Ashley Colley
email: ashley.colley@cie.fi

Jani Väyrynen
email: jani.vayrynen@cie.fi

Jonna Häkkila
email: jonna.hakkila@ulapland.fi

Exploring the Use of Virtual Environments in an Industrial Site Design Process

Keywords: User studies, virtual words, head mounted displays, immersion. 1

Virtual environments are becoming more commonly used in urban planning and the construction industry. In this paper, we investigate whether exploring a 3D model of a factory site can identify design problems related to human perception, such as exposing users to heights without sufficient protection. Problems of height and space are not easily identified during the normal design process, and are costly to correct. We present a user study (n=30) in which three different presentation formats, 1) CAVE, 2) Head Mounted Display (HMD), and 3) monitor display, are compared as methods to explore a virtual factory site. Our results indicate that HMD provides the most immersive experience and e.g. that the CAVE approach is problematic in cases where detailed navigation is required. We also identify that the use of heart rate monitoring when exploring the virtual environment can provide a useful indication of possible issues related to perceptions of the design.

INTRODUCTION

In today's world, Virtual Reality (VR) technologies have become more and more common due to increases in computing performance as well as advances in input and output technologies. Probably the most commonly known use of VR is in computer games, which have brought interaction with VR environments in to the reach of large audiences. While the VR industry is heavily driven by entertainment based use cases, especially in the gaming industry, the use of VR for professional purposes is also increasing. When building cities, factories and other large industrial sites, the role of simulation technologies can be essential in enabling cost-efficient exploration of different solutions in the design and planning phases. When exploring 3D models of industrial site architectural plans, it is important to gain a realistic perception of the environment in order to assess different construction designs. On the other hand, for sales purposes, the experiental factors may play a role when communicating with potential customers. For these reasons, it is interesting to explore different interaction technologies and immersion in this context.

Whereas 3D virtual worlds have traditionally been accessed via a PC with a monitor display screen, other interaction technologies are becoming more common, not only for researchers but also for other audiences. Immersive environments such as CAVEs have become less expensive to set up, and HMDs such as the Oculus Rift and Google Glass have caught the attention of developers as well as consumers. In this paper, we describe our work on utilizing HMD and CAVE presentations, rather than a conventional PC set-up to explore an industrial site simulation utilizing 3D models of the physical world, see Figure 1. The contribution of this paper lies in:

 Providing user study based information on the relative benefits of CAVE and HMD visualizations in identifying human perception issues in the factory site design process.  Demonstrating that heart rate monitoring can be used as a useful source of data on user perception when exploring a virtual industrial site environment.

RELATED WORK

User Experience with 3D Virtual Worlds

User experience (UX) research covers both utilitarian and hedonic aspects related to the user a product, service or user interface [START_REF] Hassenzahl | User experience -a research agenda[END_REF]. Whereas a unified definition for UX

has not yet emerged [START_REF] Law | Understanding, scoping and defining user experience: A survey approach[END_REF], it is generally agreed that it goes beyond the instrumental means and measures relevant for usability research. User experience research expands the traditional perspective of usability oriented user research by including hedonic values associated with the interaction, and investigating the system use in a more holistic manner. Whereas UX research on 3D virtual worlds has so far been altogether rather scarce, prior art has addressed selected topics UI design and users' perceptions on such systems.

Research on the UI design of virtual worlds (VWs) has typically focused on quite narrow topics, such as text readability in 3D games [START_REF] Jankowski | Integrating Text with Video and 3D Graphics: The Effect of Text Drawing Styles on Text Readability[END_REF], avatars [START_REF] Wagner | How real should virtual characters be?[END_REF], or collaborative and shared space aspects [START_REF] Liu | Survey of State Melding in Virtual Worlds[END_REF]. However, it has been identified that the ability to create realistic visualizations is one of the advantages of using 3D virtual worlds, especially when compared to conventional textual or 2D graphical user interface (GUI) presentations. User perceptions of the use of 3D virtual worlds has been charted e.g. in the context of home health care professionals. One identified strength in the approach was the patient activity monitoring, which could be visualized in a realistic yet in anonymous manner by using activity tracking combined with a 3D virtual world presentation and avatars [START_REF] Pouke | Elderly Healthcare Monitoring Using an Avatar-Based 3D Virtual Environment[END_REF]. When investigating different visualization techniques, Vatjus-Anttila et al. conclude that when 3D models of the physical world are considered, a better user experience is achieved when the VW design matches people's mental expectations of the physical space [START_REF] Vatjus-Anttila | On the Edge of a Virtual World -Investigating Users Preferences and Different Visualization Techniques[END_REF]. Contrary to our research, in prior art the research focus has been on the GUI design elements, and not in comparing user perceptions when different technology platforms are used to interact with the virtual worlds.

Considering the perception of height in both real and virtual representations, Emmelkamp et al. [START_REF] Emmelkamp | Virtual reality treatment in acrophobia: a comparison with exposure in vivo[END_REF] have presented work focused on the treatment of those with acrophobia, concluding that exposure to the virtual condition was as effective as real exposure in treating the condition. Here, the participants' heart rate was used as one measure of their response to real and virtual height. In other studies on the treatment of phobias using virtual reality [START_REF] Wiederhold | Physiological monitoring as an objective tool in virtual reality therapy[END_REF] identified galvanic skin resistance as a more useful measurement technique than heart rate. The use of heart rate monitors in exploring user experience in general has been reported on by [START_REF] Anttonen | Emotions and heart rate while sitting on a chair[END_REF]. Changes in heart rate caused by playing conventional video games has also been studied e.g. Segal & Dietz [START_REF] Segal | Physiologic responses to playing a video game[END_REF], who identified a significant increase in heart rates caused by playing video games.

Prior art has compared different presentation formats of VR from the point of view of the symptoms induced during its use, e.g. Sharples et al. [START_REF] Sharples | Virtual reality induced symptoms and effects (VRISE): Comparison of head mounted display (HMD), desktop and projection display systems[END_REF] compare the use of a Head Mounted Display, projection screen and desktop display. Here, the main conclusion being the large variation between subjects. In our study we compare a similar set of display formats, but rather focusing on differences in the utility of each to provide inputs to the architectural design process.

Immersive Environments and Human Perception

CAVEs. Immersive environments have received much attention in research. One of the most common technologies used being CAVEs [START_REF] Cruz-Neira | The CAVE: audio visual experience automatic virtual environment[END_REF], which typically surround the user with three large projected walls, and even ceiling and floor, creating an immersive display environment that can be used either in a 2D or stereoscopic 3D mode. As application domains for CAVE type immersive environments, game, architecture and cultural heritage related topic are often considered, see e.g. [START_REF] Cabral | An experience using X3D for virtual cultural heritage[END_REF]. CAVE environments have been employed in professional use when investigating and assessing architectural plans both in research [START_REF] Mobach | Do virtual worlds create better real worlds?[END_REF] and in commercial design studios [16]. Frost et al. [START_REF] Frost | Virtual reality used in a collaborative architectural design process[END_REF] present a building design process that incorporated the use of a VR CAVE environment. In their work, future users of the space being designed virtually visited the environment during the design phase and provided feedback to the architects.

Related to our research, earlier work related to human perception is of particular interest. Prior art has investigated what kind of effect the use of immersive environment has on the perception of walking distance [START_REF] Plumert | Distance Perception in Real and Virtual Environments[END_REF]. Here, it was found that test participants' distance estimates were almost identical between real world and 3D virtual world representations. When comparing a projected CAVE with a fish tank type display on a monitor, Demiralp et al. [START_REF] Demiralp | CAVE and Fishtank Virtual-Reality Displays: A Qualitative and Quantitative Comparison[END_REF] found the different displays had an effect on how suitable they were for VR applications. Also, the effect of the field of view and peripheral vision on the level of immersion experienced by users has been reported in several studies [20; 21]. With desktop virtual reality, the use of Peripheral Lenses has been proposed as a way to increase the level of immersion [START_REF] Robertson | Immersion in desktop virtual reality[END_REF]. Here, these kinds of additional screens next to the main display can be seen as a step towards a CAVE type setup.

HMDs. Head Mounted Displays (HMDs) are proposed as one method to provide the user with a deeper level of immersion in a virtual environment [START_REF] Chung | Exploring Virtual Worlds with Head-Mounted Displays[END_REF]. Since the early work of e.g. Chung in late 1980's, we have witnessed the evolution from bulky and heavy HMD equipment towards lightweight and truly mobile systems. In the scope of architectural design, Thomas' early work on using HMDs as an augmented reality tool allowing a building design to be viewed in its physical surroundings [START_REF] Thomas | Using augmented reality to visualise architecture designs in an outdoor environment[END_REF], providing an interesting base to build upon. Earlier work [START_REF] Pausch | Quantifying immersion in virtual reality[END_REF] has discussed the increased immersion provided by HMDs compared to monitors, but has however not included detailed evaluation of the differences.

