Insurance Criteria: Its history, relevance, and the Highly Protected Risk (HPR) engineering process

In this episode of "Risk! Engineers Talk Governance," due diligence engineers Richard Robinson and Gaye Francis discuss Insurance Criteria and its history and modern relevance, particularly focusing on the Highly Protected Risk (HPR) engineering process.

Richard shares his experience training with Factory Mutual in the US and explains how the HPR approach originated in the 1840s with Zacharia Allen, a cotton mill owner who re-engineered his facility to minimise fire risks. When his insurance company refused to offer discounts for these improvements, Allen created a mutual pool with other safety-conscious factory owners, establishing an engineering-based approach to insurance rather than a purely financial one.

The conversation explores key concepts like Normal Loss Expectancy versus Maximum Foreseeable Loss, highlights common design flaws in Australian Standards, and emphasises that engineers must think beyond merely following standards to truly understand what they're trying to protect. The episode concludes with takeaways about designing for specific needs rather than blindly applying Standards.

This conversation follows the R2A text Engineer Due Diligence (Concepts, Applications, Tools & Techniques) that can be purchased online at https://www.r2a.com.au/store/p/r2a-engineering-due-diligence-textbook.

For further information on Richard and Gaye’s consulting work with R2A, head to https://www.r2a.com.au.

Gaye is also founder of women’s safety workwear company Apto PPE if you’d like to check out the garments at https://www.aptoppe.com.au

Transcript

Megan (Producer) (00:00):

Welcome to Risk! Engineers Talk Governance. In this episode, due diligence engineers Richard Robinson and Gaye Francis discuss Insurance Criteria: its history, relevance today, and the highly protected risk process.

(00:18):

We hope you enjoy their chat. If you do, please give us a rating and subscribe on your favourite podcast platform. If you'd like more information on R2A's work or have any feedback or topic ideas, please head to the website www.r2a.com.au.

Gaye Francis (00:36):

Hi Richard, welcome to a podcast session.

Richard Robinson (00:38):

Hello Gaye. It's good to be back again.

Gaye Francis (00:40):

Back again. That's right. Today we're going to talk about one of the chapters in our larger book (text), the Engineering Due Diligence book, and we're going to talk about Chapter 5, Criteria and in particular 5.5, which is the Insurance Criteria and the history of it, which you're going to talk about in a moment, but also how it's relevant today. And we are particularly going to talk about the Highly Protected Risk engineering (HPR) process that's there. So over to you Richard. Give us a blast on the history.

Richard Robinson (01:14):

Right, Gaye, I wasn't too sure about that! Basically I'm just going to give a brief shot on what this HPR business is because I once upon a time trained with Factory Mutual a very long time ago in the US and actually I found it a bit more interesting than I was possibly anticipating because at that stage and being a fire engineer or anything like that was new and novel and nobody had a clue what it was. But from my point of view, basically derived from the Factory Mutual highly protected risk engineering approach. Now, the best way to actually explain it is just to explain how they started because once you understand the history of them, you get the drift. They are actually quite different to Lloyd's London, which took the wholly financial view of risk. Whereas Factory Mutual took the engineering view of risk and it basically started like this:

(01:57):

In the 1840s there was a bloke called Zacharia Allen and he owned a cotton mill. And yes, you can smile at me Gaye and that's nice. Anyway, when you rip the cotton seeds out of the cotton balls, you get a lot of friction, the highly combustible medium. So these things used to burst into flame. And the cotton gins are wooden, the factories are wooden, so what tended to happen was cotton mills burnt down a lot. And this fellow called Zacharia Allen didn't like this. So what he decided to do was to build a better cotton mill. And the way he did that is that he fire isolated the cotton gins from the rest of the structure. He actually gave his people equipment with which to put out fires and taught 'em how to do it, like a fire hose. And with massive wooden construction, you don't actually get a fire that burns the place to the ground. If you put the fire out, you just get a slightly charred timber and it works fine.

