Risk-aware decision making in the safety investments - Application of stochastic simulations and judgment value method

We propose a methodology for risk-aware decision making related to the investment in safety. The methodology consists of probabilistic risk assessment and following cost-benefit analysis upon calculated risk values. We introduce a web-based tool for computing the risk for various safety regimes. The tool makes use of joint fire and evacuation modelling along with Monte Carlo sampling for uncertain or variate input variables. The results include individual as well as societal risk values, related to fatalities or serious injuries. The obtained changes in risk values – related to the applied safety measures – define an input for the cost-benefit analysis. The analysis is based on the Life Quality Index and J-value judgement method. As a case study, we used the hotel part of a seven- story mixed-use building. We designed the methodology to be applicable in day-to-day engineering calculations related to the safety of the building as well as other purposes, such as the introduction of the new product to the market. Therefore, in this article, we focus on the practical aspect of the methodology.


Introduction
The behavior of the fire in buildings remains outside deterministic quantification. Its stochastic nature means the fire is difficult to predict as it develops, even for experienced firefighters, resulting in the number of line of duty deaths each year [73]. Even more challenging is to predict the fire development and people's reactions when the building does not yet exist. Fire safety engineers face such a challenge in their day-to-day work. They have to design safety measures that protect a building from fires, which behavior is mostly unknown at the design stage. To cope with this problem, they mostly use the collective experience of the profession or an adequate level of conservatism [9]. The experience was gained by the application of longstanding approaches that proved their performance in multiple past fire events. Conservatism is introduced in the analysis by safety margin in the input parameters, fire scenario definition or performance criteria. However, collective experience is limited to the typical fire safety engineering designs. Conservatism, on the other hand, requires a good understanding of fire phenomena and performance criteria. Moreover, it is criticized for unjustified costs, low flexibility, and preventing technological innovations and alternative solutions [1,28].
Switching to the performance-based design [28] or attainment of adequate safety, defined by explicit safety targets for more sophisticated structures, requires more systematic engineering approaches. In this case, the acceptability of the design cannot be demonstrated using expert judgments and deterministic methods. The broad spectrum of possible fire scenarios should be covered by explicit calculation of risk associated with the design to demonstrate acceptability. The probabilistic risk assessment is considered state-of-the-art among the methods for risk assessment. Nevertheless, the application of a probabilistic fire risk assessment (PFRA) is currently being limited by two primary factors: limitation in the technology available for the analysis and risk communication problems [37,39,78].
The technological limitation can be broken down into the following sub-problems: a) absence of an integrated methodology and software which would allow a complete analysis of the risks; b) a lack of data (or hindered access to it) related to systems and elements subject to assessment, c) considerable computational costs arising from the complexity of the problem or required low values of error of the approximation.
The problems with risk communication result from the absence of a defined absolute or reference value of tolerable or acceptable risk.
Moreover, the deterministic approacheswhich are mostly applied nowadaysalways lead to an expectation of zero fatalities. Therefore, the decision-makers are not used to consider the acceptability of fatalities, even at low probabilities, and hesitate to take responsibility for such decisions. Van Coile et al. define it as a lack of clarity on the position of probabilistic methods in the design process [74]. There is also a lack of methodology for cost-benefit analysis based on the calculated risk values along with a limited number of peer-reviewed case studies which can serve as a reference point to the fire engineer.

Risk calculation
The technological approaches for quantitative risk assessment are continuously developed since the late eighties when computers became available for everyday engineering and dedicated software was proposed to make complex Event Tree-based [51] risk analyses feasible. The first approaches were mostly based on a statistical analysis of historical data and transition functions fed with this data [4]. For example, CESARE-Risk adopted a time-dependent barrier failure model for the evaluation of fire spreading [3]. FRAMEworks used statistical data and hand calculation in order to establish a death rate baseline for the fire scenarios [10]. CRISP used a collection of objects, representing gas layers, vents, rooms, occupants, and firefighters [20]. These objects had defined various behaviors in response to stimuli. For a given scenario, the objects interact with each other and the simulation predicts ways in which a scenario develops over time, resulting in inevitable consequences. The Monte Carlo approach was used to define the scenarios. CUrisk applied a deterministic analysis of separate fire scenarios to calculate fire parameters within the compartment [22]. Then the evacuation model was used to determine the time taken for occupants to evacuate.
In the 1990s, the growing computer power and the development of zone fire models advanced fire risk analyses. B-RISK applies the BRANZFIRE zone model and the Monte Carlo method to generate probability distributions for relevant model outputs, given that the statistical distributions to key input parameters are assigned [82]. PFS combines zone models (OZONE and CFAST) and later a field model to predict system failure or smoke filing probability [26]. However, these approaches did not include fully-featured evacuation models for assessing the fire consequences on humans.
The continuously growing computer power enabled the use of stateof-the-art simulation models, such as computational fluid dynamics (CFD) and microscopic evacuation models. However, even now, the exceptionally high numerical cost does not allow their application in probabilistic calculations beyond the research realm. Therefore, many heuristics are applied to make the calculation feasible. For example, in work [78], a decomposition into discrete and continuous probability distributions of input parameters is required. Then with using hand calculations, discrete parameters are processed manually in the form of Event Tree Analysis (ETA). The more demanding continuous distributions are sampled by the application of response surface modeling methods [77]. Even with these approaches, the number of continuous variable inputs is minimal and the small number of simulations can hardly address the tail probabilities of possible fire scenarios. The evacuation analysis is also decoupled from the smoke spread model [78].
The latest achievements in computer science have also been used in the risk analysis domain [33]. The proposed Web application called Aamks is device-independent with heavy rendering processes left on the server-side. The application is easily accessible by a web browser and averts the complicated process of installation, maintenance, and updating. The architecture supported by parallel and grid computing enables near-linear scalability with the number of processors and the exploitation of heterogeneous computing resources. Putting this all together in cloud computing allows users to have on-demand computer power within the easy-to-use application without direct active management. With these features, it can be used in design offices in day-to-day work. The approach enables us to calculate an individual as well as societal risk for the design in question. This approach, however, still uses simplified zone models in order to address the risk calculating within several hours of calculations.
The currently available approaches allow approximating risk for any specific building. The accuracy or error of the approximation depends on the costs spend on the computation. The performance of these approaches is mostly evaluated by accuracy to predict the actual risk represented in numerical values. However, the representation of risk due to the use of numerical values makes it difficult to further assess the parties involved in the design process. Numerical values of risk left without any categorization are useless. Taking into account the availability of models allowing risk calculations and scarcity of risk communication methods, the latter seems to be currently the main obstacle for the successful implementation of risk assessment in building design.

