Argumentation has been studied for millennia, largely under the name of rhetoric (see Dixon, 1971, for a concise history of the subject), although its study fell largely into disrepute after its heyday in Greek and Roman times. Recently, it has seen a revival in many diverse areas such as strategic decision making (e.g. Mason and Mitroff, 1981; Vari, Vecsenyi & Paprika, 1985; Conklin and Begeman, 1988), computational linguistics (e.g. Cohen, 1987), design rationale (Lee and Lai, 1991) and legal expert systems (e.g. Marshall, 1989; Storrs, 1991) as well as in philosopy (e.g. Perelman and Olbrechts-Tyteca, 1971; Ehninger and Brockeriede, 1978). A well-founded, general purpose notation for argumentation would be of considerable value in these and many other fields.

This paper presents a scheme for representing argumentation. The scheme is based around a notation developed by Stephen Toulmin (Toulmin, 1958; Toulmin, Reike and Janik, 1984) for capturing what he called practical arguments. These are reasoned discourses (Perelman and Olbrechts-Tyteca, 1971) which seek the adherence of an audience to some course of action.

Since 1989, the ASAM project (Forder, Higgins, McDermid and Storrs, 1993) has been looking into ways of representing argumentation about the safety of safety-critical systems. The decision to deploy such systems depends on arguments (safety cases) which hope to show that the system in question is acceptably safe to deploy for some purpose. The arguments are often very large (many volumes of text and figures) and may involve the use of specialist notations for parts of the argument and the data it uses (e.g. calculations of probabilities or the drawing of system components). Nevertheless, the bulk of the high-level safety argumentation is in natural language.

Safety cases are normally so large and complex that they are difficult to manage, to maintain, to check and even to understand. We have sought to use a notation for argumentation that will make explicit the structure and detailed content of an argument so that arguments are easier to construct, to inspect and to understand. Following our successful use of Toulmin’s notation (hereafter, Toulmin Form) on the Alvey DHSS Large Demonstrator project (Storrs, 1991) we chose this notation as the basis for our work in ASAM. However, as we had discovered and as has been found by other research groups (Newman and Marshall, 1990, Lee, 1991), Toulmin’s notation is inadequate for capturing the whole of a real argument. This paper seeks to show the ways in which Toulmin Form is inadequate and to suggest a number of augmentations which are needed to allow us to capture more of the argument. We also describe, in detail, extensions to and an interpretation of Toulmin Form which we call Extended Toulmin Form, or ETF.

Toulmin Form is based on the assumption that each step in an argument—each micro-argument—can be expressed using a simple syntax. It will be useful briefly to review the rationale behind the form that Toulmin devised.

If we make an assertion, Toulmin argued, we commit ourselves to the claim that it involves. If that claim is challenged, we will, normally, produce some facts to support it. The facts themselves may be challenged and, if so, will require their own support so that they may be agreed and the argument may progress. This gives us a basic and simple distinction between a Claim and the Data which supports it. Of course, the Claim may still be challenged, not now on the basis of its factual support but on the question of why we believe those Data support that Claim. What the challenge demands are the "rules, principles, inference licences or what you will" that justify the step from Data to Claim. Such justifications Toulmin calls Warrants; "general, hypothetical statements which can act as bridges and authorise the particular step to which our argument commits us". The basic form of an argument is therefore;

Figure 1: Toulmin's basic micro-argument form

The nature of our Warrant will affect the amount of force that the argument gives to the Claim. If our Warrant does not allow us to draw a conclusion with complete certainty from the Data, then our assertion of the Claim must be qualified to indicate this. This is the purpose of the Qualifier. There are also conditions of exception or Rebuttal which indicate circumstances in which the general authority of the Warrant would not hold. Rebuttals should be thought of as potential rather than actual reasons why the argument might fail. That is, when we use a Rebuttal we are saying; "We can make this Claim (qualified as appropriate) on the basis of this Warrant and these Data unless we believe in this Rebuttal". In addition, the authority of the Warrant itself may be challenged, in which case we need to provide explicit support for it in the form of a Backing. A Backing is a set of statements which, in a particular field of argument, are unlikely ever to be disputed by the audience. Toulmin's complete argument form therefore looks like this;

Figure 2: Toulmin's complete micro-argument form

The ASAM project and the DHSS Demonstrator project before it (Storrs, 1991), have examined in detail written arguments in the areas of legislative policy and safety-critical system development as well as some in other areas. It is clear that an important portion (perhaps as much as 50%) of the content of an argument is made up of statements which determine the scope, purpose, subject, context and method of the argument and do not constitute reasoning. It is difficult to represent any of this in a natural way using Toulmin Form.