Together with other development trends, such as display miniaturization and increases in computing power, we now have equipment that can be easily adopted to different kinds of use cases and customized for industrial applications. Recent research using the Oculus Rift HMD has demonstrated e.g. a simulation that enables the user to experience flying like a bird [START_REF] Ikeuchi | KinecDrone: enhancing somatic sensation to fly in the sky with Kinect and AR.Drone[END_REF]. Related to the domain used in our study, i.e. construction sites, previous research has examined the role of HMDs in building renovation and construction, e.g. [START_REF] Webster | Augmented reality in architectural construction, inspection and renovation[END_REF]. However, their use has been considered rather for Augmented Reality applications instead of Virtual Reality. Comparison of different interactive technologies and charting user perceptions of using them, remains so far unexplored.

STUDY DESIGN

Industrial Site Virtual World

To evaluate the suitability of HMD and CAVE solutions for our defined use case, we implemented a prototype application that enabled a test user to move around a virtual 3D industrial site (Figure 2) with HMD, CAVE and a normal PC monitor screen as the output device. In each case a Microsoft Xbox controller was used as the interaction method. The HMD used was an Oculus Rift, Developer Kit 1 version [27]. The CAVE environment used consisted of a 180° stereoscopic 3D projection screen that did not include floor or ceiling projected surfaces. In the CAVE environment users were required to wear polarized glasses to see the stereoscopic effect.

Fig. 2. 3D model used in the virtual world

Our virtual industrial site used a 3D model that was supplied by R-Taso ltd. [START_REF][END_REF], a company that specializes in creating stair and walkway solutions for large industrial complexes. The model represented a typical installation for their products and included stairs, walkways and vertical ladders, see Figure 2. Thus, the evaluation was done with the models that are actually used for professional purposes, neglecting some of the details of high fidelity architectural models. Additionally, we added scenery and other elements to the virtual world to increase the level of realism Our application was implemented using the Unity 3D environment, with a firstperson camera controller to enable the user to move around the virtual industrial site. An example view of the 3D virtual world provided through the HMD is illustrated in Figure 3. Physics objects were added to the model to enable the user to climb stairs and walk on the elevated walkways. Ladder climbing was enabled by use of a script such that forward motion when in the vicinity of the ladder would create upward motion, and vice versa. Walking and running speed in the virtual world was 3.8 km/h and 7.8 km/h respectively. The highest walkway in the model was 12.4m above ground.

To further increase the level of immersion we added sounds, such as different footstep sounds when walking on different surfaces.

To enable analysis of differences in users navigation routes in the 3 different presentation formats of the application, we included a logging functionality, so that the path taken around the model and the time taken to reach certain waypoints were logged. Additionally, some specific events, such as falling down or starting and finishing a mini task were logged. As prior art had highlighted the effect of virtual world conditions on heart rates, we included heart rate monitoring in our study. Participants put on a heart rate monitoring chest belt at the beginning of the study before completing the initial questionnaire, and wore it for the full duration of the study. The heart rate data was logged by an Android based application for later analysis.

User Study Set-up

Study Set-up. The three visualization modes compared in the study are shown in Figure 4. In each case the virtual world model and the navigation mechanism were identical. The study was set up in one room; in one corner of the room there was the fixed CAVE system, additional equipment consisted of a laptop to run the simulation, a large flat screen display, an Oculus Rift and an Xbox gamepad. A camcorder was used to film the test sessions. In addition to video recording, users' heart rates were monitored both during tests and whilst completing the questionnaires between each test mode. During tests and while filling questionnaires users' comments and reactions were observed and notes made by a test moderator.

Each user was welcomed to the test and was asked to put on the heart rate monitor. Then the user completed a background information form. The user was told about the general phases of the test. The order in which users completed the three test modes was counterbalanced to avoid learning effects.

The user was guided to each test environment in turn and instructed on the use of the gamepad to navigate the virtual environment. The user was then briefly instructed on the tasks to be completed in the virtual environment. The user had to climb either the ladders or the stairs to the top of the silo structure. On the top of the silos there were two task checkpoints that were identified with a red glow, which the user had to find and move to. The location of the checkpoints was randomized. When arriving to a checkpoint, the simulation entered 'targeting mode' in which the user was required to find a target object on the ground below the silo towers and mark it by pointing it with a cursor and pressing a button on the controller. After finishing the two tasks, the user had to return to the starting point, either by ladder or stairs. When the user had finished the test for one presentation format, s/he was given a questionnaire related to the experienced realism during the test. After filling the questionnaire the user carried out the tests in the other visualization environments. After the final test the user removed the heart rate monitor and completed a final questionnaire where s/he chose the favorite presentation format and gave reasons for their choice. Users then completed a word selection task, choosing five words from a grid of 52 adjectives to represent each experience. This method was a customized version of the Microsoft Research Product Reaction cards method [START_REF] Benedek | Measuring desirability: New methods for measuring desirability in the usability lab setting[END_REF]. Finally, the user was thanked for their participation and a cinema ticket was given as a reward. Participants. Altogether, 30 participants took part in the user study. The participants were between the ages of 20 and 51 (M=26.4, SD=4.8), and 8 of them were women and 22 men. As a background, 71 % of the participants had not used any kind of HMD earlier, but 56 % had used 3D glasses once and 41 % more than once. In total 38 % of the participants played console games about once a year, 25 % every month.

RESULTS

Paths taken by test participants

Inspired by the work on visual presentations of real world user flows presented by Williamson & Williamson [START_REF] Williamson | Analysing Pedestrian Traffic Around Public Displays[END_REF], we aimed to present similar visualizations for a virtual environment. Figure 7 presents a top-down view of the virtual environment indicating the paths taken by users. Considering the overall paths taken by participants (see Figure 7) it appeared that with the PC participants took a straightforward, goal orientated path, compared to a more exploratory approach with the Oculus and CAVE. This is also reflected in the mean total time taken for users to complete the task with the PC (M=3m45s, SD=76s) being notably faster that either the CAVE (M=5m8s, SD=123s) or Oculus (M=5m6s, SD=91s). By visual inspection of the detailed navigation paths (e.g. Figure 8), the paths taken when using the CAVE were observed to be generally more spread and less consistent between users than either PC or Oculus conditions.

Subjective ratings

The users' subjective ratings comparing each condition are presented in Figure 9. To examine the significance of differences in the median subjective measures for each display condition, Friedman's tests were conducted on the responses to each of the Likert questions. Post-hoc analysis with Wilcoxon signed-rank tests was then con-ducted with a Bonferroni correction applied to remove problems of multiplicity, resulting in a significance level set at p < 0.016 (.05 / 3 = .016). Table 1 details the results of the statistical analysis. For all of the criteria, statistically significant differences were found between the Oculus and both other conditions. Hence the reported perception of space and the feelings of height, motion, control and realism the feeling of space provided by the Oculus were better than either the CAVE or the PC screen case. No significant differences were found between the CAVE and PC conditions. Related to the feeling of space, half (15/30) of the users commented on the wide field of view provided by the CAVE. However, there seemed to be some disagreement as to whether it was a positive or negative issue, user #7 summing up the general responses "The field of view was too big. But on the other hand it was better than with a small screen, however orientation was hard to achieve" (User #7). In the case of the Oculus, 8/30 users mentioned the effect of moving their head as contributing to the feeling of space. Almost half of the users (13/30) felt that the feeling of height when climbing the stairs or ladders was realistic, with some comments about feeling dizzy, or keeping away from the edge, e.g. "Especially when I was at the top of the ladders and glanced down, I felt like being somewhere high. It felt horrible and frightening" (User #11) and "…I was more aware of edges in the staircase." (User #12). Table 1. Analysis of significance of differences in median subjective ratings for each display condition. For the Wilcoxon signed rank tests a Bonferonni correction results in a significance level criteria of p < .016.

Friedman's test

Wilcoxon signed-rank Issues related to the poor image quality, lag or low frame rate were mentioned by 8/30 users in relation to the feeling of motion when using the Oculus, e.g. "It was somewhat choppy when you turned your head." (User #3). One user (User #21) suggested that adding head swaying when walking or running would have improved the feeling of motion.

Oculus -Cave -PC

Oculus -Cave

PC -Cave

PC -Oculus

Perception of space

Users commented on difficulties controlling the movement in the CAVE visualization, with 6/30 users giving comments in this direction e.g. "Not so easy to control as the Oculus and normal screen." (User #6). In the Oculus case, the control of the camera rotation by both rotating the head and by using the left stick on the joystick was commented negatively by 6/30 users, however 2/30 users gave positive comments related to this functionality, e.g. "Mildly confusing because the view turned with both controller and head." (User #13).

Considering the overall realism of exploring the virtual world, 15/30 users commented on the low resolution of the Oculus image as on factor limiting the reality of the experience. When asked for their favorite of the three visualization conditions 27 participants selected the Oculus, 2 the Cave and 1 the PC. The reasons given for selecting the Oculus mostly related to the experience being fun or immersive in nature e.g. "The Oculus offered the best immersion, and naturally controlling your view was effortless." (User #20).

