The simulation completed. The solver printed its success string. Sixteen deterministic checks ran against the result and every one of them passed. A report was issued, quoting a governing available-safe-egress time of 38 to 42 seconds.
The building in that model was not a building. It was a sealed pressure vessel, and by forty seconds the corridor was at 0.6 bar.
The governing egress time — the number the entire report turns on — sat inside that excursion. Pressure exceeded a plausibility bound from t=9 s to t=44 s. Every tenability figure in the document was measured in a compartment that no building could be.
A crash would have been cheap. This is the expensive shape: confident, specific and wrong, with every other indicator green.
Why it sealed
The model declared sixteen leakage paths. Every one of them was internal — lobby to stair, corridor to lobby, door to door. Not one reached outside air.
That is not an obviously wrong thing to write. Each path individually is correct: those doors exist, those leakage areas are defensible under BS EN 12101-6, and a reviewer reading the schedule would find nothing to object to. The defect is in what is absent, and absence is the hardest thing to review.
Declaring leakage turns the model into a set of sealed pressure zones. If none of those zones can vent to ambient, a 12 MW fire has nowhere to push, and the solver does the only honest thing available to it: it reports the pressure the physics demands.
Nothing in the check register was looking at pressure at all. Sixteen checks examined geometry, mesh alignment, extract duty, glazing controls, design fire, timing — and not one of them asked whether the enclosure could breathe.
The first fix, which did not work
The obvious repair is to add leakage to outside air. We did, sized from façade area per storey, and re-ran the identical model with that one change.
FDS needs three things for a leak to exist: LEAK_AREA on the zone, a
&SURF carrying LEAK_PATH, and that surface applied to an
obstruction. Miss any one and it ignores the set entirely — no warning, no error, no
note in the output.
We had two of the three. The emitter had no door to hang an envelope leak on, because a façade is not an opening, so it skipped the path and wrote the reason into a deck comment. A comment is not a finding. Nothing read it.
The second failure was ours, and worse
Before re-running, we had written a reconciliation: something to compare what the model declared against what the deck actually contained. It examined the run and reported conforms.
It was checking the wrong artefact. It counted LEAK_AREA(0) entries on the
zones — which were present — and never tested whether the leak surfaces were applied to
anything. Worse, its verdict keyed on whether the model declared envelope paths, so
it could not fail on the deck side at all.
A check that cannot fail is not a check. It is a green light with a plausible name.
It now reads what FDS reads. A leak surface declared and applied to nothing is reported DEAD, by name, for internal paths as well as envelope ones.
What it took to actually fix
Three separate defects, each hidden behind the one in front of it:
- All leakage internal. The model sealed itself.
- Leak surfaces applied to nothing. The fix was declared and inert.
- Glazing failing only on temperature. Glass that can only break when hot cannot relieve a compartment that is over-pressurising fast — so the model held a differential its own windows would physically have gone under.
What we built, not what we patched
Fixing that building would have fixed one building. What generalises:
- A model rule that rejects any building whose leakage is all internal — and deliberately stays silent when there is no leakage at all, because that model forms no pressure zones and cannot seal. If the rule fired on both, the cheapest way to silence it would be to delete your leakage, which is the more dangerous configuration.
- A pressure check that reads the shape rather than the peak: when the model was above the bound, for how long, and whether it recovered.
- A reconciliation between declared and simulated, run at the one point where the model, the deck and the emitter metadata all exist together — and a blocker, not a caveat, when they disagree.
Within a day of existing, that reconciliation found an unrelated defect that had been live for months: every report's check register had been running on an empty metadata record, and saying so in a warning nobody read.
The part that should worry you
None of this was exotic. The model was well-formed. The solver behaved correctly throughout — it never lied, it reported exactly what the geometry implied. The report was internally consistent. A competent engineer reading it would have found nothing to query, because the number that was wrong looked exactly like the number that would have been right.
If you commission CFD, the question worth asking is not whether the consultant is good. It is what in their process would have caught this — and if the answer is "an experienced engineer would have spotted it", ask how, from a report that says 38 seconds.
The checks that matter block their own author's work
Every rule described here is in the product, every number came from a real run, and the pressure check that catches it would have stopped the report we issued. That is the only kind of check worth having.
Arrange a demonstration →