Open any property loss control report and you will find three numbers that drive how an underwriter prices and structures the risk: NLE, PML, and MFL. They look similar, they are often confused, and the difference between them is the single most useful thing a facility manager, broker, or underwriter can understand about a survey. Each one answers the same question, how bad could a fire or explosion get at this location, under a different assumption about how much of the protection works. The size of each number, though, is set by the facility itself, the construction, the occupancy and its hazards, and the loss-limiting features that are built in or missing.
This is a plain explanation of what each estimate assumes, what actually sets the size of each number, how they rank, and how to read all three together.
Quick answer
- NLE (Normal Loss Expectancy) is the largest loss expected given the site as it is today, with all protection and management functioning as designed. It is usually the smallest of the three.
- PML (Probable Maximum Loss) is the loss expected when one key protective device is impaired or out of service. It usually sits in the middle.
- MFL (Maximum Foreseeable Loss) is the worst credible loss when active protection is assumed to fail and only passive barriers or space separation stop the fire. It is usually the largest of the three.
- The ranking is always NLE is less than or equal to PML is less than or equal to MFL. What separates them is one assumption about how much protection works. What sets the actual size of each is the facility, its construction, hazards, and the loss-limiting features it has or lacks.
What is NLE (Normal Loss Expectancy)?
NLE is the largest combined property damage and business interruption loss that can be expected given the facility as it exists today, with every protection and detection system and every management program operating as designed and up to its functional capability. Nothing is impaired in an NLE scenario. The sprinklers control the fire, the alarm transmits, the pump delivers its rated demand, and the response plan works.
The phrase that matters is as designed. NLE does not assume a perfect building, it assumes the actual building on a normal day, and credits only the loss-limiting features that are genuinely built into it. Its size is therefore set by the site conditions: construction, combustible loading, fire cutoffs between hazards, drainage and containment, special-hazard suppression, and automatic shutoffs all shape how far a fire gets before the as-designed protection stops it. Adequate sprinklers are one of those features, not the whole picture.
A concrete example. A facility can have fully adequate ceiling sprinklers and still carry a large NLE if a high-pressure hydraulic or ignitable-liquid system has no automatic shutoff interlocked to the sprinkler or detection system. An atomized spray fire from that kind of system cannot be extinguished by ceiling sprinklers, it keeps burning until the liquid flow is shut off. With nothing impaired and the sprinklers doing exactly what they were designed to do, the NLE is still large, because the design is missing the one feature that would limit that loss. That is the point of NLE: it measures the inherent loss-limiting design of the site, not merely whether a sprinkler system is present and working.
This is also why an underprotected site carries a high NLE with no impairment at all. If the protection cannot control the hazard it actually faces, the as-designed loss is already severe, and the NLE rises to meet the PML. NLE rewards a site that is well designed against its own hazards, and a credible inspection, testing, and maintenance program is what proves those features will perform, which is exactly why your testing records matter so much during a survey.
What is PML (Probable Maximum Loss)?
PML is the largest reasonable combined loss for a fire or explosion scenario in which a single protective device is inoperable. That device might be an impaired sprinkler system, a fire pump out for service, a closed control valve, a failed detection panel, or a process safety interlock. The engineer selects the one impairment that produces the largest credible loss, then estimates the damage that follows.
PML is the number that takes human reality into account. Systems get impaired. Valves get closed for maintenance and not reopened. A pump fails its annual test. PML asks a fair question: if one important thing is down when the fire starts, and everything else still works, how bad is it? Because only one layer is removed, the fire is contained by the remaining protection and by construction, so in a well-built, well-protected facility the PML is larger than NLE but well short of a total loss.
What the PML actually comes out to is set by the facility itself, not by a formula. Construction type, combustible loading, the size and separation of fire areas, water supply reliability, and how many single points of failure sit in the protection scheme all move the number. A site with no fire pump redundancy, an unsupervised or missing sectional control valve, or a single water supply has less margin, so removing one device produces a much larger loss. The same impairment that is a minor event in a robust building can be a near-total loss in a fragile one.
You may also see EML (Estimated Maximum Loss) in London-market and international reports. For practical purposes EML and PML describe the same idea, the loss with realistic but not catastrophic impairment.
What is MFL (Maximum Foreseeable Loss)?
MFL is the largest loss that could foreseeably occur if active protection is assumed to fail entirely and manual firefighting is delayed or absent. In an MFL scenario the sprinklers do not control the fire, the fire department does not arrive in time, and the combustible loading is at its peak. The fire burns until it reaches something that physically stops it, a fire wall built to stop it, adequate space separation between buildings, or the edge of the available fuel.
