Probabilistic Performance-based Fire Design of Structures: A Hazard-Centred and Consequence-Oriented Perspective

Abstract

Risk-based design and assessment methods are gaining popularity in performance-based structural fire engineering. These methods usually start by defining a set of hazard scenarios to use as analysis inputs. This approach, proven highly effective for other hazard types such as earthquakes, may not be optimal for fire safety design. Indeed, the strong coupling between the fire phenomenon and structural features enables an ad-hoc design variable selection (and/or optimisation) to reduce fire intensity, making fire scenarios additional design outputs. In addition, such a coupling effect implies that fire scenarios maximising consequences are structure specific. Building on these considerations, this paper discusses the limitations that arise at different analysis steps (i.e., fire-scenario and intensity treatment, identifying fire intensity measures, probabilistic fire hazard analysis, developing fire fragility models, and risk calculation) when using conventional risk-based approaches for design purposes. Furthermore, it compares such approaches with a fire safety design methodology (the Consequence-oriented Fire intensity Optimisation, CFO, approach) that addresses the identified limitations. The potential benefits of integrating the two approaches are also discussed. Finally, the fire design of a simplified steel-girder bridge is introduced as an illustrative example, comparing the consequence metrics and design updating strategies resulting from the two approaches.

1 Introduction

Monetary losses and casualties induced by recent fire accidents worldwide (e.g., [1,2,3]) have spotlighted potential deficiencies of the current design practice for structural fire safety. Significant examples of catastrophic fire consequences on different types of civil infrastructure systems include: the collapse of the World Trade Centre (U.S.) in 2001, with 2977 fatalities and $9.6B in property losses [4, 5]; the MacArthur Maze Bridge (U.S.) collapse in 2007, which caused more than $9 M direct economic losses and 26 days of downtime [6]; and the Jinji Tunnel (China) fire in 2014, which led to 40 deaths and significant damage to the tunnel structure [3, 7]. In all these instances, design deficiencies or lack of a fire safety strategy (e.g., lack of fire protection on the MacArthur Maze Bridge, lack of ventilation facilities in the Jinji Tunnel) and unexpected failure modes (e.g., external column instability due to the softened floors in the World Trade Centre collapse) can be identified. Moreover, it remains uncertain whether these events could have led to more serious outcomes. The effectiveness of potential countermeasures or design choices in preventing such severe consequences is also an open question. More generally, appropriately treating the design process’s uncertainties emerges as a critical issue.

To cope with that, risk-based design and assessment approaches for natural hazards such as earthquakes and wind are gaining popularity in performance-based structural fire engineering due to their refined uncertainty modelling. In particular, these approaches quantify risk by explicitly considering the aleatory and epistemic uncertainty propagation [8] from the input parameters (e.g., design variables and hazard-induced loads) to the output consequence metric(s). These consequence metrics are often denoted as “decision variables” (e.g., [9]) and typically include the number of injuries and casualties, property losses and business interruption [10], among others.

Notably, risk-based consequence metrics can be leveraged for either designing new structures—i.e., selecting components’ topology, shape (i.e., geometry) and size as well as a fire safety strategy to fulfil the performance objectives—or assessing whether already conceived designs/existing structures comply with target performance objectives. This paper delves into the limitations of a general risk-based methodology for design purposes, and there is no attempt to discuss potential drawbacks in assessment procedures.

Conventional risk-based design and assessment approaches span from analytical/numerical methodologies (e.g., first-order reliability method; [11]) and simulation-based approaches (e.g., Monte Carlo sampling; [12]) to address structural reliability problems to procedures based on the Pacific Earthquake Engineering Research centre (PEER)’s performance-based earthquake engineering (PBEE) framework (e.g., [13]), reviewed by Shrivastava et al. [14].

All these approaches start from the definition of fire (hazard) scenarios. Next, they compute the structure’s thermomechanical response to fire and use the results to estimate probabilistic demand models (i.e., structural response in terms of an engineering demand parameter vs a hazard intensity measure) and derive statistics of the resulting hazard-induced consequences (e.g., damage levels, repair costs, downtimes, and casualties). The selected consequence metrics are then appraised against performance objectives. Finally, the design variables are updated until an objective-compliant (or optimal) solution is attained.

However, from a design perspective, the described workflow may not be adequate to ensure truly safe and optimised design solutions. Indeed, during a fire, the temperature distribution within structural elements governs the thermomechanical performance. The evolution of this temperature over time depends on cross-sectional properties and surface heat flux from the fire. In turn, the heat flux is determined by fire characteristics (e.g., flame location and geometry, burning rate), which are strongly coupled with the surrounding structure(s) (e.g., [15, 16]). Specifically, the heated environment affects the combustion process through radiative feedback (changing the burning rate), ventilation constraints, and geometric factors affecting the buoyant fluxes. Furthermore, the release of heat and substances triggers people’s responses to the fire and fire safety measures to control fire growth and spread. This interaction is here referred to as the “fire-structure coupling effect.”

As a result, an ad-hoc design variable selection (and/or optimisation) enables reducing—up to eliminating—the fire impact (i.e., the temperature increase within structural elements). In this sense, a fire scenario should be an analysis output and considered as an additional set of design variables rather than a design input.

Another implication of the fire-structure coupling effect is that fire scenarios maximising consequences are structure specific. Therefore, methods that estimate the consequences of pre-defined hazard scenarios may be unable to identify conditions which maximise fire impacts or may be over conservative. This observation is supported by the work of Borg et al. [17], which highlights the importance of developing fire scenarios that are specific to each structure.

The Maximum Allowable Damage methodology, proposed by Cadena et al. [18], acknowledges these unique features of fire hazard by suggesting that fire-scenario assumptions should be updated during the assessment. Nevertheless, this method does not compute the fire scenario leading to the most severe consequences nor quantify uncertainty propagation to the metrics of interest. Such quantification is instead an advantage of risk-based approaches. However, their reliance on preliminary fixed fire scenarios raises concerns about the result’s significance and hampers their capacity to deliver robust optimal solutions (i.e., insensitive to small changes in uncertain input quantities; [19]). To address these limitations, Franchini et al. [20] have recently developed an alternative methodology to fire safety design called the Consequence-oriented Fire intensity Optimisation (CFO) approach. Thus, the scope of this paper is to:

• Compare a conventional risk-based design approach and the CFO approach, highlighting their differences and the potential advantages of the latter.

• Discuss the limitations of current (probabilistic) risk-based design methods for designing structures subject to fire and show how they can be addressed through integration with the CFO approach.

• Present an illustrative example regarding the fire-safety design of a bridge structure to compare the two approaches and discuss possible outcomes.

The paper is organised as follows: Sect. 2 describes the considered risk-based design method and the CFO approach. Next, Sect. 3 discusses the limitations of different risk-based design components, including fire-scenario and intensity treatment, identifying fire intensity measures, probabilistic fire hazard analysis, developing fire fragility models, and risk calculation. The risk-based and the CFO design approaches are then compared in Sect. 4 through the fire safety design of a single-span bridge. Finally, Sect. 5 draws conclusions and explores future developments.

2 Considered Approaches

Figure 1 compares a conventional risk-based design approach and the CFO approach. Both approaches start by (1) defining performance objectives related to life safety or serviceability limit states, or property protection; and (2) establishing acceptance or tolerance criteria for such performance objectives (step #1). Here, “acceptance” refers to thresholds set by the relevant authority and reflecting a socially acceptable risk level (considering stakeholders’ perspectives and preferences). On the other hand, “tolerance” indicates the willingness of stakeholders to accept certain levels of risk, subject to compliance with available acceptance criteria [10]. Further details on the considered approaches are provided in Sect. 2.1 and 2.2.

