Quantitative Fire Risk Analysis

Introduction

Fire risk analysis converts descriptions of hazards into estimates that can support defensible decisions. A qualitative statement such as “a fire is unlikely but could be severe” is useful as an initial judgement, but it does not show how often the event may occur, how many people may be exposed, what losses may result, or whether a proposed control is proportionate. Quantitative fire risk analysis (QFRA) addresses these questions by combining probability or frequency, exposure, fire development, consequences, and uncertainty.

QFRA does not produce a magically precise answer. Fire incidents are relatively rare, buildings differ, records may be incomplete, and human behaviour is variable. The purpose is therefore not false precision but structured estimation. A good analysis makes assumptions visible, uses evidence appropriately, tests important uncertainties, and links results to practical controls.

This chapter develops the basic tools required at diploma level: probability and frequency, exposure and consequence estimates, event trees, fault trees, failure data, expected loss, sensitivity analysis, and uncertainty ranges. The methods are applicable to industrial premises, warehouses, offices, residential buildings, process plants, storage facilities, and emergency planning.

Learning objectives

By the end of this chapter, the learner should be able to:

1. Distinguish probability, frequency, exposure, consequence, and risk.
2. Select suitable data and state assumptions for a quantitative estimate.
3. Construct and interpret simple event trees and fault trees.
4. Calculate expected loss and compare risk-reduction options.
5. Apply basic failure data and reliability relationships correctly.
6. Perform sensitivity analysis and communicate uncertainty ranges.
7. Recognise limitations, ethical responsibilities, and governance requirements in QFRA.

1. Foundations of quantitative fire risk

1.1 Risk as a combination of likelihood and consequence

In fire safety, risk is commonly expressed conceptually as the combination of the likelihood of an unwanted event and the severity of its consequences. A useful expected-loss representation is:

where:

• R is the expected risk or expected loss per unit time;
• fᵢ is the frequency of scenario i (events per year, for example);
• Cᵢ is the consequence of scenario i (currency, fatalities, injuries, downtime, or another defined measure);
• the summation includes all relevant scenarios.

The units must be consistent. If frequency is events/year and consequence is currency/event, risk is currency/year. If consequence is fatalities/event, the result is expected fatalities/year. Separate risk measures should normally be calculated for life safety, property, business interruption, environmental harm, and reputation rather than combining incomparable outcomes into one number.

The equation is an expected-value model. It is most useful when scenarios are sufficiently defined and when decision-makers understand that an average does not predict the exact outcome in any one year. A facility may experience no fire for many years and then suffer a major event; the expected value describes the long-term average across comparable conditions.

1.2 Probability, frequency, and exposure

Probability is dimensionless and refers to the chance that an event occurs within a specified interval or under specified conditions. Frequency is a rate, such as fires per year. They are related but not interchangeable.

If events follow a Poisson process with constant annual frequency λ, the probability of at least one event during time t is:

where t is measured in the same time unit as λ. This relationship assumes independent events, a constant rate, and no substantial change in exposure or prevention measures. It should not be used uncritically where fire frequency changes over time, events are clustered, or major common-cause failures exist.

For a small value of λt, P(N ≥ 1) ≈ λt. For example, if the estimated fire frequency is 0.02 fires per year, the probability of at least one fire in five years is:

Thus, the five-year probability is approximately 9.5%, not 10% exactly, although the simple approximation gives 10%.

Exposure describes the people, assets, processes, or time periods subject to the hazard. Examples include:

• person-hours in a high-risk area;
• number of ignition sources operating;
• quantity of combustible stock;
• hours per day that a process is attended;
• number of occupied floors;
• frequency of hot work activities.

A fire frequency derived from one exposure level should not automatically be applied to another. If a warehouse doubles its operating hours or combustible inventory, the analyst must decide whether frequency, consequence, or both are affected.

1.3 Scenario definition

A quantitative analysis begins with clearly defined scenarios. A scenario should identify:

1. the initiating event, such as an electrical fault, hot-work ignition, or cooking fire;
2. location and fuel involved;
3. relevant safeguards;
4. escalation possibilities;
5. occupancy and human exposure;
6. fire-service intervention assumptions;
7. final outcomes, such as controlled fire, flashover, fatality, total loss, or environmental release.

