vaayaa Inclusive Education
Industrial risk assessment

Power Generation and Energy Systems Risk Assessment: Plant Failure, Electrical and Process Hazards

A worked example showing how a small generation site identifies, scores and controls risks from electrical faults, equipment failure, fuel handling, supplier dependence and procedural error.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to High
See the Power Generation and Energy Systems course

Executive summary

This assessment shows how a small generation site can find, rate and control the risks that threaten people, plant and supply. Eight risks were chosen because they are plausible in daily operation, maintenance and grid work. Electrical switching, fuel release and plant failure carry the highest natural scores, because a single event can injure people or stop generation for days. Each risk is scored before controls and again after existing and added controls. Most risks fall to Medium or Low once added controls are in place, but fuel release stays at High because its consequences are severe even when rare. The first actions are a tested isolation procedure, a maintenance backlog review, a parts specification check and a shared fuel shutoff drill. The site is a teaching example, so every score illustrates method, not a real operation.

Focus area
Power generation and energy systems
Setting
Operation of a small to mid-scale generation plant with a grid connection and outsourced maintenance
Method
Likelihood and severity matrix with inherent and residual scoring

Scope

This assessment covers a teaching example of a small gas fired generation site with engine sets, a step-up transformer, switchgear, fuel supply, cooling and control systems feeding the grid. It covers safety, reliability, environmental discharge and compliance duties. It does not cover nuclear, hydro or any real site. Jurisdiction, plant size, fuel type and grid rules are assumptions made for teaching.

Context

The site has a plant manager, shift operators, an electrical engineer, a mechanical technician team and an external maintenance contractor. Generation runs through engine sets, with a transformer and switchgear linking to the grid operator. Fuel arrives by pipeline with a standby supply, and cooling uses a closed water loop. Plant controls are digital and connected to a site network. Each hazard is scored before controls to show its natural level, then again after existing controls and the additional controls proposed.

Objectives, assets and stakeholders

The objective is to run generation safely and reliably, meet the supply obligations under the grid agreement, avoid environmental harm and keep the trust of the community and regulators. Assets in scope are the engine sets, transformer, switchgear, fuel and cooling systems, control network, spare parts stock and the site records. Stakeholders include operators, technicians, contractors, the grid operator, neighbours, regulators and the owner. Each risk has one owner role. The plant manager keeps the register current and reports to the owner each quarter, and the maintenance manager reports contractor performance monthly.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 2, score 8, medium: H08 Likelihood 4, impact 3, score 12, high: H02 Likelihood 4, impact 4, score 16, high: H01 Likelihood 4, impact 5, score 20, critical: H03
3 Possible Likelihood 3, impact 3, score 9, medium: H04 Likelihood 3, impact 4, score 12, high: H05 H07
2 Unlikely Likelihood 2, impact 5, score 10, high: H06
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H08
2 Unlikely Likelihood 2, impact 2, score 4, low: H04 H05 Likelihood 2, impact 3, score 6, medium: H02 H06 H07 Likelihood 2, impact 4, score 8, medium: H01 Likelihood 2, impact 5, score 10, high: H03
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Arc flash and electric shock during switching and maintenance 16 High 8 Medium Site electrical engineer
H02 Engine or generator failure from maintenance backlog 12 High 6 Medium Maintenance manager
H03 Fuel leak and gas release 20 Critical 10 High Plant manager
H04 Specification mismatch in replacement parts 9 Medium 4 Low Stores supervisor
H05 Cooling water and emissions exceedance 12 High 4 Low Environmental lead
H06 Control system or network intrusion 10 High 6 Medium Control systems engineer
H07 Procedural deviation and human error during startup and shutdown 12 High 6 Medium Shift supervisor
H08 Loss of grid connection or fuel supply 8 Medium 6 Medium Commercial manager
H01

Arc flash and electric shock during switching and maintenance

Safety Before 16 After 8

Switching, testing or maintenance on transformers and switchgear is carried out with live parts exposed or with isolation incomplete, so an arc flash or electric shock injures a worker.

Who or what is affected: Operators, electricians and visiting contractors

Causes

Incomplete isolation, time pressure during outages and unfamiliar equipment after changes.

Consequences

Burns, serious injury, fatality and loss of the affected unit.

Existing controls

  • Written permits are issued for live and isolated work.
  • Personal protective equipment is issued and checked each shift.

Control gaps

Permits are sometimes signed before isolation is proven, and visiting staff are not always inducted.

Additional controls

  • Prevent: Use a lockout and tagout procedure with proving of dead before any contact.
  • Respond: Practise first aid and arc flash rescue drills twice a year.
Likelihood 4 x impact 4 before; 2 x 4 after Owner: Site electrical engineer Target: Within 30 days Early warning: Switching or isolation carried out without a signed permit.
H02

Engine or generator failure from maintenance backlog

Operational Before 12 After 6

Overdue inspections, oil analysis and component replacement allow wear to grow until an engine, bearing or generator winding fails and takes the unit out of service.

