Quantitative risk assessment

Quantitative risk assessment (QRA) is the estimation of risk in numerical terms, by combining the frequency of undesired events with the size of their consequences. It answers three questions: what could happen, how bad would it be, and how likely is it to happen. The results support decisions, either through comparison with acceptable risk levels or through a ranking of the options for reducing risk. A QRA identifies hazards and scenarios, estimates their frequencies with methods such as event tree analysis and fault tree analysis, and models their consequences. It presents the outcome in measures such as individual risk and societal risk.

In the process industries, QRA supports decisions on plant siting, protection options and regulatory compliance. In nuclear power, the same method is called probabilistic risk assessment (PRA), and fire PRA studies have shown that fire can be a significant or even dominant contributor to the risk of a plant. In building design, a full QRA is the most complete way to compare a design with a code-compliant reference building. It needs substantial resources, however, so simpler event tree comparisons are often used.

Definition and terminology

Watts and Hall define risk as the potential for unwanted, adverse consequences to human life, health, property or the environment. They note that risk is usually estimated as the expected value of the probability of an event times its consequence. Strictly, the risk of a building is the whole probability distribution of its fire events and their consequences. The many published definitions of risk can be seen as summary measures of that distribution, and a committee of the Society for Risk Analysis identified 17 of them. Barry expresses fire and explosion risk as the product of the frequency of an undesired event and its expected consequences:

$$R=F\times C$$

To reduce the risk of a defined fire or explosion, the frequency, the consequences or both must therefore be reduced. The terms risk analysis and risk assessment are used interchangeably by some authors and distinguished sharply by others. In the definitions of Watts and Hall, risk analysis includes the quantification of the probabilities and expected consequences of identified risks, while risk evaluation judges their significance and acceptability. Barry describes risk assessment as the use of quantitative risk estimates to support risk management decisions, and he names decision support as its key purpose.

In nuclear power, the same work is called probabilistic risk assessment or probabilistic safety assessment (PSA). More broadly, a quantitative approach is one of two families of fire safety engineering methods. The qualitative approach relies on expert judgement, experience and descriptive risk classes, while the quantitative approach uses measurements and statistical analyses and suits complex scenarios with several variables. Watts and Hall noted in 2002 that probabilistic analysis was not yet well established in fire protection engineering, where empiricism, heuristics and physics-based modelling dominated.

Steps of an assessment

Barry divides a fire and explosion risk assessment into seven steps. The analyst first defines the objectives, then identifies the hazards and describes the loss event scenarios. The consequences and the probabilities of these scenarios are assessed next, with a risk screening step alongside. The results are then presented. If the risk is not acceptable, risk reduction is analysed and the assessment is repeated, while an acceptable risk is followed by monitoring.

The steps of a fire and explosion risk assessment. An unacceptable risk leads to risk reduction and a new assessment; an acceptable risk to monitoring. Based on Barry (2002), p. 5-177.

The objectives determine the rest of the work. They state the decision to be supported, such as plant siting, protection options or regulatory compliance. They also state the focus, such as casualties, property damage, lost production or environmental damage. Finally, they fix the level of detail, relative or absolute, and the acceptable risk limits, including severity limits, likelihood limits and the risk tolerance of management.

Event trees are the most widely used technique for structuring fire scenarios, because they follow the initiation, propagation and consequences of a fire in time. An event tree may lack detail on the causes of a particular branch. In that case fault trees supplement it and provide detail on the events that lead to the final consequence.

Consequence assessment estimates the intensity of fires and explosions and their effects on equipment and people. Barry gives generic damage levels for thermal radiation, based on observations of large fires. An incident heat flux of 37.5 kW/m² damages process equipment and causes 100% lethality within 1 min. At 12.5 kW/m² the lethality is 1% in 1 min, and 4.0 kW/m² causes pain if exposure lasts longer than 20 s.

Generic damage levels for incident thermal radiation used in consequence assessment, based on observations of large fires. Based on Barry (2002), p. 5-186.