Poorly defined scenarios cause double counting. For example, “electrical fire,” “overheated motor,” and “short circuit” may overlap unless their boundaries are specified. Conversely, overly broad scenarios conceal different frequencies and consequences.

2. Data, evidence, and assumptions

2.1 Sources of data

Useful evidence may include:

• internal incident and near-miss records;
• insurer loss databases;
• regulator and fire-service statistics;
• equipment reliability data;
• inspection and maintenance records;
• occupancy surveys and time studies;
• engineering tests and commissioning results;
• published research and recognised standards;
• expert judgement documented through a structured method.

The analyst should record the population represented by each source. A national residential database may not represent a high-hazard process plant. Historical data may also reflect older equipment, weaker controls, or different building regulations.

2.2 Estimating a basic frequency

If k relevant events are observed over T exposure-years, a simple point estimate of frequency is:

where f̂ is the estimated frequency. For example, four relevant fires over 200 facility-years give f̂ = 4/200 = 0.02 fires per facility-year.

This estimate is uncertain, especially when k is small or zero. Zero observations do not prove that the true frequency is zero. A confidence or credible interval should be considered when data are limited. For rare-event counts, a Poisson model is often a practical starting point. If the exposure is one facility-year and the observed count is k, the estimated rate is still k/T, but the interval around it may be wide.

2.3 Failure probabilities and rates

For a component with constant failure rate λ and independent failures, reliability over time t is:

and the probability of failure by time t is:

Here λ has units of failures per hour, year, or another time unit. The constant-rate assumption is most defensible during the useful-life portion of a component’s life and is less suitable during early-life defects or wear-out. Maintenance, testing, standby conditions, and common-cause failures may require a more detailed model.

For small λt, F(t) ≈ λt. If a detector has a failure rate of 2 × 10^(−4) per hour, its approximate one-year failure probability, assuming 8,760 operating hours and constant rate, is:

This large value shows why units and data interpretation matter. A quoted failure rate of 2 × 10⁻⁴ per hour may be inappropriate for a continuously operating detector or may refer to a different failure mode. The analyst must validate the source rather than accept a number merely because it appears technical.

2.4 Conditional probability

Many fire outcomes are conditional. For example, the probability of a major fire may be the probability of ignition multiplied by the probability that suppression fails, multiplied by the probability that escalation occurs:

where I is ignition, SF is suppression failure, and E is escalation. The conditional notation means that each later probability applies only when the preceding conditions have occurred. Multiplication assumes that the conditional structure correctly represents dependence; it does not require all events to be unconditionally independent.

3. Event-tree analysis

An event tree is an inductive method. It begins with an initiating event and follows the success or failure of protective functions to identify possible outcomes.

For each branch, probabilities must be conditional on reaching that branch. If an initiating event has frequency f₀, and two safeguards have conditional success probabilities p₁ and p₂, the frequency of the outcome in which both safeguards succeed is:

The frequency of an outcome in which the first succeeds and the second fails is:

The probabilities of mutually exclusive final branches should sum to 1 for a given initiating event. This is an important quality check.

Worked example: warehouse fire event tree

Assume a warehouse has an initiating fire frequency of 0.10 per year. For an incipient fire:

• automatic detection succeeds with probability 0.90;
• if detection succeeds, the alarm is successfully transmitted with probability 0.95;
• sprinkler control succeeds with probability 0.80;
• if sprinklers fail, the responding fire service contains the fire before structural involvement with probability 0.60.

For simplicity, assume the sprinkler outcome is independent of alarm transmission after the initiating fire, and define the following final outcomes:

1. controlled by sprinklers;
2. sprinklers fail but fire service contains the fire;
3. sprinklers and fire-service containment fail.

The frequency of sprinkler control is:

The frequency of sprinkler failure followed by fire-service containment is:

The frequency of escalation is:

The final branch frequencies sum to 0.100 per year, confirming that the branches cover the initiating event. Detection and alarm may not affect these fire-containment frequencies in this simplified model, but they could strongly affect evacuation and life-safety consequences. This illustrates why an event tree may need separate consequence branches for property and people.

4. Fault-tree analysis

A fault tree is a deductive method. It begins with a top event, such as “automatic suppression fails,” and works backward to combinations of component failures that could produce it. Logical gates describe relationships:

• an OR gate means any input can cause the output;
• an AND gate means all specified inputs are required;
• a voting gate represents arrangements such as two-out-of-three success or failure.

