the intangible itself. Fire safety PRA values the relative costs and benefits of
reductions in risk to intangibles. Risk reduction can be bought through increased investment; the
intangibles themselves cannot be bought.
5.2.4.2.4 Disproportionality factor, D

The disproportionality factor, D, is necessarily ≥ 1. The value of D should be chosen in communication
with the stakeholders. When all direct and indirect costs and benefits of the safety measure have been
considered, D = 1 is recommended.
At all times, a full PRA with a complete assessment of costs and benefits is recommended. A value
of D > 1 to account for neglected effects is not recommended. An explicit assessment of known
and (as far as possible) unknown effects is preferred. This has clear benefits for transparency and
consistency.
A disproportionality constant D > 1 is sometimes justified through reference to risk aversion and
the Precautionary Principle. With respect to societal safety resources, true risk aversion does not
exist and the choice to spend excessive safety resources on one particular risk results in a net
loss to society.
NOTE 1 For further information, see Laws of Fear. Beyond the Precautionary Principle [6].
With respect to the fire safety goal of life safety, this implies that excessive investment in one risk
results in a net loss of lives through underinvestment in other risks.
Similarly, D > 1 is not an appropriate measure to account for the potential of catastrophic
consequences. The potential for catastrophic consequences should be taken into account through the
tolerability requirement, and as part of the consequence bearability assessment in the PRA.
Safety investments below the ALARP investment level can often result in large unnecessary losses,
while minor safety investments beyond ALARP are often benign and result in only small additional
expenditures (one possible example being investment in structural fire resistance for some types of
buildings). This is an important motivation for opting to exceed ALARP safety investments when the
cost of additional investment is low. The reference to costs being disproportionate to the benefits in
the traditional ALARP definition entails a requirement to be conservative.
NOTE 2 See Reducing risks, protecting people [5].
The appropriate level of conservatism should be assessed on a case-by-case basis. An arbitrary

disproportionality factor D > 1 can impose overly onerous requirements in some situations, while
being insufficiently safe in others.

5.2.4.2.5 Equity considerations

Equity considerations should be taken into account to ensure that risks are not disproportionally
borne by vulnerable population groups, regions, or other.
Equity considerations can be interpreted as prohibiting disproportionate concentrations of risk when
subdividing the project, exposed population or other in smaller segments.
In most situations, fire safety measures can be assumed not to introduce inequity.
Applied to the issue of life safety, the requirement of equity finds application in the prohibition of
transferring risk to identifiable persons (see 5.4.4.4). Applied to the evacuation of buildings or
facilities with a large occupancy, this implies that the achievement of tolerability and ALARP cannot
rely on risk of death being concentrated on vulnerable people, e.g. people with reduced mobility.
5.2.4.3 Approximation
An explicit evaluation of the ALARP criterion can be avoided by application of absolute or
comparative acceptance criteria. These alternative acceptance criteria are indicated as AC3 and
AC5 in Figure 6 and should be interpreted as approximations of an explicit ALARP assessment.
As approximations, their application should be conservative and their application thus generally
simplifies the assessment at the penalty of requiring additional safety investments.
NOTE Further details on the different acceptance criteria identified in Figure 6 are given in Annex C.
5.2.5 The defence in depth requirement

As indicated in Figure 6, all acceptance criteria (AC1–AC5) are associated with a defence in depth
requirement.
Defence in depth requires that multiple safety barriers are in place and failure of a single safety
feature does not result in disproportionate consequences. This implies that the performance of the
design should not rely solely on the availability of a single safety feature because:
a) design dependent on the availability of a single safety feature could be more prone to large
consequences; and
b) a design’s acceptance based on a single safety feature is more sensitive to modelling
assumptions.
Care should be taken that the respective safety barriers are not vulnerable to a single common
cause failure.
The PRA assessment should include a synopsis describing the defence in depth strategy. Conversely,
the absence of defence in depth should be explicitly justified. This is especially important where
an explicit tolerability assessment is omitted (AC1) and where the ALARP assessment (AC4) is
approximated by absolute acceptance criteria (AC3) or a comparative assessment (AC5).
5.2.6 Note on application of “safety margins”

Stakeholders might require a safety margin to increase the confidence that the acceptance
criterion is effectively achieved, and to account for, e.g. modelling assumptions and unknown
effects. This is one of the motivations for a disproportion factor D > 1 in the ALARP assessment
[see Equation (1)]. In particular situations, stakeholders could (implicitly) include a safety margin in
the disproportion factor, D.
These safety margins are subjective and have no clear mathematical meaning. It is strongly
recommended to improve modelling and validation to reduce any biases, and include a mathematical
possibility to take into account so far unobserved consequences.
NOTE 1 For further information, see On The Quantitative Definition of Risk [10].

It is emphasized that a subjective safety margin can impose a disproportionate onus in situations
with a well-defined model, while being inadequate in situations where there are large model
uncertainties or assumptions.
The possibility of unknown effects can be reduced by transparency and by eliciting and incorporating
the opinions of interested parties.
NOTE 2 See also Reducing risks, protecting people [5].
As a general rule, transparency is recommended over unjustified safety margins.

When feasible, the use of confidence intervals is preferred over the use of subjective safety margins.
Complementary application is possible.
Different mathematical formulations of the “safety margin” are possible. Here safety margin is used as
a generic term; subjectively imposing an increased requirement or penalty on the safety level of the
proposed design.
5.2.7 Recommendation of “inherently safe design”

Preference should be given to designs which are inherently safe over designs which rely on active
safety features or operational procedures. This relates closely to the requirement of defence in depth
(see 5.2.5).
NOTE See Reducing risks, protecting people [5].
This recommendation is particularly important when the consequences of failure of the engineered
safety feature or operational procedures are high.
In most situations, adequate safety is guaranteed when the design passes the tolerability
requirement; the risk level has been reduced to ALARP, and defence in depth has been considered.
The recommendation of inherently safe design is explicitly stated for clarity and as guidance to the
definition of trial designs.
5.3 Overview of acceptance criteria

For an overview of acceptance criteria, refer to Annex C.
5.4 Application to the fire safety objective of life safety

5.4.1 General
Life safety is the primary fire safety objective.
NOTE 1 To provide a common framework to all stakeholders involved, Figure 5 applies. See Figure 7 for an
application to life safety.
NOTE 2 The guidance in this subclause does not free the designer from the obligation to verify agreement with the
latest guidance documents and legal requirements.
Special emphasis is placed on the issue of risk to identifiable lives, see 5.4.4.4.
Psychological factors are often identified as influencing the acceptability of risk to life. See 5.4.2.1 as
part of the tolerability limit definition.
Current methods often do not provide sufficient information to determine the likelihood of fatality
or number of fatalities. Instead, a measure of the potential for people to be exposed to critical, i.e.
untenable, conditions can be used.
NOTE 3 This is consistent with the approach described in HSE's Land-Use planning guidance in proposing a so
called "dangerous dose" criteria [11].

Consequently, whilst “fatality” is considered as the indicative measure of consequence for life safety,
other surrogate measures can be applied. Application should be discussed with the stakeholders.
NOTE 4 Example surrogate measures have been applied in HSE’s Risk Criteria for Land Use Planning in the Vicinity
of Major Industrial Hazards [11].
Where surrogate measures are applied, a model uncertainty exists; mapping the evaluated measure
to fatalities. It is noted that surrogate measures can be chosen to give a conservative approximation
of risk to life. In those situations, the model uncertainty can be neglected, resulting in a conservative
approximation of the required safety measures. When neglecting this model uncertainty, the
conservativeness should be justified (at least qualitatively). Care should be taken that the surrogate
measure does not result in an unjustified asymmetry effect when comparing different possible
safety measures.
5.4.2 Life safety objective: tolerability limit

COMMENTARY ON 5.4.2
The tolerability limit for the fire safety objective of life safety is related to both an individual tolerability
limit and a societal tolerability limit. Tolerability needs to be assessed with respect to both limits
simultaneously.
5.4.2.1 Psychological factors

Psychological factors are important to the subjective acceptability of risks; this includes, for example,
considerations of the extent to which the risk is voluntary or involuntary.
The framework specified in this Published Document does not intend to reduce the risk to a level
that is subjectively acceptable to all members of society. Acceptance by all members of society can
only be achieved by a vision zero strategy where safety measures are implemented without regard
for costs and efficiency. A vision zero strategy, however, quickly depletes and disproportionately
focuses life‑saving resources and results in a net loss of lives. The framework in this Published
Document intends to provide guidance on determining adequate risk reduction.
Recognizing that subjective aspects of risk acceptance pervade society, both individual and societal
tolerability limits are imposed on every design.
Stakeholders can take subjective preferences into account when defining the tolerability (and
negligible) limits. However, for most designs, the subsequent demonstration of adequate safety
is based on the ALARP principle (see Figure 5; ALARP determined after tolerability has been
established).
The ALARP principle takes into account the efficiency of safety measures, resulting in a maximization
of lives saved across projects. Psychological preferences should be taken into account for the
tolerability assessment, not in the ALARP assessment.
5.4.2.2 Individual tolerability limit

COMMENTARY ON 5.4.2.2
See also Reducing risks, protecting people [5].
Individual risk concerns the risk level borne by an identifiable person or a specific group, e.g.
a named individual, a hypothetical (idealized) person, or a community residing in a particular
geographical location.

