Prescriptive Building Regulations, Safety Objectives, and Residual Risk in Germany

Abstract

In Germany, building codes relating to fire safety are mainly prescriptive nature. Therefore, fire safety engineering is based on a combination of expert judgment and reverse engineering of prescriptive rules. This necessitates to connect the given objectives with the detailed prescriptive rules—if not already described within the law or bylaw. This paper proposes a table relating the fire safety objectives of European building regulations and their German counterpart with the prescriptive model building code in Germany. In addition, a risk curve for prenormative work is also given. This represents the prescriptive regulations concerning in terms of fatalities of a level acceptable to society and emphasizes the lower degree of acceptance of multiple fatalities occurring in a single incident. This residual risk limit represents the opinion of German firefighting associations. Data taken from the London area supports the suggested slope rate, as the level of safety in Britain is similar to that in Germany. The table of prescriptive building regulations and their corresponding objectives aids everyday planning decisions in the context of determining adequate compensation without missing out any essential aspects, such as firefighting and firefighter safety. The proposed table forms the basis of the current discussion of a European model performance-based model building code (PBC) within the European Committee for Standardization CEN. Moreover, the risk curve is the first to be discussed in Germany that takes into consideration the societal aspect. It forms an appropriate basis for performing fire safety risk calculations based on fault tree analysis or Bayes nets. The CEN working group for fire safety engineering discusses both aspects of the current development of a European, performance-based fire safety code. It is presented here for the first time.

1 Introduction

Prescriptive fire safety regulations given in building codes regularly describe common building types and incorporate a typical fire safety design (cf. [1] for standard buildings in Germany and [2] for assembly halls). The prescriptive code in these regulations does not stipulate accepted risk levels, and the residual risk level is generally either unknown or not published by the regulators. Relating regulations contained in laws and subordinate regulations with the relevant safety objectives of the regulations is a matter of trial and error and rather expensive [3]. Such discussions are regularly supplemented with the views and opinions of several stakeholders, including fire departments, building authorities, fire safety engineers and experts, sellers of technical equipment (fire sprinklers, etc.), facility managers, architects, and naturally the building owner. Building regulations incorporate a high degree of experience gained from (regional) incidents.

The situation regarding building regulations in the European Union is even more complex. Laws relating to fire safety levels can only be enacted by the EU member states. And in Germany, fire safety engineers are confronted with 16 laws of the different federal states. In most German states, special buildings like hospitals, retirement homes, and small hotels (with less than 30 beds) are not subject to detailed legal regulation over and above the standard design rule by law and a general cause for “special requirements” or “facilitations” regarding the design of unregulated special buildings (cf. Sect. 51¹ in [1]).

The absence of clearly defined safety levels and the lack of a clear link between prescriptive rules and their objectives must be compensated for by the expertise of the engineer [4,5,6]. It is implicitly assumed in the case of partly prescriptive/partly performance-based fire safety regulations that if all the rules contained in a regulation are applied, the fire safety level will be acceptable [7, 8]. Building regulations clearly cannot foresee every future architectural design concept. In the event of any deviations that exceed the provisions of the building code, regulators included a way to prove that a building is safe enough in terms of the given deemed-to-satisfy solutions (cf. the so-called “deviation” Sect. 67² in [1]). Every deviation must be designated and described, its objective stated, and the solution given explained.

Risk methods exist in a more or less prescriptive environment that can be used in cases for which no performance-based codes apply [9,10,11]. However, the links between functional requirements and safety objectives and between prescriptive rules and the protection levels for people’s lives resulting from the given solutions remain unclear. Therefore, comparing the regulations with a pure performance-based design (PBD) for fire safety is both complicated and expensive. Hopkin et al. state “For uncommon buildings, adequate safety cannot be based on precedent and an explicit evaluation of the adequacy of proposed safety features may be required” [12].

To aid the understanding of this paper, we provide an overview of the German fire safety regulations system for buildings.

After the founding of the Federal Republic of Germany in 1949, legislation was divided between the federal government (“Bund”) and the Federal States by the Constitution. In 1954, the Federal Constitutional Court (“Bundesverfassungsgericht”) determined that the former building police law would be the responsibility of the federal states with the planning law assigned to the federal government. To avoid the fragmentation of the law, the federal government suggested that the states could relinquish their legislative competence for individual housing regulations if they worked with the federal government to develop a standard model building code (“Musterbauordnung (MBO)” [1]). Work on drafting the model building code began in 1955 and the first version was published in January 1960. This model building code forms the basis of the states’ building codes and has the primary purpose of regulating the safety requirements of buildings. It means that fire safety is regulated individually yet similarly in every federal state by the respective building code.

