Theresa Cameron

Boris May

Denis Johnson

Pauline Jamet

Rodet

How is Brexit Linguistically-Constructed? A Corpus Linguistic Analysis of Speeches by David

Keywords: Brexit, Cameron, May, Johnson, corpus linguistics, cognitive linguistics, discourse analysis Résumé Brexit, Cameron, May, Johnson, linguistique de corpus, linguistique cognitive, analyse du discours

Brexit as such existed linguistically before existing politically, as it has been the subject of various controversies and heated debates. From David Cameron, through Theresa May, to Boris Johnson, the conceptualization of Brexit certainly evolved. Thanks to corpus linguistics software tools together with cognitive linguistics and discourse analysis, this article seeks to study the perception of Brexit by Tories through an analysis of 45 speeches delivered by Tory Prime Ministers David Cameron, Theresa May and Boris Johnson. Following a quantitative approach, lexical frequencies as well as positive and negative keywords used by each Prime Minister are analysed and compared thanks to the use of linguistic tools, such as AntConc® and #LancsBox®. The paper concludes on a more qualitative approach by highlighting the semantic / notional domains the three Prime Ministers most frequently resort to, so as to show that Brexit is not constructed identically, at least linguistically-speaking, by the three Conservative Prime Ministers.

Introduction

Brexit as a political entity and reality just started existing after the UK formally left the EU on 31 January 2020. It is still an ever-evolving object of study yet to be defined. A commentator on The Guardian's website referred to it as "the undefined being negotiated by the unprepared in order to get the unspecified for the uninformed."1 Yet, one of the possible ways to better grasp and study this ill-defined, fuzzy entity is to resort to the language used by speakers to talk about it. As claimed by cognitive linguists2 , language reflects our conceptual system and the way we perceive the world. Language is the principal way of apprehending and making sense of reality, and studying the language we use, almost unconsciously, sheds light upon the way abstract concepts are constructed. This article will mostly deal with the Conservative and Brexit rhetoric by adopting a cognitive linguistic, discourse-based approach, following Brown & Mondon's "mixed-methods approach"3 :

A growing body of literature has highlighted the benefits of combining CDS [Critical Discourse Studies] with CL [Corpus Linguistics] […]

noting the capacity of each approach to mitigate some of the limitations associated with the other, and there have been some excellent examples of such analysis […]. Some works combining DT [Discourse Theory] and CL [Corpus Linguistics] have also recently started to emerge (Nikisianis et al., 2019: 280), indicating great potential for a mutually beneficial fusion. 4 Our linguistic analysis will focus on the perception of Brexit by Tory politicians through an analysis of 45 speeches delivered by Tory Prime Ministers David Cameron, Theresa May and Boris Johnson. We will perform linguistic studies, and more specifically lexicometric analyses, i.e. analyses regarding the lexical frequencies of some keywords (KWIC), as well as textometric analyses, i.e. analyses on the lexical specificities of a text, the characteristic lexicon of a text, the contextual attractiveness of words in a text, etc. 5 We will first focus on the lexical differences between the three Conservative Prime Ministers: the lexical frequencies will be analysed thanks to the use of linguistic tools, such as AntConc® and #LancsBox®, in a quantitative approach: positive and negative keywords used by each Prime Minister will be studied and compared, as well as the shared collocates for leywords such as UK and EU. Then, we will carry out a more qualitative approach by highlighting the semantic domains -a.k.a. notional domains -the three Prime Ministers most frequently resort to, with the help of USAS (UCREL Semantic Analysis System), via linguistic investigations with WMatrix4®: do the semantic domains differ from one Prime Minister to another, or are they more or less similar throughout the years? Is Brexit constructed identically or differently from a purely linguistic perspective?

Brief historical background, corpus and methodology

Brief historical background

Brexit holds a central place in the British political agenda. It has paralysed the political debates ever since the outcome of the 2016 referendum was made public. The question of whether the UK should remain a member of the European Union has been a controversial subject since the UK joined the European Economic Community on 1 January 1973, after two unsuccessful attempts. This is especially true for the members of the Conservative Party, who have been divided over this issue for several decades, and the Brexit referendum acted as a catalyst 6 . This controversy hovering over the UK's political stage turned into a deep political crisis on 23 January 2013, when David Cameron announced that he would hold an in-out referendum provided that the Conservative Party won the 2015 General Elections. This milestone statement at Bloomberg Institute, followed by Cameron's reappointment as Prime Minister in 2015, triggered the beginning of a picaresque-like political narrative. According to Shenhay, narratives are used by politicians so that they can shape and describe certain events from their own perspective7 . Eventually, the narrative shaped by the Leave campaign depicts Brexit as a utopian quest to exit from the EU 8 .

As announced in the 2015 Conservative Party manifesto, a referendum on the UK's EU membership was held in June 2016. Against all odds, the Brexiteers, campaigning in favour of Britain leaving the EU, eventually managed to convince a short majority of the voters. Following the outcome of the referendum, which did not correspond to what he had expected, Cameron announced his resignation on the day after, and Theresa May succeeded him as the captain of the boat in charge of leading the UK towards a "smooth and orderly" 9 departure from the EU. After a tumultuous, and yet unsuccessful battle to have the Parliament vote in favour of her deal, Theresa May announced her resignation in 2019. She fell overboard and was replaced by current Prime Minister, Boris Johnson.

All in all, this brief historical recall aims to show that Cameron, May and Johnson played major roles in this political "fiasco" 10 . As suggested by Baines et al., Brexit was a fiasco, in the sense that it involves failures in political performances and deceits 11 (such as Cameron's failure to rally his party, Theresa May's failure to pass a Brexit deal, Johnson's Leave campaign relying on deceits and untruthfulness). Yet, given its Italian origin from theatre slang, a "fiasco" is intrinsically linked to language. The diversity of opinions regarding the very meaning of the referendum but also the type of Brexit envisaged contributed to blurring the politicians' messages make a linguistic analysis of the speeches all the more relevant. This is the reason why, as linguists, we decided to build and analyze a corpus composed of their discourses to study Brexit, and how Brexit is represented from a linguistic point of view.

Corpus

Our corpus of interest gathers speeches from David Cameron, Theresa May and Boris Johnson. They are all members of the Conservative Party, and they succeeded each other at the head of the party during the Brexit "crisis", i.e., an unstable time and turning point in which decisive changes are impending12 . Brexit is considered as a political crisis, since it represents a turning point in the "life" of the European Union. Brexit will inevitably induce drastic changes in the organisation of the EU, and things are deemed to change, for better or for worse -History will tell us. Although they share the same political affiliation, they do not necessarily endorse the same outlook on the UK's relationship with the EU. As noted by Florence Faucher13 , the issue surrounding the EU membership has profoundly divided the UK, and these divisions are even more profound amongst the members of the Conservative Party. During the referendum campaign, the Party was polarised over the issue, with 40% of the MPs campaigning in favour of Brexit14 . As shown by Agnès Alexandre-Collier, the presence of Eurosceptics on the bench of the Conservative party has been threatening the cohesion of the party ever since the ratification of the Maastricht Treaty in 199315 .

Brexit uncovered cleavages and divisions of all kinds, amongst which ideological divisions within the Conservative Party. This fracture is best embedded by the fact that the two leaders of the antagonistic official referendum campaigns were both members of the Conservative Party: David Cameron, Prime Minister and front-runner of "Britain Stronger in the EU", whereas Boris Johnson, popular figure of the party and Mayor of London at the time, led the "Vote Leave" campaign 16 . Another example which strikingly shows the divisions of the Party is Michael Gove's disavowal for Theresa May. In an article for The Telegraph, he shared his opinion on a Brexit deal, which did not align with May's, although he had been appointed as Secretary of State under her premiership.17

This leads us to wonder about the emergence of such divisions in the reception of the discourses of the three Prime Ministers under scrutiny for this analysis. We resorted to various corpus linguistics tools to try and answer this research question.

Corpus linguistics is a branch of linguistics that has gained popularity amongst linguists recently. It can be defined as follows: "Corpus linguistics is perhaps best described for the moment in simple terms as the study of language based on examples of 'real life' language use". 18 Corpus linguistics enables researchers to study language based on authentic excerpts of language use. The aim of a corpus-based analysis is thus to collect a set of data representative of a specific type of language in order to study a particular linguistic phenomenon:

We could define corpus linguistics as dealing with some set of machinereadable texts which is deemed an appropriate basis on which to study a specific set of research questions. 19 The set of "machine-readable texts" collected for this study is constituted of transcripts of official statements on the theme of Brexit. These transcripts were collected from the database provided by the UK's government website www.gov.uk. The period under scrutiny spans from 2015 to 2019, a period during which the Brexit "fiasco" was at its pinnacle. To collect the data, we used a combination of keywords to browse through the aforementioned database: Theresa May; Boris Johnson; David Cameron/Brexit/prior to 2019. These transcripts constitute our set of data to investigate how Brexit is represented in the speeches of Cameron, May and Johnson. By analysing how they picture Brexit through the language each of them uses, we aim to uncover how this representation may differ, how potential differences may be concomitant to their different points of view. The benefits of corpus linguistics for the study of political discourse is highlighted by Brown & Mondon:

Critically, with its capacity for automated analysis of large corpora, CL [Corpus Linguistics] is able to offer greater breadth than is possible with in-depth, qualitative discourse studies. […] CL offers essential tools enabling us to track its usage and emerging patterns across the entire corpus. 20 92 transcripts were gathered and arranged into three sub-corpora: one for each Prime Minister. The whole corpus is distributed as follows: 34 transcripts for Theresa May (67,474 tokens21 ), 31 transcripts for David Cameron (64,606 tokens), and 24 for Boris Johnson (50,169 tokens). This constitutes a rather balanced set of data, enabling us to draw comparisons between the three corpora.

