We propose to exploit a new collaboration between academic and industrial partners to complete a Virtual Site Survey of the Pernambuco Plateau, NE Brazilian Atlantic Margin, in support of Full Proposal 864 to the International Ocean Discovery Program (IODP) entitled "Origin, Evolution and Palaeoenvironment of the Equatorial Atlantic Gateway". The Cretaceous rift basins of the tropical South Atlantic were globally significant sites of organic carbon production, biotransformation and burial. These conditions changed irreversibly with the opening of the Equatorial Atlantic Gateway, a fundamental reconfiguration of the world's oceans. Large uncertainties remain in the timing, process and impacts of this gateway opening. IODP Pre-Proposal 864 outlined a drilling programme on the Brazilian Margin to address these pressing issues. In July 2014 the IODP Science Evaluation Panel (SEP) recommended development of Pre-Proposal 864 into a Full Proposal. However, the SEP stated that legacy seismic data images included in the Pre Proposal do not adequately image the target drilling locations. IODP require clearer seismic images of target strata and geological architectures in the Full Proposal. The primary objective of this proposal is to assemble the complete site survey package necessary for acceptance and implementation of Full Proposal 864 without need for an expensive and time-consuming ship-based expedition. Project Partner ION Geophysical will make available a regional seismic survey known as BrasilSpan(TM) for our Virtual Site Survey. The quality and size of this industrial dataset eclipses anything that could be achieved by an academic ship-borne survey. We will combine this imagery with reprocessed older geophysical data and local geological knowledge provided by our Project Partner at the Universidade Federal de Pernambuco (UFPE), Brazil. The detailed, extensive and deep imaging of the Brazilian Atlantic Margin provided by the BrasilSpan survey provide unique opportunities to build a detailed geological model of the Pernambuco Plateau drill target, as well as to assess drilling safety concerns and risk to science objectives. These objectives will generate stand-alone and publishable scientific results, as well as providing a firm foundation for the science goals of the proposed drilling expedition. This work will also benefit the hydrocarbon industry by enhancing geological knowledge in a frontier part of the Brazilian Atlantic Margin. The central science goal of the related IODP drilling proposal is to provide a step change in understanding the tectonics, timing and environmental consequences of progressive opening of the Equatorial Atlantic Gateway. These are divided into four key sub-themes: (i) to provide new constraints on the timing and tectonics of the Cretaceous Equatorial Atlantic Gateway (EAG) opening and its consequences for global biogeochemical cycles, black shale formation, and the evolution of marine biota; (ii) to constrain deep biosphere communities in petroleum systems by drilling immature Cretaceous (source) and Tertiary (reservoir) successions as well as fluid migration routes from deeper buried units; (iii) to generate multi-proxy records of tropical marine and terrestrial environments under conditions of extreme warmth; and (iv) to test the resilience of tropical ecosystems to major environmental perturbations during greenhouse climate states, effectively testing the "limits of life" under conditions of extreme warmth. This Virtual Site Survey will impact industry, higher education and international relations. UK government, industry and HE sector are working to establish closer collaborative relationships with Brazilian institutions as Brazil grows in international stature. The University of Birmingham is a major player in UK-Brazil relations. Our leadership of IODP Proposal 864 to drill offshore Brazil supported by this VSS will expand this UK-Brazil collaboration in future.