The building code regulates first and foremost fire safety in residential buildings (“standard buildings”). The required fire safety level depends on the building class (“Gebäudeklasse”), which classifies each building according to its risk in building class 1, 2, 3, 4, or 5. However, there are also so-called “special buildings” (“Sonderbauten”), which are associated with a significantly higher or lower risk than standard buildings. If the risk is higher, special fire safety requirements may be imposed; if it is lower, facilitations may be permitted. For some common special buildings, such as assembly buildings, high-rise buildings and car parks, special requirements and facilitation are regulated in legal ordinances or administrative regulations, which means that they do not have to be assessed as individual cases. These are also based on model regulations and are similar in all federal states. The building codes sets the generic requirements.

These generic requirements are specified by technical building rules (“Muster-Verwaltungsvorschrift Technische Baubestimmungen (MVV TB)”) [13] as a regulation. This model is implemented at federal state level. The technical rules for design and construction of structural works, construction techniques, and construction products were thoroughly amended and merged into this rule in 2016. It is mainly a translation table between functional requirements and the technical rules set in standards by DIN and CEN. There is no administrative regulation for fire safety engineering yet, although a German standard exists [10]. Before establishing DIN 18009 as a technical rule by regulation in the MVV TB, the federal states initially aimed to gain experience with the application of this standard.

Figure 1

Overview of the interaction of EU, federal, and state-specific building law in interaction with planning and fire law

An overview of the relationship between the European Construction Products Regulation (EU-CPR) [14], the German model building code (MBO) [1] as basis for the sixteen state building codes, the following administrative regulation(s) [13], the sixteen firefighting laws and the federal law concerning the urban planning,³ which is then laid down in urban planning regulations, is given in Figure 1. The federal planning law has the task of defining the legal quality of the land and its usability; it regulates the area-related requirements for a building project.

Federal states differ in terms of who is responsible for the monitoring of fire safety regulations. For standard buildings, fire safety is generally not controlled or monitored by the building control authority, but by a qualified expert who certifies that the building complies with the fire safety requirements. In the case of special buildings it is generally required that proof of compliance with the fire safety regulations is issued by an expert and subsequently examined either by the control authority or another expert (design review engineer), depending on the federal state. As part of the monitoring process, the fire department is consulted either by the building control authority or the design review expert.

The same applies in the event of any deviations from the fire safety regulations. Depending on the federal state, either the building control authority or the design review engineer is responsible for approving deviations. However, in both cases, the fire department is involved by providing comments. An approving role can be transferred within the city from the building department to the fire department. The application and approval of deviations can become very time-consuming for the parties involved if they disagree on the safety objectives of the regulation that is the subject of the deviation.

2 State of the Art in Terms of functional Requirements and Safety Objectives

Essentially, the question is how to ensure the fire safety of a building that is of a type which is not described in detail in the building regulations (such as special buildings for which no specialized building code has been set out(cf. Sect. 51⁴ [1]): Can the residual risk level be analyzed qualitatively in terms of its functional requirements and fire safety objectives with no complex calculations?

This is all the more crucial in cases where calculation methods like fault-tree-analysis [15, 16], Bayesian networks nets [17] and the life-quality index [11] by engineers are not considered adequate in a cost-benefit-analysis (CBA), as they are time-consuming and thus expensive when applied to determining fire safety in common buildings.

The efficiency of building regulations and, in particular, fire safety regulations can be assessed using methods taken from economic analysis of law, which in turn is based on methods borrowed from welfare economics, such as cost-effectiveness analysis (CEA). A sub-form of CEA is cost-utility analysis (CUA), which Schleich [18] used to compare the efficiency of English and German building regulations in the context of fire safety. The comparison was based on the associations between the regulations and their objectives and form the basis of the example in this article [18].

Also, existing buildings require regular fire safety inspection. The then observed level of safety is often at a lower level as described in the building regulations (“Is the building still safe enough?”). This can result out of a changed law, as grandfathering clauses legally protect owners from having to customize their buildings with every building law amendment (based in Germany on the constitutional right to property, cf. Article 14 “Property” in [19] and the associated federal building law). To identify a maybe too low level of fire safety it is necessary to understand the connection between functional requirements and the objective underneath. For a CUA, it is primarily necessary to examine the objectives concerning the safety of people including rescue teams. So far, no such table that links objectives with functional requirements has been published. The matter is currently being discussed by CEN technical committee 127, working group 8 “fire safety engineering”, of which the authors authors 1,3 are members.

Pedro et al. [20] gave the most comprehensive comparison of the formulation of building regulations in the European Union up to this time already in 2010 and found that at that time only the building regulations of England of the then EU member state United Kingdom were formulated and designed as a performance-based code. According to our research, in a global comparison, New Zealand currently has building regulations that are furthest along the path towards a pure performance-based code [21].

Once the discussion concerns the safety of people, including rescue teams like firefighters, it will be vital to discuss the associated risks. Since risk is defined as the probability multiplied by the loss or impact caused, therefore from a scientific point of view that the risk of 300 individual losses of life in a year (as was the case in Germany in 2018 [22]) is the same as that of 300 people dying in a single event if there are no fatalities otherwise.