Risk communication
The problem of risk communication is closely connected to the risk assessment. Therefore, it has also been investigated for many decades. One of the first approaches was proposed by Rasmussen, together with Event Tree analysis enhancement. The risk calculated for nuclear power plants was simply related to other early death factors [51]. Table 1 presents this comparisonthe individual risk of early death by various causes. The method of ranking and communicating the risk is straightforward, just a comparison to other early death factors.
The approach was, however, criticized that it does not take into account the societal risk, namely the number of people affected, especially beyond the immediate exposition. It may be expected that damages from one nuclear incident affect far more people than lightning, meanwhile devastating the environment and properties on a large scale. Moreover, it was not clear which early death cause should be used as a reference value. The difference between the various causes in risk values also reflects the risk perception in a given society. Furthermore, when, for example, 1 × 10 − 5 is acceptable for firearms, it is not accepted for air travel. Therefore each of the domains should have their value of risk border acceptable by society.
In the fire safety domain, the limits of tolerable and acceptable individual and societal risks were first specified in [6,50,64]. The absolute value of tolerable individual risk (to the individual member of the Table 1 Individual risk of early death by various causes, presented in WASH1400 report [51]. public) was assumed to be 1 × 10 −4 death per year, while acceptable value no more than 1 × 10 −6 death per year. The values were agreed upon, referencing the risk to the activities on major industrial sites. Societal risk border value was proposed as 5 × 10 − 7 for 10 or more death per building per year and 5 × 10 − 8 for more than 100 death per building per year. The proposed values apply to any type of premises. In work [84], the method for the calculation of acceptable risk value was proposed, which takes into account premise types. Namely, the single-family home risk was taken as base risk and then converted by the proposed, premise-related risk conversion factors. The obtained value defines the risk acceptance criteria for the given premise. The calculated risk by the use of quantitative methods was also ranked using qualitative methods. For example, in Refs. [27,61], the so-called risk-ranking matrix was proposed. The obtained risk values were ranked regarding the severity of the consequences and level of frequencies. Fig. 1 depicts the exemplary risk-ranking matrix, with placed calculated risks for further ranking.
Most described fire risk ranking methods rely heavily on experienced judgment. They are, however, criticized for lack of precision within the ranges. For example, in the case of risk analysis described in Ref. [6], what action should be taken related to risk between tolerable and acceptable levels? Should the risk be further reduced if it is ranked as moderate regarding the [61]? The work [6] proposes, in this case, ALARP (As Low As Reasonably Practicable) approach, although, without guidance, how to perform it.
However, the more important critics were raised by stakeholders that absolute value risk-ranking methods do not take into account costs. If the risk is outside tolerable or acceptable value, it should be reduced regardless of the cost of its reduction, without any cost-benefit analysis [35].

