Belief Functions for Safety Arguments Confidence Estimation: A Comparative Study

Abstract

Structured safety arguments are widely applied in critical systems to demonstrate their safety and other attributes. Graphical formalisms such as Goal Structuring Notation (GSN) are used to represent these argument structures. However, they do not take into account the uncertainty that may exist in parts of these arguments. To address this issue, several frameworks for confidence assessment have been proposed. In this paper, a comparative study is carried out on three approaches based on Dempster-Shafer theory. We extract and compare the implicit logic at work in these works, and show that, to some extent, these current approaches fail to provide a consistent relationship between the informal statement of arguments, their logical model and the use of belief functions. We also propose recommendations to improve this consistency.

Quantifying Confidence of Safety Cases with Belief Functions

“…In [6], we compared some works that deal with confidence assessment in GSN and give some recommendation to improve these methods. For instance, we showed why it is more adequate to use implication instead of equivalence (used in [13][14][15]) to represent argument types.…”

“…This logical relation could be assimilated to the strategy component in a GSN (e.g., S1). When adopting a logical viewpoint [6], we then speak of a rule. Unlike the types of arguments proposed in [14], which use the equivalence connective to model such rules, we decided to break down this equivalence into two implications.…”

Logically Sound Arguments for the Effectiveness of ML Safety Measures

“…The exercise demonstrated in this paper clearly shows the benefits and challenges of precisely formulating all claims and goals into logical formulae. Many existing results [6,22,20,10] consider connecting semi-formal argumentation with Dempster-Shafer theory and apply evidence combination using rules such as Dempster's [8] or Yager's [21] rules. However, as pointed out in this paper, the translation and the generated evidence shall only be viewed as claims due to a lack of logical derivation.…”

“…(Towards quantitative argumentation) The example demonstrated in Figure 4 also provides an example on the limitation of using semi-formal notations for quantitative argumentation suggested by earlier results. Even when E1 and E2 have 100% confidence of being correct, one may be tempted to use evidence combination theory such as Dempster's rule on structural argumentation [6,22,20,10] and to conclude that G1 holds with 100% confidence. Nevertheless, based on the logical deduction, G1 does not hold without E3.…”

“…Finally, moving towards quantitative argumentation, the failed logical deduction highlights the limitation of existing semi-formal approaches in evidence combination based on Dempster-Shafer's evidence theory [19,10]. Precisely, when using GSNs in the SOTIF context, the computed probability based on evidence combination shall be viewed as a claim or as an upper bound.…”