RISK-ORIENTED FIRE ENGINEERING APPROACH IN HONG KONG FOR THE NEXT GENERATION

RISK-ORIENTED FIRE ENGINEERING APPROACH IN HONG KONG FOR THE NEXT GENERATION KT Leung Chem Tech Fire Consultants, 1/F, Block C, Hong Kong Industrial Centre, 489 491 Castle Peak Road, Cheung Sha Wan, Kowloon, Hong Kong Abstract. In recognizing the needs for evaluation of total system risk and for establishment of alternative solutions to reduce risk to tolerable levels, western countries; like USA, UK, Australia, New Zealand and Scandinavia have started to focus on establishing performance-based practices and standards using quantified risk as the basic performance parameter in the last decade. Probabilistic models are taken in addition to deterministic models to simulate hazardous situations and their likelihood of occurrence, along with events, when safety and control systems or system components operate successfully or fail. They also consider the resulting consequences and quantified impacts. This approach helps to understand the uncertainties and sensitivities of different components involved. To cope with the worldwide development in fire safety practice and to further enhance the fire safety design for buildings in Hong Kong, the riskoriented fire engineering approach should be considered to be included in our local codes for the next generation. 1. INTRODUCTION Performance-based fire engineering approach has been adopted as an alternative for fire safety design of buildings in Hong Kong since 1990s. The first guide to fire engineering approach was issued by the Buildings Department, Hong Kong through PNAP 204, APP-87 [1] in March 1998. Latest detailed guidelines have been published in the Code of Practice for Fire Safety in Buildings 2011 [2] by the Buildings Department, Hong Kong. The original objective of performance based fire engineering design is to use engineering and scientifically approach for developing fire safety requirements that can offer substantiate improvement over the currently published fire regulations and prescriptive codes, especially for special function premises not covered by codes. Deterministic models are taken for performance-based fire engineering design. Achievements of performance and risk assessments are based on a series of pre-defined / assumed fire scenarios and risk criteria. Current practices provide a cut-edge approach in performance based fire engineering design without addressing of the reliability and functionality as well as the possible failure of individual fire safety components which are normally handled by quantitative risk assessment approaches. It would be in doubt with reservation on the acceptance of proposed fire safety designs and what would be the consequences if certain design components fail or response ineffectively and inefficiently. Buildings Department has explained in PNAP 204 that there was lack of statistic information to support quantitative risk assessment at the initial implementation of fire engineering approach in 1998. As fire engineering approach has been launched for almost 2 decades in Hong Kong, we may need to review if sufficient data and statistic information have been collected to support quantitative risk assessment for performance-based fire engineering design. Risk-oriented approach can provide quantitative measurement on the total risk of the design facilities in addition to the qualitative results generating from deterministic approaches. In Hong Kong, performance based fire engineering design are worked out on the assumption that all fire safety components are in healthy manner with effective and efficient response in

the event of fire. The results of risk evaluation is mainly rested on simulation models which sometimes cannot be fully relied on while there are certain areas and data very difficult to be estimated and collected in corresponding to very rare events. Hence the result could be underestimated due to missing of some important sequences of events. The quantitative fire risk assessment in fire engineering design and the evaluation of alternative safety systems may maintain the risk of building occupants and equipment, in respect to fire hazards, at tolerable levels. With the aid of advanced computer technologies, fire risk of a specified facility can be evaluated by generating an event tree and enumerating all credible accident scenarios that may follow a range of initiating events, assessing of resulting consequences and associated impact, and calculating the corresponding likelihood of occurrence of each accident scenario. Risk-oriented approach can give a clearer picture on the possible worst scenario of fire situation if certain design components fail or with deviated response. 2. ADDITIONAL CONSIDERATIONS FOR ALTERNATIVE APPROACHES 2.1. Considerations in Addition to Deterministic Approaches Majority of fire are contributed by negligence and careless of human being. Outbreak of fire demonstrates failure of certain elements in fire safety management. Accidents often occur as a result of combination of series faults and mistakes instead of a single event. It means that other safety components could also be go wrong at the same time. Other risk may associated with fire at the time of outbreak. Certain fire safety components could either be impaired or failure to response at the time of fire. It may not able to achieve effective evaluation on the total risk in the fire engineering design without addressing the probabilities and consequences of the possible failure of fire safety components. Therefore two factors have to be considered for fire engineering approach in fire safety design; namely (a) reliability / functionality / failure of proposed safety components and (b) consequences / impacts of such failures. Reliability / failure considerations should cover: Failure / impairment of fire detection and alarm facilities; Failure / impairment of smoke control and management facilities; Failure of means of escape and evacuation facilities; Failure of response of occupiers. Failure / impairment of fire suppression and extinguishing facilities; Failure / impairment of fire resisting construction and fire compartmentation; Failure / impairment of means of access and response of fire brigade; Failure in maintaining the original fire safety design parameters. Consequence / impact considerations should cover: Number of injuries and fatalities; Extent and degree of primary / direct damages and losses; Extent and degree of secondary / indirect damages and losses; Extent and degree of operation disruption; Extent and degree of possible secondary / indirect fire spread; Extend and degree of environmental damages. Section 2.2 and 2.3 provide few case studies on these issues which demonstrate that risk of failure / reliability as well as consequence / impact should not be overlooked.

