---
title: 'ALARP: As Low As Reasonably Practicable'
url: https://www.emergentmind.com/topics/as-low-as-reasonably-practicable-alarp
type: topic
---

# ALARP: As Low As Reasonably Practicable

As Low As Reasonably Practicable (ALARP) is a risk-management principle under which residual risk after mitigations must be reduced to a level that is “as low as reasonably practicable” in view of the costs, time and effort required. In the literature considered here, ALARP is treated both as a general criterion for safety cases and as a quantitative decision rule for prospective deployment of complex models, with explicit comparisons against baseline practice and against the marginal value of further verification [1404.7528] [2507.10817]. In automated driving, ALARP is also cited as a type of risk-acceptance criterion, although its concrete operationalization remains an open question [2302.07715].

## 1. Definition, scope, and regulatory meaning

ALARP is defined by Rob Ashmore as the principle that residual risk after mitigations must be reduced to a level that is “as low as reasonably practicable” in view of the costs, time and effort required. In safety-critical industries, this means that, once obvious and cost-effective risk reductions have been made, any further expenditure must be justified by a proportionate reduction in risk [1404.7528]. Di Francesco et al. restate the principle in model-risk terms: model-induced risk should be driven down until further risk reduction becomes “disproportionate” to the effort or cost required [2507.10817].

This formulation makes clear that ALARP is not a zero-risk doctrine. The criterion is comparative and economic: it asks whether additional mitigation is reasonably practicable relative to the expected reduction in adverse consequence. A plausible implication is that ALARP arguments require both a measure of current residual risk and a credible account of the remaining mitigation options.

Within safety cases, Ashmore places ALARP in the context of system fault trees. Each basic event is assigned a failure probability or rate, and overall system risk is computed by combining these via Boolean AND/OR gates. On this account, an ALARP claim requires showing that no further practical risk reductions remain and that resources are being directed toward the dominant contributors to risk rather than toward components whose contribution is unknown or badly mis-estimated [1404.7528].

In automated driving, Salem et al. note that ISO 21448 mentions criteria such as MEM (minimum endogenous mortality) or ALARP, but that it remains an open question how such criteria can be applied to Automated Driving Systems. The paper therefore treats ALARP as a type of risk-acceptance criterion rather than as a completed quantitative doctrine [2302.07715].

## 2. Decision-analytic formalization for model risk

Di Francesco et al. formalize ALARP around **model risk**, defined as the expected downstream cost or consequence of using a model to inform decisions. Let $S$ be the set of real-world scenarios, $M_O$ the set of possible model outputs, $\Pr(s)$ the probability of scenario $s$, $\Pr(m_o \mid s)$ the reliability of the model, and $I(s,m_o)$ the impact of taking the decision implied by output $m_o$ in scenario $s$. The model risk is

$$
R_m = \int_{s \in S} \int_{m_o \in M_O} \Pr(s)\Pr(m_o \mid s) I(s,m_o)\, dm_o\, ds.
$$

Desirable outcomes are assigned negative $I$ so that risk is minimized [2507.10817].

In discrete form, the same quantity is written as

$$
R_m = \sum_{s \in S} \Pr(s) \sum_{m_o \in M_O} \Pr(m_o \mid s)\, C(d(m_o), s),
$$

where $C(d(m_o), s)$ is the cost of executing the decision rule $d(\cdot)$ triggered by $m_o$ when the true state is $s$ [2507.10817].

Because $\Pr(m_o \mid s)$ is not known in advance, the framework introduces a parameter $\theta$ to describe model reliability, for example the rows of a confusion matrix. The corresponding **Bayes risk** is the posterior average of $R_m(\theta)$:

$$
r(m) = E_{\theta \sim p(\theta \mid data)}[R_m(\theta)]
     = \int R_m(\theta)\, p(\theta \mid data)\, d\theta.
$$

The Bayes-optimal model is then

$$
m^* = \arg\min_{m \in M} r(m).
$$

In practice, $r(m)$ is estimated by Monte Carlo: draw $\theta^{(i)}$ from $p(\theta \mid data)$, compute $R_m(\theta^{(i)})$, and average [2507.10817].

On this basis, ALARP is captured by two inequalities. The first is a **benefit comparison** against baseline practice:

$$
r(m_{proposed}) \le R_{baseline}.
$$

The second is a **marginal cost-benefit** condition for additional verification:

$$
VoI \le C_{verify}.
$$

Together, these constitute a stop rule: the proposed model is adopted only if its Bayes risk is no higher than the risk of existing practice, and further verification is pursued only while the expected value of that information exceeds its cost [2507.10817].

## 3. Uncertainty quantification and value of information

The quantitative ALARP argument in Di Francesco et al. depends on explicit uncertainty quantification over the model-reliability parameter $\theta$. In classification tasks, each row of a confusion matrix is modeled as

$$
C_{i,:} \sim \mathrm{Multinomial}(N_i, \theta_i), \qquad
\theta_i \sim \mathrm{Dirichlet}(\alpha),
$$

so that after observing test data $C$ the posterior is

$$
\theta_i \mid C \sim \mathrm{Dirichlet}(\alpha + C_{i,:}).
$$

Sampling from these Dirichlet-multinomial posteriors propagates both aleatoric uncertainty and epistemic uncertainty through to $R_m(\theta)$ [2507.10817].