Product Reaction Cards

The adjectives chosen most frequently by test participants to reflect their experiences with each visualization condition are presented in Table 2. Generally the adjectives selected to describe the Cave were somewhat negative about both its visualization and ease of interaction with it. This corresponded with the descriptive comments given by the participants that described some discomfort with the wide field of view and relatively inaccurate control of the CAVE.

Table 2. Adjectives most frequently selected by users to describe the experience of each visualization mode. Bracketed numbers indicate the number of users selecting each adjective.

Cave

Oculus PC Rigid [START_REF] Wiederhold | Physiological monitoring as an objective tool in virtual reality therapy[END_REF] Entertaining ( 12) Ordinary (18) Visually unpleasant [START_REF] Emmelkamp | Virtual reality treatment in acrophobia: a comparison with exposure in vivo[END_REF] Empowering ( 11) Dated ( 13) Difficult to use [START_REF] Vatjus-Anttila | On the Edge of a Virtual World -Investigating Users Preferences and Different Visualization Techniques[END_REF] Inspiring ( 10) Controllable ( 9) Frustrating [START_REF] Vatjus-Anttila | On the Edge of a Virtual World -Investigating Users Preferences and Different Visualization Techniques[END_REF] Fun + (9) Familiar + ( 9) Unclear ( 6) Novel ( 8) Rigid (9) Easy to use [START_REF] Pouke | Elderly Healthcare Monitoring Using an Avatar-Based 3D Virtual Environment[END_REF] Easy to use ( 7) Approachable ( 8) Simple + [START_REF] Pouke | Elderly Healthcare Monitoring Using an Avatar-Based 3D Virtual Environment[END_REF] Responsive ( 7) Clear ( 7) Approachable [START_REF] Liu | Survey of State Melding in Virtual Worlds[END_REF] Approachable [START_REF] Pouke | Elderly Healthcare Monitoring Using an Avatar-Based 3D Virtual Environment[END_REF] Easy to use (7) Fast + [START_REF] Liu | Survey of State Melding in Virtual Worlds[END_REF] Innovative [START_REF] Pouke | Elderly Healthcare Monitoring Using an Avatar-Based 3D Virtual Environment[END_REF] Poor quality [START_REF] Pouke | Elderly Healthcare Monitoring Using an Avatar-Based 3D Virtual Environment[END_REF] The majority of the words selected to describe the Oculus were hedonistic in nature, with entertaining, empowering, inspiring and fun being the most chosen adjectives. The PC interface was considered somewhat dull and old fashioned. However, in its favour, the users considered the PC interface controllable, clear and easy to use.

Heart Rate Analysis

The data logged by the Android application was transferred to Microsoft Excel where analysis was made. When reviewing the logged heart rate data there were many cases where the data was considered invalid. This was for example where the chest belt sensor had poor contact with the participant's skin during the test. Thus, test data that included heart rates above 180 bpm or heart rate jumps of more than 20bpm were deemed erroneous. To enable within subjects analysis, participants whose test data included erroneous data for one or more test conditions were excluded from further analysis. Hence, the data from 17 participants was included in the heart rate based analysis (Figure 10). To identify the significance of differences between the participant's mean heart rates in each condition A one-way within subjects ANOVA was conducted. There was a significant effect of the output modality, Wilks' Lambda = 0.606, F (2,15) = 4.88, p = .023. Three paired samples t-tests were used to make post hoc comparisons between the conditions with a target criteria of p < .05. However, due to the multiple comparisons a Bonferroni adjusted significance criteria of p < .016 was applied.

A first paired samples t-test indicated that there was no significant difference in the values for PC (M=85.5, SD=12.5) and Cave (M=86.4, SD=12.8) conditions; t(16)=-0.715, p = .485. A second paired samples t-test indicated that there was a significant difference in the scores for PC (M=85.5, SD=12.5) and Oculus (M=91.7, SD=12.7) conditions; t (16)=-3.81, p = .006. A third paired samples t-test indicated that there was no significant difference in the scores for Cave (M=86.4, SD=12.8) and Oculus (M=91.7, SD=12.7) conditions; t(16)=-2.326, p = .033. It may be noted that the latter comparison of Cave against Oculus conditions would have been considered significant if we had not applied the conservative Bonferroni correction. Hence, we consider that there is a borderline significant difference between the heart rates whilst using the Cave and Oculus.

When reviewing the heart rate of individual participants there is some evidence that changes in heart rate correspond to experiences in the virtual environment (Figure 11). Although taken in isolation no conclusions can be drawn from variations in heart rate, as it is affected by many other factors beyond the experience of the virtual word, it may prove valuable when combined with other data sources. For example, peaks in heart rate at a certain point in the virtual environment could provide the trigger for qualitative interview questions related to that point.

DISCUSSION

Experiental aspects

Overall the Oculus was the clearly preferred visualization / interaction approach. The playful aspects of the Oculus based interaction identified by the users in both the product reaction cards and free form comments, highlights that playfulness in a key factor in user engagement.

In general our study had strong internal validity, the data obtained from Likert scale questions, and free form comments pointed to similar conclusions. Additionally, the heart rate data supported the findings, with the Oculus based exploration resulting in significantly higher mean heart rates than other methods, suggesting a higher level of immersion.

Control and immersion

Although the three visualization approaches we compared were based on exactly the same model and used the identical control method of the Xbox controller, the test participants judged the feeling of control to be different. Specifically, the level of control with the Oculus case was considered to give a significantly stronger feeling of control than either the PC or cave cases. The Oculus' interaction based on the natural head movement was clearly appreciated, and our duplication of camera direction control with the handheld controller joystick was not positively received.

There was also indication that the PC based solution was perceived as being more controllable than the CAVE solution. Although the Likert responses did not alone indicate a significant difference, the direction was suggested and was supported by the large variance in the navigation paths taken by different users (Figure 8) and the many free form comments related to the lack of controllability of the CAVE. This is perhaps not surprising, as although all users stood at exactly the same position when using the CAVE, we speculate that their perception of their own position in the 3D space was rather personal, depending on a variety of factors. This suggests that the CAVE type environments may not be suitable for tasks investigating precise navigation in a virtual world with a first-person camera viewpoint, as the user's exact location in the scene is not apparent. Rather the CAVE environment is more suited to presenting a relatively static view of a virtual world, and has other benefits compared to the head mounted display, for example being viewable by a number of people simultaneously without the need for additional hardware.

One interesting aspect relates to differences in perception caused by the visibility of the user's own body. While wearing the HMD, users cannot see their own hands and body, whilst in the CAVE presentation these are visible which may act to improve the level of reality, for example by providing a size benchmark.

Use of Heart Rate

We acknowledge that our use of heart rate is not rigorous in the medical sense, and the large number of results we had to discard due to operational issues was not ideal. However, we believe we have demonstrated that a simple heart rate monitoring set-up can provide useful information on the design of spaces that are being evaluated in a virtual reality environment. In this respect we have shown that, as well as for users with acrophobia as reported by [START_REF] Emmelkamp | Virtual reality treatment in acrophobia: a comparison with exposure in vivo[END_REF], heart rate can be used as an indication of emotional state also for normal users in a virtual world.

Interaction Technologies as Tools

Our target was the creation of tools and methods to enable industrial site designs to be evaluated, potential problem issues identified and designs corrected before any site construction commences. Of particular interest are safety and psychological issues, for example the perception of height and feeling of personal security when working at height. Based on our user study results we have identified that in particular feelings of discomfort due to height can be well identified by this approach, particularly when experienced via a HMD such as the Oculus used in our study.

Limitations of the Study

By making a comparison between the three different presentation formats we hope to identify particular pros and cons of each solution. Here, we acknowledge the novelty effect may have influenced the users' perceptions. However, as few participants had experience of either both the Oculus or CAVE based solutions we feel our comparison of the two is valid. As noted in the users' free form comments each solution had some level of technical limitations e.g. the limited resolution of the Oculus and the field of view of the CAVE, however we feel that these limitations represent the state of the mainstream of the currently available technology in each case.

As we only used one virtual world model in our study that places a potential limitation on the applicability of our case. In addition, it should be noted that we explored a one-time use, and user's perceptions may change in the long term when the novelty effect wears off. However, in many situations, such as when presenting the construction site to costumers, management or marketing department, the interaction and the exploration within the 3D virtual world models is of a short duration. Thus, we believe that despite of the limitations, our study offers interesting insights on using different interaction technologies.

CONCLUSION

In our user research (n=30) we have compared three different access methods for exploring a 3D model of an industrial site design, CAVE, Oculus HMD, and PC monitor. The main target of our work was to identify approaches that could provide user feedback to the architects and designers of the site installation. Our results show that the Oculus HMD was the clearly preferred method, especially for the experiental aspects it provided, but also because of the feeling of control in usage.