Risk-aware cost-benefit analysis
A cost-benefit analysis (CBA) is possible when the cost and benefit are reflected in the same units. CBA, regarding health and safety, requires setting a monetary value of life. This is, however, one of the most highly contentious points of such CBA, even though economists have come up with various ways of estimating the value of life [2,12,71].
The assessment of the monetary value of life or health is disputable.
However, it is continuously used in various domains, including insurance, public health and public transport [2,12,71]. Nevertheless, having the value of life assessed, we can then compare it with the costs of averting this death. For example, in work [83] simple cost to benefit ratio was used for the analysis. While works [32,35] propose a more sophisticated, statistical decision theory and Bayes alternative. All these methods are highly debated [42]. The arguments are that taking into account the monetary value of life is a cruel method that does not take into account societal willingness to pay for safety. Namely, the monetary value of life provided by the economic institution has less in common with how much given society wants to pay to avert the death of an individual from the public [32]. Moreover, various institutions propose the various monetary value of life. The CBA methods based on this value are very susceptible to switch-over depending on the value of life assumed.
Substantial work in this question was proposed in Ref. [66]. Tengs et al. reviewed a number of projects aimed at saving lives and evaluated the cost of life-saving interventions. It revealed significant discrepancies between the monetary value of life proposed by economists and the willingness of society to pay to avert death. Fig. 2 depicts the distributions of costs of life-saving interventions in the USA.
The proposed approach has, however, serious shortcomings for practical application. Namely, there is no strict reference value that may be used in the CBA calculations. As is presented in Fig. 2, US society is willing to pay to avert death in a wide varietyfrom several hundred dollars to billion dollars per year. Despite these shortcomings, Tengs, however, pointed out where the answer to how much society is willing to pay for safety should be sought.
The directly counting monetary value of life is always controversial and difficult to settle the agreement between parties involved. However, as Tengs presented, societies continuously invest in safety measures. Tengs' work was related to the decision making at the policy-makers level, aimed directly at life-saving interventions. However, every individual in society is involved in a decision related to safety. For example, when buying an extra safety packet with a new car. These investments have rather a marginal impact on the risk reduction or extension of the life expectancy. However, they are done by the entire society, hence is a good measure of how people as a society are willing to pay for safety. The approach is called the marginal life-saving cost principle and may be regarded to be most consistent with rational decision-making and economic theory [57,58].
Taking into account the continuous investment of societies in safety measures, Nathwani, et al. [40] related the life-saving interventions and their cost-effectiveness. They proposed that the principal value of nations is a long life in good health and wealth. Hence, they proposed an index as a measure of it called the Life Quality Index (LQI). In general, LQI can be defined as a product of the annual gross domestic product (GDP) per capita g and the life expectancy e.
where the exponent q defining the trade-off between work and leisure time.
Within the frame of LQI, the investment in safety can be perceived as taking some value of g in order to extend the value of e. The investment is societally justified when the LQI after investment at least does not shrink. Fig. 3 depicts the idea of LQI as well as investment in safety.
LQI was validated on many case studies, including health and safety regulation standards, risk and costs related to electricity generation, radiation exposure and others [40]. The first application of LQI in the fire safety domain is regarded to Hasofer and Thomas [23].
Hasofer and Thomas applied the LQI principle to the problem of costbenefit analysis of the installation of the sprinkler system in one and two-family dwellings in Australia. They related the cost of sprinkler installation and maintenance with the expected gain in productivity due to the averted death and avoidance in property losses due to the fire. The final results were presented as a benefit to cost ratio. However, there is no proposition nor discussion on what value of the ratio is rational or beneficial to society. The number of monetary components relevant to CBA was also limited. The discounting method applied was rather simple and the value of the discount rate was assumed arbitrarily.
The investment in safety is somehow similar to a lottery. We buy a ticket for some amount of money believing that we will gain more with some luck. In the case of safety investment, it relates to a single large upfront investment, which we believe will protect us from losing more in case of fire which may or may not occur with some probability (lottery). In this framework, we bid money that we have for certain against expected future uncertain profit. For example, somebody proposes us a bet, where we can gain $100 if we guess the coin toss or get nothing otherwise. How much would we pay for such a lottery: $30, $50 or rather $70? It seems reasonable to pay up to $50 because this is the expected value of the bet. However, the decision depends on the number of trials. We are more likely to bid close to the expected value for the greater number of trials and less for just one toss [41]. In most cases, we prefer sure payoff less than the expected value of the outcomes. The attitude is related to the utility of the money that we have for sure and those uncertain can be explained by Von Neumann-Morgenstern utility theorem [80].
The decision on how much to pay for the lottery depends also on the bet stake and our wealth. Most of us will probably hesitate less to bid $1 having a 50% chance to win $2 than $0.5 M even if there is a chance to gain $1 M. If with the increase of the bet's stake the difference between the expected value of the bet and the money we would like to pay for the lottery is rising, we are risk-averse. If the difference stays constant, we are risk-neutral. If none of the former cases holds we are risk-seeking.
In this sense, investment in the safety at societal decision-making can be perceived as the wealthy investor with a large number of trials. Governments have a large capacity to bear risks due to a budget that is comparatively larger than private investors and investments in diverse projects. In 2014 Fischer, in the doctoral thesis, proposed a decisionmaking framework for the investment in fire safety at a societal level based on LQI [14]. She proposed the risk-neutral attitude and the maximisation of the expected total (net) benefit. She also proposed an approach for the definition of the acceptance region within the monetary optimisation is allowed. In work [15] Fischer et al. also discussed the acceptance criteria for private investors. They proposed that the acceptance should be based on the threshold derived from the societal acceptance criterion and LQI.
Thomas et al. [69,70], on the other hand, studied the problem of investment in safety at the organisations level and proposed the risk-averse attitude to decision strategies. The proposed decision framework was based on the ratio (called J-value) of the actual amount being spent on safety measures, to the maximum that population should be willing to pay derived from LQI. Keeping the J-value at the condition ≤ 1.0 will represent a risk-averse attitude. In further works [67,68] Thomas et al. expanded the costs of the incident with other economic and environmental costs. They also include the Atkinson Power Utility function in the calculation of the expected utility of the organisation's wealth including risk aversion.
Thomas et al. also defined that the decision of investment into safety should be based on a reluctance to invest parameter. The parameters were defined as the ratio of the expected before-and-after utility difference to the starting utility of the organisation what can be defined as an organisation asset. Hence, 100% reluctance to invest in safety will be achieved when costs of the protection system reduce the utility of the organisation's assets to zero.
Fischer et al. believe that even for private investors, further monetary optimisation is possible after achieving the societal acceptance threshold. This means that after satisfying the societal acceptance criteria, private investors can further gain investing more in safety. The situation when monetary optimisation is not following societal acceptance is only possible when private decision-maker does not take into account all benefits of investing in safety. The method was further incorporated in ISO 2394:2015 [30] along with the maximum acceptable target failure probabilities.
Van Coile et al. disagree with the assumption that acceptance criteria should only be based on the net benefit to society [75]. They proposed hierarchies for acceptance criteria. The candidate design can only be optimised by CBA analysis, if it satisfies first a tolerability limit. Tolerability is defined by a limiting risk curve, denoting the societal limit above which designs cannot be justified irrespective of the associated benefits. They also proposed an acceptability limit, a threshold below which the design is considered adequately safe without requiring any further justification. Between tolerability and acceptability limit cost-benefit analysis may be performed in order to find an optimal solution. It is proposed that the CBA should be performed by comparing the cost of the investigating safety measures with the change in scalar risk indicator. The safety feature should be implemented when the cost-benefit ratio is below the defined threshold.
The methodology was then incorporated into the standard PD 7974-7:2019 [9]. When a design satisfies the tolerability criterion but incurs a higher risk than accepted, then should be accessed regarding As Low As Reasonable Practicable (ALARP) rule. The formulation of ALARP states that safety measures can be waived only if there is a gross disproportion between the risk and the costs required to mitigate it. It is mathematically represented by the following Equation: where: ΔC is the cost of the investigated safety measure; ΔRI is associated change (<0) in a scalar risk indicator; a is proportionality constant which brings all the evaluated costs and benefits to a common reference unit; and D is disproportionality factor, which reflects risk aversion or completeness of the inclusion of all the costs and benefits.
In their work [25] Hopkin et al. proposed the evaluation of safety schemes based on the J-value method. In Ref. [24] they applied this methodology for the cost-benefit analysis of residential sprinklers.
The judgement based on LQI seems to be the state-of-the-art for riskaware decision making where there is no place for comparative analysis. However, the application of this method described in work [24] was limited to statistical data and global decision affecting society as a whole. Moreover, in the methodology, the scalar risk indicator was used without addressing risk curves. None of the methodologies presented so far allows applying these methods for a design office, where various candidate designs are considered regarding the attained safety and costs behind them.
In this paper, we propose a complete methodology for risk-aware decision making in safety measures at the design state. The methodology consists of a cloud-based application that enables us to calculate risks for various candidate designs. Then on the basis of the calculated risks, the decision-making process is performed, which takes advantage of LQI. The method we present is an extension of the works by Hopkin et al. [24,25]. It proposes how the judgement value method can be used at the design stage of a specific building. It allows comparing various safety measures and finding those that satisfy the societal acceptance threshold and are optimal from the monetary point of view. Moreover, we applied the hierarchical acceptance criterion proposed in Refs. [9,75]. We also reflected calculated FN-curves in changes in scalar risk indicator.
As a case study, we used building being subject of the 13th International Performance-Based Codes and Fire Safety Design Methods Conference & Expo, Auckland, New Zealand 2020, where we also presented our solutions.

Methods and materials
For this analysis, we applied a quantitative fire risk analysis in the form of a multisimulation approach [32]. The purpose of the multisimulation is the quantification of the life safety level of people in buildings in the context of the fire safety design. The approach was implemented as a web-based application calculated on a cloud called Aamks [33]. Aamks is open-source software which demo version is available on the web page: https://aamks.szach.in.
Aamks performs a stochastic analysis of life safety in building fires based on deterministic models for fire and evacuation and stochastic sampling of uncertain or variable input parameters [32].
The general idea of Aamks is based on the approaches proposed in Refs. [26,82] stochastic simulation on zone models. However, it expanded the approaches by deploying the fully-featured evacuation model. Fire and evacuation are modeled consecutively for each model implementation, allowing quantification of the safety level of people by using a Fractional Effective Dose (FED) [47]. The fire and evacuation models are coupled, however asymmetrically dependent [34]. The agents in the evacuation model respond to the fire and smoke conditions, however, they do not alter the fire. The tool consists of eight modules presented in Fig. 4 [36].

