Ludwig Thomeczek

Tilmann Ochs

Gernot Hillier

Security Analysis of Linux Kernel Features for Embedded Software Systems in Vehicles

Keywords: security, safety, embedded, vehicle, operating systems, Linux

This paper describes different safety and security mechanisms implemented in the Linux kernel to prevent and protect against accidental or malicious misbehaviour in user applications.

First, we present a generic system model for user applications with different levels of criticality and deterministic behaviour. From this, a theoretical model for failure modes and attack scenarios on the stability of the operating system and concurrently executed user applications is derived. Then, technologies in the Linux kernel to counter the identified failure modes and attack scenarios are examined and compared.

Current work in progress is to implement requirement-based tests for these security measures and assess their effectiveness, efficiency and limits.

I. INTRODUCTION

W ITH the on-going miniaturization and improvement both in computing power and energy efficiency, electronics in vehicle systems become more integrated and connected. Real-time reporting of process metrics and the ability to alter system settings as well as remote servicing and software updates often call for connection to remote corporate networks, commonly realised via internet connections. This presents a challenge to current vehicle software and hardware designs, which are optimized for safe deterministic behaviour and small footprint size to run in an embedded environment where CPU power and memory are scarce (either due to cost savings, energy concerns or the plain size requirements).

Often new features and services are introduced into these conventional vehicle systems without proper understanding of their implications. In industrial systems, this removal of the air gap between embedded systems and the internet to allow remote access is one of these features. As certain systems never were designed to run in any other environment than a hermetically-sealed network, several prominent industrial SCADA vendors had to deal with vulnerabilities exposing complete power plants and other apparel on the internet for everybody to control [CER] [SE].

With more powerful hardware and an ever-increasing amount of features needed, software designs for new industrial and vehicle components include general-purpose operating systems, in contrast to the traditional software designs with specialised real-time operating systems or bare-metal applications, i.e., application code directly accesses the hardware without using a hardware abstraction layer. General-purpose operating systems provide up-to-date security mechanisms, and useful features for new technological trends, such as Internetof-Things, Industry 4.0 or Industrial Internet.

An established and widely-used general-purpose operating system is the Linux kernel and its surrounding software ecosystem, often just referred to as Linux or GNU/Linux. As Linux is deployed in systems with a wide range of computing capacities, from large HPC systems to low-power mobile phones, the Linux kernel is versatile and can be extensively adapted for various use cases. Its source code and documentation is provided under an open-source license and is continuously developed for over 20 years.

It can readily be adapted to be deployed onto embedded computers that provide relatively low computing power, comparable to current low-end smartphones. These embedded computing units (CU) are integrated into a certain system environment. In this paper, the assumed system environment is a vehicle, but we recognised that many insights also apply to other industrial environments. The assumed system environment is a network of embedded computers and devices, such as internet gateways or control computers.

The paper's main focus are means for configuration of the Linux Kernel to achieve a safe and secure system in the assumed environment. In this paper, we limit the scope of our analysis: we assume the use of an Preempt-RT Linux kernel and we do not consider special-purpose hardware, hard-disk encryption, redundant disk storage and the bootloader.

II. THEORETICAL MODEL BASED ON POSIX

Figure 1 shows a schematic representation depicting a basic system with the most important interacting entities.

Several processes running on the platform (labeled P 1 ,P 2 . . . P N ) are executed simultaneously with multicore and preemptive symmetric multiprocessing (SMP) scheduling. The kernel controls all external interactions, hardware accesses and execution flow of these processes.

Applications request hardware access from the kernel using abstract functions defined by the POSIX API, e.g., the pthread or signals API. For interaction with the storage devices (DISK), the kernel provides a file system (Files) with the corresponding abstract functions to the processes. To use networking hardware (NET) and access the connect networks, Berkeley sockets (Sockets) are presented to the application.

While the underlying hardware may be different depending on the platform, the POSIX abstraction provided to the applications stays the same. For CPU or memory, no abstractions are presented. Each application is agnostic to other running processes, as the kernel and the MMU arrange everything for the application to perceive as if it is the only one running on the system. This is indeed a gross oversimplification, but the separate address space and the interrupt behaviour that facilitate this are commonly not perceived by the application.

III. TECHNICAL USE CASES

Based on the system model from section II and the context provided in I, the main system workflow is built around the following key use cases.

A. SMP Software Execution

The basic state of the system as depicted in Figure 1 consists of the processes P 1 , P 2 , . . . P N running on the system, sharing the common resources.

Managing the usage of these is the applications responsibility, the OS only providing upper boundaries. As all applications assume that they are the only running program on the system, the kernel has to provide the SMP scheduling functionality by rotating control of the CPU between the currently executing processes.

B. Filesystem Usage

Using the filesystem abstraction to access data stored on the disk is one use case.

Configuration data, executables and other data needs to be stored permanently on the system, and applications need to read and write this data. Access to this data is provided with the POSIX filesystem abstraction, which the kernel then translates to disk read/writes.

C. External Communication

Programs running on the system often actively need to establish connection to external services, mostly IP-based connection through common internet infrastructure. Furthermore, external services often need to contact the running processes and request information or send control commands. Examples for this use case are system updates, cloud-based synchronisation or remote control services.

D. Internal Communication

As seen in the context model(section I), the CU is not the only control component in the vehicle. Therefore, another use case is communication to other CUs, actuators or sensors on the same vehicle. In this environment, real-time boundaries may apply to some of these communication paths.

E. Machine-Local Communication

Several different software components will be running simultaneously on the CU represented by the processes P 1 ,P 2 . . . P N , thus internal communication between the processes needs to be available.

IV. SAFETY ANALYSIS

The safety analysis is not the main focus of this paper. Hence, only the most relevant requirements for the Linux kernel are highlighted here. The assumed safety requirements are:

1) Correct software code execution 2) Correct integration and execution of hardware acceleration 3) Correct execution of POSIX API calls and kernel functions 4) Freedom from interference between POSIX API calls and kernel functions 5) Freedom from interference between software components 6) Freedom from interference between hardware components For this paper, correct integration and execution of hardware acceleration is out of scope. Correct software or Kernel/POSIX call execution (Items 1 and 3) can only be proven through formal verification and validation, or a sufficient trust level can be achieved with thorough testing. Freedom from interference by POSIX calls or kernel functions may need to be tested and handled on the source-code level. Freedom from interference between software components (Item 5) is analogous to the SMP use-case described in section III-A. For the last two safety requirements (Items 5 and 6), there exist several technologies in the Linux kernel that may help provide them. We discuss these in the next section.

Freedom from interference between software components: One of the OS scheduler's main objective is to guarantee interruption-free execution of high-priority tasks. To optimize for the specific real-time requirements, programs requiring realtime scheduling have to run at highest priority under a realtime-capable scheduler (SCHED FIFO or SCHED RR) [KZL+].

To further minimize unexpected latencies due to migrations between cores, the program can be pinned to a specific CPU core, isolated from other processes [Core Isolation].

To prevent memory or CPU cycle shortage due to demands by other tasks, the cgroup controllers for cpusets, memory and block IO can enforce limits for other processes [CGroups]. Freedom from interference by hardware components: The Linux kernel can only slightly reduce the hardware's influence because many components work independently (e.g., DMA controllers, network cards) and may interrupt the CPU or block other resources at any time.

One possibility to minimize interruptions by hardware is to mask interrupts on a CPU core running real-time critical software. The interrupts then are handled on a different core and hence, do not interrupt critical code. However, not all interrupts can be masked [Core Isolation].

V. SECURITY ANALYSIS For the security analysis, we determine assets and threats with the STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege, the threats used in the analysis) approach.

The threat modeling approach STRIDE developed by Microsoft models a system and its threats from an attacker's perspective by representing the system with a Data Flow Diagram (DFD). Elements in this diagram (either a process, data flow, data store or interactor) reside inside securityrelevant regions that are separated by trust boundaries. Data flows may cross these trust boundaries. However, if they do they are especially prone to threats.