Methodology

To carry out these analyses and comparisons, we resorted to some corpus linguistics software tools in order to study the semantic patterns that contribute to the way Brexit is framed in the speeches that constitute our corpus of interest. We performed a lexical analysis combined with a semantic analysis in order to get an overview of how language was used. Then, we tried to draw some parallels between these two analyses. The lexical analysis involved the elaboration of frequency lists so as to identify the most frequent lexical items for each Prime Minister. The next step consisted in focusing on certain lexical items particularly relevant as regards the theme of our corpus: EU and UK/Britain-related terms, and then, more specifically: Brexit, EU and UK.

We used WMatrix4® to analyze the key semantic domains related to the perception and framing of Brexit in each set of data. WMatrix4® is a software tool developed by a group of researchers at Lancaster University. It features a semantic tagger, labelled USAS (UCREL Semantic Analysis System), which groups together words belonging to the same semantic field into pre-existing semantic categories as shown in the chart in Figure1:

Lexical frequencies: positive, negative and lock words

The first analysis we decided to carry out was to create a frequency list for each corpus so as to compare the frequencies for each token in the three corpora. We used AntConc® and downloaded the three corpora individually; we added a lemma list, so that only the lemmas, i.e. the uninflected bases of the words, would be listed in the results. As our study aimed to focus mostly on lexical frequencies so as to highlight the saliency of lexical items used in the speeches, we deemed grammatical functional words not relevant to our study, and we added a stoplist to exclude them. Yet, we decided to retain some grammatical functional items such as pronouns, as they play a role in rhetorical techniques, as well as modal auxiliaries, as they reflect the speaker's position regarding their utterances. We first analyzed the absolute frequencies in the three corpora. According to SketchEngine®, Frequency (also absolute frequency) refers to the number of occurrences or hits. If a word, phrase, tag etc. has a frequency of 10, it means it was found 10 times or it exists 10 times. It is an absolute figure. It is not calculated using a specific formula. 23 We kept the first twenty-five most frequent words for each corpus, as exemplified in Figures 2, 3 and4 Interestingly, the most frequent word in the three corpora is the modal auxiliary will, as well as its preterit form would, denoting future time, hence some uncertainty (epistemic modality), but also willingness from the speaker to do something (root modality). Occurrences (1) to (3) exemplify the recurrence of will in the three corpora:

(1) CAMERON 58

Britain will hold a referendum on whether to stay in the EU. Support for our membership has declined over many years. So I am negotiating changes which will address the concerns of the British people. But these changes will benefit the EU too, and Germany can help deliver them. Let me explain.

(2) MAY 10

We will continue to work together to keep our people safe and to stand up for our values around the world. We did so long before the European Union existed and we will continue to do so long after the UK has left.

(3) JOHNSON 273

We will trade as much as ever before, if not more. We will be able to love our fellow Europeans, marry them, live with them, share the joy of discovering our different cultures and languages -but we will not be subject to the jurisdiction of a single court and legal system that is proving increasingly erratic and that is imitated by no other trading group. The words shared by the three corpora are the following ones: people, EU, European, UK, Britain, country, all, can, new and year, which shows that those themes are shared by the three Prime Ministers, as they are frequent in their respective speeches, as exemplified by occurrences (4) to ( 6):

(4) CAMERON 28 That is very positive. But we have to be frank. There are threats to the British economy, from slow growth in Europe, and challenges in other parts of the world. And so it's very important to play a role here in encouraging other countries to make the structural reforms that we've made, to make sure people set and stick to targets in terms of deficit reduction and make sure that Europe does the key deals in terms of completing the single market and services, signing trade deals with the fastest growing parts of the world, the things that will make a difference to get this continent, to get these economies growing faster, which would be good for them and good for Britain.

(5) MAY 26 I am delighted to welcome Prime Minister Cazeneuve to Downing Street today at such an important moment in both the profound friendship between our countries and the wider relationship between Britain and the whole European Union. Mr Cazeneuve and I worked very closely together as interior ministers, tackling the shared security challenges our countries face and I look forward to continuing that close cooperation.

(6) JOHNSON 38 "Today we are not only no longer a world power, but we are in the first rank even as a European one." Two months later Margaret Thatcher had won her first majority, and began the process of reversing that view of Britain, in this country and around the world. In 1981 she took on the expert opinion of 364 economists who wrote a pompous letter to the Times, calling for a U-turn on her budgetary policies; and she routed them by delivering a supply-side revolution in Britain whose benefits we enjoy to this day.

Regarding the differences in terms of frequency, it is interesting to note that deal, agreement and future are three words frequently used by Theresa May (see occurrence ( 7)), but neither by Cameron nor Johnson, which is revealing of their perception of the relationship between the UK and the EU. Indeed, Theresa May's ambition was to get her "Brexit deal" through Parliament (see "meaningful votes"); Johnson also had to secure a deal with the EU, but if he does not resort to the terms deal and agreement as often as May, it might show that he did not try to compromise with Parliament or with his own party (he actually suspended 21 Tory rebels)24 :

(7) MAY 203

And the deal sets us on course for a good future relationship with our friends and allies in the EU.

MAY 204

A close economic partnership that is good for business.

MAY 205

Ongoing security co-operation to keep our peoples safe.

MAY 206

The deal honours the referendum result and is good for both the UK and the EU.

MAY 208

Having an insurance policy to guarantee that there will never be a hard border in Northern Ireland is absolutely right it honours the UK's solemn commitments in the Belfast/Good Friday Agreement.

MAY 209

But if we ever have to use that insurance policy, it cannot become a permanent arrangement and it is not the template for our future relationship.

MAY 210

The deal that MPs voted on in January was not strong enough in making that clear and legally binding changes were needed to set that right.

MAY 211

Today we have agreed them.

On the contrary, Johnson (see occurrences (8) to ( 10)) is the only one to use the word other frequently, which is proof of a new beginning for the relationship between the UK and the EU, which has become an "other":

(8) JONHSON 253
Do we feel loyalty to that flag? Do our hearts pitter-patter as we watch it flutter over public buildings? On the contrary. The British share with other EU populations a growing sense of alienation, which is one of the reasons turn-out at European elections continues to decline. ( 9) JOHNSON 267

2) The Living Wage is an excellent policy, but how will you stop it being a big pull factor for uncontrolled EU migration, given that it is far higher than minimum wages in other EU countries? (10) JOHNSON 274 We will not lose influence in Europe or around the world -on the contrary, you could argue we will gain in clout. We are already drowned out around the table in Brussels; we are outvoted far more than any other country -72 times in the last 20 years, and ever more regularly since 2010; and the Eurozone now has a built-in majority on all questions.

As the three corpora do not contain the same number of tokens, we decided to resort to relative frequencies by using #LancsBox® which, contrary to AntConc®, enables researchers to change the statistical measurement. According to SketchEngine®,

Relative frequency, frequency per million (also called freq/mill in the interface) [is] a number of occurrences (hits) of an item per million, also called i.p.m. (instances per million). It is used to compare frequencies between corpora of different sizes. 25

Using relative frequency measurement allows researchers to compare corpora of different sizes by normalizing their respective sizes. We decided to focus essentially on the most frequent words related to Europe / the European Union / the EU on the one hand, and to the UK / Britain on the other hand, as well as on the relative frequency of use for the word Brexit.

Figure 5 displays the results in terms of relative frequency for "EUrelated words", namely EU, Europe, Union and European. What can be noticed is a significant drop in the number of EU-related words for each successive PM: Figure 5. Specific Relative Frequency for Europe-Related Words More generally, a significant decrease in the number of EU-related words in terms of relative frequency can be noted, which is symbolic of the change of focus operated by each Prime Minister, each focusing less and less on the EU, as clearly shown in Figure 6: On the contrary, we analyzed the frequency of UK/Britain-related words for the three Prime Ministers (Figure 7), with the lemmas country, We then decided to restrict our analysis to the three lemmas British, Britain and UK by adding the relative frequencies for the three Prime Ministers. Strangely enough, the relative frequency for Britain/UK-related terms also sharply decreases, as exemplified in Figure 8, when the opposite tendency was expected: This can be accounted for by the fact that once Brexit has been accepted as a political reality, the need to talk about the future of Britain and the UK tends to decrease, as the low frequency in the Johnson corpus tends to indicate, even if the question of the future of the UK outside the EU became more acute once the ties with the EU were officially cut.

