Explainable Artificial Intelligence (XAI)-Enabled Probabilistic Fire Risk Prediction for High-Rise Residential Buildings: SHAP Attribution of Human and Organisational Risks

Abstract

Fire safety in high-rise residential buildings depends on active fire protection systems subject to technical, human, and organisational risks. Prior probabilistic models incorporating human and organisational errors (HOEs) raise expected risk-to-life by 20 to 37%, yet remain inaccessible to the owners, managers, qualified persons, and regulators who must act on them. This paper applies SHAP (SHapley Additive exPlanations) to a reconstructed Bayesian network fire risk model with Markov Chain Monte Carlo uncertainty propagation, extending the T-H-O-Risk methodology across sixteen system configurations and seven buildings in five jurisdictions (Singapore, Australia, Hong Kong, New Zealand, the UK) plus a generic reference case. Global SHAP analysis attributes 89.8% of total HOE attribution to maintenance-related factors (H7, insufficient technical handover; H8, insufficient safety check; H9, inadequate periodic inspection), reframing the primary intervention from behavioural to structural. The reconstruction reproduces 112 published ERL values with a mean absolute percentage error of 1.8% on total ERL (13.7% on the HOE increment, the layer carrying the paper’s claims) and 96% interval coverage. Attribution outputs are translated into graded, risk-informed maintenance conditions for SCDF waiver assessment. To the authors’ knowledge, this is the first Shapley values attribution of HOE factors in a building system-level Bayesian network fire risk model.

1. Introduction

Fire safety in high-rise residential buildings depends on the reliable performance of active fire protection systems, which are themselves subject to technical, human, and organisational risk. When that reliability is eroded by human error or organisational shortcomings, the consequences can be catastrophic. The 2017 Grenfell Tower fire (72 fatalities) exposed systemic failures spanning material selection, regulatory compliance, building management, and emergency response that were not purely technical in origin [1]; the November 2025 Wang Fuk Court fire in Tai Po, Hong Kong, in which fire spread rapidly across an occupied residential estate during renovation work, has been linked by preliminary government findings to inadequate site fire safety management and non-compliant scaffolding netting, pending the official investigation [2,3]. Both events illustrate a persistent limitation of conventional fire risk assessment: a reliance on deterministic, technically focused methods that cannot account for the human and organisational dimensions of fire risk and are seldom interpretable to the practitioners and regulators who must act on their outputs.

Probabilistic risk assessment (PRA) methods, including fault tree analysis (FTA), event tree analysis (ETA), and Bayesian network (BN) modelling, offer a principled alternative by quantifying fire risk as a function of scenario probabilities and consequences [4,5]. Two distinct quantitative findings from the T-H-O-Risk research programme motivate this work, and they measure different constructs. First, a systematic review by Tan and Moinuddin [6] concluded that fire risk models that exclude human and organisational factors can underestimate modelled fire risk by as much as 80%; this figure refers to the gap between technically focused model outputs and risk estimates that account for human and organisational contributions reported across the reviewed literature, not to a directly observed incident rate. Second, subsequent empirical T-H-O-Risk studies quantified the effect within a single consistent model: incorporating HOEs into BN-based PRA increased the calculated expected risk-to-life (ERL) of the modelled buildings by 20% to 37% relative to the same model without HOEs [7,8,9]. Despite this evidence, the majority of extant fire PRA models confine their scope to technical failure rates.

A second limitation concerns interpretability. Models that most accurately represent fire risk, particularly those incorporating nonlinear HOE interactions, Bayesian inference, and system dynamics, are often inaccessible to building owners, facility managers, qualified persons (QPs), and regulatory authorities. In safety-critical domains governed by performance-based building codes, the auditability and defensibility of risk assessments are often regulatory requirements. This limitation creates a gap between model sophistication and practical utility [10].

Explainable artificial intelligence (XAI) offers a resolution to this interpretability challenge. SHAP (SHapley Additive exPlanations), grounded in cooperative game theory, assigns each input feature a quantified contribution to the model output, thus enabling both global understanding of model behaviour and local explanation of individual predictions [11,12]. SHAP has been applied to structural engineering, wildfire susceptibility assessment, construction cost prediction, and materials science [12,13]. Most pertinently, Alshboul and Shehadeh [14] demonstrated that integrating SHAP with a Composite Weibull Hazard Model combined with Monte Carlo Markov Chain (MCMC) posterior estimation for high-rise construction delay risk produced improved predictive accuracy (from 85.6% to 96.7%) and stakeholder-ready explanations of dominant risk factors, explicitly citing the T-H-O-Risk framework of Tan and Moinuddin [6] as a foundational probabilistic risk reference.

Despite this progress, to the authors’ knowledge, no existing study applies SHAP-based feature attribution to a probabilistic fire risk assessment model at the building system level. The nearest comparable works either address fire at the compartment level—Fan et al. [15] applied explainable ML to flashover prediction—or apply machine learning to human error-induced fire incidents without SHAP attribution or Bayesian network PRA integration [16]. Neither constitutes building system-level PRA with systematic HOE parameterisation. XAI has therefore not been applied to Bayesian network PRA with HOE integration: the class of models most directly relevant to regulatory decision-making for high-rise building fire safety.

The regulatory context of Singapore provides the primary applied focus of this paper. Singapore’s residential ignition frequency has declined over the past decade [17]; the 2012 value (2.60 × 10⁻⁵ fires/m²/year) predates a 2019 reclassification that removed rubbish chute and refuse bin fires from the structural fire category, so the genuine like-for-like trend is the post-2019 series (Section 2.4, mean 6.93 × 10⁻⁶ fires/m²/year) to which the model is calibrated, with the decline reflecting public education, enforcement, and improvements in building systems. Nevertheless, with approximately 1.55 million residential dwelling units across a predominantly high-rise urban fabric, even low per-unit ignition rates translate to substantial national fire event frequencies. The Singapore Civil Defence Force (SCDF) waiver system for alternative fire safety solutions creates a regulatory environment in which interpretable, probabilistic risk tools would have immediate practical utility.

The aim of this study is to make probabilistic fire risk attribution transparent and directly actionable for the regulators, qualified persons, and building managers who must act on model outputs. Four objectives follow from this aim: (1) to reconstruct and extend the T-H-O-Risk Bayesian network with Markov Chain Monte Carlo (MCMC) posterior uncertainty estimation; (2) to apply SHAP feature attribution across sixteen active fire safety system configurations and seven high-rise residential building case studies; (3) to validate the SHAP-attributed expected risk-to-life (ERL) values against published T-H-O-Risk results and cross-validate the SHAP global feature ranking against variance-based sensitivity ranking; and (4) to translate the SHAP attribution outputs into regulatory decision narratives applicable to the Singapore SCDF waiver framework.

The following subsections set out the technical background and the specific research gap that this study addresses. They draw on the peer-reviewed literature in explainable artificial intelligence, probabilistic fire risk assessment, and high-rise fire safety regulation published between 2012 and 2026.

1.1. Explainable Artificial Intelligence: Methods and Applicability

The opacity of modern machine learning models creates well-documented barriers to adoption in safety-critical domains where decisions must be auditable and defensible [18,19]. XAI has emerged to address this through post hoc or ante hoc explanations of model behaviour, organised along two dimensions: scope, distinguishing local explanations of individual predictions from global characterisations of model behaviour, and model dependency, distinguishing model-agnostic methods applicable to any architecture from model-specific methods that exploit internal structure [13,20].

SHAP, introduced by Lundberg and Lee [11] and grounded in cooperative game theory, has become the most widely adopted XAI method in engineering applications. Its three axiomatic properties, local accuracy (SHAP values sum exactly to the difference between model output and expected output), consistency (if a feature’s marginal impact increases, its SHAP value cannot decrease), and missingness (absent features receive zero attribution), distinguish it from earlier attribution approaches and make its outputs formally interpretable, defensible, and auditable for regulatory decision-making [11]. Practical implementations include TreeSHAP for tree-based models, which is exact and computationally efficient, and KernelSHAP for model-agnostic application at higher computational cost [11,21]. Local Interpretable Model-agnostic Explanations (LIME) [19] offers a simpler alternative by fitting a local linear surrogate near a prediction of interest, though Mohamed et al. [20] document its instability under perturbation and sensitivity to neighbourhood definition, concluding that SHAP has largely superseded LIME in engineering applications. The evaluation of XAI output quality has itself been formalised: Alshboul and Shehadeh [14] proposed a suite of metrics including the Transparency Index, Model Fidelity Function, and Explanation Consistency Check, a subset of which is adapted for the fire safety domain in the present study.

Applications of SHAP in construction and safety risk engineering provide the methodological precedents most directly relevant to this paper. Alshboul and Shehadeh [14] integrated SHAP with a Composite Weibull Hazard Model combined with MCMC posterior estimation for high-rise construction delay and cost risk, demonstrating that SHAP global and local explanations improved predictive accuracy from 85.6% to 96.7%, while producing stakeholder-ready explanations of dominant risk factors. This paper explicitly cites the T-H-O-Risk framework of Tan and Moinuddin [6] as foundational to probabilistic risk modelling in high-rise buildings, thus establishing the methodological lineage that the present study extends. Further applications across construction cost prediction [13], construction accident prediction [22], and building safety risk assessment [23] confirm the generalisability of SHAP attribution to built-environment risk problems. Within fire safety specifically, Yang et al. [24] published the first known SHAP application to any form of fire risk, using XGBoost and SHAP to assess urban fire susceptibility in Chengdu based on spatial geographic variables; Fan et al. [15] applied explainable ML to compartment-level flashover prediction. Both studies differ categorically from the present paper, which operates at the building system level with posterior-distributed HOE parameters as features within a Bayesian network.

1.2. Probabilistic Fire Risk Assessment and the T-H-O-Risk Framework

Probabilistic risk assessment in fire safety quantifies the likelihood and consequences of fire scenarios through structured logic models, proceeding from ignition frequency through fault trees and event trees to consequence models and risk integration [5]. Bayesian networks have been applied to building fire risk prediction since the early work of Khali Issa et al. [25], with subsequent hybrid BN-fault tree architectures addressing the limitations of each method used in isolation. Data-driven approaches have expanded the toolkit: Lu et al. [26] applied gradient boosting with recursive feature elimination to fire risk classification in stadiums, and Zhang et al. [27] applied a spatial Markov chain model for regional high-rise building fire risk assessment. The consistent limitation across this body of work is the absence of an interpretability layer; probabilities are propagated and risk estimates produced, but the attribution of risk to specific causal factors is not formally quantified, limiting the regulatory utility of the outputs.

The T-H-O-Risk methodology, developed by Tan and Moinuddin [6] and extended across three subsequent papers [7,8,9], addresses this limitation most directly by incorporating human and organisational errors into the probabilistic framework. Tan and Moinuddin [6] identified, through systematic review, that existing fire risk models underestimate actual risk by as much as 80% by ignoring human and organisational factors, and established the nine-category HOE taxonomy, spanning poor safety supervision, deficient training, procedural non-compliance, deficient risk assessment, deficient knowledge, inexperience, insufficient technical handover, insufficient safety checking, and inadequate periodic inspection, that subsequent papers operationalised quantitatively. Tan et al. [7,9] validated the methodology across seven case studies in five countries, finding that HOEs affect active system reliability by up to 33% with large time-varying variations driven by risk perception feedback loops in the system dynamics model. Tan et al. [8,9] performed variance-based sensitivity and uncertainty analyses, providing the feature importance rankings against which SHAP attributions are cross-validated in the present study. The sensitivity analysis constitutes the closest existing work to XAI feature attribution in fire PRA; its one-at-a-time parameter perturbation approach, however, is structurally unable to capture interaction effects between HOE variables or to distinguish factors that are highly sensitive conditionally from those that contribute most in absolute terms across the posterior distribution. The formalisation of this attribution through Shapley values is the specific methodological gap that this paper addresses.