Real arguments contain statements which constrain their scope in two ways. Firstly they determine the domain of the argument, saying what the subject of the argument is and which aspects of the subject are included and which are excluded. Secondly they set a particular context for the argument, saying which individuals in the domain and what particular states of the domain are to be discussed.

If we look at the subject of the argument in particular, we find there are many statements used in arguments which act to introduce terms, define terms and describe systems. We need to step outside Toulmin Form to define terms and describe systems because the entities, relationships and processes we wish to describe will form a major part of the vocabulary of the argument. We can think of this set of statements as constituting a model and a theory for the argument. The model describes the objects in the domain and their properties while the theory is the set of rules that describe their interactions. It is from the model that the facts in statements in an argument are drawn and it is from the theory that warrants may be obtained. Other researchers have come to very similar conclusions about the nature of models and theories and their relationships to arguments. Krause, Fox and Ambler (in press) propose a scheme for automatic argumentation where the model and theory (data and theory in their terms) provide the knowledge base for a theorem prover whose proofs of a statement (claim) constitute a set of arguments (grounds) for or against the statement.

As an example of the occurrence of models and theories in arguments, the UK Health and Safety Executive publish a two-volume standard for how to produce arguments about the safety of programmable electronic systems (Health and Safety Executive, 1987). Volume 2 (PES2) contains an example of a system for controlling the rate of the reaction in a chemical plant. The safety argument for the system begins with a lengthy description in text and in diagrams of the chemical plant and the control system and its sensors and effectors. In order completely to represent the PES2 argument, we would have to model this chemical plant in some detail—including the temporal and spatial aspects of its operation. The important point for this discussion is that to do this we must use some other modelling tool than Toulmin Form.

The model and the theory for an argument form part of the context in which the argument is made. As well as the model and theory, the context comprises additional facts and constraints that are added or assumed in the course of the argument. As an argument moves and develops it manipulates its local context through statements about strategy (see below) and by asserting new facts and constraints. Some of the facts and constraints asserted in this way have the status of assumptions—they are asserted tentatively with no strong commitment on the part of the arguer to their truth—others have the status of knowledge—the arguer is committed to a belief in their veridity, at least in the current context—and we would expect to find these statements reflected in the model. Assumptions may later be asserted into the model or theory if they are sufficiently well-supported by the argument. The claims of arguments also become part of the context and may eventually be absorbed into the model and theory if there is sufficient commitment to them.

It is also the case that real arguments contain a lot of material which is there to provide a rhetorical structure for the argument. Many statements throughout an argument will tell the audience about the strategy that the arguer is adopting to reach the conclusion. Others will state what the goals of the argument are, breaking down the goals into sub-goals as the strategy requires so that intermediate conclusions can be understood in terms of the rhetorical purpose they serve.

It seems, from our analysis, that real argument has five essential components:

It has become clear that, while the form described by Toulmin is a general-purpose notation, suitable for writing each inference step in an argument, it is inadequate in three main areas:

To overcome these shortcomings, we have extended Toulmin Form in a number of ways. Firstly, so as to allow the representation of rhetorical structure, we have developed a notion of problem structuring. This involves creating a network of goals to represent the overall structure of the argumentation. The goal structure is dictated by a solution strategy which also manipulates the context for each goal. The goal structure is itself represented as a lattice of argument steps. For each goal, there can be some detailed argumentation which leads to a Claim which satisfies the goal or which states that the goal cannot be satisfied. These are known as solutions and the statements in them are drawn from the context. Thus the complete form contains languages for describing models and theories (i.e. contexts) as well as argument steps and relations for creating goal structures.