The next step in our contrastive approach was to focus on the positive keywords, i.e. words with comparatively high frequency in the corpus of interest, and negative keywords, i.e. words with comparatively low frequency in the corpus of interest, when we compare their relative frequencies to the one found in a reference corpus. Positive keywords are interesting in a linguistic analysis as they indicate the "aboutness"26 of a particular text, i.e. what this text is about. We then looked at the relative frequency of each corpus compared to the BE06 corpus (a reference corpus27 of British English of various written text types: newspapers, fiction, academic writing and general prose), with the Log-likelihood statistic measurement tool: The positive keywords in May's speeches are still related to the EU and the UK, but words such as deal and trade are included in the list, which is proof of the beginning of the negotiation process to withdraw from the EU, as shown in Figure 10. We finally decided to focus on the very word Brexit, which was coined in 2012 according to the OED online: Is the continuous increase in the frequency of use of the word Brexit also found in the speeches of the three Prime Ministers? The relative frequency for Brexit in Figure 14 is quite relevant, as it shows an unexpected result: from an extremely low frequency for Cameron (0.31), the word reached a significant frequency (17.04) with May, who was mostly in charge of the withdrawal of the UK from the EU, to finally decrease with Johnson (13.56), as if the word lost some of its novelty once the deal was struck: Figure 14. Relative Frequency of Brexit in the three corpora To go deeper into the use made by the three Conservative Prime Ministers of the word Brexit, we resorted to the GraphColl tool in #LancsBox® to study the collocates of Brexit; the T-score 28 statistical measurement tool was used to visualize the most frequent collocates, instead of the LogDice, which is used preferably for large corpora; interestingly, the T-score enables us to tell the "narrative" 29 , or more simply the "story" of Brexit for the three Prime Ministers, i.e. how a fuzzy concept is slowly taking shape through words, which leads to a coherent narrative about this concept. Studying collocates is crucial in corpus linguistics, as collocates are words that are commonly used together, and the meaning of a given word is not simply the result of its meaning, but the interactions it develops with other words, following Firth's famous principle: "You shall know a word by the company it keeps". 30

28 T-score: T-score expresses the certainty with which we can argue that there is an association between the words, i.e. their co-occurrence is not random. The value is affected by the frequency of the whole collocation which is why very frequent word combinations tend to reach a high T-score despite not being significant collocations: https://www.sketchengine.eu/my_keywords/t-score/ 29 The concept of "narrative" was introduced in section 1.1. 30 Firth, John Rupert, Papers in Linguistics 1934-1951, London, Oxford University Press, 1957. 0,31 17,04 13,56

CAMERON MAY JOHNSON

For David Cameron, there is no narrative or story to tell as there are no collocates for Brexit, as shown in Figure 15: We can note that the number of collocates with UK increases with May, but decreases with Johnson, and that the same trend can be observed with the shared collocated between EU and UK, which seems to be revealing of the two entities drifting apart. Yet, interestingly enough, the number of collocates with EU remains relatively high, and even increases with Johnson compared to May, as if the speeches were mimetic of the fact that the EU was still in the limelight, even more now that Brexit was on its way, and that the ties between the UK and the EU had to be severed.

Semantic analysis and notional domains

To go deeper into this analysis and to offer a qualitative approach, we resorted to the UCREL Semantic Analysis System (USAS) available in WMatrix4® in order to uncover the most recurrent semantic domains in our corpus of interest. This system aims to tag each word in a given corpus with a specific semantic domain. Following the result of the tagging procedure, we performed a close reading of how these semantic domains were used in context. In other words, we looked at the words tagged under the semantic domains and suggested an interpretation as regards the way they contribute to the conceptualisation and representation of Brexit in the speeches of each Prime Minister. The first striking observation is that most of the notional domains tagged by the semantic tagger are common to the three Prime Ministers. For this case-study, we decided to focus on three of these domains, which seem to be significantly frequent in the Cameron, May and Johnson corpora: Geographical Names, Location and Direction and General Actions.

To begin with, the semantic domain Geographical Names appears significantly more frequently in the three corpora. This is no surprise given the context of our study, which involves geographical and political places. However, when considering the context of use, it is interesting to note that the politicians do not necessarily resort to the same lexical items. David Cameron uses a significant number of geographical names related to the European Union, such as euro-zone, Schengen, single-market, Germany, and this tends to differ from the Johnson corpus. We investigated the number of occurrences for the lemma Europe in the Cameron corpus and the Johnson corpus, and it confirmed our initial intuition. In the Johnson corpus, 992 words have been tagged under the domain Geographical Names, and out of these 992 words, the noun Europe appears 94 times (9,5%), whereas in the Cameron corpus, among the 2,028 words related to this semantic domain, there are 478 occurrences of the noun Europe (23%). This tends to show that Europe holds a larger place in Cameron's speeches, and thus in Cameron's political interest; this also supports the analysis of the shared collocates (Figures 18, 19 and 20).

Secondly, the Location and Direction semantic domain is, likewise, particularly recurrent in the three corpora. This domain includes prepositions, such as beyond, forward, away from, outside of, as well as verbs, such as face, stand, leave, come back, and nouns: destination, directions. The importance of this semantic field leads us to think that Brexit is conceived as a journey, a move from one point to another, as if Britain was literally exiting a place. The presence of this semantic field can also be linked with the Conceptual Metaphor Theory33 . According to this theory, some semantic domains, such as the JOURNEY semantic domain, are used in order to conceptualise abstract notions, that is notions that cannot be easily mentally represented. For example, the notion of "love" is often talked about via the use of expressions belonging to the JOURNEY semantic domain. The expression "we are at a crossroads in our relationship" illustrates this idea.

Here, the term crossroads is used metaphorically in order to frame the concept of relationships. This leads to the conceptual metaphor LOVE IS A JOURNEY. Likewise, the use of words from the Location and Direction domain to talk about Brexit could be framed under the conceptual metaphor BREXIT IS A JOURNEY, which is a way to impose some mental structure on the fuzzy concept of Brexit.

Thirdly, the use of the General Actions domain contributes to the conceptualisation of Brexit as a dynamic process, something moving, evolving, unstable. According to the USAS semantic tagger, the General Actions category refers to "general/abstract terms relating to an activity or action." 34 This category mostly encompasses verbs that denote actions. In cognitive grammar, verbs are likened to energy and motion 35 , hence instability. For instance, Theresa May repeatedly uses the expression work together. This could be linked to her will to co-operate with the EU, and it stresses the cooperative dimension of the EU-UK relationship. Interestingly, the most frequent verb in the Johnson corpus is do, a rather semantically empty verb. For instance, when Boris Johnson repeats Let's get Brexit done, the meaning of done is elusive and unfathomable. It is unclear what done means to him. This once again echoes the fuzziness of Brexit and its abstract nature. Alternatively, Johnson's catchphrase could be interpreted as a rhetorical means appealing to the voters who grew weary of Brexit, and who wanted to "get it done", whatever the cost. 36 Additionally, it is interesting to point out the extensive use of words tagged under the Numbers domain in the Johnson corpus, considering that this domain is statistically more dominant in the Johnson corpus than in the Cameron and May corpora. This is particularly relevant as regards Johnson's rhetoric during the referendum campaign: one of his most memorable arguments, although based on a lie, was related to the financial cost of the EU membership, and the amount of money the NHS would allegedly receive provided that the UK left the EU. This leads us to the assumption that for Johnson Brexit is conceived as a financial exchange, as an economic issue. This may also indicate that Johnson used figures as a rhetorical tool during the referendum campaign, not only to mention the economic implications of Brexit via the fees paid to the EU37 , as illustrated in (11), but also to back up the argument of British sovereignty, as illustrated in ( 12): (11) JOHNSON 961 Do we want to spend another billion pounds a month that could be going on the NHS? JOHNSON 197 People are surprised and alarmed to discover that our gross contributions to the EU budget are now running at about £20bn a year and that the net contribution is £10bn, and it is not just that we have no control over how that money is spent.

(12) JOHNSON 410 Now the WTO, that over decades has helped to break down the folly of protectionism and open markets, a benign and transformative process that is not only good for Britain, since our trade amounts to nearly 60% of our GDP, but which is good for the world, lifting billions of people out of poverty in the last 40 years.

JOHNSON 411

And yet the gossamer web of obstruction is growing thicker every year, and the political support for openness in trade is draining away across the world, and for the first time in decades trade is no longer growing as fast as global GDP, with volumes rising by only 2.8 per cent this year compared with an average of 5 per cent since 1990.

To sum up, this semantic analysis has revealed that the three Prime Ministers resort to similar semantic domains for the major part. However, a close look at the lexical items tagged under these semantic domains pinpointed noteworthy differences and variations across their discourses. This analysis also demonstrated that the semantic tagger could also be used to study metaphors, and this is something that we wish to work on in a future, in-depth study, following Jonathan Charteris-Black's pivotal work Metaphors of Brexit. No Cherries on the Cake?38

Conclusion

The aim of this article has been to analyze and compare the lexical frequencies, positive and negative keywords, collocates and semantic domains to see how Brexit was linguistically represented and constructed through the discourses of the three successive Conservative Prime Ministers. The language used in terms of lexical keywords, collocates and most frequently used semantic domains was studied in the corpora composed of the speeches of Cameron, May and Johnson. Our analyses enabled us to the following conclusions: Firstly, there are noteworthy variations between David Cameron's, Theresa May's and Boris Johnson's speeches, more on the lexical level than on the semantic level, as the same semantic domains -Geographical Names, Location and Direction, and General Actions -are used by the three Prime Ministers, even if the frequency may differ. Variations are therefore to be found more at the level of the word, of the lexis used than at the level of the semantic domains, which remain pretty similar for the three Conservative Prime Ministers; Secondly, the lexical and the semantic analyses, even if they brought out interesting differences, remain nonetheless complementary, as they confirm some tendencies: the theme of the EU as well as EU-related words are significantly more present at the lexical level in Cameron's and May's speeches than in Johnson's; this may be explained by the fact that before the referendum, the place of the EU was at stake, whereas after the referendum, it is the future place and role of the UK that is mentioned and becomes the focus of interest. Another interesting finding is that the relative frequency for Europe-related words follows a steady decline in the speeches of the successive three Prime Ministers -which was a trend that was expected -but that the relative frequency for UK/Britain-related words follows the same trend, which was something unexpected.