Figure 1

Fire safety design: (a) Risk-based approach; (b) CFO approach

2.1 Risk-based Design Approach

A conventional risk-based design approach is presented in Figure 1a. After setting performance objectives and acceptance (or tolerance) criteria, fire scenarios are characterised through probabilistic fire hazard analysis (step #2 in Figure 1a). According to the SFPE (Society of Fire Protection Engineers) Guide to Fire Risk Assessment [10], the essential components of a fire scenario are:

• (i) ignition, which involves identifying the first object ignited and its location;

• (ii) propagation, which refers to the ignition of other combustibles;

• (iii) fire protection features, encompassing both active (e.g., sprinklers) and passive (e.g., layers of fire protection materials) systems;

• (iv) characteristics of the structure or facility under analysis (e.g., compartment size and ventilation, structural layout, cross-sectional properties and shape, materials).

The SFPE Guide [10] also explains that calculating risk requires the occurrence rates of the “postulated” fire scenarios. Such rates are estimated by multiplying the ignition rates and conditional probabilities of the events defining the studied fire scenario (e.g., propagation to other objects, success or failure of a fire protection measure). In addition, the facility’s and the fire protection measures’ characteristics (e.g., material properties) can be treated as random variables and assigned a probabilistic distribution.

An intensity measure (IM) should be selected when computing risk following the PEER-PBEE framework (e.g., [9, 14]). Specifically, an IM is a quantitative parameter used to describe a hazard’s severity in terms of damage (or impact) potential. In this context, the probabilistic fire hazard analysis provides a hazard curve $\lambda \left( IM>im \right)$, representing the annual rate at which an IM level im is exceeded for the considered fire scenario. The consequences induced by these scenarios are estimated in step #3.

Several consequence (or impact) metrics can be used to quantify risk, including structural failure rates for different limit states of interest, loss/casualty exceedance curves (i.e., the annual rate of exceeding various repair cost/casualty levels) or the expected annual loss (e.g., [9]). The last two metrics are denoted as “decision variables” in the abovementioned PEER-PBEE framework. A curve showing the (annual) rate of exceedance of the considered consequence metric can also be defined as a “risk curve” [21]. For illustrative purposes, this paper considers the failure rate, $\lambda \left( F_{LS}\right)$, for a specific limit state of interest (LS), defined as follows:

$$\begin{aligned} \lambda \left( F_{LS} \right) = \int _{im=0}^{\infty } Pr\left( F_{LS}| IM=im \right) |d\lambda \left( IM>im \right) |\end{aligned}$$

(1)

In this equation, $F_{LS}$ indicates “failure” for the considered limit state LS (denoting the general condition of load-induced demand—measured through an engineering demand parameter—being greater than the capacity of the structure or structural component of interest); IM is the intensity measure; $Pr\left( F_{LS}| IM=im \right)$ is a fragility model, providing the probability of failure for LS given that IM equals im; $\lambda \left( IM>im \right)$ is the hazard curve; $|d\lambda \left( IM>im \right) |$ denotes the hazard curve differential with respect to IM (also evaluated at im). This definition refers to the PEER-PBEE framework, wherein the IM variability encompasses the scenario variability.

Event tree analysis is also frequently used to study complex fire scenarios and their consequences (e.g., [22, 23]). When applying this approach, a set of hazard scenarios, their occurrence rate and resulting consequences can be mapped to a loss exceedance curve (e.g., [21, 23]). Similarly, summing the products of those consequence values and their occurrence rates yields a metric analogous to the expected annual loss (i.e., the “total” risk from multiple scenarios; [24, 25]). When using this approach, the failure rate is computed as follows:

$$\begin{aligned} \lambda \left( F_{LS} \right) = \sum _{\text {i}} Pr\left( F_{LS}| scenario_{i} \right) \lambda \left( scenario_{i} \right) \end{aligned}$$

(2)

If a risk-based consequence metric is used for assessment purposes, the design variables are fixed, and $\lambda \left( F_{LS}\right)$ in Eq. 1,2 is compared with an acceptance threshold to inform decision-making. In contrast, for design purposes, the consequence metric calculation is iterated to identify design variable sets that comply with or optimise the selected performance objectives. The dashed arrow in Figure 1a indicates possible changes in the fire safety strategy that affect some of the fire-scenario components described above—typically fire protection features or structural elements’ cross-sectional properties.

2.2 Consequence-Oriented Fire Intensity Optimisation (CFO) Approach

Figure 1b illustrates the CFO approach [20], which is characterised by the following features:

• It treats fire scenarios as design variables: first, it calculates the scenario maximising consequences; next, it identifies design updates that, exploiting fire-structure coupling effects, optimise the balance between increasing structural member capacity and diminishing fire intensity (“fire-intensity optimisation”).

• It is “consequence-oriented,” expressing risk in terms of (maximum) consequences rather than distribution statistics of the considered consequence metric of interest or annual exceedance rates.

• It employs uncertainty propagation techniques to examine the impact of selected random inputs on the computed maximum consequences.

Unlike risk-based design methods, which analyse the structural response to a set of pre-defined fire hazard scenarios, the CFO approach relies on a consequence potential model (step #2 of the procedure). This model captures the relationship between structural features and the fire phenomenon (i.e., the fire-structure coupling effect). In step #3, numerical optimisation is applied to determine the fire-scenario characteristics resulting in the maximum consequences within the specified structural context.

Once the scenario maximising consequences is identified, (plain) Monte Carlo sampling (MCS) propagates uncertainties due to the considered random variables, such as material properties and initial temperature, to consequence estimates. This analysis outputs the distribution of the maximum consequence random variable $\overline{MC}$ (step #3). Such a distribution is used to estimate the probability $Pr\left[ \overline{MC} > MAC \right]$ that realisations of $\overline{MC}$ exceed a maximum allowable consequence threshold (MAC), set by end users in step #1.

The coefficient of variation (CoV) of $\overline{MC}$, measures the robustness of the solution to input variability. A designer must determine which sources of uncertainty are significant for the specific problem being investigated. Consequently, $Pr\left[ \overline{MC} > MAC \right]$ and $CoV(\overline{MC})$ only capture the effect of the selected sources of uncertainty. In contrast, risk-based design approaches aim to estimate a probabilistic distribution of consequences that accounts for all relevant sources of uncertainty, including but not limited to those considered in the CFO approach. Then, based on these results, they calculate statistics of those distributions or exceedance rates of consequences for performance assessment.

The practical implementation of the proposed CFO approach relies on incorporating fire safety in the design process from the early design stages. Such an approach differs from treating fire safety as a distinct assessment of a proposed design. In this regard, existing literature (e.g., [15, 26, 27]) highlights that an iterative and holistic (from climate control and sustainability to structural safety/resilience) design procedure represents the only means to deliver a truly optimised infrastructure. In doing so, the selected fire and heat transfer model capacity of capturing the fire-structure coupling effect (and the model reliability) determines how much a designer can optimise the features of the combustion process and fire dynamics. Nonetheless, applying the CFO approach does not require a specific level of model complexity.

The following section investigates how the fire-structure coupling effect limits the use of risk-based approaches for fire safety design. Furthermore, it discusses how such limitations can be overcome—and the benefits of risk-based design methods still exploited—through integration with the CFO approach.