Risk model and metrics
The risk calculated in the model is summarized in an event tree structure. There are currently three primary factors used for the calculation of consequences in Aamks: toxicity, heat, and traumatic injury. In the analysis, we used only the toxic injury model, which is based on the calculation of FED [63] and its further ranking [33] (probability of fatalities given FED in event tree). Figs. 5 and 6 depict event trees for the FED-based risk.
The probability of ASET>RSET branch is calculated as the share of the number of fire simulations where the evacuees have no contact with smoke to the total number of simulations. The remaining two branches (ignition and early suppression) are calculated based on statistical data. The probability of ignition in the building can be calculated for example according to the PD 7974-7:2019 [9], while the early suppression may be calculated concerning data of self-termination [17] and the probability of successful manual extinguishing [72].
FED is based on the predicted concentrations of carbon monoxide, hydrogen cyanide, hydrogen chloride, carbon dioxide, and oxygen [31,47]. The FED value equal to one is interpreted as a 50% chance of fatality and a high consequence (H). The response to lower or higher values of FED is translated into fatality by using a log-normal probability distribution function following ISO 13571 [29]. We have not found experimental justification for modeling the response by the log-normal function in the fire safety field, while its application is reported in health assessment [55,59]. The probability of fatality is calculated independently for all the evacuees. Next, the final individual risk of death is calculated as a complement probability that nobody dies.
Sublethal effects, also based on the FED, are broken down into medium (M) -seriously injured and low (L) -minor injury. The probability of serious injury is calculated using the same method as for fatalitiesas a log-normal probability distribution. However, in the case of seriously injured 50% chance is set for FED value equal to 0.3 [34]. Such a calculation of seriously injured embraces also a subset of fatalities. Hence, from the calculated value we subtract the probability of fatalities.
The minor injury (L) is calculated for 50% of a log-normal probability distribution set to 0.01 minus probability of fatality and seriously injured [34].
The risk presented in Fig. 5 is calculated as a share of the number of simulations that resulted in a given consequence type to the total number of simulations multiplied by the ignition probability and early suppression. It represents the annual risk of death to which specific individuals are exposed. This means the risk to a person in the vicinity of a threat, including the type of consequences and the probability of consequence occurring.   The individual risk does not, however, carry any information about the number of people affected in the case of a fire. The so-called societal risk [62,81] addresses this aspect. The societal risk is a measure of risk to a group of people. It is most commonly expressed concerning the frequency distribution of multiple casualty events [19]. Aamks with an applied multi-agent microscopic simulator also allows the calculation of the FN risk curves [33].
The current method of the calculation of the FN curves is rather straightforward, while it is based on sharp ranges [34] (see Table 2). This is not consistent with the calculation of the individual risk, which is based on a log-normal probability distribution on FED values.

Deterministic models
The current fire model in Aamks is CFAST [54] version 7.5.0, which provides the fire environment parameters required for the calculation of toxic and thermal FED, as well as movement speed reduction.
There are limitations of the fire model we use and they are related to the general problem of fire zone modeling. The works [5,27] summarize the assumptions made for the fire zone modeling and the limitations behind this model.
Aamks has implemented its own evacuation model [34]. The local movements are handled by the collision avoidance based on the velocity time-to-collision approaches and linear programming [76]. The wayfinding algorithm is based on the navmesh approach [60]. For each position of the agent in each step of the simulations, Aamks enquires the created data structure for fire parameters and alters agents' states (FEDs, speed) respectively and behavior correspondingly. When there is smoke on the evacuation route, the agents try to find an alternative route free of smoke.
The evacuation model also has limitation in reflection of the real evacuation process. It hardly satisfies quantitative velocity-density relation during the counter-stream, as well as other behavior related to crowd. The broader discussion of the limitations and assumptions of the evacuation model can be found in Ref. [34].

Stochastic sampling
When using the Simple Monte Carlo (SMC) approach, the required number of simulations is determined dynamically. Each of the per-formed simulations reduces the approximation error [11,43]: where p n is the approximated probability, Φ is the cumulative distribution function of the standard normal distribution, and n is the number of simulations. The root mean squared error (RMSE) of estimated expected value μ n can be calculated as follows [11,43]: where μ is the mean of the expected value of some random variable and σ its standard deviation.
The convergence rate of SMC estimation of μ is of the order. In other words, for a given Y RMSE is a function with respect to n: where ℴ is a denotation used to characterize a function according to its growth rate.

Cost-benefit analysis
For the ranking of risks calculated by Aamks, we applied the Cost-Benefit Analysis based on LQI and J-value methods [25,40]. The main idea behind this CBA is taking into account the willingness of society to pay for safety, reflected in LQI. As was mentioned in the Introduction, LQI can be defined as a product of the annual gross domestic product per capita g and the life expectancy e (see Eq. (1).
The idea of the investment in safety within the frame of LQI can be perceived as taking some value of g in order to extend the value of e. The investment in safety is beneficial for society if LQI after the investment is at least no less than LQI before investment.
The marginal value of the investment beneficial to society is when dLQI equals zero. Hence, we can rewrite Eq. (6) to the following form [40]: where − dg is the maximum per capita investment for a given safety investment, which results in a net benefit to society. The change in life expectancy de due to a safety regime can be estimated as being in proportion with the change of mortality rate dm with the proportionality constant C FM specific to a given demographic profile such that [40]: where Δf is the change in the annual expected number of fatalities, and N is the population size affected by the particular hazard. Finally, the maximum per capita investment can be expressed as: The first part of the equation: − g q C FM is constant for a given society and is called the Societal Capacity to Commit Resources (SCCR) [24]. The value of SCCR for a given society can be taken, for example, from ISO 2394:2015 [30]. The latter part of Eq. (9) is risk reduction obtained by the application of a given strategy and, in our case, is calculated by Aamks. Fig. 6. An exemplary event tree for seriously injured created by Aamksrisk for CD4 from the case study. The presented approach allows for the calculation of how much a given society is willing to pay for an investment in safety, resulting in such a decrease of fatality rate or risk in general. We can now implement it in risk-aware decision making by the so-called ALARP criterion. ALARP relates the costs of the investment with the potential benefit.
Regarding the PD 7974-7:2019 [9], the ALARP criterion for a given risk is satisfied if the costs C of risk reduction does not exceed the society's capacity to pay for this reductionin this case ΔD.
We use ΔD instead of − dg in order to be able to reflect all the costs averted by application of a given safety investment. Fire safety investments are also likely to reduce injuries and damage to the property. Therefore, the net-benefit of the safety measure (i.e., the risk reduction as valued through ΔD) comprises three terms [24]: ΔD f -the reduction in fatalities, ΔD i the utility associated with the change in expected injury rate and ΔD d the utility due to the change in expected material damage rate, such that: The following terms can be broken down into: where Δf is a reduction in fatalities calculated by Aamks; where Δi is a reduction in seriously injured calculated by Aamks and ξ i is the cost of injury prevented taken from statistics; where Δd is the reduction in damage, λ ig is the ignition probability, χ d is the reduction in damage due to sprinkler introduction (%), and ζ d is the cost of damage per unsprinklered fire ($ppp). We calculate the value of the risk of our candidate designs (CD) presented in the case study. We select the candidate design with the lowest investment and hence highest risk as a reference value. Then, we calculate Δf and Δi for the remaining fire candidate designs by subtracting risks of fatalities and seriously injured.
We also take into account FN curves in the calculations. They were included by the multiplication of the individual risks by the so-called FN-factor (FN f ). The FN-factor is the weighted arithmetic mean of the number of people affected per candidate design.
where i is the number of people affected and p i is the share of the scenarios where exactly i people die to the total number of the scenarios with fatalities. For example, the Δf for CD2 is calculated as: where: R CD1 and R CD2 are individual risks of death calculated by Aamks for CD1 and CD2.
In the above derivations, both the investment cost C and the benefit terms ΔD are evaluated on an annual basis. In our case, the safety investment relates to a single large upfront investment and then relatively low maintenance costs. However, the future benefit terms incurred over the lifetime L, can be discounted to the investment time regarding the following formula [24]: where γ is the discount rate.
For the annualized costs and single upfront investment, a general formulation of the cost considers an upfront sum (C 0 ) and an ongoing annual cost (m) which is paid over the scheme's life (L) can be expressed as [24]: where m γ is deduced via the common net present value calculation procedure [24]: The organizers of the SFPE Conference Case Study did not provide the costs behind the implementation of the consecutive candidate designs. Neither the data regarding the upfront cost C 0 , nor the ongoing annual cost of m was known. However, for the sake of the completeness of the analysis, we assumed the costs of safety measures on the basis of the local enterprises' prizing.
Finally, the total fire safety judgement value (J fi,T ) was calculated following the work [24].
This means that the safety measures of a given fire candidate design should be applied if the J fi,T ≤ 1, e.i. the discounted cost of the investment is lower than the discounted costs of safety benefits.

