ALARP: As Low As Reasonably Practicable

• ALARP is a risk management principle that defines reducing residual risk to a level where further mitigation is disproportionate to its cost, time, or effort.
• The framework employs quantitative methods, including Bayesian risk estimation, marginal cost-benefit analysis, and the Value of Information to guide verification and decision-making.
• Applications in automated driving and software reliability illustrate how ALARP supports risk acceptance decisions by comparing new models or processes against baseline practices.

As Low As Reasonably Practicable (ALARP) is a risk-management principle under which residual risk after mitigations must be reduced to a level that is “as low as reasonably practicable” in view of the costs, time and effort required. In the literature considered here, ALARP is treated both as a general criterion for safety cases and as a quantitative decision rule for prospective deployment of complex models, with explicit comparisons against baseline practice and against the marginal value of further verification (Ashmore, 2014, Francesco et al., 14 Jul 2025). In automated driving, ALARP is also cited as a type of risk-acceptance criterion, although its concrete operationalization remains an open question (Salem et al., 2023).

1. Definition, scope, and regulatory meaning

ALARP is defined by Rob Ashmore as the principle that residual risk after mitigations must be reduced to a level that is “as low as reasonably practicable” in view of the costs, time and effort required. In safety-critical industries, this means that, once obvious and cost-effective risk reductions have been made, any further expenditure must be justified by a proportionate reduction in risk (Ashmore, 2014). Di Francesco et al. restate the principle in model-risk terms: model-induced risk should be driven down until further risk reduction becomes “disproportionate” to the effort or cost required (Francesco et al., 14 Jul 2025).

This formulation makes clear that ALARP is not a zero-risk doctrine. The criterion is comparative and economic: it asks whether additional mitigation is reasonably practicable relative to the expected reduction in adverse consequence. A plausible implication is that ALARP arguments require both a measure of current residual risk and a credible account of the remaining mitigation options.

Within safety cases, Ashmore places ALARP in the context of system fault trees. Each basic event is assigned a failure probability or rate, and overall system risk is computed by combining these via Boolean AND/OR gates. On this account, an ALARP claim requires showing that no further practical risk reductions remain and that resources are being directed toward the dominant contributors to risk rather than toward components whose contribution is unknown or badly mis-estimated (Ashmore, 2014).

In automated driving, Salem et al. note that ISO 21448 mentions criteria such as MEM (minimum endogenous mortality) or ALARP, but that it remains an open question how such criteria can be applied to Automated Driving Systems. The paper therefore treats ALARP as a type of risk-acceptance criterion rather than as a completed quantitative doctrine (Salem et al., 2023).

2. Decision-analytic formalization for model risk

Di Francesco et al. formalize ALARP around model risk, defined as the expected downstream cost or consequence of using a model to inform decisions. Let $S$ be the set of real-world scenarios, $M_O$ the set of possible model outputs, $\Pr(s)$ the probability of scenario $s$, $\Pr(m_o \mid s)$ the reliability of the model, and $I(s,m_o)$ the impact of taking the decision implied by output $m_o$ in scenario $s$. The model risk is

$$R_m = \int_{s \in S} \int_{m_o \in M_O} \Pr(s)\Pr(m_o \mid s) I(s,m_o)\, dm_o\, ds.$$

Desirable outcomes are assigned negative $I$ so that risk is minimized (Francesco et al., 14 Jul 2025).

In discrete form, the same quantity is written as

$M_O$0

where $M_O$1 is the cost of executing the decision rule $M_O$2 triggered by $M_O$3 when the true state is $M_O$4 (Francesco et al., 14 Jul 2025).

Because $M_O$5 is not known in advance, the framework introduces a parameter $M_O$6 to describe model reliability, for example the rows of a confusion matrix. The corresponding Bayes risk is the posterior average of $M_O$7:

$M_O$8

The Bayes-optimal model is then

$M_O$9

In practice, $\Pr(s)$0 is estimated by Monte Carlo: draw $\Pr(s)$1 from $\Pr(s)$2, compute $\Pr(s)$3, and average (Francesco et al., 14 Jul 2025).

On this basis, ALARP is captured by two inequalities. The first is a benefit comparison against baseline practice:

$\Pr(s)$4

The second is a marginal cost-benefit condition for additional verification:

$\Pr(s)$5

Together, these constitute a stop rule: the proposed model is adopted only if its Bayes risk is no higher than the risk of existing practice, and further verification is pursued only while the expected value of that information exceeds its cost (Francesco et al., 14 Jul 2025).

3. Uncertainty quantification and value of information

The quantitative ALARP argument in Di Francesco et al. depends on explicit uncertainty quantification over the model-reliability parameter $\Pr(s)$6. In classification tasks, each row of a confusion matrix is modeled as

$\Pr(s)$7

so that after observing test data $\Pr(s)$8 the posterior is

$\Pr(s)$9

Sampling from these Dirichlet-multinomial posteriors propagates both aleatoric uncertainty and epistemic uncertainty through to $s$0 (Francesco et al., 14 Jul 2025).