3 Limitations of Conventional Risk Assessment Procedures for Fire Safety Design

This section discusses the limitations of a conventional risk-based methodology for fire safety design purposes. Specifically, inconsistencies are highlighted in the fire-scenario and intensity treatment, selection of IMs, probabilistic fire hazard analysis, fire fragility models and risk calculation as per Eq. 1,2. While the discussions regarding IMs (Sect. 3.2) and fragility functions (Sect. 3.4) are specific for risk calculations following the PEER-PBEE framework (Eq. 1), Sects. 3.1,3.3, and 3.5 refer to a general risk-based approach.

3.1 Fire-Scenario and Intensity Treatment

The thermomechanical response of a structure subject to fire depends on the spatial and temporal temperature distribution across all the components of the considered system (e.g., [28]), i.e., on the component temperature field, $T_{component}$. This field, which depends on the vector of spatial coordinates $\textbf{p}$ and the time t, allows one to calculate temperature-dependent material property deterioration and stresses resulting from both constraint thermal deformations and relative thermal deformations between elements. Thus, it appropriately captures the fire damage potential to the structure under consideration.

Estimating the temperature field requires a heat transfer model accounting for structural features, X (e.g., thermal material properties, geometry), and a thermal boundary condition representing the energy transferred from the fire to the structure. The appropriate boundary condition is the net heat flux, $\dot{q}''$, which results from an energy balance at all surfaces of the structural system [29]. Because of the fire-structure coupling effect, $\dot{q}''$ is a function of structural characteristics X, fire safety strategy X_strat, and other fire-scenario variables $\boldsymbol{\alpha}$ not included in the vectors X and X_strat. The variables included in $\boldsymbol{\alpha}$ vary according to the complexity of the selected fire and heat transfer model. Generally, they include parameters characterising heat release rate curves, wind speed, ambient temperature, moisture in combustibles and variables addressed as “fire severity measures” in the literature (e.g., maximum fire temperature, fire duration, fuel load density; [14]), which refer to temperature-time curves. The heat flux is only one of the factors influencing the component temperature field:

$${T}_{component}=f\left( {\mathbf{p}},t,{\mathbf{X}},{{\dot{q}}^{\prime\prime}}\left( {\mathbf{X}},{\mathbf{X}}_{strat},{\boldsymbol{\alpha}},{\mathbf{p}}, {\mathrm{t}} \right) \right)$$

(3)

Eq. 3 shows that the damage potential of a fire depends upon X and X_strat. In principle, design decisions can be such that $T_{component}\rightarrow 0$. For example, a stocky concrete section in a large compartment that prevents flashover could be unaffected by the fire. This represents a critical difference between fire and other hazards: for other hazards, it is generally not feasible to alter (up to the point of eliminating) the hazard’s damage potential.

Risk-based approaches rely upon preliminary assumptions on the structural configuration and features to characterise the nominal fire-scenario components listed in Sect. 2.1 (ignition, propagation, fire protection and structure/facility features). These components are then set as analysis inputs and treated as input uncertainty sources for solving Eq. 3 and calculating consequences. For design updating, only fire protection features are usually considered together with the (structural) design variables. In this process, whether the selected ignition source location and propagation path will maximise fire consequences is unclear.

On the other hand, the CFO approach deals with these components differently. First, it develops a consequence potential model that takes into account the listed elements' interaction (fire-structure coupling effect, see Sect. 1). Next, for given sets of combinations of fire protection and facility features (i.e., items (iii) and (iv) in the scenario component list), it uses numerical optimisation to identify ignition and propagation characteristics (i.e., items (i) and (ii) in the scenario component list) that maximise consequences. Finally, it seeks characteristics of items (iii) and (iv) that affect items (i) and (ii) to reduce fire intensity and, in combination with an appropriate structural capacity enhancement, make the maximum consequences acceptable or tolerable. Architectural constraints should be considered in this process.

Therefore, in the CFO approach, updating the design variables (through comparative assessment or optimisation) modifies the consequence potential model, thereby enabling the designing of fire scenarios whose maximum consequences are tolerable or minimised (e.g., [30]). This goal is achieved by optimising the balance between increasing structural member capacity and decreasing fire intensity. Design criteria such as functionality are treated as boundary conditions.

In contrast, risk-based design approaches modify the design variables until the response to the pre-set scenarios is acceptable. Even when design decisions influencing the fire scenario are adopted (e.g., implementing active or passive fire protection, see the dashed line in Figure 1), they affect fire scenarios conceived as—but not necessarily corresponding to—those maximising consequences. Indeed, the conditions maximising fire impacts are structure-specific due to the fire-structure coupling effect. Therefore, assumptions and expert judgement may be unable to estimate maximum fire consequences, especially in the case of complex structures and systems. As civil infrastructure technology is continuously developing (e.g., innovative structural layout, materials, claddings, and building utilities), the meaning of “complex” is broad. Similarly, following a random sampling approach, maximum consequences (if captured) are only one realisation of the selected consequence metric.

3.2 Fire Intensity Measure

In risk analysis following the PEER-PBEE framework, the considered IMs vary depending on the type of hazard being analysed. For example, earthquake-induced ground-motion IMs may include peak ground acceleration, peak ground velocity, or spectral acceleration at a specific frequency (or in a range of frequencies or periods of interest). Similarly, for wind hazards, IMs could include wind speed, wind gusts, or pressure fluctuations. The following characteristics are usually considered to define an optimal IM (e.g., [31]): efficiency (i.e., a measure of the predicted response dispersion at different IM levels); practicality (i.e., a measure of the correlation between IM and structural response, quantified through engineering demand parameters); sufficiency (i.e., a feature of an IM that makes the estimation of the engineering demand parameter of interest for all intensity levels independent of all other parameters characterising the hazard scenario; e.g., magnitude and source-to-site distance for earthquakes); hazard computability (i.e., the effort required for the probabilistic characterisation of the selected IM at a given site/asset of interest).

The component temperature field $T_{component}$ defined in Sect. 3.1 appropriately captures the fire damage potential to the structure under consideration, representing a good candidate fire IM. Nevertheless, the complexities of its characterisation hamper its analysis as a conventional IM for other hazards.

Indeed, Eq. 3 shows that a fire hazard IM depends upon space coordinates and the three vectors ${\textbf{X}}, {\textbf{X}}_{strat}, {\boldsymbol{\alpha}}$, i.e., $IM_{fire}=IM_{fire} \left( {\textbf{p}},t, {\textbf{X}}, {\textbf{X}}_{strat}, {\boldsymbol{\alpha}}\right)$. Here, a key observation is that $IM_{fire}$ cannot be defined independently of the structure. Furthermore, design decisions regarding X and X_strat can be such that $IM\rightarrow 0$, regardless of the considered heat release rate or fire severity measures (e.g., fuel load density). In particular, heat release rates and fire severity measures alone are not enough to fully characterise heat fluxes (e.g., [32, 33]).

Other disciplines adopt structure-specific IMs. For instance, the spectral acceleration at the first period of the structure is widely adopted in earthquake engineering to enhance efficiency, relative sufficiency, and practicality (e.g., [34]). Another example comes from the field of wind engineering, where the wind pressure on a structure (or structural component) depends on structure-specific interaction parameters obtained through aerodynamic analyses (e.g., [35]). However, the actual intensity of the hazard (e.g., the response spectrum of a ground motion, the power spectral density of a wind velocity record) is unaltered by design decisions on the considered structure, remaining site-specific and structure-independent. This independence allows the probabilistic characterisation of the hazard intensity at the construction site, which forms the first step of risk calculations as per Eq. 1.