Today's products from many manufacturing industries, notably aerospace, automotive and high-tech manufacturing, depend on embedded software to function. Since many of these products support safety or mission-critical services, the correctness of the embedded software is a paramount concern. Most of today's industrial efforts focus on improving the code review, testing and qualification process to achieve this. Whilst these processes can reveal defects, they cannot prove their absence. Further, finding defects at review, test or even integration time is too late. Significant engineering efforts have already occurred, making further changes complicated, costly, and uncertain. In contrast to testing approaches, formal verification can prove the correctness of software, substantially reducing the need for testing, whilst also increasing reliability. Formal verification has been investigated for three decades, but has matured significantly over the last few years. The proposers believe it is now possible to develop a verification framework that can verify Model-Driven Engineering (MDE) notations such as UML and SysML, which are widely used to develop embedded software. The proposers have previously mapped MDE descriptions in a custom notation into both source code and the process algebra CSP, allowing formal verification using FDR, a model checker also produced by the proposers. This led to verified embedded systems that contained 1M lines of code. This work was limited in the modelling languages, the system architectures, and execution semantics it supported and had no formal proof guaranteeing the source code generated was equivalent to the models being verified. It was also a point solution that could not interoperate with other tools, nor handle legacy code. The overall goal of this proposal is to produce an industrially-applicable framework that supports verification and implementation of MDE languages. We will also develop a proof-of-concept tool that supports our framework and allows both academic and industrial exploitation. At the core of our framework will be a new formal verification language, called Communicating Components (CoCo), that is designed to model embedded software written in MDE languages. FDR will be used to verify models expressed in CoCo; the recent step-change performance improvements in FDR3 mean we will be able to handle more complex components and architectures. We will also provide a translation from CoCo into source code. We will improve the reliability of the source code translator by using the Coq theorem prover to prove the translation preserves the semantics of the model. In addition to the MDE engineers who will benefit from this project, formal methods researchers will also benefit. We will develop new specification-directed abstraction and verification techniques, based on the compositional methods we used in our earlier verification work. Secondly, we will add extra functionality to FDR3 to support this work, and thereby make our work readily accessible to the large FDR3 community. We have assembled an enthusiastic group of industrial partners comprising Aerospace Technology Institute (leader of UK strategy for aerospace), ASML (world's largest supplier of photolithography systems), ASTC (global industry leader for tools and solutions in safety critical and real time control electronics industries), MBDA (world leader in missiles and missile systems) and Rolls-Royce CDS (leading provider of high integrity control systems), who will collaborate with us and provide essential industrial expertise across these industries. This will allow us to ensure that the framework and proof-of-concept tool we produce are industrially applicable. Our partners will also provide case studies and, we hope, ultimately provide users for our technology.

Mobile and autonomous robots have an increasingly important role in industry and the wider society; from driverless vehicles to home assistance, potential applications are numerous. The UK government identified robotics as a key technology that will lead us to future economic growth (tinyurl.com/q8bhcy7). They have recognised, however, that autonomous robots are complex and typically operate in ever-changing environments (tinyurl.com/o2u2ts7). How can we be confident that they perform useful functions, as required, but are safe? It is standard practice to use testing to check correctness and safety. The software-development practice for robotics typically includes testing within simulations, before robots are built, and then testing of the actual robots. Simulations have several benefits: we can test early, and test execution is cheaper and faster. For example, simulation does not require a robot to move physically. Testing with the real robots is, however, still needed, since we cannot be sure that a simulation captures all the important aspects of the hardware and environment. In the current scenario, test generation is typically manual; this makes testing expensive and unreliable, and introduces delays. Manual test generation is error-prone and can lead to tests that produce the wrong verdict. If a test incorrectly states that the robot has a failure, then developers have to investigate, with extra cost and time. If a test incorrectly states that the robot behaves as expected, then a faulty system may be released. Without a systematic approach, tests may also identify infeasible environments; such tests cannot be used with the real robot. To make matters worse, manual test generation limits the number of tests produced. All this affects the cost and quality of robot software, and is in contrast with current practice in other safety-critical areas, like the transport industry, which is highly regulated. Translation of technology, however, is not trivial. For example, lack of a driver to correct mistakes or respond to unforeseen circumstances leads to a much larger set of working conditions for an autonomous vehicle. Another example is provided by probabilistic algorithms, which make the robot behaviour nondeterministic, and so, difficult to repeat in testing and more difficult to characterise as correct or not. We will address all these issues with novel automated test-generation techniques for mobile and autonomous robots. To use our techniques, a RoboTest tester constructs a model of the robot using a familiar notation already employed in the design of simulations and implementations. After that, instead of spending time designing simulation scenarios, the RoboTest tester, with the push of a button, generates tests. With RoboTest, testing is cheaper, since it takes less time, and is more effective, because the RoboTest tester can use many more tests, especially when using a simulation. To execute the tests, the RoboTest tester can choose from a few simulators employing a variety of approaches to programming. Execution of the tests also follows the push of a button. Yet another button translates simulation to deployment tests. So, the RoboTest tester can trace back the results from the deployment tests to the simulation and the original model. So, the RoboTest tester is in a strong position to understand the reality gap between the simulation and the real world. The RoboTest tester knows that the verdicts for the tests are correct, and understands what the testing achieves; for example, it can be guaranteed to find faults of an identified class. So, the RoboTest tester can answer the very difficult question: have we tested enough? In conclusion, RoboTest will move the testing of mobile and autonomous robots onto a sound footing. RoboTest will make testing more efficient and effective in terms of person effort, and so, achieve longer term reduced costs.