2.2. Reliability Considerations 2.2.1 Case 1 - Fire Separation and Compartmentation According to the Code of Practice for Minimum Fire Service Installations and Equipment [3] Dynamic smoke extraction system is required for fire compartment exceeding 7000 m 3 with inadequate openable windows and excessive fire loads, like large shopping mall. 2-hour insulated fire shutters are usually used to reduce large fire compartment size to below 7000 m 3 as an alternative for provision of fire rated wall and dynamic smoke extraction system. Under the new Fire Safety Code [2], provision of additional sprinkler heads for protection of the fire shutters on both side, the insulated performance of the fire shutters are allowed to be reduced to 30 minutes only. Based on the above options, 3 alternative fire safety designs can be worked out as following: Option 1: Provision of 120-minute integrity and 120-minute insulation fire rated walls; Option 2: Provision of 120-minute integrity and 120-minute insulation fire shutters, or Option 3: Provision of 120-minute integrity and 30-minute insulation fire shutters with sprinkler protection on both sides of fire shutters. For reliability consideration, possible failure events for each option are worked out in Table 1 for comparison. To simplify the explanation of the risk assessment, semi-quantitative approach is taken and the risk score for failure of each event is assigned as 1. RISK OF FAILURE FIRE RATED WALL INSULATED FIRE SHUTTER SPRINKLER PROECTED SHUTTER LOSS OF INTEGRITY 1 1 1 BLOCKAGE OF SHUTTER 0 1 1 LOSS OF MOTOR OF SHUTTER 0 1 1 LOSS OF POWER FOR SHUTTER 0 1 1 LOSS OF MOTOR CONTROL PANEL 0 1 1 LOSS OF FIRE DETECTION SYSTEM 0 1 1 LOSS OF WATER SUPPLIES 0 0 1 LOSS OF SPRINKLER PUMP 0 0 1 LOSS OF POWER FOR SPRINKLER 0 0 1 LOSS OF SPRINKLER ALARM VALVE 0 0 1 BLOCKAGE OF SPRINKLER HEADS 0 0 1 SPRINKLER SYSTEM IMPAIRMENT 0 0 1 TOTAL RISK SCORES 1 6 12 Table 1. Risk Analysis on Possible Failure Events for 3 Different Options of Fire Separation From Table 1 above, the total risk scores show that the risk of failure for a sprinkler protected fire shutter is 12 times higher than that of fire rated wall and 2 times higher than that of the insulated fire shutter. If quantitative approach is taken with application of failure rate for each event, the difference in risk level could be much greater. It can well explain that risk assessment on the reliability of the fire safety component is significant for evaluation and comparison of the performance of different alternatives on fire safety design in fire engineering approach. It is also essential for choice of appropriate fire safety design with the risk as low as reasonable practicable. Besides, sprinkler protected fire shutter may also lead to a serious consequence of ineffective fire suppression performance of automatic sprinkler system while additional sprinklers for shutter protection significantly trim down the water supplies for fire suppression in term of pressure, flow and duration..

