A Scalability Analysis of Quantitative Confidence Assessment Methods for Assurance Cases Simon Diemert1[0000−0001−9493−7969] and Jens H. Weber1[0000−0003−4591−6728]
arXiv:2606.15480v1 [cs.SE] 13 Jun 2026
University of Victoria, Victoria, British Columbia, Canada {sdiemert,jens}@uvic.ca
Abstract. This paper proposes a model to estimate the decision complexity and effort required to apply quantitative confidence assessment methods to assurance cases. The model considers both the worst and average case for these measures and characterizes how these quantities scale with argument size. Prior work has indicated that the additional effort required to apply these methods is a barrier to their adoption by assurance case practitioners. Researchers developing new methods, or improving existing methods, can use this model to estimate the effort required to apply their method. The proposed model is parameterized using data from published case studies and is applied to three existing quantitative confidence assessment methods: the Bayesian Belief Network method, the Dempster-Shafer Theory method, and the Certus method. The results show that, while Certus has the highest worst-case decision complexity, its average-case effort is lower than the BBN and DST methods. Keywords: Assurance cases · Confidence assessment · Scalability
1
Introduction
Preparing an assurance case (AC) is a necessary activity for assuring safety- and security-critical systems in numerous domains, such as the automotive industry [1,2]. ACs are structured arguments, supported by evidence, that a system or organisation will satisfy desired quality attributes within a defined operating environment [4]. Numerous notations have been developed to express, organize, and manage ACs, with the most widely adopted being Goal Structuring Notation (GSN) [4,17]. However, the use of a structured notation alone does not ensure that an AC has adequately argued that a system fulfills its quality attribute(s). In particular, the authors or reviewers of an AC may be left wondering: do we believe the top-level claim is true?. Confidence assessment methods (CAMs) offer systematic means to evaluate an AC [9]. Numerous CAMs exist, and may be categorized as: qualitative (e.g., Assurance Claim Points [13], Eliminative Argumentation [11], and iTest [15]), quantitative (e.g., methods using Bayesian Networks [14,18] or Dempster-Shafer Theory [16]), or mixed (e.g., Assurance 2.0 [5] or Certus [10]). A recent survey of practitioners revealed that the additional effort required to apply a CAM, beyond what is normally required when preparing an AC, is Preprint accepted to the SASSUR’26 workshop. This preprint has not undergone peer review or any post-submission improvements or corrections. The Version of Record of this contribution is published in the SafeCOMP workshop proceedings when they become available via Springer.
2
S. Diemert and J. H. Weber
a key barrier to adoption [9]. In particular, for quantitative or mixed methods, significant effort might be required to both assign the computation’s parameters (e.g., weights on the argument graph’s edges) and to provide assessments for each piece of evidence supporting the argument (i.e., leaves in the argument graph). Graydon and Holloway observed a lack of scalability data or analyses for quantitative CAMs, remarking that: “it is not clear that [the surveyed] techniques requiring a substantial effort for each [argument step] will be feasible in practice ... the selected papers present no empirical evidence of scalability” [12]. It follows that researchers developing, or improving, quantitative CAMs, should evaluate the level of effort required to apply the method. This paper develops a numerical model for estimating the “decision complexity” of a quantitative CAM, i.e., the number of decisions a user of the CAM must make when applying it to an argument of a given size in both the worst case and average use cases. Using this model, the scalability of three quantitative CAMs is evaluated as the argument size changes. In this evaluation, parameters related to argument size are estimated based on previously published ACs. Then, the model is further parameterized to estimate the effort (i.e., time spent by a user) required to apply the method. The methods and results in this workshop paper are based on an analysis that was recently published in the first author’s doctoral thesis [8]. To our knowledge, this paper is the first to address the scalability of quantitative CAMs. The remainder of this paper is organized as follows. To begin, each of the three CAMs under analysis are introduced in enough detail to justify our modelling decisions. Next, the model for decision complexity and effort is introduced and then applied to the CAMs. The paper closes with a discussion of results, limitations, and next steps.
