Contents
Event tree analysis (ETA) is an inductive method that follows an initiating event through possible subsequent events to distinct outcomes. In fire safety engineering, its branches describe how fire development, protection and human actions can alter the sequence. Barry identifies initiating events, intermediate events and outcomes as its principal elements, with the intermediate probabilities conditional on the preceding sequence.[1]
An event tree makes the structure of a fire scenario explicit. Each complete path describes one combination of events from initiation to a final state. Quantification adds probabilities or frequencies to this structure; assessing harm requires a further consequence analysis.[2][3] The method therefore supports quantitative risk assessment by connecting the likelihood of initiating conditions with the possible performance of protective measures. Its value depends on meaningful event definitions, appropriate conditional probabilities and a defensible account of the resulting consequences.[4]
Boundaries and event sequence
An event tree begins with a clearly defined initiating event. This may be ignition in a particular enclosure, failure of equipment or release of a flammable substance. These starting points describe different populations of incidents. A release frequency cannot serve as a fire frequency unless the probability and circumstances of ignition are also represented.[5]
The scope establishes what the analysis includes before branches are drawn. Barry places objectives, assessment boundaries and information gathering ahead of detailed quantification. Relevant information includes equipment, inventories, protection, operating conditions and maintenance arrangements. A tree based on the original design alone can misrepresent a facility whose equipment or operation has subsequently changed.[6]
Intermediate events describe conditions that promote or limit the initiating event's development. Examples include detection, shutdown, isolation, automatic suppression and the performance of a barrier. An event can therefore represent a protective action or a condition that permits escalation. The headings should identify the required function rather than merely name the equipment installed.[1][7]
The order of the headings follows the physical and operational sequence being represented. Early detection may allow isolation before a release grows, while a later intervention may act only after substantial exposure has occurred. Distinguishing these sequences prevents the same equipment from receiving identical credit regardless of when it responds.[7]
A complete path ends in a defined outcome that can be assessed. The International Fire Engineering Guidelines illustrate paths involving sprinkler success, sprinkler failure followed by barrier success, and failure of both functions. These are useful structural examples. Their particular tenability outcomes depend on the assumptions of that example and cannot be assigned automatically to every protected building.[8]
Fire control, suppression and extinguishment also describe different levels of performance. A successful control branch may mean that growth is limited sufficiently to meet the selected objective. It does not necessarily mean that combustion has ended. The outcome description should preserve this distinction when later assessment considers continuing heat, smoke or the duration of protection.[9]
The tree is a model of the selected scenario family. Door positions, fire location, ventilation and occupant responses may require additional branches or separate initiating scenarios. The guidelines show separate fire-development and occupant-response trees, while acknowledging simplifying assumptions. Those assumptions require justification before the branches can represent an actual building.[10]
Defining success and response time
A branch labelled success needs a measurable functional meaning. Operation of a device and achievement of the fire safety objective are different questions. A sprinkler may operate without controlling the particular fire, while an alarm can function without producing evacuation in time. The scenario must establish which performance the branch represents.[8][11]
Barry separates response effectiveness, online availability and operational reliability when estimating protective-system success. Response effectiveness includes suitability, capacity, duration and timely action. Availability concerns whether the system is online, while operational reliability addresses its ability to perform when demanded. These distinctions support a more precise treatment of the reliability of fire protection systems.[9]
The event definition should identify a deadline where timing determines the outcome. Detection before loss of tenability differs from detection after occupants have been exposed. Similarly, isolation before a damaging release develops differs from eventual isolation. A generic probability of successful operation does not by itself establish successful operation within the required interval.[12][13]
Timing also determines whether functions can be treated as alternatives or must occur together. The Australian Building Codes Board (ABCB) handbook illustrates evacuation as a combination of alarm, movement to safety, remaining safe and protection during exposure. Its simplified event tree is only a partial account of those interactions. More detailed analysis is needed where their relative timing affects success.[11]
A branch should therefore retain the conditions under which its probability was estimated. These may include the particular fire, required output, available response time and the state of upstream systems. Replacing this description with a single percentage discards information needed to judge whether the value applies to another path or design.[9][14]