2.2.2 Case 2 Cabin and Island Concept Terminal 1 of the Hong Kong International Airport was the 1 st project in Hong Kong fully adopted performance based fire engineering approach in fire safety design. Cabin and Island Concept were applied in the retail / office areas and circulation areas respectively. With the development trend on retail business in the other international airports of the world, Terminal 1 was also gradually changed from a public transport terminal to a mega shopping mall cum passenger terminal upon airport opening. Different merchandises were brought into the building in form of mobile retail stalls. Café shops and catering services were also operated in open areas. Cabin concept were no longer considered in these retails and catering area which were not provided with automatic sprinkler system and dynamic smoke extraction system. Fire load and fire risk were significantly increased with the circulation areas significant reduced. Enhanced retail strategy have attracted more passengers for shopping and significantly increased the size of hand luggage with increased fire load. With the increase of fire load and reduction in circulation areas, the island concept with 1 MW fire was adversely affected. In the absence of automatic sprinkler protection and provision of dynamic smoke extraction system, the possible fire size and fire / smoke spread could increase to beyond the original design parameters. It could also lead to a consequence of increase of fire damages and extension of operation disruption in the event of fire. The situation ultimately aroused the attention of Fire Services Department who asked for review and control of fire loads for individual stall. However, no overall fire risk assessment has been carried out for the increased retail facilities. This case study demonstrates that reliability in maintaining original fire safety design parameters is direct rested on the performance and effectiveness of fire safety management as well as the understanding of the original fire safety concepts. Therefore the application of management approaches in fire engineering design requires careful and thorough considerations. 2.3. Consequence Considerations 2.3.1 Case 3 Cabinless Approach with Long Throw Sprinkler Deluge System Additional catering facilities were constructed at the Arrival Hall of Terminal 1 of the Hong Kong International Airport after airport opening. Cabin approach was only applied for the kitchen areas. All seating areas were located in open areas without cabin and roof. Long throw sprinkler deluge systems were provide at the seating areas and were operated automatically by infra-red smoke detection systems. No consideration on the consequence of operation of long throw sprinkler deluge system has been taken during design stage. Although cross zoning design have been incorporated into the design of fire detection system, the deluge systems were still vulnerable to false alarm and accidental operations with the following impacts identified: Cabinless approach did not provide any smoke containment or dynamic smoke extraction. In case fire, smoke could spread to and could stagnate at the high level of roof. No available facility was available to clear the smoke effectively. Operation disruption could be encountered for long duration clearance of smoke in the event of fire; Any accidental operation of the deluge systems could get wet large number of people in the seating areas, No adequate dry clothing was available for the victims to make change while some of them could be hurry in catching up the flight. Extensive and serious public criticism could be aroused and leading to damages to the reputation of the airport management; Local flooding could be encountered while totally 32 sprinkler heads would discharge simultaneously and inadequate floor drains was provided. Extensive flooding spread could be encounter on lower floors while the floor slab was not designed with waterproof capacity.

Water running down to the high voltage transformer rooms below could indirectly cause fire and explosion to the high voltage electrical gears. Failure of high voltage transformers could also lead to serious operation disruption of the airport for long duration with serious losses and public criticism. This case study shows that evaluation of consequences and impacts of failure for different fire safety design are essential for the premises owner / operators to make their choice. Secondary fire spread and secondary fire damages as well as operation disruptions would be important considerations for acceptable fire safety design. 