(02:46):

Having done all that, he then fronted up to his underwriter and said, look what a good thing I've done, give me a discount. And the underwriter said, buzz off the good pay for the bad, which is probably something you've heard in fairly recent times around the place. And so he said, if that's the way you feel about it, what I'm going to do is find other cotton mill owners or industrial owners who've re-engineered their facility to minimise losses and then we're going to pay what we're paying you, our existing underwriter into a mutual pool. And at the end of the insurance period, three, five years or whatever it is, we'll pay back to ourselves in profits what we didn't pay out on losses.

(03:23):

Now, as a concept, this is pretty simple, but it means you've got an engineered view of insurance, not a financial view of insurance. If you were The Lloyd's of London and which I have to say most of the Western world continues to sort of flow through a wholly financial view of insurance. It's just a matter of working out the odds. You can assure a burning building if you want to, as long as you've got the odds right. Whereas with Factory Mutual, they said: No, if you haven't engineered it properly in the first place, we won't insure you.

Gaye Francis (03:52):

They're very, very early days of safety in design.

Richard Robinson (03:54):

In effect. And that's the point. The Factory Mutual approach, it was always about control. It was never about levels of risk per se. That doesn't mean to say they didn't have reinsurance and all the other things that they do. Now, the other way they worked this out was because they still have an insurance view on life is that they then emphasised this business, the difference between, well, the way they defined it was normal loss expectancy, which is what the worst case loss should be if everything worked the way it's supposed to. In this day and age, that chiefly means automatic sprinkler protection. And then they defined the worst case, which is the maximum foreseeable loss, which was typically determined by blank firewalls or separation. And that would be the worst loss that could occur on site. So if you're a Factory Mutual engineer going to a site, you had to work out both these two things and obviously look at firewalls was the thing that could usually cause you the greatest grief.

(04:49):

Now in Australia, this is causing an awful lot of problems because we don't quite understand this. And from a financial law design viewpoint, it's pretty straightforward. I mean, if you've got a building that's worth a hundred dollars and it burns down once a year, well your annual loss expectancy is a hundred dollars per year. If you build a duplicate facility a hundred meters away and it can burn down without touching the other one, well that's $100 burning down once a year and that's $100 burning down once a year. That's $200 loss expectancy. But if you put the two buildings beside each other and don't have 'em separated, each one will take the other one down. When it burns down, you'll lose the lot twice a year, which means your lost expectancy is doubled.

Gaye Francis (05:30):

$400 potentially.

Richard Robinson (05:32):

And you can see why underwriters and people like that really want to work out what the maximum credible foreseeable loss is because that's what they really need to buy insurance and reinsure for. Now, as a design concept, this is pretty straightforward, but the trick is, and if you want to build the two facilities adjacent to each other, which from a cost point of view and land acquisition, all the rest of it becomes essential. You then have to put a firewall between them such that that firewall has the same effect as a hundred meter separation. And this depends what you're trying to protect. And Australian Standards and building codes don't really think this through very well for several reasons. First of all, they don't think about the load so much. They sort of go for a standard four hour firewall to something like that. Now standard four hour firewalls designed for a standard fire, whatever the hell that is, and there's a standard fire curve with a certain shape that you're meant to apply to a wall to see how it retains itself.

(06:24):

Not so relevant anymore because we don't do it much and we don't do much print anymore, but roll paper on end and when they print big rolls of paper or make rolls of paper, they just stack it up on top of each other on end. If one of those goes off, you can't put enough water on it to put it out. You cannot do it with sprinkler protection. You cannot do with fire hoses. You have to wait until it burns out. But that means your firewall has to be a 48 hour firewall, which you can design and build...

Gaye Francis (06:51):

But it's going to look very different to a four hour firewall.