Previous studies (e.g., [14, 36,37,38]) referred to surrogates of the heat flux, such as the maximum fire temperature, the fire duration, the area under parametric time-temperature curves and the cumulative radiant heat to define fire IMs. Parametric time-temperature curves represent the gas temperature in the environment surrounding a structural component as a function of time [39]. They are a simple proxy for calculating heat fluxes, which is only one of the factors entering Eq. 3. Furthermore, they require information on the compartment features. Drawing preliminary assumptions on those features is possible. However, these assumptions have limitations for the design process. In particular, they preclude limiting the fire damaging potential through design decisions. It is noted that most of the existing literature focuses on assessing (and not designing) existing structures or structural elements in a fixed environment. For that purpose, the listed IMs could still be adopted.

Other studies (e.g., [40,41,42,43]) used the fuel load density as an IM for fire. The fuel load density represents the thermal energy released by fuel combustion per unit of area. This fire severity measure is only one of the variables affecting the heat flux, which also requires X and X_strat. The assumption of a “structurally significant fire” occurring could justify removing the dependency on the fire safety strategy to obtain a worst-case scenario. Nevertheless, the heat flux dependency on X remains critical. As a result, the same fuel load in a different structural context can create entirely different fire scenarios and corresponding thermal loads. Thus, the fuel load is inefficient (i.e., large response dispersion at the same fuel load level) and impractical (i.e., low correlation to thermal response) as an IM. Again, if all the structural and fire safety strategy variables are fixed, the effect of fuel load uncertainty can still be assessed.

In summary, conditioning the structural design on preselected IMs requires drawing assumptions on the structure and does not allow for design choices aimed at reducing the fire damage potential. In contrast, methodologies that aim at obtaining fire scenarios as output (as the CFO approach) take full advantage of the fire intensity dependencies revealed by Eq. 3.

3.3 Probabilistic Fire Hazard Analysis

The hazard curve calculation for hazards other than fire is independent of the presence of a structure at the site, in recognition that—for example—an earthquake would strike a location independently of its built environment and the presence of engineering assets. Differently, a fire cannot exist without a structure creating it and defining the peculiarities of the combustion process/fire dynamics. As a consequence, the rates $\lambda (IM_{fire}>im_{fire})$ and  $\lambda \left( scenario_{i} \right)$ in Eq. 1,2 with the IM limitations of Sect. 3.2 - are unequivocally conditioned on X and X_strat, and a designer can alter and control them. For instance, a building could be designed with floor height, opening factor and materials such that flashover never occurs. Similarly, a proper bridge’s deck clearance could make the heat flux to the girders irrelevant. Conversely, the rate of fire intensity exceedance would drastically increase if the space under the same bridge was allocated to parking, reused for art galleries or if abusive buildings/informal settlements are built below. Thus, a proper hazard curve calculation would be as follows:

$$\begin{gathered} \lambda \left( {IM_{fire} > im_{fire} |{\mathbf{X}},{\mathbf{X}}_{strat} } \right) \\ = Pr\left( {IM_{fire} > im_{fire} |Fire,{\mathbf{X}},{\mathbf{X}}_{strat} } \right)\lambda \left( {Fire|{\mathbf{X}},{\mathbf{X}}_{strat} } \right) \\ \end{gathered}$$

(4)

$$\lambda \left( {scenario_{i} } \right) = \prod\limits_{k} {p_{i,k} } \left( {{\mathbf{X}},{\mathbf{X}}_{strat} } \right)\lambda \left( {Fire|{\mathbf{X}},{\mathbf{X}}_{strat} } \right)$$

(5)

where Eq. 4 and 5 refer to risk calculations based on Eq. 1 and 2, respectively; $Pr\left( {IM_{fire} > im_{fire} |Fire,{\mathbf{X}},{\mathbf{X}}_{strat} } \right)$ is the exceeding probability of $IM_{fire}$ given the occurrence of a fire, structural and fire safety strategy features; $p_{i,k}$ are the conditional probabilities of the k event tree branches leading to the i-th fire scenario (e.g., alarm failure, sprinkler failure; [23]). Again, the conditioning on X_strat could be removed to obtain a worst-case scenario. However, the dependency on X remains obvious. For buildings, available approaches to estimate the rate of fire occurrence $\lambda \left( Fire|\textbf{X},{\textbf{X}}_{{strat}}\right)$ tackle this issue by replacing the dependency on X with that on building category (e.g., dwellings, offices, industrial buildings). In doing so, multiplicative factors account for various components of the fire safety strategy X_strat (e.g., sprinklers, fire brigade intervention). For instance, the probabilistic model code of the Joint Committee on Structural Safety [44] computes the probability of a fully-developed (post-flashover) fire as follows:

$$\begin{aligned} \lambda (fashover|category)= A_f Pr(flashover|ignition) \lambda (ignition|category) \end{aligned}$$

(6)

In this equation, $A_f$ is the floor area and reflects the observation that, in a large compartment, there are more possible ignition sources and hence a higher ignition probability. The values of Pr(flashover|ignition) and $\lambda (ignition|category)$ are tabulated for different occupancy categories and fire protection methods.

Other studies (e.g., [38, 41]) referred to the work of Sleich et al. [45] to calculate the “probability of a severe fire per year able to endanger the structural stability.” Such “severe fire” is usually interpreted as a fully developed (post-flashover) fire. The rate of occurrence of a “severe fire,” also used to calibrate the fire load density factor implemented in the Eurocode [39, 46], can be obtained as follows:

$$\begin{aligned} \lambda (flashover|category) = A_f p_1 p_2 p_3 p_4 \end{aligned}$$

(7)

where $p_1$ is the annual rate of a severe fire occurring in the considered building category; $p_2$, $p_3$ and $p_4$ are reduction factors accounting for fire brigade intervention, fire alarm, and sprinkler systems. Several limitations can be identified in these approaches:

• A “severe fire” cannot always denote a post-flashover (fully developed) fire. Indeed, a localised fire can also be “severe” and “endanger structural stability” in buildings where flashover conditions are not met. Furthermore, travelling fires in large, open-plan compartments are now a recognised phenomenon that can result in more challenging heating conditions with respect to flashover fires (e.g., [47, 48]).

• Because buildings falling in the same category may exhibit significant differences in ${\textbf{X}}$ and ${\textbf{X}}_{strat}$, an occupancy category is inadequate to determine whether a “structurally significant fire” would occur. This argument is supported by the terms entering flashover criteria [49], including area and height of window opening (ventilation factor), compartment area and heat transfer coefficients.

• Occurrence rates based on Eqs. 6 and 7 are calibrated on fire statistics from past events. For example, Sleich et al. [45] referred to incidents reported in different countries between 1983 and 1997. However, these statistics contain limited information on building and fire safety strategy features. Thus, a large open space office with a high ceiling would have the same “severe fire” occurrence rate as an old building with small rooms and limited compartmentation measures, which is clearly not the case. Consistent with this discussion, several authors highlighted the limited availability of fire data to characterise the random variables (e.g., rate of fire occurrence, fire growth rate, room geometry, number of occupants, time-temperature curve parameters) required for risk assessment (e.g., [10, 22, 23]) and pointed out concerns about their reliability (e.g., [18]).

