Uncertainty-Aware Robustness Analysis of Blended-Wing-Body Cabin Evacuation Under the Faa 90-Second Requirement (14 CFR § 25.803)

The available sources do not directly address 14 CFR §25.803 or provide a complete explanation of the 90-second evacuation requirement; accordingly, the certification logic here is inferred from evacuation risk research and simulation-based evidence. Evacuation compliance is not determined by cabin geometry alone: pre-evacuation delay, route-choice behavior, and environmental cues can dominate total time under strict thresholds [15,16]. BIM-enabled and simulation-centered approaches support traceable, design-linked evacuation evidence, but deterministic claims are fragile because evacuees often deviate from “nearest-exit” behavior [17,18]. Computational evacuation modeling is therefore used to estimate time distributions and diagnose bottlenecks even when regulatory text is not explicitly analyzed [19], motivating an uncertainty-aware assessment for BWB cabins.

Recent evacuation modeling increasingly prioritizes agent-based models (ABMs) because they take into account heterogeneous behavior, interpersonal interactions, congestion, and emergent group effects that materially shape evacuation outcomes [20,21]. The literature also trends toward microscopic and hybrid approaches, reflecting the limits of any single paradigm for realistic crowd behavior [21]. Within ABMs, social force extensions model leader- and group-centered motion [22], while extended floor-field cellular automata improve realism for group evacuation dynamics [23]; complementary information-theoretic methods can detect emergent leadership/coordination patterns [24]. Although network/queuing and continuum models appear less developed in the current corpus, routing/optimization is promising but constrained by behavioral complexity, motivating decision-grade pipelines that integrate human factors with optimization [25,26].

The literature emphasizes that evacuation analysis must treat uncertainty explicitly because outcomes vary with (i) parameter uncertainty (e.g., reaction time, walking speed, compliance), (ii) input variability (e.g., population composition, group behavior), and (iii) scenario uncertainty (e.g., exit availability, visibility conditions) [27]. Ignoring these sources can make deterministic simulations overconfident and misleading for safety decisions [28]. Monte Carlo simulation is widely used to propagate uncertainty through evacuation models, and methodological reviews confirm its common role in safety-oriented uncertainty handling [29]. To identify what most drives compliance risk, studies recommend sensitivity analysis, especially variance-based approaches such as Sobol indices and screening methods such as Morris, which isolate dominant contributors to variability and failure probability [30]. However, practical application is limited by scarce behavioral calibration data, coordination burdens, and weak translation of uncertainty outputs into decisions [31]. These constraints motivate a robustness framing that reports tail performance and probability of compliance, not only mean evacuation time.

Evidence for direct BWB evacuation remains limited, but the literature shows that wide, complex interiors generate nonlinear congestion and behavior-driven inefficiencies that invalidate geometry-only inference. Spatial configuration governs congestion formation and exit utilization, so evacuation time cannot be deduced from layout alone [32]. Grouping and social effects further increase variability: group dynamics can raise evacuation times (~15–22%) and detour distances (~17–25%) in some conditions [33], while social influence can reduce signage detection and distort route choice away from “optimal” predictions [34]. Broader pedestrian findings likewise show speed and routing vary with demographic/contextual factors and interactions [35]. Critically, evacuees often do not choose the nearest exit or follow intended paths, motivating the use of probabilistic models of exit choice and premovement behavior [18]. For BWB cabins – where spanwise exit spacing, cross-aisles, and compartment-like zones are pronounced – these effects reinforce the need for behavior-sensitive, uncertainty-aware certification evidence.

The literature supports three pillars for certification-style BWB evacuation research. (1) Outcomes are behavior-dominated: pre-evacuation delay, group effects, and non-nearest-exit choices repeatedly shape total evacuation time [16,18,34]. (2) Microscopic/agent-based models dominate because they capture interaction and congestion realistically, yet integration with optimization and certification-ready evidence pipelines remains limited [20,23,26]. (3) Uncertainty quantification is increasingly necessary to avoid overconfident deterministic claims and to support robustness using probability-of-compliance and tail-risk metrics [27–29]. The corpus also lacks explicit, source-grounded treatment of 14 CFR §25.803, motivating this study’s positioning as an uncertainty-aware robustness contribution that operationalizes compliance via PoC, emphasizes tail risk, and uses scenario stress testing to connect layout and behavioral uncertainty to certification-relevant conclusions.