According to Leksin, “The typical well-known acceptance value which can be found in different pieces of literature and numerous regulations worldwide in the field of fire risk (in general) is $1 \times 10^{-6}$ per year and per person.” [23]. This concept of risk is in line with the definition of risk, as mentioned above.

Gardner used the measurand years-of-potential-life-lost (YPLL) as an equivalent unit for calculating potential death and years of life lost. The YPLL is thus an indicator of premature mortality. The number represents the total years that are not lived by an individual who dies before reaching the age of 75 [24]. According to Gardner a single value has to be defined by way of societal, ethical or pure governmental decisions. “Every country has to determine its own value of acceptable risk criteria according to the national regulations. As a first step, the real figures of the accidents have to be considered, and they must be adapted and optimized after a certain time. This should be applied individually” [23]. In opposition to this one-value safety level, the need for an ethical and not purely mathematical approach to safety when it comes to simultaneous and multiple deaths caused by the same incident or accident is the subject of broad discussion [25]. From a researcher’s point of view, therefore, an F-N curve [26] is needed; this will be discussed in Sect. 4.2. F-N curve is a complementary cumulative distribution plot curve, the frequency (F) of events which causes at least N fatalities (N) on log scales. Meacham [27] has also already described ideas for risk-optimized building regulations as a social task, but with a global approach.

From our experience in developing a model performance based code (PBC) in the EU at CEN, these two topics we present are the main problems we face: What are our objectives, and what does the law state technically? How unlikely must a “catastrophic” fire be? As PBC’s are largely missing in Europe, deviations are now an allowed thing to do, requiring a “formality” of the answer: “From what requirement do we deviate and how far do we deviate from it?”. From viewpoint of the authorities having jurisdiction, a lot of engineers fail in these two aspects when providing solutions that cannot be accepted. Therefore in the next step, we can and have to develop a PBC out of the proposed table and the F-N curve.

3 Methodology

As mentioned above, the aim of this article is to develop a readily understandable schema for evaluating fire safety measures without any complex simulations of acceptable residual risk. There are various ways of doing this, such as using images, texts or algorithms/flowcharts, of which the algorithm/flowchart is the one best suited for use in complex environments [16]. In our case, the flowchart presents the starting point as circles, a question as rhombus, and possible answers as rectangles [28]. Figure 4 describes the basic idea for assessing fire safety risks without the use of simulations.

Figure 2

Flowchart, matching regulatory requirements with objectives and scenarios, including residual risk aspects

The flowchart, shown in Figure 4, is supplemented by two parts: At first, Table 1 for the connection between the fire safety objectives and the functional requirement in Subsection 3.1. Second, in described Figure 3 the graph is used to testing the societally acceptable residual death risk in a fire as in Sect. 3.2. Only when all three components (algorithm/flowchart, table, and figure) are combined, it is possible to evaluate the fire safety measures without any complex simulation or calculations.

3.1 Linking Fire Safety Objectives with Requirements

Using a table, it is possible to link the prescriptive requirements from a building regulation with a fire safety objective. Table 1 consists of several components, as follows.

3.1.1 Column: Functional Requirement

This column sets out the prescriptive requirements of the building regulations (as in [1]).

3.1.2 Column: Objective

This column describes the general fire safety objectives described in the “functional requirements” column.

There are six fire safety objectives:

• (a) the load-bearing capacity of the construction must be assumed for a specific time [14].

• (b) the generation and spread of fire and smoke within the construction works must be limited [14].

• (c) the spread of fire to neighboring construction works must be limited [14].

• (d) the occupants must be able to leave the construction works or must be able to be rescued by other means [14].

• (e) the safety of rescue teams must be taken into consideration [14].

• (f) effective fire fighting must be enabled (additional special fire safety objective that must be considered in Germany [1] or international [29]). Effective fire fighting is a German special objective which includes the safety of rescue team by the EU.

3.1.3 Cell: Objective

Each feature in the objective column is now defined as to whether the linked regulation, i.e. functional requirement, is also related to the appropriate fire safety  objective. There are four possible qualitative connections. These are:

• Empty cell = The requirement described is not related to the fire safety objective.

• ■■ = Requirement serves solely this objective.

• ■ = Requirement serves two or more objectives to approximately the same degree.

• $\square$ = Requirement serves this objective to a lesser degree than another objective.

3.1.4 Line: Functional Requirement

Essential legal requirements and corresponding prescriptive requirements (e. g. [1]).

Figure 4 shows four examples of how the functional requirements are linked to safety objectives and the goals. The main table (see Table 1) only shows the link between the requirement and the safety objective.

