Eliminative argumentation is an alternative approach to building an assurance case. The argument is typically constructed positively and focuses on demonstrating why we believe the goal has been achieved. Eliminative argumentation relies on the constant questioning of “what if?”. The structure of the argument can be quite similar to that of a standard positive argument, but the focus is on identifying weaknesses in the argument that hinder its purpose. This is achieved by explicitly pointing out possible weaknesses as defeaters and then explicitly demonstrating that they are not valid. The strength of this approach lies in the explicit presentation of all known defeaters. This avoids the error of excessive optimism and distorting the facts to suit the intended purpose.
The process of building an eliminative argumentation is also slightly different. For each step of reasoning, starting with the top claim, an analysis is performed to identify all possible reasons why the goal cannot be achieved. Each obstacle is explicitly described in the argument as a defeater. In the next step, for each defeater, an argument must be found, supported by evidence, that a given defeater is ineffective. For this argument, it is also necessary to examine possible further defeaters that could render it ineffective. The work on the argumentation continues until no more defeaters can be identified and all defeaters have been successfully rejected.
We will examine the application of the eliminative argumentation approach using a simple example taken from the first publication on this approach, the 2015 SEI report “Eliminative Argumentation: A Basis for Arguing Confidence in System Properties.” The purpose of the argument is to demonstrate that the light in the room is working.
Now let’s look at this using the eliminative argumentation approach. The main goal will be the same, but we don’t create a positive strategy around it. Instead, we look for conditions that might prevent the bulb from turning on. We add these conditions as “unless…” stipulations. We start by saying that the bulb will turn on unless there’s no power. Next, we can say that the bulb will turn on unless the switch is not connected. Once the list of known problems is exhausted, we can add “unless another, as yet unknown, problem occurs.”
The condition for completing this step of the argumentation development is the lack of knowledge of other possible defeaters. If we learn of any other possible reason that could prevent the proposed postulate from being met, it should be added as another defeater.
For each deeater identified in the argument, you must now provide evidence that the given defeater will not occur in your system. This may be described by one or more claims or a strategy supported by an argument. It is important to present convincing evidence that the defeater doesn’t pose z risks or the risk is sufficiently low. For unknown defeaters, you should demonstrate that you have completed enough identification activities and identified enough of them that continuing will no longer provide any benefit in reducing the risk level.
The resulting argument has a similar structure to the traditional approach, but it explicitly states the defeater challenging the argument goals. In our example, the list of evidence is almost identical. The only difference stems from the fact that justification J1 in the first diagram is not supported by any evidence.
Although it requires more work, eliminative argumentation has the advantage that it explicitly presents defeaters, which facilitates argument verification. This allows for a potentially higher level of argument quality and trustworthiness.
This approach can now be used in PREMIS. The methods of arguments presentation and the assessment functions have been extended to include a new type of argumentation elements, defeaters.