For several reasons, Extended Toulmin Form (ETF) has a slightly different appearance from the original. Figure 3 shows the form currently supported by the ETF editor in the final ASAM prototype. The changes are mostly cosmetic (boxes around the argument components and the introduction of extra arrowheads on the lines) but there are others which are very significant.

Figure 3: The ASAM version of Extended Toulmin Form

We have added an extra node to the diagram which we call the Argument Node. This is the circle between the Data and Claim components. The Argument Node carries an unique label for the micro-argument and may be thought of as the name of the micro-argument, which one could use to refer to the micro-argument as a whole rather than to any of its parts.

The other important change is that the Rebuttal is now linked to the Argument Node rather than to the Qualifier as Toulmin has it. It is to emphasise the fact that the Rebuttal is of the micro-argument’s ability to make its Claim rather than of the Claim itself. To illustrate this, consider the "Bermudan" argument from Toulmin (1958). This goes:

Figure 4: Toulmin’s "Bermudan" argument.

The implication from Toulmin’s layout is clearly that the Rebuttal is a potential challenge to the force with which an argument can make its Claim, not of the Claim itself (a common misinterpretation). Hence, presumably, its attachment by Toulmin to the Qualifier. We wished to make it absolutely clear in our own layout, that the Rebuttal is of the Warrant’s ability to sanction the move from Data to Claim. That is, it is a Rebuttal of the argument step itself rather than of the conclusion of the argument. It is interesting to note that Ehringer and Bockeriede (1978) attach the Rebuttal to the link between the Warrant and the Data-Claim arrow.

In either case, the Qualifier is not determined by the Rebuttal but by the degree to which we can reliably deduce the Claim from the Data on the basis of the Warrant. This means that the Qualifier too should be thought of as attaching to the Argument as its effect on the Claim is only valid in the context of the micro-argument and does not propagate. We draw it attached between the Argument and claim partly for consistency with Toulmin but mostly to improve the readability of the micro-argument.

A corollary of this interpretation of qualification is that a separate mechanism needs to exist for determining the degree of belief that we have in the claim. The mechanism might consist of a calculus and rules for the propagation of belief statuses. As yet we have only tentative suggestions as to what these might be although there are proposals in the literature (e.g. Mason and Mitroff, 1981).

The final change is to add another new component to the form. This allows statements to stand in the role of Contradiction with respect to other statements. One of the most important uses for the new component is in the denial of Rebuttals but it also allows contradiction to be used structurally as part of—and at the same level as—the micro-argument network. Although the component is shown attached to the Claim in figure 3, one or more Contradictions may in fact be attached to any or all components except the Qualifier.

The concrete syntax of ETF includes constraints on the spatial locations of micro-argument components. These constraints are mostly relative to the Argument Node. The Data must be to the left of this node, the Qualifier to the right and the Claim to the right of that. The Rebuttal must be above the Argument Node and the Warrant below it, with the Backing below the Warrant. The Contradiction may be placed without constraint. There can be only one Argument Node per micro-argument, only one Claim, one Qualifier and one Warrant. There may be one or more Data, Rebuttals, Backings or Contradictions.

People new to using Toulmin Form have considerable difficulty in trying to analyse arguments so as to determine whether particular statements are Data, Warrants, Backings or whatever. The root of the difficulty is that the Toulmin Form components do not determine the type of the statements they contain: they simply indicate the role that the statement is playing relative to a particular argument step (micro-argument). That the role of a statement can change from step to step in an argument is clear from the way that the Claim of one micro-argument can be used as a Datum for another. The warrant-establishing arguments that Toulmin wrote about are clearly ones in which the statement in the Claim of one argument is intended to be used in the Warrant of another. In fact, on considering the permutations, it is obvious that any statement—with the sole exeption of the Qualifier—can be used in any component (that is, in any role) and it is the role of a statement with respect to a micro-argument which determines whether it is a Datum or a Backing and not any intrinsic property of the statement.

The diagrammatic version of Toulmin Form (and ETF) is there to make apparent the role that each statement is playing in an argument step.

Backings exist as support for Warrants. That is, if a Warrant is challenged, an appeal can be made to sets of commonly accepted facts or principles that will convince the challenger. For example, if we use the Warrant "married women rarely work for a living" (as Beveridge did in the 1940’s in an argument about social policy), we might give as Backing the data from the 1931 UK census showing that only one in eight married women were in work. The census data was, in the field of argument, authoritative and indisputable.