Mobile and autonomous robots have an increasingly important role in industry and the wider society; from driverless vehicles to home assistance, potential applications are numerous. The UK government identified robotics as a key technology that will lead us to future economic growth (tinyurl.com/q8bhcy7). They have recognised, however, that autonomous robots are complex and typically operate in ever-changing environments (tinyurl.com/o2u2ts7). How can we be confident that they perform useful functions, as required, but are safe? It is standard practice to use testing to check correctness and safety. The software-development practice for robotics typically includes testing within simulations, before robots are built, and then testing of the actual robots. Simulations have several benefits: we can test early, and test execution is cheaper and faster. For example, simulation does not require a robot to move physically. Testing with the real robots is, however, still needed, since we cannot be sure that a simulation captures all the important aspects of the hardware and environment. In the current scenario, test generation is typically manual; this makes testing expensive and unreliable, and introduces delays. Manual test generation is error-prone and can lead to tests that produce the wrong verdict. If a test incorrectly states that the robot has a failure, then developers have to investigate, with extra cost and time. If a test incorrectly states that the robot behaves as expected, then a faulty system may be released. Without a systematic approach, tests may also identify infeasible environments; such tests cannot be used with the real robot. To make matters worse, manual test generation limits the number of tests produced. All this affects the cost and quality of robot software, and is in contrast with current practice in other safety-critical areas, like the transport industry, which is highly regulated. Translation of technology, however, is not trivial. For example, lack of a driver to correct mistakes or respond to unforeseen circumstances leads to a much larger set of working conditions for an autonomous vehicle. Another example is provided by probabilistic algorithms, which make the robot behaviour nondeterministic, and so, difficult to repeat in testing and more difficult to characterise as correct or not. We will address all these issues with novel automated test-generation techniques for mobile and autonomous robots. To use our techniques, a RoboTest tester constructs a model of the robot using a familiar notation already employed in the design of simulations and implementations. After that, instead of spending time designing simulation scenarios, the RoboTest tester, with the push of a button, generates tests. With RoboTest, testing is cheaper, since it takes less time, and is more effective, because the RoboTest tester can use many more tests, especially when using a simulation. To execute the tests, the RoboTest tester can choose from a few simulators employing a variety of approaches to programming. Execution of the tests also follows the push of a button. Yet another button translates simulation to deployment tests. So, the RoboTest tester can trace back the results from the deployment tests to the simulation and the original model. So, the RoboTest tester is in a strong position to understand the reality gap between the simulation and the real world. The RoboTest tester knows that the verdicts for the tests are correct, and understands what the testing achieves; for example, it can be guaranteed to find faults of an identified class. So, the RoboTest tester can answer the very difficult question: have we tested enough? In conclusion, RoboTest will move the testing of mobile and autonomous robots onto a sound footing. RoboTest will make testing more efficient and effective in terms of person effort, and so, achieve longer term reduced costs.

In the last decade, the role of software engineering has changed rapidly and radically. Globalisation and mobility of people and services, pervasive computing, and ubiquitous connectivity through the Internet have disrupted traditional software engineering boundaries and practices. People and services are no longer bound by physical locations. Computational devices are no longer bound to the devices that host them. Communication, in its broadest sense, is no longer bounded in time or place. The Software Engineering & Design (SEAD) group at the Open University (OU) is leading software engineering research in this new reality that requires a paradigm shift in the way software is developed and used. This platform grant will grow and sustain strategic, multi-disciplinary, crosscutting research activities that underpin the advances in software engineering required to build the pervasive and ubiquitous computing systems that will be tightly woven into the fabric of a complex and changing socio-technical world. In addition to sustaining and growing the SEAD group at the OU and supporting its continued collaboration with the Social Psychology research group at the University of Exeter, the SAUSE platform will also enable the group to have lasting impact across several application domains such as healthcare, aviation, policing, and sustainability. The grant will allow the team to enhance the existing partner networks in these areas and to develop impact pathways for their research, going beyond the scope and lifetime of individual research projects.