Different levels of detail can be appropriate for different questions. A comparison involving one small change may use a simple tree, while interacting changes may require detailed supporting analysis. The ABCB handbook presents simplified probability assessment as a way to check whether differences in reliability could alter a conclusion based on deterministic modelling.[4][15]
Conditional probabilities and frequencies
Conditional probability is central to event-tree quantification. The probability assigned at a branch describes the event given the conditions already reached on that path. Hall defines the conditional probability of one event given another through their joint probability. Rearranging that definition gives the multiplication rule below, without requiring the events to be independent.[16]
Here A and B are specified events, the intersection symbol denotes their joint occurrence, and the vertical bar means given. All terms are dimensionless probabilities. Applying the same rule successively gives a path probability from branch probabilities conditioned on the preceding sequence. Using unconditional probabilities instead requires an additional, justified independence assumption.[16]
For a binary branch, success and failure must describe complementary outcomes under the same conditions. Their probabilities then sum to one. Across a complete set of mutually exclusive paths, the path probabilities also sum to one. These checks test the arithmetic and the stated partition of outcomes, although they cannot establish that the physical model is adequate.[17][2]
An initiating frequency adds a time basis to the calculation. Multiplying that frequency by the conditional probability of a path gives the frequency assigned to that path. This combines Barry's distinction between initiating frequencies and intermediate conditional probabilities with Hall's conditional-probability rule. The two quantities should remain separately identifiable in the results.[3][16]
Here fI is the initiating-event frequency, pi is the probability of path i given that initiation, and fi is its resulting frequency. If initiation is expressed in events per year, the path frequency has the same unit. A probability, by comparison, has no time unit.[3][16]
| Symbol | Meaning | Unit |
|---|---|---|
| P(A) | Probability of event A | Dimensionless |
| A) | Probability of B conditional on A | Dimensionless |
| P(A ∩ B) | Probability that A and B both occur | Dimensionless |
| fI | Initiating-event frequency | year−1 in this example |
| pi | Probability of path i conditional on initiation | Dimensionless |
| fi | Resulting frequency of path i | year−1 in this example |
A frequency expressed per year should not be relabelled an annual probability. The former counts expected occurrences relative to time, while the latter concerns whether an event occurs within a specified interval. Keeping these meanings clear avoids mixing event frequencies, probabilities on demand and equipment failure rates in the same calculation.[3]
Worked conditional example
Consider a hypothetical fire initiation frequency of 0.020 per year. Automatic control succeeds with probability 0.90. If control fails, a barrier contains the fire with conditional probability 0.80. These invented values demonstrate the three-path structure illustrated in the guidelines; they do not describe measured sprinkler or barrier performance.[8][16]
The first path ends with control success and has probability 0.90. The second requires control failure and subsequent barrier success, giving 0.10 multiplied by 0.80, or 0.08. The third requires failure of control and failure of the barrier under that condition, giving 0.10 multiplied by 0.20, or 0.02.[16]
| Outcome | Probability given initiation | Frequency (year−1) |
|---|---|---|
| Automatic control succeeds | 0.90 | 0.0180 |
| Control fails; barrier contains | 0.08 | 0.0016 |
| Both protective functions fail | 0.02 | 0.0004 |
| Total | 1.00 | 0.0200 |
The barrier probability belongs only to the population of fires for which control has already failed. It is therefore conditional on that failure, including whatever fire conditions remain. The calculation does not assume that a barrier has the same chance of success during controlled and uncontrolled fires. The first path requires no additional barrier branch for this simplified outcome classification.[16][8]
The path probabilities sum to one and their frequencies sum to the initiating frequency. These checks confirm that the three declared outcomes account for the assumed initiation population. The frequency 0.0004 per year describes the last path in this model. It is neither a fatality probability nor a statement that all fires outside that path are harmless.[17][4]
A sensitivity case reduces conditional barrier success to 0.40 while retaining the other assumptions. The last-path probability becomes 0.10 multiplied by 0.60, or 0.06. Its frequency increases to 0.0012 per year, three times the baseline value. Automatic-control success remains unchanged, while the contained-fire path falls to 0.0008 per year.[16]
This change shows how a downstream conditional assumption can affect an outcome without changing initiation or the first protective function. It does not establish which barrier value is appropriate. That requires evidence about the barrier and the exposure produced on the failed-control path, together with the functional criteria used to define containment.[9][14]
Dependencies and consequence assessment
Separate branches do not establish physical independence. The ABCB handbook identifies detection as an example of a function influencing evacuation, fire-service notification and automatic smoke management. Failure to detect may affect several subsequent actions together. Their probabilities must therefore reflect the detection state already reached, rather than repeatedly granting an unconditional success probability.[11][16]
