How do practitioners gain confidence in assurance cases?

Hawkins et al. separate an AC’s argument into two independent, but connected structures [33]. The main argument captures the fundamental rationale for why a system is assured. The secondary confidence argument provides an additional layer of argumentation to describe why authors believe the claims in the main argument. The two arguments are connected through Assurance Claim Points (ACPs). Hawkins et al. use GSN to describe both arguments and denote the claim points where the arguments intersect as shaded rectangles attached to the links (edges) in the GSN structure. Their motivation for proposing the ACP method is to simplify the main assurance argument such that it can be easily understood by readers, and detailed confidence arguments are still available for those that wish to examine them. Hawkins et al. recently described a variant of ACPs, which they call operational claim points (OCPs), aimed at capturing arguments for why an AC remains valid while the system is in operation [23].

ACs are vulnerable to confirmation bias where authors favour arguments and evidence they already believe to be true without considering alternative perspectives which has contributed to severe accidents [47, 32]. Dialectic argumentation is a method where ‘‘challenges’’, ‘‘defeaters’’, ‘‘counter-claims’’, or ‘‘weakeners’’ representing doubt or uncertainty in either the argument or supporting evidence are raised against an argument’s positive claims [57]. Dialectic argumentation has been incorporated into several structured AC notations, including Toulmin’s notation [58], GSN [9, 31], Eliminative Argumentation (EA) [28], Friendly Argument Notation [38], Assurance 2.0 [11], and the structured assurance case meta-model (SACM) [4]. Throughout the remainder of this paper we use the term ‘‘defeater’’ to refer to dialectic argumentation. There are several reports in the literature of defeaters being used by practitioners to address confirmation bias for real-world systems[35, 17, 49, 54]. Once expressed in an argument, a defeater can be ‘‘resolved’’ through further argumentation or by providing additional evidence. However, there are differing perspectives on how to interpret resolved defeaters and the implications for confidence in the AC [18]. The ‘‘deductive perspective’’ suggests that resolving a defeater should strictly return the argument to a neutral state, as if the defeater had never existed. Alternatively, the ‘‘defeasible reasoning’’ perspective advocates that some additional credit should be earned for the extra work required to both identify and resolve the defeater, and thus have a net positive effect on confidence [27].

Holloway and Wasson propose the iTest method for qualitatively evaluating arguments [39]. While they have described their method in terms of the Friendly Argument Notation (FAN) [38], the underlying concepts are broadly applicable to other notations and approaches for expressing arguments. The iTest method is performed iteratively, where compound arguments have their atomic sub-arguments isolated and interrogated. Each atomic argument is assessed using the SPRY mnemonic as a guide: ‘‘is the Syntax proper?’’, ‘‘are the Premises acceptable?’’, ‘‘is the Reasoning acceptable?’’, and ‘‘is saying Yes to the conclusion justified?’’ [39]. iTest has seen early use in the context of evaluating whether aerospace systems possess desirable ‘‘over-arching properties’’ [62].

Several proposals to use Bayesian Networks (BNs) to assess confidence exist [16, 36, 65, 52]. This family of methods typically models an argument structure as a Bayesian Network (BN) and then assigns a probabilistic valuation to the leaves of the argument structure which is propagated through the BN using the laws of probability. Sometimes the user of the method must select additional parameters (e.g., ‘‘weights’’) to adjust the propagation through the argument. For instance, Hobbs and Lloyd’s method requires that analysts provide a ‘‘belief’’ valuation (a subjective probability in $[0,1]$) for each leaf node of the argument, an additional link parameter for each parent-child relationship, a combinator parameter (i.e., ‘‘AND’’ or ‘‘OR’’), and a leakage parameter for each parent node in the argument. Once all inputs and parameters are given the method uses a BN to compute the degree of belief (as a probability) in the argument’s top-level claim [36, 18].

Another family of quantitative CAMs relies on a mathematical framework called Dempster-Shafer Theory (DST) (also called ‘‘evidence theory’’ or ‘‘evidential reasoning’’) [56]. These CAMs typically consider confidence as being composed of three concepts: belief, disbelief, and uncertainty that are linked according to a constraint known as Jøsang’s triangle [14, 10, 61, 40, 42]. The most recent method proposal in the DST family is from Idmessaoud et al. [40]. In their approach an analyst provides two valuations to each leaf of the argument: a ‘‘decision’’ and the ‘‘confidence’’ (uncertainty) in the decision. Then for each parent-child relationship the analyst also provides forward and backward relation parameters describing the relationship between the parent and child. Further, for each parent two more parameters are required to describe the support for the parent in terms of all of its children. Once all inputs and parameters are given, the method uses DST to compute a decision and confidence (uncertainty) for the argument’s top-level claim.

