ALARP Documentation Built From Continuous Fatigue Metrics
The Review With No Continuous Metrics
A UKCS safety case revision landed on a reviewer's desk in late 2025. The duty holder — a mid-sized drilling contractor operating three semi-subs in the North Sea — had produced a 40-page narrative on fatigue risk. The document covered shift patterns, rest-period compliance, training records, and a policy statement on fatigue management. The reviewer asked one question: "Where are the continuous metrics that demonstrate the argument you're making?"
The duty holder's answer — aggregated hours-worked reports and a retrospective medic log — did not satisfy the reviewer, who sent the submission back with a request for evidence that fatigue risk was being monitored in the daily flow of operations, not reconstructed quarterly. The revision went back to the engineering team, and the duty holder spent the next four months building a retrospective evidence trail from paper forms and medic logs. The submission eventually landed, but the regulator's feedback was clear: the next revision would face the same question, and the narrative-only argument would not survive another cycle.
HSE UK's page on offshore safety cases sets the structural expectation: the safety case must demonstrate that risks have been reduced to as low as reasonably practicable, with evidence that supports the argument (HSE UK Offshore Safety Cases). The Assessment Principles for Offshore Safety Cases (APOSC) go further, describing what constitutes acceptable evidence of ALARP including traceable linkage between identified hazards, implemented controls, and ongoing performance indicators (HSE UK Assessment Principles for Offshore Safety Cases).
The Australian regulator NOPSEMA's ALARP guidance is widely referenced by duty holders globally for the same test (NOPSEMA ALARP Guidance). Industry practice on ALARP demonstration, catalogued across trade publications, reinforces that the bar has been moving toward continuous, not point-in-time, evidence (Flare ALARP in Offshore Safety). The policy, training, and rota narrative is no longer sufficient on its own. Reviewers expect to see the argument connected to the data, and the data connected to the daily operational decisions that implement the argument.
The Garden as ALARP Evidence
Verdant Helm's garden data is not a compliance bolt-on; it is a continuous evidence base. Each crew member's perennial — the bloom, the wilt, the recovery — is logged, time-stamped, and linked to the controls in place at the moment the state was recorded. When the reviewer asks "what did you do when your drill-floor crew's aggregate energy dropped below a threshold on day 18?", the answer is not a policy extract. The answer is a chart showing the threshold crossing, the tasks active at that moment, the mitigations triggered (additional supervision, task deferral, peer-check insertion), and the outcome. This is evidence in the regulatory sense: specific, time-bounded, and traceable to the decisions it informed.
The framework for converting garden data into ALARP evidence has four elements. First, threshold definition. The duty holder defines, with reference to HSE shiftwork and fatigue guidance, what constitutes an actionable state in the garden — individual wilt scores, aggregate crew states, trend slopes (HSE UK Guidance for Managing Shiftwork and Fatigue Offshore). The thresholds are not absolute rules; they are triggers for structured conversation and, where warranted, intervention. The duty holder owns the threshold definitions, because they have to stand behind them in the review conversation.
Second, linked controls. Each threshold has a documented control pathway. When the threshold triggers, a named supervisor takes a defined action, and the action is captured in the same record. This closes the hazard-control-evidence loop that the APOSC requires. Third, continuous capture. The garden logs state continuously through the hitch, not at scheduled checkpoints. The record is tamper-evident and time-stamped. When the reviewer asks for a 6-month trend, the duty holder exports a report covering every threshold crossing, every control triggered, and every outcome.
Fourth, performance-indicator feed. IOGP's Report 626 on managing fatigue in the workplace supplies the indicator language ALARP documentation is expected to speak, and the garden metrics map directly onto those indicators (IOGP Report 626 Managing Fatigue in the Workplace).
Fatigue-management software that produces continuous metrics suitable for regulatory use exists in adjacent industries, and the market is converging on scheduling-plus-evidence workflows (Indeavor Fatigue Management Software NRC RP755 Compliance). The gap for offshore drilling has been the translation from generic fatigue data to safety-case-ready evidence. The garden framework closes that gap by designing the data capture around the duty holder's ALARP narrative from day one. The evidence base grows with use rather than being reconstructed for each revision, which changes the economics of safety-case maintenance and reduces the scramble that typically precedes a scheduled submission.
Advanced Tactics for Safety-Case Evidence
Three tactics turn the framework from a compliance artifact into working evidence. The first is evidence-first design of the garden thresholds. Work backward from the safety-case reviewer's likely questions — "when did you intervene?", "what did you change?", "how did you know?" — and define thresholds that produce answerable records.