Such generic thresholds give a good first-order review but are weak in their treatment of time. Detailed heat transfer or structural models are used where time matters. For people in buildings, exposure models range from simple tenability limits to fractional effective dose models and probit functions.

Frequency and probability

The frequency of a scenario follows its path through an event tree. The frequency of the initiating event is combined with the conditional probabilities of the intermediate events that increase or mitigate the spread of the fire. Barry names two ways to obtain these numbers: relevant historical data, and synthesis with fault trees, human reliability analysis and expert judgement. The two are often used together, each as a check on the other.

Historical frequencies represent only average values and suit simple systems best. Barry also reports that human error is the leading cause of fires and explosions in industry. The quoted shares are 70% to 85% for human factors, 10% to 20% for equipment failures and 10% to 20% for external factors such as earthquakes and floods.

Fire PRA of nuclear power plants writes the same logic as a formula. Siu divides the core damage frequency contribution of a fire scenario into three parts. They are the frequency of the fire, the conditional probability of damage to critical equipment, and the conditional probability of core damage given that damage:

$$\mathrm{C}\mathrm{D}\mathrm{F}=\sum _i{\lambda }_i\left[\sum _j{p}_{\mathrm{e}\mathrm{d},j\mid i}\left(\sum _k{p}_{\mathrm{C}\mathrm{D},k\mid i,j}\right)\right]$$

The three terms correspond to the three layers of fire protection defence in depth: fire prevention, fire detection and suppression, and fire mitigation. Fire frequencies are generally estimated with simple statistical models, damage with deterministic and probabilistic models of the physical processes, and core damage with conventional PRA system models. In the methodology of the Electric Power Research Institute (EPRI) and the U.S. Nuclear Regulatory Commission (NRC), the frequency of a single fire scenario is itself a product of four factors:

The three terms of the fire risk equation: fire frequency, conditional probability of equipment damage, and conditional probability of core damage, matched to the layers of defence in depth. Based on Siu (2002), p. 5-216.

$${\lambda }_k={\lambda }_{i,k}\cdot W_{g,k}\cdot {{S}{F}}_k\cdot P_{\mathrm{n}\mathrm{s},k}$$

The ignition frequency of the source is multiplied by a floor area ratio for transient fires, a severity factor and the probability that the fire is not suppressed in time. The scenario frequency is then combined with the conditional core damage probability of the scenario, and the core damage frequency of a compartment is the sum over its scenarios. Many studies start with conservative screening values, for example a damage probability of one, and refine only the scenarios that matter.

Symbol	Description	Unit
$R$	risk of a defined fire or explosion	consequence per year
$F$	frequency of the undesired event	year−1
$C$	expected consequences of the event (e.g. fatalities, damage)	consequence per event
$\mathrm{C}\mathrm{D}\mathrm{F}$	core damage frequency	year−1
${\lambda }_i$	frequency of fire scenario $i$	year−1
$p_{\mathrm{e}\mathrm{d},j\mid i}$	conditional probability of damage to critical equipment set $j$, given fire scenario $i$	dimensionless
$p_{\mathrm{C}\mathrm{D},k\mid i,j}$	conditional probability of core damage through plant response $k$, given scenario $i$ and damage $j$	dimensionless
${\lambda }_{i,k}$	ignition frequency of the ignition source of scenario $k$	year−1
$W_{g,k}$	floor area ratio for a transient fire scenario (1.0 for fixed sources)	dimensionless
${{S}{F}}_k$	severity factor of scenario $k$	dimensionless
$P_{\mathrm{n}\mathrm{s},k}$	probability that the fire of scenario $k$ is not suppressed in time	dimensionless
$R_{\mathrm{A}}$, $R_{\mathrm{B}}$	expected number of people exposed to untenable conditions per fire, for systems A and B (worked example)	persons per fire

Risk measures and presentation

Results are presented in forms that suit the decision. A risk profile plots the expected frequencies of incidents against their consequences, for example property damage, business interruption or fatalities. Barry adds that the presentation should include an uncertainty bandwidth, which matters most for rare events with large consequences.