Interestingly, the list of positive keywords, i.e. the words with comparatively high frequency, in the speeches of the three Prime Ministers shows that, on the one hand, the number of EU-related words tends to decrease when, on the other hand, the number of UK-related words tends to increase. Yet, this finding needs to be qualified because even if the number of shared collocates between EU and UK tends to decrease, the number of collocates with EU remains relatively higher than the number of collocates with UK;

Thirdly, the conceptualization and representation of Brexit, just like Brexit itself, seems unstable and has varied from 2015 to nowadays, following the political process leading to the official leave in January 2021. The collocates of the word Brexit, which are quite different for the three Conservative Prime Ministers, have enabled us to tell its narrative and to shed some light on the way it is differently conceptualized in their respective speeches.

Figure 1 .

 1 Figure 1. UCREL Semantic Analysis System 22

Figure 4 .

 4 Figure 4. Absolute Frequency for the Johnson Corpus

Figure 6 .

 6 Figure 6. General Relative Frequency for Europe-Related Words

Figure 8 .

 8 Figure 8. General Relative Frequency for UK/Britain-Related Words

Figure 9 .

 9 Figure 9. Positive and Negative Keywords in the Cameron Corpus

Figure 10 .

 10 Figure 10. Positive and Negative Keywords in the May Corpus

Figure 11 .

 11 Figure 11. Positive and Negative Keywords in the Johnson Corpus

Figure 12 .

 12 Figure 12. Brexit Entry in the OED online

Figure 15

 15 Figure 15. T-score for Brexit in the Cameron Corpus

Figure 16

 16 Figure 16. T-score for Brexit in the May Corpus

Figure 17

 17 Figure 17. T-score for Brexit in the Johnson Corpus

Figure 21

 21 Figure21displays a sample of the semantic domains that appeared statistically more frequently across our data. The column on the left corresponds to the name of the semantic tag, and the column on the right shows the semantic domain that matches the tag:

:

  Figure 2. Absolute Frequency for the Cameron Corpus Figure 3. Absolute Frequency for the May Corpus

	516
	479
	420 398 382
	341
	307
	273 263 253 238

212 210 204 199 196 195 189 176 174172 159 145 143 138

	WILL	BRITAIN	EU	EUROPEAN	COUNTRY	PEOPLE	EUROPE	CAN	UNION	ALL	WOULD	HAS	WANT	MORE	MARKET	BRITISH	WORLD	NEED	SINGLE	NOW	YEAR	MAKE	NEW	WORK	OTHER

772 524 395 327 326 278 276 276 260 250 230 229 209 194 194 194 194 172 170 167 150 148 146 145 144

	WILL	EU	UK	PEOPLE	COUNTRY	EUROPEAN	BRITAIN	WANT	CAN	WOULD	DEAL	ALL	MORE	HAS	NEW	TRADE	UNION	MAKE	RIGHT	AGREEMENT	NEED	FUTURE	YEAR	GOVERNMENT	OTHER

https://www.theguardian.com/politics/2019/mar/05/green-lights-for-the-new-amber-rudd (see "Comments" section).

2 SeeLakoff & Johnson (2003),[START_REF] Langacker | Foundations of Cognitive Grammar[END_REF], among

others.3 Brown, Katy, Mondon, Aurelien, "Populism, the media, and the mainstreaming of the far right : The Guardian's coverage of populism as a case study", Politics,

2020, 3.4 Brown, Katy, Mondon, Aurelien, "Populism, the media, and the mainstreaming of the far right: The Guardian's coverage of populism as a case study", Politics, 2020, 4. According to Fairclough et al., Critical Discourse Analysis is a "problem-oriented interdisciplinary research movement, subsuming a variety of approaches, each with different theoretical models, research methods and agenda." (Fairclough, N., Mulderrig, J., Wodak, R., "Critical discourse analysis", in van Dijk, T. A. (ed),Discourse studies, Thousand Oaks: Sage, 2011, 357-378). "By studying discourse, it emphasizes the way in which language is implicated in issues such as power and ideology that determine how language is used, what effect it has, and how it reflects, serves, and furthers the interests, positions, perspectives, and values of, those who are in power." (Waugh, L., Catalano, T., Masaeed, K., Hong Do, T., Renigar, P., "Critical Discourse Analysis: Definition, Approaches, Relation to Pragmatics, Critique, and Trends", in Capone, A., Mey, J. (eds) Interdisciplinary Studies in Pragmatics,Culture and Society, Perspectives in Pragmatics, Philosophy & Psychology, vol 4. Springer, Cham, 2016, 72).

The definition of "textometry" is available at http://textometrie.enslyon.fr/spip.php?rubrique80&lang=en

 6 Allen, Nicholas, "'Brexit Means Brexit': Theresa May and Post-Referendum British Politics", British Politics 13, n o 1, April 2018, 109.

Shenhav, S., "Political Narratives and Political Reality", International Political Science Review 27, n°3, 2006, 248.

See the definition of "crisis" in Merriam-Webster's dictionary: https://www.merriamwebster.com/dictionary/crisis

 13 Faucher, Florence, "Brexit : Pourquoi ? Comment ?", in Barraud, Boris (dir.), Brexit -Dans Toutes Ses Dimensions, Paris: Éditions L'Harmattan, 2018,

18.14 Alexandre-Collier, Agnès, "Le Nouveau visage de l'euroscepticisme conservateur à la Chambre des Communes", Revue Française de Civilisation Britannique [En ligne], XXII-2,

2017, 2.

 15 Ibidem.16 Schnapper, Pauline, "David Cameron et la campagne du Remain", Revue Française de Civilisation Britannique [En ligne],XXII-2, 2017, 6.

Schnapper, Pauline, "Brexit, or Theresa May's Headache", Observatoire de la société britannique [En ligne], 21, 2018, 6.

 18 McEnery, Tony, Wilson, Andrew, Corpus Linguistics: An Introduction, 2ed., repr. Edinburgh Textbooks in Empirical Linguistics, Edinburgh: Edinburgh University Press, 2011

, 1.19 McEnery, Tony, Hardie, Andrew, Corpus Linguistics: Method, Theory and Practice, Cambridge Textbooks in Linguistics, Cambridge: Cambridge

University Press, 2012, 1.

Brown, Katy, Mondon, Aurelien, "Populism, the media, and the mainstreaming of the far right: The Guardian's coverage of populism as a case study", Politics, 2020, 4-5.

In corpus linguistics, "tokens" correspond to the number of individual words in a text.

Rayson, P., Archer, D., Wilson, A., Introduction to the USAS category system, 2002, 2.

We would like to thank Agnès Alexandre-Collier (private conversation) for the data provided and for her interpretation.

See Scott, M., WordSmith Tools Help Manual, Version 3.0., Mike Scott and Oxford University Press, 1999.

 27 A reference corpus is a corpus chosen as a standard of comparison with the corpus of interest (pilot corpus).

See Lakoff, George, Johnson, Mark. Metaphors We Live By, Chicago: University of Chicago Press, (1980) 2003.

 34 Rayson, P., Archer, D., Wilson, A., Introduction to the USAS category system, Benedict project report, 2002,

3.35 See Langacker's "billiard-ball model": Langacker, Ronald W., Foundations of CognitiveGrammar, Stanford University Press, 1987, 56.

Cooper, Luke, Cooper, Christabel, " 'Get Brexit Done': The New Political Divides of England and Wales at the 2019 Election", The Political Quarterly 91, n°4, 2020, 1.

The EU membership supposedly costs £350M a week (we would like to thank Agnès Alexandre-Collier for this information).

Charteris-Black, Jonathan, Metaphors of Brexit. No Cherries on the Cake?, Palgrave Macmillan, 2019.

Denis Jamet is Professor of English Linguistics (University of Lyon UJML3) and Affiliate Professor of French Linguistics (University of Arizona), CEL -EA1663. He works on discourse analysis, metaphorical language, euphemism and dysphemism, as well as persuasive and manipulative language.

Pauline Rodet is an English Instructor (University of Lyon UJML3) and a PhD student, CEL -EA 1663.


Marius Bozga
email: marius.bozga@univ-grenoble-alpes.fr

Joseph Sifakis
email: joseph.sifakis@univ-grenoble-alpes.fr

Correct by Design Coordination of Autonomous Driving Systems

Keywords: Autonomous driving systems, Traffic rule specification, Map specification, Collision avoidance policy, Assume-guarantee contract, Correctness by design

The paper proposes a method for the correct by design coordination of autonomous driving systems (ADS ). It builds on previous results on collision avoidance policies and the modeling of ADS by combining descriptions of their static environment in the form of maps, and the dynamic behavior of their vehicles. An ADS is modeled as a dynamic system involving a set of vehicles coordinated by a Runtime that based on vehicle positions on a map and their kinetic attributes, computes free spaces for each vehicle. Vehicles are bounded to move within the corresponding allocated free spaces. We provide a correct by design safe control policy for an ADS if its vehicles and the Runtime respect corresponding assume-guarantee contracts. The result is established by showing that the composition of assumeguarantee contracts is an inductive invariant that entails ADS safety. We show that it is practically possible to define speed control policies for vehicles that comply with their contracts. Furthermore, we show that traffic rules can be specified in a linear-time temporal logic, as a class of formulas that constrain vehicle speeds. The main result is that, given a set of traffic rules, it is possible to derive free space policies of the Runtime such that the resulting system behavior is safe by design with respect to the rules.

Introduction

Autonomous driving systems (ADS ) are probably the most difficult systems to design and validate, because the behavior of their agents is subject to temporal and spatial dynamism. They are real-time distributed systems involving components with partial knowledge of their environment, pursuing specific goals while the collective behavior must meet given global goals.

⋆⋆ Institute of Engineering Univ. Grenoble Alpes Development of trustworthy ADS is an urgent and critical need. It poses challenges that go well beyond the current state of the art due to their overwhelming complexity. These challenges include, on the one hand, modeling the system and specifying its properties, usually expressed as traffic rules; on the other hand, building the system and verifying its correctness with respect to the desired system properties.