A threshold that triggers a form entry but no action is not evidence. A threshold that triggers a documented supervisor conversation is. The parallel work on HSE audits moving to continuous telemetry walks through the audit-side of the same shift.
The threshold design session is a multi-disciplinary exercise — HSE lead, OIM, toolpusher, and a safety-case specialist should shape the thresholds together so they match both the regulatory expectation and the operational reality.
The second tactic is revision-cycle alignment. Safety cases are revised on defined cycles (typically 5-year full revision, with material-change amendments in between). The garden data accumulates faster than the revision cycle, so the duty holder can use each revision as a chance to raise the evidence quality rather than merely repeat the prior argument. The IADC daily drilling reports powered by garden data feed the same evidence stream into a different reporting cadence, so the investment in garden data compounds across multiple regulatory interfaces. The revision cycle also becomes a learning loop — the duty holder can see which thresholds produced useful interventions and which produced noise, and tune the next revision accordingly.
The third tactic is cross-fleet benchmarking. A duty holder running multiple rigs can show the reviewer how each rig's garden compares, how interventions on rig A transferred to rig B, and how the fleet-level trend evolved. This is an ALARP argument that narrative cannot make. The parallel practice on deep-sea cargo — ISM audit evidence from continuous cognitive debt — shows how the same cross-fleet logic applies to ISM Code audits.
A fourth tactic is incident-to-evidence mapping. When a near-miss or dangerous occurrence is reported, the garden data around the event becomes part of the post-incident record automatically. The reviewer does not see a sanitized narrative of "crew fatigue was considered"; they see the actual curves, the actual threshold crossings, and the actual supervisor decisions. This is uncomfortable at first for duty holders used to narrative ALARP arguments, and it is one of the reasons the evidence base is more defensible.
A fifth tactic is regulator engagement. Some regulators welcome pre-submission engagement on novel evidence bases; others do not. The duty holder's relationship with HSE, NOPSEMA, BSEE, or the equivalent shapes how the evidence is introduced. A short pre-submission conversation that shows the reviewer what the garden data looks like — before the full revision arrives — often reduces the review friction at submission time and sets up a productive dialogue about threshold definitions and evidence sufficiency.
Common mistakes include treating ALARP as a one-time writing exercise rather than a continuous evidence practice, defining thresholds that make the data look good rather than thresholds that drive real decisions, and pulling garden data only when the reviewer asks (which signals the system is not actually used). A subtle trap: threshold gaming, where supervisors learn what numbers make the report "clean" and self-report accordingly. The antidote is multi-source data (self-report plus peer observation plus objective proxies) so that no single input can be tuned to the chart. Another trap is building the evidence system separately from the safety-case authoring process, which creates duplicate work and invites drift between what the evidence shows and what the narrative claims.
Build the Next Revision Differently
If you run HSE, OIM, or safety-case-owner duties for a UKCS or NOPSEMA-regulated operation, your next revision is a chance to change the evidence base, not just refresh the narrative. Pull the last revision and mark every fatigue-related argument that rests on policy or training rather than continuous data; the marked paragraphs are the ones the next reviewer will challenge. Verdant Helm gives duty holders and drilling supervisors a way to build ALARP evidence into daily operations so the next revision carries six months of charts behind each argument. Bring us your current ALARP narrative on fatigue and we will return a mapping showing which paragraphs the garden data would replace with evidence, plus a transition plan that gets your rig operating with continuous capture before the next review cycle opens.
The mapping exercise runs in two passes. The first pass identifies every paragraph in the ALARP narrative where the argument rests on policy, training, or point-in-time records. The second pass classifies each marked paragraph by the type of evidence that would strengthen it — threshold definition, linked control, continuous capture, or performance indicator. The output is a paragraph-by-paragraph table the HSE lead and safety-case author can work through together, with a named transition timeline for each argument. Duty holders who complete the mapping before the next revision opens typically find that 40 to 60 percent of fatigue-related paragraphs can be re-grounded in garden data within six months of operational capture.
The remaining paragraphs either stay narrative because the argument genuinely is about policy (training currency, rota design, contractor bridging) or get retired because the argument was never defensible to begin with. That trimming is its own value — a leaner ALARP narrative with stronger evidence reads better than a longer one with weaker foundations. Book a 45-minute mapping session with an HSE lead and an OIM from a rig that has run the transition — the conversation covers the specific paragraphs they retired and the specific charts that replaced them.