ERICPD (Part 1) – A clearer guide to risk control in the energy transition

Risk reduction in the UK is governed by the Health & Safety at Work etc. Act 1974 (HASAWA), which requires risks to be reduced so far as reasonably practicable. Most approaches apply the hierarchy of risk controls (HORC), a strategy that favours inherently safer, more robust controls over those reliant on procedural compliance or individual actions. One common application is the mnemonic ERICPD (pronounced “Eric P D”), but its openness to interpretation can sometimes undermine its intent. This article clarifies the meaning of each tier which should help improve its consistent use across energy transition sectors.

This article is the first in a two-part series exploring ERICPD’s role in the energy transition.

Introduction

In this article we trace ERICPD’s origins and explain the meaning and intention of each tier of the hierarchy. Our aim is to make ERICPD clearer and more practical for both legacy and emerging energy sectors. The second article in the series highlights that, while ERICPD is a valuable tool for guiding safe design, the first principles of safety must always be the compass.

WHAT IS ERICPD?

ERICPD is a practical tool and easy-to-remember mnemonic. The framework – Eliminate, Reduce, Isolate, Control, PPE, Discipline – is illustrated in Figure 1. It provides a structured sequence of risk controls that aligns with the HORC, recognised as industry good practice. ERICPD provides a simple way to apply the hierarchy in practice.

ERICPD has been widely used in UK safety practice and training for decades, guiding organisations to prioritise risk controls based on their effectiveness in reducing risk. It is commonly used to demonstrate compliance with legally mandated safety principles, such as ALARP (Ref. 1).

Figure 1 – ERICPD

Despite the widespread adoption of ERICPD, it is not documented in a public, readily available authoritative source. This leaves it open to misinterpretation and undermines its practical effectiveness.

HIERARCHY OF RISK CONTROLS

The HORC is a globally recognised concept, consistently promoted in safety literature by regulators and industry organisations, including the UK HSE and US NIOSH.

In its most common form, the HSE represents its “hierarchy of controls” as (Ref. 2):

• Elimination – physically remove the hazard.
• Substitution – replace the hazard with something less hazardous.
• Engineering controls – isolate people from the hazard through design or equipment.
• Administrative controls – change the way people work (procedures, training, supervision).
• PPE – protect the worker with Personal Protective Equipment once all other measures have been exhausted.

There are also some industry-specific variants. For example, the HSE sets out a four-stage hierarchy in its guidance for onshore major hazard process sectors which emphasises inherently safer design (ISD), prevention, control, and mitigation (Ref. 3):

• Eliminate (inherent safety)
• Prevent
• Control
• Mitigate

The guidance provides much detail and requires that the principles of redundancy, diversity, separation and segregation have been applied, and that priority is given to passive rather than active measures.

In the offshore oil sector, the Offshore Energies UK (OEUK) hierarchy is similar but additionally emphasises evacuation measures as these are especially challenging offshore (Ref. 4):

• Elimination and minimisation of hazards by design (inherently safer design).
• Prevention (reduction of likelihood).
• Detection and control (limitation of scale, intensity and duration).
• Mitigation of consequences (protection from effects).
• Evacuation, escape and rescue (ERR) arrangements.

Like these three hierarchies, ERICPD represents one specific application of the HORC. Whilst its origin lies in occupational health and safety training delivered by NEBOSH, it nevertheless aligns well with the hierarchies applied in sectors with the potential to cause major accidents.

CLARIFYING THE TIERS OF ERICPD

ERICPD’s main advantage compared to other HORCs may be that it is memorable – though many practitioners may admit they remember the letters but not always what they cover or why. With that in mind, we clarify the meaning and intention of each tier of the hierarchy.

Eliminate

Eliminate means permanently removing a hazard so that the associated risk no longer exists (Figure 2). It is the most effective level of control within the ERICPD hierarchy, as it prevents exposure entirely.

Figure 2 – Eliminate

Elimination can be achieved through design decisions that remove the hazardous material, energy source, or process step from the system altogether. Examples include:

• Using solid-state batteries in battery energy storage systems (BESS) to eliminate the risk of flammable liquid electrolytes.
• Designing remotely controlled drone inspection systems for offshore wind or solar farms, eliminating the need for personnel exposure to working-at-height or high-voltage hazards.

Although elimination seems straightforward, it is often limited by technical feasibility or functional necessity. Many processes in the energy transition inherently involve hazardous materials or high-energy systems (e.g., hydrogen, lithium, electricity) that cannot simply be removed without compromising the asset’s purpose – to generate clean energy.