If independent basic events A and B have probabilities P(A) and P(B), then:

The subtraction avoids counting the simultaneous occurrence twice. For rare, independent events, the approximation P(A OR B) ≈ P(A) + P(B) may be acceptable.

For an AND gate with independent inputs:

Worked example: failure of a fire pump start function

Suppose a fire pump fails to start if either the controller fails or the power supply fails. During a defined test interval:

• controller failure probability = 0.02;
• power-supply failure probability = 0.01.

Assuming independence:

The pump-start failure probability is therefore 2.98%, not 3.00% exactly. If both failures can arise from a shared electrical room flood or a common maintenance error, independence is invalid and the result may underestimate risk. Common-cause failures should be modelled explicitly or addressed through conservative assumptions.

Event trees and fault trees are complementary. A fault tree analyses why a protection function fails; an event tree analyses what happens after an initiating event. In complex studies they may be linked in a bow-tie model: threats lead to a top event, preventive barriers act before it, and mitigative barriers act after it.

5. Consequence estimation

5.1 Life-safety consequences

Life-safety analysis may consider smoke exposure, untenable conditions, delayed detection, escape time, rescue, and fire-service intervention. A simple risk estimate might use:

where R_F is expected fatalities per year, f is fire frequency per year, P(Fatality | fire) is the conditional probability of a fatality given the specified fire scenario, and N is the number of comparable exposure units. The model is only meaningful if the exposure unit and population are clearly defined.

More detailed evacuation analysis compares available safe egress time (ASET) with required safe egress time (RSET). A simplified safety margin is:

A positive margin does not guarantee safety because both quantities are distributions, not fixed constants. A more realistic assessment considers the probability that ASET < RSET, including detection, alarm, recognition, pre-movement, travel, congestion, and assistance requirements.

5.2 Property and business consequences

Property consequence may include structural damage, equipment replacement, stock loss, clean-up, and reinstatement. Business consequence may include lost production, temporary accommodation, supply-chain disruption, contractual penalties, and reputational effects. Double counting must be avoided: for example, lost production included in both “business interruption” and “total asset loss” may inflate the estimate.

A basic expected annual loss is:

The values should be expressed in the same currency and price base. If inflation, discounting, or time-dependent recovery is material, the analysis should state the chosen financial assumptions. Expected financial loss is not a substitute for life-safety judgement; a low monetary value cannot justify an intolerable risk to people.

6. Expected loss and decision-making

Worked example: comparing two controls

An illustrative manufacturing area has two relevant scenarios:

The baseline expected annual loss is:

A proposed suppression improvement reduces the escalated-fire frequency by 60% but does not change the small-fire frequency. The new escalated frequency is:

The post-control expected annual loss is:

The expected annual reduction is £3,600. If the annualised cost of the control, including inspection and maintenance, is £2,500, the expected monetary benefit exceeds the annual cost by £1,100. This supports the control economically, but the final decision must also consider regulatory duties, life safety, resilience, feasibility, and uncertainty.

A benefit–cost ratio can be expressed as:

Here BCR = 3,600/2,500 = 1.44. A ratio greater than 1 indicates that expected monetary benefits exceed stated costs under the model assumptions. It does not establish legal acceptability or prove that the control is unnecessary when the ratio is below 1.

7. Sensitivity analysis

Sensitivity analysis asks how much the conclusion changes when an input changes. It helps identify variables that deserve better data or stronger controls.

For a model output Y and input x, a local sensitivity measure may be expressed as:

This has units dependent on the variables. A dimensionless elasticity is often easier to compare:

It approximates the percentage change in output caused by a percentage change in the input, near a defined base case.

For the manufacturing example, the escalated-fire consequence contributes £6,000/year at baseline, while the small-fire contribution contributes only £960/year. The result is therefore more sensitive to the escalated-fire frequency and consequence. Improving estimates of sprinkler reliability, fire spread, and asset concentration may be more valuable than refining the small-fire frequency from 0.12 to 0.115 per year.