Individual risk can be either location-specific or person-specific.

a) Location-specific individual risk is the frequency at which an individual who is permanently
present at the location might be expected to sustain a given level of harm from the realization of
the specified hazards.
This definition implies that regular occupancy patterns, e.g. night-day, workday-weekend, are not
to be taken into account when calculating the individual risk. This improves comparability and
transparency.
b) Person-specific individual risk does take into account the risk level borne by identifiable or
hypothetical humans, taking into account the exposure time to the hazard. For person-specific
individual risk, occupancy patterns can be taken into account.
The applicable definition of individual risk and associated individual tolerability limit are specified in
discussion with the stakeholders. Values depend on the application.
No generally applicable value for the individual tolerability limit is specified by HSE. For the negligible
limit, HSE considers a value of 10-6 as a standard.
Thresholds should be established through stakeholder communication, e.g. for housing
developments, HSE advises against granting planning permission for any significant development
where individual risk of death for a hypothetical person is more than 10-5/year.
For sensitive developments (e.g. schools, hospitals, care homes), HSE applies more
stringent thresholds.
In very specific situations, stakeholders can opt for a less stringent limit, e.g. where the specific
storage facility is only rarely occupied, or with respect to on-site workers who voluntarily expose
themselves to fire risk.
Less stringent limits should be established through stakeholder communication.
NOTE 1 Reference is made to the latest governmental documents for tolerability limits on individual risk.
Information can be found in Risk Criteria for Land Use Planning in the Vicinity of Major Industrial Hazards [11].
ALARP or negligible should be demonstrated for a tolerable design to be considered adequate,

ensuring that for most fire safety designs the risk to life is considerably lower than the tolerability
limit given in Annex A.
Regular occupancy patterns are necessarily taken into account in the ALARP assessments.
NOTE 2 Reference is made to the latest HSE publications for applications from, e.g. land use planning [11].
5.4.2.3 Societal tolerability limit

Societal risk is the relationship between frequency of occurrence and the number of people in a given
population suffering from a specified level of harm from the realization of specified hazards (further
denoted as “casualties”).
The societal tolerability acknowledges that societal limits exist for both the frequency of adverse
events and the size of the associated consequences. Events with a low number of casualties are
generally accepted to occur with a higher frequency than events with a higher number of casualties.
Societal risk and the societal tolerability limit are depicted in Figure 7, with the horizontal axis
showing the severity of the event and the vertical axis showing either the frequency of the event or
the cumulative frequency of exceedance of the event. Both diagrams principally specify the same
information, but care should be taken to correctly interpret both types.
There are currently no widely agreed societal risk criteria in the UK. An indicative point is presented
by HSE which proposes that the risk of an accident causing the death of 50 people or more in a single

event should be regarded as intolerable if the frequency is estimated to be more than one in five
thousand per annum.
NOTE 1 See The tolerability of risk from nuclear power stations, and Reducing risks, protecting people [4], [5].
There is a developing industry framework for Societal Risk criteria summarized in HSE Research
Report, RR703 [12] and a possible approach can be based on the guidelines shown in Figure 7, which
is based on established reference criteria or anchor points and an assumed slope for logarithmic
frequencies and consequences (in this case -1).
NOTE 2 See The UK Approach to Land Planning in the Vicinity of Chemical Major Hazard Installations [13].
The societal tolerability limit specified in Figure 7, together with the negligible limit can be
considered as a benchmark by stakeholders when defining tolerability limits.
NOTE 3 The societal tolerability limit as depicted in Figure 7 is independent of the population at risk.
For building or facility fire safety, the tolerability limit should be considered applicable for the total
of the facility. It relates to subjective societal acceptance for risks associated with a single facility
or building.
For most facilities, the tolerability limit of Figure 7 can be considered as an acceptable benchmark.
For fire safety projects with a limited number of people at risk, the individual tolerability limit might
dominate the societal tolerability limit. For exceptionally large projects, the societal tolerability
limit of Figure 7 might be infeasible. The stakeholders should take into account the specifics of
the project when defining the tolerability limit. If necessary, tolerability limits can be applied to
separate sub‑sections of the building or facility. This is only reasonable in a very limited number of
cases, i.e. when the investigated facility can effectively be split in different zones which from a fire
safety perspective are independent of each other.
Very high consequence events (e.g. N > 1000) can be unbearable to the stakeholders. In that case, the
tolerability limit has a vertical asymptote at N > 1000 (see Figure 7). This should be interpreted as
requiring that events with N > 1000 are reduced to a negligible probability of occurrence. As a matter
of principle, most probabilities cannot be fully reduced to zero.
5.4.3 Life safety objective: negligible limit
5.4.3.1 General
The negligible limit can be determined in discussion with the stakeholders.
Defining the negligible limit is not required. See Annex C for the negligible limit being conceptually
set at uniform negligible probabilities of occurrence when stakeholders refrain from accepting
a negligible limit. In those cases application of AC3, AC4 or AC5 is strongly recommended
(see Figure 6).
5.4.3.2 Individual negligible limit

The individual negligible limit specified in Annex A can be considered as a benchmark for most
buildings or facilities.
5.4.3.3 Societal negligible limit

The societal negligible limit specified in Figure 7 can be considered as a benchmark for most
buildings or facilities.

5.4.4 Life safety objective: ALARP
5.4.4.1 General
Adequate life safety of the design is determined through the ALARP criterion (see Figure 5). When
applying the negligible limit (see AC2 in Figure 6), the explicit ALARP assessment is not required
as the risk is considered negligible. Known efficient safety investments should be implemented
(see 5.2.4).
The ALARP assessment can be done explicitly (see AC4 in Figure 6) or using one of the approximate
acceptance criteria AC1, AC3, AC5 (see Figure 6).
NOTE See Annex C for further guidance.
When applying AC4, the ALARP cost-benefit assessment (CBA) for investments in life safety is
explicit. For other acceptance criteria the same CBA concepts are implicitly applied.
The explicit evaluation of AC4 is the most transparent and is based on the least assumptions (see
Annex C). Application of AC4 is recommended and provides the strongest guarantee to the designer
that their assessment is correct if scrutinized.
5.4.4.2 Proportionality constant, a, for reduction of risk to human lives

Evaluation of equation (1) requires assessing the proportionality constant, a. This constant values
reduction of risk to human lives and should not be interpreted as putting a direct value on human life.
The reduction in risk to life has a value, and as safety resources are limited it is important to spend
these resources in order to maximize the reduction in risk to life. This implies that safety measures
which save more lives at a lower cost are necessarily preferred to safety measures saving fewer lives
at higher costs. The principle stated here applies beyond fire safety engineering and balances safety
investments across fields.
NOTE 1 See, for example, the principle discussions in Affordable Safety By Choice: The Life Quality Method [8].
One internationally accepted method to determine the monetary value of a reduction of risk to
human life is based on the Life Quality Index (LQI), introduced in Affordable Safety By Choice: The
Life Quality Method [8] and subsequently established from economic principles in The derivation and
calibration of the life-quality index (LQI) from economic principles [14]. Based on the LQI, the societal
capacity to pay for risk reduction measures can be evaluated.
NOTE 2 See Life quality index for the estimation of the societal willingness-to-pay for safety [15].
The societal capacity to pay for risk reductions to human lives specifies the proportionality constant,
a, as given in Equation (2), derived from economic social welfare principles.
g
=a SCCR
= CX (2)
q
1life
where:
SCCR1life is the Societal Capacity to Commit Resources for risk reduction saving one
statistical life;
g is the annual gdp per capita;
q is a work-leisure trade-off factor which can be taken equal to 0.18 for the UK;
CX is a demographic constant for a specific mortality regime over the population;
The value of q has been observed to be approximately constant over a long period of time.
NOTE 3 See The derivation and calibration of the life-quality index (LQI) from economic principles [14].