2.3.2 Case 4 High Fire Risk Occupancy for Heritage Buildings Deterministic approaches in fire engineering design majority focus on tenable conditions and life safety evaluation. It is normally inadequate to evaluate the possible impacts on properties losses. With high cultural value, the considerations on property losses of heritage buildings could outweigh the life safety considerations in fire safety design. If life safety standards cannot meet, we can simply limit or prohibit people entering the heritage building. Most of the heritage structures by nature are vulnerable to fire and is not afford to any sufferance from fire damages, especially for timber structures, like Luzon Bridge in Swiss. However this consideration is always overlooked. Catering services with kitchen facilities are often considered for revitalization of heritage buildings in Hong Kong. Kitchen facilities would impose undue high fire risk to the heritage building involved. No matter how much fire protection facilities and measures are provided, it would still have high probability giving rise to the outbreak of fire while sources of ignition permanently exist therein. Like old man boxing; no matter how best protection is provided for the old man, he will definitely collapse upon being punched. Therefore, old man is not suitable to take part in high risk sport while heritage building is not suitable to accommodate high risk occupancy. Evaluation on risk and probability of fire ignitions and impacts on fire damages is the priority on fire safety design of heritage building. 3. ALARP PRINCIPLE For evaluation of risk, ALARP principle is commonly applied for establishment of the frame work for risk criteria. ALARP is short for as low as reasonable practical referring to risk reduction. This approach which is used in the UK HSE, is illustrated in Figure 1. It takes tolerable and intolerable risks as two main criteria, known as "maximum tolerable" and "negligible" levels, These divide risks into three tiers: An intolerable region (above the "maximum tolerable" criterion), within which the risk is generally intolerable whatever the benefit may be. Risk reduction measures or design changes are considered essential. A middle band (between the "maximum tolerable" and "negligible" criteria) where risk reduction is desirable. In the UK, risks in this region are considered to be tolerable only when they have been made "as low as reasonably practicable". This requires risk reduction measures to be implemented if they are reasonably practicable, as evaluated by cost-benefit analysis. Negligible region (below the "negligible" criterion) within which the risk is generally tolerable, and no risk reduction measures are needed.

FIGURE 1. Framework for Risk Criteria ALARP Principle 4. RISK-ORIENTED APPROACH Quantitative risk-oriented approaches to fire safety are not a new concept. The Goal- Oriented Systems Approach to Building Fire Safety [4] introduced in the early 1970s was one of the first risk-oriented fire engineering approaches employed. Risk-oriented fire engineering approaches enhance and supplement the deterministic approaches for performance-based fire engineering design with probabilistic risk assessment (PRA) by taking the reliability and functionality of each and every fire safety components into consideration for determination of the acceptance level of the overall fire safety design. PRA measures the total risk quantitatively as function of the probability of an event and the consequences, and is expressed as [5]: Risk =ΣP n x C n Where: Risk = Calculated Risk P n = Probability of Event n C n = Consequence of Event n The general approach to PRA is illustrated in Figure 2. PRA usually follows a formal hazard identification process (such as a HAZOP, HAZard and OPerability study), forms part of a safety case for the facility, and is expressed as the frequency of an undesirable event. [7] PRA are normally started with simple statistical analysis. The analysis of statistics is the basis of most probabilistic fire risk assessment, from the frequency of ignition to the conditional probability of failure of a fire protection system. Statistical analysis takes data that has been collected on building fires and transforms it into information that can be used to predict the likelihood of future events. This can take the form of the simple assessment of the average probability of an event over a set of buildings over a period of time to a complex regression analysis Logic tree analysis forms major part of PRA. The two common types logic tree analysis used in PRA are event tree and fault tree. Event trees can be used to determine the risk associated with an initiation event (See Figure 3.). The total risk is the sum of the probabilities and consequences of each branch of the event tree. Fault trees can be used to determine the failure probabilities used in the event tree (See Figure 4.). The overall probability of failure or success can be determined by examining the possible failure modes using "and" and "or" logic gates. Detailed working principles of Event trees and Fault trees are discussed in Section 5 below

