Abstract
The Autonomy and Verification group1
Part of a wider, international, Autonomy and Verification Network of activity:
Programming individual autonomous reasoning agents
Over several years we have developed a range of programming languages with strong semantic foundations for the representation and implementation of individual agents. Beginning with basic autonomous agents, we have moved on to the transparent representation of the reasons for autonomous decisions, which in turn provides the basis for explainability, self-awareness and formal verification later. Once our agents become autonomous, then the decisions they are asked to make might become safety-critical or have other legal and ethical ramifications. In unpredictable environments this can quickly lead to the need for ethical decision-making [34] where the agent must reason about right/wrong, good/bad, etc, in order to come up with the most appropriate decision.
Our development of programming languages has proceeded from executable (temporal) logic specifications [10,72], through resource-boundedness and deliberation [77,78] and on to Beliefs-Desires-Intentions (BDI) languages explicitly developed with verification [32,42] or ethical reasoning in mind [23,37].
Specification and verification
A particular focus of the group has been the formal specification and verification of agent-based systems [54] and, increasingly, autonomous systems [75]; much of our work on verifiable autonomous systems is collected together in [42]. This work has encompassed a number of facets, summarised as follows.
New formalisms and logical methods. These range across novel temporal logics [56,102], multi-modal logics [88,104–106,110,111], spatial logics [97], formalisms for complex reasoning [36], and refined proof methods [87] (the proof methods often concern clausal resolution techniques). These developments together provide a formal basis for our specification and reasoning across a range of practical agent-based, distributed, or autonomous systems.
Model-checking and program model-checking. An important direction, especially for verifying agents at the heart of practical autonomous systems, involves algorithmic verification techniques such as model-checking [11,12] and, of particular relevance, program model-checking [118]. Program model-checking has been developed for agents and then agent-based autonomous systems through a series of contributions such as [38,44,48] culminating in the MCAPL Framework incorporating the Agent Java Pathfinder tool [33]. This framework has been used across a wide range of agent applications, from ethical robots [15] to road vehicle platoons [89], as we will describe later. Work on extending and refining the framework continues [124].
Runtime verification. In addition to pre-deployment verification techniques, such as proof or model-checking, an increasingly important thread of our work involves verifying agent behaviour at runtime [76]. Consequently, research directions [65], coherent frameworks [70] and practical tools [66,67] have been developed for runtime verification and applied in practice [71].
Simulation-based analysis. As we will see in later sections, we often use a combination of different verification techniques and so work has also progressed on simulation-based techniques, especially for autonomous vehicles, that can be used together with more formal techniques [108,109]. The combination of a diverse range of verification techniques is, itself, important [61,122].
Agent flexibility
In developing and verifying agents for use in practical systems, especially autonomous robotic systems, we have tackled a range of important properties and requirements, as we outline below.
Transparency and explainability. The key to an agent is its ability (and necessity) to make decisions. In understanding and explaining agent decisions, transparency about the reasons for those decisions is crucial. We have been part of standards activities for transparency across autonomous systems [123] and continue to ensure that both the programming and architectural approaches we develop are open to analysis. This transparency not only benefits formal verification but also explainability. Consequently both our agents [50] and our robotic systems [91,92] can be designed to provide explanations of their choices and behaviours.
Self-awareness and reconfigurability. Our agents, particularly once embedded in long-lived autonomous systems, must be able to cope, during their lifetimes, with inconsistencies, with unexpected failures, and with additional constraints. Consequently, we have developed self-awareness as a key facet in our systems, with an agent being able to assess not only its own beliefs or intentions but, especially when embodied, its capabilities and effectiveness [41,74]. Once an agent is able to reason about these capabilities it can refine, or even replace, them for example by recognising issues and re-organising or replanning its activities [18,25,39,66]. Particularly when these agents are at the heart of robotic systems, this becomes an important aspect, leading to reconfigurability and increased reliability [43,114,115]
Trustworthiness and verifiable ethical reasoning. While trustworthiness in standard systems is often equivalent to reliability, the additional aspect of decision-making that agents must achieve extends trustworthiness. Typically, in order to trust an agent we not only require it to be reliable but also, since we cannot control all its decisions, require that it makes decisions for our benefit [30]. Understanding, programming and verifying that an agent, possibly embedded into an autonomous system, will make the best decisions, or at least make the decisions we would have made, is a key part of our work. This quickly moves us into the field of ethical decision-making, where agents must make their decisions based on high-level principles such as good/bad, right/wrong, etc. Considering loss of trust and how to repair this is also important [116].