This study frames BWB evacuation certification as a traceable, evidence-driven decision pathway that connects design choices and uncertainty sources to certification-relevant compliance outcomes (Figure 1). Inputs comprise both controllable cabin design variables – such as exit distribution, cross-aisle configuration, and zoning – and key uncertainty factors, including population mix, pre-evacuation delay, walking speed, exit-choice behavior, and scenario conditions (e.g., exit availability and visibility). These inputs shape evacuation dynamics, where interaction effects, congestion formation, and group/leadership behavior govern crowd flow and exit utilization. Evacuation dynamics are then translated into performance metrics, including evacuation time distributions, tail percentiles, congestion indices, and exit-balance/throughput measures. Metrics are aggregated across uncertainty realizations and stress scenarios to estimate compliance probability, defined as the likelihood of meeting the 90-second requirement under credible operating conditions. Finally, the compliance probability output supports robust design decisions by identifying layout and operational levers that sustain compliance margins despite variability, enabling iterative refinement of design assumptions and configurations as needed.

Fig. 1.

Certification-style conceptual framework for blended wing body (BWB) evacuation compliance under uncertainty.

This study adopted a computational–empirical (simulation-based) research design that is explicitly certification-aligned, scenario-driven, and uncertainty-aware, treating evacuation assessment as an evidence-generation problem rather than a single deterministic prediction. Model credibility is structured using a VVUQ-oriented logic (verification, validation, and uncertainty quantification) to make assumptions explicit, assess numerical reliability, and quantify uncertainty in an auditable and decision-relevant manner [36]. Uncertainty is propagated through repeated simulation runs per scenario to estimate the evacuation-time distribution and tail behavior under a strict pass/fail criterion, enabling direct computation of certification-style probability of compliance PoC^=P(T≤90s)\widehat {PoC} = P(T \le 90s) alongside upper-tail metrics (e.g., T₉₅, T₉₉), consistent with best-practice guidance for safety-critical evacuation modeling [11].

A regulatory interpretation framework was used in this study. For a certificationstyle interpretation of 14 CFR §25.803, compliance is operationalized as T ≤ 90 s, where Tis measured from the start of the evacuation command (time zero) to the time the last occupant exits to the outside/clear area. “Exit unavailable” is modeled as a binary condition (available/unavailable) with zero discharge capacity when blocked. The “required exits” set corresponds to the baseline active exit set used in S0; stress scenarios implement exit unavailability by removing one exit per run (random single-exit loss, S1) or removing a fixed targeted exit (AFT-C blocked, S2), with the compound case (S7) applying the same targeted exit loss in combination with additional stressors. This framing ensures that scenario definitions, reported PoC values, and tail exceedances are traceable to a consistent compliance rule and a reproducible exit-availability model.

To prioritize which uncertain inputs most strongly drive non-compliance risk, the design incorporates global sensitivity analysis to identify dominant drivers and support defensible mitigation priorities and robust design choices [37]. Overall, the approach positions simulation outputs as a traceable basis for certification-style robustness arguments under uncertainty, consistent with credibility considerations emphasized in engineering decision-support modeling [38].

The unit of analysis is a single blended-wing-body (BWB) passenger-cabin configuration defined by its interior layout (exit set/placement, cross-aisles, zoning/compartment logic, and aisle geometry) evaluated under stated occupancy, loading, and operating assumptions. The scope targets transport-category cabin concepts assessed in a certification-style frame anchored to 14 CFR § 25.803, using a consistent compliance operationalization for traceable scenario comparisons: evacuation completion time. T is measured from the evacuation command (time zero) to the last occupant reaching the outside/clear area, with compliance defined as T ≤ 90 s and summarized as PoC^=P(T≤90s)\widehat {PoC} = P(T \le 90s) under uncertainty. Exit unavailability is binary (blocked exits have zero discharge): S0 defines the baseline active (“required”) exit set; exit-loss scenarios implement single-exit loss either randomly per run (S1) or as a fixed targeted loss (S2), with compound stress applying the same targeted loss alongside additional stressors (S7).

