Yassir Idmessaoud
email: yassir.id-messaoud@laas.fr

Didier Dubois
email: bdubois@irit.fr

Jérémie Guiochet
email: jeremie.guiochet@laas.fr

Confidence assessment in safety argument structure -Quantitative vs. qualitative approaches

Keywords: Assurance cases, Safety cases, Dempster-Shafer Theory (DST), Confidence propagation, Expert elicitation, Goal Structuring Notation (GSN), Qualitative Capacity Theory (QCT)

Some safety standards (e.g., ISO 26262 in automotive industry) propose the use of argument structures to justify that the high-level safety properties of a system have been ensured. The goal structuring notation (GSN) is a graphical tool used to represent these argument structures. However, this approach does not address the uncertainties that may affect the validity of the arguments.

Thus, some authors proposed to complement GSN patterns with a quantitative confidence assessment procedure. In this paper, we first present a refined procedure that expresses the relation between premises (pieces of evidence) and the conclusion (top-goal to be demonstrated) using logical expressions. Then using Dempster-Shafer theory, we quantify uncertainty on each expression to build an explicit mathematical formula for propagating uncertainty to the conclusion.

Inputs for the propagation model are collected from experts and transformed into numerical values using an improved elicitation model. Afterwards, we introduce a purely qualitative alternative to the quantitative procedure based on the theory of qualitative capacities. Finally, we adapt the propagation and elicitation models to this framework.

Introduction

Safety critical systems developed in industries such as aerospace, railway or automotive are more and more complex. Hence more reliable safety assessment procedures are needed. For instance, the development of technologies based on artificial intelligence (e.g. machine learning) rises the issue of safety, since these techniques are not yet fully understood nor covered by safety standards.

Argument structures are often used to argue in favor of safety. The so-called Goal Structuring Notation (GSN) is used to replace textual argument structures that are not always easy to operate. This graphical tool is well structured, clear and concise (compared to the text format). It allows a better visualization and understanding of the arguments. It explains how a top goal is reached by providing a body of evidence supporting it. Nevertheless, it has been noticed [START_REF] Graydon | An investigation of proposed techniques for quantifying confidence in assurance arguments[END_REF] that this representation poorly describes how the pieces of evidence interact to support a goal nor does it assess how much evidence-based confidence can be granted to them. This point raises the issue of uncertainty management in argument structures. Two main challenges emerge: (1) how to propagate uncertainties in argument structures, and (2) how to feed these structures with expert opinions ? Several works already proposed mathematical models to quantify and propagate confidence/uncertainty in graphical representations of argument structures like GSN. Graydon and Holloway [START_REF] Graydon | An investigation of proposed techniques for quantifying confidence in assurance arguments[END_REF], as well as Duan et al. [START_REF] Duan | Reasoning about confidence and uncertainty in assurance cases: A survey[END_REF], stated and discussed proposals that deal with the issue of uncertainty. An important number of approaches used probability theory to model uncertainty and propagate it with Bayesian networks [START_REF] Denney | Towards measurement of confidence in safety cases[END_REF][START_REF] Guiochet | A model for safety case confidence assessment[END_REF]. More specifically, some authors [START_REF] Nešić | A probabilistic model of belief in safety cases[END_REF] transform a GSN into a Bayesian network (BBN) and propagate probabilities accordingly. Due to the limited expressiveness of the probabilistic framework, such approaches can properly deal with uncertainties due to aleatory phenomena, but they poorly represent epistemic uncertainties due to incomplete information. In addition, these methods are also very greedy in terms of data, which requires a lot of time in order to collect and process. Other approaches, like in elicitation models. Finally, in section 5, we present our confidence assessment procedure which relies on the two previous models and conduct a preliminary comparison between the quantitative procedure and its qualitative counterpart.

Background

This section defines safety argument structures and introduces a graphical formalism used to model them known as Goal Structuring Notation (GSN). We also present some basic concepts and tools of Dempster-Shafer Theory (DST) and Qualitative Capacity Theory (QCT).

Safety argument structures

A safety argument structure, or safety case is a document that gathers a body of solid and reliable evidence demonstrating that a system is acceptably safe to accomplish a given function (or task) under given circumstances. These documents can be used, for instance, as certification tools in safety critical fields, such as automotive, railway and aerospace industries. Goal structuring notation (GSN), defined in [START_REF] Kelly | Arguing safety -a systematic approach to safety case management[END_REF], is a non-formal graphical tool, inspired from Toulmin argumentation studies [START_REF] Toulmin | The Uses of Argument[END_REF]. As presented in Figure 1, it breaks down a top claim, called "goal ", into elements, called "sub-goals" according to a "strategy" (that justifies this decomposition choice) and following a specific "context" and "assumptions" (restricting the argumentation to their contents). It also provides each sub-goal with a reference to pieces of evidence supporting it, called "solutions". The "justification" component gives the rationale behind the adoption of a strategy or the presentation of a goal. These seven elements can either be connected with an "in context of " link relating an item to the context component or by a "supported by" link which relates the remaining items.

Figure 1, represents a typical hazard avoidance GSN pattern. To be considered as "acceptably safe" (G 1 ) all hazards (from G 2 to G n ) of the system (X), listed in the context box (C 1 ), should be provably handled (Sn 1 , Sn 2 , ...) following the strategy (S 1 ). The diamonds connected to the sub-goals (i.e, G n ) means that they have not yet been achieved. "Assurance case" is a general term that includes argument structures justifying properties beyond safety (e.g, security, reliability, etc).

Dempster-Shafer Theory

Dempster-Shafer theory (DST) (aka Theory of Evidence) [START_REF] Shafer | A mathematical theory of evidence[END_REF] was developed to address the issue of imprecise evidence [START_REF] Sentz | Combination of evidence in dempster-shafer theory[END_REF]. It represents a form of generalized probability theory where probability masses are assigned to sets of possible values, instead of singletons. The idea is that there is not enough information to share a probability mass assigned to a subset among its elements. DST offers tools to model and propagate both aleatory (due to random events) and epistemic uncertainty (due to ignorance).

A mass function, or basic belief assignment (BBA), is a probability distribution over the power set of the universe of possibilities (Ω), known as the "frame of discernment". Formally, a mass function m Ω : 2 Ω → [0, 1] is such that E⊆Ω m(E) = 1, and m(∅) = 0. Any subset E of Ω such as m(E) > 0 is called a focal set of m. m(E) quantifies the probability that we only know that the truth lies in E; in particular m(Ω) quantifies the amount of ignorance.

A mass assignment induces a so-called belief function (Bel : 2 Ω → [0, 1]).

It represents the sum of all the masses supporting a statement of the form x ∈ A ⊆ Ω (x is the ill-known entity of interest); the belief function is defined by:

Bel(A) = E⊆A,E̸ =∅ m(E). (1)
Belief in the negation ¬A of the statement A is called disbelief and is represented by: Disb(A) = Bel(¬A); the value U ncer(A) = 1-Bel(A)-Disb(A) quantifies the lack of information about A. It is maximal where there is neither belief nor disbelief in A. In this paper, we shall use non-dogmatic belief functions such that m(Ω) > 0, categoric ones, such that m(E) = 1 for a single non-empty set, and simple support belief functions that are non-dogmatic ones such that 0 < m(E) < 1 for a single non-empty set E ⊂ Ω, and 0 for other subsets of Ω. In this work, a conjunctive rule of combination is used for uncertainty propagation.

It combines multiple pieces of evidence (represented by mass functions m i , with i = 1, 2, ..., n) coming from independent sources of information. When n = 2, we define m ∩ = m 1 ⊗ m 2 such that:

m ∩ (A) = E1∩E2=A m 1 (E 1 ) • m 2 (E 2 ) (2)
This combination rule is commutative and associative. The value m ∩ (∅) represents the degree of conflict between m 1 and m 2 . Note that for the calculation of the belief function (1) when m ∩ (∅) > 0, the condition E ̸ = ∅ makes full sense since otherwise m ∩ (∅) would appear in the expressions of belief and disbelief, then potentially violating the consistency condition Bel(A) + Disb(A) ≤ 1.

Dempster rule of combination requires an additional normalization step when

m ∩ (∅) > 0: m(A) = m ∩ (A)/(1 -m ∩ (∅)).
However, this normalisation is questionable when the value of m ∩ (∅) is close to 1. Indeed, it enforces the division by a very small number, which makes the result numerically unstable. A high level of conflict indicates we must reconsider the sources of information.

Qualitative Capacity theory

In contrast, we outline the qualitative approach in [START_REF] Dubois | A possibilistic counterpart to Shafer evidence theory[END_REF][START_REF] Dubois | Qualitative capacities and their informational comparison[END_REF][START_REF] Dubois | Qualitative capacities: Basic notions and potential applications[END_REF]. Let L be a finite totally ordered set representing certainty levels. In Ω, the universe of possibilities (frame of discernment), a qualitative capacity (q-capacity, for short) is a function γ : 2 Ω → L such that:

γ(∅) = 0; γ(Ω) = 1; A ⊆ B ⇒ γ(A) ≤ γ(B)
Any q-capacity can be put in the form:

γ(A) = max ∅̸ =E⊆A ρ(E), ∀A ⊆ Ω ( 3
)
where ρ is formally a basic possibility assignment (BΠA) [START_REF] Dubois | A possibilistic counterpart to Shafer evidence theory[END_REF], namely, a possibility distribution ρ : 2 Ω → L on the power set of Ω, such that max E⊆Ω ρ(E) = 1 and ρ(∅) = 0. The value ρ(E) is the strength of piece of evidence E. Note the similarity between (3) and the definition of the belief function (replacing the sum by the maximum). However, several BΠA's can generate the same γ, the least of which is the qualitative Moebius transform (QMT) of γ such that:

γ # (A) =      γ(A) if γ(A) > γ(A \ {w}), ∀w ∈ A; 0 otherwise. (4)
In the paper, we shall use non-dogmatic q-capacities such that ρ(Ω) = 1, and simple support q-capacities that are non-dogmatic ones such that 0 < ρ(E) ≤ 1 for a single non-empty set E ⊂ Ω, and 0 for other subsets of Ω. The value γ(A) (resp. γ(¬A)) qualifies the support in favor of (resp. against) A, i.e. belief (resp. disbelief) in A using an element in the qualitative scale L. The pair (γ(A), γ(¬A)) thus describes our epistemic stance with respect to A in terms of belief and disbelief, ranging from no information (i.e., (0, 0)), to full conflicting information (i.e., (1, 1)), from full belief (i.e., (1, 0)) to full disbelief (i.e., (0, 1)). This is more general than possibility theory where the case (1, 1) is not allowed.

Figure 2 presents the credibility and information orderings on pairs (belief, disbelief) including extreme cases [START_REF] Dubois | Qualitative capacities: Basic notions and potential applications[END_REF]. A proposition A is at least as credible as A is at least as informed as B if A is at least as supported as B, and ¬A is at least as supported as ¬B, i.e., γ(A) ≥ γ(B) and γ(¬A) ≥ γ(¬B) (dotted arrows from B to A); it thus ranges from ignorance ((0, 0), no information) up to conflict ((1, 1), full contradictory information). When the amount of evidence supporting the conclusion is equal to the one rejecting it, we are in the situation of indecision. Equipped with these two orderings, the set L × L then possesses a bilattice structure, well-known in inconsistency-tolerant logics (more details in [START_REF] Dubois | Qualitative capacities: Basic notions and potential applications[END_REF]).Note that the credibility and information orderings make sense in the quantitative case as well, comparing pairs (Bel(A), Disb(A)). However, the full conflict situation corresponds to (Bel(A), Disb(A)) = (0.5, 0.5).