Case study
As a case study to present the application of our approach in the real process of building design, we selected an exemplary building. For the sake of easy access to the information related to the building in question, we selected a design from the Case Study of the 13th International Performance-Based Codes and Fire Safety Design Methods Conference and Expo. We also took part in this contest, presenting our report to the broader audience during the conference.

Building description
The building is a seven-story mixed-use building, including spaces for bars and restaurants, offices, gyms, and hotel rooms. There is parking at the lowest level (basement) for 40 small electric cars. The cross section and floor plans are shown in Figs. 7-9.
The space of the building is organized as follows. Level 1 and 2 (ground level and above) are open to the public. There is an Events space at Level 1 accessed from the foyer. It can be arranged as a separate double-height space with a flat floor and movable tiered seating (300 seats). Moreover, at Level 1, the entry lobby and reception space are located. It is divided into a 120-seat cafe/bar and restaurant space opening directly to the Foyer with a full commercial kitchen.
Lounge 1 is an open lounge space within the foyer, with casual seating and tables, and doubles as the breakout space from the Event space. Lounge 2 is a games lounge for active recreation. A   Fig. 7. Cross-section B-B of the exemplary building. The upper floors in the building have a central lightwell extending from the roof to the level of the floor. It provides natural light and orientation to circulation space for the accommodation levels. The lightwell is separated from the public spaces beneath with a glass ceiling at level 3 floor level. Each of the accommodation levels contains sixteen rooms for 4 and 8 guests. The area of smaller rooms is equal to 11 m 2 and the area of the bigger room is equal to 17 m 2 . The total area of each floor with hotel rooms is equal to 800 m 2 . The building is equipped with a fire alarming system and emergency lighting. The thermal properties of materials used in our model are summarized in Table 3.
The location of exits from the ground floor are shown in Fig. 8. Access to the hotel upper levels is provided by four staircases presented in Fig. 9. All are equipped with vestibules and pressurization systems. Two of them also provide access to the car park in the basement.
The number of people in the building was assumed according to Table 4.
For the analysis, we divided the building into two fire compartments: the hotel part (levels 3-6) and the public part (levels 1-2). Then for each of the parts, we proposed candidate designs (CD) with various technical fire protection systems. CD1 -status quo, there is no many new technical fire protection systems, except that mentioned in the description; CD2doors with self-closers for each of the rooms; CD3 -natural Smoke and Heat Exhaust Ventilation System (SHEVS) installed in the roof of the lightwell; and CD4 -sprinkler system in every room. Table 5 summarizes the technical fire protection systems that variate each of the CDs. For the sake of clarity of the article, we present the results only for the hotel part of the building. The result for the rest of the building, as well as other candidate designs considered for this building, are available in proceedings of SFPE conference in New Zealand (March 2020).
The simulation process starts with the definition of the 3D model of the building (Fig. 10) using Aamks, and continues with the specification of the technical fire protection systems into the models of each candidate design. Then we run the fire and evacuation simulations.
The model's geometry remains unchanged during the simulation process (at least for a given candidate design); hence it can be considered as a fixed set of parameters defining input. This set is then expanded by other invariants related to the physical properties of the building obstacles, environmental parameters (initial indoor temperature, humidity, and others), and physical parameters of safety measures, such as sprinklers spray density and ventilation flow. We present a subset of fixed parameters in Table 6.
The second set of input parameters is uncertain or variable and is drawn from the Monte Carlo sampler. The parameters of the probability distributions are mostly based on standards such as [7,8] or the scientific records [13,18,47,48]. We summarize the variate input parameters in Table 7.
The third type of parameters comprises dependent variables. These variables are related to the fixed values or those drawn from the distributions. The heat release rate (HRR) may serve as an example of the     dependent variable. The HRR is defined as a function of a drawn sample of HRRPUA and the fire area that depends on the room of the fire origin. An effect the peak HRR is defined as the product of the HRRPUA and the area of the room of the fire origin.