Modeling involves a variety of issues related to the inherent temporal and spatial dynamics as well as to the need for an accurate representation of the physical environment in which vehicles operate. Many studies focus on formalizing and standardizing a concept of map that is central to semantic awareness and decision-making. These studies often use ontologies and logics with associated reasoning mechanisms to check the consistency of descriptions and their accuracy with respect to desired properties [START_REF] Beetz | Benefits and limitations of linked data approaches for road modeling and data exchange[END_REF][START_REF] Bagschik | Ontology based scene creation for the development of automated vehicles[END_REF]. Other works propose open source mapping frameworks for highly automated driving [START_REF]ASAM OpenDRIVE® -open dynamic road information for vehicle environment[END_REF][START_REF] Poggenhans | Lanelet2: A high-definition map framework for the future of automated driving[END_REF]. Finally, the SOCA method [START_REF] Butz | SOCA: domain analysis for highly automated driving systems[END_REF] proposes an abstraction of maps called zone graph, and uses this abstraction in a morphological behavior analysis.

There is an extensive literature on ADS validation that involves two interrelated problems: the specification of system properties and the application of validation techniques. The specification of properties requires first-order temporal logics because parameterization and genericity are essential for the description of situations involving a varying number of vehicles and types of traffic patterns. The work in [START_REF] Rizaldi | Formalising and monitoring traffic rules for autonomous vehicles in isabelle/hol[END_REF][START_REF] Rizaldi | Formalising traffic rules for accountability of autonomous vehicles[END_REF] formalizes a set of traffic rules for highway scenarios in Isabelle/HOL. It shows that traffic rules can be used as requirements to be met by autonomous vehicles and proposes a verification procedure. A formalization of traffic rules for uncontrolled intersections is provided in [START_REF] Karimi | Formalizing traffic rules for uncontrolled intersections[END_REF], which shows how the rules can be used by a simulator to safely control traffic at intersections. The work in [START_REF] Esterle | Formalizing traffic rules for machine interpretability[END_REF] proposes a methodology for formalizing traffic rules in linear temporal logic; it shows how the evaluation of formalized rules on recorded human behaviors provides insight into how well drivers follow the rules.

Many works deal with the formal verification of controllers that perform specific maneuvers. For example, in [START_REF] Hilscher | An abstract model for proving safety of multi-lane traffic manoeuvres[END_REF], a dedicated multi-way spatial logic inspired by interval temporal logic is used to specify safety and provide proofs for lane change controllers. The work in [START_REF] Rizaldi | A formally verified motion planner for autonomous vehicles[END_REF] presents a formally verified motion planner in Isabelle/HOL. The planner uses maneuver automata, a variant of hybrid automata, and linear temporal logic to express properties. In [START_REF] Esterle | Formalizing traffic rules for machine interpretability[END_REF], runtime verification is applied to check that the maneuvers of a high-level planner conform to traffic rules expressed in linear temporal logic.

Of particular interest for this work are correct by construction techniques where system construction is guided by a set of properties that the system is guaranteed to satisfy. They involve either the application of monolithic synthesis techniques or compositional reasoning throughout a component-based system design process. There is considerable work on controller synthesis from a set of system properties usually expressed in linear temporal logic, see for example [START_REF] Kress-Gazit | Automatically synthesizing a planning and control subsystem for the DARPA urban challenge[END_REF][START_REF] Wongpiromsarn | Synthesis of provably correct controllers for autonomous vehicles in urban environments[END_REF][START_REF] Wongpiromsarn | Receding horizon temporal logic planning[END_REF][START_REF] Schwarting | Planning and decision-making for autonomous vehicles[END_REF][START_REF] Waqas | Correct-by-construction design of adaptive cruise control with control barrier functions under safety and regulatory constraints[END_REF]. These are algorithmic techniques extensively studied in the field of control. They consist of restricting the controllable behavior of a system interacting with its environment so that a set of properties are satisfied. Nonetheless, their application is limited due to their high computational cost, which depends in particular on the type of properties and the complexity of the system behavior.

An alternative to synthesis is to achieve correctness by design as a result of composing the properties of the system components. Component properties are usually "assume-guarantee" contracts characterizing a causal relationship between a component and its environment: if the environment satisfies the "assume" part of the contract, the state of the component will satisfy the "guarantee" part, e.g. [START_REF] Benveniste | Contracts for system design[END_REF][START_REF] Meyer | Applying "design by contract[END_REF][START_REF] Chatterjee | Assume-guarantee synthesis[END_REF]. The use of contracts in system design involves a decomposition of overall system requirements into contracts that provide a basis for more efficient analysis and validation. In addition, contract-based design is advocated as a method for achieving correctness by design, provided that satisfactory implementations of the system can be found [START_REF] Sun | Correct-by-construction: a contract-based semi-automated requirement decomposition process[END_REF]. There are a number of theoretical frameworks that apply mainly to continuous or synchronous systems, especially for analysis and verification purposes [START_REF] Sharf | Assume/guarantee contracts for dynamical systems: Theory and computational tools[END_REF][START_REF] Mavridou | From partial to global assume-guarantee contracts: Compositional realizability analysis in FRET[END_REF][START_REF] Saoud | Assume-guarantee contracts for continuoustime systems[END_REF]. They suffer computational limitations because, in the general case, they involve the symbolic solution of fixed-point equations, which restricts the expressiveness of the contracts [START_REF] Mavridou | From partial to global assume-guarantee contracts: Compositional realizability analysis in FRET[END_REF]. Furthermore, they are only applicable to systems with a static architecture, which excludes dynamic reconfigurable systems, such as autonomous systems.

The paper builds on previous results [START_REF] Bozga | Specification and validation of autonomous driving systems: A multilevel semantic framework[END_REF] on a logical framework for parametric specification of ADS combining models of the system's static environment in the form of maps, and the dynamic properties of its vehicles. Maps are metric graphs whose vertices represent locations and edges are labeled with segments that can represent roads at different levels of abstraction, with characteristics such as length or geometric features characterizing their shape and size.

An ADS model is a dynamic system consisting of a map and a set of vehicles moving along specific routes. Its state can be conceived as the distribution of vehicles on a map with their positions, speeds and other kinematic attributes. For its movement, each vehicle has a safe estimate of the free space in its neighborhood, according to predefined visibility rules. We assume that vehicle coordination is performed by a Runtime that, for given vehicle positions and speeds on the map, can compute the free spaces on each vehicle's itinerary in which it can safely move.

We study a safe control policy for ADS, which is correct by design. It results from the combination of two types of assume-guarantee contracts: one contract for each vehicle and another contract for the Runtime taking into account the positions of the vehicles on the map. The contract for a vehicle states that, assuming that initially the dynamics of the vehicle allow it to stay in the allocated free space, it will stay in this free space. Note that the details of the contract implementation are irrelevant; only the I/O relationship between free space and vehicle speed matters. The Runtime contract asserts that if the free spaces allocated to vehicles are disjoint, then they can be allocated new disjoint free spaces provided they have fulfilled their contract.

We build on this general result by specializing its application in two directions. First, we show that it is possible to define speed policies for vehicles that satisfy their assume-guarantee contract. Second, we show that it is possible to define free space policies for the Runtime enforcing safety constraints of a given set of traffic rules. We formalize traffic rules as a class of properties of a linear temporal logic. We provide a method that derives from a given set of traffic rules, constraints on the free spaces chosen by the Runtime such that the resulting system behavior is safe with respect to these rules. This is the main result of the paper establishing correctness by design of general ADS, provided that their components comply with their respective contracts.

The paper is structured as follows. In Section 2, we establish the general framework by introducing the basic models and concepts for the representation of maps. In Section 3, we introduce the dynamic model of ADS involving a set of vehicles and a Runtime for their coordination. We show how a correct by design safe control policy is obtained by combining assume-guarantee contracts for the vehicles and the Runtime. In Section 4, we study the principle of speed policies respecting the vehicle contract and show its application through an example. In Section 5, we formalize traffic rules as a class of formulas of a linear temporal logic and show how it is possible to generate from a set of traffic rules free space policies such that the system is safe by design. Section 6 concludes with a discussion of the significance of the results, future developments and applications. The proofs of technical results are available in the long version of the paper [START_REF] Bozga | Correct by design coordination of autonomous driving systems[END_REF].

Map Representation

Following the idea presented in [START_REF] Bozga | Specification and validation of autonomous driving systems: A multilevel semantic framework[END_REF], we build contiguous road segments from a set S equipped with a partial concatenation operator ⋅ ∶ S × S → S ∪ {⊥}, a length norm ||.|| ∶ S → R ≥0 and a partial subsegment extraction operator .[., .] ∶ S × R ≥0 × R ≥0 → S ∪ {⊥}. Thus, given a segment s, ||s|| represents its length and s[a, b] for 0 ≤ a < b ≤ ||s||, represents the sub-segment starting at length a from its origin and ending at length b. Segments can be used to represent roads at different levels of abstraction, from intervals to regions. In this paper, we consider S as the set of curves obtained by concatenation of line segments and circle arcs, for representing roads of a map as depicted in Fig. 1.

We use metric graphs

G def = (V, S, E) to represent maps, where V is a finite set of vertices, S is a set of segments and E ⊆ V × S ⋆ × V is a finite set of edges labeled by non-zero length segments (denoted S ⋆ ). For an edge e = (v, s, v ′ ) ∈ E we denote • e def = v, e • def = v ′ , e.s def = s. For a vertex v, we define • v def = {e | e • = v} and v • def = {e | • e = v}.
We call a metric graph connected (resp. weakly connected ) if a path (resp. an undirected path) exists between any pair of vertices.