Richard Robinson (06:54):

The other thing where Australians get it wrong because they tend to say that you can have a tired four hour firewall, which means you can have steel structures connected and a brick wall between it. Now this doesn't work too well. You've got to decide it so that when the site's burning down as the steel collapses, it turns into ropes and so it creates great tension. So you've got to design each side of the building to be able to resist that collapse forces on the building as it collapses, which is not an easy thing to do because you've got a dynamic fire on different loads and things like that. And the other thing which we get wrong is that way we design our automated sprinkler systems, we run the six and eight inch water pipes through the top of the wall. Now I can tell you the one piece of steel that's going to have its full strength is the one that's got cold flowing water running through it. That's one of the reasons why steel sprinkler pipe works well for sprinkler protection because once the sprinklers activated, that steel stays really cool and it retains its full strength. That means when your roof on one side collapses, it just brings the sprinkler pumping down and that rips the wall down. And the best part is that then takes out your sprinkler system on the other side of the wall.

Gaye Francis (07:59):

So you're saying all your controls go, your firewall, your sprinklers and everything.

Richard Robinson (08:03):

Correct. They sometimes wonder why Factory Mutual gives their insurance, reinsurance losses are pounding and the reason is because Australian Standards got it wrong and they didn't think it through. And then people keep designing to standards without actually thinking through functionally what it is that that firewall is trying to do. And it's meant to withstand burnout of whatever's on the other side of it. So if it's pig iron underwater, which is a Factory Mutual line, you still have automatic sprinkler protection with Factory Mutual even if you've got pig iron underwater, you still have automatic sprinkler protection provided, but that means the firewall possibly doesn't need to be as robust as some other occupancies that you might conceive.

Gaye Francis (08:46):

So it goes back to understanding what the issue of concern is.

Richard Robinson (08:50):

Correct. Now what's really strange about this is, I mean, Factory Mutual in Australia is based out of Melbourne, and that's the reason why the Risk Engineering Society, it started as a loss control section of the management branch of the Victoria Division of Engineers Australia. And it very nearly didn't join Engineers Australia. It was a very close vote. But that's the reason why it started in Victoria. What was interesting, one of my then business partners, Derek Viner coined the term risk engineering because he took it off the Factory Mutual kind of approach to highly protected risk engineering, and that idea just flashed around the planet in a way that the rest of us were slightly astonished, which was quite impressive.

(09:31):

But the other point I wanted to really make, which I think is sort of interesting from my point of view because I hadn't thought of it like this. One of the Factory Mutual's arguments in life is that you can't take somebody who's learned about Standards and then reteach them to become a Highly Protected Risk Engineer because they've acquired the bad habits. This is very much like the Catholic church. You've got to get 'em early, train 'em young, and then you'll keep them for life. Well, apparently you've got to take young graduate engineers, teach 'em the Factory Mutual approach and they'll keep it going for life. Which I suppose is my condition.

Gaye Francis (10:04):

That's probably right. And then I've been trained by you.

Richard Robinson (10:09):

That's one of the things because I had this fascinating conversation. Again, the Americans are very egalitarian, all this sort of stuff. You're at the research center in Norwood, Massachusetts, and they're running the courses. You get dragged there I think three times in the year that you're in America and you get trained there. And I was having lunch with one of the, just sitting there and one of the senior guys, I mean one of the very senior guys, one of the Vice Presidents of Factory Mutual turned up, and sat next to me and said: Who are you and why are you here? And I said, I'm an Australian having a good time. Thank you for asking. Because Australians, I was trying to explain to these Americans that we got a holiday for a horse race in Melbourne, they would not believe me. They actually would not believe me.

(10:54):

Anyway, I was talking to this fellow here and I said, look, all the stuff that you guys are teaching is great and it's really good stuff, but I said, you import people from all over the planet here. I mean, I was sharing flat with the span and then a Frenchman and the retention rate of we young engineers isn't high. This is a huge investment you people are putting into characters like us. And he said, yeah, that's right. That's what he said. And I said, why do you do it? He said, because you leave us and do good works and other places and Factory Mutual prospers.

Gaye Francis (11:29):

Right.