Problems of interpretation sometimes arise if the Backing is a set of rules or principles (as in the Bermudan argument above). Toulmin offers very little help in telling a Backing from a Warrant—giving us little more than a few examples. However, it seems that a principle can be given that solves the difficulty. This is that we should see the Backing-Warrant relationship as being shorthand for a (possibly large) Warrant-establishing argument where the Backing provides the Data, the Warrant is the (ultimate) Claim and there is another Warrant (or chain of reasoning) sanctioning the move which is left implicit. We might redraw ETF to emphasise this as in figure 5.

Figure 5: Backings as Data for implied Warrant-establishing arguments. The subscript i indicates an implicit component.

Warrants are now seen as having been derived by processes such as induction from sets of agreed Data or by methods such as generalisation or specialisation from other rules.

This view of Backing has far-reaching consequences for our interpretation of all of the other components and allows us to talk about implied Rebuttals and Qualifiers as well as the implied Warrant. We can regard the Backing-Warrant arguments as forming a "shell" of argument around the one we are constructing, providing us with a set of Warrants which together define the valid arguments for the field in which we shall argue. In effect, we have, in large part, made definite Toulmin’s vague notion of a "field of argument".

There is an interesting contrast now between the kind of Data that appear in an argument and the kind which may be used as Backings. Even though they are seen to be performing a similar role in their respective arguments, the difference between them is in their status with respect to the argument we are making. As the foundation for the Warrants which determine what is valid reasoning within the field, Backings can be seen to stand outside the field of argument. They are thus (normally) not available to be reasoned about within the field (ie using the Warrants in the field) but are subject to the ways of reasoning appropriate to some other field. This is why, within any field, the Backings are normally taken as being beyond challenge and may be assumed to be universally accepted.

We take the view that Warrants may have more than one Backing. In effect, we are saying that a Warrant may be established by more than one argument. If we accept this, then we must apply the same interpretation to the qualification of Warrants as we do to the qualification of Claims. That is, the qualification is of the argument’s ability to make its Claim not of the statement in the Claim. This means that we see it as incorrect for a qualifier such as "generally" to be embedded within a Warrant (as in the Bermudan argument). This properly belongs on the argument which established the Warrant. So, each Warrant-establishing argument and thus also each Backing-Warrant pair should have its own Qualifier. The qualification of Warrants by embedding the Qualifier, in the style of Toulmin’s Bermudan argument, should, we think, be permitted as a convenient shorthand which will serve for most practical purposes—just as we are happy to retain the unexpanded Backing-Warrant link as a convenient shorthand.

The argument from Beveridge, given above, illustrates an interesting property of fields of argument which deserves further exploration. In our work on analysing the policy arguments for a recent change in the UK social security system, this argument was challenged by DHSS policy makers on the grounds that more recent census data show that the proportion of working wives has risen dramatically, thus removing the Backing for the Warrant and, indeed, allowing them to establish a different Warrant that more acurately reflected the new data.

Although this is an instance of a Backing having been successfully challenged, we still support our earlier comments about the assumption of the universal acceptance of Backings within a field of argument. It seems we can think of the matter as being like the development of theory in science. This is a slow process of refinement and accretion. The theory in a particular scientific field (which we can think of as a set of Warrants) is backed by a substantial body of observation and reasoning. Changes to theory does occur in science but it is a slow and careful process. At any moment in time, there is an accepted orthodoxy (the "paradigms" that Kuhn described—Kuhn, 1962) that is difficult to challenge. We suggest that all fields of argument operate in a very similar way. In most sciences we strive to make our observations independent of who was involved, where the observers happened to be at the time and when the observations were made. In other fields of argument (such as the law and politics) this is often not the case and would be regarded as undesirable. Thus, such fields might, for instance, expect backings to change over time. However, in most fields, a large degree of stability may be assumed for Backings.

