Selection and evaluation of fire related scenarios in multifunctional buildings considering antagonistic attacks

Abstract

Multifunctional buildings have become more common in the last years. At the same time the threat from antagonistic attacks has increased. This presents challenges for the fire safety systems in multifunctional buildings since continuity of functions, especially those considered to be of societal importance, need to be operational and at the same time antagonistic exposures may present more challenging fire scenarios. A method for selection and evaluation of fire related scenarios in multifunctional buildings, that also considers antagonistic attacks, has been developed. Based on literature review and interviews with stakeholders typical for a multifunctional building, specific problem areas that the developed method needed to take into account were identified. A first framework for development of fire scenarios, developed by the authors in previous work, was refined taking into account the identified problem areas resulting in the method described in this article. The method, still simple to use, provides guidance on how to determine assets needing protection, relevant protection objectives, exposures (both accidental and antagonistic), fire related scenarios and evaluation of scenarios. The method also takes into account the inherent probability of failure for active systems, security features, domino effects and damage to protection systems due to antagonistic attacks.

Introduction

Multifunctional buildings, for terminology see Appendix, are characterized by the multiple social or commercial functions or occupancies located within a building or interconnected buildings. There is a trend when designing new buildings to locate many functions or occupancies within one building rather than designing several single purpose buildings as has been done previously. Almost every major city has one or more buildings that may be characterized as multifunctional, e.g. hosting theatres, a subway-station, a shopping center, restaurants, offices and/or hotels within the same building. These buildings are often open to the public hosting a variety of businesses and tenants as well as a large number of visitors. Often areas within these buildings host important societal functions such as; transport facilities, municipality offices etc. All of these factors contribute to the overall complexity, vulnerability and potentially unacceptable consequences to society if an incident was to occur. An incident in such a building may result in significant consequences as a result of death, property damage and impaired functions that may be essential to societal and/or business operations.

During the last decades terrorism and physical attacks on buildings have continued to increase (Brown and Lowe 2003) adding to the overall complexity and vulnerability for multifunctional buildings. Nilsson et al. (2012) conclude that the likelihood of an antagonistic attack is in the same order of magnitude, for some buildings, as is deemed to be unacceptable by some recommendations, and antagonistic attacks can therefore not be ignored. Det Norske Veritas (Davidsson et al. 1997) for example has suggested risk criteria for individual risk between 10^-5 and 10^-7 and between 10^-4 and 10^-6 per year for N = 1 with a slope of −1 for societal risk and Stewart (2008) suggests that the probability for a terror attack on a US commercial building is between 10^-6 and 10^-7. In addition, arson should also be considered as an antagonistic attack and is a relatively common event. Richards (2008) suggests that 15% of all fires in New Zealand are deliberately lit and for public buildings (retail shopping, cinemas etc.) this may be as high as 40%. Hall (2007) concluded that 6% of all fires in the US are intentional and Simonson (2007) states that at least 25% of all fires in Sweden are intentional. Some examples of antagonistic attacks that can be mentioned include; the subway arson fire in Korea 2003 (National Emergency Management Agency 2004), the underground explosion in the UK 2005 (Handley et al. 2009), the explosion in the World Trade Center 1993 (Isner and Klem 1993), the gas attack on the subway in Japan 1995 (Pangi 2002) and the bombings in Boston, USA, 2013 (Winter et al. 2013). Since multifunctional buildings host a large number of people, critical functions important to society and may be considered iconic buildings or historically significant etc. they are more likely to be selected as targets for antagonistic attacks. This is due to the fact that such an attack is likely to inflict significant emotional and/or economic damage as well as impairment to societally important functions (Brown and Lowe 2003). Further, antagonistic attacks have the potential to cause a long-term effect on society, beyond the physical damage and interruption of services. As an example, Rubin et al. (2007) concluded that the population had reduced their use of the public transportation system within the London area 8 months after the London bombings in 2005 by 19% and Handley et al. (2009) conclude that 45% of persons directly affected by the bombings reported disabling travel anxiety that had interfered with their everyday life. In addition when considering antagonistic attacks these can be considered catastrophic with a high potential of large fires. These large fires are perceived as less acceptable than ordinary fires (Wolski et al. 2000). Wolski et al. (2000) further state that the high-rise fire risk is perceived as catastrophic compared to for example the single-family home building fire. A high-rise fire can be compared to multifunctional buildings as they also are generally large and have a potential for catastrophic events. Wolski et al. (2000) discuss nine risk factors: volition; severity; effect manifestation; familiarity; controllability; benefit; necessity; exposure pattern and origin, that can be used to describe why people require a higher or lower safety level. Many of these factors point towards a required higher safety level in multifunctional buildings, especially if antagonistic exposure exists.

Traditional fire safety design, to obtain code compliance, focuses on life safety considering accidental fire events (Klason et al. 2011) and limited consideration is given to property protection and continuity of functions. Further scenarios incorporating antagonistic events are generally not considered by the building code (Gilbert et al. 2003) and the traditional prescriptive design generally does not account for arson fires since it does not consider the actions of the individual lighting the fire (Richards 2008 Klason et al. 2011). Due to the fact that antagonistic events can be more severe and carefully planned there is a potential for larger consequences, especially if such attacks have not been taken into account at the design phase. Antagonistic attacks, as seen in the above examples, can differ widely and it may be hard to define such a scenario. However, in multifunctional buildings, there is also a potential that other protection objectives than simply life safety are present, e.g. continuity of functions and protection of property that is generally not considered by building codes.

The large number of multifunctional buildings, where not only life safety is of concern but also continuity of operations and functions, and the increased threat for antagonistic attacks create a demand for a method analyzing the fire safety level from a holistic view. Such a method needs to incorporate life safety with regards to accidental fires as well as other protection objectives (e.g. continuity of functions, property, cultural heritage) and the possibility of antagonistic events. Most building codes are reliant on prescriptive rules, however these rules are inflexible if not applied to a historically traditional building (Frantzich 1998). Multifunctional buildings are by definition not traditional buildings even though the number has increased, hence a holistic method needs to be performance-based since such a method defines protection objectives to be achieved (Frantzich 1998) and there is a possibility to consider a large variety of scenarios. Such a method includes the management of hazards more severe than usually assumed for life safety design, fire spread prevention etc. in the current building codes.

A holistic method, for selection and evaluation of fire related scenarios in multifunctional buildings considering antagonistic attacks, must incorporate a selection of fire related scenarios that need to be analyzed and evaluated. Due to the wide variety of possible antagonistic attacks the method also needs to incorporate a structure to be able to determine relevant antagonistic threats and how such scenarios may develop, i.e. initiating event, possible domino effects etc. Although antagonistic attacks might include a much greater scope than simply fire related attacks, the aim of this method is to evaluate fire related scenarios and will therefore not include antagonistic attacks such as gas attacks, cyber attacks etc., however some parts of the method may be applicable for exposures other than fire. The defined scenarios must then challenge the protection objectives and be chosen based on an analysis of possible exposures. Finally an evaluation procedure, as to whether the protection objectives are met or not, needs to be specified. In summary such a method must:

• 1. Define what facilities/functions/property/life safety etc. (hereon called assets) need to be protected.