NOTE 4 Further background on Equation (2) and the valuation of CX can be found in ISO 2394; Life quality index
for the estimation of societal willingness-to-pay for safety [15]; and Acceptability of civil engineering decisions
involving human consequences [16].
A proportionality constant, CX, based on a mortality change independent of age (i.e. uniform mortality
change) can be considered as a common benchmark for safety investments in structures.
NOTE 5 See ISO 2394.
This valuation is given in Annex A, Table A.2, with the corresponding valuation of SCCR1life assessed
using 2016 values. Detailed assessments where age-specific mortalities are taken into account
are possible, but for most applications the general proportionality constant of Equation (2) is
sufficiently accurate.
NOTE 6 See ISO 2394.
The proportionality constant in Equation (3) does not take into account subjective aspects. Subjective
issues can be taken into account by the stakeholders when defining tolerability limits for the design.
Once the design is considered tolerable for society, further risk reduction in accordance with ALARP
towards adequate safety are based on a goal of maximizing lives saved across safety investments and
are thus necessarily “risk neutral”, i.e. not penalizing specific risks over others.
Discussions on the precise value of the proportionality constant, a, rarely influence the conclusion
of the assessment, i.e. whether or not a specific safety feature is required for ALARP. Many safety
features are either clearly efficient, or clearly not-efficient. When a specific safety feature is close to
the ALARP cost-benefit threshold, but not required based on the analysis, either the safety feature
should be implemented, or a detailed sensitivity analysis is carried out, investigating the robustness
of the conclusion that the safety feature is not required in accordance with ALARP.
5.4.4.3 Proportionality constant for reduction of non-fatal risk to human lives

Non-fatal injuries should be taken into account in the ALARP assessment. This includes both physical
and psychological injuries.
It is not possible to exhaustively list all possible injuries and their valuation. Proper valuation
constants should be determined in discussion with the stakeholders. It is recommended to value
reduction in non-fatal risks proportional to reductions in fatal risks.
NOTE See Reducing risks, protecting people [5].
5.4.4.4 The issue of identifiable lives

Human life is considered to have immeasurable value and in no circumstances can the lives of
identifiable persons be balanced against a monetary benefit. Situations where identifiable persons
are exposed to a high level of fire-related risk and where only costly risk-reduction measures are
available, are outside the scope of this Published Document. In those situations a direct agreement
between the stakeholders is recommended. This might result in the implementation of fire safety
measures beyond those considered cost-effective in a CBA. Also, alternative compensation measures
(e.g. remuneration) can be considered. These specific cases are, however, outside the scope of this
Published Document.
The issue of identifiable lives generally results in intolerable designs considering the individual
tolerability limit (see 5.4.2.2). The prohibition is explicitly stated for clarity.

5.5 Review and approval of probabilistic design approaches

In order to allow probabilistic studies to be reviewed, the approver or any third-party peer reviewer
should be provided with sufficient information to be able to interrogate the underlying principles and
assumptions. This could include, though would not be limited to:
a) detail regarding the selection of input variables, including the form and basis of any probabilistic
distributions used for these;
b) detail of the probabilistic model utilized; this need not include a copy of the software used,
but sufficient information or citations should be provided to fully check the (implicit) model
assumptions and calculation methodology;
c) a clear statement and appraisal of any simplifications, assumptions or variations introduced
within the probabilistic model; and
d) detail of the acceptance criteria, including an appraisal of how these are intended to demonstrate
meeting the regulatory or client requirements for the project.
6 Analysis methods
6.1 General
This clause provides guidance on methods used to evaluate historical event data, the types of PRA
logic model which could be used to delineate the combination of events leading to undesirable
outcomes, as well as the methods which can be used to quantify the risk factors predicted by such
models. The clause also addresses the evaluation of uncertainty in these predictions which are useful
in understanding the level of confidence under which the design meets the acceptance criteria and
the driving influences on the level of confidence. In cases where uncertainties are not amenable to
statistical characterization and propagation, insights can be gained from simple sensitivity analyses.
6.2 Evaluation of probabilities

6.2.1 General
Different methods for the evaluation of probabilities exist, see 6.2.2 to 6.2.6 for the most common
and basic methods. A distinction is made between probability evaluations with discrete stochastic
variables and those with continuous stochastic variables.
NOTE 1 An overview of the discussed methods and a synopsis of their use is given in Table 1.
Further types of analysis, or variations on the types of analysis described, can be used, as appropriate,
where these can be suitably interpreted and reviewed in accordance with the principles set out in 5.5.
The application of advanced probabilistic methods requires specialized knowledge.
NOTE 2 Multiple methods for evaluating probabilities can be applied together.

Table 1 — Summary of discussed methods and main characteristics
Evaluation method Subclause Characteristics

Statistical analysis 6.2.2 Assessment of basic probabilities using statistical data.
Analytical 6.2.3 For analytical models, probabilities can sometimes be directly
calculated for given stochastic distribution of input variables.
Logic tree analysis 6.2.4 Schematic method to assess probability of an (unlikely) top event
by combining the discrete probabilities of known sub-events.
Monte Carlo 6.2.5 Numerical method to assess probabilities of a model output by
simulations repeated random sampling of the model input space. Can be
computationally expensive.
Other methods 6.2.6 More advanced calculation methods are generally intended to
reduce the computational efforts associated with Monte Carlo
simulations and should be considered as specialized.
6.2.2 Statistical analysis

The analysis of statistics is the basis of most probabilistic fire risk assessment, from the frequency of
ignition to the conditional probability of failure of a fire protection system. Statistical analysis takes
data that has been collected on building fires and transforms it into information that can be used to
predict the likelihood of future events.
Statistical analysis has the advantage that it is based on actual events and the results are, typically,
simple to apply. It is, however, based on historical data that is then averaged, and thus assumes that
future performance can be predicted from past experience and that an average measure can be
applied to a particular building. The designer should take into account whether the use of historical
data is appropriate.
A limitation of statistical analysis is that it is often not possible to collect sufficient data to predict,
with confidence, high consequence low frequency events, such as multiple fatality fires. Statistical
data is much better suited to the prediction of frequent events, such as ignition or the conditional
probability of success or failure of fire precautions. These individual pieces of information can then
be used to attempt to predict the frequency of high consequence low frequency events using more
advanced techniques.
Numerous techniques and tests for analysing data sets are in widespread use, such as determining
mean values and variance, fitting probabilistic distributions and undertaking regression analysis.
Detailed descriptions of these types of analyses are widely available in mathematics, engineering or
economics textbooks.
There is the potential for systematic error in the collection of statistical data. Sources of error
could include:
a) the scope of the data collected (i.e. limited geographies, partial data based on respondents);
b) the methods used for collecting data (i.e. equipment errors, changes in technology or systems
used for collecting data); or
c) human factors and interpretation (i.e. ambiguous terms of reference, accuracy of the data
collected by individuals).
Statistical data should be sourced from authoritative and respected institutions wherever possible.
NOTE A number of data sets which might be useful in the undertaking of fire engineering studies are referenced
in Annex B, B.2.
Where novel or unusual sources of information are required, the quality of the data and any
necessary limitations in the use of this data should be taken into account.

6.2.3 Analytical
In case of discrete stochastic variables describing the likelihood of a scenario, the overall probability
of the event can be directly calculated using methods of calculus.
In case the occurrence of a scenario is defined by an analytical model and the parameters in the
model are continuous stochastic variables, an analytical evaluation of the probability might be
possible in specific cases. For example, if Z = ASET – RSET < 0 defining failure, and both ASET and
RSET are specified by a normal distribution, Z follows a normal distribution and the occurrence
probability can be evaluated directly.
6.2.4 Logic tree analysis
6.2.4.1 General
Logic tree analysis provides a simple method for estimating the probability of occurrence of an
undesirable event (or events), known as an outcome. Such events can include, for example, the fire
reaching flashover stage, spreading beyond the room of origin or smoke causing visual obscuration
to an escape route. In this approach, the sub-events leading to the outcome are identified and placed
in sequential order. The probabilities associated with sub-events are then combined to derive the
probability of occurrence of the outcome of concern. The calculation procedure is facilitated by the
use of logic diagrams or trees that provide a graphical representation of the sequence of sub-events.
Logic tree analysis is often subdivided into event tree analysis, where the scenarios describing
different possible outcomes of a base event, and their associated occurrence probabilities are
assessed by considering the conditional probabilities of more frequent sub-events, and fault tree
analysis, where probability of a specified adverse scenario is evaluated by working backwards from
the final event to the primary causes.
6.2.4.2 Event tree analysis

Event trees work progressively forward from an initiating event (such as ignition) to generate
branches defining events and paths resulting from secondary (or nodal events) to give a range of
possible outcomes. Some of the outcomes can represent very low risk events, whereas others can
represent very high risk events.
The construction of an event tree starts by defining an initiating event leading to the final outcome,
following a series of branches, each denoting a possible outcome of a chain of events. Figure 8
provides a general example of an event tree representing a range of outcomes resulting from
an initiating event via five nodal events. All the significant nodal events should be included. The
probabilities of the nodal events are probabilities conditional on the preceding events. Often the
probabilities of the nodal events are assumed independent of the preceding events. The applicability
of this assumption depends on the specifics of the situation.
Event trees are most useful when there is little data on infrequent outcomes of concern, e.g. multiple
fire deaths. Event trees can be used to predict the frequencies of such events by the logical connection
of a series of much more frequent sub-events for which data are available or for which reasonable
estimates can be made.