3.2 Societally Acceptable Residual Death Risk in Case of Fire

The key objective of fire safety is to ensure the “safety of building users” (cf. Sect. 3⁵ in [1]). The incidence (fatalities per fire) place a vital role in assessing the distribution of deaths in terms of the number of people dying in the same fire. It is assumed that a single fire with one or two deaths has a higher probability of occurrence and is deemed as acceptable (albeit regrettable).

In contrast, a single fire incident with many victims is regularly the cause of changes to building regulations at the political level. Examples of these are:

• Grenfell Tower, 2017—72 fatalities [30]: The use of flammable building materials in the façade led to a discussion of and the testing of building materials

• Düsseldorf Airport, 1996—17 fatalities [31]: Fire safety plans were enacted for new buildings in GER

• Ringtheater in Vienna, 1881—at least 384 fatalities [32]: Amongst other measures, the use of an iron curtain in theaters became mandatory

The Grenfell Tower fire had a severe impact on EU-legislative considerations on fire safety in recent decades; the EU took action (see https://efectis.com/en/fire-information-exchange-platform-fiep-2/) leading to a debate being held in the EU parliament on September 13, 2017. Since discussion reached the EU parliament, which is not responsible for legislative and regulatory arrangements in the EU member states, it can be assumed that this loss of life was not societally acceptable.

The fire at Düsseldorf Airport in 1996 triggered an equally heated discussion on security and damage claims. Discussions about residual risk resulted in the Düsseldorf fire department being enlarged, and fire safety concepts devised by fire safety engineers for buildings other than dwelling houses, such as airport buildings, becoming a mandatory precondition for a building permit [33]. Equally, the fear of multiple loss of life in a single fire was another core theme of the public discussion.

At last, a very “non-acceptable” fire death toll must be taken into consideration. This fire is still remembered, although it was nearly 140 years ago. Officially, 384 people died in the fire in the Ringtheater in Vienna, Austria in 1881 [32], (according to Eisenberg’s historical description [34], there were even 1000 deaths). This vast loss of life transformed security measures throughout Europe. Mandatory fire curtains were now installed between stage and audience, and materials had to be flame retardant. Such life loss is still the recognized safety level basis of German special construction regulations [2, 35].

To sum up, these incidents resulted in multiple simultaneous deaths, triggering intense societal and political discussions on the subject of fire safety. On the other hand, the occurrence of 244 fatalities ($\dag$) in 244 fires [36] would appear to be politically acceptable. The incidence of rare fires causing many fatalities and multiple fires involving only one death can be combined mathematically.

All the following data refer to the period of 1996–2000 in London (UK). First, the mean population in London between 1996 and 2000 is calculated [37], where ($\bar{p}_{L}$) is given by Formula 1:

$$\begin{aligned} \bar{p}_{L} = \frac{(6.94+6.99+7.04+7.11+7.19) \times 10^6}{5 \text{years}} = 7.05 \times 10^6. \end{aligned}$$

(1)

Using Formula 2, we then split the total fire deaths in London (UK) of $n = 279$ into individual incidents [36]:

$$\begin{aligned} n = 279 \dag = {\left\{ \begin{array}{ll} 1 * \dag &{} n = 244;~\Sigma = 244\\ 2 *\dag &{} n = 12; ~\Sigma = 24\\ 3 * \dag &{} n = 2;~\Sigma = 6\\ 4 * \dag &{} n = 0 \\ 5 * \dag &{} n = 1;~\Sigma = 5. \end{array}\right. } \end{aligned}$$

(2)

With Formula 3, we then calculate the probability of death p per incident in London (UK) per year by incident with:

$$\begin{aligned} p = \left( \frac{sum~of~death~between~1996~and~2000}{5~\text{years}} \right) / \bar{p}_{L} . \end{aligned}$$

(3)

This results in the following average probabilities of fire deaths per year in London, as a measurand for the acquired level of safety in buildings (see 4):

$$\begin{aligned} Probability~of~death~_{incidents} = {\left\{ \begin{array}{ll} p_{1} = 6.92 \times 10^{-6}\\ p_{2} = 6.80 \times 10^{-7}\\ p_{3} = 1.07 \times 10^{-7}\\ p_{5} = 1.41 \times 10^{-7}\\ \end{array}\right. }. \end{aligned}$$

(4)

The probability of death per incident calculated for London, together with the three major fires (Grenfell Tower, Düsseldorf Airport and Vienna Ringtheater) as rare incidents constitute the basic data underlining the negative slope rate in Figure 3.

4 Results: Fire Safety Design Algorithm

An algorithm is used to guide fire safety engineers through the assessment of a fire safety plan in complex surroundings, as illustrated in Figure 2 in accordance with DIN 18009 [10].