• 2. State clearly protection objectives for these assets.

• 3. Evaluate what exposures or threats (including antagonistic exposures) may cause the protection objectives not to be met.

• 4. Incorporate a selection of scenarios based on protection objectives and exposures.

• 5. Evaluate whether the protection objectives are met or not for the scenarios.

Goal, purpose and working process

The goal is to present a method for selection and evaluation of fire related scenarios in existing multifunctional buildings that also considers fire related antagonistic attacks. The working process to develop such a method is presented in Figure 1. The method should identify assets, relevant protection objectives and exposures, including fire related antagonistic exposures. Further it should incorporate the selection and quantification of fire related scenarios that may pose a threat to the protection objectives not being met. Finally, the method then needs to evaluate whether the protection objectives are met or not for the selected scenarios. The purpose of the method is to support prevention of fire related accidents and consequence mitigation in case of fire related accidents in multifunctional buildings, incorporating a variety of relevant protection objectives as well as fire related antagonistic events. The main field of application for the method is for existing buildings, however parts of the method may also be applicable for new designs.

Figure 1

Working process.

To develop the method the work was divided into four steps, represented by the four boxes in Figure 1. Two steps (step 1 and 3) comprised problem identification to support development of the method and two steps (step 2 and 4) comprised development of the method itself.

The problem identification steps had two problem focus areas for multifunctional buildings. The first was problems associated with multifunctionality can include a large number of tenants, variety of different functions, different occupancies etc. The second problem area was associated with antagonistic events, e.g. larger initiating events, degree of planning etc.

In step 1 (part of problem identification), a literature review was conducted which resulted in a first framework for development of fire scenarios in multifunctional buildings, i.e. step 2 (part of development of the method). This first framework and the conclusions from the literature review are described in Nilsson et al. (2012), however the main conclusions regarding problem areas are summarized below. The main focus of the literature review was identification of problems connected to multifunctionality and antagonistic events that the method needs to consider. The literature review also comprised a review on performance-based fire design guidelines to give input on possible evaluation procedures for multifunctional buildings. Overall, the literature reviewed included the following: performance-based design guidelines; design fire guidelines; papers regarding multifunctional/multipurpose buildings; design guidelines regarding antagonistic attacks; review of occurred antagonistic attacks and their implications.

In step 3 (part of problem identification), interviews with stakeholders in a selected multifunctional building were conducted. The selected building’s main purpose was infrastructure (transport center) but the building also hosted a large variety of other businesses and functions. A total of nine interviews were conducted with different business owners, rescue services, the safety management team, etc. The interviews were semi-structured, which gave the benefit of ensuring flexibility in how and in what sequence questions are asked, for the interviewees to be able to develop their thoughts and for the interviewer to be able to ask follow-up questions so that unexpected themes could emerge (Mason 2004). The aim of the interviews was to identify additional problems with respect to multifunctionality and antagonistic events that the stakeholders in multifunctional buildings are dealing with. Further, an understanding of how different stakeholders are working with these additional problems as well as protection against antagonistic attacks and their view on such exposures was also sought. In addition questions were asked to support refinement of the first framework for development of fire scenarios presented in Nilsson et al. (2012). An interview guide was created based on the purpose with the interview. The full description and findings of the interviews can be found in Nilsson and van Hees (2012), however the main conclusions are summarized in the following section. Additionally, an extended literature review was conducted on information obtained and deemed relevant during the interview process.

The first framework developed in step 2 (part of development of the method) and presented in Nilsson et al. (2012) was to some extent based on the SFPE engineering guides (SFPE 2006 2007), however with several modifications. Based on the information from the interviews and the extended literature review in step 3 (part of problem identification) a refinement of the first framework (developed in step 2 (part of development of the method)) was done in step 4 (part of development of the method). Step 4 (part of development of the method) resulted in the final method for selection and evaluation of fire related scenarios in multifunctional buildings considering antagonistic attacks. The method is presented in the following sections, however, first the results from step 1–3 are presented.

Problem identification to support development of method

Below are the results from the problem identification presented, starting with the literature review and then the interviews. Finally remarks and a summary are presented on aspects that need to be considered within the method.

Literature review

The literature review was conducted using Web of Science search engine for peer-reviewed papers. An extended search was also conducted to find appropriate standards, dissertations etc. The results are presented below.

Stakeholders

The nature of multifunctional buildings is to gather many different occupancies and businesses in one building. This results in the fact that there are many different functions provided and that there are many different stakeholders having interests in the building. One identified problem area in Nilsson et al. (2012) is that these stakeholders can have very different views on what needs to be protected resulting in a large variety of protection objectives or goals that needs to be accounted for. For some stakeholders fire safety might not be of primary concern while as others cannot accept an interruption to the functions they provide in case of fire. There might also be interdependencies causing problems further down the line warranting a higher safety level and the protection objectives might be considerably different from what the building code generally addresses (Nilsson et al. 2012).

Fire protection systems

Multifunctional buildings often incorporate a variety of different protection systems such as; active fire protection, e.g. sprinkler system, gaseous extinguishing systems and smoke evacuation, and passive fire protection; e.g. fire compartmentation and space separation. Building codes often focus on minimizing damage to third party by requiring fire protection systems such as physical separation or fire barriers between different occupancies within a multifunctional building and between different buildings. In reviewing previous real-life antagonistic attacks and their consequences it was noted that there is a tendency for protection systems to become impaired or not to function as expected during the course of an antagonistic event. This is especially true for antagonistic events involving explosions or highly energetic initiating events which may result in physical separation or fire barriers as well as the installed active protection being inadequate or damaged due to the initiating event. As an example the bombing of the World Trade Center (WTC), 1993, can be mentioned, where the fire alarm communication system (control center) was lost so that occupants did not get evacuation information, and masonry fire walls and fire doors were voided by the force of the explosion (Isner and Klem 1993). Normal and emergency electrical power was lost affecting sprinkler system as well as emergency lighting (Isner and Klem 1993) and the smoke management system was damaged (Quenemoen et al. 1996). The situation where a single failure (in this case electricity) is disabling several protection systems is often referred to as common-cause failure (CCF) and will be discussed further in the following sections. Other examples, where protection systems have been lost are; the arson fire in Gothenburg where the fire started in an evacuation route impairing its function (Eksborg et al. 2001) and the attack on WTC, 2001, where the structural fire protection was damaged by the plane crash (Gutierrez et al. 2005). Other issues with antagonistic attacks may be that fire protection is bypassed, there is the potential for multiple fires to be ignited which the protection cannot handle or the severity of the fire is too challenging for the protection (Richards 2008). Thompson and Bank (2007) also points out the importance of attacks on fire suppression systems and attacks against evacuation routes. Since a successful outcome of a fire often is dependent upon the effectiveness of the protection systems, special consideration is needed when considering antagonistic attacks. The potential for domino effects where the initiating event escalates, e.g. an explosion followed by a fire where the protection system is affected during the event, is pointed out in Nilsson et al. (2012) and needs to be incorporated in the analysis. Not only do these examples indicate the importance of the protection systems but also supporting systems such as electricity, i.e. damaging support systems could impair the protection system. This is analogous to important functions as well in case they are dependent upon support systems.