Following a first draft of the diagram, the processes and stores are either further broken down into sub-diagrams until a desired level of complexity is reached, or analysed directly according to their corresponding STRIDE threats. The DFD in Figure 2 depicts some of the assets examined in this analysis, based on the use cases defined in Section III-C. For each use case, we perform a basic security analysis.

Further detailed information about the STRIDE approach is described in [HLOS].

Based on the DFD in Figure 2, we review all components against the applying STRIDE metrics. For example, the "Framework" process in the DFD is vulnerable to all STRIDE threats, and we evaluate for mitigations. For example, picking tampering (the T in STRIDE) as a threat, which in this case most likely happens through buffer overflow or similar memory tampering techniques on running processes, we search for available technologies to counter that threat, in this case ASLR or DEP. We repeat this for the remaining threats (SRIDE), and all other elements of the DFD. Ultimately, we achieve a certain level of security by applying mitigations for each threat. If a higher confidence is required, the components and the DFD can be further refined and re-examined. A full analysis covering all use cases and DFD elements will be described in the author's master thesis.

VI. TECHNOLOGIES

This section provides an condensed overview of most safety and security features present in the kernel that were identified in the analysis.

Adress Space Layout Randomisation

ASLR is a mitigation technique to reduce the probability of a successful exploitation of buffer overflow weaknesses.

Control Groups

Cgroups are a Linux kernel subsystem to partition tasks into different logical groups. These groups then can be subjected to rules regarding resource consumption or allocation.

Core Isolation

Real-time critical programs can be isolated onto one CPU core and interrupts generated by the hardware can be routed to CPU cores not assigned to real-time critical program execution to minimize program execution interruptions.

Data Execution Prevention and W⊕X

DEP encompasses several features to prevent the execution of memory that is not designed to be executable, such as static data segments or program buffers. This protects against attacks which insert malicious code and trick the program into executing it. W⊕X is the principle to never allow writeable memory to be executable at the same time, preventing effective code injection.

Dm-verity

Dm-verity provides block-based integrity checking for readonly filesystems.

Grsecurity

Grsecurity is an extensive patchset for the Linux kernel to improve its resilience against known attack vectors, adding a Role-based Access Control system (RBAC), chroot restrictions and a wide array of miscellaneous hardening features.

Integrity Measurement Architecture / Extended Verification Module

The IMA/EVM subsystem provides file-level monitoring against accidental or malicious changes.

Linux / Posix Capabilities

Capabilities in Linux implement a least privilege principle for processes needing superuser access by allowing finer granularity granting rights.

Linux Security Modules

With Linux security modules, the kernel implements a framework to allow the inclusion of one or several security extensions facilitating Mandatory Access Control (MAC), RBAC or other access control mechanisms that restrict access to internal kernel objects.

Namespaces

Namespaces are a Linux-specific resource isolation feature to compartmentalize system resources, such as Process IDs or networks.

Secure computing filters

Secure Computing (Seccomp) Filtering allows to restrict the use of system calls by processes through a Berkeley Packet Filter (BPF)-based program language, minimizing the kernel's attack surface.

VII. EVALUATION OF SELECTED FEATURES

Current work in progress is to cover the selected kernel features chosen from the techniques described in section VI in-depth, extending and completing the initial assessment. This includes prototypes and tests designed to test the effectiveness, impact on system efficiency and deployment footprint.

A. Test Program Design and Implementation

The test program for the effects of the different kernel configurations/technologies is shown schematically in Figure 3. Each circle depicts a running process: Listener and Tester run on the machine under test; the Client process runs on a testing machine. (1) To take a measurement, the client sends a request for a test run to the listener process, noting the timestamp.

(2) The Listener accepts the request on the network side and passes it through to the Tester via Inter Process Communication (IPC). (3) The tester then runs the interruption/preemption test to check for any occuring interruption that could occur while an algorithm is processing data for a response. (4) After a successful test run, the Tester replies to the Listener, which (5) then notifies the Client. The client again takes a timestamp, computes the difference with the first timestamp to acquire the elapsed runtime, and stores it in a histogram. (6) After a specified time, the test run is started again until a sufficient number of measurements are obtained.

After finishing the test runs, the client requests the interruption histogram from the server and stores it locally for further analysis. This test program depends highly on the type of machine both tested server and testing client are deployed on, and results are only comparable, when one parameter is changed between test runs on the same hardware setup.

So far, as of the time writing this workshop proposal, the tests have not been performed on the target system, and there is no evaluation to present at the current stage. However, we expect to present tests and an evaluation in time for the workshop in September, and update this paper if possible. VIII. RELATED WORK Most security assessments are done with a concrete product in mind and usually not published as they are considered differentiating intellectual property of the assessors. Hence, we believe that as a consequence, the development of a more generic security analysis of an abstract system model has not been in the main focus of current security assessments. Our paper provides a basic analysis to argue the use of certain Linux kernel features for security means. As the Linux kernel is open-source software, there is also a large amount of literature describing the Linux kernel in versatile technical depth. Considering security features, we are only aware of the kernel developer James Morris' overview of the Linux kernel's security features [MORR].

IX. CONCLUSION

We have describe a generic system model, derived possible attack vectors on this system model and selected the different safety and security mechanisms implemented in the Linux kernel to prevent and protect against these possible attacks. In our current work in progress, we are implementing tests for these safety measures and evaluate their effectiveness, efficiency and limits.

With our effort to make these preliminary results and work in progress public, we hope to provide first steps for a generic and common security assessment for future vehicles, which can be publicly assessed by security experts. This collaborative activity hopefully increases the security in all vehicles and reduces damage and harm of the public due to compromised remote-controlled vehicles.

  Fig. 1. POSIX based system model

  Fig. 2. External Communication Threat Model

  Fig. 3. Test Program Schematic


Michel Planat
email: michel.planat@femto-st.fr

Geometry of contextuality from Grothendieck's coset space

Keywords: numbers: 03.65Aa, 03.65.Fd, 03.67.-a, 02.20.-a, 02.10.Ox MSC codes: 11G32, 81P13, 81P45, 51A45, 14H57, 81Q35

The geometry of cosets in the subgroups H of the two-generator free group G =< a, b > nicely fits, via Grothendieck's dessins d'enfants, the geometry of commutation for quantum observables. Dessins stabilize point-line incidence geometries that reflect the commutation of (generalized) Pauli operators [Information 5, 209 (2014); 1310.4267 and 1404.6986 (quant-ph)]. Now we find that the non-existence of a dessin for which the commutator (a, b) = a -1 b -1 ab precisely corresponds to the commutator of quantum observables [A, B] = AB -BA on all lines of the geometry is a signature of quantum contextuality. This occurs first at index |G : H| = 9 in Mermin's square and at index 10 in Mermin's pentagram, as expected. Commuting sets of n-qubit observables with n > 3 are found to be contextual as well as most generalized polygons. A geometrical contextuality measure is introduced.

Introduction

Never ask for the meaning of a word in isolation, but only in the context of a sentence (Gottlob Frege, Grundlagen der Arithmetik, 1884).

There is no quantum world. There is only an abstract quantum physical description. It is wrong to think that the task of physics is to find out how Nature is. Physics concerns what we say about Nature [Niels Bohr, Spoken at the Como conference, 1927].

The lack of commutativity of quantum observations gives rise to the concept of contextuality, a kind of impossibility to recover the quanta of reality irrespectively of our words for describing it. In a nutshell, Kochen-Specker theorem states that contextuality is needed to reproduce all quantum mechanical predictions on a d-dimensional (d > 3) system [START_REF] Kochen | The problem of hidden variables in quantum mechanics[END_REF]. Since this foundational no-go theorem was discovered, many quantum systems carrying quantum contextuality have been displayed, see [START_REF] Waegell | Parity proofs of the Kochen-Specker theorem based on the 120-cell[END_REF][START_REF] Howard | Quantum Contextuality with Stabilizer States[END_REF][START_REF] Spekkens | The status of determinism on proofs of the impossibility of a noncontextual model of quantum theory[END_REF] for a recent hint. One of the most transparent contextuality proofs consist of particular sets of observables in a four-dimensional (two-qubit) or in a eight-dimensional (three-qubit) system, through the geometries of Mermin's square and pentagram, respectively [START_REF] Mermin | Hidden variables and two theorems of John Bell[END_REF][START_REF] Planat | On small proofs of the Bell-Kochen-Specker theorem for two, three and four qubits[END_REF]. Contextuality in such systems was shown to be experimentally testable [START_REF] Cabello | Experimentally Testable State-Independent Quantum Contextuality[END_REF].