Reduce

Reduce refers to minimising the level of risk associated with a hazard when complete elimination is not practicable. It involves decreasing either the likelihood of the hazard being realised, the severity of its potential consequences, or both – so far as is reasonably practicable.

Although all lower tiers of ERICPD also reduce likelihood or severity, reduce specifically focuses on inherently safer design (ISD) practices where elimination is not possible. These ISD methods of minimise, substitute, moderate (or attenuate), and simplify are illustrated in Figure 3.

Figure 3 – Reduce and inherently safer design (ISD)

The ISD practices are as follows:

• Minimise the quantities of hazardous material or energy present to limit the potential consequences of an event, e.g., using smaller hydrogen storage modules, reducing hazardous inventories, or minimising the number of potential leak paths in a process system.
• Substitute the hazardous material, process, or energy source with a less hazardous alternative, e.g., using water-based electrolytes instead of flammable organic solvents in battery systems (the electrolyte still carries some chemical and electrical hazard, but the flammability and toxicity are significantly reduced).
• Moderate the energy, concentration, or operating conditions to make them inherently less hazardous, e.g., operating at lower pressures or temperatures, or maintaining less corrosive or reactive conditions.
• Simplify the design of systems and tasks to make them easy to operate and maintain, reducing opportunities for human error or equipment failure, and increasing resilience, e.g., using fewer components, clearer control interfaces, or gravity-fed systems instead of pumped transfers, directly addressing hazards that can manifest due to system failures.

In essence, reduce aims to make the system less hazardous by design, complementing eliminate at the top of the ERICPD hierarchy.

Both likelihood and severity should be reduced to the lowest practicable level, rather than simply described as “reduced” in subjective terms.

Isolate

In ERICPD, isolate means the physical separation of people from hazardous consequences. That separation can be achieved by:

• Physical barriers such as process containment, locked enclosures, or blast walls.
• Spatial separation like locating control rooms away from process areas.
• Segregation through design such as remote operation, or physical zoning.

These methods are illustrated in Figure 4. In some ISD hierarchies, isolate is referred to as segregate.

Figure 4 – Isolate

Effective isolation focuses on protecting groups of people collectively, by isolating the hazard itself so that everyone benefits, rather than isolating individual workers through local measures. The most effective isolation strategies remove human exposure from harm’s way by design, creating resilience that does not depend on procedures or human reaction.

Control

Control refers to measures that prevent, detect, and respond to hazardous scenarios throughout their lifecycle, from the initiating event to corrective action or emergency response. The measures can be:

• Engineered controls such as machine guard interlocks, gas detection, or automatic shutdown systems.
• Administrative controls like permit-to-work procedures, operator supervision, or evacuation plans.

The emphasis on the lifecycle of the hazards underlines the importance of understanding hazards in detail.

Engineering controls must always be prioritised before administrative measures. Within engineering controls, preference should be given to passive measures – those that do not rely on human action or system activation – rather than active measures. For example, in a BESS, natural ventilation through louvres or vent stacks (driven by convection or pressure differences) would be preferred to mechanical extraction fans that activate automatically when sensors detect elevated temperature or gas concentration.

PPE

PPE refers to the targeted selection of personal protective equipment to address specific hazards, not simply the standard issue of workwear. As a physical control, PPE should always be a last resort because it only protects once a hazard is realised.

Discipline

ERICPD specifically recognises discipline as a distinct tier that addresses human behaviour and the cultivation of a safe working culture, while cautioning against over-reliance on behaviour alone.

Discipline focuses on managing hazards by promoting safe human behaviours through auditing, training, and awareness. Importantly, “discipline” here does not refer to punitive action for disobeying rules, but to the positive reinforcement of safe behaviours and the cultivation of a strong safety culture. Placing discipline below PPE highlights that culture and behaviour are essential but inherently weaker than physical controls should an incident occur.

PREVENTION AND MITIGATION

The HSE’s onshore process hierarchy and the OEUK hierarchy both explicitly refer to prevention and mitigation. A common question is how these concepts map onto ERICPD.

In ERICPD, both prevention and mitigation are implicit.

• Preventive measures reduce the likelihood of a hazardous event occurring.
• Mitigative measures limit the consequences once the event has occurred.