Ignition frequency provides the foundational input multiplier for all probabilistic fire risk assessments. Tan et al. [28], in the only published Asia-Pacific ignition frequency calibration study by this research team, analysed Australian fire statistical data from 2012 to 2019 and proposed improved Barrois model coefficients; their methodology provides the template for the Singapore calibration performed in Section 2.4. Evidence from adjacent high-hazard industries also informs the HOE probability estimation approach: Ren et al. [29] quantified the impacts of human and organisational factors on construction errors in the Netherlands using structured expert judgement, providing a directly applicable methodology for future Singapore-specific HOE database construction using SCDF fire investigation reports as the primary evidence base.

1.3. High-Rise Buildings, Performance-Based Regulation, and the Singapore Context

High-rise buildings present fire risk challenges qualitatively distinct from low-rise structures. Vertical evacuation complexity, the extent of compartmentation requirements, the dependence of mechanical system performance on maintenance quality, and the occupancy diversity of mixed-use towers each amplify the consequences of system unreliability and organisational failure in ways that purely technical models cannot capture. The regulatory response to the 2017 Grenfell Tower fire, which resulted in 72 fatalities and exposed systemic failures spanning material selection, inspection inadequacy, and building management organisational breakdown, is instructive in this regard. The Hackitt [1] independent review explicitly called for safety cases in fire safety engineering, requiring transparent, auditable risk assessments that demonstrate the causal logic behind risk numbers rather than merely showing that figures fall within tolerability limits. This regulatory pull for interpretable, attribution-supported probabilistic risk assessment is the institutional context in which the present paper’s contribution has its most direct practical value.

Fire safety regulation is transitioning globally from prescriptive codes toward performance-based design, a transition that demands probabilistic risk methods capable of quantifying building-specific risk, transparent risk acceptance criteria, and reproducible calculations that a regulatory authority can independently verify. Meacham and van Straalen [10] characterise this evolution through a sociotechnical systems framework, noting that the interpretability gap in existing probabilistic fire risk models is itself a structural barrier to institutional adoption of performance-based approaches. Singapore’s regulatory framework, administered by SCDF under the Fire Safety Act, combines a prescriptive Fire Code with waiver provisions for non-standard designs evaluated on the basis of equivalent safety outcomes, a judgement that currently relies on qualified person expertise without a transparent, quantitative risk attribution framework. With approximately 1.55 million residential dwelling units across a predominantly high-rise urban fabric, Singapore’s institutional context provides both a relevant benchmark population and a regulatory environment in which interpretable, probabilistic risk tools have immediate practical application.

1.4. Research Gap and Novel Contributions

The foregoing review points to five gaps that collectively define the scope of this paper. To the authors’ knowledge, no existing study applies SHAP-based or LIME-based feature attribution to a probabilistic fire risk model at the building system level. The boundaries of this claim are stated precisely: it concerns (i) high-rise residential buildings, (ii) Bayesian network PRA, (iii) systematic human and organisational error parameterisation, and (iv) building system-level ERL outputs; it does not extend to compartment-level fire phenomena, urban-scale fire susceptibility mapping, or non-fire construction risk, where SHAP applications exist. The nearest comparable studies are: Liu et al. [30], who applied SHAP to identify drivers of residential fire spread from urban fire incident records without building system Bayesian network integration or HOE parameterisation; Yang et al. [24] and Lu et al. [26], who applied XAI to fire susceptibility and facility-level fire risk classification at the urban or facility scale without human factor incorporation; and Alshboul and Shehadeh [14], who applied SHAP to construction delay risk without fire safety content. None integrates XAI attribution with a Bayesian network PRA framework incorporating systematic HOE parameterisation at the building system level. SCDF waiver decisions are currently qualitative and case-by-case, with no published study having trained a predictive model on waiver outcome data or applied XAI to explain which submission characteristics drive approval. One-at-a-time sensitivity analysis cannot capture synergistic or antagonistic interactions between HOE variable pairs; SHAP interaction decomposition would provide the first formal quantification of these effects in fire safety. No existing fire risk framework combines MCMC uncertainty quantification with XAI attribution in a single model, thus producing risk estimates with simultaneously quantified uncertainty and explained feature contributions. Finally, Singapore and the Asia-Pacific context remain substantially under-represented in fire safety probabilistic risk research. Together, these gaps define a well-delineated and addressable research boundary that the present study directly targets.

Against this background, the specific novel contributions of this paper are stated explicitly, each distinguished from the nearest prior work:

(1)

First, Shapley values attribution of human and organisational error (HOE) factors in a building system-level probabilistic (Bayesian network) fire risk model. Prior SHAP applications in fire safety operate at the urban scale (Yang et al. [24]; Liu et al. [30]) or the compartment scale (Fan et al. [15]), and the nearest construction risk precedent (Alshboul and Shehadeh [14]) contains no fire safety content. None attributes risk to systematic HOE variables inside a probabilistic fire model. The nearest methodological precedent, Alshboul and Shehadeh [14], combined SHAP with MCMC for high-rise construction delay risk and cites the T-H-O-Risk framework, but operates on a regression hazard model with no fire content, no Bayesian network HOE structure, and no exact Shapley computation against a no-HOE reference; the present contribution is the attribution, with quantified uncertainty, of HOE factors inside a building system fire risk Bayesian network.

(2)

Dual-layer uncertainty quantification. MCMC posterior propagation is combined with posterior SHAP credible intervals, so each feature attribution carries an explicit uncertainty band. Existing fire SHAP studies report point attributions only.

(3)

Exactness of the reported attribution. All attribution percentages in this paper (Tables 8, 10 and 11) are exact Shapley values, computed by complete subset enumeration over the nine HOE features against a no-HOE reference; the surrogate TreeSHAP pipeline is used only for the beeswarm and interaction visualisations (Figures 4 and 6b). The headline numbers therefore carry no surrogate approximation error.

(4)

A Singapore-calibrated ignition frequency (the HOE priors themselves remain literature-derived, pending the recalibration of Section 6.1) and a category-specific lifecycle (temporal) attribution; the ignition calibration is the new empirical element, while the lifecycle attribution is an illustrative extension reconstructed from the published system dynamics rather than a calibrated prediction (Section 4.5).

(5)

Direct regulatory translation: The attribution outputs are converted into graded, risk-informed maintenance conditions for SCDF waiver assessment (the graded framework of the waiver-tier table in Section 4.2). Inherited from the validated T-H-O-Risk programme [6,7,8,9], and not claimed as novel, are the nine-category HOE taxonomy, the seven case study buildings, the event tree probabilities, the design fire parameters, and the published ERL backbone to which the reconstruction is anchored (Section 2.3).

2. Methodology

2.1. Study Design Overview

This paper proposes an integrated analytical framework extending the validated T-H-O-Risk methodology [6,7,8,9] with a SHAP interpretability layer. The research design proceeds in four sequential stages: (1) model specification, reconstructing the BN structure and CPTs from published T-H-O-Risk papers; (2) posterior estimation, applying MCMC sampling to propagate uncertainty through the BN; (3) SHAP attribution, fitting an XGBoost surrogate to posterior model evaluations and applying TreeSHAP, which is exact for tree-based models, to the fitted surrogate (KernelSHAP is not used in this study); and (4) validation and regulatory translation, validating XAI outputs against retrospective case study results and translating them into regulatory decision narratives. The framework is illustrated in Figure 1.

Figure 1. Framework overview: T-H-O-Risk extended with MCMC posterior estimation and SHAP attribution pipeline.

2.2. The T-H-O-Risk Bayesian Network Framework

2.2.1. Event Tree and Fault Tree Architecture

The T-H-O-Risk model initiates with an event tree analysis mapping fire initiation to outcome chains via a sequence of active fire safety sub-system successes and failures [8,9]. Four active fire safety systems are considered: sprinkler systems, building occupant warning systems (BOWSs), local smoke detectors, and smoke control systems. This four-system architecture yields sixteen trial designs (TD01 through TD16) representing all binary combinations of system presence and absence. Key event tree node probabilities are presented in Table 1.

Table 1. Event tree node probabilities (Tan et al., 2021 [8,9], Section 3.3).

Event Node	Failure/Occurrence Probability
Fire originating in concealed space	0.20
Fire originating in sole-occupancy unit or corridor	0.80
Challenging fire development (peak HRR > 5 MW)	0.45
Smouldering fire development	0.55
Failure of fire detection system	0.10
Failure of sprinkler system	0.10
Failure of building alarm system	0.10
Blocked exit (egress failure)	0.20

2.2.2. Bayesian Network Node Structure

The BN is a directed acyclic graph encoding probabilistic dependencies, as illustrated in Figure 2. Each node is conditionally independent of its non-descendants given its parent nodes, formalised by the chain rule:

$$\mathrm{P}\left(X_1,X_2,\dots ,X_n\right)={\displaystyle {\prod }_{\mathrm{i}=1}^n}\mathrm{P}\left(X_i|\mathrm{P}\mathrm{a}\mathrm{r}\mathrm{e}\mathrm{n}\mathrm{t}\mathrm{s}\left(X_i\right)\right)$$

(1)

Figure 2. Bayesian network node structure for the T-H-O-Risk model showing HOE basic events, intermediate nodes, and active fire safety system outputs.

HOE nodes are identified via the Fussell–Vesely importance measure, which ranks basic events by their fractional contribution to the top event probability:

$$p\left(e|S\right)={\displaystyle \frac{p\left(e_S\right)}{p\left(S\right)}}$$

(2)

where e is the basic event, S is the risk state, p(eS) is the probability of the union of minimum cut sets containing event e, and p(S) is the probability of the top event. Nine HOE basic events were identified from the human reliability literature as having significant importance measure values (Table 2). Because no fire-specific HOE incident database exists at the basic event level, these occurrence probabilities are imported, following the original T-H-O-Risk studies [6,7], from the mature human reliability databases of the nuclear, aviation, and process safety industries and adapted to the building fire context by structured expert judgement. Cross-industry transfer of human error probabilities is established practice in fire and building probabilistic risk assessment, where domain-specific actuarial data are scarce. The relative ordering of error types implied by these databases is an explicit input assumption, not a result; its influence on the findings is examined directly by the prior sensitivity analysis (Section 3.7), which shows that the rank order conclusion is robust to substantial prior misspecification while the precise magnitudes are prior-dependent. This is stated as a limitation (Section 4.5) and addressed by the Singapore recalibration pathway (Section 6.1).

Table 2. HOE basic event failure probabilities (Tan et al., 2020 [7], Table 1). Values are annual basic event occurrence probabilities in the fault tree sense, derived in the original studies from nuclear, aviation, and process safety human reliability databases adapted by structured expert judgement; the evidence basis for each value is documented in Tan et al. [6,7] and the adaptation limitation is discussed in Section 4.5.

Code	HOE Basic Event	Failure Probability
H1	Poor safety supervision	4.60 × 10−4
H2	Deficient training	1.89 × 10−3
H3	Not following procedures	1.70 × 10−4
H4	Deficient risk assessment	1.80 × 10−4
H5	Deficient knowledge	1.89 × 10−3
H6	Inexperience	1.10 × 10−3
H7	Insufficient technical handover	6.30 × 10−3
H8	Insufficient safety check	2.50 × 10−2
H9	Inadequate periodic inspection	2.50 × 10−2

HOE nodes cascade through intermediate nodes, including inefficient timely control, deficient maintenance, not complying with instructions, and inefficient emergency plan, to influence the reliability of each active fire safety system. As an illustrative example, the inefficient timely control node evaluates as FALSE only when all three parent nodes are simultaneously FALSE:

$$\mathrm{P}\left(ITC=0\right)=\left[1-\mathrm{P}\left(DT=1\right)\right]\times \left[1-\mathrm{P}\left(NCI=1\right)\right]\times \left[1-\mathrm{P}\left(IEP=1\right)\right]$$

(3)

where ITC = inefficient timely control; DT = deficient training (H2); NCI = not complying with instructions (H3); IEP = inefficient emergency plan.