As the building law in the Federal Republic of Germany is the responsibility of the federal states, the requirements for the qualification of fire safety engineers differ between the federal states. However, these requirements are comparable. As a rule, they are civil engineers or architects who have completed further training in fire safety. State-approved experts for the review of fire safety design (GER: “staatlich anerkannter Sachverständiger für die Prüfung des Brandschutzes”) or review engineers for fire safety (“Prüfingenieur für Brandschutz”) have to pass a further state examination. These fire safety engineers must provide evidence of 5 years of practical experience in the fire safety design for buildings. Since the concretization of fire safety objectives via functional requirements up to performance criteria, deemed to satisfy solutions and verification methods in terms of a PBC have not been determined to date in Germany, this is not the subject of the qualification of fire safety engineers to date. Nor is this the subject of the qualification of officials of the building control authorities and fire departments. Such a determination exists in the building regulations of England and especially in those of New Zealand. Our algorithm helps these engineers to handle objectives, functional requirements and the safety necessary.

This section details the use of the algorithm in Figure 2 (whereby Q = Question, A = Answer, T = Tool, and D = Todo). The circle indicates the starting point of the schema.

Q1: “Prescriptive regulation met” is the question as to whether the building in question fully complies with all legal regulations. The possible answers are A1: “Yes” followed by D2: “Documentation of fire safety concept” or A2: “No” followed by todo D1: “Matching performance requirement (prescriptive) with objective” to check the fire safety concept. The first possible tool, T1: “Requirement vs. Objective” (see Table 1), is now available for this purpose. The aim is to link prescriptive requirements from the regulations with the relevant protection objective. The precise application of the table is described in Sect. 3.1. Once the functional requirements are assigned to the appropriate fire safety objectives, question Q2, “Which objectives are affected?”, follows. This asks whether the essential protection objectives in fire safety have been observed. The possible answers are A3: “Rescue teams’ safety” which refers to the safety of firefighters involved in a fire in the building, A4: “Occupants’ safety” which relates to the safety of the building occupants, and A5: “Economic loss” which concerns the—possibly extreme— financial consequences of a fire. These three possible answers are used to check that the leading fire safety objectives are being met.

Question Q3: “Effect of deviation on protection objectives?” concerns the extent of a deviation between building law and fire safety objectives. The second tool is T2: “Simulations, expert judgment, calculation”, which follows answer Q3. [38] gives a brief description of this topic. This is followed by D2: “Documentation of fire safety concept” i.e. a description of measures taken. In particular, the procedure described must be such that it remains transparent well into the future; documentation follows Q4.

Question Q4: “Dual control principle; Acceptance” concerns the application of the dual control principle in fire safety during testing as explained in Sect. 1 by the authorities or a design review engineer. This requires a second independent person who only checks the consistency of the concept. Depending on the respective regional state law, control authorities or independent experts can be drawn on for this purpose (e.g., Sect. 66⁶ in [1]). If the answer is A6: “Yes”, it ends with "design approved". If the answer is A7: “No”, the schema returns to the start, and a new run must be performed.

4.1 Tool 1: Law Based Functional Requirements and Underlying Objectives

As discussed above, objectives must be identified from prescriptive regulations in order to assemble a fire safety design. Table 1 is based on an intensely discussed proposal to combine functional requirements of the German model building code [1] with the underlying objectives. Since such tables or legal explanations by the law or the relevant ministries in the government are not yet available, the present table shall to be discussed and ratified by authorities such as the bodies of the Building Minister Conference Germany. These bodies develop the model building code too. The table has firstly been discussed between the German representative of the building authorities for the matter of Fire Safety Engineering (FSE) and its equivalent with the German Fire Departments. Intensifying the development has been discussed in the corresponding fire safety engineering committee at DIN (GER) and CEN (EU) (DIN NA 005-52-21 AA and CEN TC 127 WG 8 “fire safety engineering”). It connects requirements and objectives as explained in Sect. 3.1.

4.2 Tool 3: Proposal for Graded Acceptance Criteria of Annual Fire Death Risk

An essential aspect of fire safety design is the level of accepted residual risk that people will die in a fire, since no building is entirely fire proof. This means that people will always be at some risk of dying as a result of a fire. The main question, however, is how the fatalities are distributed among the criteria. An F-N curve could assist the decision making.

Figure 3

Limit curve of fire safety. Solid line: F-N curve proposed by AGBF [39] for Germany. Dashed line: common risk value as used in [23], without recognizing societally accepted life loss caused by the same event/fire. Symbols: Observed simultaneous fire death risk in the City of London from 1996 to 2000 [36] calculated as the probability per incident. Colored dots: Rare historical events for orientation (17 fatalities at Düsseldorf Airport (DUS) GER, 79 fatalities at Grenfell tower GB, 384 fatalities at the Vienna Ringtheater AT) (Color figure online)

Figure 3 presents the graphical and mathematical processing of the algorithm’s general fire safety goal as tool “T3”.