The same paper defines verification through **Value of Information** (VoI). If additional verification data $z$ were collected, the prior-stage expected cost is

$$
C_{prior} = \min_{m \in M} E_{\theta \sim p(\theta)}[R_m(\theta)],
$$

whereas the pre-posterior expected cost is

$$
C_{posterior} =
E_z\left[\min_{m' \in M} E_{\theta \sim p(\theta \mid z)}[R_{m'}(\theta)]\right].
$$

The Value of Information is then

$$
VoI = C_{prior} - C_{posterior}.
$$

If $VoI$ exceeds the cost of the verification campaign, it is worth paying for; otherwise further verification is not reasonably practicable [2507.10817].

This structure gives ALARP an explicitly sequential interpretation. First, uncertainty is represented rather than ignored. Second, adoption is decided against a baseline comparator. Third, verification itself is subjected to the same economic discipline as deployment. A plausible implication is that ALARP can be argued not only for operational use of a model, but also for the stopping point of validation activity.

## 4. Weld radiograph classification as a worked example

Di Francesco et al. illustrate the framework with automated weld radiograph classification. The true damage classes are $\{ \text{no anomaly}, \text{cracking}, \text{porosity}, \text{lack of penetration} \}$, and the proposed CNN outputs the same four classes. The test set contains $N=246$ images with an observed confusion matrix. The downstream decision is whether to repair. Manual inspection costs £350 per image plus repair costs, and unrepaired damage can lead to a failure cost $C_{fail}$ modeled as

$$
C_{fail} \sim \pi_1 \cdot N^+(50\,000, 3\,000^2) + \pi_2 \cdot \Gamma(6, 40\,000),
\qquad
(\pi_1,\pi_2) \sim \mathrm{Dirichlet}(9,3).
$$

If the model misclassifies a defect as “no anomaly,” the decision incurs $C_{fail}$, or a fraction thereof, when failure later occurs [2507.10817].

For the confusion-matrix rows, the paper places a uniform $\mathrm{Dirichlet}(1,1,1,1)$ prior on each row and uses the posterior update above. It then draws $10\,000$ samples of $\theta^{(j)}$, computes $R_m(\theta^{(j)})$ for each, and averages to obtain $r(m)$ and $95\%$ credible intervals. Three strategies are compared: perfect manual inspection, a fully automated CNN, and a hybrid that defers to manual review only when the CNN predicts the two most serious defects [2507.10817].

The per-image expected costs reported for each true class are as follows. For **no anomaly**, manual inspection yields £350, automated classification £92.55, and the hybrid £43.82; the hybrid is best. For **cracking**, the values are £1,350, £3,155.79, and £3,440.96; manual is best. For **porosity**, they are £850, £2,424.17, and £2,282.77; manual is best. For **lack of penetration**, they are £3,350, £4,501.77, and £4,825.18; manual is best. The paper concludes that the hybrid approach ALARP-dominates for “no anomaly,” whereas for real defects manual inspection remains risk-optimal [2507.10817].

The paper also gives a high-level deployment test. If the prior mix of defects is $\pi_{no}=0.90$ and $\pi_{crack}=\pi_{poro}=\pi_{lop}=0.033$ each, then

$$
r(manual)=0.90\cdot 350 + 0.033\cdot 1350 + \dots \approx 425.
$$

Deployment of the CNN is ALARP only if $r(CNN) < 425$ under that same prior mix [2507.10817].

For verification, Figure 13 reports scenario-specific VoI. In particular, for lack of penetration the Value of Information is approximately £51 per image. If a bespoke verification study costs more than £51 per image, it is not worth performing; ALARP has been reached for further verification. For the “no anomaly” scenario, VoI is near zero, so even cheap verification yields no decision improvement [2507.10817].

## 5. Software reliability quantification and system-level ALARP

Ashmore argues that quantifying software reliability is important in demonstrating that system-level risks are ALARP and that such quantification is possible in at least one meaningful case, though unlikely to be practical in every case [1404.7528]. The paper contrasts this with standards such as ARP 4761 or DO-178C, which take a process-based view of software safety and do not assign a numerical software failure probability. According to Ashmore, this leads practitioners to assume implausibly low or implausibly high software failure rates when constructing system fault trees, potentially misdirecting risk-reduction effort [1404.7528].

For software-on-demand failures, the paper gives a Binomial model. If each demand has independent failure probability $p$, and $n$ independent demands are executed with zero observed failures, then the confidence that the true failure probability is at most $p_{max}$ is

$$
1-\alpha = (1-p_{max})^n.
$$

Solving for $n$ yields

$$
n = \frac{\ln(\alpha)}{\ln(1-p_{max})}
\approx \frac{-\ln(\alpha)}{p_{max}}
\quad \text{for small } p_{max}.
$$

To claim $p_{max}=10^{-6}$ with $99\%$ confidence, the paper gives approximately $4.61\times 10^6$ failure-free tests [1404.7528].