The remaining intermediate nodes follow the same Boolean OR-gate construction: deficient maintenance evaluates over H7, H8, and H9; not complying with instructions over H3, H4, and H5; and inefficient emergency plan over H1, H4, and H6. The full node list, the logic equations for every intermediate node, and the conditional probability table mappings are tabulated in the Supplementary Materials (Table S1) to support independent replication.

2.2.3. System Dynamics Integration

The BN is coupled with a system dynamics model implemented in Vensim to introduce temporal variation across a ten-year building lifecycle [9]. Stocks represent accumulated state variables such as maintenance quality and training adequacy; flows represent rates of change. A sociotechnical feedback loop encodes the nonlinear relationship between risk perception, maintenance investment, and system reliability over time. The key temporal pattern identified in the original papers is a reliability trough around year five, recovery peak at year seven, and subsequent relaxation, driven by organisational risk perception dynamics. The SD model is parameterised with a uniform distribution for fire ignition probability covering 0.30 to 0.40 for apartment fires and 0.01 to 0.02 for corridor fires, and a triangular distribution for valve-closure probability ranging from 0.01 to 0.015. SHAP attributions are computed at five representative time snapshots (t = 1, 3, 5, 7, and 10 years).

2.3. Data Sources and Model Parameters

BN node probability values are directly reconstructed from the published T-H-O-Risk papers, providing a transparent, literature-grounded parameterisation with full provenance [7,8,9]. Event tree branch probabilities are drawn from Tan et al. [9]; HOE basic event probabilities from Tan et al. [7]; and CPT specifications are reconstructed from Tan et al. [7] using Boolean logic encoding. Design fire parameters are drawn from Tan et al. [7], covering four fire types corresponding to apartment–corridor and sprinkler active–inactive combinations (Table 4). For validation purposes, the seven case study buildings from Tan et al. [7] are adopted as the primary reference dataset, spanning heights from 51 m to 107 m, floor plate areas from 324 m² to 1343 m², and occupant densities from 18 to 58 occupants per floor. The individual characteristics of the seven buildings are summarised in Table 3.

Table 3. Characteristics of the seven case study buildings (after Tan et al. [7], Table 3). All are reinforced-concrete high-rise residential buildings; occupant counts are per floor. ‘Residential (mixed)’ denotes a mixed occupant profile within a residential tower, not a mixed-use development.

Case	Location	Height (m)	Storeys	Floor Area/ Storey (m2)	Occupants/ Floor	Total Occupants	Occupancy	Stair/Travel Config.
#1	Australia	58.7	21	1099	54	1134	Residential	Ext. travel dist.
#2	Singapore	60.0	20	505	24	480	Residential	Single stair
#3	Hong Kong	107.0	38	324	32	1216	Residential	DtS (BCA)
#4	Australia	63.0	21	1343	58	1218	Residential	Ext. travel dist.
#5	Generic	51.0	18	618	22	396	Residential (mixed)	Ext. travel dist.
#6	New Zealand	57.0	20	556	18	360	Residential (mixed)	Single stair
#7	UK	67.0	24	476	24	576	Residential (mixed)	Single stair

Table 3. Characteristics of the seven case study buildings (after Tan et al. [7], Table 3). All are reinforced-concrete high-rise residential buildings; occupant counts are per floor. ‘Residential (mixed)’ denotes a mixed occupant profile within a residential tower, not a mixed-use development.

Case	Location	Height (m)	Storeys	Floor Area/ Storey (m2)	Occupants/ Floor	Total Occupants	Occupancy	Stair/Travel Config.
#1	Australia	58.7	21	1099	54	1134	Residential	Ext. travel dist.
#2	Singapore	60.0	20	505	24	480	Residential	Single stair
#3	Hong Kong	107.0	38	324	32	1216	Residential	DtS (BCA)
#4	Australia	63.0	21	1343	58	1218	Residential	Ext. travel dist.
#5	Generic	51.0	18	618	22	396	Residential (mixed)	Ext. travel dist.
#6	New Zealand	57.0	20	556	18	360	Residential (mixed)	Single stair
#7	UK	67.0	24	476	24	576	Residential (mixed)	Single stair

Table 4. Design fire parameters (Tan et al., 2020 [7], Table 5). Growth rate in kW/s², peak heat release rate in kW, fuel load in MJ/m². The same medium growth rate (0.0117 kW/s²) applies across all four design fire conditions per the original T-H-O-Risk parameterisation, in which sprinkler activation caps peak heat release rate rather than altering the growth phase.

Design Fire	Sprinkler Active	Growth Rate (kW/s2)	Peak HRR (kW)	Fuel Load (MJ/m2)
Apartment fire	Yes	0.0117	197.0	800
Apartment fire	No	0.0117	5000	800
Corridor fire	Yes	0.0117	197.0	75.0
Corridor fire	No	0.0117	300.0	75.0

Table 5. Singapore residential ignition frequency, post-2019 series. Fire counts from SCDF annual statistics [17]; residential GFA from Singapore Department of Statistics and Urban Redevelopment Authority stock data, 2023 value extrapolated from the 2019–2022 completion trend. The 2018–2019 series discontinuity reflects SCDF’s reclassification of rubbish chute and refuse bin fires out of the structural residential category [17].

Year	Residential Fires	GFA (m2)	Ignition Frequency (Fires/m2/Year)
2019	1168	145,593,783	8.02 × 10−6
2020	1054	146,686,289	7.19 × 10−6
2021	1010	148,052,330	6.82 × 10−6
2022	935	149,621,295	6.25 × 10−6
2023	970	152,000,000	6.38 × 10−6

Table 4. Design fire parameters (Tan et al., 2020 [7], Table 5). Growth rate in kW/s², peak heat release rate in kW, fuel load in MJ/m². The same medium growth rate (0.0117 kW/s²) applies across all four design fire conditions per the original T-H-O-Risk parameterisation, in which sprinkler activation caps peak heat release rate rather than altering the growth phase.

Design Fire	Sprinkler Active	Growth Rate (kW/s2)	Peak HRR (kW)	Fuel Load (MJ/m2)
Apartment fire	Yes	0.0117	197.0	800
Apartment fire	No	0.0117	5000	800
Corridor fire	Yes	0.0117	197.0	75.0
Corridor fire	No	0.0117	300.0	75.0

The reconstruction follows a hybrid anchoring strategy that is stated explicitly to avoid overstating what is re-derived. The technical (no-HOE) ERL backbone for each of the 112 building-design combinations is anchored directly to the published T-H-O-Risk results, which constitute the validated reference output of the original model. The HOE layer is then reconstructed structurally: nine HOE basic events propagate through the four intermediate nodes via the Boolean OR-gate logic of Tan et al. [7], modify the reliability of each active system present in a trial design, and produce a configuration-dependent multiplicative ERL uplift. Per-feature effective sensitivity scales were calibrated against the attribution structure implied by the original model, and trial design-level uplift magnitudes were calibrated to the mean published with-HOE to no-HOE ratio per trial design; case-level variation was deliberately left out of the calibration so that the validation in Section 3.6 tests genuine generalisation across buildings. The complete reconstructed node list, all intermediate node equations, the calibrated parameters, and the reconstruction procedure are provided in the Supplementary Materials (Tables S1 and S2).

2.4. Singapore Ignition Frequency Calibration

Singapore national fire occurrence data are obtained from SCDF annual statistics [17] for 2012 to 2024. Residential fire occurrences declined from 3184 in 2012 to 970 in 2023. A notable discontinuity occurred between 2018 and 2019 (from 2411 to 1168 fires), representing a 52% reduction attributable to the reclassification of rubbish chute and refuse bin fires out of the structural residential fire category; this reclassification is described in the SCDF annual statistics releases accompanying the 2019 reporting year [17]. Residential gross floor area (GFA) estimates are derived from Singapore Department of Statistics and Urban Redevelopment Authority published stock data, with the 2023 value extrapolated from the 2019–2022 completions trend; data sources for both fire counts and GFA are stated in Table 5. The post-2019 series is adopted as the reference for structural building fire risk calibration (Table 5).

The post-2019 mean ignition frequency is 6.93 × 10⁻⁶ fires/m²/year with a range of 6.25–8.02 × 10⁻⁶. For BN calibration, a point estimate of 7.0 × 10⁻⁶ fires/m²/year is adopted with a uniform prior distribution bounded by [6.0 × 10⁻⁶, 8.5 × 10⁻⁶] for MCMC sampling. For Case 2 (Singapore, 20 storeys at 505 m² per floor, yielding 10,100 m² total floor area), the implied annual fire probability per building is:

$$\lambda ={\lambda }_f\times \mathrm{A}=7.0\times {10}^{-6}\times \mathrm{10,100}=7.07\times {10}^{-2}\mathrm{f}\mathrm{i}\mathrm{r}\mathrm{e}\mathrm{s}/\mathrm{b}\mathrm{u}\mathrm{i}\mathrm{l}\mathrm{d}\mathrm{i}\mathrm{n}\mathrm{g}/\mathrm{y}\mathrm{e}\mathrm{a}\mathrm{r}$$

(4)

This corresponds to approximately one structural fire event every fourteen years per building, consistent with fire incident databases for comparable residential high-rise typologies.

2.5. Markov Chain Monte Carlo Posterior Estimation

Rather than treating HOE node probabilities as point estimates, the present study adopts a Bayesian inferential approach, treating HOE node probabilities as uncertain quantities characterised by posterior distributions. MCMC sampling propagates this uncertainty through the BN to obtain posterior distributions over ERL outputs, providing credible intervals alongside point estimates. This directly parallels Alshboul and Shehadeh [14], who demonstrated that MCMC integration improved probabilistic model accuracy from 85.6% to 96.7% by replacing point estimates with full posterior characterisations.

Prior distributions for HOE node probabilities are assigned beta distributions with shape parameter alpha = 2.0 and rate parameter beta = alpha(1 − m)/m, where m is the corresponding point estimate from Tan et al. [7]; this parameterisation reproduces the point estimates as prior means with a coefficient of variation of approximately 0.71, consistent with the reported uncertainty ranges of the underlying industry databases. The full alpha and beta values for all nine parameters are tabulated in the Supplementary Materials (Table S3). An important clarification is owed to the reader: no new incident-level HOE observations were available to form a likelihood, so the HOE distributions reported in Section 3.1 represent propagated parameter uncertainty around the literature-derived estimates rather than data-updated Bayesian posteriors; this distinction between propagated epistemic parameter uncertainty and a fully data-updated posterior, and its treatment in risk-informed decision-making, follows Aven and Zio [31]; we retain the term posterior in the computational sense used by the sampling software, and we state this limitation explicitly in Section 4.5. The fire ignition probability is assigned a uniform distribution on [0.30, 0.40] for apartment fires and [0.01, 0.02] for corridor fires; the valve-closure probability is assigned a triangular distribution with minimum 0.01, peak 0.01, and maximum 0.015. MCMC sampling is performed using Hamiltonian Monte Carlo in PyMC [32], comprising 2000 tuning iterations and 2000 draws per chain across four independent chains (8000 posterior draws in total), with convergence assessed via the Gelman–Rubin statistic, bulk and tail effective sample sizes, divergence counts, and rank plots (Supplementary Figures S1 and S2).

2.6. SHAP Feature Attribution

SHAP computes the marginal contribution of each input feature to a model’s prediction through Shapley values:

$${\phi }_j\left(f,x\right)=\sum _{\mathrm{S}\subseteq \mathrm{F}\backslash \left\{\mathrm{j}\right\}}{\displaystyle \frac{\left|\mathrm{S}\right|! \left(\right|\mathrm{F}|-|\mathrm{S}|-1)!}{\left|\mathrm{F}\right|!}}\left[f\left(\mathrm{S}\cup \left\{\mathrm{j}\right\}\right)-f\left(\mathrm{S}\right)\right]$$

(5)

where F is the full feature set, S is a subset excluding feature j, f(S) is the model output with features in S present, and the weighting term ensures fair attribution across all possible feature orderings.