B if A is at least
In order to qualitatively combine pieces of evidence represented by possibilistic mass functions, i.e., BΠA's ρ i , coming from several sources of information, the qualitative counterpart of the conjunctive rule of combination for belief functions is: [START_REF] Dubois | Qualitative capacities: Basic notions and potential applications[END_REF]:

ρ ∩ = ρ 1 ⊙ ρ 2 such that
ρ ∩ (A) = max E1∩E2=A {min[ρ 1 (E 1 ), ρ 2 (E 2 )]} (5)
This is similar to (2), replacing sum by maximum and product by minimum.

However, due to the use of the (idempotent) minimum operation, the combined pieces of evidence are not supposed to be independent. The result is not always a BΠA, strictly speaking. First we may have that ρ ∩ (A) < 1 for all A. So we must add the condition ρ ∩ (Ω) = 1, which makes the combination nonassociative [START_REF] Dubois | Qualitative capacities: Basic notions and potential applications[END_REF]. This will not occur if we restrict to non-dogmatic BΠA's such that ρ i (Ω) = 1, which we assume in this paper. Under this restriction, the qualitative combination rule is associative. Besides, we may have that ρ ∩ (∅) > 0, indicating conflict between the pieces of evidence.

Quantitative confidence elicitation and propagation models

In order to assess confidence in GSN, we first need to collect assessments about its components and transform them into usable format in the setting of DST (i.e. belief and disbelief measures). Then, we need to propagate them to the top-goal while taking into account the relation between GSN elements, notably those between a goal and its sub-goals that we will respectively call conclusion and premises in the following.

A logical approach to GSN

Apart from the relationship "supported by" (between a goal and its subgoals) or "in context of " (between a goal and its context), a GSN does not explicitly specify the nature of the relation between a top-goal and its subgoals. These relations are essential to justify the choice of the uncertainty propagation schemes to be used. Wang et al. [START_REF] Wang | Confidence in safety argument-an assessment framework based on belief function theory[END_REF][START_REF] Wang | Safety Case Confidence Propagation Based on Dempster-Shafer theory[END_REF] proposed the use of equivalence (≡) to express the relation between a conclusion and its premise(s).

This choice assumes that the expert has information to both validate or refute the conclusion, based on the truth or the falsity of the premise. To remain more flexible about the state of knowledge where the expert could have only information to validate, or the one to refute the conclusion or both, we decided to use material implication (denoted by ⇒). In the following, we use Boolean variables 1 to represent premises (p) and the conclusion (C). When the premise is sufficient to validate the conclusion, we use p ⇒ C = ¬p∨C; when the falsity of the premise is sufficient to invalidate the conclusion, we use ¬p ⇒ ¬C = p ∨ ¬C;

when both statements are true, using two implications is the same as using

equivalence, i.e. ([p ⇒ C] ∧ [¬p ⇒ ¬C]) ⇔ (p ≡ C).
On the other hand, the GSN formalism does not either specify the relation between sub-goals (premises) in their support to the goal (conclusion). From a purely logical standpoint, when a conclusion is supported by more than one premise, we identify two types of links between them: logical conjunction (e.g.

p 1 ∧ p 2
) and logical disjunction (e.g. p 1 ∨ p 2 ).

Quantitative confidence elicitation model

Experts can be uncertain about the truth or the falsity of pieces of information they specify in a GSN. In this section, we present how to qualitatively express an expert judgment on a statement and how to turn qualitative uncertainty into quantitative belief values in DST.

Collecting expert data

To assess uncertainty of a proposition, say x, the expert is supposed to provide two pieces of qualitative information:

• A level of decision Dec on a qualitative scale, which describes a trend from acceptance (maximal belief) to rejection (maximal disbelief) of a proposition.

• A level of confidence Conf , on a qualitative scale, which reflects the amount of information an expert possesses that can justify his/her decision.

Each expert judgment, expressed in the form of a decision and the degree of confidence associated to it, is collected using an evaluation matrix presented in

From symbolic to numerical data

The symbolic scale of confidence (from C1 to C6 in Figure 3) is associated to a numerical scale between 0 and 1. We choose a linear scale for transforming qualitative pairs (Dec, Conf ) into numerical values like in header columns and rows of Table 1. Choosing a scale for (Dec, Conf ) and translating such pairs into numerical degrees is not trivial, we thus make the equidistance assumption for simplicity and to be comparable to previous works [START_REF] Cyra | Support for argument structures review and assessment[END_REF][START_REF] Wang | Modelling Confidence in Railway Safety Case[END_REF]. This choice will be discussed in section 4.

When Conf (x) = 1, it means that the expert has full information supporting his choice of Dec(x). While, when Conf (x) = 0, it means that he has no information to accept or deny x.

Deriving belief and disbelief degrees

Formally, confidence is defined as summation of belief (evidence in favor of the proposition) and disbelief (evidence against the proposition) degrees.

Conf (x) = Bel(x) + Disb(x) (6)
In the same way each item of the decision scale (from D1 to D5 in Figure 3) is associated with a numerical value, which can be understood as the probability of acceptance. For instance, when Dec(x) = 1 it indicates a full certainty on the truth of x. On the other hand, when Dec(x) = 0 it indicates a full certainty of its falsity. And, when for some reason the expert cannot take side, Dec(x) = 1/2.

Formally, we define the decision as the result of the Pignistic transform [START_REF] Smets | Decision making in the TBM: the necessity of the pignistic transformation[END_REF] that turns a mass function m on a set Ω x (the frame of discernment) into a probability, changing the focal sets into uniform distributions. When Ω x = {x, ¬x} has two possible states, as it is the case here, Dec(x) is the midpoint of uncertainty interval between belief and plausibility of x.

Dec(x) = 1 + Bel(x) -Disb(x) 2 (7)
Note that when Bel(x) = Disb(x) (= 0, in particular), we get Dec(x) = 1/2.

From equations ( 7) and ( 6), we get:

Bel(x) = Conf (x) -1 2 + Dec(x), Disb(x) = Conf (x) + 1 2 -Dec(x) (8)
The degree of uncertainty can easily be deduced (U ncer(x) = 1 -Bel(x) -Disb(x)). The expert is allowed to choose any pair (decision, confidence) -a dot in Fig 3 . However, some of these assessments cannot be interpreted by pairs (Bel(x), Disb(x)), in particular clear-cut decisions (acceptance or rejection, i.e., Dec(x) = 1 or 0) with low confidence degree. A constraint known as "Josang constraint" [START_REF] Jøsang | Subjective logic[END_REF] needs to be respected between Conf (x) and Dec(x). Otherwise, the transformation (Dec, Conf ) to (Bel, Disb) will lead to values outside the unit interval [0, 1].

Enforcing Bel(x), Disb(x) ∈ [0, 1], expressions in (8) yield 1 -Conf (x) ≤ min(2Dec(x), 2(1 -Dec(x)). Hence, we can express the feasibility range of Dec(x) for a given confidence level as:

1 -Conf (x) 2 ≤ Dec(x) ≤ 1 + Conf (x) 2 (9)
which defines a triangle in the evaluation matrix (Figure 3). Graphically, the assessments outside the triangle are those that do not respect the constraint and thus lead to negative belief (black dots) or negative disbelief (grey dots) values, which make no sense.

As a consequence, when the expert makes a clear-cut decision (acceptance Dec(x) = 1 or rejection Dec(x) = 0) the confidence must be maximal (Conf (x) = 1, fully informed expert), otherwise his/her decision assessment will have no grounds. The closer you get to the midpoint value (Dec(x) = 1/2, no decision), the larger the allowed confidence interval will be. The pair (Dec(x) = 1/2, Conf (x) = 0) means that the expert cannot take side because he/she has no information (total ignorance), while (Dec(x) = 1/2, Conf (x) = 1) means that he/she cannot take side because he/she has as much evidence in favor of the premise as against (total conflict).

When the pair (Dec(x), Conf (x)) provided by an expert is situated outside the triangle, we make a correction. As confidence reflects the amount of information, we keep it and modify the Dec value. When Dec(x) < 1-Conf (x)

2

(rejection: black dots on Figure 3), we set Dec(x) = 1-Conf (x)

2

. On the other hand, when Dec(x) > 1+Conf (x)

2

(acceptance: grey dots on Figure 3), we set

Dec(x) = 1+Conf (x) 2 .
Example 1. Suppose we have the following assessments on two premises (p 1 )

and (p 2 ):

• p 1 : Opposable with high confidence (Dec(p 1 ) = 0.25, Conf (p 1 ) = 0.6).

• p 2 : Acceptable with very high confidence (Dec(p 2 ) = 1, Conf (p 2 ) = 0.8).

We calculate Bel(p i ) and Disb(p i ) using [START_REF] Yaghlane | Elicitation of expert opinions for constructing belief functions[END_REF]. We notice that the assessment for p 1 is inside the triangle in the matrix (Figure 3). We can therefore claim that there is no need to adjust the values according to Josang constraint (Eq. 9): On the other hand, the assessment for p 2 is situated outside the triangle. In this case, we can be sure that the decision degree must be adjusted in accordance with the confidence value to get correct inputs. Before adjustment, we find: 1) value of disbelief, which does not make sense. Following the discussion above,

Bel(p 1 ) = 0.
Bel(p 2 ) = 0.8-1 2 + 1 = 0.9 and Disb(p 2 ) = 0.8+1 2 -1 = -0.1, a negative
C1 (0) (0,0) (0,0) (0,0) (0,0) (0,0) C2 (0.2) (0,0.20) (0,0.20) (0.
we set Dec(p 2 ) = 1+Conf (p2) 2 = 1+0.8 2
= 0.9. Then we find that Bel(p 2 ) = 0.8,

Disb(p 2 ) = 0 and U ncer(p 2 ) = 1 -Bel(p 2 ) -Disb(p 2 ) = 0.2. □
In Table 1, we grouped all possible (Dec, Conf ) pairs on premises with their appropriate (Bel, Disb) counterparts. We notice that when no information is available (C1: Lack of confidence), no matter what choice is made the degree of uncertainty is maximal (U ncer(p) = 1). On the other hand, in the case of a fully informed expert (C6: For sure) the decision value varies from rejection to acceptance, which follows the restrictions imposed by "Josang constraint".

Comparison with other approaches

There are other formulas to transform a mass function into a probability distribution that can be employed instead of the pignistic transform. Shenoy transform [START_REF] Cobb | On the plausibility transformation method for translating belief function models to probability models[END_REF] is one of them. It consists in renormalizing the plausibilities of singletons, dividing each by their sum. Applying it to a two-state frame of discernment Ω x = {x, ¬x}, we get the following formula:

Dec(x) = 1 -Disb(x) 2 -[Bel(x) + Disb(x)] (10)
Notice that like the pignistic formula (equation 7) when Bel(x) = Disb(x), Dec(x) = 1/2 which expresses the situation of indecision. The decision value calculated from Shenoy transform needs also to respect Josang constraint in order to give correct belief and disbelief degrees (included in the unit interval [0, 1]). Hence, we also frame each decision between to values:

1 2 -Conf (x) ≤ Dec(x) ≤ 1 -Conf (x) 2 -Conf (x) (11)
However, the pignistic transform is a better choice to use in our situation for the following reasons:

1. The decision interval obtained by applying Josang constraint to the pignistic transform (Eq. 9) is larger than the one obtained by the Shenoy transform (Eq. 11). Figure 4 presents the feasibility areas for each transformation (triangle for Pignistic Eq. 9 and curvy inner triangle for Shenoy Eq. 11). Notice that, indeed, the usable values (not requiring adjustment)

represented by the area inside the two triangles is larger in the case where we use the Pignistic transform (triangle with plain edges) than in the Shenoy case (curvy triangle with dashed edges).

