ALARP: How 'As Low As Reasonably Practicable' Became Law

Every safety case in Britain ends with the same five letters. ALARP stands for “as low as reasonably practicable”. In short, it tells a firm how far it must go before it can stop spending on safety. The phrase sounds soft. Yet it carries a reverse burden of proof and 75 years of case law. So this post traces how ALARP grew from a Welsh mining death into the spine of UK risk law. It then lays out the numbers, the sums, and the way a lithium-ion battery store must argue its case today.

TL;DR

What ALARP means

• ALARP works as a legal test. A firm must cut risk until the next measure costs grossly more than the safety it buys. The Court of Appeal first set that test in 1949, in Edwards v National Coal Board.
• The burden sits on the firm. So under section 40 of the Health and Safety at Work Act 1974, the accused must prove it could not have done more.
• HSE’s triangle marks the band. Above 1 in 1,000 per year for workers, or 1 in 10,000 for the public, risk counts as intolerable. Below 1 in 1,000,000, in contrast, it counts as broadly acceptable.

Why ALARP needs care

• The rule reads: implement unless cost exceeds a disproportion factor times benefit. For example, HSE’s rules of thumb run from 2 for low public risks to 10 for high ones.
• A cost-benefit sum can never excuse falling below good practice. In the worked example below, for instance, the sum rejects a £364,000 off-gas system by a factor of 89. Good practice and societal risk then carry the case anyway.
• Other countries differ. France uses acceptability grids and the US uses negligence law, while Australia wrote gross disproportion into statute.

What does ALARP mean?

ALARP means a risk has been cut until any further cut would cost grossly more than the safety it buys. The letters stand for “as low as reasonably practicable”.

According to HSE, the sister phrase SFAIRP, “so far as is reasonably practicable”, means the same thing. Statutes say SFAIRP, while risk engineers say ALARP. At the core of both, though, sits one act of weighing. On one scale sits the risk. On the other sits the sacrifice needed to remove it, including money, time and trouble.

Why does “reasonably practicable” tilt toward safety?

Because the scales carry a thumb on them. A measure therefore goes in unless its cost runs grossly out of proportion to its benefit. So a cost that merely exceeds the benefit still fails to excuse inaction.

HSE spells this out in its archived ALARP at a glance guide, for example. The process “is not one of balancing the costs and benefits of measures but, rather, of adopting measures except where they are ruled out because they involve grossly disproportionate sacrifices.” The same guide gives two easy cases. For instance, spending £1 million to spare five staff bruised knees counts as grossly disproportionate. Spending £1 million to prevent a blast that could kill 150 people, though, counts as plainly proportionate.

How did ALARP become law?

Through one 1949 judgment, one 1974 statute, and two disasters that forced regulators to put numbers on the words.

What did Edwards v National Coal Board decide?

That “reasonably practicable” sits narrower than “physically possible”. A firm escapes the duty only where the risk looks trivial beside the sacrifice.

Joseph Edwards worked as a timberman in a colliery. A section of travelling road collapsed on him, yet only about half its length carried supports. So the Coal Board argued that shoring every road in every mine would cost far too much for the risk. In Edwards v National Coal Board [1949] 1 KB 704, Lord Justice Asquith rejected that framing. The owner must first make “a computation”. The “quantum of risk” goes on one scale, and “the sacrifice involved in the measures necessary for averting the risk” goes on the other. Only “a gross disproportion between them” then discharges the duty.

What did the 1974 Act add?

A general duty on every employer, plus a reverse burden of proof. Both came from the Robens Committee, which sat from 1970 to 1972 and asked for goal-setting law instead of detailed rules.

The result, the Health and Safety at Work Act 1974, still frames the field. Section 2 obliges every employer to ensure, so far as is reasonably practicable, the health and safety of its employees. Section 3 also extends that duty to anyone else the work affects. Then section 40 does the heavy lifting. Where a duty carries the qualifier, the accused must prove that it could not have done more. The Court of Appeal upheld that reverse burden in Davies v HSE in 2002.

How did Piper Alpha and Sizewell B shape the numbers?

Piper Alpha gave ALARP its safety-case format, while the nuclear inquiries gave it numbers.

On 6 July 1988 the Piper Alpha platform exploded, and 167 people died. Lord Cullen’s inquiry then made 106 proposals. The central one required operators to write a safety case showing that major-accident risk had fallen to ALARP.