In addition it may also be the case that the protection system is not effective in achieving the protection objective, e.g. if an electrical room is of critical importance and the room is protected by sprinklers. In this case soot, heat etc. may cause too much damage to some of the electrical components before the system activates, even though the fire is controlled and does not spread outside the room (Nilsson et al. 2012).

Fire size and location

If a fire is started as part of an antagonistic attack flammable liquids or explosives may be used and in this case the fire development could potentially be accelerated when compared to that of an accidental cause (Richards 2008). This will have an impact on both life safety and other protection objectives. Generally buildings are not designed for arson fires, which is supported by the consequences related to the fire in Gothenburg (Eksborg et al. 2001) as well as the subway fire in Korea (National Emergency Management Agency 2004) with a large number of fatalities. In terms of multifunctionality there may also be sensitive equipment, support systems or rooms of special importance where even a small fire could cause large damage. Such small fires are generally not considered due to their limited effect on life safety, however these fires might be of great importance in terms of continuity of businesses and/or functions (Nilsson et al. 2012).

Both in terms of continuity of functions as well as antagonistic attacks the location of the fire is of great importance, a well-informed attacker might know exactly where to place the attack to achieve the most damage. An accidental fire at an unfortunate location might cause large consequences in terms of interruption to a function. The location of the fire therefore needs to be considered in the light of what is supposed to be protected (Nilsson et al. 2012). Unusual locations, i.e. fire locations not normally analyzed, might therefore need to be considered, for example; in sensitive areas or external facades which is a common starting area for arson fires (Klason et al. 2010).

Security and the aggressor

When reviewing design guidelines for protection against terror attacks and antagonist attacks such as Brown and Lowe (2003), it becomes clear that one of the main protection features against antagonistic attacks are security measures. Security includes surveillance, site perimeter protection, access control etc. and could help in limiting the exposure. If a building has a parking garage, vehicles that could carry potential hazards e.g. large amount of explosives, may have easy access to the building causing increased potential exposure, on the other hand if there is no parking garage the exposure may be limited to what one can carry. Analysis of the security system is therefore necessary.

Brown and Lowe (2003) suggest an evaluation of the aggressor and they state that terrorism attacks are likely to be conducted because the aggressors seek e.g. publicity for their cause, monetary gain or political gain through their actions. Richards (2008) lists the reasons for arson as vandalism, excitement, revenge, crime concealment, profit and extremist beliefs. Brown and Lowe (2003) point out the significance of understanding who the people are that want to cause harm, their means and resources. All this information provides input to be able to determine what the relevant antagonistic scenarios are that could occur.

Interviews

The conclusions and results from the interviews are given in full in Nilsson and van Hees (2012) and are, therefore only, summarized below. The interviews focused on questions related to the first framework for the method, i.e. “Assets worth to preserve” (called assets further on), “Protection objectives”, “Exposure analysis” and “Fire scenarios”, for further information see Nilsson et al. (2012). When conducting the interviews and visiting the specific building it became clear that to be able to do an analysis of such a complex building, the method needs to be simple enough so that the user is able to identify scenarios to be analyzed during a site visit.

Assets and protection objectives

The interviewees were of the opinion that the highest priority in terms of fire safety should be given to life safety and the second most important to protect was functions deemed societally important, in this case infrastructural functions within the building. Within the building of concern there were many other functions, but the main focus of the interviewees was aimed towards the core functions of the building, in this case infrastructure functions (transport center). Therefore the determination of building core functions needs to be part of the method, which is also pointed out by Brown and Lowe (2003). In order to facilitate continuity of such functions a variety of support systems are needed, examples given were electricity, control rooms, telecommunications, physical infrastructure etc. An example was given where a fire damaged a cable used for telecommunications, and caused interruption to municipality functions. Another area that the interviewees focused on was areas or functions needed to be able to handle an ongoing incident, such as dispatch centrals etc.

During the interviews it became clear that stakeholders who took part in the interviews did not have a clear opinion about protection objectives. The protection objectives were of the form “no one is supposed to get hurt”, “we do not allow any interruption to our services” etc. Additionally, during the interviews the stakeholders raised questions showing that they started to consider these issues more seriously and realized that protection objectives need to be firm and measureable. Further, they had a sense for possible make-up in case there was to be loss of a function but the procedures and potential for make-up was not formalized.

Exposures

The interviewees associated areas with high occupant density to be weak points of the building, they also considered areas where there are large amounts of combustible or flammable materials together with areas where vehicles have access and where the fire intensity can be large to be of importance. Another exposure that was brought up by the interviewees was areas in which people (i.e. the general population) have easy access and can prepare an antagonistic attack without anyone noticing, i.e. where the security was considered to be poor.

Management and multi-tenant issues

Most interviewees stated that their main protective measures against fire and antagonistic attacks are the emergency management plans and action plans put in place in case of an accident. These plans do not generally consider how to address the fire itself but rather how to evacuate the premises or how to act upon seeing a suspicious bag that may contain explosives or how to coordinate efforts with the fire rescue service. Not all the interviewees had their own plans and none of the interviewees were aware of what plans their neighbor had, i.e. there is no holistic view from the building management. Management and action plans will of course have an effect on the scenario and the method needs to be flexible enough to account for that.

A problem that some interviewees raised was that the tenants within the building had a very different view on what level of fire safety should be achieved and none of the tenants had made an assessment on how other businesses within the building may be exposing their own business.

Fire protection systems

During the interviews there were indications that the landlord was not fully aware of how the fire protection systems within the building was supposed to work, e.g. whether there was a programmed delay from detection to sounding the evacuation alarm. There were also indications that the sprinkler system was not maintained properly. Further the tenants were not aware of the limitations of the protection systems, in terms of storage heights etc., which may result in storage configurations or occupancies exceeding the design limits of the suppression systems. This again reinforces the need to analyze a scenario in which active fire protection systems fail. Further, in one fire case, the fire compartmentation did not fulfill its task and extensive smoke spread occurred, hence the method not only should consider active fire protection systems, but, needs to evaluate deficiencies in, and the reliability of, passive protection systems as well.

Rescue service

During the interviews with the rescue service they stated that there is often too high an expectation on what the rescue service can achieve. As examples of such expectations were given the ability to control and handle technical systems as well as the belief that the rescue service can fight a fire with higher heat release rate than they actually are able to. Another issue that they raised was that their access routes often collide with evacuation routes, making it harder for them to undertake a rescue operation.

Antagonism

When the interviewees were asked what kind of antagonistic threats they could imagine happening, the general opinion was that this is highly dependent upon what the aggressor wants to achieve and the aggressor’s imagination, indicating the need for aggressor evaluation. One interesting antagonistic exposure that was raised was the fact that there was an action plan in place stating that if a vehicle receives a bomb threat, and there are limited means to evacuate the vehicle at its current location, the vehicle should be brought into the multifunctional building for evacuation. This action plan results in the fact that the exposure, i.e. the potential bomb, is actually brought into the building.