Perhaps as interestingly, we now have two uses possible for the Rebuttal. The ordinary Rebuttal challenges the applicability of the Warrant. That is, it says what are the circumstances under which the Warrant would not justify the movement from Data to Claim. If we regard the implied Rebuttal in the same way with respect to the implied Warrant, we are challenging our ability—under certain circumstances—to move from Backing to Warrant on the basis of the implied Warrant. As we regard the set of Warrants derived from our Backings as, in some sense, defining the relevant set of Warrants for the field of argument, the implied Rebuttal is saying that there may be circumstances in which the Warrant is not valid in the field of argument. This kind of challenge to an argument is an important one and is not supported in "pure" Toulmin form.

Rebuttals arise because Warrants allow them to. Each Warrant we use effectively carries with it a set of Rebuttals which are the exceptions that it does not cover. Often, a qualifier, embedded in the Warrant, will signal the presence of possible Rebuttals. In writing down our arguments we may choose to make these Rebuttals explicit or not. Writing a Rebuttal means that we can believe the statement in the Claim unless we believe the statement in the Rebuttal is true—which, of course, begs the question; "Is the statement in the Rebuttal true?". Putting a statement in a Rebuttal does not commit us to any claim about its truth so, if we wish to discharge the Rebuttal (as we often would in a safety argument or a policy argument), we have two options: We can support it or deny it. To support the statement in the Rebuttal, we simply treat it as a Claim and construct a network of micro-arguments which will have that Claim as its conclusion. To deny the Rebuttal, we must assert its denial as a Contradiction. If we wish, we may then support the Contradiction with an argument net.

We can see the Qualifier as indicating the reliability of the argument for the Claim, and the implied Qualifier as indicating the reliability of the argument for the Warrant. Thus the qualification "generally" appearing in the Warrant of the Bermudan argument should more properly be seen as the implied Qualifier for the Warrant, which might happen if the implied Warrant was a rule about generalising from other rules (the statutes mentioned in the Backing). A qualification of the Warrant should lead us to expect Rebuttals and also a qualification of the argument it warrants. It should not be possible to conclude a Claim with certainty while there are undischarged Rebuttals as a result of an uncertain Warrant.

As we said earlier, the Qualifier is a judgement about how well a particular Warrant and particular Data will support a Claim. It is a judgement about the quality of the micro-argument and should not be taken as an indication of the level of our belief in the Claim (although, clearly, the quality of the argument may affect our belief in the Claim). It is quite possible, for instance, to have a high level of belief in a particular statement even though the argument presented in its support is very weak. Its is also possible that many weak arguments for the same Claim may raise our level of belief in the Claim well above that justified by any one of them. ETF does not have a mechanism for representing the level of belief in a statement. This is largely due to our belief that it is impossible to do this in a way that is meaningful for groups of users and would not lead to the possibility of misinterpretation and misuse by any particular arguer. It seems preferable to leave belief where it belongs—in the heads of the audience.

Conceptually, most Data come from the model for the argument. We say ‘conceptually’, because it is not a requirement (and nor is it often done) that the model or theory be made explicit. We say ‘most’ because there are other sources of Data. These include references, assumptions and other domains.

Many of the arguments we have studied make reference to other arguments or bodies of data which, by this means, are implicitly ‘imported’ into the current argument and become part of the current context. Thus an argument about navigation systems for oceanic flights may refer to a mathematical model developed elsewhere and reported in another document which provides data for failure rates of components that will be used in the current argument.

An extremely important source of data which are added to an argument but which will not necessarily appear in the model are assumptions made by the arguer. In general, the assumptions an arguer uses will be implicit. They will be to do with his or her common-sense model of the World and the common and obvious knowledge shared by practicioners in the field. Frequently, however, an arguer will make an explicit assumption for the purpose of the argument—perhaps as a place-holder until reliable data are available, perhaps because the assumption seems reasonable but the arguer does not want it to go unchallenged, or perhaps as a rhetorical move in the development of the argument (as in the case where the arguer says; "Let us assume A and see what conclusions we can reach."). It is important in certain fields (safety being one) that assumptions are made explicit and that they are challenged and either supported or refuted.

Occasionally, Data and Warrants from other domains and other fields will be used in an argument (as, for example, when an argument by analogy is used). Such cases are not infrequent but they should occur within the rhetorical structure as controlled and isolated excursions and the impact on the main argument of the actual Data and Warrants used should be only through the rhetorical r™les they play.