We consider the set Pos

G def = V ∪ {(e, a) | e ∈ E, 0 ≤ a ≤ ||e.
p, p ′ , that is, ↝ G def = ( - → G )
+ the transitive closure of edge rides. Finally, we define the distance d G from position p to position p ′ as 0 whenever p = p ′ or the minimum length among all segments labeling rides from p to p ′ and otherwise

+∞ if no such ride exists. Whenever G is fixed in the context, we will omit the subscript G for positions Pos G , distance d G , and rides -

→ G or ↝ G .
Fig. 1: A map with junctions (blue edges) and a merger vertices (red edges)

A connected metric graph G = (V, S, E) can be interpreted as a map, structured into roads and junctions, subject to additional assumptions:

we restrict to metric graphs which are 2D-consistent [START_REF] Bozga | Specification and validation of autonomous driving systems: A multilevel semantic framework[END_REF], meaning intuitively they can be drawn in the 2D-plane such that the geometric properties of the segments are compatible with the topological properties of the graph.

In particular, if two distinct paths starting from the same vertex v, meet at another vertex v ′ , the coordinates of v ′ calculated from each path are identical. For the sake of simplicity, we further restrict to graphs where distinct vertices are located at distinct points in the plane, and moreover, where no edge is self-crossing (meaning actually that distinct positions (e, a) of the same edge e are located at distinct points).

the map is equipped with a symmetric junction relationship on edges E which abstracts the geometric crossing (or the proximity) between edges at positions other than the edge end points. This relationship is used to define the junctions of the map, that is, as any non-trivial equivalence class in the transitive closure of . Actually, junctions need additional signalisation to regulate the traffic on their edges (e.g., traffic lights, stop signs, etc). In addition, we assume a partial ordering ≺ j on the set of vertices to reflect their static priorities as junction entries.

to resolve conflicts at merger vertices, i.e., vertices with two or more incident segments which do not belong to a junction, we assume that the map is equipped with a static priority relationship. Specifically, for a vertex v, there is a total priority order ≺ v on the set of edges

• v. This order reflects an abstraction of the static priority rules associated with each of the merging edges (e.g., right-of-way, yield-priority, etc).

every edge e is associated with a maximal speed limit e.v ∈ R ≥0 .

In the remainder of the paper, we consider a fixed metric graph G = (V, S, E) altogether with the junction relationship , static priorities ≺ v and edge speed limits as discussed above. Also, we extend the junction and priority relationships from edges to their associated positions, that is, consider (e 1 , a 1 ) ∼ (e 2 , a 2 ) def = e 1 ∼ e 2 for any relation ∼∈ { , (≺ v ) v∈V }. Finally, we denote by r 1 ⊎ r 2 the property that rides r 1 , r 2 in G are non-crossing, that is, their sets of positions are disjoint and moreover not belonging to the same junction(s), except for endpoints.

3 The ADS Dynamic Model

General ADS Architecture

Given a metric graph G representing a map, the state of an ADS is a tuple ⟨st o ⟩ o∈O representing the distribution of a finite set of objects O with their relevant dynamic attributes on the map G. The set of objects O includes a set of vehicles C and fixed equipment such as lights, road signs, gates, etc. For a vehicle c, its state st c def = ⟨c.p, c.δ, c.v , c.wt, c.it . . . ⟩ includes respectively its position on the map (from Pos ), its displacement traveled since c.p (from R ≥0 ), its speed (from R ≥0 ), the waiting time (from R ≥0 ) which is the time elapsed since the speed of c became zero, its itinerary (from the set of segments S) which labels a ride starting at c.p, etc. For a traffic light lt, its state st lt def = ⟨lt.p, lt.cl , . . .⟩ includes respectively its position on the map (from Pos ), and its color (with values red and green), etc.

The general ADS model is illustrated in Fig. 2 and consists of a set of vehicle models C and a Runtime that interact cyclically with period ∆t. The Runtime calculates free space values for each vehicle c which are lenghts c.f of initial rides on their itineraries c.it whose positions are free of obstacles. In turn, the vehicles adapt their speed to stay within the allocated free space. Specifically, the interaction proceeds as follows:

each vehicle c applies a speed policy for period ∆t respecting its free space c.f received from the Runtime. During ∆t, it travels a distance c.δ ′ to some new position c.p ′ , and at the end of the period its speed is c.v ′ , its itinerary c.it ′ , etc. The new state is then communicated to the Runtime. the Runtime updates the system state on the map taking into account the new vehicle states and time-dependent object attributes. Then it applies a free space policy computing the tuple ⟨c.f ′ ⟩ c∈C , the new free space for all vehicles based on the current system state. The corresponding free spaces are then communicated to vehicles and the next cycle starts.

Note that the coordination principle described is independent of the type of segments used in the map, e.g. intervals, curves or regions. For simplicity, we take the free spaces to measure the length of an initial ride without obstacles on the vehicle itinerary. This abstraction is sufficient to state the basic results. We discuss later how they can be generalized for richer interpretations of the map.

Assume-Guarantee for Safe Control Policies

We give below the principle of a safe control policy for vehicles, which respects their allocated free space, applying assume-guarantee reasoning.

We consider the following two hypotheses. For a vehicle c, there exists a function B c ∶ R ≥0 → R ≥0 that gives the minimum braking distance c needs to stop from speed v, in case of emergency. Furthermore, for a non-negative distance f , let Ahead c (f ) denote the ride consisting of the positions reachable on the itinerary c.it from the current vehicle position c.p within distance f ,

formally Ahead c (f ) def = {p ′ ∈ Pos | ∃δ ≤ f. c.p c.it[0,δ] ↝ p ′ }.
The following definition specifies a safe control policy using assume-guarantee reasoning on the components of the ADS architecture. We consider assumeguarantee contracts on components defined as pairs of properties A/G specifying respectively the input-output component behavior for a cycle, i.e., respectively, what the component guarantees (G) provided its environment conforms to given assumption (A).

Definition 1 (safe control policy). A control policy is safe if

each vehicle c ∈ C respects the assume-guarantee contract:

0 ≤ c.v , B c (c.v ) ≤ c.f 0 ≤ c.v ′ , 0 ≤ c.δ ′ , c.δ ′ + B c (c.v ′ ) ≤ c.f , c.p c.it[0,c.δ ′ ] ↝ c.p ′ , c.it ′ = c.it[c.δ ′ , -]
the Runtime respects the assume-guarantee contract:

∧ c 0 ≤ c.δ ≤ c.f , ⊎ c Ahead c (c.f -c.δ) ∧ c∈C c.f ′ ≥ c.f -c.δ, ⊎ c∈C Ahead c (c.f ′ )
The policy is the joint enforcement of safe speed policies for vehicles and safe free space policies for the Runtime. Vehicle safe speed policies require that if a vehicle can brake safely by moving forward within its allocated free space at the beginning of a cycle, then it can adapt its speed moving forward within this space. Runtime safe free space policies require that if the free spaces of the vehicles are non-crossing at the beginning of a cycle, then it is possible to find new non-crossing free spaces for the vehicles provided they move forward in their allocated free space.

Theorem 1. Safe control policies preserve the following invariants:

the speed is positive and compliant to the free space, for all vehicles, that is,

⋀ c∈C 0 ≤ c.v ∧ B(c.v ) ≤ c.f ,
the free spaces are non-crossing, that is, ⨄ c∈C Ahead c (c.f ).

Note that this theorem guarantees the safety of the coordination insofar as the vehicles respecting their contracts remain in their allocated free spaces which are non-crossing by construction. Nevertheless, the result leaves a lot of freedom to vehicles and the Runtime to choose speeds and non-crossing free spaces. In particular, two questions arise concerning these choices. The first question is wether the system can reach states where no progress is possible. One can imagine traffic jam situations, for example when vehicles do not have enough space to move. The second question is whether free space choices can be determined by traffic rules that actually enforce fairness in resolving conflicts between vehicles. This question is discussed in detail in Section 5.

Speed Policies abiding by the Vehicle Contract

In this section, we show that it is possible for vehicles to compute speed policies in accordance with their contract.

The behavior of each vehicle is defined by a controller, which given its current speed and its free space, computes the displacement for ∆t so that it can safely move in the free space. Such safe speed policies have been studied in [START_REF] Wang | Safe and efficient collision avoidance control for autonomous vehicles[END_REF][START_REF] Wang | A hybrid controller for safe and efficient collision avoidance control[END_REF].

We illustrate the principle of safe speed policy with respect to f considering that each vehicle is equipped with a controller that receives a free space value and adjusts its speed adequately. For the sake of simplicity, assume the controller can select among three different constant acceleration values {-b max , 0, a max } ∈ R respectively, the negative value -b max for decreasing, the zero value for maintaining and the positive value a max for increasing the speed. At every cycle, the controller will select the highest acceleration value for which the vehicle guarantee holds as defined by its contract in Def. 1. Nonetheless, an exception applies for the very particular case where the vehicle stops within the cycle, which cannot be actually handled with constant acceleration.

The proposed speed policy defines the new speed v ′ and displacement δ ′ using a region decomposition of the safe v×f space (that is, where v ≥ 0 and f ≥ B(v)) as follows:

v ′ , δ ′ def = ⎧ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎨ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎩ 0, f if f ≥ B(v), f -v∆t < B(v), v -b max ∆t < 0 v -b max ∆t, v∆t -b max ∆t 2 /2 if f ≥ B(v), f -v∆t < B(v), v -b max ∆t ≥ 0 v, v∆t if f -v∆t ≥ B(v), f -v∆t -a max ∆t 2 /2 < B(v + a max ∆t) v + a max ∆t, v∆t + a max ∆t 2 /2 if f -v∆t -a max ∆t 2 /2 ≥ B(v + a max ∆t)
(1) Intuitively, the regions are defined such that, when the corresponding acceleration is constantly applied for ∆t time units, the guarantee on the vehicle is provable given the assumptions and the region boundary conditions.