Discussion and summary of the problem identification

In the following section, remarks and thoughts are discussed on some areas identified in the literature review and during the interviews. The issues raised during the interviews are dependent upon the interviewees and the choice of building. The results from the interviews, however, have been generalized to be applicable to multifunctional buildings in general. The interviews in combination with the literature review helped to make sure that important issues are identified and that the risk of excluding important issues is minimized. In the next section a summary of identified problems is given.

Discussion regarding the problem identification

The large number of stakeholders within a multifunctional building present challenges as discussed above, e.g. many different protection objectives and goals for the fire safety, the stakeholders do not “know” each other etc. Even though not explicitly identified within the literature review or interviews it is probable that the stakeholders will have different financial prerequisites influencing their goals with regards to fire safety and their ability to achieve those goals. Further, different stakeholders will also have different exposures from antagonistic threats; some will be more exposed than others. Even though an antagonistic exposure may not exist against an important function there might still be risk of exposure due to the fact that a neighbor could potentially be exposed. The number of stakeholders presents challenges as identified above and the method needs to be able to handle these challenges and work despite these difficulties.

The number of fire protection systems within a multifunctional building can be large due to the required flexibility of the building, e.g. large open spaces, varying occupancies, etc. If these systems are integrated with each other, say dependent upon electricity or smoke detector activation there is a risk of common-cause failure (CCF), i.e. a single fault disabling several protection systems (Lundin 2005). This is an aspect that needs to be covered in the method. However, there may be systems that are considered not to be integrated with each other, e.g. if redundancy is provided for electricity by emergency power to minimize the probability of CCF. Emergency electrical power had been provided in the WTC to minimize the risk of a CCF, however the initiating event impaired both the normal and emergency power systems (Isner and Klem 1993). This illustrates that there is still a probability for CCF’s since there is dependency upon electricity even though redundancy was provided to minimize the probability of a CCF. This illustrates the potential for increased probability of a CCF when the initiating event is more severe and widespread, in the described case for instance, a bomb. This implies that systems considered not to be integrated may need to be considered as integrated depending on the scenario.

The need for evaluation of an aggressor when considering antagonistic attacks was pointed out both in the literature review and during the interviews. Such an evaluation should be conducted as part of the analysis, however it is clear that a continuous evaluation and external environment monitoring will be necessary during the life time of the building due to changing circumstances.

The development process during the interviews, e.g. stakeholders realizing that protection objectives need to be firm and measurable, indicates the need for the stakeholders to be part of an evaluation process. Just by performing an evaluation, the fire safety level will increase due to raised awareness. The large number of stakeholders in a multifunctional building means that it is important to determine which stakeholders should be present in order to make the evaluation process effective.

The interviewees divided the weak points into two main categories, areas with high occupant density and areas with high fire severity or high probability of fire ocurring. In the first framework these can be divided into two separate issues, a large amount of people is an asset while as fire severity or risk of fire is an exposure. The exposure needs to be considered in the light of the asset, there is no point in analyzing a fire if it is not exposing the asset. Therefore the initial assumption, in the first framework, that the analysis should have its starting point in the asset is still valid. Further the issue with neighbors becoming exposure risks needs to be covered in the exposure analysis and the method needs to make sure that this is considered, as the interviews indicated that this is not the case today.

In general the interviewees deemed electrical appliances rooms, telecommunication rooms, computer rooms etc. important for continuity of functions. These areas are very sensitive to fire damage, especially smoke and there is a need to investigate efficient protection options for these areas. This might include clean agent extinguishing systems (FM Global 2010), hypoxic air-venting systems (BSI 2011 VdS 2007 Nilsson and van Hees 2013) and the like.

The uncertainties in what the rescue service can achieve in the case of an accident indicates that the efforts made by the fire rescue service should not be taken into account when evaluating or designing a multifunctional building, at least not in Sweden with the resources the fire rescue service has there. However the fire rescue service may be able to help with management, communication, coordination etc. during an incident. This however requires planning and that the fire rescue service is included in the emergency management plans for the facility.

Summary of specific problems the method needs to consider

In Table 1 below the identified problems that need to be accounted for in the method are summarized. It should be noted that these problems are in addition to or of greater importance than when evaluating or designing a building not considering antagonistic attacks or multifunctionality such as when using general strategies as described in guidelines from SFPE (2006 2007).

Table 1 Problems to consider in the method

Method for selection and evaluation of fire related scenarios

The overall method for selection and evaluation of fire related scenarios is shown in Figure 2. Due to the fact that the main purpose of the method is to evaluate existing buildings and that there is often limited time available to get access to the building, stakeholders etc. the method needs to be fairly easy and straightforward. In practice, during a site visit, there is a need to be able to identify how a scenario may develop, i.e. qualitatively describe the scenario, and later in the process quantify that scenario. Given the possible amount of scenarios and the many different ways these can develop it would not be feasible to identify all possible scenario developments during a site visit. Therefore it was chosen to base the method upon scenario analysis choosing a worst-credible case for every scenario to be analyzed. A scenario chosen this way will also cover a range of other possible scenario developments due to the fact that such a scenario is more challenging than the majority of other possible scenarios.

Figure 2

Overview of method for development and evaluation of fire scenarios in multifunctional buildings. (WCC = Worst credible consequence, AASW = All active systems working, OASI = One active system impaired, AS = Active system).

With scenario analysis uncertainties are handled by choosing ‘the worst possible conditions that could reasonably be expected’ (Paté-Cornell 1996), i.e. choosing conservative values, which is what Paté-Cornell (1996) refers to as Level 2 when treating uncertainties. Level 2 implies that uncertainties for different parameters, such as heat release rate etc., are handled by choosing values that are judged to be on the conservative side, i.e. based on the current knowledge more severe values are thought to be unlikely. The benefit with using scenario analysis is that it is a simple approach and it is transparent, it is known what the scenarios are that have been designed and accounted for. The method outlined in this paper is therefore primarily based upon scenario analysis (treatment of uncertainties on Level 2 according to Paté-Cornell (1996)) and the first analyses in the method are conducted with scenario analysis.

One disadvantage with treating uncertainties by choosing conservative values is the matter of not knowing how conservative the chosen values are, i.e. the uncertainties are not quantified and the risk is unknown (Paté-Cornell 1996). Therefore treating uncertainties this way presents shortcomings in the risk management phase when the risks cannot be reduced enough at low costs and when under budget restraints (Paté-Cornell 1996). Since the risk is not quantified there is no way to determine cost effective mitigating measures or to prioritize what scenarios to address. Due to these reasons there is a possibility that the first scenario analyses, i.e. the level 2 analyses, do not give satisfactory results, i.e. it cannot be concluded that the situation is acceptable. If this is the case the method will recommend that a Quantitative Risk Assessment (QRA) be performed. QRA corresponds to what Paté-Cornell (1996) classifies as Level 4 regarding the treating of uncertainties. The reasoning behind this approach is that it is ineffective, unpractical and time consuming to perform a full QRA if it is not warranted and sufficient information can be obtained using simpler methods.