For the BN model, the present study adopts a two-step surrogate strategy. First, the model is evaluated for each of the 8000 retained MCMC draws (four chains) to produce an ERL output, generating a tabular dataset of 8000 feature–outcome pairs. Second, an XGBoost gradient boosting surrogate [33] is fitted to this dataset. Surrogate fidelity is assessed by R² between surrogate predictions and BN outputs; an R² threshold of 0.95 is required before proceeding. TreeSHAP [21] is then applied to the fitted surrogate, providing exact SHAP values for each feature and each prediction instance. Global SHAP explanations include mean absolute SHAP values, beeswarm summary plots, dependence plots, and pairwise interaction matrices. Local SHAP explanations are computed for Case 2, Singapore, under TD01 and TD04 (waiver scenario). Temporal SHAP attributions are computed at five snapshots from system dynamics model integration (t = 1, 3, 5, 7, 10 years).

For attribution reporting, the nine HOE basic events are grouped into four categories: maintenance (H7, H8, H9), training (H2, H5, H6), compliance (H1, H3), and organisational (H4). The category shares reported in Section 3.3.1 and in Tables 8 and 10 are exact sums of the per-feature Shapley values under this map, computed on unrounded values. Maintenance dominance is driven by the per-event base probabilities (H7 to H9 at 6.3 × 10⁻³ to 2.5 × 10⁻², one to two orders of magnitude above the other features) and is therefore not an artefact of the grouping.

The choice of XGBoost as the surrogate is benchmarked against three alternative tree-ensemble surrogates (Random Forest, LightGBM, and histogram-based gradient boosting) under identical five-fold cross-validation; the comparison, including edge-case error behaviour for the no-system configuration TD16, is reported in Section 3.2. Two reference-point conventions matter when reading SHAP outputs, and the revised analysis fixes one of each. For attribution tables, Shapley values are computed exactly on the reconstructed model by complete subset enumeration over the nine HOE features, with the no-HOE state (all basic event probabilities at zero) as the reference; this is computationally feasible because the reconstruction is analytic, it removes surrogate approximation error from the reported attributions, and it makes every attribution table decompose the HOE-driven ERL uplift exactly, so that per-feature values sum to the difference between the full-HOE and no-HOE conditions. The surrogate TreeSHAP pipeline is retained for visualisation-scale computations (beeswarm and dependence plots) and for the Shapley interaction decomposition of Section 3.3.2.

2.7. Uncertainty Propagation

A key methodological contribution is the integration of MCMC-derived epistemic uncertainty with SHAP attribution uncertainty, producing dual-layer uncertainty quantification. For each of the 8000 retained MCMC draws, SHAP values are computed for all features and all building designs, producing a posterior distribution over each feature’s attribution from which the posterior mean, 5th percentile, and 95th percentile SHAP values are reported. At the surrogate level, residual uncertainty is quantified via leave-one-out cross-validation of surrogate R² performance, with configurations where R² falls below 0.95 flagged explicitly.

2.8. Validation Approach

SHAP-attributed ERL values are computed for all sixteen trial designs across all seven case study buildings from Tan et al. [7] and compared against the published ERL results (112 building-design combinations). Agreement is assessed by: Pearson correlation between posterior mean ERL and published ERL (target r > 0.95, evaluated in both linear and logarithmic space given the four-decade ERL range); mean absolute percentage error (MAPE) and median absolute percentage error across all 112 combinations; per-case residual summaries; a calibration plot of predicted-to-published ratios; and coverage of published values within the 90% posterior interval (target > 85%). The SHAP global feature importance ranking is compared against the variance-based Tornado-plot sensitivity ranking from Tan et al. [8,9] using Spearman rank correlation, with significant divergence reported as a substantive finding rather than a defect.

All analyses are implemented in Python 3.12 using pgmpy [34] for Bayesian network construction, PyMC 5.28 [32] for MCMC sampling, XGBoost 3.2 [33] for surrogate fitting, and the SHAP shap Python library (v0.50) [11,21] for SHAP computation. All code and data will be made available via a public repository to ensure reproducibility, consistent with MDPI research data policies.

3. Results

3.1. MCMC Posterior Estimation of HOE Node Probabilities

3.1.1. Convergence Diagnostics

MCMC sampling was performed using Hamiltonian Monte Carlo with four independent chains of 2000 posterior draws each, following 2000 tuning iterations per chain (8000 retained draws). All HOE node probability parameters achieved R-hat = 1.000, with bulk effective sample size of at least 5492 and tail effective sample size of at least 3357. The sampler recorded zero divergent transitions at a target acceptance rate of 0.95, and rank plots show well-mixed chains. Trace plots and rank plots for all parameters are provided in Supplementary Figures S1 and S2. Because the HOE parameters carry no likelihood term (Section 2.5), these diagnostics certify faithful sampling of the specified distributions; they are necessary but not sufficient evidence of empirical calibration, which is addressed through the validation in Section 3.6 and the prior sensitivity analysis in Section 3.7.

3.1.2. Posterior Distributions

The posterior distributions of the nine HOE basic event parameters are summarised in Table 6. Parameters with higher point estimates exhibit wider posterior credible intervals, reflecting greater epistemic uncertainty for rare events poorly represented in industry databases.

Table 6. Sampling summary for HOE basic event probability parameters (four chains; intervals are 5th to 95th percentiles, i.e., 90% credible intervals, used consistently throughout this paper and in Figure 3).

HOE	Prior Point Est.	Posterior Mean	5th Pct.	95th Pct.	R-Hat
H1	4.60 × 10−4	4.57 × 10−4	7.94 × 10−5	1.1 × 10−3	1.000
H2	1.89 × 10−3	1.85 × 10−3	3.27 × 10−4	4.49 × 10−3	1.000
H3	1.70 × 10−4	1.7 × 10−4	2.98 × 10−5	4.1 × 10−4	1.000
H4	1.80 × 10−4	1.78 × 10−4	3.09 × 10−5	4.21 × 10−4	1.000
H5	1.89 × 10−3	1.9 × 10−3	3.42 × 10−4	4.47 × 10−3	1.000
H6	1.10 × 10−3	1.1 × 10−3	1.9 × 10−4	2.57 × 10−3	1.000
H7	6.30 × 10−3	6.35 × 10−3	1.18 × 10−3	1.49 × 10−2	1.000
H8	2.50 × 10−2	2.47 × 10−2	4.1 × 10−3	5.86 × 10−2	1.000
H9	2.50 × 10−2	2.5 × 10−2	4.81 × 10−3	5.78 × 10−2	1.000

Figure 3. Distributions of the nine HOE basic event probability parameters from four-chain HMC sampling of the reconstructed model. Vertical dashed lines: point estimates from Tan et al. (2020) [7]; shaded bands: 90% credible intervals (5th to 95th percentile), consistent with the intervals reported in Table 6 and throughout this paper.

Figure 3. Distributions of the nine HOE basic event probability parameters from four-chain HMC sampling of the reconstructed model. Vertical dashed lines: point estimates from Tan et al. (2020) [7]; shaded bands: 90% credible intervals (5th to 95th percentile), consistent with the intervals reported in Table 6 and throughout this paper.

The fire ignition frequency distribution (Singapore-calibrated) converged to a mean of 7.25 × 10⁻⁶ fires/m²/year with a 90% interval of [6.11 × 10⁻⁶, 8.38 × 10⁻⁶], consistent with the post-2019 SCDF-derived ignition frequency series.

3.2. Surrogate Model Fidelity

Four candidate surrogate models were benchmarked under identical five-fold cross-validation on the pooled posterior evaluation dataset spanning all 112 building-design combinations, with the regression target in logarithmic space given the four-decade ERL range. XGBoost achieved cross-validated R² = 0.99992 (Pearson r = 1.000 in linear space; MAPE 1.3%), against R² = 0.99999 for LightGBM, 0.99998 for Random Forest, and 0.99998 for histogram gradient boosting; all four tree-ensemble surrogates exceed R² = 0.999 and are practically interchangeable on this dataset, with LightGBM marginally the most accurate. XGBoost was retained for the TreeSHAP attribution pipeline for continuity with the original analysis, a choice the comparison shows carries no material accuracy penalty (full comparison in Table 7). Edge-case behaviour was also re-examined: in the recalibrated model, the no-system configuration TD16 no longer exhibits elevated approximation error (1.3% MAPE, versus 2.1% for the full-system TD01), because HOE-driven uplift is zero by construction when no active systems are present, leaving a response surface that is flat in the HOE features and therefore easy to approximate; the elevated TD16 error reported in the original submission was an artefact of the earlier, uncorrected reconstruction. A distinction must be drawn for the reader between two different quantities: the surrogate fidelity statistics in this section certify only that the surrogate faithfully mimics the reconstructed model; they are not evidence that the reconstructed model reproduces the original published T-H-O-Risk results, which is assessed separately in Section 3.6.

Table 7. Surrogate model comparison (five-fold cross-validation, log-space target, pooled dataset over all 112 building-design combinations).

Surrogate	R2 (5-Fold CV)	Pearson r (Linear)	MAPE %	MAPE % (TD16)
XGBoost (retained)	0.9999	0.9999	1.29	1.30
LightGBM	1.0000	1.0000	0.39	0.30
Random Forest	1.0000	1.0000	0.53	0.00
Histogram gradient boosting	1.0000	1.0000	0.68	0.77

3.3. Global SHAP Analysis

3.3.1. Feature Importance Ranking

The global SHAP analysis identifies maintenance-related HOE variables as the dominant contributors to ERL deviation, driven by their substantially higher basic event probabilities relative to compliance and training variables. The top three SHAP-ranked features are all maintenance category variables, collectively accounting for 89.8% of total HOE attribution (Figure 5). Training variables account for 6.7%, compliance variables 2.3%, and organisational variables 1.1%. Results are presented in Table 8.

The Spearman rank correlation between the SHAP ranking and the Tan et al. [8,9] Tornado-plot ranking is ρs = −0.867, reflecting a taxonomic divergence between basic event-level SHAP and intermediate node-level sensitivity analysis. For transparency, this coefficient was corrected during revision (an earlier value compared mismatched rank constructs); pairing the basic event-level SHAP ranking against the intermediate node-level Tornado ranking yields a genuinely inverse relationship, and −0.867 is the exact Spearman coefficient for the basic event-level SHAP ranking against the intermediate node-level Tornado ranking, and is fully reproducible from the two rank columns of Table 8. The correction is documented in the response to reviewers. This divergence is itself a substantive finding: SHAP indicates that while compliance and training failures are consequential in the conditional sense, maintenance deficiencies, by virtue of their substantially higher unconditional probabilities, generate greater absolute ERL attribution across the posterior distribution.

The beeswarm plot (Figure 4) shows that H8 and H9 attributions are tightly clustered across building-design combinations, confirming that the dominance of maintenance factors is consistent across all seven case study buildings and all sixteen trial designs. H3 (not following procedures) exhibits the widest distribution of SHAP values relative to its mean, indicating context-dependent contribution, large in buildings with complex operational requirements and small in simple configurations.

Figure 4. SHAP beeswarm summary plot computed on the XGBoost surrogate of the reconstructed model (log-scale ERL response). Each point represents one posterior sample of one building-design combination. X-axis: SHAP value (contribution to ERL); Y-axis: HOE feature ordered by mean |SHAP|; colour: feature value (red = high, blue = low).

Figure 4. SHAP beeswarm summary plot computed on the XGBoost surrogate of the reconstructed model (log-scale ERL response). Each point represents one posterior sample of one building-design combination. X-axis: SHAP value (contribution to ERL); Y-axis: HOE feature ordered by mean |SHAP|; colour: feature value (red = high, blue = low).

Figure 5. Mean absolute SHAP value bar chart—global HOE feature importance ranking, coloured by category (green = maintenance, blue = training, orange = compliance, grey = organisational).

Figure 5. Mean absolute SHAP value bar chart—global HOE feature importance ranking, coloured by category (green = maintenance, blue = training, orange = compliance, grey = organisational).