As part of this work we have developed a range of ethical reasoning capabilities for agents [23,40,51], even capturing different ethical values/concerns as a multi-agent problem and developing mechanisms to resolve dilemmas [19]. We have devised this ethical reasoning, for both agents and autonomous systems, to be amenable to formal verification and have provided verification techniques for a range of ethical styles [15,36,46,117]. There are many applications of this, with one practical one being the development of ethical reasoning in the context of autonomous road vehicle decisions [5,7,8].
Security and privacy. Our previous work on security, using temporal and modal logics [55], has led on to work on security verification and evaluation [2,3]. Recent work has also involved combining informal threat analysis techniques with our formal verification approaches [59,101], allowing formal techniques to be focussed on the areas of highest risk.
As agents communicate important information, privacy is also crucial. Our work in this area has concentrated on verifying (lack of) any information leakage or diffusion in agent-based social networks [49,52] and on formalising digital crowds [112].
Multi-agent systems
Programming multi-agent systems. Many of the programming frameworks that we have developed for individual agents naturally extend to multi-agent systems [21]. Indeed, executable specifications were designed with all systems being inherently multi-agent. Our work here has developed and applied multi-agent concepts across a range of structures, such as organisations [86], multiple advisors [19], swarms, digital crowds [112] and even social networks [49].
Collaboration, coordination and particularly teamworking between agents and humans is vital for many current and future applications. Our work in this area has particularly focussed on the Brahms framework, developed by Sierhuis and utilised by NASA [31], for which we have developed a formal verification framework [113]. In addition to examples of teamwork in social robotics, we also explore human-robot teamwork in more extreme environments [120].
Formally verifying multi-agent systems. Although many of the programming and verification techniques for agents described above are directly relevant to multi-agent systems, some of the work of the group has specificallly targetted these multi-agent aspects. These contributions include synchronisation across multiple agents [84], verification of coalitions [87,107], model-checking [13], verification of swarms [58,83,93,95], and verification of human-agent teamwork [113,120].
Heterogeneous formal verification
It is central to much of our work, especially within practical agent-based systems, that we utilise multiple different verification techniques. No single technique is sufficient for all aspects of these complex systems [61]. Consequently, we have devised a range of different ways to combine and concentrate verification, covering
Modular verification [17], particularly of complex systems, is essential [60,90] in order to deal with the size of, and diverse issues across, these systems. To tackle this diversity, combining formal verification approaches for several different formal logics [94] can be important [4,47,90]. Going further, heterogeneous verification, where very different types of verification are used for different parts of a complex system, is also essential for large, practical autonomous systems [20,119]. Finally, corroborative verification [122], where several different, but complementary, verification techniques are together used to confirm a single component’s/agent’s behaviour, is also important [68,69].
Applications
Our techniques and approaches are applicable across a wide range of application areas, often embodied systems such as robots or vehicles.
General robotics issues (inc. ROS verification, robot kitting, hazardous environments, etc)
Often, we provide general techniques and tools that can be used across a range of robotic systems. For example, runtime verification for use across ROS (“Robot Operating System”) architectures [67], transparent ethical reasoning approaches [15], verification across robotic systems [99], and agent architectures [22,35]. In addition, we have particularly examined robotics for general manufacturing tasks [28,71,103] and robots used in hazardous environments [1,73,127], such as in nuclear, offshore, or space scenarios.3
Particularly through involvement in the UK’s “Robots for a Safer World” programme and, within that, RAIN (
We have used agents, particularly our BDI-style agents, in the high-level, transparent and verifiable control of autonomous road vehicles. This particularly concerns two aspects: ensuring that individual vehicles (verifiably) make the safe/legal/ethical decisions [4–8,64] and that we can verify behaviour of platoons or convoys of (road) vehicles [89,90,97]. The former is important when we are working towards regulatory approval for “driverless” cars; the latter represents a key step towards fully autonomous vehicles.