Meanwhile the nuclear sector built the numbers. HSE’s 1988 paper The Tolerability of Risk from Nuclear Power Stations, revised in 1992, answered the Sizewell B inquiry under Sir Frank Layfield. It first set out the three-region model, and proposed the individual-risk limits that later spread to every industry.

What did R2P2 do in 2001?

Extend the nuclear framework to all work risk. HSE’s Reducing Risks, Protecting People, known as R2P2, set out the triangle, the role of good practice, and the place of cost-benefit analysis.

Then in 2025 HSE moved those pages to the National Archives. It also announced a review of the 2001 inspector guidelines, with “no intent to change the principles”. So the numbers below still describe current practice, though the web addresses have changed.

Where does fire safety law use it?

In the Regulatory Reform (Fire Safety) Order 2005, which put a “responsible person” in charge of every non-domestic building.

Article 9 requires a suitable and sufficient fire risk assessment, while article 4 lists the general fire precautions. Article 8 then applies the ALARP wording. The responsible person must take those precautions to ensure, so far as is reasonably practicable, the safety of relevant persons. After Grenfell, the Fire Safety Act 2021 confirmed that the duty covers external walls, cladding and flat entrance doors.

Why did the EU challenge fail?

Because the Court of Justice found no strict liability in the Framework Directive.

Article 5(1) of Directive 89/391/EEC tells employers to ensure safety “in every aspect related to the work”. The Commission read that as absolute, so it sued. On 14 June 2007, in Commission v United Kingdom, C-127/05, the court dismissed the action. Because the Commission had failed to prove no-fault liability, the UK qualifier survived.

What are the three regions of tolerability?

Unacceptable, tolerable if ALARP, and broadly acceptable. R2P2 draws them as an inverted triangle, wide at the top where risk runs high and narrow at the bottom where it fades into background.

Region	Meaning	Action required
Unacceptable	Risk cannot stand, save in exceptional cases	Reduce regardless of cost, or stop the activity
Tolerable only if ALARP	Society accepts the risk in return for a benefit	Reduce until further reduction costs grossly too much
Broadly acceptable	Risk sits at the level of everyday background	Keep controls in place; no further action expected

As risk falls down the triangle, the burden of justification and the required disproportion both shrink. Near the top, a firm must spend a great deal before it can refuse a measure. Near the bottom, though, a modest imbalance will do.

Which numbers mark the boundaries?

Four anchors, all per year. Three cover individual risk, while one covers societal risk.

Criterion	Value per year	Source
Intolerable above, workers	1 in 1,000	R2P2, paragraph 128
Intolerable above, public	1 in 10,000	R2P2, paragraph 130
Broadly acceptable below, workers and public	1 in 1,000,000	R2P2, paragraph 130
Societal risk, intolerable	50 or more deaths in one event, more often than 1 in 5,000	R2P2, paragraph 136

Individual risk means the yearly chance that the most exposed person dies. Societal risk, in contrast, captures the extra aversion to one event that kills many. Society treats one accident that kills 50 people as worse than 50 accidents that kill one each. So a firm has to satisfy both. HSE’s COMAH guidance later extended that single societal anchor into a full curve, which our post on F-N curves works through.

Why must tolerability and ALARP be shown separately?

Because a risk inside the tolerable band has only cleared the first gate. Sitting below 1 in 10,000 per year keeps the risk out of the intolerable zone. Yet it says nothing about the effort to drive the risk lower.

Practitioners still miss this point more than any other. A risk assessment that lands mid-band still owes a list of every further measure considered, and a reason for each one rejected.

How does the gross disproportion test work?

Through one inequality. Implement the measure unless its cost exceeds a disproportion factor times its benefit.

$\text{Implement the measure unless } \quad C > DF \times B$

Here $C$ stands for the cost of the measure, $B$ for the safety benefit in money, and $DF \ge 1$ for the disproportion factor. A plain cost-benefit analysis sets the factor at 1. So it rejects any measure that costs more than it saves. ALARP loads the scales instead, so a measure fails only when its cost exceeds several times its benefit. HSE’s cost-benefit checklist states the same rule, and also notes that factors “vary from upwards of 1” with the size of the risk.

How do you value the benefit?

With the Value of Preventing a Fatality, or VPF, times the risk reduction and the number of people exposed.