2
Methods for Quantitative Confidence Assessment
The scalability model developed in this paper is applicable to CAMs where: 1) the argument is expressed using a structured notation that represents the argument as a tree-like directed acyclic graph; 2) the user supplies valuations (belief, confidence, etc.) at the leaves of the argument; 3) the user annotates the internal structure of the argument with parameters or logic used to propagate quantities through the argument; and 4) a calculation or algorithm is applied to produce a valuation of argument’s top-level claim. Three CAMs satisfying these criteria are introduced below: the Bayesian Belief Network (BBN) method due to Hobbs and Lloyd [14], the Dempster-Shafer Theory (DST) method developed by Idmessaoud et al. [16], and the Certus method developed by Diemert and Weber [10,8]. While variations on both the BBN and DST methods exist (e.g., [18]), these methods were chosen as representative methods for their respective underlying theory of uncertainty. For instance, Hobbs and Lloyd’s BBN method is founded on probability theory.
2. METHODS FOR QUANTITATIVE CONFIDENCE ASSESSMENT
2.1
3
Overview of the BBN Method
Hobbs and Lloyd model an AC’s argument structure using a BBN [14]. Each claim in the argument is assigned a subjective degree of belief Pr(ci ) ∈ [0, 1], where 1 means the claim is believed true and 0 means it is believed false. Each leaf node in the argument, usually evidence, is annotated with a probability indicating the user’s belief. The user also provides three parameters for each step in the argument to configure the propagation of belief from child nodes to the parent node: – Combinator: Either NoisyAND or NoisyOR, describing whether the parent is supported conjunctively or disjunctively by its children. – Leakage: Captures the residual uncertainty not explained by the children. For NoisyAND, the leakage defines the belief the parent is false even if all children are true, and for NoisyOR, it defines the belief the parent is true even if all children are false. – Link Weight: Defines the influence of a child on the parent’s belief. For NoisyAND, this is the reduction in belief in the parent if the child alone is false, and for NoisyOR, it is the increase in belief if the child alone is true. These parameters are used to calculate the values in a conditional probability table (CPT) for each argument step. Then, following the standard procedure for Bayesian Networks, a conditional probability formula is used to compute belief in the parent from the children, thus propagating belief through the argument. 2.2
Overview of the DST Method
Idmessaoud et al. applied Dempster-Shafer Theory (DST), which is a generalization of probability theory [16]. Their method uses two measures to quantify the belief in the truth of a claim: decision d ∈ {d1 , . . . , d5 }, which captures the degree of acceptability from fully rejectable (d1 ) to fully acceptable (d5 ), and confidence c ∈ {c1 , . . . , c5 }, which captures the conviction behind the decision. For each leaf node in the argument, the user supplies both a decision and confidence assessment. Additionally, the user must provide several parameters for each argument step: – Combinator: either Simple, Conjunction, Disjunction, or Hybrid, indicating how to combine belief in a step’s children. – Direct Parameter: for each child node, describing the impact of the child on the parent if the child claim is believed to be true. – Reverse Parameter: for each child node, describing the impact of the child on the parent if the child claim is believed to be false. – Direct Rule: for the parent node, describing the collective impact the children have on the parent, if the children are all true.