Figure 8 — Event tree analysis
6.2.4.3 Fault tree analysis

Fault trees trace the root causes of a given top event of concern by working in a systematic manner in
order to identify basic events. This process is continued until a basic event (or set of basic events) is
identified for which the probabilities can be estimated from statistical data or judgement.
The events in a fault tree are connected by logic gates that show what combination of the constituent
events could cause the particular top event. These are generally AND gates, in which all the
constituent events have to occur, and OR gates, in which only one of the constituent events need to
occur, to cause the occurrence of that event in the fault tree. The probability of occurrence of the top
event is calculated using Boolean algebra. Figure 9 provides a general example of a fault tree.
Figure 9 — Fault tree analysis

The cut-set method is the typical approach in deriving the frequency or probability of scenarios
delineated by such logic models representing simple or complex configurations. The computational
requirements necessary to determine the minimal cut-sets of a network depend mainly on the
complexity of the system. Mature software to perform this type of analysis is readily available.
6.2.5 Monte Carlo simulations

Monte Carlo methods (or Monte Carlo experiments) are a broad class of computational algorithms
which rely on repeated random sampling of a problem having multiple stochastic inputs in order to
generate a distribution of possible results. Monte Carlo methods are especially useful for simulating
systems with many coupled degrees of freedom. They are used to model phenomena with significant
uncertainty in inputs and are well suited for use in many fire engineering applications where a
wide variety of probabilistic elements might combine in numerical models (e.g. fuel load, building
occupancy, wind speed, sprinkler system effectiveness).
A Monte Carlo assessment typically commences with the identification of the critical stochastic
variables within a model or simulation. An appropriate probability distribution is applied to each
variable, and random realizations of all stochastic variables are generated. Each set of randomly
generated input values can then be used within a deterministic model calculation in order to return
a single model realization. In order to evaluate the range and probability distribution of possible
outcomes, the process is repeated.
When considering the various stochastic inputs within a model, the developer might wish to take into
account a number of aspects, such as:
a) the quality of the data informing the input probability distributions;
b) the relative importance of each of the inputs; or
c) whether the inputs might be related by deeper underlying factors.
The distribution of the output from the model could be strongly linked to the influence of relatively
few or single input variables.
The number of trials necessary within a Monte Carlo method is dependent on both the degree of
accuracy required and the sensitivity of the results at the range of interest to the modeller. For
example, interrogating the 99.9% percentile result within a distribution having a long tail would
require a large number of trials, where the results of this study might be strongly influenced by the
result of a small number of trials. The calculation precision of the assessed probability, P, of reaching
a specified threshold is determined by the coefficient of variation, V, given by the equation:
1− P
V= ≤ Vlim (3)
P⋅N
where:
N is the number of random samples (i.e. number of model realizations).
Typically, the final coefficient of variation should be below 0.05. Other precision can be required by
the stakeholders.
For computationally-demanding models which cannot be made sufficiently more efficient through
improved algorithms or computer hardware, conducting a large number of trials might not be
feasible and alternative probabilistic methods should be taken into account.
6.2.6 Other methods

The Monte Carlo experiments can be considered as the most basic form of random sampling.
Alternative sampling schemes exist, e.g. latin hypercube sampling and orthogonal sampling.

These methods have the potential to reduce the number of simulations, but are still based on
repeated sampling.
More advanced approximate methods exist. One of the most important is the first order reliability
method, which is the method of choice for calibrating safety factors for structural engineering design
in Eurocodes. This method makes a linear approximation of the failure surface.
In summary, many methods exist for reducing computational requirements relative to crude Monte
Carlo simulations. Especially for evaluating low probabilities, recourse to more advanced methods
might be required. All methods have advantages and disadvantages, and the user should be aware of
the applicability of the chosen method to the problem at hand.
6.3 Consequence evaluation

Evaluating the consequences of fires and their impact on, e.g. people, property, and the environment,
is an essential aspect of the PRA analysis. The consequences that need to be evaluated (typically
through models) depends upon the fire safety objectives. Where preservation of life is the primary
objective, the consequence evaluation might be limited to assessing the impact of fires on the
wellbeing of those directly or indirectly affected. Other private drivers might exist, such as asset
protection and business continuity, where the consequence evaluation could extend to estimating
damage, the unavailability of an asset, or other relevant implications. The form through which
consequences are expressed depends upon the fire safety objectives. Where life safety is the sole
objective, it might suffice to estimate fatalities for a particular frequency of return of fire event (i.e.
the F-N concept). More typically (and universally relevant), consequences might be expressed in
terms of financial losses, be that through mortality, injuries, damage, loss of income. This means of
measuring consequence is also directly compatible with the ALARP principle [i.e. investments in
safety schemes in demonstration of gross disproportion relative to the realized (fire) safety benefits].
Evaluating consequences in monetary terms requires either a valuation of:
a) a preventable fatality (VPF); or
b) the benefits realized through increasing life expectancy.
The former involves many practical and ethical difficulties.
NOTE 1 See Review of the "value of a prevented fatality" (VPF) used by regulators and others in the UK [17], and
Laws of Fear. Beyond the Precautionary Principle [6].
Thus, the latter has gained traction in the form of the life quality index (LQI), and the corresponding
Society Willing to Pay (SWTP) metric.
NOTE 2 See Affordable Safety By Choice: The Life Quality Method [8], and The derivation and calibration of
the life‑quality index (LQI) from economic principles [14].
6.4 Quantification of fire risk indicator

After the fire PRA analysis model has been developed and probability/frequency data has been
assigned, the model is quantified to obtain the final fire risk results. Risk is a combination of
frequency and consequence.
The method of quantification is dependent upon the analysis technique used, and one or more types
of quantifications could be required. For example, if fault tree analysis is carried out, the probability
of occurrence of the top event is calculated using Boolean logic. If event trees are used, the probability
of each of the sequences is calculated. If a combined fault tree and event tree model is used, both of
these types of quantification methods are used.
Quantification results are usually a probability value which can then be considered against the
defined acceptance criteria (see Clause 5). Care should be taken with respect to aggregating scenarios

(including low-probability, high-consequence scenarios) in a single risk indicator. The tolerability of

the design should be established in accordance with Figure 5.
Depending on the quantification method used, the results can also provide further information. For
example, fault tree analysis quantification produces minimal cut-sets, and can be further examined
to identify the largest contributors to the overall risk. The results can also be organized by, e.g. fire
scenarios, compartments, post-fire human actions.
The results from the fire risk quantification can also feed forward to further analysis such as
sensitivity and confidence interval (or uncertainty) analysis (see Annex C).
6.5 Uncertainty and sensitivity analysis

COMMENTARY ON 6.5
This subclause describes the features of uncertainty and sensitivity analyses as well as the reporting
aspects. “Uncertainty” and “confidence” are alternative means of expressing the same concept. The
uncertainty sources are discussed in 6.5.2 to 6.5.4 to enable the designer to make informed decisions on
the uncertainty sources that might exist, and be relevant for their specific application.
6.5.1 Identification of variables/ factors featuring uncertainty

Undertaking a PRA necessitates the identification of variables, factors featuring uncertainty, and the
assigning of ranges or distributions to those variables, such that the range of possible consequences
can be evaluated alongside their corresponding probability of manifestation.
Sources of uncertainty can generally be grouped into three broad categories:
a) parameter uncertainty;
b) model uncertainty; and
c) completeness uncertainty.
NOTE This subclause does not seek to identify all possible sources of uncertainty requiring evaluation as part of a
PRA in fire safety engineering.
6.5.2 Parameter uncertainty
6.5.2.1 General
Parameter uncertainty relates to the uncertainty in the value of a parameter used in the PRA model,
such as parameters representing initiating event frequencies (ignition frequency, component failure
probabilities, human error probabilities) or parameters representing physical quantities (smoke
yields, heat release rates, fire load density, spread rates).
Uncertainties in parameters can be categorized as either:
a) epistemic uncertainties; or
b) aleatory uncertainties.
Epistemic uncertainty is due to a lack of data, and can be reduced through gathering further data.
Aleatory uncertainty relates to the intrinsic randomness of a phenomenon. Whether a variable
falls into either category depends upon circumstance. For example, in the evaluation of a material
property relating to an existing building, the uncertainty of that property could be said to be
epistemic. That is, the uncertainty could be reduced through the gathering of a greater number
of samples, and evaluating the property. However, if the material property is sought for a future
application, i.e. a building not yet complete, the uncertainty in the material property could be
considered aleatory, i.e. until the building is realized no amount of data can reduce apparent
variability in the property due to factors beyond the engineer’s control that could, in some

way, feature intrinsic randomness, e.g. in the manufacturing process, due to conditions during
construction.
6.5.2.2 Tentative parameter uncertainties in fire safety engineering

It is incumbent on the designer to identify possible sources of uncertainty when conducting a PRA.
The manner in which uncertainty is approached needs to be appropriate for a given application. The
following is a non-exhaustive list of possible parameter uncertainties, grouped broadly by field.
a) Initializing events – likelihood of fire occurrence, user intervention, fire brigade intervention.
b) Fire dynamics – growth rate, heat of combustion, convective fraction, fire load density, heat
release rate per unit area, ventilation condition (and its relationship with time), spread rates,
combustion efficiency.
c) Yields – production rates of products and species, e.g. soot, CO, CO2, HCN.
d) Reliability of systems and construction – fire resisting separations, active systems, detectors,
passive fire protection.
e) Structural response – load, material properties (and their variation with temperature/ time),
geometrical imperfections.
f) Human factors – pre-evacuation time, walking speeds, body shape, shoulder width, propensity
for fatigue.
g) Performance criteria – appropriate/ tolerable metrics for visibility, exposure to heat and yields.
6.5.3 Model uncertainty