The VPF measures the total willingness to pay for a small cut in the chance of death. It never prices a named life, however. At first, R2P2 adopted a benchmark of £1,000,000 at 2001 prices, borrowed from road appraisal. HSE’s checklist then listed £1,336,800 at 2003 prices, doubled for cancer. In March 2025 the Office of Rail and Road reported a 2024 VPF of £2,467,000, endorsed by the Department for Transport. So any ALARP case should state which figure it used, and the price year behind it.

For a measure that cuts annual individual risk by $\Delta R$ for $N$ people over a life of $T$ years, the undiscounted benefit reads $B \approx \Delta R \cdot N \cdot T \cdot VPF$. Discounting at the Treasury Green Book rate then gives the present value.

$B = \sum_{t=1}^{T} \frac{\Delta R_t \cdot N \cdot VPF}{(1+r)^t}, \qquad r = 0.035$

One caution applies to the rate. HSE’s checklist says safety benefits should carry no discount above 1.5%, a 2003 figure, while costs may use the higher Treasury rate. So a firm that discounts both sides at 3.5% shrinks the benefit and flatters the case for inaction.

How large should the disproportion factor be?

Between 1 and about 10, chosen by the size of the risk. Yet HSE has never published a formula. It insists the judgment “must be made on a case by case basis”.

Inspectors still carry rules of thumb from HSE’s 1987 Sizewell B submission, and HSE’s archived CBA principles page records them.

Position in the ALARP region	Disproportion factor
Risks to workers	Up to 3
Low risks to members of the public	About 2
High risks to members of the public	About 10
Catastrophic or multi-fatality potential	Higher still, argued case by case

The table gives the numeric form of Asquith’s word gross. The closer a risk sits to the intolerable line, the more a firm must spend before it can refuse a measure. A factor below 1 never applies, because that would bias the scales against safety.

What can a cost-benefit analysis never do?

Excuse falling below good practice, or stand alone as an ALARP case. HSE draws both lines in plain words.

First, the checklist states that a CBA “cannot be used to argue against the implementation of relevant good practice”, unless the alternative proves at least as effective. Second, a CBA on its own “does not constitute an ALARP case”. It cannot justify an intolerable risk, and it cannot justify “what is evidently poor engineering”. The courts also agree. In Baker v Quantum Clothing in 2011, the Supreme Court measured the duty against a reasonable and prudent employer. So a spreadsheet informs the judgment, yet it never replaces it.

Worked example: does off-gas detection pass the ALARP test?

On individual risk alone, no. On the full case, though, almost certainly yes.

Consider, for instance, a grid-scale lithium-ion battery energy storage system, or BESS, beside a small occupied building. A first-principles risk assessment puts the yearly chance of death for the nearest neighbour at 2 × 10⁻⁵. That sits inside the public ALARP band, below 1 in 10,000 and above 1 in 1,000,000. The candidate measure adds a package including off-gas detection, extra ventilation and deflagration management. Capital cost comes to £250,000, plus £8,000 a year in maintenance over a 20-year life.

Step 1, risk reduction: UL 9540A and IEC 62933-5-2 test evidence supports a 60% cut in the chance of a fatal escalation, so $\Delta R = 0.60 \times 2\times10^{-5} = 1.2\times10^{-5}$ per year.

Next, the exposed population: take the $N = 2$ most exposed people, namely the two nearest neighbours.

Step 3, annual benefit: with a VPF of £2,000,000, the benefit per year then reads:

$B_\text{annual} = \Delta R \cdot N \cdot VPF = 1.2\times10^{-5} \times 2 \times £2{,}000{,}000 = £48\ \text{per year}$

Then the discounted benefit: over 20 years at $r = 0.035$, the annuity factor comes to $\sum_{t=1}^{20}(1.035)^{-t} = 14.21$, so the present value reads:

$B = £48 \times 14.21 \approx £682$

Step 5, cost: present value of cost = £250,000 + (£8,000 × 14.21) ≈ £363,680, including 20 years of maintenance.

Finally, apply the test: mid-band, take $DF = 6$, then implement unless $C > DF \times B$:

$DF \times B = 6 \times £682 = £4{,}092 \ll £363{,}680 = C$

So the cost runs about 89 times the adjusted benefit. Even at a factor of 10 the gap still stays above 50. Swapping in HSE’s 1.5% rate for benefits lifts the annuity factor to 17.2 and the benefit to about £824, which changes nothing. So on individual risk alone, the measure fails.