2. The decision value obtained by the pignistic transform represents the midpoint of the uncertainty interval. This is not the case with Shenoy transform, which may sound counterintuitive. Hence, with the formula of confidence (Eq. 6), which gives the length of the uncertainty interval, we can recover the uncertainty interval from its midpoint using the pignistic transform.

On the other hand, Cyra and Gorski [START_REF] Cyra | Support for argument structures review and assessment[END_REF], and Wang et al. [START_REF] Wang | Confidence in safety argument-an assessment framework based on belief function theory[END_REF][START_REF] Wang | Safety Case Confidence Propagation Based on Dempster-Shafer theory[END_REF] formally defined decision as: the conclusion (Dec = 0). These choices seem arbitrary since they are based on no evidence. It would be better to take a neutral position because no evidence is provided to justify taking side (for or against). Therefore we replace this model by the Pignistic transform.

   If Conf (x) > 0 : Dec(x) = Bel(x) Bel(x)+Disb(x) If Conf (x) = 0 : Dec(x) = 1 (Cyra & Gorski),

Quantitative confidence propagation model

Once we have defined the process of transforming experts judgments into degrees of belief, disbelief and uncertainty, we need to define how to propagate these values to the conclusion.

Sources of uncertainty in a GSN

In order to define propagation formulas to compute the confidence in the conclusion, we need to identify the sources of uncertainty in a GSN. Thus, we consider two sources:

• Uncertainty in a premise, known as trustworthiness [START_REF] Cyra | Support for argument structures review and assessment[END_REF][START_REF] Wang | Confidence in safety argument-an assessment framework based on belief function theory[END_REF], in which the truth and falsity of pieces of evidence supporting the conclusion are • Uncertainty in the support relation between a premise and its conclusion, known as appropriateness [START_REF] Wang | Confidence in safety argument-an assessment framework based on belief function theory[END_REF], in which one can doubt the truth of this support. For instance, in Figure 5 an expert may argue whether the truth of the premise is sufficient to conclude the safety of the system. This support relation is expressed in propositional logic by material implications that we call rules. They are used to justify the propagation schemes for different argument types. Formally, each rule r is assigned a simple support mass function m r [START_REF] Shafer | A mathematical theory of evidence[END_REF], such that: m r (r) + m r (⊤) = 1. Explanation of why, unlike a premise, the negation of a rule (¬r) is not taken into consideration will be given later.

Note that assessing the support relationship in GSN between a goal (a conclusion C) and its sub-goals (premises p) means assessing the chosen strategy, taking into account all the restrictions associated with it which define its scope (i.e.

context, assumption and justification components).

Argument types

Looking through the literature, four common argument types were identified.

In the following, we present and explain how confidence is propagated for a situation of one premise (p) supporting a conclusion (C), then for two premises (p 1 ) and (p 2 ) . Finally, we deduce formulas for "n" premises.

Simple argument type (S-Arg):

This argument describes the case of a conclusion (C) supported by a single premise (p), like in Figure 5. If the premise is true, then so is the conclusion.

Material implication (p ⇒ C) is used to express the inference (support) between the premise and its conclusion. It is called direct rule: it propagates the truth (belief) in p. However, implication can only infer the acceptance of the conclusion when p holds (Modus ponens pattern). When p is not true, whether the conclusion holds is unknown. An additional rule, called reverse rule in opposition to the first one, which can infer the rejection of the conclusion, will be added: ¬p ⇒ ¬C. Direct and reverse rules are designed to respectively propagate belief and disbelief degrees of the premises. Figure 5 presents an example of a simple argument. In this case, the top-goal (or conclusion) "The system is acceptably safe" is achieved, only if the premise "The test results are conclusive" is true (direct rule). Otherwise, the conclusion is false (reverse rule). For each rule (direct and reverse), we assign resp. a simple support mass function (m ⇒ and m ⇐ ), which puts a mass on the rule and the rest on the tautology (⊤) 2 summing to 1. We also assign another function to the premise (m p ), which puts a mass on the premise (p), its negation (¬p) and the tautology (⊤) summing to 1. Using the conjunctive rule of combination, we merge masses on rules (m r = m ⇒ ⊗ m ⇐ ) in Table 2; then its result is merged with m p in Table 3:

m C = m r ⊗ m p .
This approach is a special case of the general reasoning method with uncertain propositional logic formulas proposed in [START_REF] Chatalic | An approach to approximate reasoning based on Dempster rule of combination[END_REF]. To calculate the belief degree of the conclusion, we sum the masses of all formulas that infer the conclusion (C) in Table 3 (dark grey areas).

Bel C (C) = ϕ:ϕ implies C m(ϕ) = m(p ∧ C) = m p (p) × m r (p ≡ C) + m p (p) × m r (p ⇒ C) = m p (p) • [m r (p ≡ C) + m r (p ⇒ C)] = m p (p) • [m ⇒ (p ⇒ C) × m ⇐ (¬p ⇒ ¬C) + m ⇒ (p ⇒ C) × (1 -m ⇐ (¬p ⇒ ¬C))] = m p (p) • m ⇒ (p ⇒ C)
To calculate the disbelief degree of the conclusion, we sum the masses of all formulas that infer the negation of the conclusion (¬C) in Table 3 (bright grey areas). The calculation is similar to the previous one, and we get

Disb C (C) = ϕ:ϕ implies ¬C m(ϕ) = m(¬p ∧ ¬C) = m p (¬p) • m ⇐ (¬p ⇒ ¬C)
Hence, we obtain the propagation formulas for an S-Arg, in 13: S-Arg :

   Bel C (C) = Bel p (p) • Bel ⇒ (p ⇒ C) Disb C (C) = Disb p (p) • Bel ⇐ (¬p ⇒ ¬C) (13)
Remarks:

-As said earlier, since, we work on a two states frame of discernment (True, False) for both premises Ω p = {p i , ¬p i } and the conclusion Ω C = {C, ¬C}, masses and degrees of (dis-)belief in premises, rules and conclusion, are equal.

For instance, m p (p) = Bel p (p) and m p (¬p) = Bel p (¬p) = Disb p (p).

-Unlike mass functions of premises, we do not assign a mass on negations of

rules p ∧ ¬C = ¬(p ⇒ C) (resp. ¬p ∧ C = ¬(¬p ⇒ ¬C)).
First, the negation of a rule is not a rule. Moreover, we do not assume that the truth of a premise can lead to the negation of the conclusion (at least in the GSN context). Components like rebuttals, which bring evidence against the conclusion or defeaters, which specify some exceptions to the rule, do not exist in GSN. However, it is allowed to question the truth of the premise for valid reasons (e.g., expert cannot trust the experiment because test conditions are not acceptable), which is more likely to occur. Therefore, we limit ourselves only to rules that can propagate belief and disbelief in the premises. Taking disbelief in rules into consideration will only make the calculations more complex and create conflict between mass functions.

-The belief in the conclusion Bel C (C) (resp. disbelief) only depends on the belief of the direct rule Bel ⇒ (p ⇒ C) (resp. reverse rule) and the belief (resp.

disbelief) of the premise Bel p (p). Indeed, the direct rule p ⇒ C (resp. reverse rule ¬p ⇒ ¬C) and the falsity (resp. truth) of the premise p cannot infer the rejection (resp. acceptance) of the conclusion C.

Conjunctive argument type (C-Arg):

This argument type describes the case when all premises are needed to support the conclusion. The direct rule is obtained by translating this definition into a logical expression: (∧ n i=1 p i ) ⇒ C. On the other hand, the reverse one is obtained by reversing the direct one: ¬(∧ n i=1 p i ) ⇒ ¬C, which is equivalent to ∧ n i (¬p i ⇒ ¬C), a conjunction of elementary reverse rules. For instance, in

List of hazards : -Chemical leakage.

-Explotion.

(Ctx)

The battery is safe

(C)
The risk of chemical leakage is treated

(p1)
The risk of explosion is treated (p2)

   Bel C (C) = Bel ⇒ ([∧ n i=1 p i ] ⇒ C) n i=1 Bel p (p i ) Disb C (C) = 1 - n i=1 [1 -Disb i p (p i )Bel i ⇐ (¬p i ⇒ ¬C)] (14)
We can notice from the equations in [START_REF] Idmessaoud | Belief functions for safety arguments confidence estimation: A comparative study[END_REF], that the belief formula takes the form of a general conjunction (the product of belief degrees in promises weighted by the mass in the conjunctive rule). On the other hand, the disbelief formula takes the form of a general disjunction (when n = 2, the probabilistic sum 1-(1-

Disb 1 C (C)) • (1 -Disb 2 C (C)) = Disb 1 C (C) + Disb 2 C (C) -Disb 1 C (C) • Disb 2 C (C), where: Disb i C (C) = Disb i p (p i ) • Bel i ⇐ (¬p i ⇒ ¬C) the disbelief
   Bel C (C) = 1 - n i=1 [1 -Bel i p (p i )Bel i ⇒ (p i ⇒ C)] Disb C (C) = Bel ⇐ ([∧ n i=1 ¬p i ] ⇒ ¬C) n i=1 Disb i p (p i ) (15)
In opposition to the C-Arg, the belief (resp. disbelief) formula in equation [START_REF] Idmessaoud | Quantifying confidence of safety cases with belief functions[END_REF] expresses a general disjunction (resp. conjunction). The propagation scheme of this argument (D-Arg) favors the premise with the greatest strength.

Hybrid argument type (H-Arg):

This argument type describes the case where each premise supports the conclusion to some extent, but their conjunction does it to a larger extent. This argument type could be considered as a general type which includes the two previous ones. In fact, conjunctive and disjunctive types correspond to limit cases of the hybrid one. In the example of Figure 8, the premise "Test results

were conclusive" supports the conclusion to some point. Since evidence based on formal verification was also provided, which allows to identify some unsafe states that the system will never reach, experts usually do not conduct lot of tests (which are limited by issues such as cost, feasibility, etc). On the other hand, tests can cover issues that formal verification might not capture. Unlike the D-Arg, the conjunction of these two premises improves the support degree in the conclusion. To get propagation formulas (Eqs. 16) of a H-Arg for n premises, we combine the mass on rules (m

r = m ⇒ ⊗ [⊗ n i=1 m i ⇐ ] ⊗ m ⇐ ⊗ [⊗ n i=1 m i ⇒ ]
) with those on premises (m p = ⊗ n i=1 m i p ) using the conjunctive rule of combination. See Appendix A.1 for the detailed calculation.

