Today's products from many manufacturing industries, notably aerospace, automotive and high-tech manufacturing, depend on embedded software to function. Since many of these products support safety or mission-critical services, the correctness of the embedded software is a paramount concern. Most of today's industrial efforts focus on improving the code review, testing and qualification process to achieve this. Whilst these processes can reveal defects, they cannot prove their absence. Further, finding defects at review, test or even integration time is too late. Significant engineering efforts have already occurred, making further changes complicated, costly, and uncertain. In contrast to testing approaches, formal verification can prove the correctness of software, substantially reducing the need for testing, whilst also increasing reliability. Formal verification has been investigated for three decades, but has matured significantly over the last few years. The proposers believe it is now possible to develop a verification framework that can verify Model-Driven Engineering (MDE) notations such as UML and SysML, which are widely used to develop embedded software. The proposers have previously mapped MDE descriptions in a custom notation into both source code and the process algebra CSP, allowing formal verification using FDR, a model checker also produced by the proposers. This led to verified embedded systems that contained 1M lines of code. This work was limited in the modelling languages, the system architectures, and execution semantics it supported and had no formal proof guaranteeing the source code generated was equivalent to the models being verified. It was also a point solution that could not interoperate with other tools, nor handle legacy code. The overall goal of this proposal is to produce an industrially-applicable framework that supports verification and implementation of MDE languages. We will also develop a proof-of-concept tool that supports our framework and allows both academic and industrial exploitation. At the core of our framework will be a new formal verification language, called Communicating Components (CoCo), that is designed to model embedded software written in MDE languages. FDR will be used to verify models expressed in CoCo; the recent step-change performance improvements in FDR3 mean we will be able to handle more complex components and architectures. We will also provide a translation from CoCo into source code. We will improve the reliability of the source code translator by using the Coq theorem prover to prove the translation preserves the semantics of the model. In addition to the MDE engineers who will benefit from this project, formal methods researchers will also benefit. We will develop new specification-directed abstraction and verification techniques, based on the compositional methods we used in our earlier verification work. Secondly, we will add extra functionality to FDR3 to support this work, and thereby make our work readily accessible to the large FDR3 community. We have assembled an enthusiastic group of industrial partners comprising Aerospace Technology Institute (leader of UK strategy for aerospace), ASML (world's largest supplier of photolithography systems), ASTC (global industry leader for tools and solutions in safety critical and real time control electronics industries), MBDA (world leader in missiles and missile systems) and Rolls-Royce CDS (leading provider of high integrity control systems), who will collaborate with us and provide essential industrial expertise across these industries. This will allow us to ensure that the framework and proof-of-concept tool we produce are industrially applicable. Our partners will also provide case studies and, we hope, ultimately provide users for our technology.

Mobile and autonomous robots have an increasingly important role in industry and the wider society; from driverless vehicles to home assistance, potential applications are numerous. The UK government identified robotics as a key technology that will lead us to future economic growth (tinyurl.com/q8bhcy7). They have recognised, however, that autonomous robots are complex and typically operate in ever-changing environments (tinyurl.com/o2u2ts7). How can we be confident that they perform useful functions, as required, but are safe? It is standard practice to use testing to check correctness and safety. The software-development practice for robotics typically includes testing within simulations, before robots are built, and then testing of the actual robots. Simulations have several benefits: we can test early, and test execution is cheaper and faster. For example, simulation does not require a robot to move physically. Testing with the real robots is, however, still needed, since we cannot be sure that a simulation captures all the important aspects of the hardware and environment. In the current scenario, test generation is typically manual; this makes testing expensive and unreliable, and introduces delays. Manual test generation is error-prone and can lead to tests that produce the wrong verdict. If a test incorrectly states that the robot has a failure, then developers have to investigate, with extra cost and time. If a test incorrectly states that the robot behaves as expected, then a faulty system may be released. Without a systematic approach, tests may also identify infeasible environments; such tests cannot be used with the real robot. To make matters worse, manual test generation limits the number of tests produced. All this affects the cost and quality of robot software, and is in contrast with current practice in other safety-critical areas, like the transport industry, which is highly regulated. Translation of technology, however, is not trivial. For example, lack of a driver to correct mistakes or respond to unforeseen circumstances leads to a much larger set of working conditions for an autonomous vehicle. Another example is provided by probabilistic algorithms, which make the robot behaviour nondeterministic, and so, difficult to repeat in testing and more difficult to characterise as correct or not. We will address all these issues with novel automated test-generation techniques for mobile and autonomous robots. To use our techniques, a RoboTest tester constructs a model of the robot using a familiar notation already employed in the design of simulations and implementations. After that, instead of spending time designing simulation scenarios, the RoboTest tester, with the push of a button, generates tests. With RoboTest, testing is cheaper, since it takes less time, and is more effective, because the RoboTest tester can use many more tests, especially when using a simulation. To execute the tests, the RoboTest tester can choose from a few simulators employing a variety of approaches to programming. Execution of the tests also follows the push of a button. Yet another button translates simulation to deployment tests. So, the RoboTest tester can trace back the results from the deployment tests to the simulation and the original model. So, the RoboTest tester is in a strong position to understand the reality gap between the simulation and the real world. The RoboTest tester knows that the verdicts for the tests are correct, and understands what the testing achieves; for example, it can be guaranteed to find faults of an identified class. So, the RoboTest tester can answer the very difficult question: have we tested enough? In conclusion, RoboTest will move the testing of mobile and autonomous robots onto a sound footing. RoboTest will make testing more efficient and effective in terms of person effort, and so, achieve longer term reduced costs.