Determine prerequisites

The first step in the evaluation process is to determine the prerequisites for the evaluation. In order to determine what is supposed to be analyzed, it is important to determine the core functions of the building so that the efforts and resources are allocated for evaluating the fire safety according to the level of importance of these functions. If for example the core functions of the building are infrastructure and municipality functions and there are large number of visitors, the efforts should be directed towards maintaining those functions and ensuring life safety in case of fire. Less important functions in the building such as smaller shops, restaurants etc. should not be given the same attention since it does not fall within the core functions of the building. However these businesses need to be considered as potential exposures to the core functions. Once the core functions have been determined, relevant stakeholders associated with these functions can also be determined. There may also be other indirect stakeholders that have a vested interest in the building’s safety, such as authorities, that need to take part in the evaluation. Tables 2 and 3 can be used for guidance on finding core functions and relevant stakeholders. The stakeholders are of great importance for the further evaluation since they need to provide a lot of information on how the functions of the building are provided. The possible stakeholders are mainly obtained from Brown and Lowe (2003) and SFPE (2006) but have been divided into primary and indirect stakeholders. The indirect stakeholders might have information giving value to the analysis, e.g. the police with regards to recent antagonistic threats in the area or the fire brigade giving input on how they may intervene in case of fire.

Table 2 Examples of core functions

Table 3 Examples of stakeholders

When determining the prerequisites for the evaluation, building and occupant characteristics must also be determined (Nilsson et al. 2012). The characteristics of the occupants within the building as well as the buildings functional, geometric and operational characteristics will be the basis for developing the fire related scenarios. Examples of these factors include, but are not limited to, spatial connection and/or separation between fire compartments, the flow of people at the time of building use, the evacuation routes, issues with regards to the variety of business types and hours, the management form and responsibilities among different tenants, emergency action plan and evacuation guidance depending on tenants and floors, mutual communication between each tenant and the emergency operation center etc. Other issues that may affect the evaluation include, but are not limited to, property location, utilities, applicable regulations etc.

Assets

The next step in the method for developing fire scenarios is to determine the assets that need to be protected. An asset is a resource requiring protection (Brown and Lowe 2003) and can be humans, functions, property etc. In order to be able to determine the relevant assets, input is needed from the stakeholders (determined in the previous step). During the interviews it was found that the discussion itself is a useful way of determining assets and such a discussion could be a helpful tool in an evaluation process. The relevant assets need to be determined based upon the core functions of the building so that the evaluation is focused based on the level of importance. For the purpose of this method assets have been divided into four main categories: life safety; property; environmental and functions, based upon the work in Nilsson et al. (2012). To provide guidance in finding relevant assets, Table 4 may be used.

Table 4 Examples of assets

The assets life safety, property and environment are generally fairly straightforward as opposed to what the functions might be. Providing a main function, such as train transport, might be highly dependent upon other functions supporting the main function, e.g. electricity, tracks, telecommunications etc. These supporting functions or ‘support systems’, need to be determined. Brown and Lowe (2003) suggest a two-step method, the first step is to define and understand the main function of interest and then identify the building infrastructure. This way, vulnerabilities are identified and focus is put on what a building does, how this is achieved and how various threats may affect the building (Brown and Lowe 2003). By using this approach focus is given to the support systems that were deemed important during the interviews. Using the asset evaluation form in Table 5 guidance is given to find different support systems. Further, to address the importance of functions that is needed to handle an ongoing incident, these functions have been listed in Table 4. Such functions may be control rooms, communication centrals or actual protection systems. Due to the determined importance and proneness to loss of protection systems in some scenarios a form for evaluating active fire protection systems has been developed, this is found in Table 6, and the usage of this form is discussed further under the section Quantification of scenarios.

Table 5 Asset evaluation form with examples

Table 6 Active protection system evaluation with examples

As noted in Nilsson et al. (2012) it should also be considered that the loss of property or environmental damages could result in the loss of a core function. Naturally if a building is lost it will be unavailable to provide its functions and authorities may forbid operation if functions needed to ensure environmental control, required by law, have been lost.

Protection objectives and associated damage criteria

Protection objectives need to be developed for the assets and will vary depending on the asset. Some protection objectives might be governed by legislation, e.g. life safety and environmental. Most building codes have a life safety protection objective stating something like “in case of fire, occupants should be able to leave the building in reasonable safety or the risk to occupants should be acceptably low”, for examples refer to NFPA (2012), Swedish National Board of Housing, Building and Planning (2011a) and BSI (2001). However, this protection objective is quite vague, a more precise protection objective for life safety may be that no people should die in case of fire in the building. However such a protection objective may not be achievable in every scenario and it may be necessary to develop more sophisticated protection objectives such as acceptable number of injured people or fatalities depending on the severity of the scenario. Life safety protection objectives may also, for example, be expressed as acceptable individual and societal risk. In order to be able to assess whether the protection objective is achieved or not, damage criterion associated with the protection objective needs to be developed, i.e. at what measureable impact is the protection objective not met. Most building codes have a set of damage criteria associated with life safety, one example is visibility of not less than 10 m, for example refer to BSI (2004) and Swedish National Board of Housing, Building and Planning (2011b). The International Code Council (ICC) (2011) has established protection objectives in the form of different acceptable impacts where for example, acceptable structural damage has been qualitatively described, such as “moderate structural damage, which is repairable”. Such descriptions of protection objectives and associated damage criteria might be useful and the code is recommended for input and further guidance. However the damage criterion needs to be further quantified in these cases, than is done in the code, and in terms of ‘at what impact’ the protection objective is not met, e.g. at what pressure or force is the structure damaged. Depending on the scenario, the damage criterion may differ, e.g. in case of an explosion an acceptable level of elevated pressures may be needed.

Property damage objectives might be expressed as acceptable monetary value of loss or as an acceptable damage area and environmental objectives are typically defined in terms of contamination of a medium (Nilsson et al. 2012). Again a damage criterion need to be associated with the protection objective in order to determine at what exposure level from the fire is the protection objective not met.