• The built environment is continuously evolving. Consequently, innovative structural configurations and systems (as tall/special buildings, long-span bridges or tunnels often are) may exhibit unpredicted failure modes with unknown failure statistics [50]. This is also due to construction and civil engineering innovations usually happening faster than the evolution of fundamental fire science required to assess safety [51]. Therefore, the significance of fire statistics in computing the annual rate of “severe fire” is limited for risk calculation. Along similar lines, Hopkin et al. [12] explained that risk assessment for atypical or innovative buildings could not rely on a sufficient number of fire event observations.

• Due to the dependency on ${\textbf{X}}$ and ${\textbf{X}}_{strat}$ and the fire-structure coupling effect, Torero [51] discussed that each fire scenario is unique. Therefore, it should not be assigned a probability of occurrence. Similarly, Borg et al. [17] claimed the need for engineers to establish building-specific design fires.

• Akin to the discussion on building fires, the vehicle industry continuously evolves towards sustainable transportation and electric vehicles, which can increase fire occurrence and result in unpredicted fire scenarios. For example, battery fires are becoming an increasing threat [52]. Furthermore, changes in traffic composition (percentage of heavy goods vehicles and tankers), dictated by changing needs of communities, also affect bridge and tunnel fire occurrence rates. Accordingly, an increasing trend in bridge fires has been observed in recent years (e.g., [6, 53, 54]).

These considerations raise concerns about fire occurrence rates’ suitability and appropriate accuracy to calculate consequence metrics for risk-based design approaches. It is observed that the CFO approach operates without incorporating a probabilistic fire hazard analysis; rather, it considers fire as an event with an occurrence probability of one (e.g., [55]), focusing on managing the conditions that could lead to an uncontrolled propagation. Further details are provided in Sect. 3.5.

3.4 Fire Fragility Models

Calculating risk based on the PEER-PBEE framework requires developing fire fragility models—$Pr\left( F_{LS}| IM=im \right)$, see Eq. 1. The main limitation of these models for design lays in the fact that any possible choice of IM is either strongly dependent on the structure itself (i.e., $IM_{fire}=IM_{fire} \left( \textbf{p}, \mathrm{t}, {\textbf{X}}, {\textbf{X}}_{strat}, \boldsymbol{\alpha}\right))$ as discussed in Sect. 3.2 or weakly correlated to the structural response (e.g., the fuel load density). Recognising that a fire’s thermal effects depend on design variables $\left({\textbf{X}}, {\textbf{X}}_{strat}\right)$ implies the fire engineer’s potential ability to control the fire intensity. Thus, conditioning the damage level on a hazard intensity that can be obtained as a design output requires preliminary strong assumptions on structural characteristics that may not yield optimised solutions.

This discussion does not exclude deriving fire fragility models (particularly for assessment purposes) but aims to point out their limited relevance for the goals of a general risk-based design methodology. If a single structural component is to be assessed in a predetermined environment where ${\textbf{X}}$ and ${\textbf{X}}_{strat}$ defining the fire model are preliminarily fixed for any reason (an existing structure, architectural constraints), the probability of damage at a given level of the selected IM can still be computed, with various uncertainties propagating from the random nature of the structural features and fuel loads. Nevertheless, this is limiting in view of a system-level structural design and even less in the perspective of a holistic, multi-hazard design framework. In this regard, Hackitt [56] highlighted the necessity to demonstrate building safety by assessing the structure as a single, coherent system of interdependent components.

3.5 Risk Calculation

Several measures can reduce the probability of fire occurrence (i.e., prevent ignition), but unplanned ignitions always happen, and it is impossible to prevent all significant fires (e.g., [22, 55]). Accordingly, fire safety strategies are developed assuming that a fire event occurs over the structure’s life cycle and—due to the impossibility of preventing unplanned ignitions—aim at managing the fire and reducing/minimising consequences for the exposed people and assets [22]. The Fire Safety Concepts Tree [22] reflects this feature. Therefore, a fire is not a low-probability event and will happen in a building over its life cycle. The rare event is a fire that evolves into an uncontrolled state. In addition, recognising that a fire has an occurrence probability of one suggests that fire risk should be expressed in terms of consequences (and their variability due to other sources of uncertainties) rather than probabilities of exceedance/occurrence of various loss/casualty levels or expected annual losses [55]. Consistently, the CFO approach considers fire as an event with unitary occurrence probability; then, it looks for design configurations that control/optimise maximum consequences and their robustness to uncertainty.

Expressing fire risk in terms of consequences does not preclude performing cost-benefit analyses for safety purposes. Specifically, cost-benefit analysis plays a crucial role in determining the MAC threshold (see Sect. 3.6). Furthermore, addressing uncertainties in estimating MC involves defining thresholds for $Pr\left[ \overline{MC} > MAC \right]$ and/or the robustness of $\overline{MC}$. One approach to conducting such an analysis is to compute the “total cost,” encompassing both construction and failure costs (e.g., [20]). Lastly, Sect. 3.6 delves into methods to incorporate the advantages of CFO-based design and risk-based assessment, including potential cost-benefit analyses.

A final consideration relates to scalar consequence metrics, representing risk as a single value, e.g., the expected annual loss obtained as the integral of a loss exceedance curve (see Sect. 2.1). Through integration, two significantly different loss exceedance curves could yield the same expected annual loss value. If the latter is used to define performance objectives, large consequence values characterised by negligible exceedance probabilities are implicitly allowed (e.g., [57]). Nevertheless, society tends to have limited acceptance of extremely high consequences, concluding that unacceptable losses should be prevented independently of their occurrence probability (e.g., [18, 57]. This argument is embraced by the CFO approach, which explicitly aims at quantifying and assessing such large-consequence low-probability events.

The limitations discussed above regarding hazard curves and fragility models can lead to inaccurate loss estimations, which are a further shortcoming of risk calculation. Finally, Torero [15] and Cadena et al. [50] pointed out the lack of data and knowledge on the three risk components described by Kaplan and Garrick [21] (scenarios, consequences and occurrence rates). Such a lack hampers the calibration of probabilistic distributions and adequate confidence in the design outputs.

3.6 Towards an Integrated Approach

Other disciplines, such as earthquake engineering [58] and wind engineering [59], have successfully used risk-based approaches for design updating purposes. In fire engineering, this process is hindered by the limitations discussed in Sects. 3.1–3.5. However, the following points should be taken into account:

• The CFO approach can provide a range of solutions that meet the performance objectives for maximum consequences. In such cases, multi-criteria decision-making techniques [60] can be used to rank design configurations based on the importance of the selected consequence metrics (according to stakeholders’ preferences).

• Some risk-based consequence metrics such as the expected annual loss are well-understood by stakeholders and can provide valuable support for decision-making.

• As highlighted in Sects. 3.2 and 3.4, it is possible to conduct a risk-based assessment when all the fire-scenario component properties listed in Sect. 2.1 are fixed. For example, such properties can be obtained through the CFO approach, thereby bounding maximum consequences to a tolerable or acceptable level.

Hence, combining the advantages and output metrics of both the CFO and risk-based approaches is feasible, as demonstrated in Fig. 2. More precisely, the CFO approach is first employed to identify design configurations that meet the maximum allowable consequence threshold. Subsequently, for each of these configurations, a risk-based assessment can provide supplementary consequence metrics to aid in multi-criteria decision-making. Among others, the combination of the Analytic Hierarchy Process (AHP; [61]) and the Technique for Order Preference by Similarity to an Ideal Solution (TOPSIS; [62]) is widely applied in decision-making problems. Further research can therefore explore and develop the integration between the CFO and risk-based design approaches through multi-criteria decision-making for the fire safety design of structures.

