The Kaspar Explains project aimed to assess the efficacy of utilising causal explanations on a social humanoid robot to address challenges in instructing autistic children. In a scoping retrospective study which looked back at nearly 18 years of research with the Kaspar robot in children’s education, we first identified Visual Perspective Taking (VPT) as a challenge that children with autism often encounter and where causal explanations proved to have a strong potential to support the children. In the context of a local special needs school, we then created appropriate scenarios within the VPT domain and developed a formal causal model to support the children with common misconceptions about visual perspectives. This model was implemented in an interactive scenario for the Kaspar robot. Our approach featured formative and summative evaluation cycles. Together with teachers, parents, and children, we initially assessed the interactive games regarding their suitability for children with autism. We then evaluated the general feasibility of our explanation engine with healthy adults, (n=20) , before a summative evaluation study with children with autism (n=10) at our partner school. The study design allowed all the children access to both the intervention and control phases of the study by deploying an ECE-CEC design where E represents causal explanation phases and C represents control phases without explanations. Comparing the number of correct actions in both groups, there were statistically significant differences in favour of the intervention group (p=0.04) . The study shows that causal explanations can help children better understand and retain different aspects of VPT. This study contributes to advancing innovative and productive educational tools tailored for autistic children. In our future studies, we aim to apply causal explanations to other interactive educational scenarios and areas of difficulty within the curriculum to further assist pupils in reaching their desired educational outcomes.

Testing connected cyber-physical systems (CPS) is a complex task. Connected CPS feature complex stochastic dynamic behaviour in interaction with the physical and human environment as well as communication over networks. Devising an oracle for testing connected CPS is a challenge; the oracle should be able to quantitatively reason about the stochastic nature of the interactions between the CPS and its environment. The quantitative reasoning should be sensitive to significant deviations in the dynamics and neglect minor deviations, e.g., due to measurement errors. To address this challenge, we provide the mathematical framework for conformance testing of connected CPS. We define a quantitative measure of closeness for two distributions of trajectories (i.e., output distributions from two distinct stochastic systems that are provided with the same input stimuli) that allows for capturing significant temporal and spatial deviations and neglecting subtle ones. This measure forms the basis for our notion of stochastic conformance, which determines when two stochastic systems conform to each other. We implement our proposed notion of stochastic conformance and compare our notion against a state-of-the-art baseline by applying both approaches to a case study involving a platoon of connected vehicles. Our notion detects a variety of different types of faults whilst allowing subtle deviations resulting from naturally occurring perturbations inherent to CPS.

Quantum computing has emerged as a powerful tool to efficiently solve computational challenges, particularly in simulation and optimisation. However, hardware limitations prevent quantum computers from achieving the full theoretical potential. Among the quantum algorithms, quantum annealing is a prime candidate to solve optimisation problems. This makes it a natural candidate for search-based software testing in the Cyber-Physical Systems (CPS) domain, which demands effective test cases due to their safety-critical nature. This work explores the use of quantum annealing to enhance test case generation for CPS through a mutation-based approach. We encode test case mutation as a binary optimisation problem, and use quantum annealing to identify and target critical regions of the test cases for improvement. Our approach mechanises this process into an algorithm that uses D-Wave's quantum annealer to find the solution. As a main contribution, we offer insights into how quantum annealing can advance software testing methodologies by empirically evaluating the correlation between problem size, hardware limitations, and the effectiveness of the results. Moreover, we compare the proposed method against state-of-the-art classical optimisation algorithms, targeting efficiency (time to generate test cases) and effectiveness (fault detection rates). Results indicate that quantum annealing enables faster test case generation while achieving comparable fault detection performance to state-of-the-art alternatives.

We present a formal theory for analysing causality in cyber-physical systems. To this end, we extend the theory of actual causality by Halpern and Pearl to cope with the continuous nature of cyber-physical systems. Based on our theory, we develop an analysis technique that is used to uncover the causes for examples of failures resulting from verification, which are represented as continuous trajectories. We develop a search-based technique to efficiently produce such causes and provide an implementation for such a technique. Moreover, we apply our solution to case studies (a suspension system and a connected platoon) and benchmark systems to evaluate its effectiveness; in the experiment, we show that we were able to detect causes for inserted faults.

