ALARP in the energy transition (Part 3) – Bringing the principle to life

ALARP (as low as reasonably practicable) is a cornerstone of UK health and safety law, also adopted by many multinational organisations and other jurisdictions, particularly in high-hazard sectors such as energy and transport. It underpins effective risk management by requiring risks to be reduced to the lowest reasonably achievable level, balancing the benefits of risk reduction against the cost, time, and effort involved. Despite its importance, ALARP is often misunderstood – largely because applying it in real-world contexts can be complex and nuanced. The clearest way to understand ALARP is through real examples. This article presents four case studies that cover common decision-making scenarios.

This article concludes our three-part series exploring ALARP’s role in the energy transition.

Introduction

In part 1 of this series (Ref. 1), we introduced the concept of ALARP and explored its origins, principles, and regulatory expectations. In part 2 (Ref. 2) we looked at how ALARP can be effectively demonstrated, learning from high-hazard industries.

This final article brings the principle to life through four practical case studies, each illustrating:

• A scenario likely to arise during the lifecycle of an energy transition asset, farmed as a decision point.
• A specific example from the energy transition that brings the scenario to life.
• A summary of the key factors that shape the decision-making process.

Based on these case studies, we draw out conclusions to support the consistent and effective application of the ALARP principle.

SETTING THE SCENE

Before diving into the case studies, it is helpful to establish some context.

Process versus outcome

At its core, ALARP is about making informed, balanced decisions – whether to invest further in reducing risk to people, or to accept a level of risk because further risk reduction is not justified.

The case studies are based on real decisions from the design and operation of energy transition assets. They reinforce essential lessons in applying the ALARP principle.

However, a valid ALARP outcome depends on following a robust risk management process (described in Ref. 1 and 2). This includes:

• Identifying all reasonably foreseeable hazards and assessing their associated risks.
• Applying relevant good practice to control those risks.
• Identifying and evaluating additional risk reduction measures (RRMs) for risks falling within the “tolerable if ALARP” region of the tolerability of risk framework, prioritised using the hierarchy of risk controls.
• Implementing those RRMs unless it can be clearly shown that the cost, time, and trouble is grossly disproportionate to the risk reduction achieved.

The case studies focus on the outcome – the final decision on whether to implement specific measures. They assume that the foundational process has been properly followed. Crucially, the quality of that process is as important as the eventual outcome. A well-reasoned ALARP decision must emerge from a rigorous and transparent decision-making process.

Clarifying cost-benefit analysis

The term “cost-benefit analysis” (CBA) is used throughout and deserves clarification. While some situations may require a detailed, quantitative assessment of cost versus risk reduction, often expressed in monetary terms, this should never be the starting point, or used to justify a predetermined outcome.

CBA begins as a balanced, qualitative assessment of relevant factors: cost, time, safety, operational impact, reputation, and more. This holistic approach often provides sufficient clarity to determine whether a measure is reasonably practicable. If the burden of implementation is grossly disproportionate to the safety benefit, it may be set aside; otherwise, it should be adopted.

This maintains the true intent of ALARP: it is not a loophole to avoid action, but a structured way to ask, “What more can be done?” – and if nothing, “Why not?”.

CASE STUDY 1 – DESIGN DECISION: Should a higher safety standard be adopted when it significantly increases costs?

Scenario and decision

A design team developing an energy transition asset has demonstrated lifecycle risks to personnel as “tolerable if ALARP” (Ref. 2). The design follows established good practice.

However, the team has identified an alternative design approach that further reduces risks, but it involves significant cost and poses broader implications. Is it justified?

Example

The developer of a green hydrogen generation, storage, and distribution facility has agreed off-take contracts with several third-party users and is in negotiations with others. The different users require different supply pressures. Does the developer design all pipework systems to withstand the maximum required pressure, or design each leg to withstand the delivery pressure for each specific off-taker?

Decision factors

The developer must explore all the positive and negative implications of this decision.

Designing the entire system to withstand the maximum delivery pressure offers several benefits:

• It is inherently safer as it is higher up the hierarchy of risk controls, as described in Ref. 1.
• It eliminates the need for overpressure protection (e.g., pressure relief valves or high-pressure safety trips), reducing inspection, testing, and maintenance costs.
• It offers long-term flexibility for future off-takers or pressure increases, without costly pipework upgrades or added risk to personnel.

However, it also brings drawbacks:

• Increased capital costs due to higher-rated pipework and equipment.
• Some off-takers’ systems may not tolerate higher pressures, requiring robust pressure regulation within the facility – adding cost, complexity, and maintenance burden.

The developer must complete a detailed assessment of these positive and negative factors, with a focus on understanding which option presents the lowest risk solution. If the cost, time, and trouble associated with implementing the solution is grossly disproportionate to the net risk reduction benefit achieved, then there is no obligation to implement. Otherwise, they are obliged.

The principle of “gross disproportion” skews decision making in favour of reducing risk (Ref. 1).

Using “net” to define risk reduction is essential, as there is still an inherent risk of failure within the higher-rated pipework. A robust ALARP assessment must take a holistic view to evaluate the overall risk benefit, or otherwise.