The main determinants of health inequalities are arguably socioeconomic inequalities, with income distribution and poverty among the most impactful social determinants of health. While interventions to improve education and infrastructure-related determinants require long implementation periods, and show their health effects mainly in the long-term, income-related and poverty-reduction interventions could have rapid and meaningful impacts since their initial implementation, and permanent effects on beneficiaries' life course. The main aim of our project is to evaluate the impact of the current increase in socioeconomic inequalities on morbidity, mortality, and health inequalities in five Latin American countries, namely Brazil, Argentina, Colombia, Ecuador, and Mexico (BACEM - representing more than 400 million individuals and more than half of the population of the continent), and to develop integrated simulation models and an open-access platform, named HealthProtect, able to design and evaluate the most impactful and cost-effective economic-based policies in each country for the improvement of health and reduction its health inequalities. The proposed milestones over project will be: Milestone 1 (1-12 month): Evaluation of the effects of income and wealth changes - and of the corresponding increases in poverty rates - on morbidity and mortality, overall and for groups of causes, with a focus on the pandemic and post-pandemic period, in each one of BACEM countries. Milestone 2 (9-18 month): Forecasting the changes of income distributions, poverty rates and inequalities measures in each one of the BACEM countries according to a wide range of global and local economic scenarios. Subsequently, evaluation of the impact of these scenarios on morbidity and mortality. Milestone 3 (19-36 month): Application of HealthProtect to design - together with policy makers in the economic and health sector - the most impactful and cost-effective strategies for the mitigation of the health effects of the economic crisis on morbidity, mortality and health inequalities in each BACEM. Milestone 4 (1-12 month - in parallel with Milestone 1): Development of country-specific microsimulation models able to evaluate the impact of income-based policies, including poverty and inequality-reduction interventions, on morbidity and mortality rates, overall and for groups of causes. Milestone 5 (13-18 - in parallel with Milestone 2): Development of the HealthProtect platform, with a user-friendly dashboard and open-access to stakeholders. Milestone 6 (19-36 month - in parallel with Milestone 3): Country-specific and international dissemination activities, trainings, and advocacy actions for the use of HealthProtect in policy making practices, using also the HealthProtect application of Milestone 6.

In the last decade, the role of software engineering has changed rapidly and radically. Globalisation and mobility of people and services, pervasive computing, and ubiquitous connectivity through the Internet have disrupted traditional software engineering boundaries and practices. People and services are no longer bound by physical locations. Computational devices are no longer bound to the devices that host them. Communication, in its broadest sense, is no longer bounded in time or place. The Software Engineering & Design (SEAD) group at the Open University (OU) is leading software engineering research in this new reality that requires a paradigm shift in the way software is developed and used. This platform grant will grow and sustain strategic, multi-disciplinary, crosscutting research activities that underpin the advances in software engineering required to build the pervasive and ubiquitous computing systems that will be tightly woven into the fabric of a complex and changing socio-technical world. In addition to sustaining and growing the SEAD group at the OU and supporting its continued collaboration with the Social Psychology research group at the University of Exeter, the SAUSE platform will also enable the group to have lasting impact across several application domains such as healthcare, aviation, policing, and sustainability. The grant will allow the team to enhance the existing partner networks in these areas and to develop impact pathways for their research, going beyond the scope and lifetime of individual research projects.

Brain infections, such as bacterial meningitis, still cause death and disability in the UK and worldwide. The key decision for a doctor is to decide whether a patient has bacterial meningitis, or whether they have a similar condition (a clinical mimic), such as viral meningitis. In both cases the patient often looks the same. However, bacterial infection needs immediate treatment with antibiotics whereas a mimic does not. The essential test for distinguishing between the two is the lumbar puncture (a needle passing between the bones in the spine). The lumbar puncture is often delayed, or not performed at all. This can result in delayed antibiotic treatment for those who need it, or unnecessary antibiotics in those who do not, as well as a patient not receiving a diagnosis. We offer a novel test measuring the body's response to bacterial infection in the blood. This means patients can be tested without having to wait for the lumbar puncture. We believe this test will help doctors to more accurately decide which patients do or do not need antibiotics. This will promote appropriate treatment, reduce unnecessary antibiotics, reduce in-patient stay, improve patient care and reduce the burden on health staff and hospitals. We are working with an industrial company who are experts in developing diagnostic tests, to develop our test for clinical use. We are also linking with many expert clinical teams in the UK, Europe, Brazil and Africa to assess our test on a large number of patients to ensure it is accurate. Through this project we will confirm the test is accurate and refine the test so that it can be used in hospitals in under the next 5 years.