Figure 2

Integrating the CFO and risk-based (RB) approaches for multi-criteria decision-making

Integrating the two approaches is further discussed in the context of cost-benefit analysis. Albeit focusing on controlling maximum consequences, the CFO approach is not more conservative than a conventional risk-based approach. Indeed, the conservativism of a design solution obtained through probabilistic methods depends upon the selected performance objectives, which define an acceptability limit for a design solution’s residual risk (step #1 in Figure 1b). This limit should be informed by cost-benefit analyses (e.g., [63, 64]) aimed at optimising the allocation of finite societal resources.

There is no attempt to define this acceptability limit in the current study or in Franchini et al. [20]: the CFO approach is designed to identify and mitigate maximum fire consequences by leveraging fire-structure coupling effects. The decision regarding the target performance is intentionally left to stakeholders, enhancing the approach’s versatility and broader applicability.

For instance, the acceptable performance level in the CFO approach can be framed in the generalised frequency-consequence diagram proposed by Van Coile et al. [57]. According to these authors, the risk curve of an acceptable design should lay beneath the “tolerability limit” (representing “the societal limit above which designs cannot be justified irrespective of the associated benefits”). The steep gradient of the limit curve in the high-consequence region highlights that the tolerability of high-consequence events depends on the consequence magnitude rather than frequency.

The CFO approach concentrates solely on the high-consequence region and pinpoints solutions confining maximum consequences within the tolerability limit. Subsequently, as described above, multiple solutions identified through the CFO approach can be effectively compared through risk-based consequence metrics.

The following section compares the risk-based and CFO design approaches through the fire safety design of a case study bridge. The presented example is purposely oversimplified and aims to provide a straightforward benchmark for comparing the two studied approaches. In this regard, Appendix I of Franchini et al. [20] delves into the limitations of the adopted assumptions on structural, fire, and heat transfer models. Notably, the chosen modelling strategy exclusively captures the fire-structure coupling effect by considering the influence of bridge clearance on flame impingement, tilting, and lateral spread. In general, the applicability of the CFO approach is not contingent on the model’s complexity.

4 Illustrative Example

4.1 Case Study Description

This section uses the risk-based and the CFO approaches for the fire-safety design of the single-span bridge studied by Peris-Sayol et al. [65] (assumed as an initial design configuration), considering the simplifying assumption discussed by Franchini et al. [20]. In its initial configuration, the structure features five W36x300 steel girders positioned at ${H=5}\; m$ from the road and supporting a concrete slab. The performance objective is for the bridge to resist a car fire for 20 minutes without collapsing. Therefore, the time to collapse, $t_c$, is the consequence metric of interest. In the context of the CFO approach, the 20-minute threshold represents the maximum allowable consequence (i.e., $t_{c,MAC}=20\; min$).

Figure 3 shows the problem geometry. Only one girder is considered and studied in the 2-D x-y plane. Furthermore, the left-hand side of the beam is fixed to demonstrate the CFO approach’s ability to find maximum-consequence conditions that are not obvious just based on judgment. The girder is subject to a uniformly distributed load $q=42.17 \;kN/m$, which accounts for dead and traffic loads. Following the Load Model 1 from the Eurocode [66], the traffic effect is also represented through a tandem system of two concentrated loads located at $x_{ts}=\alpha _{ts}L$. Here, $L=21.34 \;m$ is the length of the girder and $\alpha _{ts}$ a scaling factor. The design variables are the scaling factors of the bridge clearance ($X_H$), the girder depth ($X_{Hgir}$) and the flange width ($X_{wf}$). Such factors are collected in the vector ${\textbf{X}}$.

Figure 3

Case study bridge and considered random variables

The bridge is subject to a localised car fire with the fuel bed characterised by an equivalent diameter $D=1.5\;m$ and positioned at $x_{bed}=\alpha _{bed}L$. As for the fire model, the heat release rate (HRR) curve grows linearly and reaches the peak $hrr_{max}$ at a time $t_{max}$. Then, it remains constant until the burnout time $t_{bo}$. Therefore, the energy released by the burning vehicle is given by $ER=hrr_{max}\left( t_{bo} - t_{max}/2 \right)$. HRR parameters and energy released values representative of natural fires were obtained from the experimental data reported by Mohd Tohir and Spearpoint [67].

The use of these data is different for the risk-based and CFO design approaches. More precisely, the probabilistic distributions for peak HRR, time to peak and energy released (ER) suggested in the reference [67], summarised in Table 1, are adopted for risk-based design. The same table shows that the fuel bed and the tandem system locations are assumed uniformly distributed, recognising that they can be at any longitudinal position when the fire ignites. These distributions' bounds are calculated assuming that the fuel bed and the tandem system are positioned at the initial and end points of the girder. Other uncertainty sources included in the analysis are the steel material properties (yield stress $\sigma _y$, elastic modulus E, and density $\rho$). Their distributions were obtained from the work of Devaney [68] and are listed in Table 1.

Table 1 Random Variables Considered in the Example

When applying the CFO approach, the experimental data on vehicle fires inform the selection of boundary conditions for scenario optimisation. First, ER is fixed to a conservative value of 7 GJ. Then, an HRR curve characterised by $hrr_{max,ref}=5000\; kW$ and $t_{max,ref}=10 \;min$ as per NFPA-502 [69] is taken as the reference curve. Finally, scaling factors $\alpha _{hrr_{max}} \in \left[ 0.4, 1.6 \right]$ and $\alpha _{t_{max}} \in \left[ 0.6, 1.4 \right]$ are selected based on the experimental data. Eventually, the vector ${\boldsymbol{\alpha}} = \left[ \alpha _{bed}, \alpha _{hrr_{max}}, \alpha _{t_{max}}, \alpha _{ts} \right]$ identifies a fire scenario. All the random variable distributions are depicted in Figure 3, which highlights the approach implementing them (only risk-based approach or CFO and risk-based approaches).

The bridge’s thermomechanical response is then computed—for each scenario—through the procedure described in the next section.

4.2 Thermomechanical Response Calculation

4.2.1 Heat Transfer and Thermal Analysis

The heat flux from the fire to the girder is required to define boundary conditions for thermal response analysis. To that end, the girder is discretised into 0.5 m-long elements, and it is assumed that the heat flux to each of them is constant at a given time step.

As illustrated in Figure 4, the calculation combines several heat transfer models from localised fires. At each time step, the mean flame height $H_{flame}$ (defined as the distance above the fire source where the intermittency has declined to 0.5) is calculated as per Heskestad [70] and compared to the bridge clearance. This comparison distinguishes the two cases of flames not impinging (Case 1) or impinging (Case 2) on the deck.

Figure 4

Heat flux calculation methodology

In the first case (Figure 4a), the fire plume temperature at the deck level is obtained through the Heskestad’s correlation for centreline excess temperature [70]. Next, this temperature is used to calculate the heat flux to the girder elements whose centre is located within the fuel bed boundaries. On the other hand, only radiative heat transfer is considered for girder elements positioned outside the fuel bed boundaries. This flux is calculated using the point source model [71]. The point source (PS) is located at a height $y_{bed}+H_{flame}/2$ from the road level, with the fuel bed height $y_{bed}$ assumed equal to 1 m.

In the second case (Figure 4b), the flame impinges on the bridge deck, turns and spreads horizontally. The mean horizontal flame length $L_{flame}$ is assumed approximately equal to the difference between the free flame height and the height of the obstructing surface (e.g., [72]). Then, the heat flux to girder elements in contact with the flames is taken as $85\; kW/m^2$. This value is representative of objects immersed in flames [73]. Conversely, only radiative heat transfer computed through the point source model is considered for the other elements.