Useful techniques include:

• one-way sensitivity analysis: change one input at a time;
• two-way analysis: vary two influential inputs together;
• tornado diagrams: rank the effect of variables;
• scenario analysis: compare coherent optimistic, central, and adverse cases;
• threshold analysis: find the value at which a decision changes.

Sensitivity is not the same as uncertainty. Sensitivity describes the model’s response to input changes; uncertainty describes what is known or unknown about the input itself.

8. Uncertainty and ranges

8.1 Types of uncertainty

QFRA should distinguish:

• aleatory variability: natural variation, such as different ignition circumstances or occupant response;
• epistemic uncertainty: incomplete knowledge, such as limited failure data;
• model uncertainty: uncertainty arising from simplifying the physical or organisational system;
• parameter uncertainty: uncertainty in numerical inputs.

A point estimate conceals these differences. A range is often more honest. For example, an escalated-fire frequency may be estimated as 0.006/year with a plausible range of 0.003–0.012/year. Consequence may range from £250,000 to £700,000 depending on stock location and downtime.

A simple bounding calculation uses combinations of low and high values. If frequency and consequence are treated as independent ranges:

This produces a conservative envelope, not necessarily a statistical confidence interval. The low and high values may not occur together, and dependence between variables must be considered.

8.2 Probabilistic analysis

Where data and expertise justify it, uncertain inputs can be represented by probability distributions. Monte Carlo simulation samples each input repeatedly and calculates a distribution of risk outputs. The result may provide a median, percentile range, and probability that a decision threshold is exceeded.

Simulation does not eliminate poor assumptions. It can give a highly detailed distribution based on invalid independence assumptions or biased data. A transparent deterministic analysis with credible ranges is often preferable to an opaque simulation.

8.3 Communicating uncertainty

A professional report should state:

• the base-case estimate;
• the principal assumptions;
• the range or distribution used;
• the data quality and source;
• the dominant uncertainties;
• the effect on the recommended decision;
• actions required to reduce uncertainty.

If the decision remains the same across credible ranges, it is robust. If small changes reverse the decision, the analysis should recommend additional evidence, interim safeguards, or a precautionary approach.

9. Illustrative case study: cold-storage warehouse

Background

This fictional case concerns a 12,000 m² cold-storage warehouse containing palletised packaging and food products. Forklift charging, electrical distribution, battery equipment, and occasional contractor hot work are present. The warehouse operates continuously, with 18 workers on a typical shift and a larger population during dispatch periods.

Problem

Management must decide whether to install additional automatic detection and improve sprinkler monitoring in an older storage zone. Historical company data show two relevant fires in 100 comparable facility-years. One was controlled rapidly; the other caused extensive smoke and stock damage. Local records are insufficient to estimate severe-fire frequency directly.

Analysis

The observed initiating-fire frequency is:

Because the sample is small, this is treated as a central estimate rather than a precise truth. The team develops three outcome branches:

The expected consequence per initiating fire is:

The baseline expected annual loss is:

Engineering review indicates that improved detection and sprinkler monitoring could reduce the probability of major escalation from 0.05 to 0.02 and the probability of significant local damage from 0.25 to 0.20. The rapid-control branch then becomes 0.78. The post-control expected consequence is:

The post-control expected annual loss is:

The expected annual reduction is £1,056. If the annualised cost is £900, the expected monetary benefit is slightly greater than the cost. However, the most important reason for the project may be life safety and compliance rather than financial return. The team therefore examines alarm audibility, travel distances, impairment management, fire-service access, and the effect of cold-store conditions on detection and suppression.

Uncertainty and decision

The team tests a frequency range of 0.01–0.04 per year and major-fire probabilities of 0.02–0.08. The result varies substantially. Because the decision is sensitive to rare major outcomes, the team recommends obtaining insurer loss data, verifying sprinkler performance, and implementing a formal impairment procedure. Management approves the project, records the assumptions, and schedules a review after two years of operating data.

Learning points

1. Small datasets should not be treated as exact frequencies.
2. Rare, high-consequence branches can dominate expected loss.
3. Detection and suppression controls affect different parts of the event tree.
4. A financially marginal decision may still be justified by life-safety and regulatory considerations.
5. Data collection and review are part of risk control, not administrative additions.

10. Professional practice, ethics, and governance

Quantitative results can influence investment, occupancy, insurance, and emergency planning. Analysts therefore have a duty to avoid selective data use, hidden assumptions, and unjustified precision. A report should be reproducible: another competent analyst should be able to identify the data, equations, branch definitions, and calculations.