Drones are becoming essential tools in emergency situations such as search and rescue, surveillance, and firefighting. These applications make the development of trustworthy software a priority to increase efficiency, cut costs, and reduce risks, in future replacing human personnel in challenging areas. RoboChart, a platform-agnostic tool, brings numerous benefits to the robotics community by providing a language and high-level tool to describe a model via automatic verification and exhaustive testing of the model. However, when it comes to real robotics it is essential to use testing tools suitable for specific robotic software. In the context of the Robotic Operating System (ROS), it imposes its own design constraints, best practices, and communication requirements. This paper aims to apply the RoboChart modelling approach to autonomous firefighting drones, putting forward a low-level ROS software architecture that aligns with RoboChart models, ensuring the trustworthiness of the system during operation.

This paper presents an investigation into the effectiveness of introducing explicit causal explanations in a child-robot interaction setting to help children with autism improve their Visual Perspective Taking (VPT) skills. A sample of ten children participated in three sessions with a social robot on different days, during which they played several games consisting of VPT tasks. In some of the sessions, the robot provided constructive feedback to the children by giving causal explanations related to VPT; other sessions were control sessions without explanations. An analysis of the children’s learning progress revealed that they improved their VPT abilities faster when the robot provided causal explanations. However, both groups ultimately reach a similar ratio of correct answers in later sessions. These findings suggest that providing causal explanations using a social robot can be effective to teach VPT to children with autism. This study paves the way for further exploring a robot’s ability to provide causal explanations in other educational scenarios.

The Kaspar robot has been used with great success to work as an education and social mediator with children with autism spectrum disorder. Enabling the robot to automatically generate causal explanations is key to enrich the interaction scenarios for children and promote trust in the robot. We present a theory of causal explanation to be embedded in Kaspar. Based on this theory, we build a causal model and an analysis method to calculate causal explanations. We implement our method in Java with inputs provided by a human operator. This model automatically generates the causal explanation that are then spoken by Kaspar. We validate our explanations for user satisfaction in an empirical evaluation.

We perform a systematic literature review on testing, validation, and verification of robotic and autonomous systems (RAS). The scope of this review covers peer-reviewed research papers proposing, improving, or evaluating testing techniques, processes, or tools that address the system-level qualities of RAS. Our survey is performed based on a rigorous methodology structured in three phases. First, we made use of a set of 26 seed papers (selected by domain experts) and the SERP-TEST taxonomy to design our search query and (domain-specific) taxonomy. Second, we conducted a search in three academic search engines and applied our inclusion and exclusion criteria to the results. Respectively, we made use of related work and domain specialists (50 academics and 15 industry experts) to validate and refine the search query. As a result, we encountered 10,735 studies, out of which 195 were included, reviewed, and coded. Our objective is to answer four research questions, pertaining to (1) the type of models, (2) measures for system performance and testing adequacy, (3) tools and their availability, and (4) evidence of applicability, particularly in industrial contexts. We analyse the results of our coding to identify strengths and gaps in the domain and present recommendations to researchers and practitioners. Our findings show that variants of temporal logics are most widely used for modelling requirements and properties, while variants of state-machines and transition systems are used widely for modelling system behaviour. Other common models concern epistemic logics for specifying requirements and belief-desireintention models for specifying system behaviour. Apart from time and epistemics, other aspects captured in models concern probabilities (e.g., for modelling uncertainty) and continuous trajectories (e.g., for modelling vehicle dynamics and kinematics). Many papers lack any rigorous measure of efficiency, effectiveness, or adequacy for their proposed techniques, processes, or tools. Among those that provide a measure of efficiency, effectiveness, or adequacy, the majority use domain-agnostic generic measures such as number of failures, size of state-space, or verification time were most used. There is a trend in addressing the research gap in this respect by developing domainspecific notions of performance and adequacy. Defining widely accepted rigorous measures of performance and adequacy for each domain is an identified research gap. In terms of tools, the mostwidely used tools arewell-establishedmodel-checkers such as Prism and Uppaal, as well as simulation tools such as Gazebo; Matlab/Simulink is another widely used toolset in this domain. Overall, there is very limited evidence of industrial applicability in the papers published in this domain. There is even a gap considering consolidated benchmarks for various types of autonomous systems.

We reflect on our experience in the conceptualization and implementation of Responsible Research and Innovation (RRI) in an exploratory research project funded by the UKRI Trustworthy Autonomous Systems (TAS) Hub. In this paper, we report the narratives captured during a series of focused discussions with the project team and the industry partners using RRI Prompts and Practice Cards (PPC) as a tool to guide the discussion. Inspired by agile software development, we propose an agile-like RRI model for embedding RRI in exploratory research that supplements future growth, while ensuring a human-centred and ethical approach. Such an iterative model promotes continuous RRI focus, sensitivity and consideration for all stakeholders, minimising compromises and risks, whilst fostering team-wide well-being and research validity throughout the research life cycle.