Results
For each of the CDs, we calculated the individual and societal risks in terms of the following consequences: fatalities, serious injuries and minor injuries. These calculations are based only on the Monte Carlo simulations using CFAST and A-evac. They do not contain the ignition and early suppression probabilities, hence they are conditional to the fire ignition and non-suppression. To get absolute, annual probabilities for each CD, the Monte Carlo results were be multiplied with the ignition and non-suppression probabilities.
The number of simulations for each of the scenarios was approximately 1000 simulations. However, for CD4 we calculated 5000 simulations in order to present how a larger number of simulations affect the error. Fig. 11 depicts the convergence of the predicted share of fatal fires p = 0.215 in CD4. Further increasing the number of simulations will decrease the error of approximation. The data of the calculated RSME for the analysed candidate designs are summarized in Table 8.
Each fire simulation was characterized by the probability of its occurrence and predicted consequences. The consequences were determined based on the development of FED values and its further categorization: L1 -inhaled gases result in minor injury, L2 -serious injury, L3 -death. In Table 8, we summarize the predicted relative probabilities of each loss category for candidate designs 1-4 along with the errors of their Monte Carlo approximations. Each relative probability was calculated as the share of simulations with given consequences for at least one person.
The values of Table 8 can be transformed into individual risks by multiplying them with the annual ignition probability and the early nonsuppression probability. According to PD 7974-7:2019 [9], the probability of ignition in the hotel category is 4.6 × 10 − 2 per occupancy per year. The early suppression fails with probability of 0.17, which is calculated based on the data of self-termination [17] and the probability of successful manual extinguishing [72]. For the reasons of investigating the effect of the assumed occupancy category, we also calculate the risks with the ignition frequency of dwellings 1.3 × 10 − 3 1/a [9]. Table 9 summarizes the individual risks for three different consequences: R1: minor injury, R2: serious injury, R3: death.
We present the calculated societal risk in the form of FN curves, representing the annual probabilities of N or more casualties (fatalities,    Fig. 11. Convergence of the simple random sampling approximation of the share of fatal fires in CD4.  Table 2. Figs. 12 and 13 show the FN -curves calculated with the ignition frequencies of hotels and dwellings, respectively. We also provide other performance measures for better illustration of the difference among the candidate designs. Fig. 14 illustrates the shares of scenarios where evacuees had no contact with smoke (value of FED = 0) and those where they inhaled some toxic gases.
Cumulative distributions of the simulation results are shown in Appendix A. Fig. 20 depicts the cumulative distribution functions (CDF) of Available Safe Egress Time (ASET) for the candidate designs, and Fig. 21 shows the cumulative distributions of the minimum visibility on the evacuation routes. Fig. 22 illustrates the CDFs of the minimum height of the smoke layer on the evacuation routes. Finally, Fig. 23 illustrates the CDFs of the maximum temperature.
Our goal was to create an approach and software that can be used in the day-to-day work of design offices. Fig. 15 shows the cumulative distributions of the of run-times for each CD. In most cases, the run-time of a single simulation was less than 40 min. Using one processor, the total computing time would be 1000 times the mean of the distribution, but parallel computing reduces the total run-time almost linearly. Using a cluster with at least 60 cores makes it possible to compute one candidate design within 12 h, and reduction to few hours is possible if the computing is carried out in a cloud with high scalability.

Risk ranking
We take advantage of hierarchical acceptance criteria, defined in works [9,75]. They stated that the values of individual risk should be first categorized, referencing tolerable and acceptable values. The level of torelable and acceptable risks should be agreed among the stockholders involved in the project. There is no such possibility in our case. Therefore we adopted the values from the older version of PD 7974-7 standard, PD 7974-7:2003 [6] which defined 1 × 10 − 4 as the maximal tolerable risk and 1 × 10 − 6 as the broadly acceptable individual risk level.
As seen from Table 9, none of the candidate designs satisfies the tolerability limit when the hotels' ignition frequency is used, i.e., the calculated individual risks of death are higher than 1 × 10 − 4 . Hence, all the candidate designs should be rejected and new approaches for further risk reduction should be sought. However, we applied the most common safety measures in the fire protection. Then, the only solution which can hardly satisfy the tolerability limit can only be based on all possible safety measures. Having a closer look at the ignition probabilities in PD 7974-7:2019 [9], we see that the value for hotels is the highest among all the building categories. It is arguable whether the hotels have 35 times higher ignition probability than dwellings. One of the explanations of such a high value of ignition probability for hotels is that they are in the same group as hostels or communal living. This type of buildings, in the majority of the countries, display a lower level of technical condition, including electrical installation. Moreover, the socio-economic aspect of the occupants of these buildings is reflected in the high ratio of breaking of the fire protection rules. The hotels with trained staff and high technical standards of the interiors, electrical installation, etc. are in sharp contrast to the communal living buildings. This may justify the very high ignition probability of the hotels.
Since the ignition probability has a crucial impact on calculated risk and may lead to the wrong risk categorization, it is important to use credible data and keep the validity of the calculations. However, for the sake of the presentation of the approach, let us assume the ignition probability 1.3 × 10 − 3 per occupancy per year from the dwellings category of PD 7974-7:2019. In this case, all the candidate designs satisfy the tolerability limit, i.e., the calculated individual risks of death are lower than 1 × 10 −4 . None of them, however, satisfy acceptability limitscalculated risk values are higher than 1 × 10 − 6 .
The hierarchical acceptance approach requires also categorizing the risk regarding the societal tolerability limits. However, there are currently no widely agreed on societal risk criteria in New Zealand nor the United Kingdom (regarding the [24] these two countries have similar GDP per capita and demographic profiles). PD 7974-7:2019 proposes that the risk of an accident causing the death of 50 people or more in a single event should be regarded as intolerable if the frequency is estimated to be more than one in five thousand per annum. All of the candidate designs satisfy this condition. PD 7974-7:2019 also proposes an approach based on a slope for logarithmic frequencies. The local scrutiny line is defined as the death of 100 or more in 1 × 10 − 4 1/a and death of 1000 or more in 1 × 10 − 5 1/a. The conditions are satisfied by all of the candidate designs, when the ignition frequency of dwellings is used (Fig. 13).
If the individual risk is in the range between tolerability and acceptability limits, PD 7974-7:2019 recommends the application of the ALARP criterion for risk ranking. We applied the methodology described in section 2.4 -LQI and J-value approach. All of the following calculations are based on the ignition probability for dwellings (1.3 × 10 − 3 1/ a).
For each of the candidate designs, we calculated risk reduction Δf for fatalities and Δi for seriously injured. The reference value of risk was  Fig. 12. FN curves representing the societal risk of the candidate designs in terms of annual probability of N or more fatalities, severe and light injuries. Ignition probability 4.6 × 10 − 2 1/a (hotels).
CD1, while it assumed the building without any additional safety measures. An analysis using the J-value method is conducted based upon the study by Hopkin et al. [24]. Their study examined the cost-benefit of installing domestic sprinkler systems in New Zealand. Regarding this study we assumed the values for New Zealand [24]: SCCR = 3,665,000 ($ppp), ξ i = 25,015 ($ppp), Δd = 83% for sprinkler application, ξ d = 14, 342 ($ppp). Table 10 summarized the calculation of ΔD for the considered candidate designs.
Our study is limited to the discount rate provided in work [24] when considering SCCR values for New Zealand (i.e. long-term societal discount rate) and thus a 3% discount rate (γ) was used. We also follow the lifetime assuming L = 45 years. The summary of discounted benefit ΔD γ calculation for each candidate design is presented in Table 10.
The value of loss in the material used in our calculation is taken from the work [24] and represents an average value for domestic buildings. Such an assumption adds additional uncertainty to our calculation because, for our specific hotel building, the costs may be higher. This is related to the interior design but also the loss of profits from the potential rental of the rooms.
As we mentioned, the organisers of the SFPE contest did not provide information about the cost of the implementation and maintenance of the analysed safety measures. However, for the sake of the completeness of this paper, we sent the project of the building to the local enterprises and asked for the calculation of costs behind the implementation and maintenance of analysed safety measures. The costs provided in PLN were then converted into $ppp based on the OECD data for2019. 1 In the case of SHEVS, we assumed that it cannot operate without a fire alarm system. However, also the alarming of the evacuees is based on fire detection. Therefore, it is arguable whether to include the costs of the fire alarming system to SHEVS or not. We decided not to include it. The costs are summarized in Table 11.
Finally, we calculated the total fire safety judgement value and then compared it with ALARP acceptance criteria defined by PD 7974-7:2019. The results are presented in Table 12.