To remain design-relevant at the concept level, occupancy is set within a representative BWB range (~200–300 passengers) and the analysis tests loading skews, visibility/crew-effectiveness degradations, and exit availability within that envelope. The study does not claim certification demonstration; it provides auditable, uncertainty-aware outputs (PoC, tail risk, stress-response patterns) to support engineering trade studies and certification planning.

A hybrid continuum–agent framework models BWB evacuation as coupled wide-area redistribution and local bottleneck/queue dynamics, consistent with certification-style, scenario- and uncertainty-driven evidence. The cabin is decomposed into (i) macro regions where motion is approximated by density/velocity fields and (ii) micro regions (aisles, merges, exit interfaces) where discrete interactions dominate pass/fail outcomes, consistent with established hybrid evacuation practice.

Macro dynamics evolve by mass conservation: 2∂ρ∂t+∇·(ρv)=S(x,t){{\partial \rho } \over {\partial t}} + \nabla \cdot(\rho {\bf{v}}) = S({\bf{x}},t) where S(x,t) injects occupants into flow after pre-movement delay. A navigation potential encodes routing. Φ(penalizing degraded paths under stress), with 3v=u(ρ)−∇Φ‖∇Φ‖,u(ρ)=u0f(ρ){\rm{v}} = u(\rho ){{ - \nabla \Phi } \over {\nabla \Phi }},u(\rho ) = {u_0}f(\rho ) capturing congestion-driven speed reduction. Microdynamics uses agents with heterogeneous delays/speeds and stochastic exit-choice tendencies; motion is advanced by 4xi(t+Δt)=xi(t)+vi(t)Δt{{\rm{x}}_i}(t + \Delta t) = {{\rm{x}}_i}(t) + {{\rm{v}}_i}(t)\Delta t with v_i(t) shaped by desired motion and local interactions, consistent with evidence that bottlenecks and behavior dominate cabin-like evacuations. Continuum–agent coupling is flux-consistent: macro outflow is converted to agents and agent outflow is deposited conservatively to preserve mass balance. Evacuation time uses a conservative stop rule (clock stops when the last occupant exits). Exit discharge is capacity-limited by C_e(persons/s); stress is modeled by reducing capacity or setting C_e = 0 for blocked exits. In the macro field, exit limits are imposed.5(ρv·n)≤Cewe(\rho {\rm{v}}\cdot{\rm{n}}) \le {{{C_e}} \over {{w_e}}} ensuring physically interpretable queueing at exits. Uncertainty is propagated via Monte Carlo sampling of behavioral/scenario inputs (Table 1), producing a distribution of evacuation times T^(k). Compliance is estimated as 6PoC^=1N∑k=1NI(T(k)≤90)\widehat {{\rm{PoC}}} = {1 \over N}\sum\nolimits_{k = 1}^N I \left( {{T^{(k)}} \le 90} \right) with robustness summarized using tail percentiles (e.g., T₉₅,T₉₉) to quantify both the likelihood and the severity of non-compliance under declared scenarios.

Scenario stress-testing is implemented as a structured, repeatable matrix (Table 2) that perturbs a small set of certification-relevant stressors while holding the model form and sampling protocol fixed (Sections 3.5–3.6). The objective is auditable, comparable evidence across scenarios – not ad hoc case selection. Each scenario is a named condition set (exit-availability state, visibility tier, initial passenger spatial distribution, and crew-effectiveness level) that can be re-instantiated deterministically for any Monte Carlo batch and sensitivity design. This design reflects established findings that evacuation performance is highly sensitive to exit availability and guidance effectiveness, particularly for BWB-like layouts where inaccessible exit sets can dominate outcomes [45], and it follows simulation-for-certification logic used to isolate parameter/topology effects under controlled assumptions [49,50].

Stressors were selected to map directly to mechanisms that shift both PoC^\widehat {{\rm{PoC}}} and tail risk: (i) exit loss reduces effective egress capacity and forces rerouting – known to inflate evacuation times under door/egress failures [41]; (ii) reduced visibility degrades movement efficiency and exit discovery/choice; (iii) skewed loading tests whether wide-floor geometry produces center-loading penalties versus edge-loading advantages; and (iv) reduced crew effectiveness probes the empirically supported role of guidance/compliance in improving flow organization at merges and exits [2,5]. Exit choice is treated as behavior-sensitive rather than nearest-exit optimal, with scenarios explicitly constructed to alter perceived utility and herding tendencies [42].