We recently found a mathematical scheme giving rise to the aforementioned geometries as well as many related ones [START_REF] Planat | It from qubit: how to draw quantum contextuality[END_REF]- [START_REF] Planat | Drawing quantum contextuality with 'dessins d'enfants[END_REF]. Our work is based on Grothendieck's great insight about the relationship between algebra, geometry and topology, called by him dessins d'enfants [START_REF] Grothendieck | Sketch of a programme[END_REF] ‡. In the present note, the elusive 'contextual' geometries are given a precise definition. We compare the (ring) commutativity of observables and the (group theoretical) commutativity of cosets that both coordinatize the vertices of the relevant geometry. We find that the non-existence of a dessin for which the coset commutator (a, b) = a -1 b -1 ab exactly corresponds to the commutator of observables [A, B] = AB -BA on all lines of the geometry is a convincing signature of quantum contextuality. In this definition, contextuality arises first for 9 and 10 vertices like in Mermin's point-line configurations.

In Sec. 2, we shortly explain how the two-generator free group and its subgroups are given the coset structure of a Grothendieck's dessin d'enfant D, how a D may stabilize a point/line geometry G, then we introduce our criterion for geometrical contextuality. In Sec. 3, we fully explicit the algebraic/topological/geometrical meaning of small nontrivial dessins in relation to their (non-)contextuality, including the case of Mermin's structures. In Sec. 4, it is shown how contextuality arises in maximum sets of commuting operators starting with the 4-qubit case. Finally, in Sec. 5, a geometrical contextuality measure is introduced and applied to generalized polygons.

Coset coordinates, dessins d'enfants and finite geometries

Let F = a, b be the free group on two generators. Elements in the group are words u, that are products of elements of F and their inverses modulo the only defining relation uu -1 = e, with e the identity element. In the following, we restrict to the free group G = a, b | b 2 = e , which accounts for an extra involution b. The index n := |G : H| of a subgroup H in G counts the number of cosets/copies of H that fill up G. A right coset with respect to an element g ∈ G is defined as Hg = {hg : h ∈ H}. The set of right cosets partitions G. In other words, every g ∈ G belongs to just one right coset. Similar statements holds for left cosets.

A transversal is an indexed set of (right) coset representatives for H in G, and the coset table is a way to express the action of generators a, b and of the non-trivial inverse a -1 on them. The algorithm performing this task is the Coxeter-Todd algorithm [START_REF]Handbook of Magma functions[END_REF]. Under the action of a and b, the indexed coset representatives are represented by a two-generator permutation group P = g 0 , g 1 . The latter corresponds to a map on a compact orientable surface that is, a triple (g 0 , g 1 , g ∞ ) with g 0 g 1 g ∞ = 1, from which the V vertices, E edges and F faces of the map are defined by the cycles of g 0 , g 1 and g ∞ [START_REF] Jones | Theory of maps on orientable surfaces[END_REF][START_REF] Lando | Graphs on surfaces and their applications[END_REF]. Grothendieck was enthusiastic in seing such a map as a bicolored map D, also called an hypermap [START_REF] Walsh | Hypermaps versus bipartite maps[END_REF], with B black vertices and W white vertices, in such a way that the adjacent vertices have always opposite color and the corresponding segments ‡ For another mathematical approach of quantum contextuality based on sheaf theory, the reader should look at [START_REF] Abramsky | The sheaf-theoretic structure of non-locality and contextuality[END_REF] and the references therein.

are the n edges [START_REF] Grothendieck | Sketch of a programme[END_REF]. For bicolored maps derived from G, the valency of white vertices is ≤ 2. The resulting dessin d'enfant is endowed a natural topological structure with Euler characteristic 2 -2g = B + W + Fn, where g stands for the topological genus.

Grothendieck also recognized a dessin as an object defined over the field Q of algebraic numbers as a complex algebraic curve. Technically, given f (x), a rational function of the complex variable x, a critical point of f is a root of its derivative and a critical value of f is the value of f at the critical point. Let us define a so-called Belyi function corresponding to a dessin D as a rational function f (x) of degree n embedded into the Riemann sphere Ĉ in such a way that (i) the black vertices are the roots of the equation f (x) = 0 with the multiplicity of each root being equal to the degree of the corresponding (black) vertex, (ii) the white vertices are the roots of the equation f (x) = 1 with the multiplicity of each root being equal to the degree of the corresponding (white) vertex, (iii) the bicolored map is the preimage of the segment [0, 1], that is D = f -1 ([0, 1]), (iv) there exists a single pole of f (x), i. e. a root of the equation f (x) = ∞, at each face, the multiplicity of the pole being equal to the degree of the face, and (v) besides 0, 1 and ∞, there are no other critical values of f . In addition, the coefficients of Belyi functions are algebraic numbers [START_REF] Lando | Graphs on surfaces and their applications[END_REF].

Finally, the coset structure and its permutation representation (by a dessin d'enfant) provide a coordinatization to many point-line geometries occuring in the investigation of commutation of quantum observables [START_REF] Planat | It from qubit: how to draw quantum contextuality[END_REF]- [START_REF] Planat | Drawing quantum contextuality with 'dessins d'enfants[END_REF]. Taking the permutation group P (it identifies a dessin D) corresponding to a subgroup H of G, one proceeds by first listing the m non-isomorphic subgroups S m stabilizing a pair of elements/cosets. Given a S m , all points on a line of the putative geometry G m should share the same two-point stabilizer subgroup of P . The lines of a G m are thus distinguished by their (isomorphic) stabilizers acting on different G-sets. Doing this, the cosets happen to coordinatize the edges of the D and, at the same time, the vertices of the resulting geometries G m .

Identifying commutation for cosets and for observables: contextuality

The key point, not recognized by us before, is that, not only there should exist a bijection between a point-line geometry G m stabilized by a dessin D and the point-line geometry occuring in a set of quantum observables (quantum observables as cosets), but the commutation structure in both cases should also correspond (commuting operators on a line as commuting cosets). While the commutator [A, B] = AB-BA for observables A and B is that for a ring, the commutator for the representative of two cosets a and b is the group theoretical one (a, b) = a -1 b -1 ab. We identify a contextual geometry as one where at least one line of p points/cosets fails to satisfy the 'commutation law' (a 1 , a 2 , . . . , a p ) = e whatever the ordering of cosets. Observe that, in our definition of non-contextuality, we do not ask the commutation of all pairs of cosets but that of their product.

A few non-contextual and contextual geometries are described at the next section.

The smallest index contextual geometry is recognized to be a 3 × 3-grid (a Mermin square of observables) as it could have been expected.

From non-contextual to contextual point-line geometries

Recovering the octahedron

Let us apply our approach to a very simple geometry, that of the octahedron O whose 'lines' are the triangles. There exist 56 subgroups of index 6 in G and, while many of the corresponding dessins may be used to recover O, most of them are of the contextual type. For instance, the permutation group P 1 =

(1, 2, 3)(4, 5, 6), (2, 4)(3, 5) [where the G-set {1, 2, 3, 4, 5, 6} is an ordered set of indices for the transversal {e, a, a -1 , ab, a -1 b, aba -1 }] can be used to recover O as shown in Fig. 1 (i). The cosets that serve as coordinates of the edges of the dessin and as coordinates of the vertices of O are shown. In this setting, only the triangles above the square in O have their coordinates satisfying the commutation law so that the dessin is of the contextual type.