We have concluded that CAVE type environments are not ideal for first-person presentation of a virtual environment in cases where precise navigation is needed, e.g. exploring a factory building. We have demonstrated that the use of a commercial heart rate monitor can be used to give useful information on user perceptions when exploring a virtual environment.

7

Fig. 1 .

 1 Fig. 1. Test participant exploring the virtual factory environment with Oculus Rift head mounted display Paths taken by users are shown as blue trails.

Fig. 3 .

 3 Fig. 3. View seen by the user through the Head Mounted Display

Fig. 4 .

 4 Fig. 4. The three visualization modes compared in the study. Left to right: PC screen Oculus Rift HMD, Stereoscopic CAVE

Fig. 5 .

 5 Fig. 5. User using the HMD version of the application. Note the Xbox controller.

Fig. 6 .

 6 Fig. 6. User navigating the CAVE version of the application using the Xbox controller.

Fig. 7 .

 7 Fig. 7. Top down view of our virtual factory environment, showing the paths taken by all users when exploring the space.

Fig. 8 .

 8 Fig. 8. Paths taken by users when climbing the stairs, at the level without a safety barrier. Top: Oculus, Middle: PC, Bottom: CAVE.

Fig. 9 .

 9 Fig. 9. Subjective rating for each visualisation condition.

Fig. 10 .

 10 Fig. 10. Mean heart rates for each condition. Values for participants with invalid readings have been removed from the analysis.

Fig. 11 .

 11 Fig. 11. Example heart rate of participants whilst exploring the virtual world (Top: user #10, Oculus. Bottom: User #1, Oculus).

ACKNOWLEDGMENTS

The authors would like to thank Ville Törmänen of R-Taso ltd. who supplied the 3D models used and gave valuable insights into the practical problems associated with industrial site design.


Fiona Dermody
email: fiona.dermody3@mail.dcu.ie

Alistair Sutherland

Margaret Farren

A Multi-Modal System for Public Speaking Pilot Study on evaluation of real-time feedback

Keywords: Affective Computing, Multi-Modal Interfaces, Social Signal Recognition, Human Computer Interaction

A prototype has been developed for a digital system and multi-modal user interface to analyze social signals displayed during public speaking. User testing on the prototype has commenced to evaluate the most effective way to display real-time feedback to users on their speaking performance.

Introduction

The fear of public speaking tops the list of human phobias. However, success in social, academic and occupational situations depends on the ability to communicate effectively to groups. A fear of public speaking thus limits achievement in social gatherings, education and enterprise [START_REF] Dwyer | Is Public Speaking Really More Feared Than Death?[END_REF]. However, the fear of public speaking can be so great that it can lead to avoidance of speaking in the public domain altogether [START_REF] Feldman | Psychological stress, appraisal, emotion and cardiovascular response in a public speaking task[END_REF]. The problem is a recursive one, how can an individual improve their speaking skills and reduce their fear of speaking in public if they avoid speaking in public? Public speaking is not just about the words spoken. Effective speaking involves the use of gestures, facial expressions and vocal variety. All these social signals combine to give the appearance of self-confidence in a speaker. Research has found that anxious speakers do not engage the attention of an audience [START_REF] Freeman | Behavioral inhibition and the attribution of public speaking state anxiety[END_REF]. Rather the audience focuses on the speaker's nervous disposition instead of their words [START_REF] Winton | Social anxiety, fear of negative evaluation and the detection of negative emotion in others[END_REF].

The solution, which we propose, is interdisciplinary. It incorporates theory from computing, psychology and communications. It is envisaged that this social signal recognition system will enable individuals to develop their competence in public speaking.

Using a combination of 3D video imaging, audio and social signal processing algorithms, this digital system analyses facial expressions, tone of voice and gestures. The system then provides feedback on the user's speaking performance. It will also deliver tutorial videos on good speaking practices. Exposure to these dynamic features will enable a speaker to systematically develop confidence and skill before speaking in front of a live audience.

Skilled human trainers in communication are scarce and expensive. This digital system incorporates experience from one such skilled human trainer to provide constructive feedback to users on their speaking performance. This digital experience will enable anxious speakers to develop their public speaking skills cost-effectively, in private and at their own pace.

Existing Research

There have been attempts to use social signal recognition for public speaking but not for instruction purposes [START_REF] Batrinca | Cicero -towards a multimodal virtual audience platform for public speaking training[END_REF]. This system is innovative because it will extend the field of human computer interaction:

 Combining all modalities -voice, gesture, facial expression and body pose into a multi-modal system for delivering instruction in public speaking  Incorporating the knowledge of experts in public speaking ensures that the feedback provided on a user's speaking is based on a real-world, practice-based approach

Research Question

Which form of real-time multi-modal feedback is most effective for users to develop skill in public speaking?

3 Proposed multi-modal system for public speaking

The system will use a Microsoft Kinect connected to a computer. Social Signal Processing techniques will be used to recognize the speaker's body language, gestures, voice, and facial expressions  Classify speaker's emotion, as perceived by the audience, from the combination of the above  Perceived emotion is regarded as the primary component for analysis.  Give feedback to user on speaking performance  Provide examples of good and bad speaking practice  Set tutorial exercises from beginners level to advanced level and will evaluate the user's performance

Progress to date

A prototype has been developed following a user survey on the features required in a multimodal system for public speaking. Initial user testing has commenced.

Expected Results

One of the technical challenges to be overcome during the development of the system is the optimal way to display feedback to the user in real time during their speaking task. The nature of the feedback is imperative, as our survey showed that some users prefer visual feedback while others prefer textual feedback. The system will be evaluated to ascertain what is the most effective way to display feedback to users on their speaking performance. Results of this user testing will be presented.

Acknowledgement

This material is based upon works supported by Dublin City University under the Daniel O'Hare Research Scholarship scheme.


Martin Schmettow
email: m.schmettow@utwente.nl

Tutorial: Modern regression techniques for HCI researchers

Objectives

Despite a century of progress in statistics since the introduction of ANOVA and Pearson correlation, many researchers are still squeezing their precious data into the tight corset of those dated statistical models. This is particularly limiting in applied disciplines such as HCI, where impact factors can be numerous, heterogeneous and difficult to control experimentally. The proposed tutorial aims at liberating applied researchers from constraints and concerns associated with legacy statistics. After the tutorial, attendees will be able to:

1. build general linear models, with multiple categorical and metric predictors 2. model and interpret interaction effects 3. identify the optimal set of predictors through model selection 4. analyze data from complex research designs using mixed-effects models 5. use all above-mentioned techniques to conceive advanced research models 6. use all above-mentioned techniques to create more efficient research designs

Content

The tutorial spans one day, divided into four sessions of 90 minutes. All start with a motivating example, then explain the technique and demonstrate its use in R (or SPSS, if desired). In all sessions, attendees have opportunity to work on exercises.

2.1

Session 1: From classic to general linear models (GLM)

Attendees are picked up where they most likely stand: outcome variables are continuous and predictors are either metric or categorical. After briefly rehearsing ANOVA and regression, the general linear models (GLM) framework is introduced, which allows to free combinations of any number of categorical and metric predictors.

Session 2: Interaction and selection

With multiple predictors, the outcome variable sometimes shows non-linear trends, which often can conveniently be modeled as interaction effects. First, interactions between factors and metric predictors are introduced. Then, common interaction pat-terns, such as ceiling effects and amplifiers are explained by examples. Finally, we advance to hypothesis forming with interaction effects. In view of the gain in flexibility, the Akaike Information Criterion (AIC) is introduced as alternative to F-tests.

Session 3: Basic mixed-effects models

In experimental or observational research, repeated measures often are preferable with regard to efficiency and data richness. But, neither classic, nor general linear models can deal with repeated measures. (Tweaks exist, but these are limited in statistical power and flexibility.) Linear mixed-effects models as the modern way to deal with repeated measures, efficiently and gracefully [START_REF] Gueorguieva | Move Over ANOVA[END_REF].

Session 4: Advanced mixed-effects models

The final session unleashes the power of mixed-effects models by introducing hierarchical and cross-classified random effects. By example of [START_REF] Molich | Rent a Car in Just 0 , 60 , 240 or 1,217 Seconds? -Comparative Usability Measurement, CUE-8[END_REF], it is shown how to deal with complex sampling schemes. Finally, a paradigm for quantitative design research is introduced, that uses samples of designs [START_REF] Monk | The Product as a Fixed-Effect Fallacy[END_REF].

Intended audience

The tutorial is primarily targeted at HCI researchers who are conducting or planning observational and experimental studies. Knowledge of legacy parametric statistical methods is required, such as linear regression and ANOVA. The first part of the tutorial is a rehearsal, bringing all attendees on the same level before proceeding to more advanced techniques. Familiarity with SPSS and/or R is assumed.

Suggested readings

For preparation, attendees may best pick their favorite textbook on statistics and review the respective chapters on ANOVA and linear regression. An introduction to everything covered in the tutorial (and beyond) is [START_REF] Gelman | Data analysis using regression and multilevel/hierarchical models[END_REF]. It is recommended to also take a few hours to get acquainted with the basics of R and Rstudio (www.rstudio.com).