Table 8. Global SHAP feature importance ranking, mean absolute SHAP values. The comparison column reports the variance-based sensitivity ranks of Tan et al. [8,9], which were computed at the intermediate node level; the two rankings therefore compare attribution constructs at different levels of the network, and their divergence is interpreted in Section 4.1 rather than read as direct disagreement. Category shares are computed on unrounded Shapley values; the printed three-significant-figure means do not reproduce them exactly.

Rank	HOE Feature	Mean |SHAP|	Category	Tan et al. [8,9] Sensitivity Rank
1	H9—Inadequate periodic inspection	1.94 × 10−5	Maintenance	9
2	H8—Insufficient safety check	1.93 × 10−5	Maintenance	8
3	H7—Insufficient technical handover	7.37 × 10−6	Maintenance	7
4	H5—Deficient knowledge	1.46 × 10−6	Training	5
5	H2—Deficient training	1.15 × 10−6	Training	2
6	H1—Poor safety supervision	8.14 × 10−7	Compliance	6
7	H6—Inexperience	8.02 × 10−7	Training	4
8	H4—Deficient risk assessment	5.85 × 10−7	Organisational	3
9	H3—Not following procedures	3.74 × 10−7	Compliance	1

Table 8. Global SHAP feature importance ranking, mean absolute SHAP values. The comparison column reports the variance-based sensitivity ranks of Tan et al. [8,9], which were computed at the intermediate node level; the two rankings therefore compare attribution constructs at different levels of the network, and their divergence is interpreted in Section 4.1 rather than read as direct disagreement. Category shares are computed on unrounded Shapley values; the printed three-significant-figure means do not reproduce them exactly.

Rank	HOE Feature	Mean |SHAP|	Category	Tan et al. [8,9] Sensitivity Rank
1	H9—Inadequate periodic inspection	1.94 × 10−5	Maintenance	9
2	H8—Insufficient safety check	1.93 × 10−5	Maintenance	8
3	H7—Insufficient technical handover	7.37 × 10−6	Maintenance	7
4	H5—Deficient knowledge	1.46 × 10−6	Training	5
5	H2—Deficient training	1.15 × 10−6	Training	2
6	H1—Poor safety supervision	8.14 × 10−7	Compliance	6
7	H6—Inexperience	8.02 × 10−7	Training	4
8	H4—Deficient risk assessment	5.85 × 10−7	Organisational	3
9	H3—Not following procedures	3.74 × 10−7	Compliance	1

3.3.2. SHAP Co-Attribution and Interaction Analysis

Two distinct analyses are reported, and the distinction matters methodologically. The first is a co-attribution analysis: pairwise Pearson correlations between HOE SHAP value columns (Figure 6a) measure the tendency of features to contribute jointly. The revision also corrects an interpretive artefact in the original version of this analysis: the previously reported near-perfect co-attribution between H8 and H9 reflected the shared dependence of all attributions on configuration magnitude when computed in absolute ERL units across building-design combinations. With the configuration scale removed (attributions computed on the dimensionless HOE uplift), the residual co-attribution between independently distributed HOE parameters is weak (r(H8, H9) = 0.05; r(H2, H5) = 0.10), and no significant negative (compensating) correlations are observed. True coupling is instead quantified by the second analysis, which computes exact SHAP interaction values on the tree surrogate (Figure 6b). The off-diagonal Shapley interaction terms are small relative to main effects (aggregate interaction-to-main-effect ratio 0.158), with the largest pairwise terms arising within the maintenance cluster (H8-H9, H7-H8, H7-H9) and mixed in sign. Between categories, the interactions are weak, so the category-level SHAP shares on which the attribution rests are effectively additive; the 0.158 aggregate interaction-to-main-effect ratio is concentrated within the maintenance cluster and accounts for the modest H8-H9 super-additivity. HOE variables therefore operate predominantly as compounding rather than substituting risk factors. The practical consequence is quantified directly on the reconstructed model in Table 9: halving H8 alone reduces posterior mean ERL for Case 2 TD01 by 3.4%, halving H8 and H9 jointly by 7.9% (slightly more than the sum of the single-variable reductions, reflecting the convexity of the multiplicative system-reliability structure: a joint reduction acts on a steeper portion of the response surface than either single reduction alone), and halving the full maintenance cluster (H7, H8, H9) by 9.8%, against 1.1% for the training cluster; combined maintenance cluster intervention is therefore substantially more effective than any single-variable intervention, and combination benefits accumulate at least linearly. Because the reconstruction applies the same relative HOE structure to every configuration, the percentage reductions in Table 9 are identical across buildings by construction (computed on unrounded ERL; the rounded ERL column will not reproduce them exactly) and only the absolute ERL scale differs by building; the case-level validation of Section 3.6 therefore tests absolute scale and ranking, not building-specific relative HOE behaviour, which this reconstruction does not claim to resolve.

Figure 6. (a) SHAP co-attribution correlation heatmap (9 × 9 Pearson r between SHAP value columns), measuring joint contribution tendency. (b) Mean absolute SHAP interaction values (Shapley interaction index, off-diagonal terms) computed exactly on the tree surrogate. The two panels answer different questions and are labelled accordingly.

Figure 6. (a) SHAP co-attribution correlation heatmap (9 × 9 Pearson r between SHAP value columns), measuring joint contribution tendency. (b) Mean absolute SHAP interaction values (Shapley interaction index, off-diagonal terms) computed exactly on the tree surrogate. The two panels answer different questions and are labelled accordingly.

Table 9. Modelled risk reduction from intervention combinations (posterior mean ERL on the reconstructed model; reduction relative to the corresponding baseline).

Configuration	Intervention Scenario	Posterior Mean ERL (Deaths/Year)	Reduction %
Case 2, TD01	H8 halved	4.12 × 10−6	3.4
Case 2, TD01	H9 halved	4.12 × 10−6	3.5
Case 2, TD01	H8 + H9 halved	3.92 × 10−6	7.9
Case 2, TD01	maintenance cluster halved (H7, H8, H9)	3.84 × 10−6	9.8
Case 2, TD01	training cluster halved (H2, H5, H6)	4.22 × 10−6	1.1
Case 2, TD01	all HOE halved	3.79 × 10−6	11.1
Case 2, TD04	H8 halved	4.88 × 10−5	2.1
Case 2, TD04	H9 halved	4.88 × 10−5	2.2
Case 2, TD04	H8 + H9 halved	4.73 × 10−5	5.1
Case 2, TD04	maintenance cluster halved (H7, H8, H9)	4.67 × 10−5	6.4
Case 2, TD04	training cluster halved (H2, H5, H6)	4.95 × 10−5	0.7
Case 2, TD04	all HOE halved	4.62 × 10−5	7.3
Case 7, TD01	H8 halved	6.39 × 10−5	3.4
Case 7, TD01	H9 halved	6.38 × 10−5	3.5
Case 7, TD01	H8 + H9 halved	6.09 × 10−5	7.9
Case 7, TD01	maintenance cluster halved (H7, H8, H9)	5.96 × 10−5	9.8
Case 7, TD01	training cluster halved (H2, H5, H6)	6.54 × 10−5	1.1
Case 7, TD01	all HOE halved	5.88 × 10−5	11.1

Table 9. Modelled risk reduction from intervention combinations (posterior mean ERL on the reconstructed model; reduction relative to the corresponding baseline).

Configuration	Intervention Scenario	Posterior Mean ERL (Deaths/Year)	Reduction %
Case 2, TD01	H8 halved	4.12 × 10−6	3.4
Case 2, TD01	H9 halved	4.12 × 10−6	3.5
Case 2, TD01	H8 + H9 halved	3.92 × 10−6	7.9
Case 2, TD01	maintenance cluster halved (H7, H8, H9)	3.84 × 10−6	9.8
Case 2, TD01	training cluster halved (H2, H5, H6)	4.22 × 10−6	1.1
Case 2, TD01	all HOE halved	3.79 × 10−6	11.1
Case 2, TD04	H8 halved	4.88 × 10−5	2.1
Case 2, TD04	H9 halved	4.88 × 10−5	2.2
Case 2, TD04	H8 + H9 halved	4.73 × 10−5	5.1
Case 2, TD04	maintenance cluster halved (H7, H8, H9)	4.67 × 10−5	6.4
Case 2, TD04	training cluster halved (H2, H5, H6)	4.95 × 10−5	0.7
Case 2, TD04	all HOE halved	4.62 × 10−5	7.3
Case 7, TD01	H8 halved	6.39 × 10−5	3.4
Case 7, TD01	H9 halved	6.38 × 10−5	3.5
Case 7, TD01	H8 + H9 halved	6.09 × 10−5	7.9
Case 7, TD01	maintenance cluster halved (H7, H8, H9)	5.96 × 10−5	9.8
Case 7, TD01	training cluster halved (H2, H5, H6)	6.54 × 10−5	1.1
Case 7, TD01	all HOE halved	5.88 × 10−5	11.1

3.4. Local SHAP Analysis—Singapore High-Rise Buildings

3.4.1. Case 2, Trial Design TD01 (Full Active Systems)

For Case 2, the 20-storey Singapore residential building with all four active fire safety systems installed, the posterior mean ERL under the full HOE condition is 4.26 × 10⁻⁶ deaths/year (90% interval [3.77 × 10⁻⁶, 4.7 × 10⁻⁶]), consistent with the published value of 4.04 × 10⁻⁶ [7]. The published no-HOE baseline ERL is 3.23 × 10⁻⁶ deaths/year, yielding a total HOE attribution of 1.03 × 10⁻⁶ deaths/year, a 32.0% elevation relative to the no-HOE baseline. All percentages in this section are defined against the published no-HOE baseline; the previous version of this manuscript mixed the SHAP expected-value reference with the no-HOE baseline, which produced internally inconsistent figures, and this has been corrected throughout. Results are presented in Figure 7 and Table 10.

Figure 7. Local SHAP grouped bar chart for Singapore Case 2, TD01 (full active systems). HOE contributions grouped by category with 90% posterior credible interval error bars.

Table 10. Local SHAP attribution for Case 2, TD01—Singapore.

Rank	HOE Feature	Category	SHAP Value (Deaths/yr)	% of Total HOE
1	H9—Inadequate periodic inspection	Maintenance	3.98 × 10−7	38.6
2	H8—Insufficient safety check	Maintenance	3.81 × 10−7	36.9
3	H7—Insufficient technical handover	Maintenance	1.43 × 10−7	13.9
4	H5—Deficient knowledge	Training	3.11 × 10−8	3.0
5	H2—Deficient training	Training	2.4 × 10−8	2.3
6	H1—Poor safety supervision	Compliance	1.75 × 10−8	1.7
7	H6—Inexperience	Training	1.7 × 10−8	1.7
8	H4—Deficient risk assessment	Organisational	1.16 × 10−8	1.1
9	H3—Not following procedures	Compliance	8.01 × 10−9	0.8
	Total HOE attribution		1.03 × 10−6	100

Table 10. Local SHAP attribution for Case 2, TD01—Singapore.

Rank	HOE Feature	Category	SHAP Value (Deaths/yr)	% of Total HOE
1	H9—Inadequate periodic inspection	Maintenance	3.98 × 10−7	38.6
2	H8—Insufficient safety check	Maintenance	3.81 × 10−7	36.9
3	H7—Insufficient technical handover	Maintenance	1.43 × 10−7	13.9
4	H5—Deficient knowledge	Training	3.11 × 10−8	3.0
5	H2—Deficient training	Training	2.4 × 10−8	2.3
6	H1—Poor safety supervision	Compliance	1.75 × 10−8	1.7
7	H6—Inexperience	Training	1.7 × 10−8	1.7
8	H4—Deficient risk assessment	Organisational	1.16 × 10−8	1.1
9	H3—Not following procedures	Compliance	8.01 × 10−9	0.8
	Total HOE attribution		1.03 × 10−6	100

The maintenance cluster (H7 + H8 + H9) accounts for 89.4% of total HOE attribution in this local decomposition (Table 10; the corresponding global figure is 89.8%, Table 8). The plain-language regulatory interpretation is as follows: for this Singapore residential building with full active systems, over four-fifths of the HOE-driven risk elevation is attributable to deficiencies in inspection, safety checking, and technical handover, not to behavioural non-compliance. The most impactful single intervention is a structured third-party maintenance and inspection regime targeting sprinklers and fire alarm systems.