Since the dessin for P 1 is of a small size, it is an easy task to derive its corresponding Belyi curve as

f 1 (x) = - 1 64x 3 (x -1) 3 (x + 3) 2 .
To see this, take the derivative f ′ 1 (x) = 3(x -1) 2 (x + 3) 2 (x 2 + 3)/(64x 3 ). The critical points are the black points at x = 1 and x = -3 ( where the valency is 3) and the white points at x = ±i √ 3 (where the valency is 2). Then, solving the equation f 1 (x) = 0, one gets of course the two solutions x = 1 and -3 corresponding to the black points while solving for f 1 (x) = 1 one gets the critical (white) points at x = ±i √ 3 and the real (white) points at x = -3 ± 2 √ 3. Hence the coordinates of vertices of the dessin are those shown in Fig. 1 (i). The two solutions of the equation f 1 (x) = ∞ are x = 0 and x = ∞, they correspond to the center of the faces.

Besides P 1 , there are four permutation groups P isomorphic to the group Z 2 × Z 6 that may be used to recover O. Two of them are tree-like as is the dessin shown in [9, Fig. 2] and one can check that they are of the contextual type. The other two are non-contextual as the one shown in Fig. 1 (j) where the permutation group is P 2 = (1, 2, 4, 6, 5, 3), (2, 3)(4, 5) [here the G-set {1, 2, 3, 4, 5, 6} is an ordered set of indices for the transversal {e, a, a -1 , a 2 , a -2 , a 3 }]. The Belyi curve for this dessin is easily found as

f 2 (x) = 4 27 x 6 (x 2 -1) 2 ,
and this function allows to coordinatize the vertices of the dessin in Fig. 2 (j).

Observe that all coordinates of both dessins in Fig. 1 live in the extension field Q( √ 3).

Recovering the n-simplex and the 2r-ortoplex

In our earlier work, we found that there exist many dessins D of index n stabilizing the n-simplex and, when n is even (n = 2r), also stabilizing the r-orthoplex: the smallest orthoplex structures are the square, the octahedron and the 16-cell for which r = 2, 3 and 4, respectively [10, Table 1]. The vertices in these trivial structures can always be coordinatized in terms of single-generator cosets a q , for some q ∈ Z and |q| ≤ n/2. The commutator of every pair of cosets is thus the identity so that the n-simplex and the r-orthoplex are of the non-contextual type.

Recovering geometries of small index

In this line of thoughts, the first connected and non-trivial geometries that are D-stabilizable are the bipartite graph K(3, 3), the Fano plane and the bipartite graph K(4, 4) corresponding to the index (the number of vertices) 6, 7 and 8, respectively.

As for the graph K(3, 3) and stricto sensu, we found no dessin D built from the free group G and that respects the non-contextual definition that the edges of the graph are defined by commuting cosets. But there exists an hypermap built on the general free group F = a, b that satisfies the latter constraint as shown on Fig. 2 (i).

As for the Fano plane, there exists a map and a single-generator and non-contextual given three-qubit coordinates in such a way that the product of operators on a thick line is minus the identity matrix, see [START_REF] Planat | Distinguished three-qubit 'magicity' via automorphisms of the split Cayley hexagon[END_REF] for all such configurations.

coset coordinatization shown in Fig. 2 (j). Then, a dessin d'enfant D stabilizing the bipartite graph K(4, 4) in terms of two-generator cosets and in a non-contextual way is shown in Fig. 2 (k).

Recovering contextual geometries

The smallest size and contextual point-line geometry (in the sense of our definition in Sec. 2) is the (3 × 3)-grid, also known as Mermin's square in honor of D. Mermin who made use of it to prove the Kochen-Specker theorem in the four-dimensional Hilbert space [START_REF] Mermin | Hidden variables and two theorems of John Bell[END_REF][START_REF] Planat | On small proofs of the Bell-Kochen-Specker theorem for two, three and four qubits[END_REF]. There exists a unique (genus 1) map stabilizing the Mermin's square shown in Fig. 3 (i) (also pictured in [9, Fig. 7]). There are two subgroups S 1 ∼ = Z 1 (a singleelement group) and S 2 ∼ = Z 2 (a two-element group) stabilizing a pair of elements in the permutation group attached to the dessin. Both stabilizer subgroups lead to Mermin squares that are skewed to each other. The former one is non-contextual that is the cosets on the lines/triads of the grid are commuting (not shown); the other grid is contextual as shown at the bottom of Fig. 3 (i) in that the right column does not had all his triples of cosets commuting. This observation establishes a striking parallel with the proof of the Kochen-Specker theorem based on this geometry. It does not come as a surprise that two other D-stabilized geometries of index 9, the Pappus and Hesse configurations, that contain the (3 × 3)-grid, are also found to be contextual. But the multipartite graph K(3, 3, 3) admits a two-generator non-contextual dessin (not shown).

For the index ten, there are four non-trivial graph/configurations that may be Dstabilized. The Petersen graph and the Mermin's pentagram corresponds to two distinct stabilizer subgroups S i , (i = 1..2) of the permutation group P for the relevant D, see [START_REF] Planat | Drawing quantum contextuality with 'dessins d'enfants[END_REF]Fig. 10]. Another disguise of both is the Desargues configuration that can also be D-stabilized as shown in [START_REF] Planat | Drawing quantum contextuality with 'dessins d'enfants[END_REF]Fig. 11]. The last D-stabilized connected structure is the bipartite graph K [START_REF] Mermin | Hidden variables and two theorems of John Bell[END_REF][START_REF] Mermin | Hidden variables and two theorems of John Bell[END_REF]. All the four structures are contextual. In Fig. 3 (j), one plots one of the three D-stabilized pentagrams. In the corresponding dessin, one notices that coordinates on the right of the vertical axis are obtained from the ones at the left by replacing a by a -1 . The bold lines of the pentagram are those that are defective for the commutativity of the cosets on them.

Contextuality in maximum sets of commuting observables

While maximum sets of mutually commuting observables arising from the twoqubit and three-qubit Pauli group are non-contextual -they correspond to the triangle and Fano plane [START_REF] Levay | Three-Qubit Operators, the Split Cayley Hexagon of Order Two and Black Holes[END_REF] [also Fig. 2 (j)], respectively-this is no longer true for commuting sets in the general n-qubit Pauli group, n > 3.

In the four-qubit Pauli group, such a maximum set comprises 2 4 -1 = 15 operators arranged as 35 triads on which the product of operators is the identity matrix. The point/line geometry is that of the projective space P G(3, 2). We ask two questions: (i) does it exist a dessin of index 15 stabilizing P G(3, 2)? (ii) are the coset coordinates such that each line of P G(3, 2) has commuting cosets as its points? The answer to (i) is yes but the answer to (ii) is definitely no, as shown below.

For recovering/stabilizing P G(3, 2), we start from a subgroup G ′ of the free group F of finite representation G ′ = F/[b 2 = a 8 = (ba -1 ) 7 ] = 1. The selected relations at the quotient were suggested by the finite representation of the symmetric group S 8 . There are four subgroups H of G ′ of index 15 and permutation group P isomorphic to the alternating group A 7 , of cardinality 2520. The stabilizer of one point in P is the group P SL(2, 7) and that of a pair of points is the alternating group A 4 . The geometry that arises from A 4 is that of the projective space P G(3, 2). We selected the dessin that produces as many lines as possible such that their points/cosets satisfy the commutation law, only nine over the 35 have this property. Thus the three-dimensional projective space is clearly contextual. The result is illustrated in Fig. 4 with the dessin (i) and the corresponding three-dimensional projective space (j).

A similar methodology holds for P G(n, 2), n > 3, which is a model of a maximal commuting set in the (n+1)-qubit setting. For the general case, one finds that P G(n, 2) contains at least a copy of P G(n -1, 2) [a perp-set of P G(n, 2)] as a non-contextual subset.