Background of the tutor

The instructor, Dr. Martin Schmettow, is assistant professor in psychology at the University of Twente (The Netherlands). He has more than a ten year experience in HCI research and education. At his home university, he gives a number of well received courses in Psychology bachelor and master education. Besides his background in Psychology and HCI, he is an expert in modern statistics, including modern regression techniques, exploratory techniques, maximum likelihood estimation, psychomet-ric methods and Bayesian analysis. He has used advanced regression techniques in several publications [START_REF] Hund | The impact of culture and recipient perspective on direction giving in the service of wayfinding[END_REF][START_REF] Schmettow | Optimizing Usability Studies by Complementary Evaluation Methods[END_REF][START_REF] Schmettow | An implicit test of UX: Individuals Differ in What They Associate with Computers[END_REF][START_REF] Schmettow | Are users more diverse than designs? Testing and extending a 25 years old claim[END_REF], but is also known for his mathematical contributions to the problem of sample size estimation in usability testing studies [START_REF] Schmettow | Sample size in usability studies[END_REF].

For further background information, visit the instructors page on ResearchGate (https://www.researchgate.net/profile/Martin_Schmettow), as well as the tutorial handout (http://rpubs.com/schmettow/regression_in_r).

Pedagogical concept

Generally, the tutorial presents modern statistical techniques in a non-intimidating way. Focus is on understanding practical implications of the techniques and train applications in R (or SPSS). Mathematical formalism is avoided as much as possible. The tutorial consists of four sessions that are structured as follows:

1. Every session starts with a mini lecture that first describes a research problem where a particular limitation of classic statistical techniques exists, for example: How can one simultaneously compare the impact of age and level of education (factor) on web browsing performance? 2. Then, the problem is analyzed, and a new technique is introduced, for example: Factors and metric predictors can be mixed ,by capitalizing on sum of squares and the by introducing dummy variables. 3. Third, it is demonstrated by an example, how the technique is used in R, for example: General linear models can be estimated using lm command with a formula expressions. User don't have to deal with dummy variables themselves. 4. Fourth, attendees will work in pairs, applying the newly learned technique to a given research problem, for example: Examine the combined effects of sleep deprivation and noise on performance (data set: Sleep). The proposed tutorial is based on a lecture unit of the Psychology master course Research methods in Human Factors and Engineering Psychology. In January 2013, a compact version has been given to PhD students at the University of Twente. In December 2013, a one-day workshop has been given to PhD students and post docs at the University of Würzburg, Germany (host: Prof. Dr. Jörn Hurtienne).

Material and required resources

Attendees receive the following material:

1. Handout containing more than 100 crafted presentation slides 2. Online tutorial for regression analysis in R 3. Written tutorial, explaining linear mixed-effects models by the example of four case studies (23 pages), SPSS instructions included. 4. Collection of ten real and synthetic data sets 5. Annotated list of recommended books 6. List of over 50 references for use in publications It is assumed that attendees bring a notebook with R and Rstudio installed. Those, who want a SPSS demonstration alongside, need SPSS installed (version 19 upwards). The tutorial uses a very small subset of the R programming language. Basic programming skills are beneficial.


Gérard Le Lann
email: gerard.le_lann@inria.fr

Safe Automated Driving on Highways -Beyond Today's Connected Autonomous Vehicles

Safe automated driving rests on safety-critical (SC) inter-vehicular (IV) coordination. Safety criticality is defined unambiguously via the Bounded Move requirements. We show that today's autonomous vehicles and upcoming connected vehicles fail to meet these requirements by huge margins. We present a cyber-physical construct, IV communication protocols and IV agreement algorithms that achieve SC IV coordination in highway autonomic vehicular networks. Worst-case termination time bounds of protocols and algorithms are given, which allows for checking that the Bounded Move requirements are met. These solutions lay the ground for novel standards specifically aimed at safety. Interestingly, they also meet privacy requirements. Some open problems raised with automated driving are put into perspective.

Introduction

The purpose of this paper is to shed some light on where we stand and where we might be heading to regarding safe human-less driving. Whether such predictions as "autonomous vehicles will be on the roads by 2020" should be trusted depends on [START_REF] Shladover | Longitudinal control of automated guideway transit vehicles within platoons[END_REF] what is meant by "autonomous vehicle", and (2) which environments are considered (dedicated paths or ordinary traffic conditions). Not long ago, we were told that "autonomous vehicles had been driven thousands of miles without any accident". Such misleading statements are a thing of the past (existing autonomous vehicles have been involved in dozens of accidents, unreported collisions not taken into account). However, given that fierce competition is the rule in the fast growing market of autonomous vehicles, the "fairy tales" era is not over yet.

Early work was focused on platoons [START_REF] Shladover | Longitudinal control of automated guideway transit vehicles within platoons[END_REF]. The original concept (pre-planned linear formations with a lead truck piloted by a human driver) has evolved, now referred to as strings (spontaneous formations of autonomous vehicles). Safe intervehicular gaps with human driven vehicles are too large, and humans are responsible for about 90% of severe accidents (severe human injuries and fatalities). Seeking for improvements, the Intelligent Transportation Systems (ITS) community has stated two contradictory goals (overall goal denoted Ω):

-Significant reductions of safe inter-vehicular gaps in strings (a few meters, even at medium-high velocities) so as to minimize travel times and pollution (Ω 1 ), -Significant reductions in the number of severe accidents (Ω 2 ). A reduction ratio of 10 is commonly quoted.

Safety issues appear to be the least rigorously studied in the ITS field. That must be corrected, since solving the numerous safety problems that remain open is a prerequisite to the advent of safe automated driving. To this end, we examine safety-critical (SC) scenarios, where severe accidents occur if not handled correctly. Given that human life is at stake, SC scenarios to be examined are those where risks of severe accidents are highest, the case with high velocities. Therefore, we consider multilane highways (outside, around, and inside cities), where vehicles form networks of spontaneous short-lived or long-lived strings of various size. A vast majority of SC scenarios result from ordinary or/and intentional maneuvers (e.g., overtaking, lane changes, on-ramp zipper merging, accelerations, decelerations). Other SC scenarios result from unexpected or undesired events, such as brutal stopping (the "brick wall" paradigm) and irrational behaviors, leading to accidents and sudden lane blocking. Goal Ω must be achieved for all these SC scenarios, the latter contributing to the non-zero residual accident ratio (Ω 2 ).

The ITS community has adopted the SAE standard that identifies 6 levels of driving automation, from 0 to 5 [2]. Level 0 is assigned to human driven vehicles.

To the exception of level 5, referred to as full automation, denoted FullAU herein, human supervision is mandatory-laws and insurance companies mandate the presence of human drivers, legally responsible for taking over whenever needed. As of today, vehicles on the roads have SAE levels ranging from 0 to 3. Arguing against or in favor of FullAU driving is pointless unless there are good reasons to believe that safe FullAU driving is achievable, currently an open question. In the sequel, we demonstrate that safe FullAU driving on highways is feasible, achieving goal Ω, provided that self-organizing/autonomic vehicular strings are endowed with necessary SC inter-vehicular (IV) coordination schemes.

Focusing on highways is also particularly interesting from other standpoints. A significant fraction of vehicles that travel on highways daily are occupied by people going to and returning from work, wasting about 1 hour of human time per day per vehicle. Thanks to FullAU driving, this huge time budget can be spent in more rewarding activities (e.g., work, rest, education, e-shopping, infotainment).

In Section 2, we show that goal Ω cannot be achieved with connected autonomous vehicles as envisioned today, and we review the limitations of remedies currently under investigation. Vehicular networks [START_REF] Karagiannis | Vehicular networking: A survey and tutorial on requirements, architectures, challenges, standards and solutions[END_REF] are cyber-physical systems-of-systems [START_REF] Rajkumar | Cyber-physical systems: the next computing revolution[END_REF], and SC IV coordination can only rest on some appropriate cyber-physical construct. The relevance of the cyber dimension, vastly overlooked so far, is highlighted in Section 3, where safety criticality is rigorously characterized via the Bounded Move requirements. In Section 4, we examine longitudinal and lateral SC scenarios and we present the cohort construct as well as IV protocols and distributed agreement algorithms that meet the Bounded Move requirements, along with analytical results and illustrations. Perspectives and some open problems are discussed in Section 5.