Occupant response can introduce another sequence alongside fire development. The guidelines distinguish occupants alerted by direct sensory cues, an alarm or other people. These routes can lead to different response times and therefore different exposure conditions. Combining occupant-response paths with fire-development paths requires attention to their shared conditions, particularly whether detection and warning have already succeeded.[10][16]
Fault tree analysis can support an event-tree branch by examining the combinations of equipment, human and external failures that defeat its function. Barry describes using these methods together when simple historical estimates are inadequate. The supporting failure model must correspond to the event definition and conditions used in the event tree.[3][2]
Consequences remain a separate part of the assessment. An outcome such as failed suppression identifies a system state, but does not directly quantify temperature, smoke exposure, damage or casualties. The physical and occupant-response calculations must evaluate that state. The consequence measure should correspond to the design objective against which the alternatives are being compared.[7][11]
The ABCB handbook demonstrates why equal consequences conditional on operation need not mean equal risk. Two systems can provide equivalent protection when working, yet differ in how often they fail. Including their failure probabilities can change the comparison. Conversely, a high operational probability cannot compensate automatically for an inadequate result whenever the system operates.[4][9]
Evidence, uncertainty and reporting
Probability assignments need a traceable evidence basis. Barry identifies relevant historical experience and synthesis using fault trees, human-reliability assessment and engineering judgement as complementary approaches. Generic historical values may require adjustment for the actual facility. Differences in equipment, operating practice and management can limit their applicability to the sequence being assessed.[3]
Historical incident descriptions may reveal causes and consequences without providing a usable numerical frequency estimate for the facility. Barry notes that minor events are not always reported and that records can be incomplete. The analyst must distinguish evidence that a sequence is possible from evidence of how often it occurs. The population and observation period therefore matter when interpreting a numerical assignment.[6][3]
A record should preserve each event's description, probability range, source, selected value and justification. Barry's documentation example includes these fields so that assumptions remain reviewable. Where expert judgement supplies missing information, the basis and relevant expertise should be recorded. An unsupported point value remains uncertain even when subsequent arithmetic is exact.[14]
Monte Carlo simulation can propagate mathematically described input uncertainty through repeated calculations. Notarianni explains that correlations between inputs need representation when generating realistic scenarios. Sampling cannot establish the correctness of an unsupported branch structure or probability distribution. The resulting spread describes the uncertainty and variability encoded in the model.[18]
Reporting should connect the event tree, its probability evidence and the consequence calculations. The reader needs to identify which paths control the conclusion and which assumptions could change it. This maintains the distinction between a transparent model of possible sequences and a demonstrated judgement about the acceptability of the resulting fire risk.[14][4][18]
See also
Notes
- ↑ 1.0 1.1 Barry (2002), pp. 5-180–5-181.
- ↑ 2.0 2.1 2.2 Australian Building Codes Board et al. (2005), p. 2.2-4.
- ↑ 3.0 3.1 3.2 3.3 3.4 3.5 3.6 3.7 Barry (2002), pp. 5-188–5-190.
- ↑ 4.0 4.1 4.2 4.3 4.4 Australian Building Codes Board (2020), pp. 118–119.
- ↑ Barry (2002), pp. 5-181–5-183.
- ↑ 6.0 6.1 Barry (2002), pp. 5-177–5-179.
- ↑ 7.0 7.1 7.2 Barry (2002), pp. 5-182–5-184.
- ↑ 8.0 8.1 8.2 8.3 Australian Building Codes Board et al. (2005), pp. 2.2-3–2.2-4.
- ↑ 9.0 9.1 9.2 9.3 9.4 Barry (2002), pp. 5-194–5-200.
- ↑ 10.0 10.1 Australian Building Codes Board et al. (2005), pp. 2.2-5–2.2-6.
- ↑ 11.0 11.1 11.2 11.3 Australian Building Codes Board (2020), pp. 120–122.
- ↑ Barry (2002), p. 5-184.
- ↑ Barry (2002), pp. 5-199–5-200.
- ↑ 14.0 14.1 14.2 14.3 Barry (2002), pp. 5-189–5-190.
- ↑ Australian Building Codes Board (2020), p. 120.
- ↑ 16.00 16.01 16.02 16.03 16.04 16.05 16.06 16.07 16.08 16.09 16.10 16.11 Hall (2002), p. 1-184.
- ↑ 17.0 17.1 Hall (2002), pp. 1-183–1-184.
- ↑ 18.0 18.1 Notarianni (2002), p. 5-51 and pp. 5-54–5-55.
References
- Australian Building Codes Board. (2020). Fire safety verification method handbook (Version 1.1).
- Australian Building Codes Board, National Research Council of Canada, International Code Council, & Department of Building and Housing. (2005). International fire engineering guidelines.
- Barry, T. F. (2002). Quantitative risk assessment in chemical process industries. In P. J. DiNenno (Ed.), SFPE handbook of fire protection engineering (3rd ed., Chapter 5-13, pp. 5-176–5-213). National Fire Protection Association.
- Hall, J. R., Jr. (2002). Probability concepts. In P. J. DiNenno (Ed.), SFPE handbook of fire protection engineering (3rd ed., Chapter 1-11, pp. 1-182–1-192). National Fire Protection Association.
- Notarianni, K. A. (2002). Uncertainty. In P. J. DiNenno (Ed.), SFPE handbook of fire protection engineering (3rd ed., Chapter 5-4, pp. 5-40–5-64). National Fire Protection Association.