Why does the spreadsheet miss the point?

Because individual risk leaves out most of the harm a BESS fire causes. Three terms belong in the case, and each one pushes the answer the other way.

• Societal risk. One event can injure many people, force an evacuation, and also release hydrogen fluoride. So multi-fatality potential raises both the benefit and the factor. The F-N curve carries that term.
• Good practice. NFCC guidance, NFPA 855 and venting under NFPA 68 may require detection regardless of any sum. That triggers the first red line above.
• Wider detriment. Environmental damage, emergency response and business interruption count as benefits of prevention. HSE’s checklist lists evacuation and clean-up among them.

Individual-risk CBA rarely justifies expensive measures. That fact explains why good practice and societal risk, rather than the spreadsheet, decide most BESS cases.

How do other countries handle the same question?

Differently. Britain exported the words, yet only Australia and New Zealand copied the test into statute.

Regime	Core legal test	Uses ALARP?	Key instrument
UK	Reasonably practicable; gross disproportion; reverse burden	Yes, the originator	HSWA 1974; R2P2
EU	Ensure safety “in every aspect”; “as far as possible” flavour	No, though SFAIRP held compatible	Directive 89/391/EEC
France	Obligation of safety; reduce at source; acceptability grids	No	Code du travail L.4121-2; loi Bachelot 2003
Australia	Codified “reasonably practicable” with statutory factors	Yes, in statute	WHS Act 2011, section 18
New Zealand	Codified “reasonably practicable”	Yes, in statute	HSWA 2015, section 22
US	Negligence “reasonableness”; general duty clause	No	OSH Act; Carroll Towing

Why does France reject ALARP?

Because French law starts from an obligation of result and a duty to remove risk at source. So an explicit cost-benefit balance never enters the statute.

The Code du travail, article L.4121-2, for instance, lists nine principles of prevention. The first two read “avoid the risks” and “combat the risks at source”. For major-hazard sites, the loi Bachelot of 30 July 2003 added probabilistic hazard studies and the MMR grid, a 5 × 5 matrix of probability against severity. Each dangerous phenomenon then lands in an acceptable, measures-required, or unacceptable cell.

How did Australia and New Zealand codify it?

By writing the weighing factors into the Act, with cost last on the list.

Section 18 of Australia’s Work Health and Safety Act 2011 defines “reasonably practicable” as what is “reasonably able to be done”. The firm weighs the likelihood of harm, its degree, what it knows or ought to know, the controls available, and finally cost, “including whether the cost is grossly disproportionate to the risk”. Thus the statute carries Asquith’s test. Similarly, section 22 of New Zealand’s Health and Safety at Work Act 2015 copies it almost word for word.

What does the Learned Hand formula say?

That a defendant acts negligently when the burden of a precaution costs less than the probability of loss times its gravity. The US has no ALARP duty, so this negligence calculus does the work instead.

Judge Learned Hand first wrote the rule in United States v Carroll Towing in 1947.

$B < PL \implies \text{negligent}$

The gap from ALARP then shows in one number. Carroll Towing balances at a factor of 1, so a precaution counts as required once $B < PL$. ALARP demands gross disproportion, with a factor of up to 10 before a measure can go. ALARP also appears in IEC 61508, ISO 31000, and for fire in ISO 16732-1 and PD 7974-7.

How do you demonstrate ALARP for a BESS?

By reasoning from first principles, because no BESS-specific statute exists and the codes still change every year.

Why does the regulatory gap matter?

Because the general duty under the 1974 Act carries the whole load. Britain has no law that sets a minimum distance between a battery store and a house.

The House of Commons Library briefing CBP-7621, updated on 23 June 2025, records that “there is no mandatory minimum distance that BESS sites should be from other buildings”. In that vacuum, the ALARP case becomes the compliance route.

HSE’s archived compliance guide then draws the split. Where relevant good practice fits, following it normally suffices. Where it does not, though, the firm must argue from first principles with a quantified case. Battery storage sits in the second camp, because chemistries move faster than codes. For example, the NFCC planning guidance for fire and rescue services, updated in 2025, proposes 30 m between cabinets and occupied buildings. That distance can fall to 0.914 m between enclosures where UL 9540A tests show no propagation. NFPA 855 and IEC 62933-5-2 then supply the rest.

What did Moss Landing show?

That individual-risk sums understate a battery fire. Societal, environmental and business losses dominate the true calculus.