Today's Connected Autonomous Vehicles

Most results that underlie currently deployed autonomous vehicles originate from control theory, kinematics, and robotics. Autonomy is about to be supplemented with "connectedness". Starting year 2020 in the USA, new vehicles shall be equipped with radio communication devices conformant to WAVE standards [START_REF]Wireless LAN medium access control (MAC) and physical layer (PHY) specifications amendment 6: wireless access in vehicular environments[END_REF]. These connected autonomous vehicles, referred to as AU vehicles, are/will be equipped with on-board (OB) systems based on the following technologies: -LOS (line-of-sight) sensing technologies (e.g., radars, lidars, and cameras), that ensure robotics-centric capabilities (e.g., proximity detection, motion and trajectory control, lane keeping), -Geo-positioning technologies, based on GNSS "sensing" (e.g., GPS, Glonass, Galileo) and e-maps, providing vehicle space-time coordinates, -Non-LOS radio communication technologies conformant to IEEE 802.11p or ETSI ITS-G5 standards, providing omnidirectional medium-range (≈ 300 m) communication capabilities [START_REF]Wireless LAN medium access control (MAC) and physical layer (PHY) specifications amendment 6: wireless access in vehicular environments[END_REF]. Radio communications are sometimes viewed as just another type of sensing technology-a vehicle "senses" its non-LOS environment thanks to data read from messages received. This (mistaken) vision is unnecessarily restrictive-see Section 3.

Limitations of the aforementioned technologies are widely acknowledged, often referred to as "shyness": AU vehicles are not "aggressive" enough. In ordinary traffic conditions (no reserved lanes as for busses, taxis, or carpooling), SC maneuvers are based on "daring" and "guessing" whether other vehicles appear to "understand" and are willing to give way. Besides large IV gaps (Ω 1 is not achieved), this translates into overly cautious lane change maneuvers that are unduly aborted or postponed, clearly not the best strategies for achieving Ω 2 . Human or human-like cognitive capabilities appear to be necessary.

• Authority sharing

With AU vehicles, it is mandated that a human keeps his/her hands on the wheel, ready to intervene whenever necessary. In a SC scenario, acceptable reaction latencies are in the order of 1 to 2 seconds. (See Subsection 4.2, where we show that 100 FullAU vehicles forming a string can make SC decisions in less than 208 ms, in less than 1 second when every message must be repeated once, a performance beyond the reach of humans.) Studies devoted to human-machine interaction demonstrate that it takes between 5 and 8 seconds for a distracted driver to take over control, i.e. to understand "what is going on" and to make a correct decision [START_REF] Gold | Take over!" How long does it take to get the driver back into the loop? 57[END_REF], [START_REF] Mok | automation off: unstructured transition timing for distracted drivers of automated vehicles[END_REF]. Humans are too slow, especially in adverse driving conditions (tiredness, heavy rain, fog, darkness).

Note also that trusting humans as a last resort to compensate for incomplete automation is contradictory with the original rationale for automated driving. If about 90% of severe accidents are caused by humans when they are supposed to be continuously at the wheel, how could we trust humans (for achieving Ω 2 ) when they are told that they do not have to pay continuous attention to driving? How do we know at design time (e.g., in a R&D laboratory) whether a human should be trusted more than some automaton, or the opposite, for every possible future SC scenario under every possible future conditions? Authority sharing problems have been under extensive examination in the defense domain and in air transportation. With AU vehicles, we eventually have to face the same problems that have surfaced with automated flying: "automation addiction" has eroded pilots flying skills to the point that, too often, pilots do not recall how to recover from a loss of control by the flight management system.

• Artificial intelligence AI (machine/deep learning) should help, undoubtedly the case in urban settings, where there is a need for detecting bicyclists, pedestrians, dogs (in some cities), for scene recognition in general. However, vehicular AI faces limitations as regards responsiveness (large response times due to image processing, data retrieving and semantic understanding). In cities, where velocities are reasonably small-enforced in the future, the latter difficulty may not be an impediment. Conversely, as for the handling of SC scenarios on highways, today's sensingand-AI engines are too slow-see Subsection 3.2. Fortunately, highways are settings where goal Ω can be achieved with deterministic time-bounded solutions (see Section 4) that rest on assuming lane recognition and lane numbering (cameras and e-maps suffice). Reliance on accurate GNSS-assisted geopositioning is needed with other solutions and in bad weather conditions (e.g., invisible lane marking due to snow). No matter how smart, decisions made by a vehicular AI engine are also based on sensing, and thus suffer from the same limitations proper to sensing/robotics capabilities (see Subsection 3.1). Also, it remains to be seen how one may prove safety when AI is resorted to.

• The need for new WAVE standards

The inadequacy of today's WAVE standards and LTE, 4G and 5G technologies regarding safe AU driving has been pointed at by numerous experts. A brief analysis is given in the Appendix. The conclusion is:

For achieving goal Ω, vehicular networks must be provided with specific radio channels and IV communication protocols distinct from those defined in current WAVE standards or used in public telecommunication networks.

We have been here before. After years of experimentation, it became clear that the Arpanet NCP protocol, inappropriate for the Internet, had to be replaced by some novel protocol, now known as TCP/IP. Similarly, years after their initial inception, it is clear that today's WAVE standards are inappropriate for achieving SC IV communications. Moreover, they do not take advantage of more recent and affordable technologies (short-range high speed radio, optical communications). Lastly, due to mandated periodic beaconing of messages that carry IP or MAC addresses, they are potential threats to privacy (e.g., anonymity breaches, remote intrusions, spoofing, and vehicle tracking are feasible). Solutions based on certified pseudonyms delivered by a cloud-based trustable Authority are far from being satisfactory [START_REF] Wiedersheim | Privacy in inter-vehicular networks: why simple pseudonym change is not enough[END_REF]. There is a need for novel standards (WAVE 2.0). Examples of solutions for WAVE 2.0 are given in the sequel. Today's WAVE 1.0 standards should be kept for non-SC IV communications.

Since goal Ω cannot be achieved with today's AU vehicles "augmented" with human intelligence or/and AI, one may be tempted to conclude that safe FullAU driving is unfeasible, a fortiori, at least within the foreseeable future. Why such is not the case is explained below.

Beyond Today's Connected Autonomous Vehicles

AU driving is based on vehicle-centric sensing only. IV coordination in autonomic vehicular networks is needed for achieving goal Ω. The relevance of the "network" dimension (rather than focusing on "the ego vehicle") should not come as a surprise in the Internet age. To paraphrase the famous dictum "The network is the computer" (J. B. Gage, Sun Microsystems), which was popular in the 80's when the focus was still on "the computer", one may write "The (autonomic vehicular) network is the (automated) vehicle". IV coordination encompasses IV communication protocols and IV explicit agreement algorithms needed to prove that, e.g., asphalt resources are shared in mutual exclusion by nearby vehicles and within strict time bounds (otherwise, collisions occur), that concurrent and conflicting maneuvers such as lane changes are handled fairly and in bounded time, and so on. Scientists and experts in distributed dependable computing systems and networks feel on firm ground here, since resource sharing and consensus/agreement in the presence of concurrency and failures are fundamental problems which have been studied for almost half-a-century [START_REF] Lynch | Distributed algorithms[END_REF]. And ditto for real-time computing [START_REF] Moser | Reconciling fault-tolerant distributed algorithms and realtime computing[END_REF]. Solutions devised for cyber systems achieve wellknown logical "safety" and liveness properties [START_REF] Lamport | Proving the correctness of multiprocess programs[END_REF]. In autonomic vehicular networks, the counterparts of these properties are reactive safety and proactive safety, respectively-see below. Since reactive safety is taken care of by sensing/robotics, we are invited to devise the cyber-physical counterparts of the aforementioned cyber solutions that would achieve proactive safety.

Reactive safety vs. proactive safety

Sensing/robotics solutions serve to achieve collision avoidance (as much as possible) in hazardous situations created by nearby vehicles. Unfortunately, hazards can only be sensed after they are (being) instantiated, likely too late in SC scenarios. Furthermore, avoidance strategies are inherently speculative, since they are based on guessing (silently) other vehicles' behaviors. That is reactive safety. When "caught" in a SC scenario, an AU vehicle tries to protect itself. On the contrary, IV coordination achieves hazard prevention (as much as possible) by influencing behaviors of other vehicles a priori, and by striking explicit IV agreements. Prior to being undertaken, a risk-prone maneuver is declared, allowing nearby vehicles to return positive or negative feedback via IV messaging.

That is proactive safety. Unless worst-case assumptions that underlie IV coordination solutions would be violated, there is no need for collision avoidance.

Sensing/robotics capabilities are necessary for fine-tuning agreed upon maneuvers, keeping in check vehicles behaviors/trajectories (e.g., making sure that sufficient spacing is kept between the 3 vehicles performing an agreed lateral insertion in a string).

Lane changes/merging, un-signaled intersection or roundabout crossings, are examples of SC scenarios where explicit IV agreements are necessary. Accident warning is another example. Common belief is that it suffices to have emergency messages broadcast by damaged vehicles, quoting their geo-positions, so as to warn approaching vehicles. Surprisingly, none of the numerous publications that examine this usage of broadcasting addresses the essential question of what should be the behaviors of vehicles that receive such emergency messages. Brutal braking or random lane changes can only result in more accidents. SC IV coordination and proactive safety are more than needed in such scenarios.

IV communications and IV coordination take time. An essential question is "how much". More precisely, how to tell whether a solution to a SC IV communications/coordination problem is appropriate with regards to goal Ω?