Model uncertainty relates to the uncertainty in the assumptions made in the analysis and to the
validity of models used. Generally, correlations adopted in fire safety engineering design are
empirical, i.e. idealizations are made to provide consistency between models and observations/
experiments. Such idealizations introduce an inherent source of possible inconsistency between the
actual process/ behaviour, and the engineering model that endeavours to replicate it.
Importantly, model uncertainty cannot be eliminated. Improved models could be developed that
reduce the uncertainty or multiple modelling methods can be applied to the same problem so that the
impact of modelling uncertainty on the end conclusion of the analyses can be addressed.
6.5.4 Completeness uncertainty

Completeness issues imply that something is missing, and hence optimistic biases might exist. This
class of uncertainties could have a significant impact on the predictions of a PRA model. Examples of
sources of incompleteness include:
a) the scope of the PRA does not include some class of initiating events, hazards, or modes
of operation;
b) failure modes or behaviours might exist that have yet to be comprehended or observed,
e.g. through the adoption of novel materials or processes; and
c) the analysis might have omitted phenomena, failure mechanisms, or other factors because their
relative contribution is believed to be negligible.
6.5.5 Treatment of uncertainties
6.5.5.1 General
The appropriate means of addressing uncertainties depends on their typology.

The following five steps are generally adopted in a systematic uncertainty evaluation.
a) Identification, screening and characterization of uncertainties (steps 1, 2 and 3).
b) Analysis of characterized uncertainties (step 4).
c) Reporting (step 5).
NOTE See 6.5.5.2 for further information on step 5.
The review of the identified uncertainties is carried out on a task-by-task basis to identify both
implicit and explicit stated assumptions and uncertainties inherent in the modelling or applied
data. This is a qualitative review that involves assessing the perceived importance on the product(s)
of each task and particularly on the overall results and insights. The possible effects on future
applications, e.g. assessing alternative design options, should also be taken into account. A qualitative
review is conducted to determine the potential impact of each source. An assessment is provided of
the applicability of the issue to the application under evaluation (applies to generic issues) and the
importance of the uncertainty based on its potential impact and any mitigating factors present to
reduce the uncertainty.
The strategies to address sources of uncertainty might include, but are not limited to, those
listed below.
a) Parameter uncertainty – Explicit quantification of uncertainties using probability distributions,
and propagation of probability distributions using techniques such as Monte Carlo sampling and
Latin hypercube sampling.
b) Model uncertainty – Developing multiple models for an issue, assigning a probability that
each model is the correct model based on engineering judgment, and hence propagating,
probabilistically, these modelling uncertainties in the overall results.
c) Completeness uncertainty – Providing a basis for excluding uncertainties that cannot, or by
choice will not, be addressed, i.e. qualitative justification. Where a completeness uncertainty
could relate to an unforeseeable failure mode, or an incomprehensible consequence,
completeness uncertainty might be best addressed through risk aversion.
d) The Monte Carlo method provides a means to combine probability distributions such as HRR,
manual suppression time. Using the Monte Carlo method in its simplest form, the single loop
solution (1D Monte Carlo) produces results in the form of a mean value of the probability of
occurrence, see 6.2.5.
e) In order to calculate the uncertainty of the results, the Monte Carlo method is implemented
in a more complex form called double-loop (2D Monte Carlo). In such an approach there
are probability distributions that characterize uncertainty on parameters, and probability
distributions that characterize variability in parameters, human behaviour or component/
system state. The first class of probability distribution is related to epistemic uncertainty and
is implemented in an outer sampling loop. The second is related to aleatory behaviour and is
implemented in an inner sampling loop.
6.5.5.2 Reporting of uncertainty (step 5)

Key results from the fire PRA quantitative uncertainty analysis are the mean fire induced
consequence frequencies, and a measure of the width of the uncertainty distributions, see Figure 10.

Figure 10 — Example of typical uncertainty distribution
A key objective is to understand what input uncertainties are most influencing the overall uncertainty
on output probabilities or frequencies. For this reason, it is desirable to present a quantitative
measure of the influence of uncertainties on the final uncertainty distribution on the results.
Figure 11 provides an example in the form of a “tornado chart”.
Tornado charts show the contribution to variance, based on Pearson’s coefficient, graphically and
ranked from highest to lowest. These charts also show whether the input value has a positive or
negative effect on the output value. A positive effect is shown by a bar on the right hand side of the
figure and a negative effect is shown by a bar to the left. A positive effect implies that an increase
in the input value causes an increase in the output value, and a decrease in the input value causes
a decrease in the output value. Conversely, a negative effect means that increases in the input value
decrease the value of the output, and vice versa.

Figure 11 — Example of Tornado Chart Showing Contribution to Variance
6.5.6 Sensitivity analysis

If the results of the probabilistic risk analysis are within the acceptance criteria, sensitivity analysis
might not be needed. If, however, the results of the probabilistic risk analysis are close to the
acceptance criteria, variations in the variables can have a significant effect on the conclusions from
the analysis and sensitivity analysis should be used to assess this.
The first step of sensitivity analysis is to identify the variable(s) that are likely to have the greatest
impact on the results of the analysis. The variables can be identified as:
a) those where a small change is magnified due to its role in an equation or analysis; and/or
b) those whose value is subject to substantial variability or uncertainty.
The variables identified as potentially having a significant impact on the results of the analysis can
then be investigated in one of three ways:
1) a single variable with an alternative value;
2) a single variable over a range of values; or
3) a multiple point assessment of multiple variables.
A sensitivity analysis of a single variable with an alternative value is the simplest approach. The
analysis is repeated with an alternative (usually more onerous) value to assess whether the
conclusions of the analysis are robust. If the assessment criteria are still satisfied, the conclusions of
the analysis are further reinforced.
Often sensitivity analysis based on a single alternative value of a variable is not very conclusive.
Therefore, sensitivity analysis of a variable over a range of values is used. The analysis is repeated and
a graph is produced showing the variation of the results of the analysis against values of the variable.
This provides much greater insight into the relationship between the variable and the output of the

analysis. If the results of the analyses lie across the acceptance criteria, a critical value of the variable
can be identified and an assessment made of its implications.
7 Data collection for PRA

Wherever possible, the data used should be directly applicable to the case under review. For example,
many shopping malls and airports collate data on the time it takes to evacuate the building when the
fire alarm goes off. Such data is unlikely to be released into the public domain, but might be available
when a study on the development in question is carried out.
Manufacturers often have data on the failure of their systems or the components that make up their
systems. Service companies for fire alarms and sprinklers might keep maintenance records that can
be interrogated. Such data might be confidentially sensitive and difficult to obtain. Where applicable,
data can be obtained from other industries where PRA is extensively used and the amount of data
might be able to support the PRA.
NOTE 1 Data can often be sourced from other industries such as nuclear, offshore and petrochemical, where PRA
has long been established as a core analytical methodology.
The data or source of the data used for the PRA should be clearly identified and wherever possible,
made available for review to enable further understanding of the quality of the data as well as any
potential bias.
NOTE 2 See Annex B for examples of collated data.

Annex A (informative)
Acceptance and tolerability criteria
Reference values for the individual tolerability and negligible limit are given in Table A.1. The
valuation of the SCCR for the valuation of reductions in risk to life is specified in Table A.2. These
values are for informative purposes only.
Table A.1 — Individual risk limits
Limit Value Reference

Individual tolerability limit 10-4 / year Based on [4]
Individual de minimis limit 10 / year
-6
[4]
Table A.2 — Parameters and valuation of benchmark proportionality constant SCCR1life
Parameter Value Reference

Demographic constant CX for 16.5 years Derived from ISO 2394.
uniform mortality change. UK data.
2% discount rate.
GDP per capita g (2016) 28 448 GBP/year [18]
Work-leisure exponent q 0.18 [14]
SCCR1life 2.6·10 GBP
6
—
Annex B (informative)
indicative probabilities
B.1 Reliability of sprinkler systems

The reliability of sprinkler systems largely depends on the supervisory regime in force, although
there are some technical measures which can help, such as placing an alarm on the main shut-off
valve and duplicating the water supply.
The only statistical analyses of sprinkler system failures (which themselves are relatively rare) come
from the USA [19]. They show that the leading cause of failure is closure of the shut-off valve. In
the UK the position of this valve is monitored and alarmed, while in the USA this is a relatively new
requirement. In the UK almost all sprinkler systems are installed by third-party accredited installers,
whereas in the USA there is a system of state licensing, with variable stringency.
No UK specific data for sprinkler reliability has been sourced. However, summaries of studies from
the USA and New Zealand (NZ) are provided in Table B.1 and Table B.2.