The same paper defines verification through Value of Information (VoI). If additional verification data $s$1 were collected, the prior-stage expected cost is

$s$2

whereas the pre-posterior expected cost is

$s$3

The Value of Information is then

$s$4

If $s$5 exceeds the cost of the verification campaign, it is worth paying for; otherwise further verification is not reasonably practicable (Francesco et al., 14 Jul 2025).

This structure gives ALARP an explicitly sequential interpretation. First, uncertainty is represented rather than ignored. Second, adoption is decided against a baseline comparator. Third, verification itself is subjected to the same economic discipline as deployment. A plausible implication is that ALARP can be argued not only for operational use of a model, but also for the stopping point of validation activity.

4. Weld radiograph classification as a worked example

Di Francesco et al. illustrate the framework with automated weld radiograph classification. The true damage classes are $s$6, and the proposed CNN outputs the same four classes. The test set contains $s$7 images with an observed confusion matrix. The downstream decision is whether to repair. Manual inspection costs £350 per image plus repair costs, and unrepaired damage can lead to a failure cost $s$8 modeled as

$s$9

If the model misclassifies a defect as “no anomaly,” the decision incurs $\Pr(m_o \mid s)$0, or a fraction thereof, when failure later occurs (Francesco et al., 14 Jul 2025).

For the confusion-matrix rows, the paper places a uniform $\Pr(m_o \mid s)$1 prior on each row and uses the posterior update above. It then draws $\Pr(m_o \mid s)$2 samples of $\Pr(m_o \mid s)$3, computes $\Pr(m_o \mid s)$4 for each, and averages to obtain $\Pr(m_o \mid s)$5 and $\Pr(m_o \mid s)$6 credible intervals. Three strategies are compared: perfect manual inspection, a fully automated CNN, and a hybrid that defers to manual review only when the CNN predicts the two most serious defects (Francesco et al., 14 Jul 2025).

The per-image expected costs reported for each true class are as follows. For no anomaly, manual inspection yields £350, automated classification £92.55, and the hybrid £43.82; the hybrid is best. For cracking, the values are £1,350, £3,155.79, and £3,440.96; manual is best. For porosity, they are £850, £2,424.17, and £2,282.77; manual is best. For lack of penetration, they are £3,350, £4,501.77, and £4,825.18; manual is best. The paper concludes that the hybrid approach ALARP-dominates for “no anomaly,” whereas for real defects manual inspection remains risk-optimal (Francesco et al., 14 Jul 2025).

The paper also gives a high-level deployment test. If the prior mix of defects is $\Pr(m_o \mid s)$7 and $\Pr(m_o \mid s)$8 each, then

$\Pr(m_o \mid s)$9

Deployment of the CNN is ALARP only if $I(s,m_o)$0 under that same prior mix (Francesco et al., 14 Jul 2025).

For verification, Figure 1 reports scenario-specific VoI. In particular, for lack of penetration the Value of Information is approximately £51 per image. If a bespoke verification study costs more than £51 per image, it is not worth performing; ALARP has been reached for further verification. For the “no anomaly” scenario, VoI is near zero, so even cheap verification yields no decision improvement (Francesco et al., 14 Jul 2025).

5. Software reliability quantification and system-level ALARP

Ashmore argues that quantifying software reliability is important in demonstrating that system-level risks are ALARP and that such quantification is possible in at least one meaningful case, though unlikely to be practical in every case (Ashmore, 2014). The paper contrasts this with standards such as ARP 4761 or DO-178C, which take a process-based view of software safety and do not assign a numerical software failure probability. According to Ashmore, this leads practitioners to assume implausibly low or implausibly high software failure rates when constructing system fault trees, potentially misdirecting risk-reduction effort (Ashmore, 2014).

For software-on-demand failures, the paper gives a Binomial model. If each demand has independent failure probability $I(s,m_o)$1, and $I(s,m_o)$2 independent demands are executed with zero observed failures, then the confidence that the true failure probability is at most $I(s,m_o)$3 is

$I(s,m_o)$4

Solving for $I(s,m_o)$5 yields

$I(s,m_o)$6

To claim $I(s,m_o)$7 with $I(s,m_o)$8 confidence, the paper gives approximately $I(s,m_o)$9 failure-free tests (Ashmore, 2014).

For continuous-time operation, the analogous Poisson model is

$m_o$0

Ashmore notes that to bound $m_o$1 failures/hour at $m_o$2 confidence requires approximately $m_o$3 hours of continuous testing (Ashmore, 2014).

The case study concerns a safety-monitoring control loop implemented in software with three 8-bit sensor readings and three 1-bit status flags, giving a total input space of

$m_o$4

distinct input combinations. An automated harness checks the Software Under Test against an animated VDM formal specification. Performance is about $m_o$5 million SUT-only executions per second per core, or $m_o$6 tests/s/core with oracle checks. A $m_o$7-core machine running for $m_o$8 hours yields roughly $m_o$9 tests, sufficient for full exhaustive coverage in under $s$0 hours (Ashmore, 2014).

