Uncertainty Elicitation and Propagation in GSN Models of Assurance Cases

Abstract

Goal structuring notation (GSN) is commonly proposed as a structuring tool for arguing about the high-level properties (e.g. safety) of a system. However, this approach does not include the representation of uncertainties that may affect arguments. Several works extend this framework using uncertainty propagation methods. The ones based on Dempster-Shafer Theory (DST) are of interest as DST can model incomplete information. However, few works relate this approach with a logical representation of relations between elements of GSN, which is actually required to justify the chosen uncertainty propagation schemes. In this paper, we improve previous proposals including a logical formalism added to GSN, and an elicitation procedure for obtaining uncertainty information from expert judgements. We briefly present an application to a case study to validate our uncertainty propagation model in GSN that takes into account both incomplete and conflicting information.

Confidence assessment in safety argument structure - Quantitative vs. qualitative approaches

“…Attenuation and amplification effects. As presented in the application of section 3.4, in the case of a C-Arg (the most encountered argument in our state of the art study), we can have premises with high credibility assessment and yet end up with a conclusion with little credibility [16]. A similar problem (this time amplification) occurs with D-Arg.…”

“…A real world case study is provided in [16], but we propose here a smaller generic example to illustrate our approach. We consider a situation with two premises p 1 and p 2 supporting a conclusion C. Then, we set the belief on rules to the values in Table 4 according, respectively, to the C-Arg, D-Arg and H-Arg and propagate confidence from premises to the conclusion.…”

“…This paper relies on and completes preliminary works presented at conferences [14,15,16]. It is structured as follows.…”

“…2 for the detailed calculation of the conflict mass.Note that in the expression(16) of Bel(C) and Disb(C), we first directly calculate expressions of the form b(C) = ϕ|=C m (n) (ϕ) and d(C) = b(¬C) = ϕ|=¬C m (n) (ϕ) that include the term m (n) (⊥), butare easier to compute than Bel(C) and Disb(C). Then we subtract the term m (n) (⊥) calculated recursively in a separate way (see Appendix A.2).…”