Finally, a system must be ALARP as a whole – not just for one part or one user. This means involving all stakeholders to ensure risks are reduced ALARP for the entire system. In practice, this requires structured consultation with key stakeholders throughout the decision-making process, ensuring their knowledge and safety concerns are incorporated before finalising any risk reduction measures.

CASE STUDY 2 – GOOD PRACTICE DECISION: When must existing assets be retrofitted to meet new good practice?

Scenario and decision

An incident on an asset has led to a change in good practice. While such improvements should be adopted in similar, new assets – a key foundation for an ALARP justification – is the owner/operator of existing assets obligated to retrofit these changes? If so, under what circumstances?

Example

To manage fire risk in battery energy storage system (BESS) facilities, aerosol and gaseous fire suppression systems are commonly used as alternatives to water-based systems (which can leak and exacerbate battery fires). However, high-profile incidents have raised concerns about their effectiveness. While they may extinguish flames, they do not prevent thermal runaway (an uncontrolled chemical reaction where battery cells overheat and can propagate to neighbouring cells, forming a flammable and toxic vapour cloud). This shifts the hazard from fire to explosion, which poses a greater risk to people and is harder to mitigate.

As a result, there is a growing move to prohibit these systems in new BESS developments, with recognised good practice guidance expected to follow. But should they also be removed from existing facilities?

Decision factors

Removing aerosol and gaseous fire suppression systems from existing BESS facilities would have the following positive implications:

• If thermal runaway occurs, the absence of a suppression system reduces explosion risk. Ignited gases allow the battery to burn itself out. This is currently considered best practice, as battery fires are difficult to extinguish, and active firefighting may prolong the incident. In any case, affected battery racks would need replacement, regardless of suppression system use.
• Removing suppression systems also reduces reliance on less effective explosion mitigation measures like deflagration panels (weak points designed to burst open and release pressure when a deflagration occurs) or procedural controls. Some BESS designs now incorporate spark igniters to ensure immediate ignition of off-gases during thermal runaway, helping prevent delayed ignition and explosions. These can be installed alongside suppression system removal as an added safeguard.
• Emergency response personnel benefit from greater clarity and reduced hazard levels. Battery fires can be safely monitored and contained, provided the system is designed to prevent fire spread. In contrast, explosion risk requires more caution and poses greater danger to responders.
• A standardised suppression-free approach across all BESS facilities simplifies emergency response procedures and avoids site-specific variations in incident handling.

However, there will be negative implications too:

• If a small electrical fire occurred outside the battery cells (i.e., without triggering thermal runaway), there would be reduced protection to prevent escalation to a major fire.
• Insurers may refuse coverage for BESS without fire suppression systems, as current versions of recognised standards (e.g., NFPA 855) mandate their inclusion. Although future revisions may relax this, insurers typically adhere to published guidance. Additionally, some battery manufacturers may void warranties if suppression systems are removed retrospectively.
• Decommissioning suppression systems and modifying BESS safety logic will require capital expenditure, specialist intervention, and significant downtime resulting in loss of revenue for the owner/operator.

This example highlights a fundamental point in applying ALARP. The UK HSE’s stance is that businesses must bear the costs of compliance with legislation and good practice, including production stoppages, because maintaining safe operations is a legal obligation, not something to be offset by business losses.

Companies must absorb the cost of staying legally compliant, including design modifications arising from an enhanced understanding of hazards. Companies must keep abreast of the latest recognised good practice and revisit risk assessments, incorporating new lessons learned. If the current risk cannot be demonstrated to be ALARP, it is a legal obligation to implement changes.

Asset losses, such as condemning a battery to a fire, are not allowable deductions in a cost-benefit analysis. Similarly, the costs associated with downtime are commercial concerns. They cannot be included in the cost side of a safety-focused cost-benefit analysis because they do not pertain to reducing risk to people. Only safety-related costs that reduce risk are eligible for inclusion.

A hugely important consideration here will be the age of the BESS and the length of time over which the benefits will be realised. The shorter the remaining life, the more likely the negative impacts will outweigh the positive.

In part 1 of this series, we explained why ALARP is a gift. This scenario illustrates that well. The emergence of accepted good practice does not automatically require its retrospective application to existing assets. ALARP supports a balanced, case-by-case decision – recognising the need to manage risk while remaining sympathetic to legitimate business objectives.

CASE STUDY 3 – INNOVATION DECISION: Should new technology be adopted when it reduces risk but adds cost and brings new issues?

Scenario and decision

The owner/operator of an energy transition asset becomes aware of a technological advancement that could reduce risk to people. However, implementing it involves significant cost and broader implications. How should the owner/operator assess whether adopting this risk reduction measure is reasonably practicable?

Example

Wind turbine generators (WTGs) require regular inspection to ensure their continued integrity. Traditional inspections using rope access expose technicians to significant risks, notably working at height. The advent of drone technology enables remote inspections, eliminating the need for rope access. Should the wind farm owner/operator adopt this innovation to achieve the associated risk reduction?