Individual risk is the probability of injury or death to a person at a specified location within the effect zone of a fire or explosion. It is often drawn as risk contours, which are closed lines of constant risk around a facility. A contour shows the expected frequency of events that can cause a specified harm at a location, whether or not anyone is present there.

Schematic individual risk contours around a petrochemical plant. Each line joins points of equal individual risk; inside a line the risk is at least that value. Based on Barry (2002), p. 5-210.

Societal risk takes account of the likelihood of multiple casualties. It is usually presented as an F-N curve, which plots the cumulative frequency of events with N or more fatalities against N on logarithmic scales. An F-N curve for people beyond a plant boundary needs a definition of the population at risk, the likelihood that people are present and the reliability of mitigation such as evacuation. Risk indices, such as the fatal accident rate, give single numbers for comparing design options.

The Fire Safety Verification Method of the Australian Building Codes Board uses similar definitions. Individual risk is the frequency at which an individual may be expected to sustain a given level of harm from a fire in the building. Societal risk is the relationship between frequency and the number of people harmed in a given population, usually the occupants of the building and its surroundings. Most human risk quantification is based on fatalities, and Barry stresses that the fatal doses of thermal radiation, blast and toxic chemicals are themselves uncertain.

Worked example

The handbook of the Australian Building Codes Board shows why a purely deterministic comparison can mislead. Two fire safety systems give the same deterministic result. If they work as designed, nobody is exposed to untenable conditions, and if they fail, 2 people are exposed. System A, in the code-compliant reference building, has a reliability of 90%, and system B, in the proposed design, has a reliability of 70%. A deterministic analysis alone would therefore judge the two systems equivalent. A simple risk calculation multiplies the probability of failure by the number of people exposed:

$$R_{\mathrm{A}}=0.1\times 2=0.2,R_{\mathrm{B}}=0.3\times 2=0.6$$

System B exposes the occupants to three times the risk of the reference solution, so the two designs are not equivalent. The handbook concludes that a risk assessment is generally required whenever the reliabilities of the fire safety systems differ appreciably between the proposed design and the reference building. The results are expected numbers of people exposed per fire. A full QRA would also account for the frequency of fires and repeat the calculation over many scenarios.

Probability of failure and expected number of people exposed per fire for the reference system A and the proposed system B. Based on Australian Building Codes Board (2020b), pp. 118 to 119.

Use in fire safety engineering and regulation

Barry lists five reasons why companies use QRA. It helps to reduce design risks to in-house standards and to evaluate code equivalency or the relative risk of design options. It can also show a community or an insurer that a large hazard carries a small risk. Other uses are the prediction of effect zones for emergency planning and compliance with government requirements. In the United States, Barry noted in 2002 that rules under the 1990 Clean Air Act Amendments may require risk assessment and risk management programmes from facilities that hold threshold amounts of hazardous materials. Several states also required QRA.

In the nuclear industry, PRA has been used since the Reactor Safety Study of 1975, and studies had been performed for all operating nuclear power plants in the United States by 2002. Fire PRA determines the contribution of fires to plant risk, and its results are used to decide whether and how the fire protection programme of a plant should change. Because the main concern is the health and safety of the public, fire PRA focuses on scenarios that lead to core damage and uses the core damage frequency as its principal measure.

For buildings in Australia, the International Fire Engineering Guidelines (2005) explain that the performance requirements of the Building Code of Australia set a benchmark for the risk of fatality, injury and loss of adjacent structures. That benchmark is not zero risk, but its level is not stated explicitly, so acceptance criteria are agreed for each project. The Fire Safety Verification Method handbook (2020) uses a comparative approach, in which a code-compliant reference building indirectly defines the acceptable levels of individual and societal risk.

A detailed QRA is the most complete way to make this comparison in the Australian method. Because of the time-dependent interactions between fire, fire safety systems, occupants and fire services, it often needs substantial resources and multi-scenario analysis. For designs with only minor differences from the reference building, simple event trees for the probabilities and deterministic analysis of the critical branches are considered reasonable and conservative.