Quantifying geometrical contextuality

Once one accepts that the coset structure of finite geometries induced by dessins d'enfants may reveal a geometrical contextuality, it is tempting to arrive at a quantification of such a contextuality. Quantifying quantum contextuality is currently an active subject [START_REF] Abramsky | The sheaf-theoretic structure of non-locality and contextuality[END_REF][START_REF] Grudka | Quantifying contextuality[END_REF][START_REF] Durham | An Order-Theoretic Quantification of Contextuality[END_REF]. From our definition in Sec. 2, a contextual finite geometry G cannot have all its lines encoded with commuting cosets. Let l be the number of lines of G and u the number of them with commuting cosets. Thus G is contextual as soon as l u > 1 so that a possible measure of contextuality is c = l-u l where 0 ≤ c ≤ 1 and c vanishes for a non-contextual geometry.

Our earlier work featured a few generalized polygons [the Mermin's square GQ(2, 1) is the smallest one] § useful for encoding the commutation law of quantum operators in § A Tits generalized polygon (or generalized n-gon) is a point-line incidence structure whose incidence graph has diameter n and girth 2n. A generalized polygon of order (s, t) is such that every line contains s + 1 points and every point lies on t + 1 lines. According to Feit-Higman theorem, the finite generalized n-gons, s, t ≥ 2, exist for n = 2, 3, 4, 6 or 8. One uses the notation GQ (for a generalized quadrangle), the generalized Pauli group. In such structures, the number h of geometric hyperplanes is known and h happens to grow with the contextual parameter l u roughly as log 2 h, GH (for a generalized hexagon) and GO (for a generalized octagon) corresponding to n = 4, 6 and 8, respectively.

A geometric hyperplane of a generalized polygon is a proper subspace meeting each line at a unique as shown in Table 1.

Table 1. Geometric contextuality measure l/u (l the number of lines and u the number of them with commuting cosets) for a few generalized polygons compared to the base-two logarithm of the number h of hyperplanes within the selected geometry. [START_REF] Frohard | Geometric hyperplanes in generalized hexagons of order[END_REF] and Fig. 6 The generalized hexagon GH(2, 2)

Geometry

The generalized hexagon GH(2, 2) (with 63 vertices and dually 63 lines/triads) is an excellent geometrical model of 3-qubit contextuality [START_REF] Levay | Three-Qubit Operators, the Split Cayley Hexagon of Order Two and Black Holes[END_REF][START_REF] Planat | Distinguished three-qubit 'magicity' via automorphisms of the split Cayley hexagon[END_REF] . The second dessin in Fig. 6 (b) is of genus 1 and signature (B, W, F, g) = (18, 36, 9, 1), it stabilizes the dual of GH(2, 2) shown in Fig. 6 (a) through the stabilizer subgroup S 2 ∼ = E + 32 (the extraspecial group of order 32). It has been recognized that the size 12096 of the automorphism group of GH(2, 2) is also the number of 3-qubit pentagrams and is related to the number of copies of hyperplanes in each class [START_REF] Planat | Distinguished three-qubit 'magicity' via automorphisms of the split Cayley hexagon[END_REF]. For this hexagon (resp. its dual), the geometrical contextuality measure l u = 21 (resp l u = 15.75) is larger than log 2 h = 14, while it is not the case for the other polygons in the table. The hexagon GH(2, 2) can be consided as 'strongly contextual' in this respect.

Conclusion

We provided a striking comparison between the commutativity of multiple qubit quantum observables and that of cosets of subgroups of the two-generator free group. This parallel allowed us to propose a new definition of contextuality based on the coset point or containing the whole line. The set of hyperplanes can be constructed in an efficient way by using an addition law for the hyperplanes: the 'sum' of two hyperplanes is just the complement of the symmetric difference in the relevant G-set of indices labelling the vertices of the geometry [START_REF] Frohard | Geometric hyperplanes in generalized hexagons of order[END_REF][START_REF] Green | The Veldkamp space of the smallest slim dense near hexagon[END_REF]. structure of Grothendieck's dessins d'enfants, in close correspondence with the standard quantum one. In particular, geometric contextuality in small generalized polygons starting with the (3 × 3)-grid was investigated. Further work may focus on identifying and quantifying contextuality in higher size geometries. Since a complex algebraic curve defined over the field Q of algebraic numbers [that is a Belyi function f (x)] [START_REF] Grothendieck | Sketch of a programme[END_REF][START_REF] Lando | Graphs on surfaces and their applications[END_REF] is attached to any dessin d'enfant D, it is expected that the contextuality criterion features specific curves through the action of the group of automorphisms Gal( Q/Q) of the field Q (the absolute Galois group) on dessins that would be helpful to recognize. We can say more about Nature than in Bohr's century. The coset language, with only two letters a and b, is enough for quantum contextuality. Even the sporadic groups enter this frame [START_REF] Planat | A moonshine dialogue in mathematical physics[END_REF].

Bibliography

Figure 1 .

 1 Figure 1. (i) A contextual hypermap (top) stabilizing the octahedron (bottom) with the corresponding coset labelling. The vertices of the dessin are in the extension field Q( √ 3) as shown. The triangles with thick lines do not have all their edges indexed with commuting cosets. (j) A non-contextual map (top) stabilizing the octahedron (bottom). The octahedron is also given a set 3-qubit coordinates that are mutually commuting at the vertices of a triangle.

Figure 2 .

 2 Figure 2. (i) A non-contextual hypermap (left) stabilizing the bipartite graph K(3, 3) (right) with the corresponding coset labelling. (j) A non-contextual map/dessin (top) stabilizing the Fano plane (bottom). (k) A non-contextual map/dessin (left) stabilizing the bipartite graph K(4, 4) (right) with the corresponding coset labelling. The graph K(3, 3) and the Fano plane are given a set of two-and three-qubit coordinates, respectively. The seven 3-qubit coordinates in the Fano plane are mutually commuting and the product of the three coordinates on any line is the identity matrix (see Sec. 4).

  Figure 2. (i) A non-contextual hypermap (left) stabilizing the bipartite graph K(3, 3) (right) with the corresponding coset labelling. (j) A non-contextual map/dessin (top) stabilizing the Fano plane (bottom). (k) A non-contextual map/dessin (left) stabilizing the bipartite graph K(4, 4) (right) with the corresponding coset labelling. The graph K(3, 3) and the Fano plane are given a set of two-and three-qubit coordinates, respectively. The seven 3-qubit coordinates in the Fano plane are mutually commuting and the product of the three coordinates on any line is the identity matrix (see Sec. 4).

Figure 3 .

 3 Figure 3. (i) A contextual map/dessin (top) stabilizing the Mermin square (bottom)with the corresponding coset labelling. The right hand side column is defective as in the original proof of Kochen-Specker theorem derived for two-qubit coordinates. (j) A contextual map/dessin (top) stabilizing Mermin pentagram (bottom). The thick lines are defective: not all of their cosets are commuting. The lines of the pentagram are given three-qubit coordinates in such a way that the product of operators on a thick line is minus the identity matrix, see[START_REF] Planat | Distinguished three-qubit 'magicity' via automorphisms of the split Cayley hexagon[END_REF] for all such configurations.

Figure 4 .

 4 Figure 4. (i) A contextual hypermap/dessin stabilizing the projective space P G(3, 2). The edges are labelled in terms of an indexed G-set and the corresponding cosets. (ii) The projective space P G(3, 2) as a model of a 4-qubit maximal commuting set. A few lines/triads inside are not drawn. Thick triads are such that their points are commuting cosets.

Figure 5 .

 5 Figure 5. The generalized hexagon GH(2, 2)(a) is stabilized by the genus zero dessin (b). Only three lines of GH(2, 2) have mutually commuting cosets (not shown).

Figure 6 .

 6 Figure 6. The dual of generalized hexagon GH(2, 2)(a) is stabilized by the genus one dessin (b). Only four lines in this dual have mutually commuting cosets (not shown).