H-Arg :

               Bel C (C) = Bel ⇒ ([∧ n i=1 p i ] ⇒ C) × n i=1 Bel i p (p i ) • [1 -Bel i ⇒ (p i ⇒ C)] +{1 - n i=1 [1 -Bel i p (p i ) • Bel i ⇒ (p i ⇒ C)]} -m (n) C (⊥) Disb C (C) = Bel ⇐ ([∧ n i=1 ¬p i ] ⇒ ¬C) × n i=1 Disb i p (p i ) • [1 -Bel i ⇐ (¬p i ⇒ ¬C)] +{1 - n i=1 [1 -Disb i p (p i ) • Bel i ⇐ (¬p i ⇒ ¬C)]} -m (n) C (⊥) (16)
where the mass m (n) C (⊥)3 represents the conflict degree for (n) premises. We propose a recursive formula to calculate conflict mass for n ≥ 2 premises:

m (n) C (⊥) = Bel (n-1) C (C)×m n (¬p n ∧¬C)+Disb (n-1) C (C)×m n (p n ∧C)+m (n-1) C (⊥) (17)
where:

-m

(1) A conflict situation represents the case when one or more premises lead to opposite assessments of the conclusion (e.g., a premise p i supports a conclusion C, while the negation of another premise p j supports its negation). Formally, it always takes the form of a combination of four items: p i , p i ⇒ C, ¬p j and ¬p j ⇒ ¬C, which produce empty intersections (noticeable if we combine the masses of elementary rules and those on the premises). In the case of the C-Arg and D-Arg this combination never occurs. Indeed, since the definition of a C-Arg (resp. D-Arg) does not use direct (resp. reverse) elementary rules that combine with reverse (resp. direct) elementary rules, we can see that the value of m (n) C (⊥) is always zero for these types. Facing a conflict situation, when we have opposite assessment on premises supporting the same goal, the conjunctive type adopts a cautious behavior in favor of the propagation of the premises that does not support the conclusion.

C (⊥) = 0 -Bel (n-1) C (C) = {1 - n-1 i=1 [1 -Bel i p (p i ) • Bel i ⇒ (p i ⇒ C)]} -m (n-1) C (⊥) -Disb (n-1) C (C) = {1 - n-1 i=1 [1 -Disb i p (p i ) • Bel i ⇐ (¬p i ⇒ ¬C)]} -m (n-1) C (⊥) -m i (p i ∧ C) = Bel i p (p i ) • Bel i ⇒ (p i ⇒ C) -m i (¬p i ∧ ¬C) = Disb i p (p i ) • Bel i ⇐ (¬p i ⇒ ¬C). See Appendix A.
On the contrary, the disjunctive type takes a more optimistic view, which favors the propagation of the premises that support the conclusion. The hybrid type (H-Arg) stands between these two limit cases, and the mass m way. In the case of full conflict, this mass is equal to 1 making this normalisation meaningless (division by zero). 4 In fact the term m (n) C (⊥), if high enough, provides additional information in the sense that it detects a contradiction in the expert data, which may lead to questioning the argument structure.

• Our confidence propagation scheme can be addressed by standard existing belief function software based on results in [START_REF] Shenoy | Axioms for probability and belief-function propagation[END_REF] (e.g., the belief function machine implemented in MatLab), but the GSNs we study have a particular tree-like structure that enables an explicit symbolic calculation of the belief function on the conclusion space. The explicit formulas make the calculation more efficient, are easy to interpret and liable to sensitivity analysis, thus better explaining the obtained results, and validating the approach.

• Unlike our proposal, which uses simple support functions to quantify confidence in rules separately, Wang et al. [START_REF] Wang | Safety Case Confidence Propagation Based on Dempster-Shafer theory[END_REF] represent the relation between the premises and the conclusion with a single mass function for all rules with weights summing to 1. This choice makes the confidence in one premise dependent on confidence in the other ones. The more confidence in the rule corresponding to a particular premise, the less confidence in the other rules. Our approach has more degrees of freedom and is closer to logic.

Application

A real world case study is provided in [START_REF] Idmessaoud | Uncertainty elicitation and propagation in GSN models of assurance cases[END_REF], but we propose here a smaller generic example to illustrate our approach. We consider a situation with two premises p 1 and p 2 supporting a conclusion C. Then, we set the belief on rules to the values in Table 4 according, respectively, to the C-Arg, D-Arg and H-Arg and propagate confidence from premises to the conclusion. We consider three different settings of premise assessments. A first one, with positive evaluations to the conclusion (C) according to each argument type. Finally we transform and approximate the calculated belief and disbelief values into symbolic decision and confidence pairs. The results are gathered in Table 5.

Bel⇒([p 1 ∧ p 2 ] ⇒ C) 1 1 0 Bel⇐([¬p 1 ∧ ¬p 2 ] ⇒ ¬C) 1 0 1 Bel 1 ⇒ (p 1 ⇒ C) 0.75 0 1 Bel 1 ⇐ (¬p 1 ⇒ ¬C) 0.75 1 0 Bel 2 ⇒ (p 2 ⇒ C) 0.
Notice that C-Arg, as expected, favors the propagation of the premise with least strength. The effect of attenuation is due, on the one hand, to the product between belief degrees on premises, which decreases the belief of the conclusion, and, on the other hand, to the probabilistic sum of disbelief degrees of premises, which increases the disbelief of the conclusion. In Table 5, we can notice that the decision degree of the conclusion respectively moves from tolerable and opposable to no decision and rejectable due to the attenuation effect in the first and second case.

In opposition to C-Arg, we can notice that D-Arg favors the propagation of the premise with the strongest assessment. The effect of amplification is due to the use of probabilistic sum for belief degrees and the product for the disbelief degrees. In Table 5, we can notice that the decision of the conclusion respectively moves from tolerable and opposable to acceptable and no decision due to the amplification effect in the first and second case.

Finally, we can notice that the H-Arg achieves a balance between the assessments by maintaining respectively tolerable and opposable decisions in the first and second cases and giving no decision in the third case when we have opposite assessments. But in return, it degrades the level of confidence.

Argument types in the literature -Comparison

As discussed above, the logical definition of the H-Arg includes many argument types. In the following, we compare some argument types proposed in the literature with those we propose.

Using the informal definition of the argument types given in [START_REF] Cyra | Support for argument structures review and assessment[END_REF][START_REF] Ayoub | Assessing the overall sufficiency of safety arguments[END_REF] and the formal one [START_REF] Wang | Modelling Confidence in Railway Safety Case[END_REF], we placed those types with respect to ours in Figure 9. We can notice that in each work there is a pure conjunctive type and a pure disjunctive one. The rest of the types can be considered as a special case of the hybrid (H-arg) one. Some are close to the C-Arg, while others are more close to the D-Arg. The "complementary and alternative combination type", proposed by Cyra and Gorski [START_REF] Cyra | Support for argument structures review and assessment[END_REF], by definition is at equal distance between C-Arg and D-Arg. However, these authors consider this type either as an alternative type or a complementary type according to each situation, instead of proposing a unified formula that cover these two types.

These works also use DST to model and propagate confidence in GSN. As we did, they proposed different propagation formulas for different identified types of arguments [START_REF] Ayoub | Assessing the overall sufficiency of safety arguments[END_REF][START_REF] Cyra | Support for argument structures review and assessment[END_REF][START_REF] Wang | Safety Case Confidence Propagation Based on Dempster-Shafer theory[END_REF]. However, they poorly describe how premises interact to support the conclusion (imprecise argument types). For instance, Anaheed et al. [START_REF] Ayoub | Assessing the overall sufficiency of safety arguments[END_REF] try to explain these interactions using Venn diagrams where the logical (conjunction, disjunction, etc) and confidence (mass assignment) aspects of these argument types are mixed up. Therefore, we cannot guess the argument type from its propagation formulas. They all take the form of a weighted average. Similar remarks can be made on Cyra and Gorski's work [START_REF] Cyra | Support for argument structures review and assessment[END_REF], where one cannot identify, from the formulas, the logic that leads to them.

The work of Wang et al. [START_REF] Wang | Safety Case Confidence Propagation Based on Dempster-Shafer theory[END_REF] is closer to ours. A separation between the logic (argument type definition) and confidence (mass assignment definition) was made, which facilitates the understanding of their formulas. They use a mix between conjunction and disjunction to model their types and logical equivalence to link premises to the conclusion. Using equivalence assumes that information about both the acceptance and denial of the conclusion is available and they have the same weight [START_REF] Idmessaoud | Belief functions for safety arguments confidence estimation: A comparative study[END_REF]. These models do not consider the case where a single type of information is available, hence the interest of breaking it down into two implications, as we do.

Qualitative confidence propagation and elicitation models

In this section, we present reasons to question the quantitative approach to uncertainty elicitation. It motivates a purely qualitative counterpart of the quantitative elicitation and propagation models presented in previous section.

Then, we introduce the new approach based on qualitative capacity theory.

Rationale for the qualitative approach

There are three reasons to develop a purely qualitative confidence elicitation and propagation model in argument structures.

Source independence assumption. Using Dempster rule of combination (with or without normalization) supposes that the belief functions defined to quantify confidence (or uncertainty) in a conclusion (C) are coming from independent sources. Hence, the confidence provided by multiple pieces of evidence supporting the same conclusion (acceptance of x or its rejection) is higher than the one provided by each one individually: i.e, for two pieces of evidence we get a degree of confidence

α 1 + α 2 -α 1 • α 2 ≥ max(α 1 , α 2 )
, where α i is the confidence provided by the ith piece of evidence.

In this framework, we often rely on the judgment of a single expert to assess the confidence in each node of a GSN (a conclusion supported by one or more premises). Hence, we cannot always assume independence of sources. It is not systematically verified in practice. Therefore, it is important to investigate combination rules that do not suppose independence of sources. Destercke et al.

[32] and Denoeux [START_REF] Denoeux | Conjunctive and disjunctive combination of belief functions induced by nondistinct bodies of evidence[END_REF] propose some idempotent rules of combination to merge belief functions induced by dependent sources. In the qualitative setting the counterpart of the conjunctive rule of combination is idempotent.

Attenuation and amplification effects. As presented in the application of section 3.4, in the case of a C-Arg (the most encountered argument in our state of the art study), we can have premises with high credibility assessment and yet end up with a conclusion with little credibility [START_REF] Idmessaoud | Uncertainty elicitation and propagation in GSN models of assurance cases[END_REF]. A similar problem (this time amplification) occurs with D-Arg. To overcome this problem, we can change the numerical scale of decision and confidence. The choice of the linear scale adopted in section 3.2 is adopted only to compare with previous studies. For instance, using a logarithmic scale, commonly encountered in railway safety applications, may partially solve this issue, but the results of the calculation will always strongly rely on the choice of the scale. As seen later this phenomenon will not occur in the qualitative setting. For all these reasons, we find it valuable to investigate a purely qualitative approach of confidence elicitation and propagation, which avoids the qualitativenumerical translation step.

Qualitative confidence elicitation model

In order to elicit qualitative capacities, we use a modified version of the quantitative method proposed in sub-section 3.2, already outlined in [START_REF] Dubois | Qualitative capacities: Basic notions and potential applications[END_REF]. Thus, the same types of information will be collected to assess the GSN pattern:

• We now turn pairs (Dec, Conf ) into qualitative capacity assessments on the scale L. To make decision and confidence scales compatible with the transformation formulas presented hereafter, we make several assumptions:

(i) The bipolar scale D is equipped with an order-reversing map ν D such that ν D (d -i ) = d i . Especially we have that ν D (Dec(x)) = Dec(¬x).