For continuous-time operation, the analogous Poisson model is

$$
P(0\text{ failures in }T) = e^{-\lambda T},
\qquad
\lambda_{max} = -\frac{\ln(\alpha)}{T}.
$$

Ashmore notes that to bound $\lambda \le 10^{-6}$ failures/hour at $99\%$ confidence requires approximately $4.61\times 10^6$ hours of continuous testing [1404.7528].

The case study concerns a safety-monitoring control loop implemented in software with three 8-bit sensor readings and three 1-bit status flags, giving a total input space of

$$
2^{3\cdot 8 + 3\cdot 1} = 2^{27} \approx 1.34\times 10^8
$$

distinct input combinations. An automated harness checks the Software Under Test against an animated VDM formal specification. Performance is about $1$ million SUT-only executions per second per core, or $320$ tests/s/core with oracle checks. A $32$-core machine running for $24$ hours yields roughly $8.8\times 10^8$ tests, sufficient for full exhaustive coverage in under $24$ hours [1404.7528].

With zero failures observed in $N=1.34\times 10^8$ trials, the paper gives

$$
p_{max} = 1 - \alpha^{1/N} \approx -\frac{\ln(\alpha)}{N}.
$$

At $95\%$ confidence, $p_{max}\approx 3.0\times 10^{-8}$; at $99\%$ confidence, $p_{max}\approx 5.2\times 10^{-8}$. Ashmore concludes that the probability of software failure on any single demand is below a few $\times 10^{-8}$ at high confidence, and that this number can be inserted directly into the top-level system fault tree to support a quantitative ALARP claim that treats software on the same footing as hardware [1404.7528].

The principal limitation is practicality. The paper emphasizes threats to validity including incorrect requirements, missing oracle coverage, unknown internal state distributions in black-box components, and the difficulty of representative sampling for real-time or continuous systems. This supports a narrower conclusion: quantitative ALARP arguments for software are feasible in some cases, not universally [1404.7528].

## 6. Explicit risk acceptance in automated driving

Salem et al. propose the **Risk Management Core** (RMC) as a process framework for explicit representation and management of risk in Automated Driving Systems. The framework consists of three ISO 31000 activities: risk analysis, risk evaluation, and risk treatment. The paper states that these steps mirror what is needed to demonstrate that residual risk has been driven to an accepted level, even though it does not itself derive a formal ALARP curve or cost-benefit equation [2302.07715].

The paper’s ontological structure includes the relationships “Risk = $f(\text{severity of harm}, \text{probability of harm})$,” hazard as a potential source of harm, hazardous event as hazard plus scenario, and a risk treatment ontology connecting safe target behavior, safety goals, safety measures, risk reduction, and safety integrity. Fowler’s “risk budgets” sketch is used to distinguish $R(original)$, the maximum achievable reduction, loss of reduction due to less-than-$100\%$ integrity giving $R(L)$, and new risk introduced by safety functions themselves giving $R(C)$. Residual risk is then represented as the combination of these terms plus the remainder of the original risk, with tolerable risk as the line that must be undercut [2302.07715].

The numerical example concerns an urban T-intersection with a marked crosswalk. The hazard is “Road vehicle collides with a vulnerable road user at a pedestrian crossing, resulting in potential injury of the VRU,” and the hazardous event is “Road vehicle collides with a pedestrian in front of a crosswalk.” The scenario assumptions are $1{,}000$ electric vans operating $22$ h/day for $365$ days, giving $8.06\times 10^6$ h/year of fleet operation, with $3$ near misses per van per year and one fatal collision per $3{,}000$ near misses. The resulting actual risk is approximately

$$
\frac{1\ \text{fatality/year}}{8.06\times 10^6\ \text{hours/year}}
= 1.24\times 10^{-7}\ \text{fatalities/hour}.
$$

Using a “Positive risk balance” criterion, the paper sets accepted risk from Berlin human-driving statistics at approximately

$$
\frac{1/6\ \text{fatalities/year}}{3.59\times 10^8\ \text{hours/year}}
= 4.64\times 10^{-10}\ \text{fatalities/hour}.
$$

Because actual risk is much greater than accepted risk, risk reduction is mandated. The derived safety goal is “Prevent collision between a road vehicle and a vulnerable road user at crosswalks,” and the behavioral safety requirement is “If a crosswalk is detected, detect pedestrians’ crossing intention reliably” [2302.07715].

This example clarifies an important point about ALARP in emerging domains. Salem et al. explicitly state that ISO 21448 mentions ALARP but leaves open how to apply it to automated driving. The RMC therefore supplies process scaffolding—hazard logs, risk estimates, safety goals, safety measures, and iteration—rather than a completed socio-technical definition of “reasonably practicable.” A common misconception is that application of current safety standards alone yields an explicit ALARP justification. The papers considered here instead indicate that standards often provide process obligations or implicit guidance, whereas explicit ALARP claims require quantitative risk representation, comparison against accepted thresholds or baseline practice, and a documented argument that further risk reduction is not reasonably practicable [2302.07715] [1404.7528].

Source: https://www.emergentmind.com/topics/as-low-as-reasonably-practicable-alarp