3.4.2. Case 2, Trial Design TD04 (Sprinkler and Detector Only—Waiver Scenario)

Under TD04, representing a waiver scenario in which BOWS and smoke control are absent, the posterior mean ERL with full HOEs rises to 4.98 × 10⁻⁵ deaths/year against the published TD04 no-HOE baseline of 4.12 × 10⁻⁵ deaths/year, with total HOE attribution of 8.6 × 10⁻⁶ deaths/year (21% relative to the TD04 no-HOE baseline). Relative to the full-system TD01 configuration, absolute HOE attribution is amplified by a factor of approximately 8.4 (Figure 8) while the proportional composition of the attribution is essentially unchanged (maintenance approximately 89.4%, the local TD01 comparator). HOE factors enter as multiplicative uplifts to the failure pathways of the systems present, so removing BOWS and smoke control amplifies absolute HOE contribution without changing its relative composition. From a regulatory standpoint, a SCDF waiver for BOWS or smoke control should be accompanied by strengthened maintenance regime conditions, since the absolute maintenance risk exposure rises accordingly.

Figure 8. Local SHAP grouped bar chart for Singapore Case 2, TD04 (sprinkler and detector only; waiver scenario). Relative to Figure 7 (TD01, all four systems), the bars are amplified by a factor of approximately 8.4 in absolute terms while the ranking and category composition of the attribution remain unchanged; the comparison illustrates that waiving systems scales the existing maintenance exposure rather than creating new dominant pathways.

3.4.3. Regulatory Decision Narrative

As shown in Figure 9, total HOE SHAP attribution grows from 1.03 × 10⁻⁶ deaths/year (TD01, full systems) to 6.68 × 10⁻⁵ deaths/year for the highest-exposure configurations, an amplification of approximately 65× across the configuration space; for TD16 (no active systems), HOE attribution is zero by construction, because the modelled HOE pathways act through the reliability of installed active systems. The threshold annotations in Figure 9 require precise definition: the quantity plotted is ERL in deaths per year, and the annotated reference values are the individual-risk tolerability criteria summarised in BSI PD 7974-7, used here as contextual reference levels rather than as formal acceptance criteria for ERL; a formal societal risk comparison using F-N coordinates is presented in Section 3.6 [35]. Configurations without sprinklers (TD09 onward) carry HOE exposures one to two orders of magnitude above the full-system configuration, indicating that maintenance HOE exposure in unsprinklered buildings warrants regulatory scrutiny even in the absence of other active system deficiencies.

Figure 9. HOE risk amplification bar chart (log scale): total absolute HOE attribution per trial design TD01-TD16 for Case 2, computed on the reconstructed model. Attribution rises by up to approximately 65× as systems are removed and is zero for TD16 (no active systems) by construction. BSI PD 7974-7 individual-risk tolerability reference levels are annotated for context only; the formal societal risk comparison appears in Figure 12.

3.5. Temporal SHAP Analysis

In response to the limitation of the earlier single-multiplier formulation, the temporal model now assigns category-specific lifecycle evolution functions reconstructed from the system dynamics behaviour reported in Tan et al. [8,9]: maintenance-related HOE probabilities follow the organisational risk perception cycle with a reliability trough near year five and recovery peaking near year seven; training-related probabilities accumulate between refresher cycles; compliance-related probabilities drift slowly upward with operational familiarity; and organisational factors follow a slow build-then-stabilise pattern (functional forms and parameters in Supplementary Section S4). SHAP attributions computed at five lifecycle snapshots (Table 11; Figure 10) now show composition change over time: the maintenance share of total HOE attribution moves from 89.5% at year one to 89.4% at year five and 88.2% at year ten, with total attribution peaking at year 5. Maintenance remains the dominant category at every time point, but the lifecycle profile is no longer artefactually constant. The category shares are computed over all nine HOE features; Table 11 lists the top five for brevity, with the full set in the Supplementary Materials (Table S6).

Figure 10. Temporal SHAP evolution: HOE attribution at t = 1, 3, 5, 7, 10 years for Singapore Case 2, TD01. Lines show top five HOE features; shaded bands show 90% posterior credible intervals.

Table 11. Temporal SHAP attribution—mean |SHAP| by year for top HOE features, Case 2 TD01.

HOE	t = 1 yr	t = 3 yr	t = 5 yr	t = 7 yr	t = 10 yr
H8	3.92 × 10−7	4.16 × 10−7	4.34 × 10−7	3.83 × 10−7	3.93 × 10−7
H9	3.95 × 10−7	3.99 × 10−7	4.24 × 10−7	3.89 × 10−7	4.06 × 10−7
H7	1.46 × 10−7	1.56 × 10−7	1.58 × 10−7	1.44 × 10−7	1.43 × 10−7
H5	3.11 × 10−8	3.39 × 10−8	3.45 × 10−8	3.21 × 10−8	3.47 × 10−8
H2	2.46 × 10−8	2.67 × 10−8	2.63 × 10−8	2.54 × 10−8	2.75 × 10−8

Table 11. Temporal SHAP attribution—mean |SHAP| by year for top HOE features, Case 2 TD01.

HOE	t = 1 yr	t = 3 yr	t = 5 yr	t = 7 yr	t = 10 yr
H8	3.92 × 10−7	4.16 × 10−7	4.34 × 10−7	3.83 × 10−7	3.93 × 10−7
H9	3.95 × 10−7	3.99 × 10−7	4.24 × 10−7	3.89 × 10−7	4.06 × 10−7
H7	1.46 × 10−7	1.56 × 10−7	1.58 × 10−7	1.44 × 10−7	1.43 × 10−7
H5	3.11 × 10−8	3.39 × 10−8	3.45 × 10−8	3.21 × 10−8	3.47 × 10−8
H2	2.46 × 10−8	2.67 × 10−8	2.63 × 10−8	2.54 × 10−8	2.75 × 10−8

Total HOE attribution peaks at year 5, coinciding with the maintenance reliability trough of the organisational risk perception cycle. Maintenance factors remain the largest category at all time points while their share now varies across the lifecycle, indicating that maintenance dominance is a structural property of the configuration rather than an artefact of the temporal model. The operational implication is retained and sharpened: third-party inspection protocols should be implemented from commissioning, with elevated scrutiny in the window around the mid-lifecycle reliability trough rather than introduced reactively after it.

3.6. Validation

3.6.1. ERL Validation Against Published T-H-O-Risk Results

Two corrections made during revision materially affect this section, and both are stated openly. First, re-extraction of the published reference data directly from the original T-H-O-Risk result files identified transcription errors in the previously compiled reference values for Cases 3, 4, and 6 (the correct published with-HOE TD01 ERLs are 8.85 × 10⁻⁶, 1.92 × 10⁻⁵, and 8.68 × 10⁻⁶ deaths/year respectively); the apparent three-to-five-fold deviations reported in the originally submitted manuscript were partly artefacts of those reference errors and partly resolved by the tightened trial design-level calibration described in Section 2.3; the two contributions are inseparable retrospectively, and both corrections are stated here so the reader can weigh them. Second, the HOE uplift calibration was tightened at the trial design level (Section 2.3) while case-level variation was withheld from calibration. Against the corrected reference set, the posterior mean ERL reproduces the published results across all 112 building-design combinations with mean absolute percentage error 1.8% (median 1.5%) and 96% of published values falling within the 90% posterior interval. Pearson correlation exceeds 0.999 in both linear and logarithmic space, satisfying the r > 0.95 target of Section 2.8; however, because the no-HOE backbone is anchored to published values (Section 2.3), near-unity correlation is partly by construction. This anchoring means the informative test of the reconstruction is the HOE layer itself, so errors are also reported directly on the HOE increment (the with-HOE minus no-HOE difference): across the 105 combinations with at least one active system, the mean absolute percentage error on the increment is 13.7% (median 10.1%), with a maximum of 131% for Case 3 TD09, a near-zero-denominator outlier where the HOE increment is smallest in absolute terms; this outlier does not affect the maintenance dominance rank order, which is preserved in every case, and it is reported here rather than suppressed. Total ERL percentage errors are correspondingly diluted (MAPE 1.8%) because the increment constitutes roughly a fifth to a third of total ERL; both views are provided so the reader can judge the reconstruction at the layer that carries the paper’s claims. Reconstruction error is low and is not concentrated in any single building class: per-case MAPE (averaged over the sixteen trial designs) ranges from 1.3% (Case 1) to 2.4% (Case 7), with Case 2 at 2.1%, and the larger-footprint buildings (MAPE 1.8%) are no worse than the standard-footprint buildings (MAPE 1.8%). The largest single combination total ERL error is Case 2 TD01 (Singapore; 5.4%). Selected results are presented in Table 12 and the full per-combination residual set in Supplementary Table S5, with the calibration plot in Figure 11.

Table 12. Validation results—published ERL vs. MCMC posterior mean, TD01 with HOE.

Case	Location	Published ERL (HOE)	MCMC Posterior Mean	90% CI
#1	Australia	7.56 × 10−6	7.49 × 10−6	[6.61 × 10−6, 8.26 × 10−6]
#2	Singapore	4.04 × 10−6	4.26 × 10−6	[3.77 × 10−6, 4.7 × 10−6]
#3	Hong Kong	8.85 × 10−6	8.86 × 10−6	[7.82 × 10−6, 9.78 × 10−6]
#4	Australia	1.92 × 10−5	1.87 × 10−5	[1.65 × 10−5, 2.07 × 10−5]
#5	Generic	2.88 × 10−6	2.94 × 10−6	[2.59 × 10−6, 3.24 × 10−6]
#6	New Zealand	8.68 × 10−6	8.5 × 10−6	[7.5 × 10−6, 9.38 × 10−6]
#7	UK	6.86 × 10−5	6.61 × 10−5	[5.83 × 10−5, 7.29 × 10−5]

Figure 11. Validation against the corrected published reference set across 112 building-design combinations: (left) posterior mean ERL of the reconstructed model versus published T-H-O-Risk ERL (Tan et al., 2020 [7]), MAPE 1.8%; (right) calibration plot of predicted-to-published ratios. Outputs plotted are from the reconstructed Bayesian network evaluated over the propagated parameter distributions, not from the surrogate.

To make the calculation chain concrete and independently checkable, consider Case 2 (Singapore; 20 storeys, 505 m² per floor; Table 3) under trial design TD01 with all four active systems present. The Singapore-calibrated ignition frequency (point estimate 7.0 × 10⁻⁶ fires/m²/year, used here for legibility; the validated ERL uses the full posterior, mean 7.25 × 10⁻⁶, which gives about 13.7 years, confirming the approximation is immaterial) applied to the 10,100 m² total floor area gives an annual structural fire probability of about 7.1 × 10⁻² per building (Equation (4)), or one event every fourteen years. Propagating this through the reconstructed Bayesian network, with the technical (no-HOE) reliability backbone anchored to the published value, yields a no-HOE ERL of 3.23 × 10⁻⁶ deaths/year; this corresponds to an effective consequence factor of about 4.6 × 10⁻⁵ expected deaths per structural fire, set by the event tree branch probabilities and the ASET/RSET consequence model of Tan et al. [7]. Introducing the nine HOE basic events at their posterior means raises the posterior mean ERL to 4.26 × 10⁻⁶ deaths/year, a 32.0% elevation, against the independently published with-HOE value of 4.04 × 10⁻⁶ deaths/year (a 5.4% overshoot, which is conservative in that risk is not underestimated). Exact Shapley decomposition of the resulting 1.03 × 10⁻⁶ deaths/year HOE increment attributes 89.4% to the maintenance cluster (H7, H8, H9), of which H9 (inadequate periodic inspection) and H8 (insufficient safety check) alone account for 75.5%. For the 480 occupants of this building, the with-HOE ERL of 4.26 × 10⁻⁶ deaths/year is about one expected fire fatality per 235,000 building-years, or 0.04 deaths per year across a stock of ten thousand such buildings.