This study adds a robust design module that converts evacuation simulations into layout guidance under uncertainty, moving beyond point estimates. It has two levels.

Level 1: Robustness screening (DOE + tail-risk diagnostics). A design-of-experiments sweep evaluates feasible cabin/egress layouts across stress-test scenarios, PoC^\widehat {{\rm{PoC}}}, and tail metrics (e.g., T₉₅, T₉₉) to capture high-consequence outcomes. Global sensitivity analysis is used to identify dominant robustness levers (e.g., exit throughput, initiation delay, merge/topology constraints), yielding compact robust rules – layout changes that increase PoC^\widehat {{\rm{PoC}}} while reducing tail sensitivity to behavioral/environmental variability – consistent with reliability-based design where probability-of-success is the target [51,52].

Level 2: Robust optimization (simulation-driven, uncertainty-aware search). Layout selection is posed as a multi-objective robust problem over decision variables: x (e.g., aisle widths, cross-aisle connectivity, exit topology) under uncertainties θ (Table 1) and scenario s (Table 2): 9maxx∈X PoC(x),minx∈XT95(x)\mathop {\max }\limits_{x \in X} {\mathop{\rm PoC}\nolimits} (x),\;\mathop {\min }\limits_{x \in X} {T_{95}}(x) subject to feasibility constraints (exit-count, aisle limits, geometric validity): 10gj(x)≤0,=1,…,m,∈X.{g_j}(x) \le 0, = 1, \ldots ,m, \in X

Because Monte Carlo evaluation is expensive, surrogate models (e.g., Gaussian Process/Kriging) approximate objectives, 11PoC^(x),T^95(x)\widehat {{\mathop{\rm PoC}\nolimits} }(x),{{\hat T}_{95}}(x) and are iteratively refined via adaptive sampling, consistent with surrogate-assisted robust/reliability optimization workflows [51,52]. Quantile-aware surrogate strategies can further improve learning efficiency when tail behavior (T₉₅, T₉₉) is decision-critical [45].

This research is a simulation-only study and involves no human participants, interviews, or identifiable personal data; therefore, formal human-subject ethics approval is not required. Data governance focuses on ensuring that all model inputs and assumptions are transparent and auditable: the manuscript provides complete model documentation, distributional parameter tables (Table 1), and a fully specified scenario matrix (Table 2), including any stressor toggles and exit-availability rules. Reproducibility is supported by providing implementation-level artifacts – pseudocode for the hybrid continuum–agent coupling, definitions of all output metrics (PoC, T95, T99), and a logged random-seed strategy (master seed and replicate seeds) – so results can be reproduced exactly. Where permitted by the review policy, the study also includes a code appendix or a controlled-access repository protocol (e.g., private during peer review, with release upon acceptance) that contains the model configuration files, scenario definitions, and scripts required to rerun the full experiment set.

A single deterministic baseline run was used to establish a reference evacuation profile for the BWB cabin configuration with N = 225 occupants and k = 5 available exits. The cabin geometry, zoning, and exit identifiers (FWD-L, FWD-R, AFT-L, AFT-C, AFT-R) are shown in Figure 4, providing the spatial context for subsequent flow and congestion observations.

Fig. 4.

BWB cabin layout with geometric exit identification for the deterministic baseline (N = 225; Exits: FWD-L, FWD-R, AFT-L, AFT-C, AFT-R).

Under the deterministic reference assumptions, the baseline produces a stable evacuation completion time and an evenly distributed exit loading pattern, which together define the benchmark against which stressed and stochastic cases can be compared (Table 3). Exit use is balanced by construction in the baseline, yielding identical per-exit throughput totals and shares (Table 4). This balanced loading is reflected in the exit utilization curves in Figure 6, where cumulative evacuation trajectories are effectively parallel/overlapping across exits, indicating no preferential exit dominance in the reference configuration.

Table 3.