(ii) The unipolar scale C is isomorphic to the positive part of D, and is equipped with an order-reversing map ν such that:

ν(c i ) = c n-i .
In order to switch from a pair (Dec(x), Conf (x)) to a pair of capacity values (γ(x), γ(¬x)), we define a function f that maps D×C to the belief-disbelief scale L × L containing pairs (γ(x), γ(¬x)). The scale L must have the same number of elements as C (i.e., 3 here L = {0, λ, 1}). The mapping f :

D × C → L × L:
must satisfy some conditions [START_REF] Dubois | Qualitative capacities: Basic notions and potential applications[END_REF]:

• If the expert declares lack of confidence, the result is f (Dec(x), 0 C ) = (0, 0), whatever the trend expressed on the decision scale.

• If the expert is fully confident, then f (1 D , 1 C ) = (γ(x), γ(¬x)) = (1, 0), and likewise, f (0 D , 1 C ) = (0, 1), f (e D , 1 C ) = (1, 1)
. Indeed, for the latter, there is a total conflict: the expert is maximally informed, and cannot decide between x and its negation.

• max(γ(x), γ(¬x)) = Conf (x): the belief in x or its negation cannot be stronger than the confidence.

• if Dec(x) is the midpoint of D, then γ(x) = γ(¬x)(= Conf (x)) (no reason
to take side).

• if Dec(x) is less than the midpoint of D, then the trend is to reject x, so γ(x) < γ(¬x) = Conf (x), and the smaller D(x), the smaller γ(x).

• if Dec(x) is greater than the midpoint of D, then the trend is to accept

x, so γ(x) = Conf (x) > γ(¬x), and the greater D(x), the smaller γ(¬x).

Conf Dec d -2 (Rej) d -1 (Opp) d 0 (N D) d 1 (Tol) d 2 (Acc) c 0 (Lack of conf.) (0,0) (0,0) (0,0) (0,0) (0,0) c 1 (Moderate conf.) (0,λ) (λ,λ) (λ,λ) (λ,λ) (λ,0) c 2 (For sure) (0,1) (λ,1) (1,1) (1,λ) (1,0)
Keep in mind γ : 2 Ω → L = {0, λ, 1}.

These conditions lead to propose the following translation formulas [START_REF] Dubois | Qualitative capacities: Basic notions and potential applications[END_REF]:

if Dec(x) < e D , then γ(x) = min[ν C (Dec(¬x)), Conf (x)] and γ(¬x) = Conf (x) if Dec(x) > e D , then γ(x) = Conf (x) and γ(¬x) = min[ν C (Dec(x)), Conf (x)] if Dec(x) = Dec(¬x) = e D , then γ(x) = γ(¬x) = Conf (x)
In Table 1, we grouped all possible (Dec, Conf ) pairs on premises with their appropriate (γ(x), γ(¬x)) counterparts, using the formulas above. We can notice an anti-symmetry between belief and disbelief degrees with respect to the central column (d 0 : No decision). We also notice that when no information is available (c 0 : Lack of confidence), no matter what choice is made, the degrees of belief and disbelief take the minimal value. On the other hand, in the case of a fully informed expert (c 2 : For sure) the decision value varies from rejection to acceptance and is reflected by the pair (γ(x), γ(¬x)). We can see that the values in the table respect the conditions imposed above.

Qualitative confidence propagation model

To build the qualitative confidence propagation model, we are going to use the same rules (argument types) as those defined for the quantitative models in sub-section 3.2. To represent uncertainty in premises and rules, we use nondogmatic q-capacities instead of belief functions, and the qualitative rule of combination to merge these capacities.

Simple argument type (S-Arg):

To model this argument type, we associate to each rule (direct and reverse one) a simple support BΠA (resp., ρ ⇒ and ρ ⇐ ), and a BΠA on the premise space ρ p , assigning a mass to its truth ρ p (p), its falsity ρ p (¬p) and the tautology ρ p (⊤) = 1. Then, using the combination rule in equation ( 5), we merge the BΠAs on rules (ρ r = ρ ⇒ ⊙ ρ ⇐ ) with the one on the premise (ρ p ): 7). Similarly to the quantitative formulas, γ

γ C = γ r ⊙ γ p (Table
C (C) = ρ C (C), γ p (p) = ρ p (p)
and γ r (r * ) = ρ r (r * ), ∀r * (conjunctive, disjunctive, direct or reverse), since we work on a two states frame of discernment Ω x = {x, ¬x}. We get:

γ C (C) = max ϕ:ϕ⊢C,ϕ̸ =∅ ρ(ϕ) = max(min(ρ p (p), ρ r (p ≡ C)), min(ρ p (p), ρ r (p ⇒ C))) = min[ρ p (p), ρ ⇒ (p ⇒ C)] as ρ r (p ≡ C) = min(ρ ⇒ (p ⇒ C), ρ ⇐ (¬p ⇒ ¬C)) ≤ ρ ⇒ (p ⇒ C) = ρ r (p ⇒ C).
A similar computation can be done for γ C (¬C).

So, we conclude for the uncertainty propagation in simple argument: S-Arg :

   γ C (C) = min[γ p (p), γ ⇒ (p ⇒ C)] γ C (¬C) = min[γ p (¬p), γ ⇐ (¬p ⇒ ¬C)] (18)
We can notice that, like in the quantitative setting, the belief γ C (C) only depends on the direct rule γ ⇒ (p ⇒ C) and the belief degree of the premise γ p (p), while the disbelief γ C (¬C) only depends on the reverse rule γ ⇐ (¬p ⇒ ¬C) and the disbelief of the premise γ p (¬p).

Conjunctive argument type (C-Arg):

We formally defined direct and reverse rules for this type by (resp.): (∧ n i=1 p i ) ⇒ C and ∧ n i=1 (¬p i ⇒ ¬C). Following the same reasoning as for the previous argument type, we put a simple BΠA on each rule (conjunctive direct rule: ρ ⇒ and elementary reverse rules: ρ i ⇐ ), and a function BΠA on each premise: ρ i p , which assigns one mass on the truth of (p i ), its falsity (¬p i ) and the tautology (⊤) such that ρ i p (⊤) = 1. Then, using the combination rule in equation ( 5), we deduce γ C (C) and γ C (¬C) from the combination: ρ C = ρ p ⊙ ρ r , where:

ρ p = (⊙ n i=1 ρ i p ) and ρ r = ρ ⇒ ⊙ (⊙ n i=1 ρ i ⇐ )
. Hence, we get the following confidence formulas for a C-Arg: C-Arg :

   γ C (C) = min{min n i=1 γ i p (p i ), γ ⇒ ([∧ n i p i ] ⇒ C)} γ C (¬C) = max n i=1 {min[γ i p (¬p i ), γ i ⇐ (¬p i ⇒ ¬C)]} (19)
In the formulas of the quantitative approach (Eqs. 14), we use probabilistic sum (a + b -ab) and the product (ab) instead of max, min, highlighting the similarity between the results obtained in both models. In fact, we can better see with min-max operators that the C-Arg favors the propagation of the premise with the lowest strength (minimal belief, with a maximal disbelief degree).

Disjunctive argument type (D-Arg):

Formally, the direct and reverse rules are defined as follows: ∧ n i=1 (p i ⇒ C) and (∧ n i=1 ¬p i ) ⇒ ¬C. The calculation of γ C (C) and γ C (¬C) is identical to the one above, swapping the two expressions (ρ C = ρ p ⊙ ρ r , where ρ r = (⊙ n i=1 ρ i ⇒ ) ⊙ ρ ⇐ and ρ p = ⊙ n i=1 ρ i p ). We get the confidence propagation formulas for a D-Arg: D-Arg :

   γ C (C) = max n i=1 {min[γ i p (p i ), γ i ⇒ (p i ⇒ C)]} γ C (¬C) = min{min n i=1 γ i p (¬p i ), γ ⇐ ([∧ n i ¬p i ] ⇒ ¬C)} (20)
We can notice that this model, like its quantitative counterpart (Eqs. 15), favors the propagation of the premise with the greatest strength (maximal belief and minimal disbelief degree).

p i ⇒ C with ¬p j and ¬p j ⇒ ¬C, j ̸ = i, whose conjunction is a contradiction ⊥ with mass:

ρ ij C (⊥) = min[ρ i C (p i ∧ C), ρ j C (¬p j ∧ ¬C)] = min[ρ i p (p i ), ρ i ⇒ (p i ⇒ C), ρ j p (¬p j ), ρ j ⇒ (¬p j ⇒ ¬C)]]
The final weight on contradiction for n premises takes the form ρ C (⊥) = max i̸ =j ρ ij C (⊥). Besides, this capacity on contradiction does not affect the final results of belief and disbelief since γ C (C) and γ C (¬C) are not less than γ C (⊥).

For instance, for n = 2: ρ C (⊥) = max(ρ 12 C (⊥), ρ 21 C (⊥)). Using equation 3, we get:

γ C (C) ≥ max(min(ρ 1 p (p 1 ), ρ 1 ⇒ (p 1 ⇒ C)), min(ρ 2 p (p 2 ), ρ 2 ⇒ (p 2 ⇒ C))) ≥ max(ρ 12 C (⊥), ρ 21 C (⊥)
). and likewise for γ C (¬C).

Confidence assessment procedure for a GSN

In this section, we present our confidence assessment procedure, which includes both our elicitation and propagation models. This procedure is the same for the quantitative (section 3) and purely qualitative (section 4) settings.

Determination of belief weights for rules

Before presenting the details of the belief estimation procedure for rules, we draw your attention on an observation made for the propagation model presented in sub-section 3.3. The whole procedure is based on this observation.

Assuming clear-cut knowledge about some (or all) premises (Bel i p (p i ) = 1 -Disb i p (p i ) ∈ {0, 1}) and total ignorance about the others (U ncer i p (p i ) = 1, i.e., Bel i p (p i ) = Disb i p (p i ) = 0), Bel C (C) and Disb C (C) respectively take the belief values of direct and reverse rules. For example, in the case of a conclusion (C) supported by two premises (p 1 ) and (p 2 ), assuming total acceptance of these two premises with maximal confidence, i.e. Bel 1 p (p 1 ) = Bel 2 p (p 2 ) = 1 then: Bel C (C) = Bel ⇒ ([p 1 ∧ p 2 ] ⇒ C) using equation [START_REF] Idmessaoud | Belief functions for safety arguments confidence estimation: A comparative study[END_REF]. While assuming total rejection with maximal confidence of (p 1 ), i.e Disb 1 p (p 1 ) = 1 and total ignorance about (p 2 ), i.e. U ncer 2 p (p 2 ) = 1 then: Disb C (C) = Bel ⇐ (¬p 1 ⇒ ¬C) using equation [START_REF] Idmessaoud | Belief functions for safety arguments confidence estimation: A comparative study[END_REF].