  . The hexagon GH(2, 2) and its dual can be stabilized by dessins d'enfant. For recovering them, one can start from a subgroup G ′′ = F/[b 2 = a 4 = (ab) 7 = (a, b) 6 ] of the free group F . There are just two subgroups H of G ′′ of index 63 inducing a dessin with permutation group P of order 12096. The first dessin in Fig. 5 (b) is of genus 0 and signature (B, W, F, g) = (21, 35, 9, 0), it stabilizes GH(2, 2) shown in Fig. 5 (a) through the stabilizer subgroup S 1 ∼ = Z 3 2 ⋊ Z 2 2


Rolf Johansson Sp

The Importance of Active Choices in Hazard Analysis and Risk Assessment

Keywords: ISO 26262, hazard analysis and risk assessment, safety goals, failure models, highly automated driving

According to the functional safety standard for road vehicles, ISO 26262, the list of safety goals shall be shown to be complete. Especially when considering highly automated driving, this may lead to the formulation of very general hazardous event. On the one hand this may make it easier to show completeness, but on the other hand it may cause that too strong ASIL attributes are allocated on too much of the implementation, implying unnecessary high cost. This position paper claims that carefully chosen explicit failure models in the hazard definitions, will generally enable more cost-efficient and still safe E/E systems for road vehicles. This is especially important for highly automated driving and autonomous vehicles, where many safety goals may have an impact on a large part of the entire E/E architecture.

I. INTRODUCTION

When performing a hazard analysis and risk assessment (HA&RA) in the domain of road vehicles according to ISO 26262 [START_REF] Iso | International Standard 26262 Road vehicles --Functional safety[END_REF], it is a challenge to make the list of Safety Goals (SG) complete and correct, still not forcing the implemented functionality to become too expensive. This is a variant of the classical problem in design verification, saying that if you are not so detailed in the analysis you need instead to be conservative. The more details you put in your analysis, the smaller margins are needed. In an analogous way the HA&RA can be based on few and general hazards and situations, or a larger number of more detailed ones. In the former case the benefit is a shorter HA&RA, easier to perform and easier to show complete. The cost for this is a design that might be much more expensive because of the higher values and or/the broader implications of the safety goals. In the latter case the cost might be lower, but this requires a more elaborated HA&RA. This position paper argues that safety goal formulation, is an active choice and that it in many cases is worth the effort to be more explicit and elaborated in the HA&RA. The paper is organized as follows. In section II is argued for how to verify completeness of a HA&RA. Section III presents why it can be said that a HA&RA that is an activity that can be performed in many valid ways and thus important make a choice about. In section IV it is argued how to elaborate the HA&RA and especially identifying several hazards constituted by different tolerance margins. Section V then tells why this is extra important for autonomous vehicles, where the cost implications may be significantly higher.

Finally section VI concludes the paper and summarizes the claims of this position paper.

II. HAZARD ANALYIS AND RISK ASSESSMENT COMPLETENESS

The hazard analysis and risk assessment (HA&RA) is the activity prescribed in ISO26262 [START_REF] Iso | International Standard 26262 Road vehicles --Functional safety[END_REF] which results in a list of safety goals (SG) that together are sufficient to fulfil, in order to keep an item functionally safe. The input to this activity is the item definition which contains the functional description on which the scope of functional safety is based.

The method to reach a complete list of sufficient SGs is to first generate a complete list of hazardous events (HE), and then make sure that each of the HEs are covered by at least one SG.

A hazardous event is specific with respect both to situation and to hazard. The list of HEs can be seen as complete if it covers all combinations of situations and hazards relevant for the item of concern. Situation includes both the environmental conditions and the vehicle state. This means that it is possible to formulate dedicated HEs investigating the effect of rain, snow, darkness, road friction, road steepness, other vehicles, vulnerable road users etc, but also elaborating the effect of e.g. the ego vehicle speed.

Of course there are potentially an infinite number of possible situations that can be defined. There are several categorizations made to structure what situations to consider, both internal to companies and more publicly published, e.g. [START_REF] Martin | Investigation of the influence of non-E/E safety measures for the ASIL determination[END_REF], [START_REF] Jang | A Study on situation analysis for ASIL Determination[END_REF] and [START_REF] Verband Der Automobilindustrie E | Situationskatalog E-Parameter nach ISO 26262-3[END_REF]. A claim in this position paper is that such lists are of limited use when determining what situations to consider in a specific HA&RA.

The hazards specify how the item can fail in a potentially dangerous way. This means that the list of HEs should contain the safety-critical failing possibilities of the functionality described in the item definition.

The list of HEs can be claimed to be complete if there is no candidate HE that would require another SG not already in the list. Another way to formulate this is to say that the list of HEs needs to cover all the dimensioning cases. We do not need to list a number of combinations of hazards and situations, which would be covered by the already identified safety goals.

The above implies that a method for proving completeness of a HA&RA is to challenge it by trying to formulate more HEs. If we cannot formulate any new HE, not already covered by the list of SGs, we can conclude that we are ready with the HA&RA activity. In ISO26262 [START_REF] Iso | International Standard 26262 Road vehicles --Functional safety[END_REF], it is required in paragraph 7.4.5.1 of part 3 to verify the completeness of the HA&RA. However, there are no criteria for what is considered as a valid argument for completeness. This paper claims that a good method for verification of HA&RA completeness, is to let a review team challenge the list of HEs looking for a candidate HE that is not covered by the list of SGs. If the review team cannot identify such an HE, they may conclude completeness of the HA&RA.

III. THE HA&RA TRADE-OFF PROBLEM

The previous section elaborated the semantics of completeness of a HA&RA. However, this doesn't say anything how detailed the situations and the hazards should be defined. This position paper claims that this is always a choice, and never completely given by the item definition. For the same item definition, the length of the list of considered HEs may differ very much, all of them still fulfilling the completeness criteria.

As an example let us consider an automatic emergency brake (AEB). In a very short version there are two HEs in the list. Both consider the situation 'driving'; the one the hazard 'omission' and the other the hazard 'commission'. The situation 'driving' here will cover all possible conditions when the vehicle is driving. If we can argue that when we are not driving, neither a commission failure nor an omission failure will be considered as severe at all, we can conclude that this list of situations is complete.

When determining the ASIL attribute for these two HEs, we can argue that they both are: E4, S3 and C3. The justification for the situation 'driving' becoming E4 is obvious. This situation includes all driving situations and hence also the cases when either there is a vehicle close behind driving at high speed, or rather close in front standing still. In both these cases the controllability is very low and the severity is very high. This implies that an ASIL D attribute will be inherited to all parts of the E/E systems implementing the AEB. This in turn will put a high cost to the implementation.

An alternative HA&RA may list a number of different situations, and also more elaborated hazards. In the list of situations, it may be relevant to identify the most critical situations for the omission and the commission failures, respectively. If such critical situations (implying S3 and C3), can be identified as having a lower exposure, such a strategy is worthwhile. If we for example can argue that the situations where the AEB really saves our life (omission is S3) are quite rare (the drivers are skilled, having a safe strategy), the omission hazard will not imply an ASIL D safety goal. This means that if we can argue that the emergency situations when the actuation of an AEB really makes a difference between life and death are less frequent than E4, we will lower the ASIL D implication otherwise being the case.

We can go even further in detailing the HA&RA activity by detailing the hazards. In the above example we only consider the omission and commission failures of the AEB. This means that either the AEB works properly, exactly as intended, or it doesn't brake at all when needed, or it fully activates the braking in an improper situation. What if the omission is not complete, but only, for example, a little bit too late in the brake activation? In the simple list of hazards only containing omission and commission, we consider only the cases that either everything is OK or it doesn't work at all. It might be fruitful also to introduce some margins in which we still consider it as jeopardizing safety, but requiring lower risk reduction.

For an AEB, a hazard of a too late activation by 0,1 s may include potential consequences of collisions, but the impact speed may be limited causing the maximal severity to be lower as well. If we foresee the design solutions to become very expensive to claim full timeliness with high ASIL, it might be a good idea to specifically address a limited timing failure by a SG having a lower ASIL attribute than a complete omission failure.