Metric	Symbol	Baseline value
Total occupants	N	225
Available exits	k	5
Evacuated through each exit (final)	nj	45 for each of the 5 exits
Exit shares (final)	Si=njn{S_i} = {{{n_j}} \over n}	0.20 for each exit
Most-loaded exit share	maxSj	0.2
Exit balance index (CV across exits)	Cvexit	0.00 (perfectly balanced under equal split)
Total evacuation time (last occupant exits)	Tdet	t0+45μ seconds{t_0} + {{45} \over \mu }{\rm{ seconds}}
Mean overall discharge rate	q¯=NTdet\bar q = {N \over {{T_{det}}}}	225t0+45μ person /s( if t0=0=5μ){{225} \over {{t_0} + {{45} \over \mu }}}{\rm{ person }}/s\left( {{\rm{ if }}{t_0} = 0 = 5\mu } \right)

Congestion development in the baseline is localized and time-dependent. The density snapshots in Figure 5 show that crowding emerges first in the interior circulation structure (early snapshot), intensifies as converging streams accumulate in shared approach regions (mid snapshot), and then shifts toward exit-approach areas as the system clears (late snapshot). Collectively, these heatmaps identify the primary bottleneck mechanism in the deterministic reference as flow convergence at shared-aisle/cross-aisle interfaces and exit-approach zones, rather than persistent saturation at a single exit. These baseline patterns (balanced exit usage with transient interior hotspots) establish a deterministic “control” profile for interpreting bottleneck amplification and exit-loading imbalances in later scenarios (Tables 3–4; Figures 4–6).

Fig. 5.

Density heatmap snapshots over time for the deterministic baseline evacuation scenario (t = 10 s, 30 s, and 45 s; N = 225; k = 5).

Fig. 6.

Exit utilization over time for the deterministic baseline evacuation scenario (cumulative evacuated per exit; N = 225; k = 5).

Uncertainty propagation used repeated runs per scenario to estimate the evacuation-time distribution and certification-aligned compliance probability PoC^=P(T≤90s)\widehat {{\rm{PoC}}} = P(T \le 90{\rm{s}}), summarized with a 95% CI and upper-tail percentiles T₉₅ and T₉₉. Across S0–S7 (Table 2), baseline conditions maintain high compliance, whereas stressors that reduce effective egress capacity or increase initiation/flow delays shift the distribution to the right and thicken the tail (Table 6).

Baseline S0 achieves near-certain compliance (PoC ≈ 0.973) with tails below 90 s. By contrast, exit-loss and compound stress dominate failure risk: S1 (random single-exit blocked) and S2 (targeted blocked) yield very low PoC (≈0.015; ≈0.010), and S7 collapses to PoC ≈ 0.000 with T₉₅ – T₉₉ well beyond 90 s (Table 6; Figure 7a). Reduced visibility (S3) is also near-collapse (PoC ≈ 0.007; T₉₅ > 90 s), showing mobility penalties alone can drive non-compliance even without topology loss. In contrast, reduced crew effectiveness (S6) and edge-heavy loading (S5) retain partial compliance (PoC ≈ 0.088; ≈0.134) but inflate the upper tail, indicating sensitivity to initiation/flow efficiency and demand redistribution (Table 6; Figure 7a).

Fig. 7.

Probability-of-compliance and evacuation-time distributions under uncertainty: (a) PoC by scenario with 95% CI, (b) CDF of evacuation time by scenario with 90-s threshold, and (c) boxplots of evacuation time by scenario with 90-s threshold (R = 5000).

The CDFs (Figure 7b) show baseline mass well left of 90 s, while stress scenarios shift probability mass toward/above 90 s; boxplots (Figure 7c) confirm median shifts and increased spread under stress, consistent with risk being governed by both likelihood (PoC) and severity (tail percentiles).

Stress testing yields a clear certification-style risk ordering by PoC^\widehat {{\rm{PoC}}} and uppertail behavior. Baseline S0 remains near-certain compliant, with evacuation times concentrated well below 90 s, indicating a substantial buffer (Table 6).

Exit-loss and compound degradation dominate failure risk: S1 (random single-exit blocked), S2 (targeted blocked), and S7 (compound stress) shift the completion-time distribution rightward, with PoC collapsing and tail percentiles extending far beyond 90 s (Table 6; Figure 8a). Movement/coordination stressors are not uniformly “intermediate”: reduced visibility S3 is near-collapse (PoC ≈ 0.007; T₉₅ > 90s), while reduced crew effectiveness S6 and edge-heavy loading S5 retain partial compliance (PoC ≈ 0.088 and 0.134) but thicken the upper tail, reflecting sensitivity to initiation/flow efficiency and demand redistribution (Table 6; Figure 8a).