The protection objectives for functions however, may be more difficult to determine. Loss of functions is often associated with interruption to services, e.g. a business or important societal function. As stated above support systems may be of great importance and important support systems may also need protection objectives and associated damage criteria in order to be able to ascertain the overall protection objective for the determined asset. There is a need for a structured method to find appropriate protection objectives and to identify the different support systems that are important. In order to facilitate this process the stakeholders need to be interviewed to gain information, also Table 5 can be used for guidance to help find critical support systems. A structured way of determining protection objectives for functions is again to focus on core functions and it is essential to determine how the facility fits into the “big picture”, i.e. how critical the facility is to the organization’s operation, after that protection objectives can be established (SFPE 2006). One suitable way of establishing the objectives is to conduct a business impact analysis (BIA), often done for IT systems (Bowen et al. 2006) and as recommended in NFPA 1600 “Standard on Disaster/Emergency Management and Business Continuity Programs” (NFPA 2013). A BIA identifies a system’s critical resources, each resource is then further examined to determine how long functionality of the resource could be withheld before an unacceptable impact is experienced (Bowen et al. 2006). The time identified is maximum allowable outage (MAO) and the balancing point between MAO and the cost for recovery establishes the Recovery Time Objective (RTO). This method can be applied to multifunctional buildings as well by establishing the impact on a function if loss occurs of a component or support system. Recovery strategies together with protection should then result in a downtime less than the RTO. It might also be beneficial to include loss of customers due to prolonged downtime in this analysis. Damage criteria depend on the support systems or resources required to maintain the functions and could include equipment, personnel etc. Business continuity plans and possible make-up at other locations can be incorporated into this analysis. To determine opportunities such as make-up and to establish business continuity plans, standards for business continuity planning and emergency management such as NFPA 1600 (NFPA 2013) can be utilized. If there is make-up available at other locations this might allow for a longer RTO.

Virtually any protection objective can be chosen for any asset, hence the method fulfills the requirement of being able to address a large variety of protection objectives. Further this step also focuses on support systems and therefore also addresses the issue of identifying critical fire locations. In Table 5 examples are given of protection objectives as well as associated damage criteria.

Exposure analysis

The next step in the method is to determine the hazards/threats that could pose a risk that the protection objectives are not met for the specified assets and associated support systems. This is referred to as an exposure analysis, sometimes called hazard identification. A hazard is a condition or physical situation with a potential to cause harm (SFPE 2006). A physical hazard might be flammable liquids or combustibles, but if a hazard relates to a person or group it will normally be defined in terms of state of knowledge, attitude or belief that is characterized as human action within an event (Nilsson et al. 2012). Sometimes the physical hazard might be separated from the asset, e.g. by physical separation, fire compartmentation or by active fire protection systems etc. Therefore it is essential to evaluate how the asset is protected from any hazards. To facilitate this, the asset evaluation form can be used as a checklist, see Table 5. The checklist contains an evaluation of the construction, i.e. is it fire rated, are penetrations sealed etc. Further it contains an evaluation of the occupancy and the associated hazards that comes as a natural consequence of the occupancy, the protection and security features are also evaluated. Hence, the asset evaluation form addresses the identified issue with for example maintenance of fire separation not being adequate and other potential deficiencies in construction features as well as evaluation of security features mitigating the exposures.

Exposures are divided into two main types based on the work by Nilsson et al. (2012), accidental/natural exposures and antagonistic exposures. If the exposure is actually endangering the asset, needs to be determined based upon location of the asset in relation to the exposure, hence the construction features and physical separation in the asset evaluation form, Table 5, need to be considered. Based on the exposures identified according to the sections below possible, scenarios can be added to Table 5.

Accidental/natural exposures

Accidental/natural exposures are exposures causing an accidental fire, i.e. without intention. An example can be a fire in regular combustible material that was ignited by an electrical fault or through hot work operations, in this case the exposures being the combustible material and the ignition source. Accidental/natural exposures that present an exposure to life safety are generally considered by the building code. For multifunctional buildings however, a larger focus on the functions is needed, which follows from the determined assets and their support systems (Nilsson et al. 2012). It is important not to overlook any exposures that may expose the assets (including their support systems), there may be what could generally be considered a small exposure, say a small fire in an electrical room, that may not generally be analyzed. However this smaller fire might cause the damage criterion for an asset or support system to be exceeded hence the protection objective may be exceeded. It is therefore important to consider the exposure in relation to the damage criterion and the protection objective, if these are reflecting a high proneness to fire damage these small exposures need to be considered as well. For accidental/natural exposures the method for hazard identification in the SFPE engineering guide has been adapted and a more detailed description can be found in that guide (SFPE 2006). Also Table 7 can be used for guidance in finding exposures. The accidental/natural exposures have also been divided into Internal and External exposures just to raise the awareness that there may be exposures further away from the building itself endangering the protection objectives, one example could be a fire at a neighbor, a gas explosion further away or a train on fire entering the building.

Table 7 Examples of accidental/natural exposures

Antagonistic exposures

As determined by the literature review and the interviews the way an antagonistic attack may develop can vary considerably and the literature gives a broad list of possible attacks. Examples from Brown and Lowe (2003) and Thompson and Bank (2007) include, explosion, arson, fire as a secondary effect to blast, attacks on load-bearing members, bypassing fire protection, attacks against evacuation routes to slow down evacuation etc.

Additionally, with antagonistic attacks the possibility that the attack is targeted against something else needs to be considered, there may be tenants within the building having a more severe antagonistic threat against them than the core functions considered. One example was given during the interviews where the procedure was to transport a bomb-threatened vehicle (say train, ferry, airplane) into the multifunctional building in order to evacuate the vehicle. This due to the fact that provisions in the multifunctional building made evacuation quicker.

The exposure from antagonistic events is a combination of many factors. Brown and Lowe (2003) suggest an approach where the existence of a threat, the capability of the aggressor, history of attacks and intentions of the aggressor is evaluated in order to give guidance regarding the exposure. Nilsson et al. (2012) suggested adding threats and security to this as well and the approach given in Nilsson et al. (2012) is chosen in this method for evaluating the exposure from antagonistic threats. In order to be able to determine the existence and history of an exposure, input from different stakeholders is needed. Tenants and owners may know if they have experienced attacks before and the police or fire department may have information on vandalism in the area etc. The intentions to conduct an antagonistic attack will give one piece of information on how the attack may be conducted. Adding the factor of security will give guidance on the magnitude of the scenario as well, e.g. if a car cannot enter the building the amount of explosives or accelerants that can be brought into the building may be limited and the exposure less severe. Table 8 presents steps to go through to determine antagonistic exposures. It should be noted that the table is not conclusive and the process is somewhat iterative; sometimes starting with the aggressor and its capabilities, sometimes with possible scenarios and then determine who has that capability.

Table 8 Antagonistic exposures

It needs to be recognized that antagonistic attacks may be more severe and targeted as opposed to accidental/natural exposures. A well-informed attacker may know exactly where to strike to achieve the intention of the attack, therefore focus need to be put on the assets when determining exposures. When considering the severity of an attack, explosives, flammable liquids etc. has the potential for a rapid development of a scenario with potential for domino effects such as a fire followed by an explosion. Security features, i.e. how much hazardous material can be transported into the area of interest, give some guidance on severity as do the evaluation of the aggressor’s capability. However, there is a clear possibility for extreme events, i.e. events exceeding the design level event (Bukowski 2006), when considering antagonistic attacks. Brown and Lowe (2003), however, state that the more secure a building is and the better designed it is to resist an antagonistic threat, not only will the damage probably be less severe, but the building is also less likely to be picked as a target. The procedure described above and in Table 8 gives guidance on what possible exposures may be present. Whether the building should be designed to resist those exposures or not is up to the relevant stakeholders.