Sensitivity analysis can be used to draw useful conclusions in the first instance or to assess the robustness of a decision based on PRA. If the results of the probabilistic risk analysis are well within the acceptance criteria, then sensitivity analysis might not be needed. If, however, the results of the probabilistic risk analysis are close to the acceptance criteria, then variations in the variables can have a significant effect on the conclusions from the analysis and sensitivity analysis should be used to assess this. Detailed of sensitivity analysis may get reference to PD 4974-7:2003 [7]. Determining whether the calculated total risk determined for the event tree results in an acceptable design solution depends upon the acceptable risk of the project stakeholders. The acceptance criteria are further discussed in Section 8. FIGURE 2. General Approach to PRA 5. LOGIC TREE ANALYSIS Fire safety relates to control of risk to life and properties as well as to the operation continuity. Without appropriate risk assessment methodology, it is impossible to quantify risk or effectively evaluate the performance of alternative designs. The procedures involved are complex; require extensive research, data and use of computer. Risk assessment methodology has been successfully applied in regulations for catastrophic events such as earthquake and nuclear plant failure, and fire risks can be similarly predicted. The performance is assessed by considering initially the performance of different combination of fire system components and fire scenarios in isolations. However, the results from each of these scenarios are then combined on the bass of the probability of occurrence of each of these scenarios via the use of an event tree approach. The results of each separate evaluation are combined using a risk assessment framework to yield system performance parameters. All fire safety components may on occasions fail for a variety of reasons such as lack of maintenance, random mechanical / electrical failure, impairment for maintenance, alterations and additions, inability to cope with unusually high fire severity, or a lower than expected performance capacity of the fire safety component. This should be recognized as a minimum in the development of the variations fire scenarios. In addition, data is required on the reliability of each fire safety component, this type of data should be obtained from the manufacturer or where appropriate, published statistic or from a fault tree analysis of the the

fire safety component. In PRA, the reliability and functionality of the following fire safety components shall be included in the assessment. For simplification of the assessment process, it is suggested to group the fire safety components into the following eight topics: Failure / impairment of fire detection and alarm facilities; Failure / impairment of smoke control and management facilities; Failure of means of escape and evacuation facilities; Failure of response of occupiers. Failure / impairment of fire suppression and extinguishing facilities; Failure / impairment of fire resisting construction and fire compartmentation; Failure / impairment of means of access and response of fire brigade; Failure in maintaining the original fire safety design parameters. Accordingly, it is essential to consider fire scenarios and their consequences when such fire safety components both work successfully and fail. Under such circumstances the appropriate strategy is to treat fire as an uncertain event and assess multiple quantitative fire scenarios and the possible outcomes in a probabilistic manner using the technique of probabilistic risk assessment. The consequence criteria are suggested to include the following: Number of injuries and fatalities; Extent and degree of primary / direct damages and losses; Extent and degree of secondary / indirect damages and losses; Extent and degree of operation disruption; Extent and degree of possible secondary / indirect fire spread; Extend and degree of environmental damages. Figure 3 and 4 give an example on event tree analysis and fault tree analysis on risk-oriented fire engineering design respectively. Details of the methodology and procedure may get reference to the PD 7974-7:2003 [7] FIGURE 3. Event Tree Analysis For FIGURE 4 Fault Tree Analysis For 6. ESSENTIAL DATA FOR RISK ASSESSMENT The use of reliable data is essential to the performance of a realistic risk assessment. In the absence of specific data the assumptions and data must be conservative, based on sound engineering judgement. The type of information required for a PRA can broadly be classified into five main groups: Models and data; Fire statistics; Building data; System reliability data; Probabilistic data of occupant response. 7. ACCEPTANCE CRITERIA Upon PRA, the results shall be used to evaluate against the acceptance criteria as specified by the building / fire authorities. An acceptable design shall show that the risk of death, injury as well as damages meets or is well above the acceptance criteria.