The first draft was formulated by the German Fire Departments, but it is now being presented quantitatively for the first time. The German fire services (professional and voluntary) proposed incorporating a tiered security level as an F-N Curve. This proposal was widely discussed within the expert group of the prevention departments in the fire departments (“Arbeitskreis Vorbeugender Brandschutz”—Preventive Fire Protection working group- of the Association of Heads of Professional Fire Brigades in the Federal Republic of Germany (AGBF Bund)—as well as in the Association of German cities and Towns (“Deutscher Städtetag”). It was finally acknowledged by the group for fundamental issues of the Association of Heads of Professional Fire Brigades in the Federal Republic of Germany (“Arbeitskreis Grundsatzfragen” AGBF Bund) [40].

The curve describes the acceptable risk limit considering the reached level of safety due to prescriptive building regulations. As a rough estimate, the German Fire Departments calculated an average starting point of 300–400 fire fatalities per year divided by 80 million (the population of Germany), resulting in an IRPA of $5.0 \times 10^{-6}$ due to fire. This is based on the fire death statistics in Germany in recent years (406 fatalities in 2006, 346 in 2007, and 398 in 2008). The figure fell to 306 by 2018 [22]. “This risk was averaged over all age levels, mobility levels, types of uses, and regions (city/country) and could, therefore, represent the starting point of the straight line. The average personal risk of death or personal accident risk for a year is about four to two orders of magnitude higher. Taking into account the introduction of smoke alarms in 2019 by fourteen out of sixteen federal states, there would be a starting point of the straight line, which reflects the individual risk of death due to a fire, of $3.0 \times 10^{6} a^{-1}$” [39]. The slope rate was a qualitative proposal that has now been improved by the addition of data calculated in Sect. 3.2 based on data in [36]. The German “RABT” tunnel safety rule was taken into consideration [41], which integrates the higher need for safety measures when more traffic passes through, although these scenarios are rare. The RABT fulfills Directive 2004/54/EC of the European Parliament and of the Council of 29 April 2004 on minimum safety requirements for tunnels in the Trans-European Road Network in Germany. Wang et al. showed for China an almost identical slope rate and data for fire societal risk criteria [42]. In particular, there is a comparable level of safety level between the data from the London Fire Brigade (see Figure 3), the European Union [18] and the safety level in Germany [39]. China also has a very similar pattern [42].

When formulating a fire safety concept, one important consideration is to prevent extreme events. An extreme event is one involving many lives being lost due to the same fire, but it may only occur very rarely. This is illustrated in the form of a graph. The number of deaths resulting from the same incident is described as the incidence value on the x-axis. The y-axis describes the probability that an equivalent extreme event will occur yearly. The incidence figures of the London Fire Brigade (UK) are plotted in Figure 3 with incidences of 1, 2, 3, and 5 (for the calculation basis, see Sect. 3.2). The Düsseldorf Airport, Grenfell Tower, and Vienna Ringtheater incidents, which were the subjects of intense political discussion, are shown for orientation.

As mentioned above, Leksin defines a one-value level of safety as $1 \times 10^{-6}$ per year per person [23]. This value is the individual risk per annum (IRPA) and is shown as a horizontal, dashed line in Figure 3.

The precise probability of an extreme event occurring cannot yet be described in a fire safety concept, but it is of great relevance when considering the fire safety concept as a whole. A detailed approach about vulnerable populations is not given, too. Out of the list of special buildings, whom the building law applies the need for a fire safety design concept, one could gain the idea what is the starting level to consider special preventive measures (cf. Sect. 2 MBO [1]; e.g. more than 10 children in a kindergarten, 6 elderly people in one unit, one intensive care patient, 12 hotel beds). The graphic serves the fire safety engineer as a thought-provoking impulse to take the extreme (and catastrophic) event into account. Such incidents are not acceptable by society although rare but not impossible. DIN 18009-1 [10] includes a method to identify these scenarios in Figure 3 of this German standard.

Figure 4

Links between functional requirements, protection goals and objectives, using four examples

4.3 Application: Munich (Germany) City Hall

In the City of Munich (Germany), the combination of the above-proposed ideas led to a significant reduction in facility management costs for fire safety. Munich Town Hall is said to have enhanced its fire safety [43]. A saving of several ten million euros was achieved between the plans previously made by a fire safety engineer. The fire safety engineer based his planning on the prescriptive specifications (Bavarian State Building Code, based on the model building code at the time; cf. [33]). Whereas

• the Munich Fire Department (fire safety inspection duty and fire safety advisor within the City of Munich council),

• the City of Munich itself as the building owner/user, and

• the building control authority (legal authorization)

achieved the saving by applying the algorithm in Figure 2. In detail, the deviations from the building code and the resulting improvements were assessed in terms of their direct impact on the safety of people’s lives (cf. Table 1, objective “d)”) and by considering the estimated number of people directly affected (cf. Figure 3) taking into account grandfathering clauses.