The obtained heat flux is used as the boundary condition for the thermal response analysis, aiming to compute the temperature’s time history in the girder. Assuming a constant temperature distribution across the section is acceptable for steel sections. Thus, under this hypothesis, the temperature development in the girder is obtained through the lumped thermal mass approach described by Quiel et al. [74].

4.2.2 Structural Response and Consequence Analysis

The temperature’s time histories are used to calculate the bridge’s structural response through the OpenSees for fire software [75]. In this process, the displacement of each girder node is recorded. Then, the time to collapse $t_c$ is identified when any of the conditions described by Hu et al. [54] occurs: (i) runaway behaviour of girder deflection; (ii) reversal of horizontal displacement at the free-end support; (iii) excessive vertical deflection. This procedure calculates the time to collapse $t_c\left( {\textbf{X}}, \boldsymbol{\alpha}\right)$ for a given fire scenario and design variable configuration. If the bridge resists until burnout without collapsing, the time to collapse is considered to be infinite ($t_c\rightarrow \infty$) for that configuration.

When applying the considered risk-based design approach, calculating $t_c$ for one of the pre-set scenarios described in Sect. 4.1 estimates a realisation of the random variable $\overline{t}_c$. Then, this variable’s distribution can be used to estimate the annual rate at which $\overline{t}_c$ is lower than the 20-minute threshold. Such a consequence metric, denoted $\lambda \left( \overline{t}_{c}<20 \;min\right)$, is equivalent to the failure rate in Eq. 1.

Differently, in the CFO approach, $t_c\left( {\textbf{X}}, \boldsymbol{\alpha}\right)$ represents the consequence potential model (see Figure 1b). This model is first used to compute the fire-scenario properties ${\boldsymbol{\alpha}}_{MC}$ yielding the minimum time to collapse $t_{c,MC}$ for a given design variable configuration ${\textbf{X}}'$:

$$\begin{aligned} t_{c,MC}, {\boldsymbol{\alpha}}_{MC} = min \left\{ t_c \left( {\textbf{X}}', {\boldsymbol{\alpha}} \right) \right\} \end{aligned}$$

(8)

Next, the consequence potential model is applied to investigate the uncertainty effect on $t_{c,MC}$ through MCS. At each iteration, the finite element analysis is used to obtain the time to collapse, which is feasible considering the limited computational cost of the studied model (about 3 s/analysis on an Intel(R) Core(TM) PC with 3.0 GHz i9 CPU processor and 256 GB of RAM). However, alternative techniques, such as surrogate modelling [76], may be necessary for more complex structural analyses.

The CFO approach only propagates uncertainty from the steel material properties (see Table 1). This analysis estimates the distribution of the random variable $\overline{t}_{c,MC}$, and the probability that such a variable is lower than the CFO threshold (i.e., $Pr\left[ \overline{t}_{c,MC} < t_{c,MAC} \right]$). Furthermore, the CoV of $\overline{t}_{c,MC}$ quantifies the robustness (i.e., limited variability) of the computed solution to input uncertainties. Because design variable configurations that do not collapse are characterised by an infinite $t_{c,MC}$, the CoV is calculated for the distribution of $\overline{t}_{c,MC}$ conditioned on the collapse occurrence (i.e., $CoV(\overline{t}_{c,MC}|collapse)$).

4.3 Results and Discussion

4.3.1 Fire Scenarios and Consequence Metrics

The initial bridge design configuration is named “Design A” and is characterised by a design variable vector ${\textbf{X}}_A= \left[1, 1, 1 \right]$. When applying the risk-based design approach, MCS for hazard scenario generation provides the light-grey HRR curves in Figure 5a. The experimental HRR curve envelopes from Tohir and Spearpoint [67] are also reported in this figure. Comparing them to the curves generated through MCS, it is noted that a large number of samples exhibit a growth rate higher than the observed ones. For safety assessment, this is a conservative condition when paired with high energy released. Conversely, several samples reach the peak HRR at a time significantly longer than the 20-minute threshold. Each HRR curve is associated with a random location of the fuel bed and tandem system, as shown by the grey circles in Figure 5b. This figure compares the positions of the fuel bed and the tandem system concerning (1) the scenarios sampled through the risk-based approach; and (2) the scenarios calculated from the CFO approach. The black line at $y=0.0\;m$ indicates the road level where the burning vehicle is situated. The remaining horizontal lines represent the girder’s top and bottom flanges, with distinct colours denoting specific girder designs.

As shown in Table 2, the probability that the time to collapse is lower than the 20-minute threshold is 0.043. Furthermore, the annual rate of this event is obtained assuming a representative car fire’s occurrence rate equal to 0.0684 fires/year [77] and results in a value of $2.90\times 10^{-3}/year$. This risk-based consequence metric could be acceptable considering the short time required to evacuate the bridge in the case of a fire so that collapse does not threaten life safety. Hence, according to the risk-based design method, Design A complies with the performance objectives and does not require updating.

Figure 5

Scenario comparison: (a) HRR time histories; (b) fuel bed and tandem system postions

Table 2 Design Approach Comparison

Consider now the CFO approach. Figure 5a presents the long-cool and short-hot limits constituting the boundaries for consequence maximisation. Solving Eq. 8 for Design A provides the scenario vector ${\boldsymbol{\alpha}}_{MC, A}$ listed in the fourth column of Table 2 and plotted in Figure 5a–b. The corresponding time to collapse is $t_{c,MC,A} = 11.47\; min$. Because this time is significantly lower than the CFO threshold, a sensitivity study is conducted for design variable updating. Consistently, Design B in Table 2 is selected. This configuration requires a 5% increase in the bridge clearance ($X_H$), a 20% increase in the girder depth ($X_{Hgir}$) and a 15% increase in the flange width ($X_{wf}$). Increasing $X_H$ delays flame impingement and reduces the lateral flame spread. Consequently, this design variable modifies the heat flux time history. On the other hand, the selected values for $X_{Hgir}$ and $X_{wf}$ result in a lower section factor (i.e., the ratio of the heated perimeter to the cross-sectional area [22]), which slows down the girder’s temperature rise. Additionally, the updated $X_{Hgir}$ and $X_{wf}$ increase the moment of inertia of the girder, reducing deflections. The resulting time to collapse is $t_{c,MC,B} = 20.23\; min$ (sixth column of Table 2).

The observation of Table 2 (CFO columns) and Figure 5 reveals that the fire scenarios yielding $t_{c,MC}$, identified by the scaling factors $\alpha$, are significantly different for Design A and B. Notably, maximum consequences are specific to the structure and cannot be derived from boundary values. The observed dissimilarity between the two scenario vectors ${\boldsymbol{\alpha}}_{MC,A}$ and ${\boldsymbol{\alpha}}_{MC,B}$ also suggests that identifying such scenario variable combinations through preliminary assumptions would be challenging. Consequently, fire scenarios selected a-priori may overlook the conditions that maximise consequences. Even if the information regarding the maximum consequence is obtained through random sampling (following the risk-based design approach, see Sect. 4.3.2), it is only a realisation of the selected consequence metric, often concealed behind the significant result dispersion (light-grey curves in Figure 5a and circles in Figure 5b). Further details on this matter are provided in the next section.