We propose a procedure for collecting belief degrees of rules based on the elicitation model (as for the premises) and the observation of the paragraph above where we assume that the GSN pattern to be assessed is a C-Arg (resp. D-

Arg) to estimate the values of Bel ⇒ ([∧ n i=1 p i ] ⇒ C) and Bel i ⇐ (¬p i ⇒ ¬C) (resp. Bel i ⇒ (p i ⇒ C) and Bel ⇐ ([∧ n i=1 ¬p i ] ⇒ ¬C))
. Thus, from the expert assessment of the conclusion for predefined extreme premise assessments (Bel, Disb), we can measure the belief values of the rules. These values can be used afterwards to calculate the confidence of a conclusion based on belief values of the premises.

Moreover, as mentioned before, no positive disbelief is assigned to a rule. This constraint impacts the allowed pairs (Dec, Conf) for the expert. The latter is constrained to choose only a decision on the positive side (from "no decision" to "acceptable") for direct rules. On the contrary, (s)he can only choose a negative decision (from "rejectable" to "no decision") for the reverse rules. Formulas in ( 6) and ( 7) are used to derive the degrees of belief on rules. We note that the results obtained for these two rules are consistent with our expectations. Indeed, starting from high confidence values, we find that the belief value these rules is indeed higher than the uncertainty value.

To collect the masses on rules, Wang et al. [START_REF] Wang | Safety Case Confidence Propagation Based on Dempster-Shafer theory[END_REF] choose to use identification techniques. They ask the expert to give his/her assessment about the conclusion (outputs) according to predefined assessment of premises (inputs). Then, using a non-linear least square method, they identify the values of the rules weight (denoted ω i ). However, we notice that this method could lead to values outside the unit interval [0, 1], which makes no sense. Moreover, asking the expert to give his/here assessment of the conclusion according to predefined inputs (i.e, Supposing that we have "tolerable, with high confidence" and "opposable, with low confidence" assessment on premises, what this your assessment on the conclusion ?) can be disturbing and difficult, specially if you have several premises. In our case, we ask the expert to give his/her opinion only on extreme situations assuming that the argument is a C-Arg (resp. D-Arg) to define the direct (resp. reverse) conjunctive rule and the reverse (resp. direct) elementary rules. The first one is called modeling phase. It provides the beliefs on the rules. The second is called the application phase. It provides the beliefs on the premises and then propagates them with the beliefs on the rules, using the propagation model, up to the conclusion. This procedure is the same for both quantitative and purely qualitative methods.

Outline of the confidence assessment procedure

Modeling phase

It will be conducted by asking 2n + 2 questions to the assessor using the evaluation matrices, n being the number of premises. The first 2n questions concern masses on elementary rules (direct and reverse). For instance, to get (resp.) the values of Bel 1 ⇐ (¬p 1 ⇒ ¬C) and Bel 1 ⇒ (p 1 ⇒ C) the expert will be asked the following questions (in the case n = 2): Then using the propagation formulas, we calculate the belief and disbelief in the conclusion. This procedure will be iterated for each node consisting of a conclusion (goal in GSN formalism) supported by its premises (sub-goals), starting from the bottom of the GSN, up to the top-goal.

Finally, we may transform the resulting pair (Belief, Disbelief), of the conclusion, into a pair (Decision, Confidence) (using formulas ( 6) and ( 7) in the numerical setting) and approximate them by choosing the qualitative values, of the closest pair (Dec, Conf ) to their corresponding numerical values.

Quantitative vs. qualitative assessment procedures

On an artificial example (Figure 12) that displays three argument types (C-Arg, D-Arg and H-Arg), we apply our approach in order to see how each type affects the propagation of uncertainty from premises to the overall goal (conclusion). We also apply the quantitative approach on this artificial case study. To compare results from both approaches, we will use the same decision and confidence scales presented in Figure 13.

The example in Figure 12, presents a top-goal (G) supported by two subgoals (G1) and (G2) through a hybrid argument type (H-Arg). Each one of them is also supported, respectively, by two premises. Goal (G1) is supported by the premises (P1) and (P2) related by a conjunctive argument type (C-Arg).

On the other hand, goal (G2) is supported by the premises (P3) and (P4) related by a disjunctive argument type (D-Arg). For simplicity, we set all masses on rules of C-Arg, D-Arg, and the conjunctive ones of H-Arg to their maximal values ("acceptable for sure"). While we set the value of elementary rules of H-Arg to "tolerable, for sure". Then, we use four different cases of premises assessments and compute the confidence in the top goal for each. To get, respectively, belief degrees and q-capacities from the assessment of rules (see Table 8) and premises, we use the appropriate elicitation models in sub-sections 3.2 and 4.2.

In general, we can see from Table 9 that both approaches give close results, which fits well with our expectations. The only difference is in the confidence values. We can say that, in this case the qualitative approach gives results with higher levels of confidence than the quantitative one.

We notice from Table 9 in the 1 st and 2 nd lines that, as expected, the top goal keeps the same decision as premises respectively: "tolerable" and "opposable"., with a degradation of the degree of confidence in the quantitative case.

Calculating the conflict mass in both cases, we can notice that their values are not null (i.e., m G (⊥) = 0.25 for both cases). These values result from the difference between the calculated evaluations of the conjunctive argument in G 1 and disjunctive argument in G 2 . In the 3 rd line, we get "tolerable" decision, because the D-Arg favors the propagation of the premise with the greatest weight (toler- C-Arg

(P 1 ∧ P 2) ⇒ G1 1 1 ¬P 1 ⇒ ¬G1 1 1 ¬P 2 ⇒ G1 1 1 D-Arg (¬P 3 ∧ ¬P 4) ⇒ ¬G2 1 1 P 3 ⇒ G2 1 1 P 4 ⇒ G2 1 1 H-Arg (G1 ∧ G2) ⇒ G 1 1 (¬G1 ∧ ¬G2) ⇒ ¬G 1 1 G1 ⇒ G λ 0.75 ¬G1 ⇒ ¬G λ 0.75 G2 ⇒ G λ 0.75 ¬G2 ⇒ ¬G λ 0. 75
Remember: Bel : 2 Ω → [0, 1] and γ : 2 Ω → L = {0, λ, 1}.

G (Quant.) G (Quali.) 1 st (Tol,c 2 ) (Tol,c 2 ) (Tol,c 2 ) (Tol,c 2 ) (Tol,c 1 ) (Tol,c 2 ) 2 nd (Opp,c 2 ) (Opp,c 2 ) (Opp,c 2 ) (Opp,c 2 ) (Opp,c 1 ) (Opp,c 2 ) 3 rd (Tol,c 2 ) (Tol,c 2 ) (Tol,c 2 ) (Opp,c 2 ) (Tol,c 1 ) (Tol,c 2 ) 4 th (Opp,c 2 ) (Tol,c 2 ) (Tol,c 2 ) (Tol,c 2 ) (ND,c 1 ) (λ, λ) ≡ (ND,c 1 )
Where: c 2 : For sure, c 1 : Moderately confident and c 0 : Lack of confidence.

able) to G 2 (G 1 : tolerable). The conflict mass in this situation is m G (⊥) = 0.26.

The opposite assessments in the disjunctive argument does not have a significant impact on the top goal G. On the contrary, in the 4 th line, we get a "no decision". This result is explained by the fact that we end up with two opposite judgments in the H-Arg (conflict situation) due to C-Arg that propagates the premise with least strength (opposable) to G 1 (G 2 : tolerable). This also explains the high value of the conflict mass (i.e., m G (⊥) = 0.44), in contrast to previous cases.. The degree of confidence also decreases in the quantitative case.

The difference in the degree of confidence between qualitative and quantitative approaches is due to the nature of the operations used. For example, the C-Arg favors the propagation of the weakest premise (weaker belief and stronger disbelief). In the quantitative setting, we use the product and the probabilistic sum. And in the qualitative case, we use min and max, which does not model attenuation or reinforcement effects in case of independent pieces of information.

Notice that in the 4 th case, we get the assessment for the qualitative setting:

γ C (C) = γ C (¬C) = λ.
In this situation, we choose to translate these values to "no decision" (ND), with "moderate confidence" (c 1 ). However, if we go back to Table 6, we notice that this assessment could express three different decision values (opposable, no decision and tolerable). This is one limitation of the qualitative approach, a relative lack of discrimination.

Conclusion

In this article, we propose an approach to confidence assessment in assurance cases based on GSN. To do this, we formally define argument types using logical expressions, and model the inference of the goal to be proven from the pieces of evidence they support. Then, using belief functions, we quantify confidence According to the values taken by the degrees of belief of the rules (direct and inverse), the type is easily identifiable. This allows for easy implementation and fast execution of this model for possible future applications. The propagation model also takes into consideration conflict situations involving two or more opposite assessments regarding different pieces of evidence supporting the same goal. We also improved an existing expert information elicitation model, using the pignistic transform, and adding a neutral (indecisive) option to the possible uncertainty assessment choices. In addition, we propose a questionnaire to collect data about rules and premises.

To avoid the relative arbitrariness of the quantitative assessment approach, notably the issues related to the attenuation-amplification effects, choice of numerical scales, and the independence of sources assumption, we propose a new purely qualitative confidence assessment method which propagates qualitative belief and disbelief from the premises to the conclusion. This approach avoids the need for transforming expert assessments from natural language into numerical values which can be seen as a source of uncertainty.

The use of DST to quantify and propagate confidence in graphical models of argument structure such as GSN is not widespread and is relatively new compared to Bayesian approaches. However, the main problem to overcome lies in the elicitation procedure. The elicitation model for both the quantitative and qualitative approach need improvements. On one hand, it is important to develop specific scales calibrated to real assurance cases and verify that the results

given by the elicitation model are intuitively correct. On the other hand, it is also necessary to develop the questionnaire by improving, for instance, the way in which the questions are asked. Indeed, it seems that the way in which the questions are asked so far encourages the experts to give extreme assessments, which leads to extreme argument types. In particular, most case studies we encountered only involved the C-Arg. However, for a robust validation of our approach, more experiments on general cases must be conducted for both quantitative and qualitative assessment methods. These experiments would be useful to further compare the quantitative assessment method and the qualitative one so as to determine which approach is best.

Finally, the approach we propose only takes into consideration components from the GSN formalism (goal, strategy, solutions, context, etc). Thus, it is not always easy to switch from one formalism to another. By integrating other components, our approach will become more generic. An interesting proposal is to take into account exceptions to rules (i.e. defeaters) or evidence against the conclusion (i.e. rebuttals) by considering disbelief respectively in direct and reverse rules. Where:

-Bel

(2)

C (C) = 1 -[1 -Bel 1 p (p 1 )Bel 1 ⇒ (p 1 ⇒ C)] • [1 -Bel 2 p (p 2 )Bel 2 ⇒ (p 2 ⇒ C)] -Disb

Figure 1 :

 1 Figure 1: GSN example adapted from Hazard Avoidance Pattern [19]

Figure 2 :

 2 Figure 2: Evolution of certainty and information in pairs (belief, disbelief)

Figure 3 .Figure 3 :

 33 Figure 3. Each dot in this matrix corresponds to a pair (Dec, Conf ).

6 -1 2 + 0 2 - 1 -

 62021 .25 = 0.05, Disb(p 1 ) = 0.6+1 0.25 = 0.55 and U ncer(p 1 ) = Bel(p 1 ) -Disb(p 1 ) = 0.4.