With zero failures observed in $s$1 trials, the paper gives

$s$2

At $s$3 confidence, $s$4; at $s$5 confidence, $s$6. Ashmore concludes that the probability of software failure on any single demand is below a few $s$7 at high confidence, and that this number can be inserted directly into the top-level system fault tree to support a quantitative ALARP claim that treats software on the same footing as hardware (Ashmore, 2014).

The principal limitation is practicality. The paper emphasizes threats to validity including incorrect requirements, missing oracle coverage, unknown internal state distributions in black-box components, and the difficulty of representative sampling for real-time or continuous systems. This supports a narrower conclusion: quantitative ALARP arguments for software are feasible in some cases, not universally (Ashmore, 2014).

6. Explicit risk acceptance in automated driving

Salem et al. propose the Risk Management Core (RMC) as a process framework for explicit representation and management of risk in Automated Driving Systems. The framework consists of three ISO 31000 activities: risk analysis, risk evaluation, and risk treatment. The paper states that these steps mirror what is needed to demonstrate that residual risk has been driven to an accepted level, even though it does not itself derive a formal ALARP curve or cost-benefit equation (Salem et al., 2023).

The paper’s ontological structure includes the relationships “Risk = $s$8,” hazard as a potential source of harm, hazardous event as hazard plus scenario, and a risk treatment ontology connecting safe target behavior, safety goals, safety measures, risk reduction, and safety integrity. Fowler’s “risk budgets” sketch is used to distinguish $s$9, the maximum achievable reduction, loss of reduction due to less-than-$$R_m = \int_{s \in S} \int_{m_o \in M_O} \Pr(s)\Pr(m_o \mid s) I(s,m_o)\, dm_o\, ds.$$0 integrity giving $$R_m = \int_{s \in S} \int_{m_o \in M_O} \Pr(s)\Pr(m_o \mid s) I(s,m_o)\, dm_o\, ds.$$1, and new risk introduced by safety functions themselves giving $$R_m = \int_{s \in S} \int_{m_o \in M_O} \Pr(s)\Pr(m_o \mid s) I(s,m_o)\, dm_o\, ds.$$2. Residual risk is then represented as the combination of these terms plus the remainder of the original risk, with tolerable risk as the line that must be undercut (Salem et al., 2023).

The numerical example concerns an urban T-intersection with a marked crosswalk. The hazard is “Road vehicle collides with a vulnerable road user at a pedestrian crossing, resulting in potential injury of the VRU,” and the hazardous event is “Road vehicle collides with a pedestrian in front of a crosswalk.” The scenario assumptions are $$R_m = \int_{s \in S} \int_{m_o \in M_O} \Pr(s)\Pr(m_o \mid s) I(s,m_o)\, dm_o\, ds.$$3 electric vans operating $$R_m = \int_{s \in S} \int_{m_o \in M_O} \Pr(s)\Pr(m_o \mid s) I(s,m_o)\, dm_o\, ds.$$4 h/day for $$R_m = \int_{s \in S} \int_{m_o \in M_O} \Pr(s)\Pr(m_o \mid s) I(s,m_o)\, dm_o\, ds.$$5 days, giving $$R_m = \int_{s \in S} \int_{m_o \in M_O} \Pr(s)\Pr(m_o \mid s) I(s,m_o)\, dm_o\, ds.$$6 h/year of fleet operation, with $$R_m = \int_{s \in S} \int_{m_o \in M_O} \Pr(s)\Pr(m_o \mid s) I(s,m_o)\, dm_o\, ds.$$7 near misses per van per year and one fatal collision per $$R_m = \int_{s \in S} \int_{m_o \in M_O} \Pr(s)\Pr(m_o \mid s) I(s,m_o)\, dm_o\, ds.$$8 near misses. The resulting actual risk is approximately

$$R_m = \int_{s \in S} \int_{m_o \in M_O} \Pr(s)\Pr(m_o \mid s) I(s,m_o)\, dm_o\, ds.$$9

Using a “Positive risk balance” criterion, the paper sets accepted risk from Berlin human-driving statistics at approximately

$I$0

Because actual risk is much greater than accepted risk, risk reduction is mandated. The derived safety goal is “Prevent collision between a road vehicle and a vulnerable road user at crosswalks,” and the behavioral safety requirement is “If a crosswalk is detected, detect pedestrians’ crossing intention reliably” (Salem et al., 2023).

This example clarifies an important point about ALARP in emerging domains. Salem et al. explicitly state that ISO 21448 mentions ALARP but leaves open how to apply it to automated driving. The RMC therefore supplies process scaffolding—hazard logs, risk estimates, safety goals, safety measures, and iteration—rather than a completed socio-technical definition of “reasonably practicable.” A common misconception is that application of current safety standards alone yields an explicit ALARP justification. The papers considered here instead indicate that standards often provide process obligations or implicit guidance, whereas explicit ALARP claims require quantitative risk representation, comparison against accepted thresholds or baseline practice, and a documented argument that further risk reduction is not reasonably practicable (Salem et al., 2023, Ashmore, 2014).