Most ERICPD levels contribute to both outcomes, depending on how the measures are applied. In general, prevention dominates the upper levels (eliminate, reduce, isolate, control), while mitigation features more strongly in the lower tiers (PPE and aspects of control). Discipline supports both prevention and mitigation by reinforcing safe behaviours that maintain the effectiveness of measures throughout the lifecycle.

REDUNDANCY AND DIVERSITY

In major hazard sectors, the principles of redundancy and diversity are essential to achieving robust risk reduction:

• Redundancy provides multiple, independent means of performing the same safety function, so that if one fails, another continues to protect, e.g., dual sensors for hydrogen detection.
• Diversity uses different types of controls or mechanisms to achieve the same safety function, reducing vulnerability to common-cause failures such as power loss, software faults, or human error, e.g., using both a mechanical and an electronic overspeed protection on a wind turbine.

ERICPD guides the selection of the type of control (from eliminate down to discipline). Once that tier is chosen, redundancy and diversity help determine whether that control is sufficiently reliable, available, fault tolerant, and resistant to single-point and common-cause failures.

As one moves down ERICPD, controls become less inherently robust and more dependent on systems or people. Consequently, redundancy and diversity become increasingly important for control (engineered and administrative), PPE, and discipline.

EFFECTIVENESS CRITERIA FOR RISK REDUCTION MEASURES

While ERICPD prioritises which type of control to use, it does not assess how well that control performs. The effectiveness of a selected risk reduction measure depends on how fully it achieves the intended risk reduction – in other words, how robustly it performs its function under all relevant operational, environmental, and degraded conditions throughout its lifecycle.

Effectiveness criteria such as coverage, functionality, availability, reliability, maintainability, survivability, and interdependencies, must therefore be applied within each ERICPD tier to determine whether the chosen measure is truly adequate. For example, within the control tier, when evaluating a fire detection and suppression system, key questions include: are all hazardous areas properly covered, does activation trigger automatic shutdowns, what is the frequency and quality of routine inspections and functional tests?

Only by applying these criteria can the chosen controls be shown to provide the intended risk reduction.

COMPARISON WITH HSE’S HIERARCHY OF CONTROLS

ERICPD aligns closely with the HSE’s hierarchy of controls:

• Eliminate and Reduce correspond to Elimination and Substitution.
• Isolate aligns with Engineering Controls. Separating isolate from control emphasises the collective value of physically removing groups of people from exposure to the hazard, rather than relying on systems or actions to control it.
• Control combines Engineering and Administrative Controls, covering prevention, detection, control, mitigation and emergency response measures.
• PPE remains the final physical defence.
• Discipline adds an additional layer focusing on human behaviour, training, supervision, and safety culture.

CLARIFIED ERICPD WITH EXAMPLES

Our clarified ERICPD is summarised in Figure 5.

Figure 5 – Clarified ERICPD

Some examples reflecting a range of energy sectors are presented in Table 1.

Table 1 – Clarified ERICPD with examples

Conclusion

ERICPD is a powerful mnemonic that supports application of the HORC, prioritising risk reduction measures according to their effectiveness. Yet lack of formal definition risks diluting its intent, particularly in sectors newer to its use, such as those emerging through the energy transition. By clarifying definitions, ERICPD can remain relevant and practical across all sectors.

ERICPD, or indeed any form of the HORC, is as much a mindset as it is a tool. While our clarifications promote consistency in its use, it is important not to become overly fixated on what sits where on the tiers, but to focus on the goal – always seek the most effective control.

Ultimately, ERICPD is a guide, not a substitute for leadership, technical judgement, or adaptive thinking. Its enduring value lies in reinforcing that risk controls must always be prioritised by effectiveness, not convenience.

In the second article of this series, we examine ERICPD’s limitations and compare it with the UK’s Principles of Prevention, showing that while ERICPD is a helpful tool, first principles remain the essential foundation for managing emerging risks in the energy transition.  

References

1. Health and Safety at Work etc. Act 1974 (Sections 2(1), 3(1)) and Management of Health and Safety at Work Regulations 1999 (Regulation 3). https://www.legislation.gov.uk/ukpga/1974/37
2. Health and Safety Executive (HSE) website guidance, https://www.hse.gov.uk/ppe/managing-risk-using-ppe.htm
3. Health and Safety Executive (HSE), CA internal guidance – COMAH safety report assessment. COMAH SRAM 2015 – Process safety criteria (PDF)
4. Offshore Energies UK (OEUK), Guidance on Risk Related Decision Making – Issue 2, July 2014.