On 16 January 2025 a fire broke out at Vistra’s 300 MW Moss Landing facility in California. The company’s annual report to the SEC records that operations across the complex then ceased. Management later chose not to return the 100 MW battery to service. Mass evacuation, fears of hydrogen fluoride release, and litigation followed as a result. Our posts on LFP versus NMC chemistry and on putting out a lithium battery fire cover the physics behind that loss.

What does a BESS ALARP case contain?

Six parts, in order. Each one answers a question that an inspector will ask, so the order matters.

1. Hazard identification. Thermal runaway, propagation, off-gassing, deflagration and toxic release. Our post on event trees and fault trees covers the structure.
2. Quantified risk. Individual risk for the most exposed person, and an F-N curve for societal risk.
3. Good practice first. Apply NFCC, NFPA 855 and IEC 62933 before any sum.
4. Further measures. List every further option through the hierarchy: eliminate, substitute, engineer, then procedure.
5. Gross disproportion argument. For each rejected measure, record the cost, the benefit and the factor used.
6. Sign-off and review triggers. A competent person signs. New UL 9540A data, a chemistry change or an incident then reopens the case.

What do critics say about ALARP?

That it runs in a circle, hides value-of-life judgments, and cannot escape the ethics of pricing a death. So a rigorous practitioner should know each objection.

• Circularity. Jones-Lee and Aven (2011) argue in Reliability Engineering and System Safety that “grossly disproportionate” takes its meaning from what industry already does. So the standard risks defining itself.
• Opaque judgments. Melchers (2001) warned in the same journal that acceptance criteria “are not fully open to public scrutiny and can appear to be settled by negotiation”.
• CBA all the way down. Ale, Hartford and Slater (2015) contend in Safety Science that ALARP “cannot be separated from some form of Cost Benefit Analysis”. So every objection to pricing life applies to ALARP too.

Two more objections come from practice rather than theory.

• Moral hazard. A well-funded firm can produce an elaborate CBA to justify inaction. That inverts the precautionary principle, because the principle demands action under deep uncertainty.
• A contested VPF. University of Bristol researchers noted in 2017 that the VPF rests on a survey of 167 people. They also argued that a re-analysis would push the figure roughly ten times higher.

For novel hazards such as large-format lithium-ion storage, the precaution point bites hardest. The data needed to quantify $P$ and $\Delta R$ may not yet exist, so any CBA rests on thin ground.

How should you write an ALARP case?

Lead with good practice, show tolerability and ALARP separately, and write for the reverse burden. Seven habits cover most jobs.

On the method

1. Apply good practice before the spreadsheet. Use a CBA only for measures beyond the codes, because a favourable sum never excuses a missing standard.
2. Show tolerability and ALARP as two findings. First show the risk sits below 1 in 10,000 per year for the public. Then show the reduction effort.
3. Pick the factor by position and consequence. Use about 2 for low public risks, up to 3 for workers, and about 10 near the intolerable line. Then write the choice down.

On the inputs

4. Add societal risk and wider detriment for a BESS. Build an F-N curve, and add wider losses, including evacuation, environmental and business-interruption costs.
5. State the VPF and its year. Say whether you used the £2,467,000 rail figure or an HSE value. Discount benefits at no more than 1.5%, then run sensitivity on both the VPF and the factor.
6. Write for section 40. You will have to prove you did enough. So keep a signed ALARP register that lists every rejected measure and the reason.
7. Say so when the data runs out. Where $P$ and $\Delta R$ resist confident numbers, say so, then lean conservative rather than rest on a fragile sum.

Key takeaways

ALARP began as a court’s answer to a mining death. It then grew into the core rule of British safety law. The test asks one question: would the next measure cost grossly more than the harm it prevents? Parliament then put the burden of proof on the firm, R2P2 drew the triangle, and HSE’s rules of thumb set the factor between 2 and 10.

The sums matter most, though, where they fail. For a battery store, an individual-risk CBA rejects almost every expensive measure. Good practice, societal risk and wider losses therefore carry the case instead. So write those terms down, name the factor, and date the case. Then reopen it the moment the chemistry or the codes change.

Cite this article

Dinh, D. C. (2026, September 6). ALARP: How 'As Low As Reasonably Practicable' Became Law. PyroRisk. https://pyrorisk.net/blog/alarp-how-as-low-as-reasonably-practicable-became-law/

Get citation →

---