Some of the Claims we make in an argument will be new in the sense that, although they are derivable by reasoning from the Data and Warrants in the context, they have not before appeared in the context themselves. Once a new Claim has been made, the statement it contains becomes part of the context. Some of these statements may, eventually, be asserted into the model or theory if sufficient commitment to them can be engendered in an appropriate authority.

Where groups work together to build and review arguments, commitment to the Data used in the argument (including that generated as Claims) is a socially negotiated process dependent on the social relationships between the group members (particularly the organisationally determined ones). Each statement in a model used by a group will thus have a status determined in this way, indicating the extent to which the statement is officially sanctioned for use by the group. Commitment is therefore something like belief in that it indicates a degree of adherence to statements by the groups which originate the arguments which use them.

Figure 6 shows the relationship between rhetorical structure, detailed argumentation and model in the scheme we use on the ASAM project. The diagram is simplified in that, for clarity, it excludes details of the meta-levels as well as different "views" or abstractions of the model.

Figure 6: The relationships between the major conceptual entities in ASAM.

If we think of the reasoning steps that we describe in ETF as micro-arguments, we can regard the goal lattice as a macro-argument. It gives the overall structure of the argument and we can use it as the framework on which to attach strategies, contexts and solutions.

All argumentation takes place in some context. That is, an argument uses models of rationality that are appropriate to the field in which it is made, it refers to facts and beliefs that are to be found in the scope of the domain of the argument (except where particular rhetorical techniques allow it to move outside the domain, e.g. to supply an analogous case) and it employs logical relations in the structure of the domain to warrant claims about the domain.

The relationship between argumentation and context is a very complicated one because of the interdependencies between them. Arguments not only use the models and theories in the context, they may also determine them.

In many areas of argumentation, there is little need to describe the context in any detail. We tend to engage in argumentation in fields and in domains with which we are very familiar. In certain fields, however, such as philosophy, science, policy making and engineering, the arguer has an obligation to make explicit the context in which his or her argument applies. The main reason for this seems to be that practical arguments in these fields tend to be for changes to the underlying models and theories of the domains involved.

Such fields have developed their own languages for describing, more or less formally, the contexts for particular domains. Often, there will be many different abstractions of a domain at various levels of detail and each may have its own distinct language. It is important that a system for writing arguments can somehow accommodate these other languages by, at least, providing a means whereby statements in the argument can be shown to map to statements in the domain descriptions. Ideally, the system would also allow us to show how the mapping operates and how it was used in particular instances.

To give a concrete example of this in the field of safety argumentation, let us look at how a fault tree is derived and used. A fault tree is a particular abstraction of a safety-critical system which emphasises the causal relationships between failure events. From some kind of structural model of a system (e.g. a wiring diagram) and taking a particular component or sub-system failure as the root event, an AND/OR tree is constructed which shows how the failures of other components or sub-systems can cause the root failure. Given this AND/OR tree (which has its own graphical notation) we can derive more concise logical expressions which describe it. From these, employing the probabilities of failure for the various components and sub-systems we have considered, we can produce formul¾ for calculating the likelihood of failure of the root event.

Partly, the value of this is in having a graphical, failure-event-oriented abstraction of the domain. Partly, the value is in being able to calculate failure probabilities. The role of the fault tree in a safety argument is to fulfill both these purposes. The fault tree can be throught of as a graphical presentation of a set of rules (or a single, complex rule) which lead(s) to a claim about the root failure event. It stands, in the rhetorical structure of a safety argument, in the same place as a solution expressed in ETF would but it can also be seen as a version of the theory associated with the model for the argument. The mapping between this abstraction of the model and the original model can be thought of as the transformations that were applied to move from the one to the other. These transformations could be expressed as ETF warrant-establishing arguments taking the model as data, using warrants to effect the transformation and having the fault tree as the final claim.

Because arguments are intended to persuade, they are structured in such a way as to maximise their persuasive effect on their particular audience. The arguer employs a strategy for presenting his or her arguments and this strategy determines the rhetorical structure of the argument.