The Bounded Move (BM) requirements

In the current ITS literature, "safety" is referred to without being precisely quantified. (Safety issues related to interactions among vehicles bear limited resemblance with functional safety examined in vehicle-centric frameworks, such as ISO 26262 [START_REF]Road vehicles -Functional safety -Part 10[END_REF].) Safety-related problems would receive simple solutions if one could assume that vehicles do not move while messages are being disseminated, acknowledged, and agreements are struck. Since this is unrealistic, the best we can aim at is to bound and quantify distances travelled by vehicles involved in SC scenarios. If such distances are small enough, then goal Ω is achievable.

It is customary to use latencies to characterize "safe" response times. For example, WAVE 1.0 standards state that emergency messages shall be delivered in at most 100 ms. That is meaningless. We are not told whether this bound should hold in the presence or in the absence of message losses. Moreover, distances travelled in 100 ms do matter, and they depend on velocities. Binding together space and time variables is mandatory. Safety proofs must be given for worst-case conditions. Time bounds that appear in the following BM requirements are stated for worst cases regarding radio channel contention, vehicular density, and IV message/ack losses. Let λ stand for the worst-case upper bound of channel access delays, Δ d for the worst-case upper bound of string-wide acknowledged message dissemination delays, and Δ a for the worst-case upper bound of string-wide or inter-string agreement delays. Consider vehicles involved in a SC scenario and let σ stand for the smallest "car asphalt slot" (σ = smallest car size + smallest IV gap). Typically, σ is in the order of 7 m (5+2). BM requirements are as follows:

-BM 0 : a MAC protocol is acceptable only if the distance travelled in λ time units by any vehicle is significantly smaller than σ.

-BM 1 : an algorithm for string-wide acknowledged message dissemination is acceptable only if the distance travelled in Δ d time units by any vehicle is smaller than σ.

-BM 2 : a string-wide or inter-string agreement algorithm is acceptable only if the distance travelled in Δ a time units by any vehicle is smaller than 2σ.

The rationale is simple: if vehicles switch from their current "slots" to at most 1 (BM 1 ) or 2 (BM 2 ) "slots" ahead while, respectively, building common knowledge or reaching agreement, then goal Ω can be achieved. (Other sufficiently constraining bounds may be considered.)

Other BM requirements may be defined for open roads or urban settings, which have specific driving regulations (e.g., highest velocities, how to cross intersections and roundabouts with no traffic lights). Physical zones (recorded on e-maps) and digitized signs/panels provide vehicles with on-line knowledge of zone limits (city limits, highway ends here, etc.). Appropriate SC IV coordination schemes would be activated according to which type of zone is entered.

SC IV Coordination in Autonomic Vehicular Networks

In the ITS literature, terms such as strings or platoons have received no precise definitions. As a result, it is impossible to demonstrate that the BM requirements are met. These shortcomings can be corrected. Constructs with specifications are necessary for reasoning about (and proving) properties under worst-case conditions, notably worst-case timeliness properties. A cyber-physical construct that is essential to meeting the BM requirements is presented in the sequel. SC scenarios that arise on highways are enumerable. They can thus be examined fully. Safety-preserving on-line decisions derive from driving rules (learned by humans). They happen to be deterministic. They can be translated in protocols and algorithms, and implemented in OB systems.

Cohorts: A basic construct for autonomic vehicular networks

Cohorts-strings with a specification [START_REF] Le Lann | Cohorts and groups for safe and efficient autonomous driving on highways[END_REF], [START_REF] Le Lann | Safety in vehicular networks-On the inevitability of short-range directional communications[END_REF], appear to be an early example of cyber-physical constructs needed to prove the existence of such time bounds as λ, Δ d , and Δ a . The cohort concept was originally devised for minimizing the number of vehicles involved in rear-end collisions in "brick wall" conditions. Essential features of cohorts are as follows: • Ranking. Members communicate via 1-hop neighbor-to-neighbor (N2N) messages and beacons, which are acknowledged. They assign themselves consecutive integers, called ranks. An isolated vehicle assigns itself rank 1. In case a vehicle X catches up with a cohort Γ, tail N of rank n, X and N execute a cyberphysical remote procedure call based on N2N messaging. If successful, X assigns itself rank n+1 and becomes Γ's new tail. If denied, X stays away (smallest intercohort gap) or overtakes Γ. Member ranking is used in SWIFT, a MAC protocol aimed at achieving time-bounded N2N communications in cohorts (see further).

• Fault-tolerance and cohort splits. Neighbors exchange beacons periodically, enabling time-bounded detection of a N2N link failure, due to stop or timing failures of an OB system, or caused by too many message/ack losses. In case of a P-to-Q link failure, a cohort split is triggered: Q decelerates until a safe gap is created with P. Thus, in cohorts, N2N communication network partitioning can be ignored. An inter-cohort gap is safe when the head of a cohort that follows another cohort can stop without hitting the tail of the cohort ahead (gap S ct/ch in Fig. 1).

• Worst-case faulty N2N link conditions. Let f stand for the number of temporarily faulty N2N links in the course of a message dissemination involving n members, and not leading to a cohort split. Trivially, we have 0 ≤ f ≤ (n-1) z, where z stands for the highest number of consecutive tolerated faults impacting a N2N link. • Highest velocity.size product. For minimizing the number of rear-end collisions under "brick wall" conditions, a cohort that moves at velocity v shall not comprise more than n*(v) members [START_REF] Le Lann | Safety in vehicular networks-On the inevitability of short-range directional communications[END_REF]. Very fast moving vehicles are isolated most often. Conversely, a cohort that moves slowly includes many members, for the reason that slow motion is necessarily due to highly dense traffic conditions (otherwise, members would simply leave a slow cohort in order to move faster), typically the Fig. 1. The cohort construct case at rush hours or on single lane sections. Based on this observation, the original concept has been refined as follows: n*(v) must be an inverse function of v (or vice-versa), i.e. the fastest the smallest (or the opposite), which we write v.n*(v) ≤ b [START_REF] Le Lann | A collision-free MAC protocol for fast message dissemination in vehicular strings[END_REF], [START_REF] Le Lann | Fast distributed agreements and safety-critical scenarios in VANETs[END_REF].

A correct valuation of bound b shall not be arbitrary. Assume that a cohort moving at 250 km/h (highest velocity in WAVE 1.0 standards) shall not include more than 4 members. Thus, with velocities in km/h, we would have b = 1,000.

• Naming and privacy. Names appearing in N2N messages are member ranks (rather than IP/MAC addresses in WAVE 1.0 standards). Thanks to consecutive ranking and SWIFT, ranks are authenticated. As a result, masquerading attacks are immediately detected. Neither geo-positioning data nor V2V beaconing is resorted to in the solutions presented below. Therefore, vehicle tracking and anonymity breaches are unfeasible.

Communication protocols for SC IV coordination

In order to make coordinated behavioral decisions, cohort members shall share some common knowledge, which implies cohort-wide dissemination of SC messages, such as "new n is 11", "new velocity is 70 km/h", "lane blocking ahead", "smallest accepted SAE level is 3" (see further).

• SWIFT: A deterministic MAC protocol for safety and privacy in cohorts In cohorts, one can take advantage of directional antennas. Every vehicle is equipped with a backward looking and a forward looking antenna, small beamwidth (e.g., 25°), short-range (e.g., up to 30 m). A N2N SC message received from a neighbor is acknowledged and forwarded to the opposite neighbor. Acks are piggybacked on messages. With SWIFT [START_REF] Le Lann | A collision-free MAC protocol for fast message dissemination in vehicular strings[END_REF], λ = 2hθ, where h stands for the highest number of contiguous members that may experience interferences due to a transmitter, and θ stands for the largest N2N message transmission duration. Conservative figures are θ = 1 ms, h = 4 if malicious or irrational attacks (e.g., suicides) are deemed highly unlikely. Thus, λ = 8 ms, and BM 0 is met: less than 0.56 m are travelled for v < 250 km/h. • Worst-case cohort-wide acknowledged message dissemination delays With SWIFT, channel accesses match descending and ascending member ranking, alternatively, thus enabling fast symmetrical message dissemination. (This is unfeasible or achieved very inefficiently with conventional CSMA/CA or TDMA protocols.) Assuming no malicious attacks and no concurrency (a single N2N message is disseminated), we have shown in [START_REF] Le Lann | A collision-free MAC protocol for fast message dissemination in vehicular strings[END_REF] Highest bounds Δ d hold for very pessimistic loss conditions. Tolerated loss frequencies are equal to z(n-1)/Δ d , i.e. ≈ 100 Hz (99 losses per second) in the above example. Note in passing that periodic beaconing is totally impracticable under such loss frequencies.

• Acknowledged message broadcast/multicast within and across cohorts SWIFT achieves longitudinal acknowledged message broadcast (or multicast) over a cohort or any cohort subset. Compounded with lateral inter-cohort communications (see below), this instantiates 360° time-bounded acknowledged broadcast/multicast modes, not available with WAVE 1.0 standards.