Decision factors

Replacing rope access with drone inspections would have the following positive implications:

• Drone inspections significantly reduce risk by minimising the need for manual inspection, recognising some physical inspections may still be required to validate drone survey results.
• Rope access inspections are expensive and the use of drones will present a cost saving over the WTG’s remaining life.
• Drone surveys are faster, reducing WTG downtime and minimising generation losses, offering a further commercial benefit.
• Using drone technology to digitally capture the condition of WTG towers and blades creates opportunities to leverage artificial intelligence for deeper insights into asset health and performance. This can deliver broader commercial benefits, including optimised inspection planning and early detection of potential issues.

However, there will be negative implications too:

• The flying of drones within the wind farm presents new risks, for example, collisions and dropped objects.
• If poorly planned or executed, drone inspections may be less reliable or effective than rope access, potentially missing critical defects, compromising structural integrity, or identifying issues that are not present, leading to unnecessary downtime.

The owner/operator must complete a detailed assessment of the positive and negative implications of embracing drone technology. If drones deliver a net risk reduction, and the cost of implementation is not grossly disproportionate to the risk reduction achieved, then the owner/operator is obliged to embrace them.

CASE STUDY 4 – HIGHER RISK DECISION: Can new technology be retrofitted that increases revenue but introduces additional safety risks?

Scenario and decision

An energy transition asset owner/operator identifies a modification offering significant commercial benefits, but it increases risk to personnel. How should the owner/operator assess whether the increased risk is acceptable in pursuit of business gain?

Example

The owner/operator of a wind farm has become aware of a “power-boost” option now available from the WTG original equipment manufacturer (OEM) which increases generating output. Should the owner/operator retrofit this technology to realise the commercial benefit?

Decision factors

The benefit of installing this “power-boost” unit is clear – generating output and revenue will increase. Such modifications typically enhance power output by 5-15% during optimal wind conditions. This additional generation capacity becomes particularly valuable when electricity prices rise, and grid capacity becomes constrained.

However, there will be negative implications:

• Retrofitting this feature will cost money. The capital cost, installation costs and any increase in through-life operating and maintenance costs need to be understood.
• An increase in operating and maintenance burden (number, frequency and duration of visits) presents additional risk to technicians.
• The power-boost unit may introduce additional hazards, e.g., fire and electrocution.
• The unit may push other components outside their design envelope, compromising the life of the WTG and eroding the commercial benefits.

This case study flips the usual ALARP question – not whether to reduce risk, but whether an increased risk can be justified for business gain. ALARP applies just as effectively here, reinforcing its flexibility. It remains the test for whether the higher risk is tolerable and whether further reduction is reasonably practicable.

The ALARP principle does not forbid making changes that increase risk. However, the new risk profile must be demonstrated as ALARP, just as any baseline design would have to be. Any additional risk introduced by the retrofit must be identified, assessed, and reduced ALARP.

The key point here is that commercial gain cannot justify accepting a higher risk unless it can be shown that:

• the increased risk is still in the tolerable if ALARP zone, and;
• further risk reduction measures are not reasonably practicable, i.e., they would be grossly disproportionate in cost, time, or effort to the safety benefit gained.

This is another great example of the gift that is ALARP, once again showing that it is sympathetic to valid business-driven goals.

CONCLUSION

These case studies highlight key take-aways that support the consistent and effective application of the ALARP principle:

Process considerations

1. Good practice is mandatory and cannot be overridden by CBA. The only exception is when good practice is established after an asset is operational. In such cases, ALARP will support “business as usual” if it is shown that the cost, time, or trouble associated with complying with evolving good practice is grossly disproportionate to the benefit gained.

2. In undertaking CBA analysis, all the positive and negative implications of the decision must be explored. Implications will include risk, money, time and other softer factors such as reputation and relationships.

3. A CBA does not necessarily require a detailed quantitative assessment. More often, a proportionate, pragmatic review of the potential benefits and drawbacks of a decision is appropriate. Quantitative analyses can quickly become complex and risk losing objectivity if they focus too heavily on numbers to justify a preferred outcome. A well-considered qualitative assessment can be more effective in supporting sound, unbiased judgments about whether further risk reduction is reasonably practicable, and, ultimately, whether enough has been done to manage risk.

Assessment considerations

8. ALARP is a continuous obligation, not a one-time achievement. Owners/operators must regularly review risks by considering operational experience, evolving good practice, and technological advances. Further risk reduction measures must be implemented unless their cost, time, or effort is grossly disproportionate to the benefit gained.

9. ALARP is not a justification for inaction, but a commitment to proactively explore all reasonably practicable measures to reduce risk. It requires an open-minded approach and a willingness to pursue risk reduction options until they can be demonstrated to be unjustifiable on practicability grounds.

Applying the ALARP principle rigorously ensures that safety remains paramount without losing sight of practical realities and business needs. It demands ongoing vigilance, balanced judgment, and a proactive commitment to risk reduction, ultimately safeguarding people while enabling sustainable progress in the energy transition.

References 

1. Cairn Risk, ALARP in the energy transition (Part 1) – The gift that keeps on giving.
2. Cairn Risk, ALARP in the energy transition (Part 2) – How to demonstrate ALARP effectively.