Table B.1 — Sprinkler reliability by occupancy based on USA experience
Occupancy % where equipment % effective of those that % where operated

operated operated effectively
Offices 91 96 87
Restaurants 90 92 83
Storage 86 96 82
Residential 93 96 89
All 92 96 88
NOTE See U.S. Experience with Sprinklers [19].
Table B.2 — Sprinkler effectiveness (%) by occupancy based on NZ experience
Water supply Occupancy Expected Lower Upper

Single town’s main Apartment 90 59 97
supply Office 95 81 99
Diesel pump and Apartment 90 46 97
tank Office 95 67 99
Dual supply: Diesel Apartment 90 61 97
pump, tank and Office 96 89 99
town’s main
Effectiveness is defined by the product of: reliability, availability and efficacy:
• Availability – Is the system on-line when called upon;
• Reliability – Ability of the system to operate when called upon;
• Efficacy – Does the system meet the performance requirements when operational.
NOTE See Effectiveness of Fire Safety Systems for Use in Quantitative Risk Assessments [20].
B.2 Data tables

Table B.3 — Overall probability of fire starting in various types of occupancy
Occupancy Probability of fire starts per occupancy

y-1
Industrial 0.9 × 10·2
Offices 0.4 × 10·2
Assembly entertainment 0.7 × 10·2
Hospitals 2.6 × 10·2
Schools 1.4 × 10·2
Dwellings 0.13 × 10·2
Food and drinks premises; hotels, hostels; communal 4.6 × 10·2
living
Other public buildings and services 1.8 × 10·2
NOTE See A Critical Evaluation of BS PD 7974‑7 Structural Fire Response Data Based on USA Fire
Statistics [21].

Table B.4 — Fire growth rate distributions
Occupancy Distribution Mean (m2/s2) Standard dev 75th 90th 95th

type (m2/s2) percentile percentile percentile
(m2/s2) (m2/s2) (m2/s2)
Offices Log-normal 7.6 × 10-5 11 × 10-5 3.9 × 10-5 9.4 × 10-5 18.3 × 10-5
Residential 8.1 × 10-5 9.3 × 10-5 5.4 × 10-5 10.4 × 10-5 17.4 × 10-5
Restaurants 7.4 × 10-5
7.8 × 10-5
5.0 × 10-5
10.2 × 10 -5
17.0 × 10-5
Stores 9.7 × 10-5 12.2 × 10-5 5.3 × 10-5 12.3 × 10-5 22.6 × 10-5
NOTE 1 Data applies to fires at least 1 m2 in area, with fire brigade intervention within 20 min.
NOTE 2 See Statistical Estimations of the Distribution of Fire Growth Factor – Study on Risk-Based
Evacuation Safety Design Method [22].
Table B.5 — Fire load energy density for various types of occupancy
Occupancy Distribution type Mean fire load Coefficient of References

energy density variation (-)
(MJ/m2)
Dwelling 780
Hospital 230
Hotel room Gumbel type I 310 0.30 [23]
Library 1 500
Office 420
School 285
Fast food outlet 526 0.61
Clothing store 393 0.42
Restaurant 298 0.64 [24]
Kitchen 314 0.51
Retail unit storage area Log-normal 1 196 1.01
Manufacturing and 1 180 0.73 [25]
storage of combustible
goods (<150 kg/m2)
Manufacturing and 9 920 0.86
storage of combustible
goods (>150 kg/m2)

Table B.6 — System effectiveness
System Lower bound (%) Upper bound (%) Ref

Commercial heat 85 95 [20]
detection*
Residential heat 80 90
detection*
Commercial smoke 86 97
detection (photoelectric
and ionization)*
Residential smoke 78 93
detection (photoelectric
and ionization)*
Stairwell pressurization* 47 52
* Effectiveness is defined by the product of: reliability, availability and efficacy:
• Availability – Is the system on-line when called upon;
• Reliability – Ability of the system to operate when called upon;
• Efficacy – Does the system meet the performance requirements when operational.
Probability of fire 85 95 [26]
doors (sleeping
accommodation) with
self-closing devices being
closed
Reduction in US 53 [27]
residential fatalities
and casualties due to
functioning smoke alarms
Table B.7 — Extent of Damage in USA Fire Incidents, 1989-1994
Protection % constrained to room % constrained to floor % involving the full

of origin of origin structure
None 59 4 37
Detection (D) 85 4 11
Sprinklers (S) 89 3 8
Fire resisting 77 4 19
construction (FRC)
D+S 92 2 6
D+FRC 92 3 5
S+FRC 91 3 7
D+S+FRC 95 2 3
NOTE See Evaluation of Fire Safety Design Alternatives [28].

Annex C (informative)
Commentary on acceptance criteria
COMMENTARY ON Annex C
This Annex provides commentary on the different acceptability criteria in Figure C.1.
Figure C.1 — Acceptability criteria
C.1 AC1: Comparative safety criterion with implicit tolerability assessment

C.1.1 Application
The acceptability of the design is based on demonstrating equivalent or improved safety
performance compared to an accepted reference design. The reference design is commonly based on
prescriptive guidance.
No explicit tolerability assessment is made. Tolerability is based on the tolerability of the
reference design.
Omitting the explicit tolerability assessment in principle allows reducing the detail and complexity of
the PRA, as only the change in performance relative to the reference design is to be determined.

C.1.2 Assumptions and designer responsibility

The tolerability of the reference design is assumed.
The safety level of the reference design is assumed to comply with the ALARP requirement.
By demonstrating equivalent safety or better, it is assumed that the proposed design is both tolerable
and achieves a safety level in exceedance of the ALARP requirement.
The designer takes responsibility for the tolerability of the reference design, its compliance with
ALARP, and its appropriateness as a benchmark for the trial design.
C.1.3 Guidance
Comparative safety assessments are prone to a number of pitfalls. Common pitfalls for comparative
safety investments which are to be avoided are:
a) accepted (prescriptive) design solutions are not necessarily tolerable; and
b) accepted (prescriptive) design solutions are not necessarily ALARP.
NOTE 1 This relates to the common observation that safety levels in prescriptive guidance might differ
between buildings. In some cases prescriptive design solutions could exceed the ALARP requirement. In specific
cases the ALARP requirement might be closely approximated. It cannot be excluded that some prescriptively
accepted design solutions do not adhere to the ALARP requirement.
c) application of prescriptive guidance to structures that are outside the scope of the guidance
document cannot result in a benchmark for adequate safety;
d) modelling assumptions and simplifications applied in the safety evaluation do not necessarily
have the same effect on both the prescriptive design solution and the alternative design
(“asymmetry effect”). Modelling assumptions which are at first sight “conservative” can unduly
penalize the reference design; and
e) the intent of that code needs to be clearly understood. The intentions of the prescriptive
recommendations should be taken into account, as particular provisions might have more than
one objective.
NOTE 2 Common and longstanding application in designs, and observed performance in a large number of fires are
indicative of the reference design being both tolerable and ALARP.
The stakeholders can opt to include a subjective “safety margin” (or “safety factor”) to compensate for
the possibility of unknown adverse effects in the equivalency assessment, see 5.2.6. Equivalency of
the design is then determined through Equation (4):
SLtrial
≥ SM (4)
SLref
where:
SLtrial is the safety level of the trial design;
SLref is the safety level of the reference design;
SM is the safety margin (≥ 1).
Other equivalent formulations are possible. The recommended value of the safety margin depends on
the model. For simple and well-understood models and a well-established reference design the safety
margin can be close to unity.

C.2 AC2: Negligible criterion

C.2.1 Application
The spectrum of possible consequences and associated probabilities is assessed. For the specific fire
safety objective, the risk curve is located in the negligible region (see Figure 5). The design is readily
acceptable without further justification.

No additional assumptions beyond modelling assumptions.
C.2.3 Guidance
Negligible limit is determined through stakeholder consultation. In absence of consensus, the most
onerous negligible limit is to be applied.
If stakeholders are unwilling to specify a negligible limit, the negligible limit can be considered to
correspond with uniform negligible frequencies for all consequences.
In absence of stakeholder agreement, an indicative value of a negligible frequency for fire safety is a
frequency below 10-10 per year. A negligible limit with uniform negligible probabilities can be used as
a basis for applying AC2. However, in those situations an ALARP assessment, i.e. application of AC3,
AC4 or AC5, is recommended.
C.3 AC3: Absolute criterion

C.3.1 Application
Absolute acceptance criteria function as an approximation for the ALARP criterion. This allows
limiting the scope of the assessment, e.g. omitting an explicit cost evaluation.
A design which meets the absolute acceptance criterion is assumed to fulfil the ALARP requirement.

The absolute acceptance criteria function as an approximation of the ALARP criterion and errs on the
side of increased safety investment.
The designer is responsible for the conservativeness of the applied absolute acceptance criteria. This
constitutes a requirement to apply best efforts as a diligent professional. The designer’s efforts are
to be assessed in the light of the collective knowledge of the profession. This constitutes an elevated
benchmark relative to the readily available knowledge of an ordinary competent practitioner.
When no practicable approximate absolute acceptance criteria can be established, the designer needs
to opt to apply a different acceptance criterion, i.e. AC4 or AC5.
C.3.3 Guidance
Absolute acceptance criteria are established through stakeholder consultation. The designer
ensures that the absolute acceptance criteria correspond with a conservative approximation of the
ALARP criterion.
NOTE Professional bodies can publish guidance to their members, listing absolute acceptance criteria which are
considered by the profession as state-of-the-art conservative approximations of the ALARP requirement.