Table 1 :

 1 Values from (Dec, Conf ) to (Bel,Disb) pairs on premises (see Figure3for symbol meaning)

Figure 4 :

 4 Figure 4: Pignistic (plain line) and Shenoy (dashed line) transforms constraint

Figure 5 :

 5 Figure 5: Sources of uncertainty in GSN -A simple argument type (S-Arg) example (Note that the arrow direction is not intuitive regarding the inference p supports C)

Figure 6 :

 6 Figure 6: A conjunctive argument type (C-Arg) example

Figure 7 :

 7 Figure 7: A disjunctive argument type (D-Arg) example

Figure 8 :

 8 Figure 8: A hybrid argument type (H-Arg) example

  2 for the detailed calculation of the conflict mass.Note that in the expression[START_REF] Idmessaoud | Uncertainty elicitation and propagation in GSN models of assurance cases[END_REF] of Bel(C) and Disb(C), we first directly calculate expressions of the form b(C) = ϕ|=C m (n) (ϕ) and d(C) = b(¬C) = ϕ|=¬C m (n) (ϕ) that include the term m (n) (⊥), butare easier to compute than Bel(C) and Disb(C). Then we subtract the term m (n) (⊥) calculated recursively in a separate way (see Appendix A.2). Remember that we may have b(C) + d(C) > 1 since m (n) (⊥) is then counted twice. Additional explanation is given through an example of computation of belief and disbelief propagation formulas for the case of two premises supporting one conclusion in Appendix A.1.We can notice that belief and disbelief propagation formulas for an H-Arg (Eqs. 16) have the same form. They sum two parts. A first one which expresses the conjunctive component of this type, weighted by the uncertainty on the direct elementary rules (1 -Bel i ⇒ (p i ⇒ C), resp. the reverse ones). The second part represent its disjunctive component. To deduce the formulas of a C-Arg from H-Arg, all you need is to set the elementary rules (Bel i ⇒ (p i ⇒ C)) and the reverse conjunctive one (Bel ⇐ ([∧ n i=1 ¬p i ] ⇒ ¬C)) to zero. Conversely, if we set to zero the masses of the direct conjunctive rule and those of the reverse elementary rules, we get the formulas of a D-Arg. Finally, in the case of a conclusion supported by one premise, both masses of the direct and reverse conjunctive rules are equal to zero. Thus, we also deduce the formula of an S-Arg. Hence, the propagation formulas of the H-Arg can also be used to calculate confidence of the other argument types (S-Arg, C-Arg and D-Arg).

•

  In the case of a minor conflict (m(n) C (⊥) small), instead of subtracting m (n) C (⊥),we could normalise the result, dividing by the consistency degree (1 -m (n) C (⊥)) as proposed in the usual Dempster rule of combination. It would eliminate the conflict and proportionally increase the contradictionfree degrees of the belief Bel C (C) and disbelief Disb C (C) in a misleading

  Transformation of qualitative assessments into quantitative ones. Encoding qualitative uncertainty assessments with real numbers contains a part of arbitrariness, whatever the chosen target scale. As suggested previously, changing the linear scale into a logarithmic one can partially mitigate the attenuation and amplification effects respectively in C-Arg and D-Arg. But this transformation can introduce instability in the propagation model: the results of the propagation steps may depend upon the choice of the transformation from qualitative to quantitative values, including when approximating back the calculated values of belief, disbelief, and uncertainty of the conclusion into qualitative decision and confidence pairs.

•

  The decision index Dec(x), takes values in a bipolar scale D = {0 D = d -n , d n-1 , . . . , d 0 = e, d 1 , . . . , d n = 1 D } with 2n + 1 values, the bottom of which (0 D ) expresses rejection, the top (1 D ) acceptance, and the midpoint (e D ) a neutral position. In the application, we assume n = 2. The confidence index Conf (x) lies in a positive uni-polar scale with n + 1 values C = {0 C = c 0 , c 1 , . . . , c n = 1 C } (the top 1 C expresses full confidence, the bottom 0 C is neutral-no information). For n = 2: the levels c 0 to c 2 may respectively express lack of confidence, moderate confidence and full confidence.

Example 2 .

 2 Suppose the case of a conclusion (C) supported by one premise (p). Figure10describes the procedure of rule elicitation. To get the belief on the direct rule R 1 : p ⇒ C and the reverse one R 2 : ¬p ⇒ ¬C, we ask an expert to give his/her assessment about the conclusion respectively when (Dec(p) = 1, Conf (p) = 1) for R 1 , and then when (Dec(p) = 0, Conf (p) = 1) for R 2 .Suppose the expert gives the following assessments:• When (Dec(p) = 1, Conf (p) = 1), the expert assigns "Tolerable, with high confidence" to the conclusion (C), hence: Dec(C) = 0.75 and Conf (C) = 0.6.• When (Dec(p) = 0, Conf (p) = 1), the expert assigns "Opposable, with very high confidence" to the conclusion (C), hence: Dec(C) = 0.25 and Conf (C) = 0.8.

Figure 10 : 2 + 2 -

 1022 Figure 10: Belief elicitation of rules

Figure 11

 11 Figure 11 illustrates our assessment procedure structured in two phases.

1 .

 1 Supposing no knowledge about the premise p 2 : (Dec = 0.5, Conf = 0) and total rejection (rejectable for sure) of p 1 : (Dec = 0, Conf = 1), what is your Decision/Confidence in the conclusion ? 2. Supposing no knowledge about the premise p 2 : (Dec = 0.5, Conf = 0) and total acceptance (acceptable for sure) of p 1 : (Dec = 1, Conf = 1), what is your Decision/Confidence in the conclusion ?

Figure 12 :

 12 Figure 12: GSN artificial example

Figure 13 :

 13 Figure 13: Evaluation matrix

(

  belief and disbelief) in these expressions, and merge them with a variant of Dempster rule of combination, thus defining a quantitative confidence propagation model. In contrast to similar approaches proposed in the literature, we propose a general model covering the different types of arguments. The propagation formula can be used to compute the confidence in the conclusion for the four types of arguments we have defined (H-Arg, C-Arg, D-Arg and S-Arg).

m

  123 (⊥) = m 12 (⊥) + m 1 (p 1 ∧ C)m 3 (¬p 3 ∧ ¬C)[1 -m 2 (¬p 2 ∧ ¬C)] + m 1 (¬p 1 ∧ ¬C)m 3 (p 3 ∧ C)[1 -m 2 (p 2 ∧ C)] + m 2 (p 2 ∧ C)m 3 (¬p 3 ∧ ¬C)[1 -m 1 (p 1 ∧ C) -m 1 (¬p 1 ∧ ¬C)] + m 2 (¬p 2 ∧ ¬C)m 3 (p 3 ∧ C)[1 -m 1 (p 1 ∧ C) -m 1 (¬p 1 ∧ ¬C)] = m 12 (⊥) + m 3 (p 3 ∧ C) • Disb

( 2 )

 2 C (C) + m 3 (¬p 3 ∧ ¬C) • Bel

( 2 )

 2 C (C) = 1-[1-Disb 1 p (p 1 )Bel 1 ⇐ (¬p 1 ⇒ ¬C)]•[1-Disb 2 p (p 2 )Bel 2 ⇐ (¬p 2 ⇒ ¬C)]This calculation can be extended to n > 1 premises. Hence, we get as many asn-1 i=1 C i n-1 (2 i -1)focal sets inducing the conclusion C ({Ω p1 ×...×Ω pn }∧C) and others of the same count inducing its negation ¬C ({Ω p1 × ... × Ω pn } ∧ ¬C). Combining these focal sets respectively with (¬p n ∧ ¬C) and (p n ∧ C) generates an empty intersection. Summing the masses of these focal sets gives the general formula of conflict m (n) (⊥) (equation 17). Notice that conjunctive rules [∧ n i=1 p i ] ⇒ C and [∧ n i=1 ¬p i ] ⇒ ¬C were not involved in this calculation because they do not generate an empty intersection (e.g., ([p 1 ∧ p 2 ] ⇒ C) ⊗ ¬p 1 = ¬p 1 ).

Table 2 :

 2 Combination of direct (m⇒) and reverse (m⇐) rules for S-Arg

	mr = m⇒ ⊗ m⇐	m⇒(p ⇒ C)	m⇒(⊤)
	m⇐(¬p ⇒ ¬C)	p ≡ C	¬p ⇒ ¬C
	m⇐(⊤)	p ⇒ C	⊤

Table 3 :

 3 Combination of the mass on premise (mp) with its rule (mr) for S-Arg

	m = mp ⊗ mr	mr(p ≡ C)	mr(p ⇒ C)	mr(¬p ⇒ ¬C)	mr(⊤)
	mp(p)	p ∧ C	p ∧ C	p	p
	mp(¬p)	¬p ∧ ¬C	¬p	¬p ∧ ¬C	¬p
	mp(⊤)	p ≡ C	p ⇒ C	¬p ⇒ ¬C	⊤

Table 4 :

 4 Example of belief values for the three argument types with two premises (p 1 and p 2 )

	supporting a conclusion (C)
	Types	H-Arg	C-Arg	D-Arg
	Rules

Table 5 :

 5 Three examples of (Belief, Disbelief) propagation for a conclusion (C) supported by two premises (p 1 and p 2 ) and their (Decision, Confidence) counterpart

				75	0	1
		Bel 2 ⇐ (p 2 ⇒ ¬C)	0.75	1	0
	Configuration	G 1	G 2		G (C-Arg) G (D-Arg) G (H-Arg)
	1 st	(0.75, 0.25) (0.75, 0.25) (0.56, 0.44) (0.94, 0.06) (0.63, 0.13)
		(Tol,c 6 )	(Tol,c 6 )		(ND,c 6 )	(Acc,c 6 )	(Tol,c 5 )
	2 nd	(0.25, 0.75) (0.25, 0.75) (0.06, 0.94) (0.44, 0.56) (0.13, 0.63)
		(Opp,c 6 )	(Opp,c 6 )		(Rej,c 6 )	(ND,c 6 )	(Opp,c 5 )
	3 rd	(0.75, 0.25) (0.25, 0.75) (0.19, 0.81) (0.81, 0.19) (0.30, 0.30)
		(Tol,c 6 )	(Opp,c 6 )		(Opp,c 6 )	(Tol,c 6 )	(ND,c 4 )

(both tolerable, for sure), negative evaluations (both opposable, for sure) and opposite evaluations. Then, we propagate confidence from premises (p 1 and p 2 )

Table 6 :

 6 Values from (Dec, Conf ) to (Bel,Disb) pairs on premises for n = 2

Table 7 :

 7 Combination of the focal sets of the premise (ρp) with its rules (ρr) for S-Arg

	ρ = ρp ⊙ ρr	ρr(p ≡ C)	ρr(p ⇒ C)	ρr(¬p ⇒ ¬C)	ρr(⊤)
	ρp(p)	p ∧ C	p ∧ C	p	p
	ρp(¬p)	¬p ∧ ¬C	¬p	¬p ∧ ¬C	¬p
	ρp(⊤)	p ≡ C	p ⇒ C	¬p ⇒ ¬C	⊤

Table 8 :

 8 Values of the belief degrees on rules

	Type	Rule	Qualitative	Quantitative
			value (γ)	value (Bel)

Table 9 :

 9 Pairs (decision, confidence) using qualitative (Qual.) and quantitative (Quant.)

	methods
	Case	P 1	P 2	P 3	P 4

Table A .