4.3.2 Uncertainty Effect

In the CFO approach, the scope of uncertainty analysis is to verify the limited variability of the estimated maximum consequence to selected sources of input randomness. To that end, Figure 6 plots the probabilistic conditional distributions $f\left( \overline{t}_{c,MC}|collapse\right)$ for Design A and B. These distributions were obtained by propagating material property uncertainties (for steel) to the maximum consequences determined through deterministic optimisation (vertical dashed and dash-dotted lines). The dotted vertical line shows the target performance objective ($t_c\ge 20\;min$). The CoVs of the two consequence distributions are reported in Table 2, and result 0.040 and 0.021, respectively. Hence, both configurations exhibit limited sensitivity to steel material properties uncertainty, with Design B revealing more robust.

Figure 6

Distributions of the time to collapse from the CFO approach and risk curve from the risk-based design approach

In Figure 6, the $t_c=20\;min$ threshold ($t_{c,MAC}$ in the CFO approach) is located in the tail of the $\overline{t}_{c,MC,A}$ distribution and is approximately 15 standard deviations away from the mean. Therefore, for this particular case, a sample size of $10^4$ was used, and a conservative assumption was made that $Pr[\overline{t}_{c,MC,A}<t_{c,MAC}]$ is equal to 1. On the other hand, Design B has a failure probability of 0.026, which was estimated through $5\times 10^4$ simulations. This number allowed predicting $Pr[\overline{t}_{c,MC,B}<t_{c,MAC}]$ with a CoV lower than 0.1, which was set as a threshold for convergence. As discussed above for $\overline{t}_{c,A}$, such a failure probability value is tolerable for life safety (in this specific case).

The risk curves from the risk-based design approach are also displayed in Figure 6. These curves represent the mean annual rate at which the time to collapse falls below the value indicated on the horizontal axis. Their convergence was evaluated with respect to the annual rate of exceeding the 20-min threshold, necessitating $40\times 10^4$ and $70\times 10^4$ simulations for Design A and B, respectively. The risk curve of Design B is reported to highlight how the CFO approach enables improving the design from the selected risk-based metric perspective. Specifically, the latter reduces from $2.90\times 10^{-3}/year$ to $8.79\times 10^{-7}/year$.

The maximum consequence distributions obtained through the CFO approach overlap with the risk curves in the high-consequence (i.e., low $t_c$) low-probability region. In this regard, note that the CFO approach uses numerical optimisation to identify fire-scenario features (peak HRR, time to peak HRR, fuel bed and tandem system locations) maximising consequences (vertical lines in Figure 6). In contrast, the risk-based approach treats these scenario features as input uncertainty sources. The overlap occurs because, in this simplified example, the random sampling in the risk-based approach finds the fire-scenario feature combination maximising consequences.

Therefore, if the scenario assumptions enable capturing (through random sampling) the conditions maximising consequences, a risk-based performance assessment in the tail region provides similar conclusions as the CFO approach.

However, when it comes to design updating, the risk-based method faces limitations in determining the most influential variables for reducing maximum consequences. This challenge endures regardless of the computational burden of an MCS-based design update. Indeed, the risk-based approach seeks variables that improve the response to the pre-selected scenarios, potentially overlooking conditions that yield the most significant consequences. Even if design updating identifies solutions implicitly reducing fire intensity, this intensity still refers to the assumed ignition and propagation conditions. Furthermore, treating scenarios as inputs restricts the design solution space to a suboptimal region. In contrast, the CFO approach focuses on solutions that optimise the balance between diminishing fire intensity and increasing structural capacity. This objective is achieved while simultaneously assessing the solution’s robustness to selected sources of uncertainty.

The construction material cost, denoted as $C_I$, is presented in Table 2 and shows that Design B incurs a 12% higher cost than Design A. These estimates are based on the unit material costs documented in the Washington State Department of Transportation Bridge Design Manual [78]. Additional details concerning the simplifying assumptions drawn for the cost model are elaborated in Franchini et al. [20]. Despite the increased construction cost, controlling maximum consequences through the CFO approach yields the following benefits:

• Life-cycle cost reduction: By limiting maximum fire consequences, the CFO approach can contribute to reducing the overall life-cycle cost (e.g., [79]) of the structure, thus justifying the larger upfront investment. Franchini et al. [20] provide a simplified analysis in these terms.

• Compliance with tolerability limits: As discussed in Sect. 3.6, risk curves associated with an acceptable design should be bounded within a tolerability limit. The CFO approach is a valuable tool to maintain this upper boundary, overcoming the limitations outlined in Sect. 3.

• Optimised design: By explicitly treating fire scenarios as design variables, the design tolerability is achieved through an optimised trade-off between enhanced structural capacity and reduced fire intensity.

This study exclusively presents Design B as a compliant solution. Nevertheless, it is noteworthy that Franchini et al. [20] identified multiple solutions for the same case study. In light of this, exploring these alternative options through risk-based consequence metrics (as undertaken for Design B) can significantly enhance the decision-making process. Indeed, the CFO approach is limited in providing insights into consequence distributions outside the low-probability, high-consequence region of the consequence spectrum.

5 Conclusions

This paper investigated the limitations of risk-based methods for fire safety design and compared a conventional risk-based approach with a recently-developed methodology called the Consequence-oriented Fire intensity Optimisation (CFO) approach. The following points summarise the key takeaways from the presented study:

• The fire phenomenon is strongly coupled with the structure wherein it develops, enabling an ad-hoc design variable selection to decrease fire intensity (to an extreme where the fire intensity tends to zero). In this sense, the fire intensity becomes an additional design variable (analysis output). This coupling also results in fire scenarios maximising fire impact being specific to each structure. However, most risk-based design approaches consider fire hazard scenario features (first ignited object and its location, fire propagation, fire protection features and characteristics of the studied structure) as additional uncertainty sources (i.e., variables with uncertainties) and set them as analysis inputs.

• The CFO approach, on the other hand, implements a different strategy. It considers fire protection and structure characteristics as design variables and, for a given combination of these features, determines the ignition source and propagation characteristics maximising consequences. The approach then uses MCS to investigate the impact of selected uncertainty sources on the estimated maximum consequence. This process is iterated until design variables are found that reduce fire intensity and ensure that maximum consequences meet the performance objectives. In this way, the design update takes advantage of the fire-structure coupling effect while considering the uncertainty’s impact.

• Limitations were identified in conventional fire risk analysis procedures when used for design purposes. These limitations exist in various analysis steps, including how fire scenarios and intensity are treated, identifying appropriate fire intensity measures, defining models for the annual rate of intensity measure exceedance/scenario occurrence (hazard curves), developing fire fragility models, and carrying out risk calculations. Despite these limitations, it was highlighted that risk-based consequence metrics provide valuable support in ranking design configurations obtained through the CFO approach based on stakeholder preferences. Therefore, the CFO and risk-based approaches can be integrated in the context of multi-criteria decision-making.

• The two approaches were compared through the fire safety design of a simplified case study bridge. The initial design configuration could meet performance objectives in terms of the chosen scalar risk metric. Still, it exceeded a maximum consequence threshold in the low-probability, high-consequence region. The design was therefore updated through CFO approach-informed decisions that simultaneously reduced fire intensity (altering the clearance and the section factor) and enhanced the cross-sectional capacity (modifying the girder’s depth and flange width). When considering the entire risk curve, the risk-based method yielded similar conclusions about the initial design’s compliance. Nonetheless, it faced limitations in finding solutions bounding maximum consequences during design updates.

In future research, there is a need to develop and refine the integration of the two approaches for multi-criteria decision-making. This integration should be tailored to specific types of structures and facilities, considering their unique characteristics. Furthermore, multi-hazard performance objectives are required towards holistic structural design and optimisation.