Which Hazards to detail, and how, is a design choice. This paper claims that it should be an active choice to what detail the hazards are formulated in the HA&RA.

IV. TOWARDS MORE DETAILED HAZARDOUS EVENTS

The Hazop guide words [START_REF] Iec | International Standard 61882 Hazard and operability studies (HAZOP studies) -Application guide[END_REF] are in most cases an efficient way to find candidates for detailing the hazards. By starting with the functionality claimed in the item definition, applying the Hazop guide words may in most cases become candidates for more detailed hazards. For the guide words implying quantifications like 'too much', 'too little', 'too late', and 'too early', it is also a good idea to consider several intervals.

In our timing failure in the AEB example above, we could have three failure boundaries: less than 0,04 seconds too late resulting in QM, less than 0,10 seconds causing ASIL A, less than 0,25 seconds ASIL B, and arbitrary timing failures implying ASIL C. All of these will become dimensioning in the sense that no one of them can be seen as covered by the other ones. The hazard implying the highest ASIL attribute (ASIL C in this example), is the one restricted by no tolerance at all. When going down in integrity level, the required margin restricting the hazard becomes harder to fulfil. Either the timing margin is tough or the integrity attribute is tough, not both at the same time. In a similar way can any hazard be detailed considering different degrees of failing according to the Hazop guide words; too little, too much, too early, too late.

V. IMPLICATIONS FROM HIGHLY AUTOMATED DRIVING

When introducing vehicles capable of highly automatic driving (HAD) or even autonomous vehicles, the activity of HA&RA becomes more complex. Furthermore, the implications of many safety goals are spread on a larger part of the E/E systems of the vehicle. This implies that ending the HA&RA activity with a few safety goals that could be regarded as too unelaborated, and thus potentially too conservative, may generate a significant increase in cost of the vehicle.

The more complex the functionality implemented by the E/E systems, and the more each SG will cause effects on a large portion of the E/E systems, the more important is it to be careful when performing the HA&RA. This paper claims that for autonomous vehicles and for HAD it is very important to perform active choices of how detailed the situations and the hazards are considered in the evaluation of hazardous events. The potential cost saving are significant when comparing more elaborated HA&RA with more general ones.

VI. CONCLUSIONS AND FUTURE WORK

This position paper argues for the importance of a detailed and elaborated hazard analysis and risk assessment (HA&RA).

Firstly it argues for a methodology valid for the problem of HA&RA verification with respect to completeness. The conclusion is that if a review team can find any candidate hazardous event (HE) not covered by any listed safety goal (SG), the completeness is shown not to hold. If no such candidate HE can be found by the review team, the verification can be seen as showing completeness of the HA&RA.

Secondly is argued for the importance of being detailed enough in terms of situations and of hazards when defining what hazardous events to consider. The claim is that a lower number of hazardous events may imply a more expensive solution than a more elaborated list of HEs. Note that both ways, the HA&RA may be shown to be complete. This means that both ways are fulfilling all aspects in ISO26262, but the one implies a more expensive solution than the other. Furthermore, it is argued for the importance of finding explicit failure models for all hazards. It is claimed that the Hazop guide words are relevant in most cases. Even if originally the set of failures is considered as limited by commission and omission, it may make sense to introduce failures reflecting most of the Hazop guide words.

Then it is claimed that it in many cases may make sense to generate several failures from the quantitative guide words like: too little, too much, too early and too late. This may introduce a set of hazards where some are more restricting in the tolerated failure margin and other are more restricting in the required safety integrity. Having an idea of the cost drivers in the design, might to an extent generate a differentiation of the safety goals based on this kind of SG detailing.

Finally, this paper takes the position of arguing for the importance of being detailed enough in the HA&RA for HAD and autonomous vehicles. It is claimed that the cost of a too conservative SG is significantly higher for such vehicles because of broader implications of each SG. This implies that the potential to save cost by elaborating the HA&RA is significant for autonomous vehicles.

ACKNOWLEDGMENT

This work has been financed by The Swedish government agency for innovation systems (VINNOVA) in the FUSE project (ref 2013-02650).


Vincent Daien
email: vincent.daien@gmail.com

A Le Pape

D Heve

I Carriere

Incidence and characteristics of cataract surgery in France from 2009 to 2012: a national population study

Objective: To report age-and sex-specific incidence rates of cataract surgery in France and evaluate the trends of cataract surgery from 2009 to 2012.

Design: Cohort study

Subjects: Data for all patients who underwent primary cataract surgery in France between January 2009 and December 2012 were collected from the national database.

Methods: Annual incidence rates were calculated and adjusted to the corresponding-year national population data from the French national institute of statistics. Kaplan-Meier analysis was used to assess the time between surgeries for both eyes and the relationship between age and interval for bilateral surgery.

Main Outcome Measures: Age-and sex-specific incidence of cataract surgery.

Results: Over the 4 years, 2,717,203 eyes in 1,817,865 patients (59.1% women, mean age 73.5±0.015 years) underwent cataract surgery. Between 2009 and 2012, the total number of operated eyes per year increased, from 634,070 to 723,172 (+14.0%) and the number of patients with one or both eyes undergoing cataract surgery decreased, from 475,301 to 449,318 (-5.5%).

The incidence of cataract surgery increased from 9.86 to 11.08/1,000 person-years and that of operated patients (one or both eyes) decreased from 7.39 to 6.89/1,000 person-years. The incidence of cataract surgery ranged from 1.06/1,000 person-years for patients 40-49 years old to 65.94/1,000 person-years for those 80-89 years old. Between 2009 and 2012, the probability of second-eye surgery 12 months after the first-eye surgery increased from 40.6% to 51.2% (P<.0001). The median interval for surgery between eyes was 29 (interquartile range 14-86) days and decreased over the study period (P<.0001). The rate of posterior capsular tear was 0.20%, with a higher proportion from extracapsular extraction than phacoemulsification (7,9% vs 0.15%; P<.0001). The proportion of patients who underwent cataract surgery with a history of high myopia or eye trauma or retinal detachment was 0.49%, 0.21%, and 0.80% respectively.

Conclusions: This study documented the incidence and trends in cataract surgery in the overall population in France. Between 2009 and 2012, the number of people undergoing cataract surgery slightly decreased, but the total number of operated eyes increased because the proportion of surgeries on the second eye increased.

Introduction

Cataract is the most common eye disease in older adults and is a major cause of vision impairment and blindness worldwide. [START_REF] Hyman | Epidemiology of eye disease in the elderly[END_REF] Cataract surgery is the most commonly performed procedure in people > 65 years old in the developed world. [START_REF] Bellan | The Evolution of Cataract Surgery: The Most Common Eye Procedure in Older Adults[END_REF] Additionally, with the aging of the population in Western countries, the number of people with cataract surgery is increasing. [START_REF] Congdon | Prevalence of cataract and pseudophakia/aphakia among adults in the United States[END_REF] Two studies based on general population data reported on the incidence of cataract surgery: the Swedish National Cataract Register reported an incidence of 9.0/1,000 person-years in 2009, [START_REF] Behndig | One million cataract surgeries: Swedish National Cataract Register 1992-2009[END_REF] and the Rochester Epidemiology Project, performed in Olmsted County, Minnesota, USA, reported an incidence of 11.0/1,000 person-years in 2011. [START_REF] Gollogly | Increasing incidence of cataract surgery: population-based study[END_REF] A few reports of the incidence of cataract lens opacities were based on a limited cohort of patients. [START_REF] Klein | Incident cataract surgery: the Beaver Dam eye study[END_REF][START_REF] Panchapakesan | Five year incidence of cataract surgery: the Blue Mountains Eye Study[END_REF] Detailed incidence data regarding cataract surgery are important for determining community surgical needs and assessing the potential impact of intervention strategies. An efficient source of incidence data on cataract surgery in France is the national administrative database of hospitalizations (Programme de Médicalisation des Systèmes d'Information [PMSI]) which reports all cataract surgeries performed in France. The PMSI database has provided accurate population-based data. [START_REF] Chantry | Hospital discharge data can be used for monitoring procedures and intensive care related to severe maternal morbidity[END_REF][START_REF] Lorgis | Outcomes after acute myocardial infarction in HIVinfected patients: analysis of data from a French nationwide hospital medical information database[END_REF] The purpose of the current study was to assess the incidence of cataract surgery in France between 2009 and 2012. Secondary objectives were to determine the characteristics of patients who underwent cataract surgery, the surgical techniques used, the per-operative complication incidence and the time between surgeries for both eyes as well the relationship with age.