Unmanned air vehicles (inc. “Rules of the AIr”, safe operating envelopes, etc)
Our work with unmanned air systems, specifically UAVs, is again focussed on using agent architectures for these systems, and also on applying heterogeneous verification techniques to tackle their complex issues. In particular, we have combined diverse techniques such as simulation and formal verification [108,119] in order to provide a general approach to the analysis, and potentially certification, of UAVs operating in critical environments [53,109]
Space robotics (inc. orbital, formation-flying, astronaut-robot teams, etc)
Primarily through UKRI funded projects on Engineering Autonomous Space Software and Future AI and Robotics for Space (FAIR-SPACE) we have applied our techniques to the Space domain. This work includes utilising BDI agent programming and simulation in space systems [45,96,125], the development and verification of astronaut-rover teamwork [120], verification and validation across space robotics [20,27,60,63], and work (with NASA) towards verification tool-chains supporting assurance [14].
Domestic robotics (inc. safety, social/trust issues, teaching of robots, etc)
Particularly through work on the “Trustworthy Robotic Assistants” (robosafe.org) project, and subsequently with the universities of Hertfordshire (UK) and Waterloo (Canada), we have looked at agent architectures (and, again, formal verification) for domestic robotic assistants. The specific issues we have explored include safety [57,82], trust [9], reliability [121], and teaching the robots new behaviours [91].
Broader impact
The activities of the Autonomy and Verification Group have led to impact beyond just standard research outputs.
Standards and usage
Our work, particularly on transparent behaviours and formal verification, has led to significant involvement in developing national and international standards. Our standards work has primarily been with the British Standards Institution, for example on BS8611: “Guide to the Ethical Design and Application of Robots and Robotic Devices” [16], and the IEEE, for example on P7001: “Transparency of Autonomous Systems” [123] and P7009: “Failsafe Design of Autonomous Systems” [62]. Not directly relating to standards, our work has contributed to general issues, for example concerning “Moral Autonomous Systems” [29].
Regulations, assurance and certification
As an example of work with regulatory bodies, we produced a white paper with the UK’s Office for Nuclear Regulation entitled “Principles for the Development and Assurance of Autonomous Systems for Safe Use in Hazardous Environments” [100]. In addition we have produced publications giving routes to, and guidelines for, certification [53,81,119], self-certification [74], and assurance [14,126] of autonomous systems.
International activities
We have organised a range of conferences/workshops, most recently SCAV, EMAS, FroCoS, JELIA, CLIMA, AREA, FMAS, and a number of Dagstuhl Seminars [79,80,85]. Similarly, we have organised a range of journal special issues, most recently the AI Journal Special Issue on Ethics for Autonomous Systems.
We also play a leading part in international organisations, such as the IEEE Technical Committee on the Verificaiton of Autonomous Systems, the ACM SIGAI, and the European Association for Multi-Agent Systems.
The group has been involved in international competitions, both concerning agents and robotics. In particular, the Multi-Agent Programming Contest where we have won [24,26,98]. We have also worked with NIST in the USA in extending their ARIAC robotic competition [71]
Outreach and engagement
Particularly via robotics, we continue to be involved in outreach and public engagement activities.
Louise Dennis leads the LegoRovers4
While at Liverpool the group worked with artists Cecile B. Evans to produce the “Sprung a Leak” exhibit at Tate Liverpool during 2016 and 2017.7
In this area many challenges and open problems remain.
Programming individual autonomous reasoning agents. Challenges here include enabling more flexible reasoning – such as contextual, priority-based and probabilistic reasoning around plan and intention selection, integration with AI planning tools, and techniques for reasoning about failure and adaptation. Similarly there are challenges in transparency and explainability – while it has long been recognised that cognitive agents can, in principle, explain themselves there has been relatively little work exploring how to do this in practice. Advances have been made in all these areas, but there is comparatively little work that does so while trying to maintain properties such as verifiability.
Specification and verification. The challenges here include enabling better use of different types of verification together to improve verification of systems overall; creating toolkits that enable a unified specification, design, verification and implementation workflow; better analysis and verification of machine learning sub components; improved formal verification techniques to cope with complex autonomous systems; and better consideration of factors such as trustworthiness, security, privacy when designing systems.
Agent flexibility. Capturing, and formalising, both ethical principles and concepts of responsibility across agent-based systems, and then moving from these to both execution and formal verification. Incorporating, and verifying, not only reliability but safety and security issues.
Multi-agent systems. Being able to handle complex human-agent-robot teams, and in particular the dynamic nature of responsibility and autonomy within realistic and practical teams.
Applications. Real applications, from straightforward individual robots, to more complex teams and truly autonomous vehicles acting well beyond human control. Also the practical ethical issues of domestic robotic assistants with safety, social and privacy responsibilities.