This is the catastrophe number. It is not the everyday expectation, it is the boundary of credible bad luck. Because nothing active is credited, the only things that limit an MFL are passive: fire-rated barriers and physical separation. This is why fire wall construction is treated so seriously. FM Global Data Sheet 1-42, Maximum Foreseeable Loss Limiting Factors, sets out construction requirements for an MFL fire wall whose job is to stop fire spread and confine the loss to the side where it started. Where a credible barrier or separation exists, the MFL drops to the values on one side of it. Where it does not, the MFL can approach the total value of the largest undivided area.
How the three estimates rank
The relationship never changes:
| Estimate | Protection assumption | Typical size | What limits the loss |
|---|---|---|---|
| NLE | All systems work as designed | Smallest | The site’s built-in loss-limiting features, all functioning |
| PML | One key device impaired | Middle | Remaining active protection plus construction |
| MFL | All active protection assumed to fail | Largest | Passive barriers and space separation only |
NLE is less than or equal to PML is less than or equal to MFL by definition. The three are not fixed distances apart, though. They are three points on a single scale, and how far apart they sit depends entirely on the facility. In a strong building they spread out, the NLE is small, the MFL is large, and the PML lands in between. In a weak one they compress upward: where protection is inadequate, the NLE rises to meet the PML, and where there is also no rated fire wall or space separation to stop a free-burning fire, the PML in turn rises toward the MFL. At the limit, a poorly protected, undivided building can carry an NLE, a PML, and an MFL that are all nearly the same large number.
A related figure you may see is the Maximum Amount Subject (MAS), sometimes called Maximum Possible Loss (MPL), which is simply the total value of property within the largest fire division. MAS is a value ceiling, not a loss scenario, and the MFL cannot exceed it.
Where business interruption fits
Business interruption (BI), also called time element, is not a fourth tier. It is a component that runs through all three estimates. Every loss scenario, NLE, PML, and MFL, has both a property damage piece and a BI piece, because a fire that destroys part of a building also stops the income that building produces. BI is driven by how long it takes to restore operations, and that restoration period grows with the size and complexity of the occupancy. A data center or a specialized manufacturing line can carry a far longer restoration period, and therefore a far larger BI loss, than a simple warehouse of equal square footage. This is why two buildings with identical property values can carry very different total losses.
How to read all three together
No single number tells the story. Read the magnitudes and the ranking together, because the same three conditions, the construction, the hazards, and the loss-limiting features, drive all of them at once.
A strong location shows a small NLE well below a large MFL, with the PML in between. The site has real loss-limiting features, so removing one device or even all active protection still leaves something to stop the fire. An underprotected or poorly subdivided location shows the opposite: a high NLE sitting close to the PML and the MFL, because there is little built in to limit the loss in any scenario. That is usually the most urgent profile a survey can surface, and it is not always a sprinkler problem. It can be a missing automatic shutoff on a fuel system, inadequate drainage, a single water supply, or no fire wall in a large undivided area.
So the numbers point straight to the fix. A high NLE says the everyday, fully-functioning loss is already severe, and the answer is a missing design feature, an interlocked shutoff, a cutoff wall, adequate sprinkler density for the hazard. A PML that jumps well above the NLE says the site leans heavily on one device, and the answer is redundancy or supervision. An MFL near the full building value says there is no passive barrier, and the answer is a rated fire wall or real space separation. For an underwriter, the three together shape capacity, pricing, and where to push for improvement. For an owner, they name the few changes that actually move the worst case in the right direction. For more on how survey findings turn into those recommendations, see our checklist on preparing for an HPR insurance survey and our breakdown of what changed in NFPA 13 for storage occupancies.
Frequently asked questions
Is PML the same as worst case? No. PML assumes one important protection system is impaired while the rest still works. The true worst case is the MFL, which assumes active protection fails and only passive barriers limit the loss.
Which number does an underwriter rely on most? It depends on the decision. PML often drives day-to-day pricing and retention because it reflects a realistic impairment, while MFL informs how much capacity to commit and where catastrophic exposure sits. NLE shows what good protection and maintenance are worth.
Why is my MFL almost as high as my building value? Because MFL credits no active protection. If your largest fire area has no rated fire wall or adequate space separation breaking it up, there is nothing in the MFL scenario to stop the fire short of the full value of that area. Adding a credible barrier is often the most effective way to reduce it.
Are these terms standardized across insurers? The concepts are consistent, but the labels vary. PML and EML are used interchangeably in different markets, and MAS and MPL both describe total values at risk. Always read the report’s definitions, since the assumptions behind each number matter more than the acronym.
If you want a second set of eyes on how loss estimates are developed for one of your locations, or on a report you have received, our team works these scenarios in the field every week. Get in touch.