C.4 AC4: ALARP criterion

C.4.1 Application
Adequate safety is demonstrated through an explicit evaluation of the ALARP criterion.
When using PRA, the ALARP assessment is done through a societal cost-benefit assessment (CBA),
see 5.2.4.2.

The designer assesses direct and indirect costs and benefits from a societal perspective.
Although AC4 is, engineering-wise, more challenging, it imposes a lower burden of responsibility on
the designer as compared to application of the other acceptance criteria.
C.4.3 Guidance
C.4.3.1 Costs
The direct and indirect costs of the safety measure mostly relate to the installation and maintenance
costs. Other costs can be associated with, e.g. a loss of heritage value for heritage buildings.
Cost reduction resulting from a proposed safety measure is to be taken into account, as stated below.
C.4.3.2 Benefits
Direct and indirect benefits are to be taken into account, including loss reductions due to the
implementation of the safety measure. For example, sprinklers proposed for life safety also reduce
expected property losses. This reduction in losses is an indirect benefit of sprinkler implementation
(reducing the net cost of the sprinkler installation). The indirect benefit needs to be taken into
account when assessing ALARP.
C.4.3.3 Discounting
As stated in 5.2.4.2, all costs and benefits are discounted to a common point of reference using the
societal discount rate. The recommended societal discount rate is equal to the long term growth rate.
C.4.3.4 Proportionality constant, a

The proportionality constant, a, is to be determined, bringing all costs and benefits to a common
unit of reference. The appropriate proportionality constants depend on the considered fire
safety objective.
NOTE It is not feasible to list and provide up-to-date guidance for all possible fire safety objectives in this
Published Document. For the main fire safety objective of life safety, see 5.4.
C.4.3.5 Disproportionality factor, D

The disproportionality factor, D, should be determined through consultation with the stakeholders.
A factor D = 1 is recommended when all costs and benefits (including uncertainties) are explicitly
considered. An extensive explicit evaluation of costs and benefits is recommended. Events for which
no experimental data exist can also be taken into account.
As discussed in 5.2.4.2, common arguments in favour of disproportionality factor D > 1 relate,
amongst others, to an aversion with respect to high consequences, uncertain effects of modelling
assumptions, a lack of trust with respect to the trustworthiness of the designer. These aspects are
preferably taken into account through other means, see 5.2.4.2.4.

It is recommended that the non-acceptance of high consequence events is taken into account through
the tolerability assessment. The issue of the bearability of consequences is emphasized in the PRA
process flowchart of Figure 2.
It is recommended to explicitly consider uncertainty in the modelling assumptions as part of the
PRA. The uncertainty with respect to the design’s risk profile is then evaluated in accordance with
best practice.
The possibility of intentional misconduct is a liability issue and is not to be balanced through the
disproportionality factor, D.
C.5 AC5: Comparative safety criterion with explicit tolerability assessment

C.5.1 Application
The acceptability of the design is based on demonstrating equivalent or improved safety
performance compared to an accepted reference design. The reference design is commonly based on
prescriptive guidance.
Tolerability of the design is explicitly assessed.
The comparative safety evaluation allows limiting the detail of the PRA as a detailed evaluation of
costs and benefits of safety investments is not required.

The ALARP criterion is approximated by demonstrating equivalent or improved safety compared
to an accepted reference design (commonly a prescriptive design solution). When the costs and
benefits of the reference design are similar as for the assessed trial design, and the reference design is
ALARP, the comparative safety assessment allows demonstrating ALARP without requiring a detailed
evaluation of costs and benefits.
The designer takes responsibility for the appropriateness of the reference design.
As tolerability of the design is explicitly assessed, AC5 results in a considerably reduced designer
responsibility compared to AC1.
C.5.3 Guidance
Reference is made to the guidance for AC1, see C.1.3.

Bibliography
Standards publications
For dated references, only the edition cited applies. For undated references, the latest edition of the
referenced document (including any amendments) applies.
ISO 2394, General principles on reliability for structures
Other publications
[1] HOPKIN, D., VAN COILE, R., LANGE, D. Certain Uncertainty – Demonstrating safety in fire
engineering and the need for safety targets. SFPE Europe, Issue 07. 2017.
[2] VAN COILE R., HOPKIN D., LANGE D., JOMAAS G., BISBY L. The need for hierarchies of acceptance
criteria for probabilistic risk assessments in fire engineering. Fire Technol. 2018
[3] SOCIETY OF FIRE PROTECTION ENGINEERS. Engineering Guide to Performance-Based Fire
Protection. Second Edition, 2007
[4] HEALTH AND SAFETY EXECUTIVE. The tolerability of risk from nuclear power stations. TSO,
London, 1988
[5] HEALTH AND SAFETY EXECUTIVE. Reducing risks, protecting people. TSO, London, 2001
[6] SUNSTEIN C.R. Laws of Fear. Beyond the Precautionary Principle. Cambridge University Press,
Cambridge, UK, 2005
[7] FRANK W., FARQUHARSON J. Guidelines for Developing Quantitative Safety Risk Criteria. Center
for Chemical Process Safety of the American Institute of Chemical Engineers, New York, 2009
[8] NAHTWANI J., LIND N.C., PANDEY M.D. Affordable Safety By Choice: The Life Quality Method.
University of Waterloo, 1997
[9] FISCHER K. Societal decision-making for optimal fire safety. Institute of Structural Engineering,
ETH Zurich, Switzerland. 2014.
[10] KAPLAN S., GARRICK B.J. On The Quantitative Definition of Risk. Risk Anal. 1981, 1 pp. 11–27
[11] HEALTH AND SAFETY EXECUTIVE. Risk Criteria for Land-use Planning in the Vicinity of Major
Industrial Hazards. 1989.
[12] HEALTH AND SAFETY EXECUTIVE. Societal Risk: Initial briefing to the Societal Risk Technical
Advisory Group. HSE Research Report RR703. London: TSO, www.hse.gov.uk/research/rrpdf/
rr703.pdf [Last viewed 31 March 2019.]
[13] MADDISON T. The UK Approach to Land-use Planning in the Vicinity of Chemical Major Hazard
Installations. Health and Safety Executive. London: TSO. 1988.
[14] PANDEY M.D., NATHWANI J.S., LIND N.C. The derivation and calibration of the life-quality index
(LQI) from economic principles. Structural Safety. 2006.
[15] PANDEY M.D., NATHWANI J.S. Life quality index for the estimation of the societal willingness-to-
pay for safety. Structural Safety. Vol. 26, pp. 181–199. 2004.
[16] LENTZ A. Acceptability of Civil Engineering Decisions Involving Human Consequences. Doctoral
dissertation. Technischen Universität München, Germany. 2007.
[17] THOMAS P., WADDINGTON I. Review of the “value of a prevented fatality” (VPF) used by
regulators and others in the UK. Nuclear Future, 2016

[18] OFFICE FOR NATIONAL STATISTICS. Gross domestic product per head: Table P. 2018. https://
www.ons.gov.uk/economy/grossdomesticproductgdp/datasets/gdpperheadtablep [Last
viewed 31 March 2019.]
[19] NATIONAL FIRE PROTECTION ASSOCIATION. U.S. Experience with Sprinklers.
Ahrens, USA, 2017
[20] NEW ZEALAND FIRE FIRE SERVICE. Marsh. Effectiveness of Fire Safety Systems for Use in
Quantitative Risk Assessments. New Zealand Fire Service Commission Research Report
Number 89. 2008.
[21] MANES M., RUSH D. A Critical Evaluation of BS PD 7974-7 Structural Fire Response
Data Based on USA Fire Statistics. Fire Technology. Edinburgh Research Explorer. 2018.
(https://www.research.ed.ac.uk/portal/files/79577930/Manes_Rush2018_Article_
ACriticalEvaluationOfBSPD7974_.pdf) [ Last viewed 31 March 2019.]
[22] DEGUCHI Y., NOTAKE H., YAMAGUCHI Y. TANAKA, T. Statistical Estimations of the Distribution
of Fire Growth Factor – Study on Risk-Based Evacuation Safety Design Method. Fire Safety
Science. Proceedings of the Tenth International Symposium. Maryland, 2011.
[23] EUROPEAN COMMUNITIES. Competitive steel buildings through natural fire safety concepts.
Office for Official Publications for the European Communities, Luxembourg, 2002
[24] ZALOK E., HADJISOPHOCLEOUS G. and MEHAFFEY, J., Fire loads in commercial premises. Fire &
Materials, 33, 63–78, 2009.
[25] THOMAS P. Design guide: Structure fire safety. Fire Safety Journal, Vol. 10(2), pp 77–137, CIB
W14 Workshop report, 1986.
[26] FRANK K., SPEARPOINT, M. and WEDDELL S., Finding the Probability of Doors Being Open
Using a Continuous Position Logger. Fire Safety Science. 2014, 11 pp. 969–982. DOI:10.3801/
IAFSS.FSS.11-969
[27] HALL J. US Experience with Sprinklers and Other Automatic Fire Extinguishing Equipment.
National Fire Protection Association, Quincy, MA, 2009
[28] ROSENBAUM E. Evaluation of Fire Safety Design Alternatives. MS Thesis, Department of Fire
Protection Engineering, University of Maryland, College Park, MD, 1996.
Further reading
BS 7974:2019, Application of fire safety engineering principles to the design of buildings –
Code of practice
PD 7974-1, Application of fire safety engineering principles to the design of buildings – Part 1: Initiation
and development of fire within the enclosure of origin (Sub-system 1)
PD 7974-3, Application of fire safety engineering principles to the design of buildings – Part 3:
Structural response and fire spread beyond the enclosure of origin (Sub-system 3)
PD 7974-4 (Withdrawn), Application of fire safety engineering principles to the design of buildings –
Part 4: Detection of fire and activation of fire protection systems (Sub-system 4)
PD 7974-5, Application of fire safety engineering principles to the design of buildings – Part 5: Fire and
rescue service intervention (Sub-system 5)
PD 7974-6, The application of fire safety engineering principles to the design of buildings – Part 6:
Human factors: Life safety strategies – Occupant evacuation, behaviour and condition (Sub-system 6)
PD 7974-7, Application of fire safety engineering principles to the design of buildings – Part 7:
Probabilistic risk assessment