Munich Town Hall was built between 1867 and 1906 and refurbished after World War II. The building, of course, developed over time. The main problems were that in this building—which is under heritage protection legislation⁷—the stairs were openly connected to halls, installations breached the compartmental system of fire-resistant walls and ceilings (including electrical installations such as Ethernet cables being fed through forced air heating ducts also, all rooms and floors were connected), the smoke detection system did not function properly, and means of escape routes and fire-fighting access routes were not accessible. Besides fire safety, water hygiene was another major problem [43].

A fire safety engineer was hired on a private contract basis to develop a plan for the renovation. The Munich Fire Department was not included. The fire safety strategy concept which would have met and fulfilled the legal requirements in 2006 (documented by the fire safety concept), the costs soon reached a level that drew political attention to the matter. The Munich City Parliament took a political—but lawful—decision labelled “Yes to fire prevention—but with a sense of proportion” on October 5, 2011 instructing the Munich Fire Department to develop methods for legally complying with fire risk reduction in public buildings on the basis of a cost-benefit analysis. “The aim here is to ensure a uniform level of security based on building law requirements, taking economic efficiency into account.” (Sect. 2.1.1 in [43]). The fire inspection conducted by the Munich Fire Department then set out all deviations and categorized proposed measures for the Munich Town Hall de facto using the above method.

The political decision states: “With the elimination of the deficiencies from the fire inspection from 2012, the most important fire safety objectives of defensive fire protection such as sufficient time to escape the people in the building, sufficient time for the fire department to rescue people and effective fire fighting are met. Further improvements, such as the early detection of fires and the prevention of the uncontrolled spread of fire across the entire building complex, are to be determined in terms of property protection and evaluated with regard to feasibility. The Bavarian Insurance Chamber is consulted” [43].

This quote shows that recognizing legal grandfathering clauses and linking functional requirements to objectives can significantly reduce costs. The objective of limiting the spread of smoke was the first one to be assessed as it had the greatest effect on people’s safety. This led to the installation of smoke-resistant doors between the stairs and floors and the expansion of the smoke detection system; also, the air heating cable installations were densely padded with non-combustible mineral wool. Although the padding did not gain legal fire safety approval requirements it did satisfy the objective of “limiting smoke spread”. “Specifically, this means that now only original fire safety deficiencies (e.g., faulty fire alarm system, locked emergency exits, combustible storage, safety-relevant structural defects) are assessed—taking into account the efficiency of the Munich Fire Department” [43].

5 Discussion

As van Coile et al. [44] showed, a life quality index can be used as an indicator with which to compare fire safety measures. Similarly Hopkin et al. [12] presented their J-value “to evaluate investments in fire safety [...]”, and de Sanctis and Fontana discussed “the LQI criterion [...] to an evacuation problem optimizing the required door width for Swiss retail buildings” [11]. From our point of view, all of these methods can help identify the level of safety in a building design. Nevertheless, in a mostly prescriptive environment, it is both time- and cost-intensive to evaluate these schema fitting to the deemed-to-satisfy solutions by law. In line with these ideas, the question of whether this method of identifying objectives from functional requirements represents the current state of the art to be used for deviations from standard building regulations will remain the subject of intense discussion.

This paper is a response to the development of a performance-based code for the European Union together with CEN. We realize that the data set is small, but it complements the approach taken by Meacham et al. [27], now with a more specific means of linking the theory with the safety objectives.

In their article in 2018, van Coile et al. discussed the first point in their schema entitled “Fire safety engineering design & its objectives” (see Fig. 1 in [45]). They provide several sources for objectives to be followed besides the building regulations. Despite considering all the cited sources, there is still no clear link between the given prescriptive requirements and the according objectives. This link is now given in Table 1.

The move away from prescriptive regulations to a performance-based code remains a demanding but necessary task for regulators. It is hoped that Table 1 will be an asset for discussing the underlying objectives and the safety levels associated with the requirements. As this link is not openly revealed by building control authorities and the proposal given here has only been developed through years of experience in discussing and developing both fire safety plans and fire safety regulations (as two of the present authors are involved in this field of expertise), it is still a subject of discussion and is hard to prove scientifically in the strict sense.

Furthermore, the slope rate of the proposed F-N curve represents a rather rough estimation based on qualitative arguments, little data, and societal and political observations. As this curve is a limit to be discussed, current curves are one or two orders of magnitude less strict (cf. Fig. 7 “F-N diagram” BS 7974, Part 7 2019 + A1 2021 [46]) and seem to take the approach that fatalities due to fires are comparatively rare, since fires in general are rare events (for instance compared to total numbers of flu or Covid-19 victim). The starting point is, nevertheless, a back-calculation of total fatalities as observed in Germany in recent years and which is open to comparison between different countries with comparable safety measures (such as in the European Union). The number of victims is difficult to determine because no detailed statistics on fire deaths are available from these data sets [22]. China collects more data and led to a fire societal risk criteria F-N-curve published already in 2005 [42]. Their data is very similar to the European fire safety and about half a magnitude higher in deaths per incident. Nevertheless, our proposal plays a role in avoiding high-risk solutions and taking societal requirements into account.