Fig. 8.

Stress scenario ranking and worst-case exit-block patterns for the probability-of-compliance analysis (R = 5000; threshold = 90 s).

Fixed single-exit block tests identify worst-case topology loss. Blocking the center aft exit (AFT-C) is most damaging, redistributing demand, increasing governing discharge time, and amplifying the upper tail; forward-exit blocks follow closely, consistent with upstream flow concentration in the corridor/aisle geometry (Table 7; Figure 8b).

A global screening sensitivity analysis was performed using Morris elementary effects to identify which uncertain inputs most strongly influence (i) Probability-of-Compliance. P^(T≤90s)\hat P(T \le 90{\rm{s}}) and (ii) the upper-tail performance T₉₅. Results indicate that effective exit-discharge capacity is the dominant driver of both compliance risk and tail risk escalation. Specifically, the global exit-capacity scaling (μ_scale) exhibits the largest Morris μ^* for PoC and T₉₅, meaning modest degradations in service rate produce disproportionate increases in tail times and noncompliance probability (Table 8; Figure 9).

Among structural and behavioral terms, the AFT-C capacity advantage (aftc bonus) and exit-choice concentration toward AFT-C (aftc bias) also contribute materially, consistent with the earlier “worst-case” exit-loss result that removing a high-capacity/high-demand exit inflates tail risk. Pre-movement delay (t0_mode) is a secondary but still meaningful driver, primarily affecting PoC by shifting the entire completion-time distribution to the right rather than changing discharge dynamics. Finally, the exit-choice variability parameter (gamma shape) and the blocked-exit probability (p block) contribute to tail behavior by increasing imbalance and occasionally severe redistribution, thereby amplifying rare long evacuations even when the median remains comparatively stable (Table 8; Figure 9).

Fig. 9.

Tornado-style Morris sensitivity plot for PoC and T₉₅.

Robust-design screening reveals a Pareto trade-off between certification-aligned compliance probability PoC^=P(T≤90s)\widehat {{\rm{PoC}}} = P(T \le 90{\rm{s}}) and a structural-penalty proxy dominated by exit count k(with smaller add-ons for cross-aisles and wider aisles). Across layout families D1–D9, designs that increase effective discharge capacity and/or reduce exit-loading imbalance achieve higher PoC and improved tails (lower T₉₅, T₉₉) under uncertainty (Table 9). Notably, compliance gains are not strictly proportional to structural cost: several non-dominated options improve PoC via targeted flow-management features – especially cross-aisle redistribution and capacity-preserving geometry – without increasing k (Figure 10a–b).

Fig. 10.

Pareto trade-off between compliance probability and structural penalty proxy, with representative recommended layout families (R = 5000; PoC = P(T ≤ 90 s)).

Three practical design rules follow: (1) Avoid dominant-exit loading – zoning and routing that balance demand across exits increase PoC at the same k (Table 9; Figure 10). (2) Use cross-aisles as robustness amplifiers – they enable lateral redistribution when local aisles saturate, reducing the probability that a single exit governs the outcome (Table 9; Figure 10). (3) Treat aisle width as a capacity lever – wider aisles exhibit a threshold-like benefit by improving effective discharge/service, raising PoC without changing k; when adding exits is costly, capacity-preserving aisle/door-area geometry can recover compliance margin more efficiently than topology changes alone (Table 9).

The certification-style scorecard shows a sharp separation between nominal and stressed performance across S0–S7 when judged by compliance likelihood PoC = P(T ≤ 90 s) and tail severity (T95 – T₉₉) (Table 10; Figure 11). Baseline S0 is effectively assured (PoC ≈ 1.000, tight CI) with tails well below 90 s, indicating a robust buffer. The dominant robustness threats are capacity/topology disruptions: exit-loss (S1 random 1-exit blocked; S2 AFT-C blocked) and compound stress (S7) collapse to PoC ≈ 0.000 with T₉₅ – T₉₉ far beyond 90 s, consistent with structurally constrained discharge under the current topology/capacity envelope (Table 10; Figure 11). These cases require design-level mitigation (exit redundancy, cross-aisle redistribution, capacity-preserving aisle/door-area geometry), not parameter tuning.