Cooperative awareness basic services are key components of several Connected Autonomous Vehicles (CAV) functions. We present a rigorous approach to the analysis of cooperative awareness basic services in a CAV setup. Our approach addresses a major challenge in the traditional analysis techniques of such services, namely, coming up with effective scenarios that can meaningfully cover their various behaviours, exercise the limits of these services and come up with a quantitative means for design-space exploration. Our approach integrates model-based testing and search-based testing to automatically generate scenarios and steer the scenario generation process towards generating inputs that can lead to the most severe hazards. Additionally we define other objectives that maximise the coverage of the model and the diversity of the generated test inputs. The result of applying our technique to the analysis of cooperative awareness services leads to automatically generated hazardous scenarios for parameters that abide by the ETSI ITS-G5 vehicular communications standard. We show that our technique can be used as an effective design-space exploration method and can be used to design adaptive protocols that can mitigate the hazards detected through our initial analysis.

In Model-based Testing (MBT), test cases are automatically generated from a formal model of the system. A disadvantage of MBT is that developers must deal with formal notations. This limitation is addressed in this paper, where use cases are used to model the system. In previous work, we have proposed an automatic strategy for generating test cases from use cases written in a Controlled Natural Language (CNL), which is an English textual notation with a well-defined grammar. Due to its precise syntax, it can be processed and translated into a formal representation for the purpose of automatic test case generation. This paper extends our previous work by proposing a state-based CNL for describing use case control flows enriched with state and data operations. We translate state-based use case descriptions into CSP processes from which test cases can be automatically generated. In addition, we show how a similar notation can be used to specify test selection via the definition of state-based test purposes, which are also translated into CSP processes. Test generation and selection are mechanised by refinement checking using the CSP tool FDR. Despite the fact that we work at a purely process algebraic level to define a test generation strategy, we are able to address model coverage criteria. Particularly, by using FDR, it is possible to have access to the underlying LTS models; we then implemented algorithms for covering events or transitions, possibly combined with selection using test purposes. We also discuss several ways of improving the efficiency of the test generation strategy. As far as we are aware, this integration between an algebraic approach to test case generation with an operational approach for coverage criteria is an original and promising insight. All steps of the strategy are integrated into a tool that provides a GUI for authoring use cases and test purposes described in the proposed CNL, so the formal CSP notation is completely hidden from the test designer. We illustrate our tool and techniques with a running example and a more elaborate case study taken from an industrial setting.

Recent surveys about autonomous vehicles show that the public is concerned about the safety consequences of system or equipment failures and the vehicles' reactions to unexpected situations. We believe that informing about the technology and quality, e.g., safety and reliability, of autonomous vehicles is paramount to improving public expectations, perception and acceptance. In this paper, we report on the design of an interactive exhibit to illustrate (1) basic technologies employed in autonomous vehicles, i.e., sensors and object classification; and (2) basic principles for ensuring their quality, i.e., employing software testing and simulations. We subsequently report on a public engagement event involving this exhibit at the Royal Society Summer Science Exhibition 2019 in the exhibit titled "Trusted Autonomous Vehicles". We describe the process of designing and developing the artefacts used in our exhibit, the theoretical background associated to them, the design of our stand, and the lessons learned. The activities and findings of this study can be used by other educators and researchers interested in promoting trust in autonomous vehicles among the general public.

We propose a multi-objective strategy for finding effective inputs for fault detection in Cyber Physical Systems (CPSs). The main goal is to provide input signals for a system in such a way that they maximise the distance between the system's output and an ideal target, thus leading the system towards a fault; this is based on Genetic Algorithm and Simulated Annealing heuristics. Additionally, we take into consideration the discrete locations (of hybrid system models) and a notion of input diversity to increase coverage. We implement our strategy and present an empirical analysis to estimate its effectiveness.

Conformance testing is a formal and structured approach to verifying system correctness. We propose a conformance testing algorithm for cyber-physical systems, based on the notion of hybrid conformance by Abbas and Fainekos. We show how the dynamics of system specification and the sampling rate play an essential role in making sound verdicts. We specify and prove error bounds that lead to sound test-suites for a given specification and a given sampling rate. We use reachability analysis to find such bounds and implement the proposed approach using the CORA toolbox in Matlab. We apply the implemented approach on a case study from the automotive domain.