4
S. Diemert and J. H. Weber
– Reverse Rule: for the parent node, describing the collective impact the children have on the parent, if the children are all false. As with the BBN method above, these parameters are used to configure a series of computations that propagate the user’s assessments from the leaves of the argument to the root to produce an overall decision and confidence measure. 2.3
Overview of the Certus Method
Certus is a mixed (quantitative and qualitative) method for confidence assessment that uses a domain-specific language to describe belief in an AC’s argument [10,8]. Rather than assigning numerical probabilities, Certus uses linguistic belief levels to describe belief in the argument. Nine “canonical” belief levels are suggested, ranging from reject (the claim is surely false) to certain (the claim is surely true). The belief levels represent fuzzy sets over a belief scale defined using possibility theory [8]. The user may choose to interact with Certus linguistically, using the named belief levels, or numerically, using degrees of membership in fuzzy sets. The levels range from reject (the claim is surely false) through uncertain (maximum uncertainty) to certain (the claim is surely true), providing an expressive yet interpretable vocabulary for belief. To use Certus, the user annotates each node in the argument with a belief assignment expression. Leaf nodes are usually assigned belief levels directly, e.g., E1 is certain. Internal nodes in the argument are annotated with expressions that describe how belief in the children combine to produce a belief in the parent. The Certus language provides several mechanisms for expressing belief propagation: comparison and logical operators (e.g., >=, and), built-in functions (e.g., min, max), cases conditional expressions, and higher-level macros such as #MIN (the minimum among the child beliefs) and #FUSE (approximately the average belief among child nodes). Figure 1 illustrates these ideas on a small adaptive cruise control (ACC) argument1 from [8]. Belief annotations appear in the top-right corner of each node (e.g., L for low, SK for skeptical), and Certus expressions are shown in partial rectangles connected by dashed lines.
3
Model for Estimating Decision Complexity and Effort
This section develops models for estimating the decision complexity and level of effort required to apply a quantitative CAM for worst case and average case of using the CAM. For the purpose of this analysis, “decision complexity” is defined as the number of decisions a user must make while applying a CAM, including decisions related to selecting leaf valuations or selecting propagation parameters. The level of effort model aims to translate the decision complexity into a measure that represents the duration of time a user might require to complete the analysis. The “worst case” measure imagines that user must make every possible decision 1
This argument fragment is intended for illustrative purposes, and might be incompleted. Notably, it does not address the possibility of driver “mode confusion”.
3. MODEL FOR ESTIMATING DECISION COMPLEXITY AND EFFORT
The ACC does not reduce the safety of the vehicle while disengaged.
L
C6100
C6100 is #FUSE
SK
C6000
C6000 is cases C6200 >= high -> C6100, otherwise min(C6100, C6200)
The ACC will not request braking or engine torque except when engaged.
C6110 is min(E6112, high)
H
C6110
When disengaged a hardware interlock blocks control signals from the ACC.
When disengaged the ACC does not request braking or engine torque.
VH
E6121
FMEA shows the interlock failing in a way that allows the ACC to control the vehicle is highly unlikely.
Source code inspection shows that the ACC will not request braking or engine torque while deactivated.
OK
OK
E6112 is certain
SK
The ACC can only affect the vehicle through braking and engine torque.
L
C6120
C
E6112
C6200 is cases D6220 is certain -> reject, D6220 >= vhigh -> vopposed, D6220 >= high -> opposed, D6220 >= low -> skeptical, otherwise uncertain
C6200 C6120 is cases E6121 <= low -> E6121, otherwise low
5
L
D6220
Unless the ACC affects vehicle electronics through unintended pathways. RES
D6220 is low
E6121 is vhigh
Fig. 1: Applying Certus to an argument fragment; from [8].
entailed by the method whereas the “average case” assumes that sensible default values and tool support can be used to reduce the number of decisions. 3.1
Modelling an Argument Structure
For this analysis, an AC’s argument is modelled as an n-ary tree of claims with height h > 1, where each leaf claim has m child evidence nodes. While real ACs have much more diverse structures, this admittedly artificial model of argument simplifies the analysis while also permitting meaningful comparison among quantitative CAMs. This model is visualized in Figure 2 a tree with h = 3. h=1
h=3
nh- 1 Claims p decisions per Claim
…
h=2
…
… m·nh-1 evidence nodes v decisions per Evidence
Fig. 2: Model of AC argument structure for analysis.