Important governance practices include:

• version control for models and input data;
• independent review of high-consequence analyses;
• documentation of exclusions and boundary conditions;
• explicit treatment of impairment and maintenance failures;
• protection of sensitive security information;
• consultation with workers and emergency responders;
• alignment with applicable fire-safety legislation, building requirements, codes, standards, and insurer conditions.

Legal compliance is a minimum requirement, not proof that risk is acceptable in every circumstance. Conversely, a numerical model should not be used to override a mandatory requirement. Where human life is at stake and evidence is weak, the precautionary principle may justify additional safeguards.

Artificial intelligence can assist with data classification, anomaly detection, document review, and scenario generation. It should not independently determine fire risk acceptance. AI outputs require verified data, explainable assumptions, competent review, and controls against biased or incomplete training data. A generated estimate is not evidence merely because it is numerically precise.

11. Best-practice workflow

A proportionate QFRA can follow this sequence:

1. Define objectives, boundaries, assets, occupants, and decision criteria.
2. Identify credible initiating events and avoid overlapping scenarios.
3. Gather relevant frequency, occupancy, equipment, and consequence data.
4. Construct event trees for outcome development.
5. Use fault trees to examine failure of important barriers.
6. Calculate frequencies, probabilities, consequences, and expected loss with consistent units.
7. Check that branches are mutually exclusive and collectively complete.
8. Test assumptions through sensitivity and scenario analysis.
9. Present ranges and data quality, not only a single number.
10. Compare options against legal, life-safety, technical, economic, and operational criteria.
11. Record decisions, responsibilities, inspection requirements, and review dates.
12. Update the analysis after incidents, changes, impairments, occupancy changes, or new evidence.

Chapter Summary

Quantitative fire risk analysis provides a structured way to estimate how often fire scenarios may occur, how protective systems influence outcomes, and what consequences may follow. Expected risk is commonly calculated by summing scenario frequency multiplied by consequence. Probability and frequency must be distinguished, and exposure must be defined before historical rates are transferred to a new setting.

Event trees proceed from initiating events to possible outcomes, while fault trees work backward from an undesired top event to combinations of failures. Reliability equations and logical gates support basic analysis, but assumptions concerning independence, constant failure rates, common-cause failures, and data quality must be stated. Consequence estimates should separately address life safety, property, business interruption, environmental harm, and other relevant objectives.

Expected loss can compare controls, but monetary optimisation cannot replace legal duties or life-safety judgement. Sensitivity analysis identifies influential inputs, whereas uncertainty analysis communicates incomplete knowledge and variability. Ranges, scenarios, and probabilistic methods are useful only when their assumptions are transparent. Professional QFRA is therefore not merely a calculation; it is a documented decision process based on evidence, competent judgement, proportionate modelling, and continual review.

Key Terms

Probability: A dimensionless measure of the chance that an event occurs within a defined condition or interval.

Frequency: The rate at which events occur, commonly expressed as events per year.

Exposure: The people, assets, activities, or time periods subject to a hazard.

Consequence: The outcome or severity produced by a fire scenario.

Expected loss: The probability- or frequency-weighted average loss over a defined period.

Initiating event: The event that starts a fire scenario or analysis sequence.

Scenario: A defined combination of initiating event, conditions, safeguards, and outcomes.

Event tree: An inductive model that follows success and failure branches from an initiating event.

Fault tree: A deductive logic model explaining how failures combine to produce a top event.

Top event: The undesired event at the starting point of a fault-tree analysis.

Basic event: A component or condition represented at the lowest practical level of a fault tree.

AND gate: A logic gate requiring all input events to occur.

OR gate: A logic gate in which any input event can produce the output event.

Conditional probability: The probability of an event given that another condition has occurred.

Reliability: The probability that a component performs its required function for a specified time.

Common-cause failure: Failure of multiple safeguards or components due to one shared cause.

Sensitivity analysis: Examination of how changes in inputs affect model outputs.

Uncertainty: Lack of complete knowledge about parameters, variability, or model structure.

Expected annual loss: The estimated average monetary loss per year across defined scenarios.