Sensitivity analysis
In order to get insight into which parameters have the highest impact on the estimated risk, we calculated Spearman's rank correlation coefficients (SRCC). In the SRCC approach, the values are labeled by ranks, i.e., the relative position of the observations within the variable, and the correlation between two variables is based on these ranks. The correlation varies from 1 (very high similarity) to −1 (very high dissimilarity). A value of zero indicates no correlation between two variables and the output.
SRCC can be used as a measure of the relative contribution of each input variable to the uncertainty in the risk values. This contribution comprises two elements, the degree of uncertainty of the input parameter and the sensitivity of the risk to changes in that parameter. In our case, the results of the sensitivity analyses are of significant practical value as they quantify the contributions of the safety measures into the risk reduction.

Discussion
The first thing striking while reading the individual risks, summarized in Table 9, is their surprisingly high values in comparison to the broadly accepted values proposed, for example, in Refs. [61,65,83].
Regarding the study [24], the individual risk of death in dwelling fires in New Zealand is 2.72 × 10 − 5 1/a. The calculated one for our building, even for the sprinkler equipped candidate design is higher 4.75 × 10 − 5 .      The FN curves also display a very high number of people affected, reaching 350 persons. We assume that the problem is caused by the type of building in question and its occupants. As was mentioned, the subject of the analysis is the hotel part of the building. As the input parameters for evacuation modeling, we applied PD7974-6:2003 [7] standard. Regarding this standard, the pre-evacuation time mean value equals 894 s (excluding the room of fire origin). New Zealand standard [38] defines a slightly shorter time (600s), however, it does not reflect the possible variance. During this time, the fire can freely grow. If the door to the room of fire origin is opened, continuously produced smoke fills the evacuation routes. Then after a time defined as pre-evacuation, the evacuees start evacuating. They face the impossible condition to evacuate without inhalation of a large amount of toxic gases.
In Aamks, an option for shelter (staying in the room free of smoke) has not been implemented. Moreover, as far as we know, there is no such clause in the New Zealand safety codes. Therefore, the evacuees are forced to evacuate through the smoke.
It seems, however, that the intervention time of fire brigades may be, in many cases shorter than 900 s. During the intervention, the fire brigade controls fire growth, smoke spread, alters the pre-evacuation time or even rescues people [53]. There is no fire brigade intervention model implemented yet in Aamks, and it is arguable whether it should be implemented, as we are not aware of regulations or standards that take into account fire brigade intervention in building protection. Hence, this hypothetical scenario is compliant with standards, even if it may be perceived as unrealistic.
Despite the high values of the calculated risk, we assume that our study is correct. The core of the analysis is, however, the comparative study between candidate designs and the cost-benefit analysis of the safety measures behind these designs.
Regarding our calculation (Table 9), the lowest value of individual risk is provided by CD2 -the application of doors with self-closer. This candidate has a lower risk even comparing to the sprinkler application solution. The reason is related to our choice to model sprinklers in CFAST using its suppression mode instead of the extinguishing mode. A discussion of how this mode affects fire development is provided in the CFAST manual [45]. Taking into account the long pre-evacuation time and the continuous production of smoke from the fire (even suppressed), the smoke was able to fill the evacuation paths, especially when doors to the room of fire origin were open.
The pie chart (Fig. 14) confirms this assumption. CD2 has the lowest number of scenarios where evacuees have contact with smoke. Since we did not assume that doors may be broken by fire, self-closer prove their high performance in fire protection.
The sensitivity analysis of CD2 does not, however, indicate a significant correlation between the door open to fire origin and the risk. The strongest correlation was found with the parameter fire origin, which indicates the compartment type of fire origin: hotel room or corridor. The low importance of the fire room door position seems to be a consequence of the low probability of the fire compartment door being open, p = 0.14. There were not many such scenarios. Hence, the most impacting factor of risk was a fire on corridors.
Although the candidate with sprinklers (CD4) has higher individual risk than CD2, the societal risk of fatalities is significantly lower with this design (see Fig. 13). The suppressing effect of activated sprinklers reduced the amount of smoke substantially, and fewer people inhaled high doses of toxic gases. A quite steep FN curve indicates this for CD4.
As we can see, SHEVS (CD3) does not provide much improvement in the safety of the building, comparing the reference candidate design (CD1). The building in question has the vents system integrated with active draft curtains. The floor on fire has an open draft curtain, while other floors have it closed protecting evacuation routes. However, we were unable to recreate such controls. The implementation of the fire model CFAST does not allow for active curtain management, depending on the triggering effect.
According to the sensitivity analysis, in CD1, the following parameters had the highest correlations with the individual and societal risks: open door to the room of fire origin; type of the room of fire origin (corridor, hotel room); and the growth rate of the fire. In CD2, as was discussed, the highest correlations were with: the type of the room of fire origin; an open door to this room; and peak HRR. In CD3 also an open door to fire origin was the most correlating factor with the risks. The next was the type of room of fire origin and peak HRR. The peak HRR correlated especially with the societal risk. The number of open vents has a low negative impact on risk.
CD4 followed the previous patterns in correlations. An open door to the room of fire origin correlates mostly with the risks, and with individual risk in particular. The second correlating parameter is the type of room of fire origin. The failure of the sprinkler was also a factor of importance, especially for societal risk. Soot yield and the fire growth rate were almost as important.
The following CBA provides a simple yet powerful method for decision making. Since each of the candidate designs attained the required value of risk, the decision is only based on the ALARP criterion and the calculation of averted costs. Regarding the results presented in Table 12, the safety measure behind the CD2 should be implemented because its judgement value is lower than 1.
CD3 (SHEVS and fire alarm system) does not provide much improvement in safety, however, the costs of its implementation and maintenance are also relatively low. Hence, J fit for this candidate design is only slightly greater than 1. Regarding PD 7974-7:2019 when the Jvalue (or cost to benefits ratio) exceeds unity, the proposed safety scheme exceeds the society's capacity to pay, and its implementation is not required based on the ALARP criterion. The choice to spend excessive safety resources on one particular risk result is considered as a net loss to society [9].
Finally, the application of the sprinklers averts 905,801 ($ppp) for 45 years of building lifespan, with costs discounted value of 1,703,281 ($ppp). The J-value for this candidate design equals 1.88. According to ALARP criterion, its implementation is not recommended.
In the case of our analysis, only one candidate design satisfies the ALARP acceptability criterion. However, we may expect that there will be situations where more than just one candidate satisfies the acceptability criteria. Then the question arises, which of them should be implemented. Our opinion is that the candidate with the best cost to benefit ratio should be implemented first. Then the remaining safety measures should be considered for implementation when they satisfy the ALARP criterion calculated with respect to the risk reduction previously implemented safety scheme. The consideration of the combination of safety measures from various candidate designs is also possible. However, the method of gradually adding safety measures, starting with the most effective, results in fewer scenarios considered.
The CDFs of the computation's run-time indicate that majority of the simulations were completed in a time shorter than 40 min. However, some simulations took several hours. The problem with long run-times is related to the CFAST pressure solver, which freezes when there are too many vent flows to calculate or a fire in a closed compartment generates significant over-pressure. The open roof vents in CD3 helped to avoid over-pressures, and the observed run-times are significantly shorter.