Fig. 11.

Robustness scorecard: PoC by scenario with 95% CI and target PoC threshold (R = 5000; threshold = 90 s; target PoC = 0.95).

Operational/behavioral stressors are not uniformly “moderate” under the target PoC = 0.95: reduced visibility (S3) yields very low compliance (PoC ≈ 0.008; T₉₅ > 90 s), while reduced crew effectiveness (S6) and biased loading (S4–S5) retain partial PoC (≈0.040 – 0.135) but still fail due to inflated tails – i.e., residual risk is tail-driven by adverse combinations of pre-movement delay, exit service-rate variability, and routing imbalance (Table 10). Overall, compliance risk is governedjointly by likelihood (PoC vs 0.95) and severity (tail exceedances), so mitigation should prioritize removing structural bottlenecks before optimizing second-order factors, and robustness must be assessed against tail draws – not just typical conditions (Table 10).

In certification terms, results are a robust evidence statement, not a single evacuation time. Compliance is operationalized as PoC^=P(T≤90s)\widehat {{\rm{PoC}}} = P(T \le 90{\rm{s}}) under declared uncertainty and scenarios, with T₉₅ – T₉₉ as tail-risk indicators of exceedance frequency and severity. Baseline S0 shows assured compliance (PoC ≈ 1.0) with tails well below 90 s, indicating a clear margin. Under stress, that margin collapses: exit-capacity/topology disruptions (S1 random single-exit loss; S2 AFT-C loss) and compound stress (S7) drive PoC toward zero and push T₉₅ – T₉₉, far beyond 90 s (structural bottleneck limitation). Reduced visibility (S3) is also close to collapse, with T₉₅ > 90 s, showing mobility penalties alone can exceed the certification comfort zone even without topology loss. By contrast, reduced crew effectiveness (S6) and loading skews (S4–S5) retain partial PoC but fail certification-style compliance targets (e.g., PoC ≥ 0.95) because risk is tail-driven, not median-driven.

Design levers that recover margin act on the controlling mechanisms: increasing effective discharge capacity and reducing exit-demand imbalance (e.g., cross-aisle redistribution, capacity-preserving aisle/door-area geometry, and adding/redistributing exit capability). Accordingly, certification prioritization should first focus on removing structural bottlenecks and improving flow redistribution (lifting PoC, shrinking T₉₅ – T₉₉), then applying operational/behavioral controls (guidance/wayfinding, reduced pre-movement delay) to harden residual tail risk.

This study aligns with prior evacuation research in three ways: (1) the outcomes are behavior-dominated – pre-movement delay, non-nearest-exit choices, and social/interaction effects can govern total evacuation time under strict thresholds; (2) the modeling choice is consistent with the shift toward microscopic/agent-based and hybrid approaches to capture congestion, interactions, and emergent bottlenecks; and (3) the stressors reflect BWB-oriented findings that exit availability and crew/guidance effectiveness are high-impact drivers in wide, non-cylindrical layouts.

The key divergence is the claim format and evidence pipeline. Many studies emphasize mean or single-run evacuation time and implicitly treat uncertainty, which can yield “looks compliant” conclusions without quantifying how often compliance holds under credible variability. Here, compliance is operationalized as PoC^=P(T≤90s)\widehat {{\rm{PoC}}} = P(T \le 90{\rm{s}}) and paired with tail-risk metrics (T₉₅, T₉₉), making the certification question one of robustness under uncertainty and stress, not point performance. This reframing improves auditability (assumptions → scenario toggles → outputs) and links dominant uncertainty drivers to actionable design levers (exit topology, cross-aisle redistribution, capacity preservation).

Consequently, conclusions can change: a design that appears compliant under deterministic/mean-time assessment can be fragile under a PoC + tail lens, because rare-but-plausible tail draws can dominate pass/fail outcomes under a hard 90-s threshold.