In this scenario, the adoption of Mutation Analysis increasingly demands the definition of specific mutation operators for these new features. It is desirable that these new operators can be added to the mutation environment for reproducing those new errors that appear over time.The main contributions of this paper are:(1) the development of a hierarchical architecture for mutation operators that minimizes the dependence of external libraries and that facilitates the implementation of new operators;(2) BacterioWeb, a new mutation tool that performs all the mutation tasks in the web;(3) some mutation operators specifically designed for reproducing some common context-aware errors reported by mobile applications developers;(4) a comparison of the proposed architecture with those in other tools.

We present a process for sound conformance testing of cyber-physical systems, which involves functional but also non-functional aspects. The process starts with a hybrid model of cyber-physical systems in which the correct behavior of the system (at its interface level) is specified. Such a model captures both discrete behavior and evolution of continuous dynamics of the system in time. Since conformance testing inherently involves comparing continuous dynamics, the key parameters of the process are (1) the conformance bounds defining when two signals are sufficiently close to each other, and (2) the permitted error margin in the conformance analysis introduced by sampling of continuous signals. The final parameter of this process is (3) finding (and adjusting) the sampling rate of the dynamic behavior. In the specified process, we provide different alternatives for fixing the error margin of the conformance testing if the sampling rate is fixed, establishing the sampling rate if the error margin is fixed and finding conformance bounds once the sampling rate and the error margin are fixed.

During the last fifty years, there has been a significant increase of embedded HW-SW components in critical systems. This trend increases software size and complexity, and strongly impacts systems safety and reliability. Currently, many researches are focusing on how to achieve the trustworthiness levels required for these systems. To this end, model-based testing (MBT) techniques play an important role generating tests from specification models. When MBT is applied to analyse critical systems, it is also desired to formally state the conditions to guarantee that the SUT is correct with respect to the specification by means of a conformance relation, which can be used to prove that the test generation strategy is sound. In this situation, we say we have a formal MBT strategy.

In this paper, the performance of the commonly used neural-network-based classifiers is investigated on solving a classification problem which aims to identify the object nature based on surface features of the object. When the surface data is obtained, a proposed feature extraction method is used to extract the surface feature of the object. The extracted features are then used as the inputs for the classifier. This research studies eighteen household objects which are requisite to our daily life. Six commonly used neural-network-based classifiers, namely one-against-all, weighted one-against-all, binary coded, parallel-structured, weighted parallel structured and tree-structured, are investigated. The performance for the six neural-network-based classifiers is evaluated based on recognition accuracy for individual object. Also, two traditional classifiers, namely k-nearest neighbor classifier and naive Bayes classifier, are employed for comparison purposes. To evaluate robustness property of the classifiers, the original data is contaminated with Gaussian white noise. Experimental results show that the parallel-structured, tree-structured and the naive Bayes classifiers outperform the others under the original data. The tree-structured classifier demonstrates the best robustness property under the noisy data.

This paper presents the automatic drug administration for the regulation of bispectral (BIS) index in the anesthesia process during the clinical surgery by controlling the concentration target of two drugs, namely, propofol and remifentanil. To realize the automatic drug administration, real clinical data are collected for 42 patients for the construction of patients’ models consisting of pharmacokinetic and pharmacodynamic models describing the dynamics reacting to the input drugs. A nominal anesthesia model is obtained by taking the average of 42 patients’ models for the design of control scheme. Three PID controllers are employed, namely linear PID controller, type-1 (T1) fuzzy PID controller and interval type-2 (IT2) fuzzy PID controller, to regulate the BIS index using the nominal patient’s model. The PID gains and membership functions are obtained using genetic algorithm (GA) by minimizing a cost function measuring the control performance. The best trained PID controllers are tested under different scenarios and compared in terms of control performance. Simulation results show that the IT2 fuzzy PID controller offers the best control strategy regulating the BIS index while the T1 fuzzy PID controller comes the second.

A traffic model for GSM/GPRS, the hybrid radio resource allocation (HRRA) algorithm is evaluated. A dedicated number of GPRS channels plus idle periods between GSM voice calls are used for GPRS data packet transfers. A simulator was developed in order to evaluate the HRRA algorithm, which provides a reasonable forecast on the voice blocking probability and on packet delay for a single cell system. Since the major issue is the correct resource allocation, results are shown for the influence of some choices and assumptions on the overall performance. As expected, blocking probability can reach very high values if the number of dedicated channels increases too much. For the specific case of 4 carries and traffic of 20 Erl, 4 channels dedicated to GPRS still enable an affordable blocking probability, leading to a mean packet delay of 15 s. The results can be used to illustrate the fundamental options that need to be taken by an operator, when implementing GPRS.