In the Netherlands, building regulations set limits on measures, such as walking distances and fire resistance in minutes. They do not state how many casualties or how much fire spread to neighbouring plots is acceptable. Van Rossum notes that the lack of risk-based limit values is a drawback of a quantitative approach in Dutch fire safety engineering. The acceptable residual risk then has to be agreed in advance, for example by comparison with a reference situation based on the regulations. Some standards for large fire compartments are partly based on this method.

Uncertainty and limitations

Siu distinguishes two kinds of uncertainty in fire PRA. Aleatory uncertainty describes random variation, such as the number of fires in a room over a given period, which is modelled with a Poisson distribution. Epistemic uncertainty describes limited knowledge, such as the uncertain value of the room fire frequency itself, and it can be reduced with more data. In the EPRI/NRC methodology, the epistemic distributions are propagated through the risk model with Monte Carlo simulation or Latin hypercube sampling. The result is a probability distribution of the core damage frequency instead of a single value.

Data are a common weak point. Fire records for homes in the United States are numerous but thin on detail, nuclear plants have few fires but detailed records, and a single building has very few relevant events of its own. Watts and Hall add that no totally objective way to measure fire risk exists, because problem identification, data collection and the integration of information all involve subjective judgement. The International Fire Engineering Guidelines note that probabilistic methods need much statistical data that are not always available. They also involve time-consuming calculations and are harder to validate, so deterministic methods are used more often.

Finally, the numbers do not decide acceptability by themselves. Accepting a level of risk is a value judgement, and the result depends on whose values are applied, such as those of a client, an authority or the general public. Watts and Hall treat it as an axiom of fire risk analysis that zero risk is not an achievable goal.

See also

• Fire risk assessment
• ALARP
• TNT equivalence
• Common cause failure

References

• Australian Building Codes Board. (2020b). Handbook: Fire Safety Verification Method (Print version 1.1).
• Barry, T. F. (2002). Quantitative risk assessment in chemical process industries. In P. J. DiNenno, D. Drysdale, C. L. Beyler, W. D. Walton, R. L. P. Custer, J. R. Hall Jr., & J. M. Watts Jr. (Eds.), SFPE handbook of fire protection engineering (3rd ed., pp. 5-176–5-213). National Fire Protection Association; Society of Fire Protection Engineers.
• National Research Council of Canada, International Code Council, Department of Building and Housing, & Australian Building Codes Board. (2005). International fire engineering guidelines (2005 ed.). Australian Building Codes Board.
• Nowlen, S. P., Najafi, B., Wyant, F. J., Forester, J., Kazarians, M., Kolaczkowski, A., Joglar, F., Funk, D., Hannaman, G., & Anoba, R. (2005b). EPRI/NRC-RES fire PRA methodology for nuclear power facilities: Vol. 2. Detailed methodology (NUREG/CR-6850; EPRI 1011989). Electric Power Research Institute; U.S. Nuclear Regulatory Commission, Office of Nuclear Regulatory Research.
• Siu, N. (2002). Fire risk assessment for nuclear power plants. In P. J. DiNenno, D. Drysdale, C. L. Beyler, W. D. Walton, R. L. P. Custer, J. R. Hall Jr., & J. M. Watts Jr. (Eds.), SFPE handbook of fire protection engineering (3rd ed., pp. 5-214–5-226). National Fire Protection Association; Society of Fire Protection Engineers.
• Van Rossum, E. (2027). Introduction to Fire Safety Engineering. Fire Safety Academy.
• Watts, J. M., Jr., & Hall, J. R., Jr. (2002). Introduction to fire risk analysis. In P. J. DiNenno, D. Drysdale, C. L. Beyler, W. D. Walton, R. L. P. Custer, J. R. Hall Jr., & J. M. Watts Jr. (Eds.), SFPE handbook of fire protection engineering (3rd ed., pp. 5-1–5-7). National Fire Protection Association; Society of Fire Protection Engineers.