The n-ary tree of claims has a total of nh − 1 nodes, each being a parent whose belief is computed based on n ∈ N children. Let p ∈ N be the number
6
S. Diemert and J. H. Weber
of decisions that a user of a CAM must make for each parent node. The hth layer of the claim tree has nh−1 parent nodes that are each supported by m ∈ N evidence nodes. In total there are m · nh−1 evidence nodes. Let v ∈ N denote the number of decisions that a user must make about each evidence node.
3.2
Worst Case Decision Complexity
Using the above construction of an argument, the number of decisions that a user of a CAM must make to apply the method in the worst case is: Od
p · (nh − 1) + v · m · nh−1
(1)
Where O(. . .) is Big O notation, the first term is the number of decisions to configure belief propagation among claims, and the second term gives the number of leaf valuations.
3.3
Average Case Decision Complexity
In practice, the user does not need to make a decision for every analysis input. Method implementations or tools can use sensible defaults that represent the most common configurations. Let αn and αm denote the proportion of cases where a user must fully specify an argument step’s configuration (p decisions) or leaf valuation (v decisions). In the other 1 − α cases, a smaller number of decisions are required, p′ and v ′ respectively: Ωd (nh − 1) · αn · p + (1 − αn ) · p′ + m · nh−1 αm · v + (1 − αm ) · v ′ (2) When αn = αm = 1, the average case reduces to the worst case above. 3.4
Estimating Effort
Let tp denote the time in minutes to make a single decision about belief propagation in an argument step, and tv the time to make a single leaf valuation decision. The total effort in minutes is: T = tp · (nh − 1) · αn · p + (1 − αn ) · p′ + tv · m · nh−1 αm · v + (1 − αm ) · v ′ (3)
4
Selecting Model Parameters
The model for decision complexity and effort derived in Section 3 has a number of parameters that must be selected before it can be used for a scalability analysis.
4. SELECTING MODEL PARAMETERS
4.1
7
Selecting Argument Size Parameters
The two parameters, n and m, govern the size of arguments generated by this model. These parameters are estimated using data from a selection of published AC case studies as shown in Table 1. Using the averages values, summing evidence and residual defeater nodes for leaf count and claims plus defeaters for internal nodes gives: 222 = nh − 1
and
131 = m · nh−1
Taking h = 10 yields n ≈ 1.72 and m ≈ 1, which is consistent with ACs having 1–2 child claims per argument step and one evidence node per line of reasoning.
Table 1: Reported node counts for a selection of ACs in the literature. Argument
4.2
Claims Evidence Defeaters
Res.
Sum
CERN LHC MPS [19]
146
70
105
9
330
Argument #1 from [7]
184
147
153
19
503
Argument #2 from [7]
188
144
130
28
490
Argument #3 from [7]
94
81
79
7
261
ILI Trust Argument [6]
142
165
45
-
352
Ventilator Argument [3]
113
54
81
37
285
Average
144
110
99
21
370
Selecting α for the Average Case Analysis
For the average case, we select αn = αm = 0.20. This corresponds to a scenario where 1 in 5 argument steps requires non-trivial decision-making. This value was informed by observations from other analyses, including a case study and expressivity analysis, in which 21% of reasoning steps required custom belief propagation expressions [8].
4.3
Selecting CAM-Specific Parameters
The decision complexity and effort models require that the p, p′ , v, and v ′ parameters be selected for each CAM being analyzed.