In our work we have presented the overall structure of an argument as a goal structure. The top-level goal of a safety argument might be to show that a system is acceptably safe to deploy. This goal is achieved (say) by showing that the system meets required standards for its configuration, its reliability and its quality (cf Health and Safety Executive, 1987). Each of these goals is satisfied by sub-goals and so on until a complete lattice structure of goals has been created where the terminal goals can be satisfied directly by argument or by reference to the model. We call this structure the macro-argument to distinguish it from the micro-arguments we have been representing in ETF.

The decision about how each goal in the macro-argument is satisfied is a matter of strategy. This determines the sub-goals, if any, the contexts for the sub-goals and any assumptions that might need to be made in those contexts. The strategy may also describe the kind of argument to be used as a solution for the goal. This may simply say that an ETF argument or a fault tree (or whatever) would be appropriate, or it may say what the structure of the solution itself should be.

The need for extensions to Toulmin Form has been felt by many researchers who have found it unsuitable for capturing the full richness and complexity of real arguments and yet have been attracted to it for its simplicity and generality. The discussion here presents a scheme for augmenting Toulmin Form with information about the overall structure of an argument and the context in which it is being made. We also present a new variant of Toulmin Form—ETF—which we believe is more complete and more usable, both in its syntax and in its interpretation, than the original. On the ASAM project, we built a series of prototype computer programs which use this scheme, including the ETF notation, to support the construction, maintenance and review of safety arguments. These were evaluated (on a fairly small scale) with users in the UK Civil Aviation Authority and the results were extremely encouraging. Our basic concern—that engineers would find ETF a difficult, alien style in which to develop arguments—was completely unfounded. This supports the same finding from the DHSS Demonstrator project where DHSS policy makers were able to use Toulmin Form with little or no training and found it's style of laying out the components of an argument to be clear and supportive.

Cohen, R.. Analyzing the Structure of Argumentative Discourse. Computational Linguistics, 1987, 13, 11-24.

Conklin, J. and Begerman, M.L.. gIBIS: A Hypertext Tool for Exploratory Policy Discussion. MCC Technical Report No. STP-082-88, Austin, Texas, 1988.

Dixon, P.. Rhetoric. Methuen, 1971.

Ehninger, D. and Brockeriede, W.. Decision by Debate, 2nd edn. Harper and Row: New York. 1978.

Forder, J., Higgins, C., McDermid, J. and Storrs, G.. SAM—A Tool to Support the Construction, Review and Evolution of Safety Arguments. Proc. Safety-critical Systems Symposium SSS’93, Bristol, England, Feb. 1993.

Health and Safety Executive, Programmable Electronic Systems in Safety Related Applications, vol. 2, General Technical Guidelines. London: Her Majesty’s Stationery Office, 1987.

Krause, P.J., Fox, J. and Ambler, S.. Argumentation as a unifying concept for reasoning under uncertainty. Artificial Intelligence in Medicine (in press).

Kuhn, T.S.. The Structure of Scientific Revolutions. University of Chicago Press, Chicago. 1962.

Lee, J.. DRL: A Task-Specific Argument Representation Language. Proc. AAAI Spring Symposium on Argumentation and Belief, Stanford University, March, 1991, 122-132.

Lee, J. and Lai, K-Y.. What's in Design Rationale? Human-Computer Interaction, 1991, 6, 251-280.

Marshall, C.C.., Representing the structure of a legal argument. Proc. 2nd International Conference on AI and Law, Vancouver, 1989, 121-127.

Mason, R. and Mitroff, I.I.. Challenging Strategic Planning Assumptions. Wiley, 1981.

Newman, S.E. and Marshall, C.C.., Pushing Toulmin Too Far: Learning From an Argument Representation Scheme, Unpublished research paper, Xerox PARC, 3333 Coyote Hill Road, Palo Alto, CA 94034, USA., 1990.

Storrs, G.. The Policy System. In T. Bench-Capon (ed) Knowledge-Based Systems and Legal Applications, Academic Press, 165-182, 1991.

Toulmin, S.E.. The Uses of Argument. Cambridge University Press, 1958.

Toulmin, S.E., Rieke, R. and Janik, A.. An Introduction to Reasoning. Macmillan, New York, 1984.