In the Fire Code [3], it specifies that fire engineering approach shall not provide a level of safety inferior to that provide by prescriptive requirements. The pre-identified objective shall have taken into consideration of the objectives of fire service installations and equipment for the protection of life and property of the occupants within the premises and the firefighting personnel in the event of emergency. For PRA, criteria are set such that the probability of a given undesirable event is acceptably low, or As Low As Reasonably Practicable (ALARP). The acceptance criteria vary depending on the fire safety objectives of the study. Criteria for life safety will be different to criteria for business continuity. Similarly, acceptance criteria will be different depending on the analytical approach adopted. Criteria for absolute levels of risk will be different to criteria for comparative risk analyses. Table 2 gives typical types of acceptance criteria. Analysis Method Fire Safety Objectives Comparative Life Safety Financial Level of risk equivalent to code compliance solution Comparison of design alternative (cost benefit analysis) Absolute No of casualty per year Acceptable average loss per year TABLE 2 Typical types of acceptance criteria 7.1. Comparative criteria It can often be difficult to establish the level of risk in absolute terms. However, it can be relatively straightforward to demonstrate that a design provides a level of risk equivalent to that in a building which conforms to more prescriptive codes (life safety or financial). Since the study is purely comparative, it is unlikely that any assumptions or data regarding ignition frequencies or reliability of systems will have any significant influence on the outcome. This can be confirmed by sensitivity analysis. Before it can be demonstrated that a solution offers the same level of risk as a prescriptive code, the intent of that code needs to be clearly understood. During the qualitative design review, the intentions of each recommendation should be considered, as particular provisions might have more than one objective. Alternative design solutions can be developed to address the specific underlying objectives. The fire safety engineer should demonstrate that the solution proposed will be at least as effective as the conventional approach. 7.2. Absolute criteria 7.2.1 Life safety Absolute acceptance criteria for life safety can fall into two categories: individual and societal. Individual risk is the frequency at which an individual is expected to sustain a given level of harm from the realization of specified hazards. This is usually related to a specific pattern of life. For fire safety, this might be the individual risk of someone who works in an office or industrial building or of a passenger who visits an MTR station twice a day. Societal risk is the relationship between frequency of occurrence and the number of people in a given population suffering from a specified level of harm from the realization of specified hazards. Societal risk criteria are often expressed as lines on an FN curve, showing the cumulative frequency of accidents involving N or more fatalities. This allows them to control not only the average number of fatalities or injuries from all sizes of accident, but also the risks of catastrophic accidents killing many people at once. The Hong Kong Planning Standards and Guidelines, Chapter 12 publish a F/N curve for offsite risk from potentially hazardous installations (PHI), which is showed in Figure 5. This

shows the maximum tolerable risk of accidents involving 100 or more fatalities is 10-5 per year for a single plant. Also, this shows that any incident that could potentially result in over 1000 fatalities is unacceptable. This can be used to define or adjust the acceptable criteria for fire safety design. However, currently, there are no generally accepted absolute criteria in relation to fire safety. The enforcing body or authority concerned will need to accept that the level of risk proposed is As Low As is Reasonably Practicable (ALARP). FIGURE 5. F/N Curve for Off-site Risk From PHI Ramachandran, G. proposes that the levels of risk to individual members of the public from the activities on major industrial sites [18] are: (a) maximum tolerable risk to individual member of the public (deaths per year) is 10-4 ; (b) general acceptable risk to individual member of the public (deaths per year) is 10-6. He also proposes that the levels of societal risk from the failure of building structures due to fire [19] are: (a) risk for 10 or more deaths per building per year is 5 10-7 (b) risk for 100 or more deaths per building per year is 5 10-8 BSI published the average levels of risks for a range of building types in UK for the years 1995 1999 in PD 7974-7:2003 Table 2 [7] may be used a good reference for defining the acceptance criteria and is reproduced in Table 3 below.

TABLE 3. Number of deaths per building and the number of deaths per occupant 7.2.2 Loss Control In probabilistic terms, the probability of loss can be combined with monetary loss under various fire scenarios to assess expected losses. The criteria need to be assessed by absolute study and be expressed as an acceptable financial loss in dollars. These financial criteria, in terms of levels of loss or interruption, should be set in conjunction with the organization concerned and/or their financiers or insurer. An organization or facility can decide, given its investments, competitive position, insurance cover, contingency plans, etc. that it can tolerate certain levels of loss or disruption with certain return periods. These are usually expressed in terms of a financial loss per year or level of financial loss and a frequency. Using the techniques in PRA, it is possible to estimate the risk of damage that result from a fire. This information may then be used to estimate potential monetary losses and enable cost benefit analysis to be undertaken to establish the relative value of installing additional or alternative fire protection measures.. When considering alternative fire safety designs probability and consequence of accidental operation of fire protection systems should also be addressed, like extent and degree of possible water damages and public liabilities as well as possible secondary fire spread. 7.2.3 Operation Disruption Operation disruption can be expressed in term of duration of operation disruption in minutes or hours which can significantly reflect the severity of losses in company goodwill and reputation in addition to monetary losses, especially for public utilities and public servicing trades. It may not be the concern of the enforcing bodies or authorities. However, it can provide clear picture to the building owner and operator to make their own choice on alternative fire safety design, especially for those critical facilities which are not allow and do not afford to be suspend for few days or even a few hours. For operation disruption concerns, probability and consequence of accidental operation of fire protection system should be addressed and evaluated the possible impacts.