8
S. Diemert and J. H. Weber
BBN Method. In the worst case decision complexity, a user of the BBN method must make p = n + 2 decisions per parent claim in the argument. Each child has a link weight parameter and then the combinator and leakage parameter must be selected. For evidence a single decision is made per node, so v = 1. For the average decision complexity, let the α case be the same as the worst case above (p = n + 2, v = 1). However, suppose that for the 1 − α case, tooling assists the user so that they must only select the combinator (NoisyAND or NoisyOR) for each parent claim. Further, suppose the tool also assigns link weights for each child to evenly distribute their contribution to the parent (e.g., wi = 1/n for NoisyAND). The leakage parameter defaults to k = 1, giving p′ = 1. For evidence, the user is still required to assign a belief for each leaf node, so v ′ = 1. DST Method. For the worst case decision complexity, a user of the DST method must make p = 2n+3 decisions per parent claim in the argument. Each child has two parameters (the forward and reverse parameter) and each parent has a combinator, a combining forward, and combining reverse parameter. For evidence, two decisions must be provided per node, one for the “decision” and “confidence”, so v = 2. For the average decision complexity, let the α case be the same as the worst case above (p = 2n + 3, v = 2). However, suppose that for the 1 − α case tooling assists the user so that they only need to select a combinator, so p′ = 1. For the evidence, two decisions must still be made, so v ′ = 2. Certus. For the worst case decision complexity, suppose that a user of Certus must write a custom belief propagation expression over all child nodes in an c1 , c2 , this is: argument step and belief levels. For an argument step c0 c0 is cases c1 is reject and c2 is reject -> reject, ... c1 is certain and c2 is vhigh -> vhigh, c1 is certain and c2 is certain -> certain, otherwise uncertain
There are nine belief levels defined by Certus, so this gives p = 9n decisions per argument step for the worst case. The number of leaf valuations for evidence is v = 1, since a user can make an assignment with a single decision. This worst case for Certus is quite extreme; several features of the Certus language exist to avoid such scenarios, including macros and user-defined operators. For the average case, suppose a user must manually craft a belief propagation expression with p = n decisions α percent of the time, and in the other 1 − α cases they can use Certus’ macros or a user-defined operator that require only a single decision, so p′ = 1. Valuation of leaf nodes remains as v ′ = 1 since every leaf must be assigned a belief level as input. 4.4
Selecting Time and Effort Parameters
The parameters tp and tv must be chosen to model effort/time estimates. For simplicity, the same parameters are used in both the worst and average case analyses. Suppose that each evidence valuation takes (on average) tv = 5 minutes
5. SCALABILITY ANALYSIS
9
of effort to complete. In practice, some might be much faster and others might take significantly longer. For example, many evidence checks amount to simple binary decisions (e.g., “was this document approved?”), which could be completed within a few seconds, but others might require lengthy reviews, consultation with interest holders, and so on. For the argument steps, suppose that each decision takes tp = 0.5 minutes (30 seconds) to complete. As with evidence valuation, this is intended as an average, with many decisions taking just a few seconds and others requiring more time.
5
Scalability Analysis
The worst and average case decision complexities for the Certus, BBN, and DST methods are estimated using the model developed in Section 3 with the parameters selected in Section 4 for different choices of argument height (parameter h). The results are visualized in Figure 3. Table 2 gives the detailed decision complexity values and Table 3 gives the corresponding effort estimates.
5,000
Worst Case for Certus (α=1) at h=12 is 30,088 decisions
Worst Case Certus (α=1) Worst Case BBN (α=1) Worst Case DST (α=1) Average Case Certus (α=0.2)
4,000
Average Case BBN (α=0.2)
Number of Decisions
Average Case DST (α=0.2)
3,000
2,000
1,000
0 1
2
3
4
5
6
7
8
9
10
11
12
Height of Claim Tree (h)
Fig. 3: Scalability analysis results for 1 ≤ h ≤ 12.
The results for h = 10 are taken as representative in terms of argument size, based on published case studies in Table 1. At this size, Certus has the worst worst-case decision complexity, requiring over 10,000 decisions, compared to the BBN method (971 decisions) and the DST method (1,716 decisions). However, in the average case Certus’ decision complexity is the lowest. A similar trend
10
S. Diemert and J. H. Weber
exists for the effort estimates. On average, for an argument with approximately 350 nodes, our model predicts that it would take 13 hours of effort to apply Certus, 14 hours for the BBN method, and 26 hours for the DST method.