This is a fidelity check of the reconstruction against the published value to which its no-HOE backbone is anchored (Section 2.3), not an independent empirical verification; the latter requires the SCDF incident data described in Section 6.1. The genuine out-of-sample evidence in this paper is the case-level generalisation for Cases 3, 4, 6, and 7, whose case-level variation was deliberately withheld from calibration (Section 2.3) and whose residuals (per-case MAPE 1.3% to 2.4%) are therefore a test of generalisation rather than of fit. Case 2 TD01 is shown deliberately because it is the largest single combination residual in the validation set (5.4%), not the smallest.

Residual dispersion does not concentrate in any single building class; the cases with the highest published with-HOE to no-HOE uplift ratios (Cases 3, 4, 6, and 7) were withheld from case-level calibration so that their residuals test genuine generalisation, and these residuals remain within the low bounds reported above rather than being fitted away. The practical reading is that the reconstructed model preserves both the absolute scale and the relative risk ranking required for SHAP-guided intervention prioritisation, with case-level absolute errors bounded by the residuals reported above.

The F-N risk profiles for Cases 4 and 7, the two buildings with the highest absolute ERL estimates, are presented in Figure 12a,b. Three curves are shown per case: the original HOE condition, a SHAP-guided single intervention targeting H8, and a SHAP-guided combined intervention targeting H8 and H9. The combined intervention (a 7.9% reduction in posterior mean ERL; Table 9) measurably lowers the Case 7 societal risk profile toward the BSI PD 7974-7 broadly acceptable band in the low-consequence regime; the underlying F-N coordinates are tabulated in the Supplementary Materials (Table S7). This illustrates the practical regulatory utility of SHAP-ranked attribution for informing waiver conditions.

Figure 12. (a) F-N curves under TD01 (full active systems) for Cases 4 and 7, the two buildings whose societal risk profiles approach the BSI PD 7974-7 tolerability boundary. Three curves per case: original HOE condition, SHAP-guided single intervention (H8), SHAP-guided combined intervention (H8 + H9). (b) F-N curves for TD04 (sprinkler and detector only; waiver scenario)—Cases #1 to #7. No-HOE (solid; technical failure rates only), HOE (dotted; HOE basic events at their literature point estimates), and full-HOE (dashed; HOE probabilities at the upper bound of their time-varying lifecycle range) variants, following the variant definitions of Tan et al. [9]. Figure 12a,b are subpanels of a single figure and are cross-comparable: (a) shows the full-system configuration, (b) the TD04 waiver configuration.

3.6.2. Evaluation Metrics Summary

The XAI evaluation metric results are summarised in Table 13.

Table 13. XAI evaluation metric results.

Metric	Description	Result
Model Fidelity and Faithfulness	Surrogate R2 across building-design combinations	0.99992
Surrogate Pearson r	Surrogate predictions vs. BN ground truth	1.000
HOE Maintenance Attribution	% of global SHAP from maintenance category	89.8%
HOE Training Attribution	% of global SHAP from training category	6.7%
Peak risk year (temporal SHAP)	Year of maximum total HOE attribution	Year 5
MCMC R-hat (max)	Convergence diagnostic	1.000
MCMC Bulk ESS (min)	Effective sample size	5492
Validation Coverage	Published ERL within 90% posterior interval	96%

3.7. Prior Sensitivity Analysis

Because the HOE parameters carry no likelihood term (Section 2.5), the stability of the maintenance dominance finding under alternative plausible priors is a necessary robustness check rather than an optional one: H8 and H9 dominate partly through base probabilities roughly two orders of magnitude above the compliance variables. Six prior configurations were therefore propagated through the full attribution pipeline for Case 2 TD01: the baseline literature point estimates; maintenance probabilities halved; maintenance probabilities quartered; compliance and organisational probabilities increased tenfold; all nine probabilities equalised at 2.5 × 10⁻³; and a combined adverse case with maintenance probabilities reduced tenfold and compliance probabilities increased tenfold.

The maintenance category share of total HOE attribution under these six configurations is 82.7%, 81.1%, 73.6%, 59.2%, 34.2%, and 28.4% respectively (these shares are computed on the mean absolute SHAP normalisation of the prior sensitivity pipeline, so the baseline reads 82.7% rather than the exact Shapley headline of 89.8%; the analysis tracks the change across configurations, not the absolute level), with the top-ranked single feature remaining a maintenance variable (H8 or H9) in the first four configurations and shifting to H4 and H1 only under the equalised and combined adverse priors. The finding is therefore robust to substantial prior misspecification: maintenance dominance survives halving and quartering of the maintenance base probabilities and a tenfold compliance increase, and is overturned only when the literature-derived probability ordering is essentially erased. The decisive empirical test remains recalibration against Singapore incident records through the data-sharing pathway of Section 6.1, and the dependence of the headline finding on the literature-derived priors is restated in the limitations (Section 4.5).

4. Discussion

4.1. SHAP Indicates a Complementary Attribution Layer to Prior Sensitivity Analysis

The global SHAP feature importance ranking diverges substantially from the variance-based sensitivity analysis of Tan et al. [8,9], with Spearman rank correlation ρs = −0.867. Prior sensitivity analysis ranked compliance and training variables, ‘Not comply with instructions’, ‘Deficient training’, and ‘Inefficient emergency plan’, as the dominant HOE factors. The SHAP analysis ranks maintenance variables first, second, and third: H9, H8, and H7, accounting for 89.8% of total HOE attribution.

This divergence is not a methodological failure but a fundamental finding. The Tornado analysis of Tan et al. [8,9] measures conditional sensitivity: how much ERL changes per unit change in each HOE variable, evaluated at the intermediate node level. This naturally highlights compliance and training variables, which activate multiple downstream pathways in the BN’s Boolean CPT structure. SHAP, by contrast, measures absolute attribution at the basic event probability level: how much each HOE variable actually contributes to ERL across the full posterior distribution. At this level, H8 and H9 dominate because their unconditional probabilities (2.5 × 10⁻²) are two orders of magnitude higher than compliance variables such as H3 (1.7 × 10⁻⁴), generating substantially larger ERL increments in expectation even if their conditional influence per unit change is smaller.

The result is methodologically instructive because it contradicts the expectation that behavioural variables would dominate, an expectation consistent with the sensitivity rankings of Tan et al. [8,9] and the broader human factors literature. Sensitivity analysis and SHAP attribution are not interchangeable, and the choice of attribution framework can materially alter the regulatory guidance derived from the same underlying model. A risk management strategy targeting both the maintenance cluster for absolute risk reduction and the compliance/training cluster for high-leverage intervention at critical junctions would be more effective than a strategy derived from either analysis alone.

A worked numerical example clarifies when each analytical lens governs. Consider two hypothetical Singapore towers identical to Case 2 except for their operational profile. Building A operates with a rigorous compliance culture (H3 at its fifth posterior percentile) but an ageing maintenance regime (H8, H9 at their 95th percentiles); Building B reverses the profile. Propagating both profiles through the reconstructed model, Building A carries a posterior mean ERL approximately 9% above the Case 2 baseline, dominated by maintenance attribution. Building B, despite operating with compliance parameters at their worst plausible values, sits approximately 13% below baseline, because its excellent maintenance regime removes more risk than its poor compliance culture adds; yet conditional sensitivity analysis would flag Building B’s compliance exposure as its most sensitive parameter. The example quantifies the asymmetry directly: the maintenance state moves absolute risk by multiples of what the compliance state can move it, while compliance remains the higher-leverage parameter per unit of probability change. Sensitivity analysis therefore governs questions of the form ‘which parameter, if it shifted, would move this building’s risk fastest’, while SHAP attribution governs ‘which factors account for the risk this building actually carries’. The dispersion of H3 attributions visible in the beeswarm plot (Figure 4) follows the same logic: H3’s SHAP contribution is largest in configurations with many active systems, where procedural compliance gates multiple reliability pathways simultaneously, and smallest in sparse configurations where fewer pathways exist for procedural failure to degrade.

For SCDF, this is a harder message than ‘improve training’ but a considerably more actionable one. Inspection frequency, third-party certification of safety checks, and maintenance record completeness are directly observable, enforceable, and documentable as waiver conditions. We state the epistemic status of this guidance precisely: it is a model-informed regulatory hypothesis derived from a reconstructed probabilistic model with literature-based HOE parameters, not an empirical finding from observed intervention trials; its adoption should follow the staged route described in Section 6, beginning with retrospective benchmarking against SCDF inspection and incident records. Subject to that caveat, the analysis provides SCDF with a quantitative basis to strengthen maintenance-specific conditions in waiver grants, and provides building owners with a defensible priority: before investing in cultural programmes, ensure the inspection regime is rigorous and independently verified.

4.2. Maintenance Dominance and Regulatory Implications

The maintenance-dominant attribution profile, consistent across all seven case study buildings, all sixteen trial designs, and all five temporal time points, provides a quantitative basis for a risk-informed inspection regime. Figure 9 demonstrates that total HOE exposure grows by up to approximately 65× as active systems are removed, vanishing only in the no-system limit TD16 where no active system reliability remains for HOEs to degrade, while the maintenance-dominant attribution profile remains unchanged in relative terms. The operational guidance derivable is as follows: maintenance regime standards should be strengthened proportionally to the number of active fire protection systems absent from a building’s configuration, since each system removal amplifies the absolute maintenance HOE exposure without changing its relative dominance.

For the SCDF waiver process, this finding is directly actionable. A waiver application for a building seeking exemption from sprinkler installation should be accompanied by a maintenance regime commitment substantially more rigorous than the current standard, specifically targeting safety check frequency (H8) and inspection protocols (H9), rather than generic fire safety management enhancements. The current Fire Safety Act framework addresses active fire system maintenance as a compliance requirement on fixed annual or biennial cycles without differentiation by building age, active system configuration, or maintenance track record. The quantitative evidence presented here supports a shift toward risk-informed inspection scheduling.

To make this operational, Table 14 proposes graded supplementary waiver conditions anchored to the quantified HOE exposure amplification and the BSI PD 7974-7 tolerability bands. The grading logic is as follows: each active system removed from the full-system configuration multiplies absolute maintenance HOE exposure by the configuration-specific factor quantified in Figure 9, so compensatory maintenance conditions scale with the number and type of systems waived. Tier 1 (one non-sprinkler system waived; HOE exposure approximately 4× the full-system level, range 3.7 to 4.2× across configurations): annual third-party certification of all remaining active systems and maintenance records audit. Tier 2 (two non-sprinkler systems waived, the TD04-class scenario; exposure approximately 6× to 9×): six-monthly third-party inspection of sprinkler and detection systems, digital maintenance log with regulator access, and named accountable maintenance manager. Tier 3 (any sprinkler waiver; exposure one to two orders of magnitude above the full-system level): quarterly independent inspection, continuous monitoring of detection and alarm availability where practicable, and mandatory F-N demonstration that the resulting societal risk profile remains within the tolerable band of Figure 12. These tiers are proposed as a starting framework for regulatory consultation rather than as finalised code requirements; threshold refinement requires the SCDF data-sharing arrangement described in Section 6.

Table 14. Proposed graded supplementary maintenance conditions for SCDF waiver assessment, anchored to the quantified HOE exposure amplification (Figure 9) and BSI PD 7974-7 tolerability bands. The tiers are proposed as a starting framework for regulatory consultation, with thresholds to be calibrated against SCDF incident data (Section 6.1); the exposure multipliers are modelled exposure ratios, not validated risk ratios.