(v) = v 2 /2b max .
Note that the speed policy works independently of the value of the parameter ∆t, which is subject only to implementation constraints, e.g., it must be large enough to allow the controlled electromechanical system to realize the desired effect. A large ∆t may imply low responsiveness to changes and jerky motion, but will never compromise the safety of the system.

The proposed implementation of the speed policy is "greedy" in the sense that it applies maximum acceleration to move as fast as possible in the available space. We could have "lazy" policies that do not move as fast as possible, and simply extend the travel time. We have shown in [START_REF] Wang | Safe and efficient collision avoidance control for autonomous vehicles[END_REF] that the region-based speed policy approaches the optimal safety policy, i.e., the one that gives the shortest travel time, when we refine the choice of acceleration and deceleration rates in the interval [-b max , a max ].

Free Space Policies implied by Traffic Rules

In this section, we study free space safety policies for a given set of global system properties describing traffic rules. We formalize traffic rules as a class of linear temporal logic formulas and provide a method for computing free space values for vehicles that allow them to meet a given set of traffic rules.

Writing Specifications of Traffic Rules

Given a map G and a set of objects O, we specify traffic rules as formulas of a linear time logic of the following form, where □ is the always time modality and N is the next time modality:

□ ∀c 1 . ∀o 2 ...∀o k . φ(c 1 , o 2 , . . . , o k ) ⟹ N ψ(c 1 , o 2 , . . . , o k ) (2)
A rule says that for any run of the system, the satisfaction of the precondition φ implies that the postcondition ψ holds at the next state. Both φ and ψ are boolean combinations of state predicates as defined below. Furthermore, we assume that ψ constrains the speed of a single vehicle c 1 for which the property is applicable, and which we call for convenience the ego vehicle. The rules involve state predicates φ in the form of first-order assertions built from variables and object attributes (denoting map positions, segments, reals, etc) using available primitives on map positions (e.g., rides ↝ , edge rides -→ , distance d, equality =), on segments (e.g., concatenation and subsegment extraction), in addition to real arithmetic and boolean operators.

Moreover, we define auxiliary non-primitive location and itinerary predicates proven useful for the expression of traffic rules. For a vehicle c ∈ C and x either an object o ∈ O, a vertex u or an edge e of the map, we define the predicates c@x (c is at x), c -→ x (c meets x along the same edge), c ↝ x (c meets x) as in Table 1.

≤ c defined as c.p ⊕ c δ ≤ c c.p ⊕ c δ ′ if and only if δ ≤ δ ′ . c@x c - → x c ↝ x x = o c.p = o.p ∃δ. c.p c.it[0,δ] -----→ o.p ∃δ. c.p c.it[0,δ] ↝ o.p x = u c.p = u ∃δ. c.p c.it[0,δ] -----→ u ∃δ. c.p c.it[0,δ] ↝ u x = e ∃a. c.p = (e, a) ∃δ. ∃a > 0. c.p c.it[0,δ] -----→ • e∧ ∃δ. ∃a > 0. c.p c.it[0,δ] ↝ • e∧ c.p c.it[0,δ+a] ↝ (e, a) c.p c.it[0,δ+a] ↝ (e, a)
Table 1: Location and itinerary predicates.

We define the semantics of state predicates φ in the usual way, by providing a satisfaction relation σ, st ⊢ φ, where σ is an assignment of free variables of φ and st is a system state. A complete formal definition can be found in [START_REF] Bozga | Specification and validation of autonomous driving systems: A multilevel semantic framework[END_REF]. The semantics of rules is defined on pairs σ, [st (t i ) ] i≥0 consisting of a function σ assigning objects instances to object variables of the formulas and a run [st (t i ) ] i≥0 for a finite set of objects O. For initial state st (t 0 ) we define runs as sequences of consecutive states [st (t i ) ] i≥0 obtained along the cyclic ADS execution as described in section 3.1 and parameterized by the sequence of time points t i def = t 0 + i ⋅ ∆t, that is, equal to the time for reaching the i th system state.

We provide examples of traffic rules in Table 2. We restrict ourselves to safety rules that characterize boundary conditions that should not be violated by the driver controlling the vehicle speed. Therefore, the preconditions characterize potential conflict situations occurring at intersections as well as other constraints implied by the presence of obstacles or speed rules, e.g., traffic lights or speed limit signals. The preconditions may involve various itinerary and location predicates and constraints on the speed of the ego vehicle. Moreover, the latter are limited to constraints maintained by the vehicle and involving braking functions in the form B c (c.v ) # k where k is a distance with respect to a reference position on the map and # is a relational symbol # ∈ {<, ≤, =, ≥, >}. Furthermore, the postconditions involve two types of constraints on the speed of the ego vehicle: either speed regulation constraints that limit the distance to full stop, that is

Deriving Free Space Rules from Traffic Rules

We show that we can derive from traffic rules limiting the speed of vehicles, rules on free space variables controlled by the Runtime such that both the traffic rules and the free space contract hold.

To express constraints on the free space variables c.f , we use, for vehicles c, auxiliary limit position variables ⟨c.π⟩ c∈C such that c.π = c.p ⊕ c c.f . In other words, the limit position c.π defines the position beyond which a vehicle should not be according to its contract. It is clear that for given c.π and c.p, c.f is defined as the distance from c.p to c.π.

Using the limit position variables ⟨c.π⟩ c∈C we can transform structurally any state formula φ into a free space formula φ π by replacing constraints on speeds by induced constraints on limit positions as follows, for # ∈ {<, ≤, =, ≥, >} and t a non-negative real constant:

B c (c.v ) # d(c.p, x) + t ↦ c.π # c x ⊕ c t c.v # t ↦ c.π # c c.p ⊕ c B c (t)
The first case concerns speed regulation constraints bounding the limit position c.π relatively to the position x of a fixed or moving obstacle ahead of c, that is, a stop or traffic light sign, a vehicle, etc. The second case concerns speed limitation constraints bounding c.π relatively to the current vehicle position c.p and the allowed speed.

Given a state formula φ, let φ π be the derived formula obtained by replacing constraints on speeds by constraints on limit positions. The following theorem guarantees preservation between properties involving speed constraints and properties involving limit positions, in relation to the vehicle speed contracts.

Theorem 2. The following equivalences hold:

(i) φ ⟺ (∃ c.π) c φ π ∧ ⋀ c B c (c.v ) = d(c.p, c.π) (ii) ↙φ ⟺ (∃ c.π) c φ π ∧ ⋀ c B c (c.v ) ≤ d(c.p, c.π)
where ↙φ is the speed-lower closure of φ, that is, φ where speed constraints of the form c.v # t, B c (c.v ) # d(c.p, x)) + t for # ∈ {≥, >} are removed.

Re-calling Thm. 1 in section 3.2, notice that B c (c.v ) ≤ d(c.p, c.π) is enforced by safe control policies as d(c.p, c.π) = c.f . Therefore, any property φ is preserved through equivalence only when all the vehicles run with the maximal allowed speed by the distance to their limit positions. Otherwise, the speed-lower closure ↙φ is preserved through equivalence, that is, only the upper bounds on speeds as derived from corresponding bounds on limit positions.

Therefore, all traffic rules of form (2) which, for states satisfying the precondition φ, constrain the speed of vehicle c 1 at the next cycle according to constraint ψ, are transformed into free space rules on limit positions of the form:

□ ∀c 1 .∀o 2 ...∀o k . φ π (c 1 , o 2 , . . . , o k ) ⟹ N ψ π (c 1 , o 2 , . . . , o k ) (3)
Notice that the postcondition ψ π is of the form c 1 .π ≤ c 1 b ψ (c 1 , o 2 , . . . , o k ) for a position term b ψ obtained by the transformation of ψ.

For example, the traffic rule 1 is transformed into the free space rule: □∀c 1 . ∀c 2 . c 1 ↝ c 2 ⟹ N c 1 .π ≤ c 1 c 2 .p. The traffic rule 4(ii) is transformed into the free space rule:

□∀c 1 . ∀c 2 . ∀u. c 1 - → u ∧ c 2 - → u ∧ c 1 .π = u ∧ c 2 .π = u ∧ c 1 .p ≺ u c 2 .p ⟹ N c 1 .π ≤ c 1 u.
We are now ready to define the Runtime free space policy based on traffic rules. Let R denotes the set of traffic rules of interest e.g., the ones defined in Table 2. For a current ADS state st and current limit positions and free spaces ⟨c.π, c.f ⟩ c∈C the policy computes new limit positions and new free spaces ⟨c.π ′ , c.f ′ ⟩ c∈C as follows:

c.π ′ def = min ≤c { σb ψ | [∀c 1 .∀o 2 ...∀o k . φ ⟹ N ψ] ∈ R, σ[c/c 1 ], st ⊢ φ π } ∪ { e • | ∃a < ||e||, c.π = (e, a), c ↝ e } (4)
c.f

′ def = δ such that c.p ⊕ c δ = c.π ′ (5)
Actually, that means computing for every vehicle c the new limit position c.π ′ as the nearest position with respect to ≤ c from two sets of bounds. The first set contains the bounds σb ψ computed for all the free space rules derived from the traffic rules in R and applicable for c at the given state st. The second set contains the endpoint e • of the edge e where the current limit position c.π is located. It is needed to avoid "jumping" over e

• , even though this is allowed by application of the rules, as e

• may be a merger node and should be considered for solving potential conflicts. Then, we define the new free space c.f ′ as the distance δ from the current position c.p to the new limit position c.π

′ measured along the itinerary of c.