• Autonomic management of heterogeneous vehicular networks Thanks to N2N messaging, distinct cohorts of human-driven vehicles and cohorts of AU or FullAU vehicles can form spontaneously, without having to "freeze" specific lanes for either category. Admission in a cohort (in a given lane) may be conditioned on various parameters, SAE level being one of them (see Ranking, Subsection 4.1). This is essential regarding safety and efficiency, since cyberphysical capabilities depend directly on such levels. Let us give an illustration with Δ d and safe IV gaps s xy (v). Let p stand for s max (v)/s min (v). Reaction delays and p are highest with lowest SAE levels, and p determines parameter h. For the version of SWIFT which copes with malicious or irrational attacks, it can be shown that having p = 4 (e.g., SAE level 1) leads to h = 8, while having p = 1.5 (e.g., SAE level 5) leads to h = 5. Bounds Δ d are smaller with small values of h whenever f ≠ 0. It is desirable to enable the spontaneous formation of cohorts comprising only AU vehicles of some high SAE level. Indeed, thanks to faster message dissemination/agreements, they would be able to handle SC scenarios more rapidly or/and at higher velocities, while enjoying stipulated safety properties.

Distributed agreement algorithms for SC IV coordination

Cohort members must also cope with concurrent SC events, such as conflicting lateral lane changes, lane change attempts when a fast-moving vehicle is approaching, or simultaneous steep braking and insertion attempts with a cohort. Agreement algorithms Eligo and LHandshake [START_REF] Le Lann | Fast distributed agreements and safety-critical scenarios in VANETs[END_REF] build on SWIFT. • Worst-case cohort-wide agreement delays. Let p stand for the number of participants (members that want to disseminate a message or that propose a value-an input to agreement). With Eligo, extending the results presented in [START_REF] Le Lann | Fast distributed agreements and safety-critical scenarios in VANETs[END_REF] and assuming no malicious attacks, we have the following worst-case termination time bound (highest latency after which every member knows that all members know and decide):

Δ swa (n,f,p) = 2hθ {1+p+2[f + (n-1)/h]}. Assume p = n/10). We have: -v = 180: Δ swa (5,0,1) = 32 ms, Δ swa (5,4,1) = 96 ms; 1.6 ≤ δ ≤ 4.8; -v = 10: Δ swa (100,0,10) = 488 ms, Δ swa (100,99,10) = 2.072 s; 1.36 ≤ δ ≤ 5.76. BM 2 is met in both cases.

• Worst-case lateral inter-cohort agreement delays. With LHandshake, we have Δ isa (g,f,p) ≤ 2 σ max + Δ swa (g,f,p), where g stands for the number of consecutive members that must reach agreement, e.g., that receive an insertion request from an adjacent vehicle (g < 5 in realistic cases). Variable σ max stands for the worst-case delay for transmitting a message, MAC access delay included. With WAVE 1.0 standards, σ max takes unbounded values, thus the need for lateral MAC protocols that would meet BM 0 . With appropriate solutions (to appear in forthcoming publications), LHandshake meets BM 2 .

Perspectives

We have shown that it is possible to achieve goal Ω with AU and FullAU vehicles on highways, thus providing some backing to disruptive approaches. The fact that SC IV coordination is feasible while vehicles move by negligible distances opens up new perspectives regarding safe automated driving on highways, notably the prefixing of risk-prone maneuvers in the physical space by explicit IV agreements in cyber space. Cyber-inspired solutions have a significant impact of how to validate OB systems. So far, testing on the roads and intensive simulations are the only solutions considered. Unfortunately, testing on the roads is plagued with serious weaknesses. Key findings in [START_REF] Kalra | Driving to safety[END_REF] are: "Autonomous vehicles would have to be driven … sometimes hundreds of billions of miles to demonstrate their reliability in terms of fatalities and injuries… existing fleets would take … sometimes hundreds of years to drive these miles…". What about regression? Since technology keeps evolving (e.g., new OB software releases, new hardware, new sensing devices), suites of tests previously performed must be replayed. Likely, testing on the roads is not a convergent process. Cyber-inspired solutions come with proofs, which serve to demonstrate properties for a (usually) very large set of reachable states. Since testing such states is useless, the complexity and the duration of validation phases are significantly reduced. And what about liability issues? As OB hardware and/or software may be frequently modified, which kind of guarantees and liabilities apply to not-so-recent vehicles with OB systems running versions/releases superseded by newer ones [START_REF] Smith | Automated driving policy[END_REF]?

Research is being pursued by us and others working on the cross-fertilization of robotics and cyber-inspired algorithms. We have designed new versions of SWIFT and IV protocols for cohort join maneuvers and message dissemination that cope with malicious attacks (e.g., impersonation, message falsification/destruction). Other recent results related to optical communications would also contribute to the advent of WAVE 2.0 standards. We are applying the cohort construct to urban and open road settings, such as un-signaled intersections and roundabouts, considering assumptions more realistic than those found in the current literature. For example, we assume that entrance and exit roads have different numbers of lanes, that vehicles have to coordinate extremely quickly since they may have to follow intersecting trajectories while entering or/and crossing an intersection or a roundabout, and they may have to perform lane merging for entering an exit road.

  that: Δ d (n,f) = 2hθ {1+f+(n-1)/h}, n ≤ n*(v). Consider two extreme cases (b = 1,000): v = 180, n* = 5 and v = 10, n* = 100. Let us have z = 1 (every N2N message must be sent twice). One finds that BM 1 is met (δ standing for distance travelled in meters): -v = 180: Δ d (5,0) = 16 ms, Δ d (5,4) = 48 ms, and 0.8 ≤ δ ≤ 2.4; -v = 10: Δ d (100,0) = 208 ms, Δ d (100,99) = 1 s, and 0.58 ≤ δ ≤ 2.78.

Appendix -Today's WAVE standards considered inadequate

Today's WAVE standards for IV communications, such as IEEE 802.11p and ETSI ITS-G5 are based on WiFi technology. They serve to provide so-called "connected vehicles" with access to Internet and cloud services (infotainment, weather data, traffic conditions, etc.), in addition to enabling best-effort IV communications. Vehicles can thus be seen as "smartphones on wheels".

Essential choices are reliance on CSMA/CA as the MAC-level protocol and omnidirectional communications, radio range in the order of 300 m, and interference range in the order of 500 m. There cannot be such bounds as λ with WAVE 1.0 standards. Stochastic channel access delays are exceedingly high in moderate or worst-case contention conditions. This is shown in [START_REF] Yao | Delay analysis and study of IEEE 802.11p based DSRC safety communication in a highway environment[END_REF] where average values of MAC delays achieved by the IEEE 802.11p protocol range between 75.3 ms and 211.8 ms, for various channel loads, assuming 1 vehicle every 12 m. At 108 km/h, vehicles travel 6.35 m at least (the 211.8 ms figure is not a strict bound), which is much higher than stated in BM 0 .

Mobile radio communications are unreliable [START_REF] Karlsson | Field measurements of IEEE 802.11p communication in NLOS environments for a platooning application[END_REF]. Lack of acknowledgements (acks) in multicast or broadcast modes under WAVE 1.0 standards is another major weakness. Use of acks leads to the broadcast storm problem [START_REF] Tonguz | On the broadcast storm problem in ad hoc wireless networks[END_REF], no timebounded solution published so far. Since SC message dissemination and IV agreements must be achieved in bounded time despite losses of messages or acks, there cannot be such bounds as Δ d and Δ a . None of the BM requirements is met by WAVE 1.0 standards. Ditto for solutions built out of these standards, such as CACC (Cooperative Adaptive Cruise Control), where message broadcast is most often implicitly assumed to be free from contention and fully reliable, in contradiction with numerous impossibility proofs. For example, when less than 2/3 of vehicles targeted by a broadcast do not receive a broadcast message, no agreement/coordination is feasible. Results established ignoring such issues are of little significance for real-world conditions.

A similar conclusion applies to periodic beaconing (broadcasting of CAM messages), frequencies in the 1 to 10 Hz range. Since message losses do occur, "situational maps" are inaccurate, and they may differ significantly for any 2 nearby vehicles, rendering them useless for building a common global view, believed to be necessary for safety (mistakenly). Moreover, in addition to overloading communication channels and OB processors, beaconing amounts to breaching privacy voluntarily, since vehicles reveal their IP/MAC addresses and time dependent geolocations to unknown recipients within ranges in the order of 300 m, making tracking, spying and hacking much easier. Finally, reliance on vehicle-to-infrastructure (V2I) communications via terrestrial nodes, such as roadside units or 3G/LTE/4G/5G relays, can only lead to poorer results in terms of delays. Also, terrestrial nodes may fail and/or be "attacked", and they can be used for launching all sorts of attacks, man-in-the-middle attacks in particular. V2I communications favor security and privacy threats, hence safety threats.