Table 2: Decision complexity (Od / Ωd ) in the worst and average cases. Argument Size
Worst Case (Od , α = 1) Average Case (Ωd , α = 0.20) Certus BBN
h
|C| |E| |C| + |E|
1 1 1 2 2 2 3 4 3 4 8 5 5 14 9 6 25 15 7 44 26 8 76 45 9 131 77 10 226 132 11 389 227
6
2 4 7 13 23 40 69 120 207 357 615
Od
DST
Certus BBN
DST
Od
Od
Ωd
Ωd
Ωd
34 4 89 9 185 18 350 34 633 61 1,120 108 1,958 188 3,399 326 5,878 563 10,141 971 17,475 1,673
7 16 32 60 108 190 332 576 995 1,716 2,957
2 4 8 14 25 44 76 131 226 390 671
2 5 9 17 30 53 93 161 278 480 827
4 8 14 26 47 82 143 247 426 735 1,265
Discussion
From the scalability analysis results above, in the worst case, a user applying Certus to assess belief in an AC must make significantly more decisions than when using the BBN or DST methods. This is not surprising: among the methods analyzed, Certus aims to offer greater flexibility in belief propagation expressions, which comes at the cost of higher decision complexity in extreme scenarios [8]. However, in the average case, Certus users make marginally fewer decisions than BBN users and roughly half as many as DST users. Beyond the results of the scalability analysis, this paper makes two conceptual contributions to the field of quantitative confidence assessment. First, in response to concerns raised by practitioners [9], it has introduced two measures to understand the additional work required to apply a CAM: decision complexity (number of decisions) and level of effort (in hours). Second, it has proposed a numerical model for estimating these quantities. The application of the model to three different quantitative CAMs serves as a means of preliminary validation of the concept. There are several limitations and areas of future work that could be explored related to the effort required to apply quantitative CAMs. Limitations of the Argument Model. The argument model is an idealized n-ary tree chosen for analytical tractability. Real ACs are not uniform trees: some
6. DISCUSSION
11
Table 3: Effort estimates (T , in hours) in the worst and average cases. Argument Size
Worst Case (T , α = 1) Average Case (T , α = 0.20) Certus BBN
h
|C|
|E| |C| + |E|
1 1 1 2 2 2 3 4 3 4 8 5 5 14 9 6 25 15 7 44 26 8 76 45 9 131 77 10 226 132 11 389 227
2 4 7 13 23 40 69 120 207 357 615
DST
Certus BBN
DST
T
T
T
T
T
T
1 2 5 9 17 30 52 90 156 270 465
0 0 0 1 1 2 4 6 10 18 31
0 0 1 1 2 4 7 11 20 34 59
0 0 0 0 1 1 3 4 8 13 23
0 0 0 1 1 2 3 5 8 14 24
0 0 1 1 2 3 5 9 15 26 45
have long chains of reasoning that are considerably deeper than the average, and others have a handful of wide argument steps alongside mostly narrow ones. In the present study, this concern is partially mitigated by grounding parameter choices in published case studies, but the model is unlikely to perfectly predict decision complexities for real-world ACs. A future analysis could use statistical simulations parameterised with structural data from industrial partners. Limitations of the Decision Parameters. The model counts the number of decisions but not their relative difficulty. For instance, the DST method requires v = 2 decisions per leaf valuation on a five-point ordinal scale, whereas the BBN method requires one decision on a continuous [0, 1] scale. Whether one is harder than the other for AC developers is an open empirical question not addressed by the current model. Limitations of the Timing Parameters. The timing parameters tv and tp were chosen based on intuition rather than empirical data, and are likely contextdependent (e.g., developer skill, argument domain). As a result, the effort estimates should be treated as rough illustrations rather than precise predictions. A calibration study would be necessary to produce accurate timing parameters for a given deployment context. Acknowledgments. This work was supported by the Natural Sciences and Engineering Research Council (NSERC). Disclosure of Interests. In addition to his role at the University of Victoria as a Ph.D. student, author S. Diemert is employed by Critical Systems Labs Inc., a Vancouver-based company that develops commercial tools for AC management.