Note that if the free space policy respects the assume-guarantee contract of the Runtime from Def. 1 then it will moreover guarantees the satisfaction of all traffic rules from R where both the pre-and the postcondition φ and ψ are speed-lower closed formulas. First, conformance with respect to the contract is needed to obtain the invariants B c (c.v ) ≤ c.f = d(c.p, c.π) according to Thm. 1. Second, these invariants ensure preservation through equivalence between speed-lower closed formula and derived formula on limit positions, according to Thm. 2. Third, the free space policy ensures the satisfaction of the derived free space rules, that is, by construction it chooses limit positions ensuring postconditions ψ π hold whenever preconditions φ π hold. As these formulas are preserved through equivalence, it leads to the satisfaction of the original traffic rule.

Correctness with respect to the Free Space Contract

We prove correctness, that is, conformance with the assume-guarantee contract of Def. 1, of the free space policy obtained by the application of the traffic rules from Table . 2 excluding the one concerning traffic lights. For this rule we need additional assumptions taking into account the light functioning and the behavior of the crossing vehicles.

First, we assume that the vehicle braking dynamics are compatible with the speed limits associated with the map segments, that means:

for any edge e leading to a junction (and henceforth a stop sign) or a merger vertex holds B c (e.v ) ≤ ||e||, for any vehicle c ∈ C (see Figure 3 i.e., between two consecutive speed limit changes, there is sufficient space to adapt the speed.

B c (v) e v (a) e 1 e 2 v 1 v 2 B c (v 1 ) B c (v 2 ) (b)
Fig. 3: Explaining restrictions on speed limits Second, we call an ADS state ⟨st o ⟩ o∈O consistent with limit positions ⟨c.π⟩ c∈C iff for every vehicle c ∈ C:

the limit position is ahead of the current vehicle position, that is, c.p ≤ c c.π, there is no stop sign located strictly between the current vehicle position and the limit position, that is, c.p < c so.p < c c.π does not hold for any stop so, the limit position conforms to the speed limits of the current edge (e 1 The next proposition states the correctness of the free space policy constructed from traffic rules. The proof is provided in [START_REF] Bozga | Correct by design coordination of autonomous driving systems[END_REF].

Proposition 2. The free space policy respects the safety contract for the Runtime provided the initial ADS state is consistent with initial limit positions.

Discussion

The paper studies results for the correct by design coordination of ADS based on assume-guarantee contacts. The coordination follows a two-step synchronous interaction protocol between vehicles and a Runtime that, based on the distribution of vehicles on a map, computes the corresponding free spaces. A first result characterizes safe control policies as the combination of assume-guarantee contracts for vehicles and the Runtime. This result is then specialized by showing how policies consistent with their respective contracts can be defined for vehicles and the Runtime. In particular, for vehicles, we provide a principle for defining speed policies and, for the Runtime, we compute free space policies that conform to a set of traffic rules. The results are general and overcome the limitations of a posteriori verification. They can be applied to ADS involving a dynamically changing number of vehicles. In addition, they rely on a general map-based environment model, which has been extensively studied in [START_REF] Bozga | Specification and validation of autonomous driving systems: A multilevel semantic framework[END_REF]. Control policies for vehicles and the Runtime can be implemented efficiently. In particular, the speed policy has been tested in various implementations [START_REF] Wang | Safe and efficient collision avoidance control for autonomous vehicles[END_REF][START_REF] Wang | A hybrid controller for safe and efficient collision avoidance control[END_REF] and found to be not only safe, but also closer to the optimum when refining the space of possible accelerations.

Note that the results can be extended with slight modifications to maps where the segments are curves or regions to express traffic rules involving properties of two-dimensional space, for example for passing maneuvers. For example, if we consider region maps, their segments will be regions of constant width centered on curves. Itineraries, free spaces and B(v) will be regions. The relationship B(v) ≤ f becomes B(v) ⊆ f and the addition of lengths of segments should be replaced by the disjoint union of the regions they represent. The speed control policy will remain unchanged in principle but will need a function computing the distance travelled in a region. Finally, the runtime verification of the disjointness of free spaces may incur a computational cost depending on the accuracy of the region representation.

The presented results provide a basis for promising developments in several directions. One direction is to extend the results to achieve correctness by design for general properties. We have shown that traffic rules, which are declarative properties of vehicles, can be abstracted into safety constraints on free spaces. In this way, we solved a simple synthesis problem by transforming a "static" constraint on vehicle speed into a "dynamic" constraint on shared resources.

An interesting question that should be further investigated, is whether the method can be extended to more general properties involving the joint obligation of many vehicles. For example, we can require that for any pair of vehicles c 1 and c 2 that are sufficiently close, the absolute value of the difference between their speeds is less than a constant k, i.e., |c 1 .vc 2 .v | ≤ k. This can be achieved by a free space constraint that gives more free space to the vehicle with the lower speed, assuming that vehicle speed policies are not "lazy" and use as soon as possible the available space.

For general properties involving more than one vehicle, it seems realistic to translate them directly into free space constraints that will enforce the constraints processed by the Runtime to ensure the safe control policy. In particular, in addition to safety properties, we could devise free space policies that optimize criteria such as road occupancy and uniform separation for a given group of vehicles e.g. platoon systems studied in [START_REF] El-Hokayem | A layered implementation of DR-BIP supporting run-time monitoring and analysis[END_REF]. Note that achieving non-blocking control is such a property that involves the application of occupancy criteria.

Another direction is to move from centralized to distributed coordination with many runtimes. It seems possible to partition traffic rules according to the geometric scope of their application, e.g., a specific runtime could control access to each junction. Finally, the Runtime can be used as a monitor to verify that the vehicle speed policies of an ADS are safe and respect the given traffic rules.

  s||} of positions defined by a metric graph. Note that positions (e, 0) and (e, ||e.s||) are considered equal respectively to positions • e and e • . We denote by p s -→ G p ′ the existence of an s-labelled edge ride between succeeding positions p = (e, a) and p ′ = (e, a ′ ) in the same edge e whenever 0 ≤ a < a ′ ≤ ||e.s|| and s = e.s[a, a ′ ]. Moreover, we denote by p s ↝ G p ′ the existence of an s-labelled ride between arbitrary positions

Fig. 2 :

 2 Fig. 2: General ADS architecture

Proposition 1 .

 1 Moreover, the vehicle position and the itinerary are updated according to the travelled distance by taking c.p ′ such that c.p c.it[0,c.δ ′ ] ↝ c.p ′ and c.it ′ = c.it[c.δ ′ , -]. Furthermore, the waiting time c.wt is updated bt taking c.wt ′ def = c.wt + ∆t if c.v = c.v ′ = 0 and c.wt ′ def = 0 otherwise. The region-based speed policy respects the safety contract for vehicles if the braking function is B

  Furthermore, for a vehicle c ∈ C and non-negative δ let c.p ⊕ c δ denote the future position of c after traveling distance δ, that is, either c.p if δ = 0 or the position p ′ such that c.p c.it[0,δ] ↝ p ′ . We extend ⊕ c to arbitrary future positions of c by taking (c.p ⊕ c δ) ⊕ c δ ′ def = c.p ⊕ c (δ + δ ′ ) and we consider the total ordering

  (a)), for any consecutive edges e 1 , e 2 holds B c (e 1 .v ) ≤ ||e 1 || + B c (e 2 .v ), for any vehicle c ∈ C (see Figure 3(b))

e 2 )

 2 ) and next edge (e 2 ) on the itinerary of c, that is, d(c.p, c.π) ≤ B c (e 1 .v ) and d(c.p, c.π) ≤ d(c.p, • + B c (e 2 .v ).

1 enforcing safety distance between following vehicles c 1 and c 2 :

2 coordination within all-way-stop junctions: (i) safe braking of vehicle c 1 approaching a stop so 1

waiting before the respective stops so 1 , so 2 and c 2 waited longer than c 1 then c 1 has to stay stopped

waiting before the respective stops so 1 , so 2 the same amount of time and c 2 is at an entry with higher priority then c 1 has to stay stopped

3 coordination using traffic-lights: if vehicle c 1 meets a red traffic light lt 1 , it will remain in safe distance

4 priority-based coordination of two vehicles c 1 and c 2 whose itineraries meet at merger vertex u:

c 2 are reaching u and c 1 has less priority than c 2 then c 1 must give way

5 enforcing speed limits for vehicle c 1 : (i) if c 1 is traveling in an edge e then its speed should be lower than the speed limit □ ∀c 1 . ∀e. c 1 @e ⟹ N c 1 .v ≤ e.v (ii) if c 1 is approaching an edge e then it controls its speed so that it complies with the speed limit at the entrance of e □ ∀c 1 . ∀e.

Table 2: Traffic rules

or speed limitation constraints requiring that the speed c 1 .v does not exceed a given limit value.

Note the difference with other approaches using unrestricted linear temporal logic, with "eventually" and "until" operators, to express traffic rules, e.g. [START_REF] Bozga | Specification and validation of autonomous driving systems: A multilevel semantic framework[END_REF]. We have adopted the above restrictions because they closely characterize the vehicle safety obligations in the proposed model. Furthermore, as we show below, traffic rules of this form can be translated into free space rules that can reinforce the policy managed by the Runtime.