Possibilistic Logic (PL) is a formalism for reasoning based on ‘‘possible’’ and ‘‘necessary’’ outcomes using fuzzy set theory [21, 64]. Idmessaoud et al. applied PL to address several limitations they observed with their DST-based approach, such as confidence amplification and attenuation effects caused by fractions being multiplied together during confidence propagation [40]. Given that Idmessaoud et al.’s PL-based approach is quite new, there are no reports of it being used for real-world systems yet.

Subjective Logic (SL) is another formalism for reasoning under uncertainty developed by Jøsang [42]. Like DST, SL encodes confidence in terms of three quantities: belief, disbelief, and uncertainty, which are called ‘‘opinions’’. However, unlike DST, it also provides a mathematical ‘‘bridge’’ to express confidence in terms of probability distributions, namely the beta distribution, where the mean value of the distribution encodes belief and the variance captures uncertainty. Since SL is a logic, it provides several operators that can be used to propagate confidence. Several authors have proposed CAMs based on SL [20, 63, 34]. The most recent is by Herd et al., which applied SL to an argument fragment focused on autonomous vehicle perception [34].

A survey of quantitative CAMs would be incomplete without mentioning Graydon’s and Holloway’s work on the validity of these methods [30]. In summary, Graydon and Holloway selected several qualitative CAMs and attempted to independently reproduce the worked examples in the related publications with minimal success or found that the results the CAMs generate are ‘‘implausible’’. This suggests that, even though these methods are built on rigorous mathematical frameworks, additional work is required to validate them for practical use. Graydon and Holloway concluded that quantitative CAMs ‘‘require further validation before they should be recommended as part of the basis for deciding whether an assurance argument justifies fielding a critical system’’ [30].

If an argument is prepared using defeaters, then Goodenough et al. propose that confidence can be measured using a Baconian Probability (BP) [27]. BP’s are expressed as $x|y$ where $y$ is the total number of defeaters in the argument and $x$ is the number of resolved defeaters. Note that BPs should not be interpreted as a conventional probability in $[0,1]$, rather they should be read as ‘‘$x$ out of $y$’’). BPs are based on the notion of defeasible reasoning, where one’s confidence increases as reasons to doubt a claim’s truth are enumerated and resolved. However, the magnitude of the increase is not defined. Goodenough et al. originally proposed using BPs to evaluate ‘‘confidence maps’’, which were the precursor to the notation now referred to as Eliminative Argumentation [28]. Some authors have described limitations about the use of BPs as means of quantifying confidence [17, 29].

Bloomfield and Rushby proposed the ‘‘Assurance 2.0’’ framework, which considers three complementary perspectives: positive, negative, and residual [11]. Confidence in Assurance 2.0 first comes from building sound arguments in the positive perspective, then ‘‘confirmation measures’’ using subjective probability valuations can be used to quantify confidence in the positive perspective. In the negative perspective, the analyst identifies (and aims to resolve) defeaters to the positive argument. The argument is said to be valid if all defeaters are resolved. The residual perspective considers unresolved defeaters, which must be accepted to complete the AC.

Participants were asked to describe their number of years of professional work experience, both for general activities (not necessarily assurance related work) and working in systems assurance. Overall, the group of participants was relatively experienced, with an average of 23 years of general professional experience and 16 years of systems assurance experience. Additionally, seven participants had more than 35 years of general professional experience. Table 1 contains a more detailed breakdown of the participants’ experience.

Participants were asked to describe the industries they have worked within, both for general activities (not necessarily assurance related) and those for which they have contributed to an AC. The automotive industry (including autonomous vehicles) was the most well represented ($n=9$, $47\%$). Other well represented areas were aviation ($n=7$, $37\%$) and defence ($n=6$, $32\%$). Table 2 contains a detailed breakdown of industries. Note that many participants reported experience in multiple industries.

Preparing an AC is a significant undertaking, typically performed by multiple persons who assume different roles. Participants were asked what role(s) they had assumed while contributing to ACs. The most common role was ‘‘reviewer’’ (i.e., peer or internal reviewer), with most ($n=16$, $84\%$) participants indicating they had experience reviewing ACs. Further, a majority of participants ($n=14$, $74\%$) also had experience contributing as a ‘‘developer’’ (i.e., author, creator). Less common roles included ‘‘approver’’ ($n=5$, $26\%$), ‘‘manager’’ ($n=4$, $21\%$), and ‘‘auditor’’ ($n=8$, $42\%$). Note that many participants reported experience with multiple roles.