Tier	Waiver Scope	Modelled HOE Exposure vs. Full-System	Proposed Supplementary Conditions
1	One non-sprinkler active system	Approx. 4× (range 3.7–4.2×)	Annual third-party certification of remaining active systems; maintenance records audit
2	Two non-sprinkler active systems (TD04-class)	Approx. 6× to 9×	Six-monthly third-party inspection of sprinkler and detection systems; digital maintenance log with regulator access; named accountable maintenance manager
3	Any sprinkler waiver	One to two orders of magnitude	Quarterly independent inspection; continuous monitoring of detection and alarm availability where practicable; mandatory F-N demonstration within tolerable band (Figure 12)

4.3. The Temporal Dimension: Lifecycle Consistency

Temporal SHAP analysis under the category-specific lifecycle dynamics of Section 3.5 indicates that maintenance factors remain the dominant attribution category at every lifecycle time point studied, with their share varying between 88.2% and 89.5% and total attribution peaking at year five, coinciding with the maintenance reliability trough of the organisational risk perception cycle before recovery peaks near year seven. The earlier single-multiplier formulation, which produced an artefactually constant composition and an attribution peak at year three, has been replaced; the recomputed lifecycle profile now shows genuine, if modest, composition change while preserving maintenance dominance throughout. The residual gap to the richer system dynamics behaviour of Tan et al. [8,9] is that the present lifecycle functions are reconstructed from the published behaviour rather than fitted to longitudinal maintenance data, a limitation stated in Section 4.5.

The temporal analysis delivers a clear lifecycle message: maintenance HOE exposure is present and dominant from the first year of occupancy, and rises toward the mid-lifecycle reliability trough. Risk management strategies that defer systematic maintenance inspection until after year five miss the window of highest marginal risk reduction.

4.4. Regulatory Applications: Waiver Assessment and ALARP Demonstration

The local SHAP analysis for Singapore Case 2 under TD04 demonstrates that removing BOWS and smoke control does not introduce new HOE risk pathways; it amplifies the existing maintenance exposure. SCDF waiver conditions for these systems should therefore require measurably higher standards within the maintenance category already present in TD01, rather than new categories of HOE mitigation.

The F-N curve analysis for Case 7, the highest-risk building in the validation set, identifies a structured maintenance enhancement programme, third-party inspection of all active systems at six-monthly intervals, as the highest-priority candidate risk reduction intervention. We are careful not to overclaim what this analysis demonstrates: SHAP attribution identifies and ranks candidate interventions and quantifies their modelled risk reduction, which constitutes the risk-reduction-options component of an ALARP demonstration; a complete ALARP case additionally requires cost estimation, practicability assessment, and a gross disproportion argument, none of which are performed here. The contribution of this framework to ALARP practice is therefore the transparent, auditable identification and quantification of intervention options, which the qualified person can carry into the full ALARP assessment required by the relevant authority.

In practical terms, a qualified person or fire safety engineer applies the framework in five steps. First, the building’s active system configuration is matched to one of the sixteen trial designs, and the case most similar in height and footprint (Table 3) is selected as the reference. Second, the model returns the posterior mean ERL with its 90% credible interval, giving an uncertainty-aware risk figure rather than a single number. Third, the SHAP ranking identifies which HOE factors carry the building’s risk; in every validated configuration, these are the maintenance variables H8 (insufficient safety check) and H9 (inadequate periodic inspection). Fourth, the intervention table (Table 9, Section 3.3.2) quantifies the modelled ERL reduction from targeting those factors, which the engineer carries into the ALARP options appraisal. Fifth, for a waiver submission, the graded maintenance conditions (Section 4.2) and the F-N intervention curves (Figure 12) provide an auditable, quantitative basis for the compensatory measures proposed to the authority. The framework therefore converts an opaque risk number into a ranked, defensible action list, which is its primary practical value. The framework interpolates within the validated envelope (residential towers of 51 m to 107 m, footprints 324 m² to 1343 m²); buildings outside this envelope require the recalibration described in Section 6.3 before the outputs are relied upon. Figure 13 presents this five-step workflow, including the envelope check, as an algorithm.

Figure 13. Algorithm for the five-step practical application of the framework by a qualified person or fire safety engineer. Starting from a building’s active system configuration, height, and footprint, the workflow matches the nearest reference trial design (Step 1, Table 3), checks that the building lies within the validated envelope (51–107 m height, 324–1343 m² footprint; otherwise recalibrate per Section 6.3), quantifies risk as a posterior mean ERL with a 90% credible interval (Step 2), ranks the dominant HOE drivers by SHAP value (Step 3), appraises interventions against the modelled ERL reduction for the ALARP case (Step 4, Table 9), and assembles the auditable basis for a waiver submission (Step 5, Section 4.2 and Figure 12), converting an opaque risk number into a ranked, defensible action list. Section and table references correspond to the same steps described in the text.

4.5. Limitations

Five limitations bound the interpretation of these results, and each is tied to the specific findings it affects. First, HOE prior probabilities derive from nuclear, aviation, and process safety databases rather than Singapore fire incident records. This matters most for the maintenance dominance finding because H8 and H9 dominate partly through their higher base probabilities; the prior sensitivity analysis in Section 3.7 shows that the finding is robust until maintenance base probabilities are reduced by roughly an order of magnitude relative to the literature values, but empirical recalibration against SCDF fire investigation records remains the decisive test and requires the data-sharing arrangement proposed in Section 6. Second, the HOE distributions are propagated parameter uncertainty, not data-updated posteriors (Section 2.5); credible intervals therefore reflect assumed rather than empirically learned uncertainty widths. Third, the technical ERL backbone is anchored to published T-H-O-Risk outputs rather than re-derived from first principles, so the framework inherits any limitations of the original model’s event tree and consequence calculations; the anchoring choice is documented in Section 2.3 and the Supplementary Materials. Fourth, the category-specific lifecycle functions in Section 3.5 are reconstructed from the published system dynamics behaviour rather than fitted to longitudinal maintenance data, and should be read as structured illustration of composition change rather than calibrated temporal prediction. Fifth, the framework is calibrated and validated specifically for high-rise residential buildings spanning 51 m to 107 m (18 to 38 storeys), of both standard and large floor plate footprints and single-stair, extended travel distance, and deemed-to-satisfy configurations (Table 3); reconstruction error is low and is not concentrated in any building class (per-case MAPE 1.3% to 2.4%). The framework is not yet validated for mixed-use developments that combine residential with substantial commercial or industrial occupancies, whose HOE taxonomy and system configurations differ; extension to those typologies (Section 6.3) requires recalibration of the HOE priors and conditional probability structure rather than fundamental methodological change.

5. Main Conclusions

This paper presents an XAI-enabled probabilistic fire risk assessment framework for high-rise residential buildings, extending the validated T-H-O-Risk methodology with MCMC posterior uncertainty quantification and SHAP feature attribution. The following conclusions are drawn:

(I) SHAP indicates a maintenance-dominant HOE attribution profile that diverges from, yet enriches, prior sensitivity analysis.

Spearman rank correlation between SHAP and Tornado rankings is −0.867. Prior sensitivity analysis ranked compliance and training variables as dominant. The SHAP analysis, operating at the basic event probability level, identifies H8 (insufficient safety check) and H9 (inadequate periodic inspection), each with base failure probabilities of 2.50 × 10⁻², as jointly accounting for the majority of total HOE attribution (89.8% for the maintenance category). The precise share is a prior-dependent estimate; the prior sensitivity analysis (Section 3.7) shows that what is robust to prior misspecification is the rank order finding that maintenance is the largest single HOE category, and the graded waiver tiers are anchored to that rank order rather than to the precise multipliers. The primary indicated intervention to reduce HOE-attributable fire risk in Singapore’s high-rise residential stock is a mandatory, independently verified periodic inspection regime rather than training or safety culture programmes alone, presented as a model-informed regulatory hypothesis subject to the validation pathway described in Section 6.

(II) HOE attribution is configuration-dependent in magnitude but not in composition.

Removing active fire safety systems amplifies total HOE exposure by up to approximately 65-fold across the configuration space (HOE attribution vanishes only in the limiting no-system configuration, where no active system reliability remains for HOEs to degrade). This provides a principled basis for scaling maintenance-specific compensatory conditions in SCDF waiver assessments in proportion to the number and type of active systems absent, operationalised in the graded conditions of Table 14.

(III) Maintenance-related HOE attribution is dominant from year 1 of occupancy.

Under category-specific lifecycle dynamics, maintenance factors remain the dominant attribution category at every time point studied (t = 1, 3, 5, 7, 10 years), with their share varying between 88.2% and 89.5% and total HOE exposure peaking around year 5, coinciding with the organisational risk perception trough. Lifecycle-differentiated inspection regimes with elevated scrutiny around the mid-lifecycle trough are indicated.

(IV) MCMC-SHAP integration provides uncertainty quantification for XAI outputs.

Integration of MCMC uncertainty propagation (four chains, 8000 draws, R-hat = 1.000, bulk ESS at least 5492, zero-divergence sampling) with SHAP attribution produces credible intervals over feature attributions. This dual-layer uncertainty quantification, at the parameter level via MCMC and at the attribution level via posterior SHAP intervals, is an original methodological contribution with applicability beyond the fire safety domain.

(V) Framework is validated with documented limitations.

Validation against the corrected set of 112 published T-H-O-Risk building-design combinations yields a mean absolute percentage error of 1.8% with 96% interval coverage (correlation above 0.999, partly by construction given the anchored backbone). Reconstruction error is low and is not concentrated in any building class (per-case MAPE 1.3% to 2.4%; worst single combination 5.4%, Case 2 TD01), and is reported per case. For standard-footprint residential towers, the SHAP attribution outputs and F-N curve interventions are suitable for use by qualified persons and regulatory officers as decision-support inputs, subject to the limitations stated in Section 4.5; the framework is not presented as a substitute for the statutory judgement of the qualified person or the authority.

6. Future Directions

6.1. Extension to SCDF Waiver Outcome Prediction

The most immediate research extension is the application of XAI to SCDF waiver outcome data as a supervised classification problem. SCDF administers waiver applications under the Fire Safety Act across a substantial and growing caseload; the decisions embedded in that record, spanning building type, system configuration, waiver scope, and the supporting analysis characteristics that qualified persons present, constitute a structured dataset whose patterns have not been systematically examined in the published literature. Building and system configuration variables would serve as input features; waiver outcome (approved, conditionally approved, or rejected) would serve as the classification target. SHAP attribution on a trained classifier would indicate which submission characteristics most strongly predict approval probability, providing qualified persons with a principled basis for pre-submission assessment and offering SCDF a transparent aid for routine case review. The methodological precondition is access to a sufficiently large and consistently coded record of past decisions, which would require a formal data-sharing arrangement between the research team and the authority. Subject to that condition, this extension represents a tractable and practically significant application of the XAI framework developed here.

6.2. Integration with Physics-Informed Neural Networks

Physics-informed neural networks (PINNs) offer a complementary physics-grounded predictive layer to the probabilistic HOE attribution framework developed here. A hybrid architecture combining PINN outputs at the design fire level with Bayesian network HOE attribution at the system level and SHAP interpretability across both layers would approach a comprehensive fire risk intelligence system. PINNs provide interpretability through physical law; SHAP provides interpretability through feature attribution. Together they constitute a more complete explanatory framework than either alone.

6.3. Extension to Mixed-Use Typologies

Extension to mixed-use, commercial, and industrial high-rise typologies is necessary for broader regulatory applicability. Singapore’s significant stock of mixed-use integrated developments presents a particularly challenging fire safety engineering context in which HOE taxonomy, system configuration requirements, and regulatory approval pathways differ substantially from the purely residential case. The SHAP attribution framework is architecturally compatible with extended building typologies, requiring recalibration of HOE prior distributions and CPT structures rather than fundamental methodological change. Prospective validation applying the framework to new buildings not included in the original case study set, with comparison against actual incident outcomes over a multi-year follow-up period, would provide a substantially stronger evidentiary basis for regulatory adoption.