The main finding of Schleichs’ CUA [18] of British and German building regulations was that both sets of regulations were similarly effective and that no cost savings could be expected from changing these regulations without lowering the current national level of safety. However, cost savings can be anticipated from optimized building permit procedures, particularly by reducing the discussions of deviations, which can consume a great deal of time and money. The application of Table 1 will serve to avoid such discussions because it concretizes the functional requirements related to each fire safety objective. Where a deviation from a deemed-to-satisfy-solution is given in the regulations, Table 1 can help fire safety engineers, building control authorities, and fire departments to identify the fire safety objective in question and conduct a systematic search for a reasonable alternative solution that reduces the risk associated with the deviation as reasonably practical (usually an equivalent risk following the ALARP principle [44]). The same applies to the proposed F-N curve in Figure 3. In Figure 3, this closeness in safety allows a comparison between the German fire department’s proposal and the data from the London Fire Brigade, as discussed in Sect. 3.2. This not only clarifies the fire safety objective behind each functional requirement but also states the level of safety as a design value, which can be used for alternative solutions using advanced fire safety engineering methods (i.e. performance-based design).

Regarding the use of a mathematical curve, the question is, from a societal point of view, whether it should not end at 10 or even 100 deaths per fire. Mathematically, this represents a discontinuity, which, however, cannot be simulated in a risk-based model with scenario analysis. Nevertheless, an assessed risk of 100 deaths per fire is necessary, because extreme and implausible scenarios do occur (such as a terrorist attack in which a plane destroys all available escape routes). These rare events can then be neglected when compared to the proposed curve. If 100 fatalities are never acceptable in a risk assessment, from a mathematical point of view, these buildings should not be erected at all.

From the authors’ point of view, this curve should be incorporated in the discussion on fire safety engineering and the development of a performance-based code from existing prescriptive regulations, recognizing the combination of regulative requirements and the idea of risk-based engineering as accepting the loss-of-life-risk not to be “one-value $10^{-6}$”. The algorithm in Figure 2, Table 1, and the residual risk as presented in Figure 3 can lead to a minimum legal safety level. Also, the subjective point of view (opinion) could be objectified.

6 Conclusions and Outlook

Without the need for costly and time-consuming calculations as part of a PBD approach, the proposed methodology can be used to link requirements with fire safety objectives. Its use requires no profound knowledge of mathematics, risks, or computational science. Simulations or other calculations are not stand alone tools that give a complete overview of the fire safety level reached [9]. If a large number of people are threatened simultaneously, when the graded, permissible risks are observed, it automatically leads to higher material requirements or greater redundancy.

Table 1 should be used as the basis for further discussion, to justify this expert knowledge—that by legal definition cannot be proved. The proposal for a graded acceptance F-N curve can be used to discuss, for instance, the results obtained with an event tree with the authorities involved [26]. Overall, the algorithm can be used as a framework for the usage of fire safety engineering in a future performance based code environment in Germany—as it ensures the consistency within the jurisdiction like in New Zealand’s approach.

It was found that the safety level established by the prescriptive code is in accordance with the proposed slope rate. With the above table and chart in mind, stakeholders can take a broader view when discussing how to improve a building’s fire safety and understand a cost-effective design.

The suggested next step would be to improve the documentation and statistical analysis of fires involving multiple simultaneous victims. The discussion of the safety level determined using a graded approach must then be based on better data. The objectification of future fire safety design could lessen the impact of the human factor [16] in terms of differences in knowledge, expertise, or even personal interest, to enable the most efficient cost-safety ratio in engineering fire safety (CEA).

7 Appendix: Table 1

Key to Table 1:

• (a) The load-bearing capacity of the construction must be assumed for a specific time.

• (b) The generation and spread of fire and smoke within the construction works must be limited.

• (c) The spread of fire to neighboring construction works must be limited.

• (d) The occupants must be able to leave the construction works or must be able to be rescued by other means.

• (e) The safety of rescue teams must be taken into consideration.

• (f) Effective fire fighting must be enabled.

■■ = Requirement serves solely this objective

■ = Requirement serves two or more objectives to approximately the same degree

$\square$ = Requirement serves this objective to a lesser degree than another objective

(a) to (e) Requirements correspond with [14] Annex I “Basic requirements for construction works”, No. 2, f) refers to Sect. 14⁸ in [1] and is derived from the requirements for the safety of emergency teams and their functional needs.

Table 1 Linking Functional Requirements by German Model Building Code with Its Relating Objectives