Selection of scenarios to analyze and qualitative description

Based on the determined assets, the protection objectives and the exposure analysis, fire related scenarios challenging the protection objectives have been identified and listed in the asset evaluation form (Table 5). At this stage the scenarios have not been quantified but are rather described with qualitative characteristics such as initiating event, fire spread to secondary rooms, etc. An example would be “An explosion in the mail room, tearing down the fire wall and damaging sprinkler piping causing extensive fire spread to the adjacent computer room”. In the qualitative description of the scenario it is important to list possible domino effects, such as a fire following an explosion or damage to fire walls resulting in larger damaged areas. The possibilities of domino effects need to be recognized at this early stage and later quantified during the quantification of the scenario to determine if such a scenario is possible and if it will develop as first described qualitatively. Further variation in time and room need to be considered, if e.g. life safety is of concern there may be large variations in occupant density depending on time of the day and location within the building. The same may also be true for other protection objectives, e.g. interruption to transportation facilities may have greater consequences during rush hours. From the previous steps the identified number of scenarios are likely to be unmanageable and the scenarios need to be merged into clusters (SFPE 2006). From each cluster one or more scenarios are chosen for further quantification in order to represent the other scenarios within the cluster in terms of challenging the stated protection objectives. Another input on the choice of scenarios that should be further analyzed and quantified can be given by listing the scenarios and determine how many assets each scenario threatens. Scenarios that pose a threat to several assets may be more critical to analyze.

Quantification of scenarios

The scenarios chosen for further analysis, in the previous step, need to be fully quantified, e.g. heat release rate (HRR), soot production etc. need to be specified. The process is described in Figure 3 below and is based on the method presented in Staffansson (2010) and further details on how to quantify e.g. HRR can be found in this literature. However factors affecting the scenario need to be defined and should at least include building, occupants and fire characteristics (SFPE 2007). In large these factors have already been determined while using the asset evaluation form presented in Table 5. Occupant characteristics may not have been determined, however if life safety is to be evaluated this needs to be done.

Figure 3

Fire related scenario development.

The quantification of fire scenarios, and determination if the protection objectives are met or not, is done in three steps. The three steps are illustrated in Figure 3 and the complexity of the analysis increases with each step, if it is necessary to continue to the next step. The idea is to do an initial screening on whether a detailed analysis is needed or not and still to some extent include the probability of failure of active fire protection systems as this has been identified as important when considering antagonistic threats. Further, the consequences can be determined for the specific scenario. The three steps are scenario based and treat uncertainties on Level 2 according to Paté-Cornell (1996), i.e. by choosing conservative values. If the design cannot be deemed to be acceptable after these three steps a QRA is recommended. QRA is outside the scope of this article and therefore not discussed further.

Scenarios incorporating antagonistic events have a potential to be more severe, this has been discussed above, e.g. flammable liquids present the potential of a fast developing fire (Richards 2008) and of course an explosion can create a significant damage. As discussed in the Literature review section there is a potential that fire protection systems, both active (sprinkler, self closing doors etc.) and passive (fire barriers, physical separation etc.) are inadequate or damaged if the initiating event is severe, e.g. an explosion. To handle this within the method a question is always asked whether the passive/active fire protection is still operational after the initiating event, see Figure 3. These factors need to be included in the evaluation and should have its starting point in the assets as well as the exposure analysis and be qualitatively described in the previous step. In this step the basis of quantifying this scenario need to be developed, e.g. what kind of flammable liquid, amount etc., i.e. input needed in order to calculate the scenario.

Worst credible consequence (WCC)

The worst credible consequence (WCC) scenario is the first step in evaluating a scenario. It considers the scenario when all active fire protection systems are impaired. Active fire protection systems can be active fire suppression systems such as sprinklers, evacuation alarm, self closing doors activated by smoke detection etc. This scenario has similarities with maximum foreseeable loss or estimated maximum loss within the insurance industry. However, it should be pointed out that different insurance companies have different definitions, some assumes that fire walls are not breeched and others require a special fire wall or physical separation if it should be assumed to limit the fire damage. The benefit of analyzing this scenario is that it provides information to whether active fire protection systems are needed to meet the protection objectives. If the protection objectives are met without any active fire protection system there is no need to conduct any further analysis of the scenario. Further, if protection objectives are met, there is no need to analyze impairment of the fire protection systems due to any reason (as part of antagonistic attack or common failures), hence there is no need to analyze the availability and reliability of the systems.

Depending on the initiating event impairment of passive fire protection may also occur, especially when considering antagonistic attacks, e.g. fire walls may be damaged, structural fire protection may be damaged or evacuation routes may be blocked as recognized in the literature review. This is considered in the second box in Figure 3.

All active systems working (AASW)

The next step in the method is to evaluate the scenario with all active fire protection systems operational, i.e. the active systems are available at the time when the initiating event occurs and continue to operate during the fire scenario, if the system is not physically damaged by the initiating event. For a system to be available during the scenario means e.g. that for a sprinkler system the pump is in automatic and all appropriate valves are opened etc. However, the initiating event might still cause the active protection system to fail, one example would be an explosion tearing down a wall bringing sprinkler pipes down rendering the system ineffective (Nilsson et al. 2012), this is what is checked in the second box in Figure 3. Another example is that the systems are bypassed as a part of an antagonistic attack or a wall is damaged to a room protected with hypoxic-airventing as is suitable for some areas in multifunctional buildings, e.g. electrical rooms (Nilsson and van Hees 2013). Such considerations are all addressed in the second box in Figure 3.

If the fire safety systems are not impaired due to the initiating event, there is still the question whether the system effectively will control or protect against the event. How different active systems affect the fire development in a building with an occupancy it is designed for and with a general fire initiation can be found in the literature (Nystedt 2011 Madrzykowski and Vettori 1992 Evans 1993, Swedish National Board of Housing, Building and Planning 2011b). However the effectiveness needs to be determined against the stated protection objectives and the anticipated fire hazard the system was designed for. If the fire hazard for some reason is higher than what was designed for, e.g. if multiple fires are started as part of an antagonistic event (Richards 2008) or if the protection objective concerns e.g. contamination, then the suppression system might be ineffective (Nilsson et al. 2012). A fire in a computer room for example may be adequately controlled by a sprinkler system to not spread further within the building but the protection objective for functional performance of the computer system may be exceeded due to smoke or water damage.

During the interviews a need was identified for flexibility to include how action plans, emergency management plans, fire rescue service etc. affect the scenario. As pointed out by Lundin (2001) the effect of human interaction during an event is very hard to predict and model, therefore caution need to be applied. However there is a flexibility to include any damage mitigating actions into the method. This can be applied for example, either by modifying the design fire if there are appropriate means for manual fire fighting or including effects of the emergency management plans on evacuation behavior due to assistance from personnel.

If the protection objectives are not met when all active systems are working mitigating measures or adjustment of the protection objectives are needed. This is due to the fact that the protection objectives are not met in the most beneficial circumstances for the scenario, and will therefore never be met unless something is changed. One could come to the conclusion that other mitigating measures are needed, the protection objective was set to high or the scenario considered was to severe, whatever the cause the process needs to be reevaluated with a change in some of these factors.