NO COPYING WITHOUT BSI PERMISSION EXCEPT AS PERMITTED BY COPYRIGHT LAW
British Standards Institution (BSI)

BSI is the national body responsible for preparing British Standards and other
standards-related publications, information and services.
BSI is incorporated by Royal Charter. British Standards and other standardization
products are published by BSI Standards Limited.
About us Reproducing extracts

We bring together business, industry, government, consumers, innovators For permission to reproduce content from BSI publications contact the BSI
and others to shape their combined experience and expertise into standards Copyright & Licensing team.
-based solutions.
The knowledge embodied in our standards has been carefully assembled in Subscriptions
a dependable format and refined through our open consultation process. Our range of subscription services are designed to make using standards
Organizations of all sizes and across all sectors choose standards to help easier for you. For further information on our subscription products go to
them achieve their goals. bsigroup.com/subscriptions.
With British Standards Online (BSOL) you’ll have instant access to over 55,000
Information on standards British and adopted European and international standards from your desktop.
We can provide you with the knowledge that your organization needs It’s available 24/7 and is refreshed daily so you’ll always be up to date.
to succeed. Find out more about British Standards by visiting our website at You can keep in touch with standards developments and receive substantial
bsigroup.com/standards or contacting our Customer Services team or discounts on the purchase price of standards, both in single copy and subscription
Knowledge Centre. format, by becoming a BSI Subscribing Member.
PLUS is an updating service exclusive to BSI Subscribing Members. You will
Buying standards
automatically receive the latest hard copy of your standards when they’re
You can buy and download PDF versions of BSI publications, including British revised or replaced.
and adopted European and international standards, through our website at
To find out more about becoming a BSI Subscribing Member and the benefits
bsigroup.com/shop, where hard copies can also be purchased.
of membership, please visit bsigroup.com/shop.
If you need international and foreign standards from other Standards Development
With a Multi-User Network Licence (MUNL) you are able to host standards
Organizations, hard copies can be ordered from our Customer Services team.
publications on your intranet. Licences can cover as few or as many users as you
wish. With updates supplied as soon as they’re available, you can be sure your
Copyright in BSI publications
documentation is current. For further information, email subscriptions@bsigroup.com.
All the content in BSI publications, including British Standards, is the property
of and copyrighted by BSI or some person or entity that owns copyright in the Revisions
information used (such as the international standardization bodies) and has
Our British Standards and other publications are updated by amendment or revision.
formally licensed such information to BSI for commercial publication and use.
We continually improve the quality of our products and services to benefit your
Save for the provisions below, you may not transfer, share or disseminate any
business. If you find an inaccuracy or ambiguity within a British Standard or other
portion of the standard to any other person. You may not adapt, distribute,
BSI publication please inform the Knowledge Centre.
commercially exploit, or publicly display the standard or any portion thereof in any
manner whatsoever without BSI’s prior written consent.
Useful Contacts
Storing and using standards Customer Services
Standards purchased in soft copy format: Tel: +44 345 086 9001
Email (orders): orders@bsigroup.com
• A British Standard purchased in soft copy format is licensed to a sole named
user for personal or internal company use only. Email (enquiries): cservices@bsigroup.com
• The standard may be stored on more than 1 device provided that it is accessible Subscriptions
by the sole named user only and that only 1 copy is accessed at any one time. Tel: +44 345 086 9001
• A single paper copy may be printed for personal or internal company use only. Email: subscriptions@bsigroup.com
Standards purchased in hard copy format: Knowledge Centre

• A British Standard purchased in hard copy format is for personal or internal Tel: +44 20 8996 7004
company use only. Email: knowledgecentre@bsigroup.com
• It may not be further reproduced – in any format – to create an additional copy.
Copyright & Licensing
This includes scanning of the document.
Tel: +44 20 8996 7070
If you need more than 1 copy of the document, or if you wish to share the Email: copyright@bsigroup.com
document on an internal network, you can save money by choosing a subscription
product (see ‘Subscriptions’). BSI Group Headquarters
389 Chiswick High Road London W4 4AL UK

PD 7974-7-2019

Uploaded by

Copyright:

Available Formats

PD 7974-7-2019

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

PD 7974-7-2019

Uploaded by

Copyright:

Available Formats

What are the main topics covered in the document?

What are the main topics covered in the document?

What are some of the analysis methods discussed?

What are some of the analysis methods discussed?

PD 7974‑7:2019

BSI Standards Publication

Application of fire safety engineering

Part 7: Probabilistic risk assessment

Publishing and copyright information

© The British Standards Institution 2019

Published by BSI Standards Limited 2019

ISBN 978 0 580 98926 1

ICS 13.220.20; 91.040.01

The following BSI references relate to the work on this document:

Amendments/corrigenda issued since publication

Date Text affected

© THE BRITISH STANDARDS INSTITUTION 2019 – ALL RIGHTS RESERVED

© THE BRITISH STANDARDS INSTITUTION 2019 – ALL RIGHTS RESERVED i

Relationship with other publications

Use of this document

ii © THE BRITISH STANDARDS INSTITUTION 2019 – ALL RIGHTS RESERVED

Contractual and legal considerations

© THE BRITISH STANDARDS INSTITUTION 2019 – ALL RIGHTS RESERVED iii

THIS PAGE DELIBERATELY LEFT BLANK

3 Terms and definitions

3.1 As Low As Reasonably Practicable (ALARP)

3.4 conditional probability

3.8 failure mode

© THE BRITISH STANDARDS INSTITUTION 2019 – ALL RIGHTS RESERVED 1

3.11 individual risk

3.12 initiating event

3.15 probabilistic model

3.16 probability distribution

3.21 societal risk

2 © THE BRITISH STANDARDS INSTITUTION 2019 – ALL RIGHTS RESERVED

4.1.2 Safety basis of deterministic design methods

Large levels of conservativeness should be quantified or at least specified further.

© THE BRITISH STANDARDS INSTITUTION 2019 – ALL RIGHTS RESERVED 3

4.1.3 Objective and use of PRA

4.1.3.2 Use of PRA to demonstrate adequate safety

4.1.3.3 Use of PRA to rank design alternatives

4.1.4 Note on deterministic — PRA hybrid approaches

4.2 Steps in a PRA and layout of this published document

4 © THE BRITISH STANDARDS INSTITUTION 2019 – ALL RIGHTS RESERVED

4.2.2 Flowchart for demonstrating adequate safety of a design

Figure 1 — Flowchart for demonstrating adequate safety of a design

© THE BRITISH STANDARDS INSTITUTION 2019 – ALL RIGHTS RESERVED 5

4.2.3 Flowchart for analysis of trial design using PRA methods

Figure 2 — General flowchart for design assessment using PRA methods

4.2.4 Layout of this Published Document

6 © THE BRITISH STANDARDS INSTITUTION 2019 – ALL RIGHTS RESERVED

c) specifics on the quantification of the risk indicator, see 6.4;

© THE BRITISH STANDARDS INSTITUTION 2019 – ALL RIGHTS RESERVED 7

Figure 3 — Consolidated flowchart for a design through PRA

8 © THE BRITISH STANDARDS INSTITUTION 2019 – ALL RIGHTS RESERVED

NOTE Image courtesy of the Health and Safety Executive [4].

5.1.2 Societal requirements and private decision-making

© THE BRITISH STANDARDS INSTITUTION 2019 – ALL RIGHTS RESERVED 9

5.1.3 Risk perception and societal risk acceptance

5.2 General framework for the definition of acceptance criteria