Bow-tie model: A combined representation linking preventive barriers, a top event, and mitigative barriers.

Review Questions

Short Answer Questions

1. Distinguish probability from frequency in fire risk analysis.
2. What is the purpose of defining exposure before applying historical fire data?
3. State the difference between an event tree and a fault tree.
4. Why must common-cause failures be considered in barrier analysis?
5. What is the difference between sensitivity and uncertainty?

Long Answer Questions

1. Explain how expected annual loss is calculated and discuss at least four assumptions that may affect its validity.
2. Describe the process of constructing an event tree for an initiating warehouse fire.
3. Explain AND and OR gates in fault-tree analysis and discuss the importance of independence assumptions.
4. Discuss how life-safety, property, business interruption, and environmental consequences should be treated in a QFRA.
5. Explain how a professional analyst should communicate uncertain or incomplete fire-frequency data.

Analytical / Application Questions

1. A facility has an initiating-fire frequency of 0.04 per year. Suppression succeeds with probability 0.85. If suppression fails, the fire service contains the fire with probability 0.50. Calculate the annual frequency of suppression-controlled fires, fire-service-contained fires, and escalated fires.
2. A fire pump-start function fails if either a controller with failure probability 0.03 or a power supply with failure probability 0.02 fails. Assuming independence, calculate the pump-start failure probability and explain how a common electrical-room hazard could change the result.
3. A proposed control costs £1,200 per year and reduces a fire scenario frequency from 0.01 to 0.004 per year. The consequence is £300,000 per event. Calculate the expected annual monetary benefit, compare it with the cost, and identify two non-financial factors that should influence the final decision.

Multiple Choice Questions with Answers

Question 1

Which expression represents expected risk across multiple fire scenarios?

A. R = ∑ᵢ fᵢCᵢ

B. R = ∑ᵢ fᵢ/Cᵢ

C. R = ∑ᵢ Cᵢ − fᵢ

D. R = fᵢ + Cᵢ

Correct Answer: A. R = ∑ᵢ fᵢCᵢ

Question 2

A fire frequency is 0.02 per year. Under a Poisson assumption, what is the approximate probability of at least one fire in five years?

A. 0.02%

B. 2.0%

C. 9.5%

D. 20.0%

Correct Answer: C. 9.5%

Question 3

What is the principal starting point of an event-tree analysis?

A. A final financial loss

B. An initiating event

C. A maintenance schedule

D. A legal standard

Correct Answer: B. An initiating event

Question 4

A fault tree uses an AND gate for two independent events with probabilities 0.1 and 0.2. What is the output probability?

A. 0.02

B. 0.08

C. 0.30

D. 0.50

Correct Answer: A. 0.02

Question 5

For independent events A and B with probabilities 0.02 and 0.01, what is P(A OR B)?

A. 0.0002

B. 0.0100

C. 0.0298

D. 0.0302

Correct Answer: C. 0.0298

Question 6

If four relevant fires occur over 200 facility-years, what is the estimated frequency?

A. 0.002 fires per year

B. 0.02 fires per year

C. 0.20 fires per year

D. 50 fires per year

Correct Answer: B. 0.02 fires per year

Question 7

Which statement best describes sensitivity analysis?

A. It proves that the base-case estimate is correct.

B. It examines how changes in inputs affect outputs.

C. It removes all model uncertainty.

D. It replaces the need for professional judgement.

Correct Answer: B. It examines how changes in inputs affect outputs.

Question 8

A scenario occurs at 0.01 per year and causes £300,000 per event. What is its expected annual loss?

A. £300

B. £3,000

C. £30,000

D. £300,000

Correct Answer: B. £3,000

Question 9

Which is an example of epistemic uncertainty?

A. Different occupants respond at different speeds.

B. A fire produces variable flame lengths.

C. The failure database contains very few relevant observations.

D. Wind direction changes during an incident.

Correct Answer: C. The failure database contains very few relevant observations.

Question 10

Why should monetary expected loss not be used as the sole life-safety decision criterion?

A. Money cannot be multiplied by frequency.

B. Life-safety duties and ethical considerations may require controls regardless of financial value.

C. Property consequences are always larger than fatality consequences.

D. Expected loss is only applicable to residential buildings.

Correct Answer: B. Life-safety duties and ethical considerations may require controls regardless of financial value.