Though geography was not a key factor considered when sampling for this study, the sample we obtained contained participants from a range of locations: North America ($n=13$), the United Kingdom ($n=4$), and Europe ($n=2$).

An overview of the final codebook generated during open coding is shown in Table 3. Codes were organized into a two-level hierarchy with the first level consisting of six ‘‘categories’’ and the second level containing 54 detailed codes. Two additional categories (Impact and Importance) were used to code the responses of multiple-choice questions, which had a closed set of potential answers/responses for the participants to pick from. In total, 605 codes were assigned as part of the open coding analysis. The most common category of codes used was Methods (assigned to 207 lines) followed by Barriers (assigned to 135 lines), which is not surprising given that these topics are related to the core purpose of this study. Detailed results for each code category are presented below in Section 4.3.

Each analyst independently coded each interview transcript before meeting to discuss (and potentially modify their assigned codes). Agreement between analysts was computed before and after their discussion at both the categorical and detailed code level, using the calculation described in Section 3.3.2. Across all interview transcripts, before discussion, the analysts agreed on an average of 71% of code assignments per transcript line at the categorical level and an average of 57% of assignments per transcript line at the detailed code level. After discussion, agreement was measured to be an average of 98% per line at the categorical level and an average of 97% per line at the detailed code level. For reference, for the final codebook consisting of 61 detailed codes, if codes were randomly assigned with equal probability, the average level of agreement per transcript line would be approximately $1.86\%$²²2We verified this using a statistical simulation of our agreement calculation over a 100,000 transcript lines that had randomly assigned codes, including accounting for the possibility that analysts picked different numbers of codes..

Compliance with regulations, technical standards, contractual, or organizational requirements is a principal motivator for preparing ACs. Practitioners also widely recognize that ACs are useful for documenting assurance arguments in a structured and systematic manner, for communicating with interest holders and decision makers, and evaluating assurance-related evidence. Some practitioners view ACs as ‘‘live’’ and holistic models of assurance that evolve alongside the system being developed.

Structured notations (e.g., GSN, CAE, EA, SACM) are now widely used by practitioners to express assurance arguments and are generally favoured as a means of organizing assurance-related information. However, some concerns exist related to the complexity of structured notations distracting from the essential purpose of ACs as a means to capture clear assurance arguments. Further, despite wide use of structured notations, narrative expression of ACs is still common, with many practitioners having experience with both structured notations and narratives.

Review is a very common³³3We hesitate to say that review is “universally” used because of our modest sample in this study, but it is worth noting that all participants identified review as a method. means of assessing and increasing confidence in ACs, with some practitioners also using systematic review methods to ‘‘interrogate’’ an argument. Checklists derived from standards, guidance documents, organizational practices, and experience are used as review criteria to confirm all necessary topics have been addressed. Despite the clear importance of review, there might be an over-dependence on this as the only confidence assessment method, suggesting practitioners might value complementary methods. Dialectic argumentation (i.e., ‘‘defeaters’’ or ‘‘challenges’’) is also widely used as a means of mitigating bias in arguments. However, there are open methodological questions about the use of dialectic methods such as the absence of clear ‘‘stopping’’ criteria, handling of resolved defeaters, and distinguishing between genuine argument defeaters versus claims. While many practitioners are aware of quantitative methods for confidence assessment (e.g., BBNs, DST), they have seen very limited use for real-world ACs. Further, many practitioners have negative opinions of quantitative methods due to: a lack of confidence that the methods produce trustworthy results; loss of information when confidence is expressed as a number; difficulty explaining or justifying assessment results to interest holders or regulators; and volume of inputs required to use the method.

The results from confidence assessments are generally used to communicate to interest holders, understand the qualitative risk associated with the system, and improve the quality of an ACs argument or supporting evidence.

There are many barriers or challenges inhibiting the use of CAMs. First, these activities are perceived as adding to the workload of assurance experts, especially for qualitative methods that require a human to provide many inputs as part of the assessment. Second, there is also a lack of accessible guidance and training material on the theoretical basis for CAMs and how to select and apply in practice. Third, confidence assessment is seen as a subjective activity that produces variable results that can be difficult to interpret. Fourth, quantitative methods are relatively immature and there is a lack of empirical evidence to show they are trustworthy. Finally, the overall adoption of ACs as a system assurance method remains a limiting factor to practitioners applying AC confidence assessment: without an AC confidence cannot be assessed.