7.2.4 Other Acceptance Criteria Other performance criteria may also be important for some particular design, which include: Extent and degree of fire spread to adjoining properties; Life safety to the fire brigade personnel; Extent and degree of environmental damages; Loss of stock, market share and customers. 8. BENEFITS AND LIMITATIONS OF PROBABILISTIC RISK ASSESSMENT By assigning probabilities of failure to the fire protection measures and assigning frequencies of occurrence to unwanted events and fire initiation. PRA can analyses and combines number of different fire scenarios as part of complete fire safety assessment of building design. The use of multiple scenarios and their combination through probabilistic techniques is the key feature of a PRA approach. The great benefits of PRA are that it can: Establish the most cost efficient design solution; Provide a measure of the effect of the low probability high consequence events; Facilitate comparison of the effectiveness of dissimilar fire safety components (e.g. smoke control versus compartmentation); Evaluate the effect of failure of one or more fire safety components. PRA technique requires availability of statistical data on fire events and on the reliability / performance of fire safety components. The application of PRA can be severely limited by data availability. It demands a higher skill level from the fire engineer and is very complex in quantification. This form of analysis will also require greater assessment skill by the building surveyor and the technical specialists assisting. Full probabilistic risk assessment can be very time consuming and expensive to undertake and so might not be practicable in some circumstances. 9. MANAGEMENT AND CONTROL 9.1. Control Regime Outbreak of fire is an indication of failure in fire safety management in certain degree. The building occupancy could have been changed; the occupancy load and fire load could have been increased the means of escape could have been blocked and the fire protection systems could have been out of order. Therefore, the assumption of good fire safety management approach being taken for fire engineering approach may need carefully review.. While risk-oriented fire engineering designs apply extensive engineering calculation, computer modeling with series presumed operation environment, which vary from one building to another, it will require a structured fire safety management on the operations of the premises so as to ensure that the operation parameters of the premises are continuously maintained within the design criteria and the premises are operated at a reasonable safety level. For the sake of public safety, it is strongly recommended that legal requirements and responsibilities to be imposed on the designers, owners and operators of a risk-oriented fire engineering designed premises to establish a proper fire safety management system plus a third party audit system to certify the effectiveness of the management. Following paragraphs highlight major issues to be considered.

9.2. Enforcement Authority Since fire safety management system and third party audit are proposed to be imposed as legal requirements for a risk-oriented fire engineering designed building, it is required to identify an appropriate authority to enforce these requirements. Fire Services Department would be considered as the most appropriate department to take up these authorities. Currently, certain elements which are applied in the performance-based design are not properly covered under the jurisdiction of the Fire Services Department, like building population, building layout, building usage and fire loading. The proposed fire safety management system and third party audit system could centralized the authorities on the Fire Services Department to cover all operation elements of the premises specified under the design criteria and to enforce the rectification of any deficiencies. Further study is recommended to set up appropriate legislation in this area. 9.3. Fire Safety Management It is recommended that the owners or operators of premises are required to hire a qualified fire engineer, either CEng or IEng, with adequate knowledge on risk-oriented fire engineering design to develop and implement a proper fire safety management system for a risk-oriented fire engineering designed building. The management system should cover: Management Structure and Deployment of Resources; Management Objectives and Goals; Control and Supervision; Management of Changes; Operations and Maintenance of Designed Facilities and Structures; Training, Communication and Coordination; Emergency Preparedness and Accident Investigation; Performance Monitoring and Audit; Management Review. 