Conclusion and future work
The goal of the article was to introduce a framework for optimizing decision-making related to fire safety measures at the level of a specific building. We presented a complete methodology starting from the preparation of the model of the building enabling stochastic fire and evacuation modeling, individual as well as societal risk calculation, and decision-making framework upon the calculated risks. The methodology is supported by engineering tools that implement all the steps of the proposed methodology. Relatively fast simulation time allows us to consider various candidate designs and different safety measures during the design process. The application of given safety measures is reflected in the reduction in risk value for fatalities and seriously injured. These reductions in risk are then transferred into cost, averted by society, using the Life Quality Index approach, Finally, these costs are compared with the costs of investment and judged according to the J-value method. Our approach allows relating the costs the given society spends for general safety, with the investment in safety measures at the level of a specific building. Acceptable fire safety decisions, even at the level of specific buildings, are related to life-saving and always should be defined from a societal point of view.
We analysed in the case study a real and quite complex building. It combines the various types of use of the interiors. Since the design is modern and unique, it makes it difficult to use the collective knowledge from past fire events. Therefore, the organizers of the SFPE Case Study recommended the performance-based design approach to address the safety issues.
We applied the probabilistic risk assessment to face the problem. Such an approach is considered the most advanced and accurate method to evaluate safety. However, the complexity and the high costs of computation, mostly keep it beyond the reach of design offices. The tools we develop, prove that even for such complex buildings, the simulation time is acceptable when working in cloud computing. This adds to our tool a very important, practical aspect.
Our goal was to propose a method for cost-benefit analysis related to investment in fire safety, that can be applied at the design phase. We tried to avoid the definition of which data or statistics should be used for the specific building. This is out of our intention and scope. However, for the proper communication of the approach, we needed data supporting our calculations. For this purpose, we used the available data summarized in Tables 7 and 10. The data was collected from various countries and scientific records. In this sense, applying this broad source of data to the specific building poses another uncertainty on our calculation for the building in question. The distribution of the burning materials, the fire dynamics in this specific building may have other distribution than we used. However, as we mentioned, we propose the methods and the software as its implementation. Moreover, the software allows users to alter the probability distributions. Therefore, the uncertainty can be further limited depending on the input parameters the users define.
The decision-making with our approach is relatively simple and takes advantage of hierarchical decision making [75] and PD 7974-7:2019 standard. It just requires relating the calculated risks with the tolerability and acceptability limits. If the risks are placed in the so-called ALARP region, the further process is also kept simple. The reduction in risk provided by various safety regimes is converted into marginal life-saving costs and related to costs of the application of these safety regimes. This gives the decision-makers a powerful tool that is strongly based on the societal willingness to pay for safety, and a more solid basis for decision-making, that is always related to the responsibility for acceptability of failures. The hesitation of taking responsibility for such decisions is considered one of the key obstacles to the successful implementation of probabilistic fire risk assessment in real projects.
The proposed tools allow for exploring the spectrum of possible fire scenarios and their consequences. Such a wide source of data is provided for all the considered candidate designs. To get insight into the reasons contributing to failure, Aamks provides rich visualization, starting from the animations of each simulation up to the summaries in a form of various charts. This is a very important aspect of designing reliable and cost-effective safety measures for buildings.
The current methods of verification are mostly based on verification of the deterministic models, correctness of input probability distributions, and the good practices of code development. Therefore, we plan developing a method of verification by launching simulations for the building stock and checking whether we are reconstructing historical data.
The current method of risk visualization is mostly based on the set of the probability distribution of output parameters. The number of charts is significant, yet they still lack spatial relationships. For example, what part of the building is especially risky. We are currently developing a method of spatial risk visualization in the form of so-called heat maps. The parameters considered for the visualization in such a way are: derivative of FED value concerning the position of the evacuees and speed of evacuees. This type of visualization allows for spotting the riskgenerated part of the building.
The LQI-base approach is based on the marginal life-saving costs principle. The problem of the decision of investment in fire safety is then reduced to a basic resource allocation problem. Within this approach, societal resources are limited and should be invested efficiently. Saving unnecessary costs in one building may be then allocated more efficiently in another. This satisfies the general principle that investments into life safety should be directed to those areas where the most considerable lifesaving benefit can be derived. This is fairly obvious when regarding only the monetary aspects of fire safety. However, if we recall Fig. 2, we observe a considerable variance in resource allocation in life-saving projects. This variance cannot be just explained by a lack of methodology for risk-aware decision-making methods.
Directing the societal resources to the specific investment in safety is a political act that expresses values regarding the relative importance of different possible adverse consequences for a particular decision [16]. Fire protection engineering belongs to the field of technical sciences. Hence, we prefer physical, chemical, and statistical laws over expert judgment or social and political sciences. However, after Renn [52], we claim that insight from other sciences such as psychology, economics, and social science can help understand safety and risk. Therefore, the reason for the enormous variance in Tengs' bar-chart [66] should be sought in social sciences and the approach of social outrage [56].