Richard Robinson (11:29):

I always thought, wow, the Americans always mystify me because they're so good in some places and other places, it just doesn't quite make sense. I told her that cartoon, they used to gave me the flip over the desk calendar and the generous sort of some Christian religious homily, and then you get to tax time and it says, next they're getting shot and missed, nothing's quite as satisfying as an income tax return. I thought only in America.

Gaye Francis (12:00):

I don't want to compare those two.

Richard Robinson (12:02):

I don't have a basis for comparison either. I do agree that tax returns are satisfying. But the point that what I was trying to say was that Factory Mutual was control focused and that's how they started and that's what they were trying to do, and they weren't relying on just the financial numbers, which the Lloyd's approach actually did.

Gaye Francis (12:21):

I think that's one of the key takeaways from this, but also that you can't just design to Standards.

Richard Robinson (12:29):

Correct.

Gaye Francis (12:30):

You actually have to...

Richard Robinson (12:31):

To think through what it is you're trying to achieve. And if you fail to do that nonsense arises and how much nonsense have we seen from Australians designing to Standards in recent times.

Gaye Francis (12:40):

And the Standards often don't apply or can't be applied to the actual situation that they find themselves?

Richard Robinson (12:50):

Well, just to, again, I don't want to bore people with Fire Standards and things like that, but in the US the Factory Mutual Sprinkler Standard is NFPA 13, which is the National Fire Code Sprinkler standard because it's an engineered standard. If they have a problem, something burnt down somewhere, they rack that material up, put it in their research lab and find out what sprinkler density actually is required. AS 2118, which is the Australian Sprinkler Standard, it might've changed a bit, but it started off from the Fire Officers Committee of the UK, i.e. the insurance committee, and it was a retrospective standard in the sense that if underwriters had a bad experience, they then increased the design density of the sprinklers.

Gaye Francis (13:30):

But it wasn't tested.

Richard Robinson (13:31):

It wasn't an Engineered Standard. It's just something that followed through. And that flows through to the way in which we design things. Remember how I said the firewalls and the sprinkler pipe takes it down? Well, again, it's got to do with scale, and the reason for this America just industrialised it. If Australia compared to America there for a while, we just are less than one state. We're little, right? We might be the 10th largest economy on the planet, but San Francisco and California, I think is the second largest economy out right now, isn't it?

Gaye Francis (14:06):

Not sure.

Richard Robinson (14:06):

Anyway, the point I make is that what they do is they put the water pipes around the outside of the plant so that even if the walls collapse, you can't lose your fire protection water. And it's just a different design process. But that depends on the size of your factory. If you're only building a small one, I'd stick to a Australian Standards. If I'm building a big one, I'd definitely go with North American Standards.

Gaye Francis (14:27):

Yeah, I think Standards might be a whole other podcast and the discussion that engineers have to have around Standards.

Richard Robinson (14:34):

Well, the funniest one though, and again, I was working at Factory Mutual at the time. I had a problem with the Fire Main, this was in Melbourne. They had a problem with the Fire Main and they were digging holes to try and find it and couldn't find it, and people were getting cranky and what's going on here. What had happened was the plant had been designed in Canada and had been installed in Melbourne. The pipe had been installed to be below the permafrost level. That's why it was so far underground.

Gaye Francis (15:05):

<laughs> Which it didn't need to be the case in Melbourne.

Richard Robinson (15:07):

It would've been lot simpler if it'd been a little bit closer to the surface.

Gaye Francis (15:10):

It does get cold, but not quite permafrost cold.

(15:14):

So a couple of takeaways. Look at what you're designing for. Have that understanding of maybe what's happened in the past doesn't necessarily represent what happens in the future. And be careful of Standards. But I think we might cover Standards in another podcast Richard.

Richard Robinson (15:32):

I'm sure that's going to be the case.

Gaye Francis (15:35):

<laughs> Well, thank you for joining us today and thanks for listening everyone. Bye.

Richard Robinson (15:39):

Bye.