9.4. Audit Scopes, Intervals and Submissions To ensure the effectiveness of fire safety management and the operations of the premises maintaining within the design criteria, a third party audit is recommended to be conducted for all risk-oriented fire engineering designed premises at least once every 12 months. The scopes of audit are recommended to cover the following: Compliance-based audit of operations parameters against the design criteria; Engineering audit against the performance of designed facilities and structures; Management audit against the developed fire safety management system. The auditor shall submit the audit report with recommended action list to the Authority within 14 days after the audit. The building management of the premises shall answer the Authority with proper action plan for rectification of deficiencies within 30 days of report submission. The Authority may take appropriate legal action against the building management or operators for non-compliance. 9.5. Audit Criteria While the design concepts and criteria of risk-oriented fire engineering designed buildings vary from one building to another, it is impracticable to develop a set of standard audit criteria for all premises. It is recommended that the fire engineering designer is assigned with legal responsibilities to develop auditing guidelines and to specify the audit criteria for future fire safety management and auditing purposes. Such guidelines shall form part of his submissions for the risk-oriented fire engineering design. A copy of all fire engineering reports should be properly handed over from the designer to the building management. It is recommended to get reference to the similar approach of the Construction (Design and

Management) Regulations 2007 of the United Kingdom on the duties of designer. 9.6. Auditor Competency With complicated fire engineering applications in the design, the auditors are required strong competency in fire engineering and auditing skill. It is recommended that Registered Fire Engineers should be further developed and trained up to take up this function. A safety auditing course is recommended to be provided for Registered Fire Engineers for this purpose. A proper register for all qualified fire safety auditors is recommended to be maintained by the Fire Services Department. The disciplinary system for Registered Fire Engineer shall be extended to cover fire safety audit. 10. REFERENCES [1] Guide to Fire Engineering Approach, Practice Note for Authorized Persons and Registered Structural Engineers PNAP 204 APP-87, Buildings Department, Hong Kong, 1998 [2] Code of Practice for Fire Safety in Buildings 2011, Buildings Department, Hong Kong, 2012 [3] Code of Practice for Minimum Fire Service Installations and Equipment and Inspection, Testing and Maintenance of Installations and Equipment, Fire Services Department, Hong Kong, 2012 [4] Goal-Oriented Systems Approach to Building Fire Safety, PBS P 5920.9, Building Fire Safety Criteria: Appendix D, U.S. General Services Administration, Washington, DC, 1972. [5] SFPE Engineering Guide to Performance-Based Fire Protection, National Fire Protection Association, Quincy, MA, 2007. [6] NFPA 550, Guide to the Fire Safety Concepts Tree, National Fire Protection Association, Quincy, MA, 2007. [7] PD 7974-7: 2003, Application of Fire Safety Engineering Principles to the Design of Buildings - Part 7: Probabilistic Risk Assessment, British Standards Institute, London, UK, 2003. [8] BS 7974, Application of Fire Safety Engineering Principles to the Design of Buildings Code of Practice, British Standards Institute, London, UK, 2001. [9] Health and Safety Executive. The tolerability of risk from nuclear power stations. London: TSO, 1988. [10] Rasbash D. J. Criteria for acceptability for use with quantitative approaches in fire safety, Fire Safety Journal. 1984/85, 8, 141-157. [11] Fire Engineering Guidelines 1 st Edition, Fire Code Reform Centre Limited, Sydney, Australia, 1996 [12] Meacham, B., Charters, D., Johnson, P. & Salisbury, M. Building Fire Risk Analysis, SFPE Handbook of Fire Protection Engineering, National Fire Protection Association, Quincy, MA, 2008. [13] SFPE Engineering Guide Fire Risk Assessment, Society of Fire Protection Engineers, Bethesda, MD, November 2006. [14] ISO 16732-1, Fire Safety Engineering Guidance on Fire Risk Assessment, International Organization for Standardization, Geneva, Switzerland, 2012. [15] Ramachandran, G. and Charters, D. Quantitative Risk Assessment in Fire Safety, Spoon Press, London, England, 2011. [16] Charters, D., Salisbury, M., and Wu, S., The Development of Risk-Informed Performance- Based Codes, Proceedings of the 5th International Conference on Performance Based Codes and Fire Safety Design Methods, Society of Fire Protection Engineers, Bethesda, MD, 2004. [17] BS ISO/TR13387-1:1999 Fire Safety Engineering Part 1 Application of Fire Performance Concepts to Design Objectives, British Standards Institute, London, UK, 1999 [18] Ramachandran, G. Probability based building design for fire safety. Part 1. Fire Technology. 31, 3, 1995, 265-275; Part 2, Fire Technology. 31, 4, 1995, 355-368. Ramachandran, G. Probability based fire safety code. Journal of Fire Protection Engineering. 2, 3, 1990, 75-91.