12
S. Diemert and J. H. Weber
References 1. Road vehicles - Functional safety. Standard ISO 26262, International Organization for Standardization (2018) 2. ISO/PAS 8800:2024 Road vehicles — Safety and artificial intelligence. Standard 8800, International Organization for Standardization (2024) 3. Demonstration Safety Case Argument for the Gravity Ventilator (gVent). Tech. rep., Critical Systems Labs Inc., Canada (2025), https://criticalsystemslabs. com/wp-content/uploads/2025/12/gVent-Safety-Case.pdf 4. Assurance Case Working Group: Goal Structuring Notation Community Standard (Version 3). Standard, Safety Critical Systems Club (2021) 5. Bloomfield, R., Rushby, J.: Assessing Confidence with Assurance 2.0. Tech. Rep. SRI-CSL-2022-02, SRI International (2022) 6. Casey, A., Millet, L., Joyce, J., Nachiappan, V., Keane, S.: Using Eliminative Argumentation to Enhance Trust in ILI Results. In: Proceedings of the ASME 2024 14th International Pipeline Conference (IPC2024). Calgary, Canada (Feb.) 7. Diemert, S., Joyce, J.: Eliminative Argumentation for Arguing System Safety - A Practitioner’s Experience. In: 2020 IEEE International Systems Conference (SysCon). pp. 1–7 (2020) 8. Diemert, S.: Confidence in Dynamic Assurance Cases. Dissertation, University of Victoria, Victoria, BC, Canada (May 2026), https://dspace.library.uvic.ca/ items/71de88af-ede1-4654-9899-aa5a7a6cdfee 9. Diemert, S., Shortt, C., Weber, J.H.: How do practitioners gain confidence in assurance cases? Information and Software Technology 185, 107767 (Sep 2025) 10. Diemert, S., Weber, J.H.: Certus: A Domain Specific Language for Confidence Assessment in Assurance Cases. In: Computer Safety, Reliability, and Security. SAFECOMP 2025 Workshops. pp. 211–225. Springer Nature Switzerland, Cham (2025) 11. Goodenough, J.B., Weinstock, C.B., Klein, A.Z.: Eliminative Argumentation: A Basis for Arguing Confidence in System Properties. Tech. rep., Carnegie Mellon University - Software Engineering Institute (2015) 12. Graydon, P.J., Holloway, C.M.: An investigation of proposed techniques for quantifying confidence in assurance arguments. Safety Science 92, 53–65 (2017) 13. Hawkins, R., Kelly, T., Knight, J., Graydon, P.: A New Approach to Creating Clear Safety Arguments. In: Advances in Systems Safety, pp. 3–23. Springer (2011) 14. Hobbs, C., Lloyd, M.: The Application of Bayesian Belief Networks to Assurance Case Preparation. In: Achieving Systems Safety, pp. 159–176. Springer (2012) 15. Holloway, C.M., Wasson, K.S.: A Primer on Argument Assessment. Tech. rep., National Aeronautics and Space Administration (NASA) and Joby Aviation (2021) 16. Idmessaoud, Y., Dubois, D., Guiochet, J.: Confidence assessment in safety argument structure - Quantitative vs. qualitative approaches. International Journal of Approximate Reasoning 165, 109100 (2024) 17. Kelly, T.P.: Arguing Safety - A Systematic Approach to Safety Case Management. PhD thesis (1998) 18. Nešić, D., Nyberg, M., Gallina, B.: A probabilistic model of belief in safety cases. Safety Science 138, 105187 (Jun 2021) 19. Viger, T., Joyce, J., Diemert, S., Menghi, C., Chechik, M., Uythoven, J., Zerlauth, M., Felsberfer, L.: Assessing the Usefulness of Assurance Cases: Experience with the Large Hadron Collider. Systems Engineering (2025)