Who or what is affected: Operators, maintenance staff and the grid operator

Causes

Staff shortages, deferred tasks to keep output high and unreliable spare parts.

Consequences

Unplanned outage, repair cost, lost revenue and penalties under supply terms.

Existing controls

  • A planned maintenance schedule is kept in the work order system.
  • Vibration and temperature are logged each shift.

Control gaps

Deferred tasks are approved informally, and trend data is reviewed only after an alarm.

Additional controls

  • Detect: Trend vibration and oil analysis results and flag any rising change.
  • Prevent: Clear the backlog of critical tasks and ring fence a monthly maintenance window.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Maintenance manager Target: Within 45 days Early warning: Overdue critical maintenance tasks on the work order system.
H03

Fuel leak and gas release

Safety Before 20 After 10

A pipe joint, valve seal or flexible hose in the fuel train fails, releasing flammable gas into the plant room, where it can ignite or displace air.

Who or what is affected: Operators, technicians, neighbours and the site fabric

Causes

Vibration fatigue, corrosion, poor fitting of replacement parts and seal wear.

Consequences

Fire, explosion, injury, evacuation and serious environmental and legal exposure.

Existing controls

  • Gas detectors alarm in each plant room and shut down the fuel valve.
  • Fuel pipework is pressure tested after each change.

Control gaps

Leak checks depend on routine rounds, and detector calibration is not tracked by date.

Additional controls

  • Detect: Perform daily walk round checks for leaks using portable detectors.
  • Recover: Keep a tested emergency shutdown and ventilation plan with an isolation valve at the boundary.
Likelihood 4 x impact 5 before; 2 x 5 after Owner: Plant manager Target: Within 30 days Early warning: Gas detector alarms or unexplained fuel pressure drops.
H04

Specification mismatch in replacement parts

Supplier Before 9 After 4

A replacement valve, sensor or winding is supplied with ratings or dimensions that differ from the approved specification, and is fitted without checking, so it fails early or damages the unit.

Who or what is affected: Maintenance staff, operators and the connected equipment

Causes

Substitute parts offered by suppliers and unclear part numbers in the asset register.

Consequences

Early failure, damage to connected units and delayed return to service.

Existing controls

  • Parts are bought against a purchase order with a stated part number.
  • Goods are checked for visible damage on receipt.

Control gaps

Receipt checks look at condition only, not ratings or drawings.

Additional controls

  • Prevent: Verify each part against the approved specification and nameplate before fitting.
  • Detect: Compare installed equipment with the asset register at each planned outage.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Stores supervisor Target: Within 30 days Early warning: Spare parts fitted that do not match the approved specification.
H05

Cooling water and emissions exceedance

Environmental Before 12 After 4

Chemical dosing in the cooling loop drifts, or stack emissions rise during poor combustion, so discharge or air release goes above the permitted limit and harms local water or air quality.

Who or what is affected: Neighbours, wildlife, the environmental lead and the regulator

Causes

Dosing pump faults, poor combustion tuning and heavy rain washing contaminants.

Consequences

Permit breach, fines, habitat damage and loss of community trust.

Existing controls

  • Cooling water is sampled weekly and recorded.
  • Combustion is tuned at each major service.

Control gaps

Sampling is weekly, so short excursions can pass before anyone sees them.

Additional controls

  • Detect: Install continuous monitoring on discharge and stack readings with alarm levels.
  • Respond: Hold a spill and discharge response kit and a written reporting route.
Likelihood 3 x impact 4 before; 2 x 2 after Owner: Environmental lead Target: Within 60 days Early warning: Emissions or cooling water readings above the permitted limit.
H06

Control system or network intrusion

Technology and data Before 10 After 6

Unpatched controllers, shared passwords or a remote access link let an outsider or a careless user change set points, disable protections or stop the plant.

Who or what is affected: Operators, the grid operator, staff and the plant itself

Causes

Legacy software, remote vendor access and staff reusing passwords.

Consequences

Loss of control, unsafe set points, outage and a reportable incident.

Existing controls

  • Operator stations sit on a separate network from office systems.
  • Each operator has an individual login.

Control gaps

Vendor remote access is left open between visits and patches are deferred.

Additional controls

  • Prevent: Restrict remote access to named accounts with approval and multi-factor sign in.
  • Recover: Test restoring controller configuration from an offline backup each year.
Likelihood 2 x impact 5 before; 2 x 3 after Owner: Control systems engineer Target: Within 60 days Early warning: Remote access sessions opened outside an approved maintenance window.
H07

Procedural deviation and human error during startup and shutdown

People Before 12 After 6

Operators skip a step, use an outdated procedure or misread an alarm during start up, load change or shutdown, so the unit trips, overheats or is damaged.

Who or what is affected: Operators, shift supervisors and the plant

Causes

Fatigue, night shifts, unclear procedures and alarm floods.

