A five by five risk matrix has twenty-five cells. Sixteen of them change their rating band when one reviewer moves a single axis by one level, and every cell in the middle band does. That arithmetic, not the colour of the boxes, is what a review meeting can actually test.
What the review is approving, and what is outside it
A risk assessment is three columns of work: hazards listed, each one rated, each rating answered by a control with an owner. It is not the product certificate, the suppression datasheet or the emergency response plan, and mixing them is why some assessments never close.
Out of scope here: which suppression agent is correct, who writes the emergency plan, and what a certificate covers. Those are separate documents.
What each discipline in the room is protecting
Every hazard gets three different colours because four people in the room are protecting four different things.
The fire safety engineer protects the enclosure and the responders who arrive at it. The EPC protects the installation sequence and the energisation date. The operator protects the shift and its load. The authority's or insurer's representative protects the repeatability of the record, because a rating nobody else can reproduce is not a rating.
None of those positions is wrong; the disagreement is rarely about the hazard, but about which axis to move.
The premise that gets withdrawn
Every assessment carries an unstated premise about people, and the common one is that the site is manned, so the procedures in the document are in force.
Take the premise away mid-review: the plant is staffed 07:00 to 19:00 and unattended for the other twelve hours. An administrative control is then in force half of the clock.
The published use case makes the unattended half the busy half. Off-peak charging and peak-window discharge put the highest duty on the hours when nobody is on site, so a control that is absent when the duty is highest is not a 50 percent control.
That is the moment to re-sort the list, and the sorting rule is one question: does the control act by itself, or does it need somebody to decide?
Which ratings are worth debating
The matrix in front of the room is five by five, scored as likelihood multiplied by consequence, with bands at 1 to 4, 5 to 9, and 10 and above.
The shape of that scheme is worth knowing before anyone argues about a colour: a one-level shift on either axis changes the band in 16 of the 25 cells, so 64 percent are fragile and 9 are robust.
| Band | Cells in the matrix | Cells that change band on a one-level shift |
|---|---|---|
| Low, score 1 to 4 | 8 | 5 |
| Medium, score 5 to 9 | 7 | 7 |
| High, score 10 to 25 | 10 | 4 |
Conditions and units: a 5 by 5 matrix scored as likelihood multiplied by consequence, band boundaries at 5 and 10; a one-level shift moves either axis by one step with the other held. Result in cells. Source: derived from the scoring scheme.
Worked example. Seven cells sit in the middle band and all seven are fragile. A hazard scored 9 and one scored 10 are a single reviewer's opinion apart, and one is tolerable while the other is not. An hour spent debating the colour of those two boxes is an hour spent on the least reproducible part of the document.
The productive question is different: which hazards sit in fragile cells, and are the axis definitions written down? A likelihood scale whose levels read possible and likely has no period attached, and a scale without a period cannot be reproduced by a second reviewer. Anchoring each level to a time window is the cheapest fix available.
Controls that stop working when the site empties
The published specifications already describe a set of controls, and they differ between the two product families.
| Control | 265 kWh cabinet (published) | 20GP container (published) |
|---|---|---|
| Suppression | aerosol and water mist | FM200 / NOVEC1230 |
| Compartment separation | not published | electrical and battery compartments separated |
| Enclosure | IP54, C4 | IP54, C5 |
| Operating temperature | -30 to 55 degrees C, derating above 45 degrees C | 0 to +45 degrees C |
Conditions and units: as published for the two families. Source: published specification statements, current range, 2026.
Read that table as an inventory of self-acting controls: every published item works with nobody present. An agent discharges, a compartment boundary holds, a derating point acts on the converter.
What the published pages do not contain is any control that needs a person, and that is exactly the layer the withdrawn premise deleted. So the test for each hazard is one sentence long: name the control that acts with nobody on site. If the honest answer is a procedure, the hazard is unmitigated for part of the day by construction and belongs in the fragile list.
The decision, and the two items left open
Ask which hazards carry only an administrative control and what happens to them when the site is unattended. A supplier who points to the safety manual is pointing at a document, not a barrier.
Ask for the likelihood axis with a time window per level; a matrix whose levels carry no period cannot be reproduced by anyone not in the room.
Ask which of the published controls are self-acting and which need a decision. A list that mixes the two hides the half of the day when nobody is there.
Four things become fixed before the assessment is signed. Compartment separation is fixed once the container is built and cannot be added on site. The suppression agent is fixed once the unit is built and its documentation issued. The published temperature window and its derating point are fixed by design, so an assessment that assumes operation above 45 degrees C relies on something unpublished. And the manning assumption is fixed once the emergency plan is issued and drilled, which is why the review has to test it now rather than after.
Everything published above comes from the specification pages of the units Ruibit distributes; the manning hours and scoring bands are site inputs.
Two items leave the room open. The likelihood anchors for the middle band are owed by the assessment author before the next review. The ownership of the administrative controls is owed by the site's operations manager before energisation. The hazard list does not need to be longer; it needs the two columns that are missing, and an owner for each row.
FAQs
1. What should a BESS safety risk assessment contain?
Three columns of work: the hazards listed, each one rated, and each rating answered by a control with a named owner. A rating without an owner is an observation, and a control without an owner is a sentence.
2. Why do two reviewers score the same hazard differently?
Because a five by five matrix is fragile in the middle. A one-level shift on either axis changes the band in 16 of the 25 cells, and all seven cells in the middle band change. Anchoring each likelihood level to a defined time window is what makes a rating reproducible.
3. What is a fragile cell in a risk matrix?
A cell whose band changes when one axis moves by a single level while the other is held. Sixteen of the 25 cells are fragile, so the review should spend its time on the hazards sitting in those cells rather than on the colour of the whole matrix.
4. What should a control measure include?
A named owner, the layer it works at, meaning self-acting or requiring a person, and the condition under which it is in force. If a site is unattended for twelve hours a day, an administrative control exists for half the clock.
5. What cannot be added after the container is built?
Compartment separation, the suppression agent with its documentation, and the published temperature window with its derating point. An assessment that relies on a barrier the container does not have cannot install it on site.