Results indicate robustness is governed by structural bottlenecks rather than marginal gains in nominal walking speed. Under single-exit loss and compound stress, compliance probability collapses and T₉₅ – T₉₉ inflates, so the design priority should be on exit redundancy and demand rebalancing, not parameter “tuning.” Three manufacturer levers follow from this: (i) exit placement/spacing to avoid a dominant critical exit (fixed-block tests identify AFT-C as most damaging), (ii) cross-aisle/connector geometry to enable lateral redistribution when an exit is lost, and (iii) zoning/compartment logic that prevents upstream concentration and reduces merge conflict before discharge. Designs should therefore be iterated against PoC and tail exceedances under explicit exit-loss conditions, where fragility is most visible.

For regulators evaluating novel geometries, the present study implies an auditable model-evidence template: (1) a declared interpretation of the 90-s criterion and exit-availability mapping, (2) a scenario matrix including topology loss and compound stress, (3) uncertainty propagation reporting PoC + tail metrics (not only mean time), and (4) sensitivity/driver attribution showing what controls compliance outcomes – i.e., how often compliance holds, how severe exceedances are, and why failures occur.

For airlines, procedural guidance effectiveness is a practical risk-control knob – especially for tail behavior – because guidance compliance and pre-movement delay materially influence PoC and T₉₅ – T₉₉. Priorities are (i) assertive crew commands that redistribute demand to underutilized exits, (ii) briefing/wayfinding that reduces early hesitation/counterflow, and (iii) boarding/cabin practices that limit extreme loading imbalance when feasible. Airlines cannot eliminate exit loss, but they can reduce it by improving initiation and routing discipline when geometry is near capacity limits.

This study introduces a certification-style, uncertainty-aware evacuation evaluation pipeline that turns simulation outputs from point estimates into an auditable robustness argument. Compliance is quantified as PoC^=P(T≤90s)\widehat {{\rm{PoC}}} = P(T \le 90{\rm{s}}) and complemented by tail-risk metrics (T₉₅, T₉₉) to capture rare-but-plausible exceedances. A traceable scenario matrix (topology loss, visibility degradation, reduced crew effectiveness, loading skews, and compound stress) supports systematic “what fails and why” comparisons across stressors. Uncertainty propagation plus Morris global sensitivity screening links drivers to levers by separating factors that control compliance likelihood from those that drive extreme-delay behavior, enabling prioritized mitigation rather than ad hoc tuning.

The results identify bottleneck throughput and pre-movement delay as dominant drivers, mapping directly to actionable interventions (exit redundancy/redistribution; initiation and guidance controls) for early configuration trades. Generalizability extends beyond a single cabin drawing: the transferable contribution is not the evacuation time of Figure 4, but the robustness structure – including scenario-defined exit availability, uncertainty propagation, PoC/tail metrics, and driver attribution. Because the dominant failure modes are mechanism-level (discharge-capacity collapse, exit-demand imbalance, rerouting limitations), the conclusions remain informative for other BWB candidates with similar wide-cabin features (spanwise redistribution, cross-aisle connectivity, perimeter exits). While absolute PoC values will vary by geometry, the stressor risk ordering and the mechanism-to-mitigation mapping remain decision-relevant and can be reused for other non-cylindrical concepts by substituting the exit network, connectivity, zoning, and representative loading/behavior envelopes.

This study provides certification-style, uncertainty-aware evidence for evacuation robustness, but it does not replace a full-scale certification demonstration. No program-specific trial data are available for direct validation; therefore, results should be interpreted as comparative robustness evidence rather than proof of regulatory acceptance. A further limitation is that Figure 4 represents a reference concept geometry; alternative aisle/exit architectures may shift absolute PoC values, although the study’s primary contribution is the robustness pipeline and the identification of dominant mechanisms under uncertainty. Findings also depend on assumed uncertainty distributions for key behavioral and flow parameters (e.g., pre-movement delay, guidance compliance, exit service-rate variability); while bounded and evidence-tagged, different populations, procedures, or crew performance could change absolute PoC values even if mechanism rankings remain stable. Finally, several physical and operational complexities have been simplified: reduced visibility is represented via mobility penalties rather than time-evolving smoke/heat/toxicity fields, and crash-consequence effects are abstracted through scenario toggles (exit loss, aisle obstruction).

Future work should (i) couple the framework with smoke/visibility CFD to replace static penalties with dynamic fields, (ii) calibrate key parameters via human-in-the-loop or VR-based evacuation drills, and (iii) integrate evacuation robustness with structural/weight penalties in certification trade studies to quantify safety–performance design trade-offs.