 A [START_REF] Wang | Safety Case Confidence Propagation Based on Dempster-Shafer theory[END_REF]: Combination of the i th premise (p i , i = {1, 2}) with its elementary rules for Table A.13: Combination of the 1 st and 2 nd premises (p i ) with their elementary rules for H-Arg

	bold). Thus we prove that:
	m12 = m1 ⊗ m2	m2(p2 ∧ C)	m2(¬p2 ∧ ¬C)	m2(p2)	m2(¬p2)	m2(p2 ⇒ C)	m2(¬p2 ⇒ ¬C)	m2(p2 ≡ C)	m2(⊤)
	m1(p1 ∧ C)	p1 ∧ p2 ∧ C	∅		p1 ∧ p2 ∧ C	p1 ∧ ¬p2 ∧ C	p1 ∧ C	p1 ∧ p2 ∧ C	p1 ∧ p2 ∧ C	p1 ∧ C
	m1(¬p1 ∧ ¬C)	∅		¬p1 ∧ ¬p2 ∧ ¬C	¬p1 ∧ p2 ∧ ¬C	¬p1 ∧ ¬p2 ∧ ¬C	¬p1 ∧ ¬p2 ∧ ¬C	¬p1 ∧ ¬C	¬p1 ∧ ¬p2 ∧ ¬C	¬p1 ∧ ¬C
	m1(p1)	p1 ∧ p2 ∧ C	p1 ∧ ¬p2 ∧ ¬C		p1 ∧ p2	p1 ∧ ¬p2	p1(p2 ⇒ C)	p1(¬p2 ⇒ ¬C)	p1(p2 ≡ C)	p1
	m1(¬p1)	¬p1 ∧ p2 ∧ C	¬p1 ∧ ¬p2 ∧ ¬C	¬p1 ∧ p2	¬p1 ∧ ¬p2	¬p1(p2 ⇒ C)	¬p1(¬p2 ⇒ ¬C)	¬p1(p2 ≡ C)	¬p1
	m1(p1 ⇒ C)	p2 ∧ C		¬p1 ∧ ¬p2 ∧ ¬C	p2(p1 ⇒ C)	¬p2(p1 ⇒ C)	(p1 ⇒ C)(p2 ⇒ C)	(p1 ⇒ C)(¬p2 ⇒ ¬C)	(p1 ⇒ C)(p2 ≡ C)	(p1 ⇒ C)
	m1(¬p1 ⇒ ¬C)	p1 ∧ p2 ∧ C	¬p2 ∧ ¬C	p2(¬p1 ⇒ ¬C)	¬p2(¬p1 ⇒ ¬C)	(p2 ⇒ C)(¬p1 ⇒ ¬C)	(¬p2 ⇒ ¬C)(¬p1 ⇒ ¬C)	(p2 ≡ C)(¬p1 ⇒ ¬C)	¬p1 ⇒ ¬C
	m1(p1 ≡ C)	p1 ∧ p2 ∧ C	¬p1 ∧ ¬p2 ∧ ¬C	p2(p1 ≡ C)	¬p2(p1 ≡ C)	(p1 ≡ C)(p2 ⇒ C)	(p1 ≡ C)(¬p2 ⇒ ¬C)	(p1 ≡ C)(p2 ≡ C)	(p1 ≡ C)
	m1(⊤)	p2 ∧ C		¬p2 ∧ ¬C		p2		¬p2	p2 ⇒ C	¬p2 ⇒ ¬C	p2 ≡ C	⊤
	H-Arg
	m i = m i p ⊗ m i r	m i r (p i ≡ C)	m i r (p i ⇒ C)	m i r (¬p i ⇒ ¬C)	m i r (⊤)
	m i p (p i )	p i ∧ C	p i ∧ C	p i		p i
	m i p (¬p i )	¬p i ∧ ¬C	¬p i		¬p i ∧ ¬C	¬p i
	m i p (⊤)	p i ≡ C	p i ⇒ C	¬p i ⇒ ¬C	⊤

Each variable is denoted by x when it takes the value "True" and ¬x when it takes the value "False".

Also denotedy b m(Ω) according to the set theory syntax, [⊤] = Ω.

Also denoted by m(∅) according to the set theory syntax: [⊥] = ∅.

This can be the case with masses on formulas equal to 1.

Hybrid argument type (H-Arg):

Merging the q-capacity functions of all rules with those on premises, such that: ρ C = ρ p ⊙ ρ r , where ρ r = ρ ⇒ ⊙ (⊙ n i=1 ρ i ⇐ ) ⊙ ρ ⇐ ⊙ (⊙ n i=1 ρ i ⇒ ) and (ρ p = ⊙ n i=1 ρ i p ), we get the confidence propagation formulas for an H-Arg:

H-Arg :

In order to get a non-trivial H-argument, we need that the weight of rules of the form [∧ n i=1 p i ] ⇒ C be greater than the weight of individual rules p i ⇒ C, and likewise, the weight of rules of the form [∧ n i=1 ¬p i ] ⇒ ¬C be greater than the weight of individual rules ¬p i ⇒ ¬C.

We can notice, as expected (analogy to quantitative formulas), that formulas of H-Arg (Eqs. [START_REF] Sentz | Combination of evidence in dempster-shafer theory[END_REF], are more general than C-Arg formulas (Eqs. [START_REF] Kelly | Safety case construction and reuse using patterns[END_REF], and D-Arg (Eqs. 20). Assuming maximal belief (= 1) (resp. disbelief) on premises, it is enough that the simple direct rules take a null value (resp. the reversed conjunctive one) to get the conjunctive argument type. And conversely, to get the disjunctive argument type, we have to put null values on direct conjunctive and simple reverse rules. The S-Arg, represents a special case when only one premise is available (n = 1). In the following, only the H-Arg will be used since it covers the four types.

Conflict degree impact on the H-Arg. Remember that C-Arg and D-Arg argument types are conflict-free (m (n) (⊥) = 0 in the quantitative setting). They respectively propagate the premise with lowest and highest assessments. However, it is not the same for H-Arg. Indeed, merging BΠA's ρ i p (on p i , ¬p i and ⊤), ρ i ⇒ , ρ i ⇐ , i = 1, . . . n, as in its quantitative counterpart, the BΠA pertaining to the conclusion C obtained from this fusion may assign a mass to the contradiction. Conflict always appears when four items are merged of the form: p i and It is important to mention that the expert can only select pairs (Dec, Conf ) from the positive side of the evaluation matrix ("no decision" to "acceptable") while assessing direct rules. Conversely, he/she can only select negative assessment for the reverse rules ("rejectable" to "no decision"). For instance in Figure 11 (modelling phase), choosing a pair from this forbidden zone (shaded) will assign a mass to Bel 2 ⇒ (¬[p 2 ⇒ C]) which is not a rule (see, sub-sections 3.1 and 3.3). Even if we set all the positive masses of this kind (disbelief on rules) to zero, we prefer not to allow access to this area to keep consistency with the rules definition. The implication used to define rules can only infer one side of the assessment at a time.

Once the masses on rules are obtained, one can deduce the argument type of the assessed GSN pattern (C-Arg, D-Arg or H-Arg). The case of C-Arg is simple to identify, since verification of one premise (i.e., true) cannot infer the conclusion C alone. Thus,

Conversely, the denial of one premise (i.e., false) infers the conclusion denial ¬C. However, it is not the same for D-Arg. If a premise p 1 supports the conclusion C, then p 1 ∧ p 2 also supports it even if p 2 cannot. To keep consistency with the definition of D-Arg, we set the mass of the direct conjunction and the reverse elementary ones to

), if at least the mass on one elementary rule is equal to the one on the conjunction. In this case, we can say that the conjunction of premises does not bring additional support to the conclusion.

Then, once the masses of the rules are acquired and the propagation formula is specified, we can proceed to the next step of this assessment procedure by following the instructions below, for the considered system.

Note: The number of pieces of information/questions to collect, is a critical point of this interaction. The smaller the amount of data required, the easier the approach will be for both user and evaluator. We did not specifically drive any study to assess the best number of information items. But what we have done so far is to compare the number of pieces of information needed in some similar approaches and in ours. For instance, when using Bayesian approaches [START_REF] Nešić | A probabilistic model of belief in safety cases[END_REF][START_REF] Hobbs | The application of Bayesian belief networks to assurance case preparation[END_REF] to propagate confidence in the network, we need 2 n pieces of information to quantify the inference between a parent node and its child nodes (rules in our approach). Having only 2n + 2 questions per node represents an asset in favor of our approach.

Application phase

In this phase, the expert will be asked again n additional questions (1 question per premise). Hence, we end-up with 3n + 2 questions per node. These questions are grouped in a questionnaire [START_REF] Idmessaoud | Questionnaire for estimating uncertainties in assurance cases[END_REF].

Appendix A. Propagation formulas -detailed calculation

In the following, we present a detailed calculation of propagation formulas for the hybrid argument type (H-Arg) in the case of a conclusion (C) supported by two premises (p 1 ) and (p 2 ) in the numerical setting. Then, we present how we calculate the mass of conflict for "n" premises.

To calculate propagation formulas in a pure qualitative setting, it is enough to replace, respectively, the mass functions (BPA: m p , m r and m C ) and the conjunctive combination rule (equation 2) by qualitative capacity functions (BΠA: ρ p , ρ r and ρ C ) and the qualitative combination rule (equation 5). Since we always combine the same rules for each type of argument, all the following combination tables are the same for the quantitative and qualitative approach.

11: Combination of direct and reverse elementary rules for the H-Arg

Combination of premises and their elementary rules with the conjunctive rules (table A.10) for H-Arg

In Table A.14, we have chosen not to represent the focal elements resulting from Table A.13 which imply neither the conclusion nor its negation, so as to reduce the size of the table.

To calculate the belief degree of the conclusion, we sum the masses of all elements that imply the conclusion (C) in Table A.14 (dark grey areas).

56

see Tables A.11 and A.12

and simplify the calculation of the terms: [START_REF] Idmessaoud | A qualitative counterpart of belief functions with application to uncertainty propagation in safety cases[END_REF], we replace them by the sum of m 1 (p 1 ∧ C) and m 2 (p 2 ∧ C) from which we subtract the masses of the empty intersection and the redundant term

Notice that m 12 (∅) results from the combination in Table A.13 only, since the empty intersection does not appear when conjunctive rules are combined with themselves (i.e. direct and reverse rules in Table A.10) or with elementary rules (i.e. Table A .14), m C (∅) = m 12 (∅) includes only the conflict mass resulting from the combination of elementary rules (i.e. white entries 57 in Table A.13).

To calculate the conflict degree, we sum the masses of all elements that have an empty intersection (∅) in Table A. [START_REF] Idmessaoud | Belief functions for safety arguments confidence estimation: A comparative study[END_REF].

Keep also in mind that for frame of discernment with two elements (i.e. |Ω|= 2):

To calculate the disbelief degree of the conclusion, we sum the masses of all elements that imply the negation of the conclusion (¬C) in Table A.14 (bright grey areas).

. Conflict mass calculation

In this section, we calculate the conflict mass formula for "n" premises. Let us enumerate all conflicting combinations of 4 formulas when merging mass functions on premises and rules.

The case n = 2 is already addressed in the previous section. Hence, the sum m 12 (⊥)+m 13 (⊥)+m 23 (⊥) counts twice the product of three terms. There are 12 such terms, so we have to delete 6 of them (the ones in