One active system impaired (OASI)

If the protection objectives are met for the scenario when all active systems are working, there is still a need to analyze the robustness of the fire safety, i.e. how dependent is the fulfillment of the protection objectives upon one single fire safety system. The need for robustness of the fire safety, i.e. to not be fully dependent upon one system in order to achieve the protection objectives for a scenario, has been recognized by e.g. Lundin (2005) the Swedish (Swedish National Board of Housing, Building and Planning 2011b) and the New Zealand (Department of Building and Housing 2012) building code as well as in design fire scenario 8 in NFPA 101 (NFPA 2012).

In Figure 3 the process for developing the scenario with one active system impaired is described. The scenario starts with one active system being impaired, e.g. the sprinkler system is not considered to affect the scenario. In this case the active system is assumed to be impaired before the initiating event occurs (the first box of Figure 3) due to some general failure mode of the active system. A general failure mode could e.g. be that the pump has been inadvertently turned off, a valve is closed by accident or the batteries for starting the engine are empty. This is assumed in order to account for the inherent probability of failure of active fire protection systems. However, there is still the question of whether the initiating event damages and impairs any other (excluding the already assumed impaired system) active or passive fire protection system and this is addressed in the third box of Figure 3.

In the third box of Figure 3 a check is done as to whether the other active systems and passive systems are still operational and that they have not been damaged or disabled as part of the scenario. As an example, in the first box the sprinkler system is assumed to be impaired due to empty starting batteries. An initiating event occurs which is an antagonistic attack including an explosion, in the third box a check is done and it is concluded that the explosion damaged the control panel for the evacuation alarm. Hence the scenario now includes two impaired active systems, the sprinkler system due to empty batteries and the evacuation alarm that was damaged by the initiating explosion. The difference from the AASW scenario is that the inherent failure probability of active systems is accounted for in this scenario by assuming impairment to the sprinkler system before and during the scenario.

If the protection objective is met for the scenario the process is repeated but with another active system impaired in the first box in Figure 3, e.g. the smoke management system (only one active system is assumed to be impaired due to inherent failure modes at each scenario, i.e. in the second case for the example above the sprinkler system is assumed to be working again). This is then repeated so that all active systems have been impaired once in the first box in Figure 3.

If the protection objective is not met for any of the scenarios, with on active system impaired, one needs to determine whether the likelihood of failure for the system is acceptable or not. If the likelihood of failure is acceptable, then continued evaluation is conducted testing with other active systems impaired. If the likelihood of failure is unacceptable then mitigating measures, change of scenario or altering protection objective needs to be considered (the same that is done when protection objectives are not met for AASW, see above). Generally, there is an acceptable probability of failure for an active system and a higher consequence is probably acceptable in this case meaning that it may be acceptable that the first stated protection objective is not met and a larger damage is accepted when an active system fails.

When all active systems have been assumed to be impaired in the first box in Figure 3 and all these variations of the scenario have been evaluated the availability and reliability of the least reliable active system need to be analyzed. The likelihood of failure for that system needs to be determined and if the probability of failure for the least reliable active system can be accepted, the situation is acceptable, since this is the highest probability for failure. If the determined probability is too high the situation may be unacceptable, however this is unknown since the protection objective is either met with the system failing or the probability was earlier determined to be acceptable. Hence failure of another system at the same time as the first system is needed in order for the situation to be unacceptable. At this stage the evaluation process is starting to become more complex and it is recommended to perform a full QRA.

An availability and reliability analysis of active protection systems is needed to assess the likelihood of failure of the system. Availability refers to if the system is in operational mode when the fire starts (compare to the first box in Figure 3), e.g. the system is unavailable if it has inadvertently been left out of service after maintenance (SFPE 2007). The system reliability on the other hand considers that the system does not always perform as designed or intended, e.g. if a component is failing during operation or if the fire hazard for some reason is greater than the design of the system, say an antagonistic attack. Another issue is whether the system is affected by the initiating event or not, as asked in Figure 3, this has mainly to do with if the system is isolated from the event, e.g. a separate pump house for the sprinkler pumps and risers presents a fairly isolated system compared to a sprinkler room within the building the system is protecting. In order to facilitate evaluation of an active system for the purpose of this method Table 6 has been developed.

The categories in Table 6 have been developed based on the discussion by Lundin (2005) regarding attributes for defining fire safety. For the purpose of the evaluation of active systems the relevant attributes are: function; human action/performance; complexity; reliability; and vulnerability, these are described in Table 9. The attributes are discussed in detail in Lundin (2005) and are based on the work done by Meister (1991).

Table 9 Attributes considered

By using Table 6 and addressing the attributes an assessment can be made of the availability and reliability of fire safety systems and help in determining likelihood of failure in order to assess if the likelihood is acceptable or not.

Once the last box in Figure 2 has been evaluated the analysis for a scenario is either finished or it has been determined that a QRA is needed for the scenario. The process is then repeated for all scenarios chosen in the step “Selection of scenarios to analyze”. Once this has been completed the analysis of the building is done.

Future work

The method is still in the developing phase and the method has not been fully tested in practice yet. This is a weakness and the next step is to apply the method on an actual building to test and determine its strengths and weaknesses. One identified focus area to be evaluated when applying the method is how well domino effects are captured within the method or if refinement is needed in this aspect. Such effects might include multiple events such as a coordinated attack with for example a fire and an explosion at different locations but as part of the same attack.

Conclusion

An engineering method for selection and evaluation of fire related scenarios in multifunctional buildings, considering antagonistic attacks, has been developed. The method is based on identified (through literature review and interviews) important aspects and problems, specific for antagonistic threats and multifunctional buildings. The specific identified problems that are taken into account are summarized in Table 1.

The strength of the method is that there is now a process available for a systematic evaluation considering new aspects of fire safety. Further the method is based on sound principles and there is a clear connection to both fire safety engineering in the normal (accidental) case and principles for protection against antagonistic events. The method is also compatible with standards on emergency management and business continuity planning and can e.g. be used in the risk assessment phase of such standards such as NFPA 1600 (NFPA 2013). Finally the method treats uncertainties for the scenarios in a scientifically recognized way, i.e. by choosing conservative values according to the level 2 approach.

Appendix

Terminology

Active fire protection systems, AS: Fire protection system that needs to activate as a response to fire, e.g. sprinkler system, evacuation alarm, self closing doors activated by smoke detector etc.

Antagonistic attack: Manmade attack, against a specific target to which the aggressor bear hostility, with the intention to cause harm as a consequence of the attack, e.g. terrorist attack such as an explosion or arson fire.

Security: Security is protection aimed towards limiting access such as perimeter fencing, CCTV, watch service, locking etc.

Multifunctional building: One or several connected buildings hosting several functions (e.g. societal) or occupancies (e.g. office, restaurant) where the facility and its functions is one integrated whole. The definition also includes underground facilities.