Consequences

Trips, equipment damage, injury and lost generation.

Existing controls

  • Written start up and shutdown checklists are used on each shift.
  • Shift handover is recorded in a log.

Control gaps

Procedures are not reviewed after plant changes, and training is not refreshed.

Additional controls

  • Prevent: Confirm each checklist step aloud and tick it, with a second check on critical valves.
  • Detect: Review trip and alarm logs weekly to find repeated deviations.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Shift supervisor Target: Within 45 days Early warning: Repeated alarm trips or missed checklist steps in shift logs.
H08

Loss of grid connection or fuel supply

Supplier Before 8 After 6

The grid link or the gas supply is interrupted, or the supplier fails to deliver, so the plant cannot export power or run as planned.

Who or what is affected: Operators, the grid operator, customers and the owner

Causes

Upstream network faults, weather and supply contract limits.

Consequences

Lost revenue, contract penalties and disruption to local users.

Existing controls

  • A standby fuel contract is held with a second supplier.
  • The grid agreement sets notice periods for outages.

Control gaps

The standby contract has not been tested and the restart sequence is undocumented.

Additional controls

  • Respond: Keep a black start plan and a standby generator procedure for site loads.
  • Recover: Agree a priority restart sequence with the grid operator and test it yearly.
Likelihood 4 x impact 2 before; 3 x 2 after Owner: Commercial manager Target: Within 90 days Early warning: Gas supply pressure falls below the contracted minimum.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and severity runs from Negligible to Catastrophic. Multiplying the two gives a score from 1 to 25, which falls into four bands. Low covers 1 to 4 and is accepted and watched. Medium covers 5 to 9 and needs routine controls with a named owner. High covers 10 to 16 and needs senior attention and a dated plan. Critical covers 17 to 25 and needs immediate action, with work restricted until controls are in place. Inherent risk is the score before any controls, judged as if controls were absent. Residual risk is the score after existing and added controls are working. Severity is judged on harm to people first, then on equipment damage, lost generation, environmental release and legal exposure. A safety risk is never rated down only because it has not happened yet. Operators, technicians and the contractor challenge the ratings at each review, and any indicator reaching its threshold triggers a re-score.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Overdue critical maintenance tasks on the work order system.Escalate to the maintenance manager when any critical task is overdue, and to the plant manager after 14 days.
Switching or isolation carried out without a signed permit.Stop the work at once, escalate to the site electrical engineer, and review the permit system before work resumes.
Gas detector alarms or unexplained fuel pressure drops.Escalate to the shift supervisor immediately, and to the plant manager if the alarm repeats within a shift.
Spare parts fitted that do not match the approved specification.Escalate to the stores supervisor at once, quarantine the part, and inform the plant manager within a day.
Emissions or cooling water readings above the permitted limit.Escalate to the environmental lead when a reading is above limit, and to the regulator contact as the permit requires.

Contingency arrangements

If a serious event occurs, such as an arc flash, a fuel release or a loss of generation, the shift supervisor makes the plant safe, isolates the affected section and raises the emergency response. Injured people receive first aid and medical help at once. The plant manager informs the owner, the grid operator and the regulator as the relevant rules require, through a named contact. Maintenance restores supply from standby units where possible, and the critical spares list is used to shorten repair time. Records are preserved for the investigation.

Prioritized action plan

  1. Introduce a tested lockout and isolation procedure for all switching and maintenance, owner site electrical engineer, within 30 days.
  2. Review the maintenance backlog and clear overdue critical tasks, owner maintenance manager, within 45 days.
  3. Verify replacement parts against the approved specification before fitting, owner stores supervisor, within 30 days.
  4. Run a fuel shutoff and gas detection drill with all shifts, owner plant manager, within 60 days.
  5. Restrict control network access and test restoration from backup, owner control systems engineer, within 60 days.

Conclusion

Reliable and safe generation depends on a few steady habits: tested isolation, a controlled maintenance backlog, verified replacement parts, fuel shutoff drills and close watch on every alarm trend. The highest natural scores sit with electrical work, fuel release and plant failure, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek licensed engineering and legal advice for any real plant decision.

Assumptions and limitations

Assumptions

  • The site operates under a national electrical and environmental regime, not named here, with a licensed operator in charge.
  • Staff are trained operators and technicians who follow written isolation and permit procedures.
  • Maintenance is shared between in-house technicians and one external contractor under a written agreement.

Limitations

  • The scores are examples for learning and do not describe any real plant, grid or regulator.
  • Electrical, process and environmental rules differ by place and change over time, so specialist review is needed.
  • This is educational content and does not replace a formal site-specific assessment or licensed engineering advice.

Related frameworks to study

  • Hierarchy of controls
  • Failure mode and effects analysis
  • Lockout tagout isolation procedures
  • Bow tie risk analysis
  • Management of change process

Industrial Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Power Generation and Energy Systems course Read the best practices for this course

More Industrial risk assessments

Hourly Active: 45,552 Learners