Methods

The study protocol was approved by the national health authority in France.

Data source

The data for all patients who underwent cataract surgery in France between January 2009 and December 2012 were collected from the PMSI, similar to the US Medicare system. Since 2004, each hospital's budget depends on the medical activity described in the PMSI, which compiles discharge abstracts related to all admissions in the 1,546 French healthcare facilities, public or private. Information in these abstracts covers both medical and administrative data, including identification number, date of birth, and gender of patients. These data are rendered anonymous, and discharge abstracts related to a given patient can be linked, as usually done with Medicare

Data extraction

For each patient, cataract surgery was identified by the PMSI code BFGA004 corresponding to cataract extraction performed by phacoemulsification with intraocular lens implantation in a capsular bag, or by BFGA002, BFGA006, BFGA008 or BFGA009, corresponding to manual extracapsular extraction. Patients with previous retinal surgery were not included. The perioperative vitrectomy procedure used for posterior capsular rupture was recorded if the code BGFA008 was associated with the surgical care. Sociodemographic variables including age and gender were recorded. Eye characteristics, including high myopia and a history of eye trauma, were collected with ICD-10 diagnostic codes H44.2 or H52.1 and S05, respectively. Before extraction of the cohort, 0.26% of persons were not included because of presumed coding errors. Excluded persons were younger (p<0.01) and the proportion of women were lower (p<0.01) as compared with the study population.

Statistical analysis

Characteristics of patients who underwent cataract surgery in France are presented with mean± SE and relative frequencies. Annual incidence rates by age group were adjusted to the corresponding year population data from the national institute of statistics in France. Kaplan-Meier analysis was used to assess the interval between surgeries for both eyes and the relationship between age and interval for bilateral surgery. The duration of follow-up after cataract extraction was based on the patient's last registration in the database, which was December 2012 for all patients. Differences in intervals between surgeries for both eyes were investigated by the log-rank test. Significance was set at P < .01. Analysis involved use of SAS v9.3 (SAS Inst., Cary NC).

Results

Overall and age-and sex-specific incidence of cataract surgery

Between 2009 and 2012, 2,717,203 eyes in 1,817,865 patients (59.1% women, mean age 73.5±0.015 years) underwent cataract surgery in France (table 1).

The total number of operated eyes per year increased, from 634,070 to 723,172 (+14.0%), but the number of patients with one or both eyes undergoing cataract surgery decreased, from 475,301 to 449,318 (-5.5%) (table 1). The corresponding incidence of cataract surgery increased from 9.86 to 11.08/1,000 person-years and the number of operated patients (one or both eyes) decreased from 7.39 to 6.89/1,000 person-years (figure 1; table 1).

The incidence of cataract surgery ranged from 1.06/1,000 person-years for people 40 to 49 years old to 5.04, 20.57, 59.33, 65.94 and 26.38/1,000 person-year for those 50-59, 60-69, 70-79, 80-among age groups, from 46.7% for those 40-49 years old to 49.7%, 54.5%, 60.4%, 63.3%, 67.0% for those 50-59, 60-69, 70-79, 80-89 and ≥ 90 years old, respectively. In age group 60-79 years old, the incidence was higher for women and in age group ≥ 80 years old, incidence was higher for men (figure 2).

Characteristics of cataract surgery in France between 2009 and 2012

Phacoemulsification was used in 99.3% of surgeries (table 2). Use of extracapsular lens extraction decreased between 2009 and 2012 (0.83% vs 0.58%, respectively; P<.0001). The proportion of patients who underwent cataract surgery with a history of high myopia or eye trauma or retinal detachment was 0.49%, 0.21%, and 0.80% respectively (table 2). The rate of anterior vitrectomy for posterior capsular tear was 0.20% overall, with a higher occurrence from extracapsular extraction than phacoemulsification (7.9% vs 0.15%, P<.0001) (table 2).

The time between surgeries for both eyes decreased between 2009 and 2012

Between 2009 and 2012, the probability of second-eye surgery 12 months after the first-eye surgery increased from 40.6% to 51.2% (P<.0001; table 3). The probability of second-eye surgery increased within 7, 15, 30 or 60 days after surgery for the first eye (P<.0001; table 3).

The median (interquartile range) number of days for surgery between eyes was 29 (14-86) and decreased over the study period (P<.0001; figure 3).

The probability of second-eye surgery within 15 days after first-eye surgery was higher for younger than older patients (logrank P<.0001; figure 4).

Discussion

The PMSI program, with its exhaustive national database from the 1,546 French healthcare facilities, public or private, has allowed for assessing the characteristics and trends of cataract surgery in France. This study documented age-specific rates for the incidence of cataract surgery in the overall population in France. The proportion of bilateral surgery increased from 2009 to 2012 and the time between surgeries for both eyes decreased, with a higher proportion of younger than older patients undergoing surgery on both eyes within an interval of 13 days. The rate of the main per-operative complication, vitrectomy for posterior capsular tear, was 0.2%, with a notable higher occurrence with extracapsular extraction than phacoemulsification.

The incidence of cataract surgery has increased in the developed world during the last decade with the conversion from extracapsular extraction to phacoemulsification. [START_REF] Behndig | One million cataract surgeries: Swedish National Cataract Register 1992-2009[END_REF][START_REF] Gollogly | Increasing incidence of cataract surgery: population-based study[END_REF][START_REF] Erie | Incidence of cataract surgery from 1980 through 2004: 25-year population-based study[END_REF][START_REF] Klein | Incidence of age-related cataract over a 15-year interval the Beaver Dam Eye Study[END_REF] The rate of cataract surgery in Sweden increased from 4.5 to 9.0/1,000 person-years from 1992 to 2009 [START_REF] Behndig | One million cataract surgeries: Swedish National Cataract Register 1992-2009[END_REF] and in Minnesota from 8.5 to 11.0/1,000 person-years from 2005 to 2011. [START_REF] Gollogly | Increasing incidence of cataract surgery: population-based study[END_REF] In France, between 2009 and 2012, the incidence of cataract surgery increased from 9.86 to 11.08/1,000 person-years, but the incidence of operated patients (one or both eyes) decreased from 7.39 to 6.89/1,000 personyears.

In the present study and in previous studies, [START_REF] Erie | Incidence of cataract surgery from 1980 through 2004: 25-year population-based study[END_REF][START_REF] Klein | Incidence of age-related cataract over a 15-year interval the Beaver Dam Eye Study[END_REF] the incidence of cataract surgery increased for older age groups. Cataract reflects well-described aging processes in the lens. By the age of 80 years, 80% of people will have a significant cataract in one or both eyes or will undergo cataract surgery. [START_REF] Panchapakesan | Five year incidence of cataract surgery: the Blue Mountains Eye Study[END_REF] During the 4-year period of the study, the age-specific incidence increased in all age groups over 50 years old. The age-group incidence was close to that observed in previous studies. [START_REF] Behndig | One million cataract surgeries: Swedish National Cataract Register 1992-2009[END_REF][START_REF] Gollogly | Increasing incidence of cataract surgery: population-based study[END_REF] The mean age with cataract surgery ranged from 73.0 years in 2011 in Minnesota 5 to 74.9 years in 2009 in Sweden. [START_REF] Behndig | One million cataract surgeries: Swedish National Cataract Register 1992-2009[END_REF] In the present study, the mean age was 73.4 years in 2012.

In Western countries, the mean lifespan is increasing. Most older adults are living independently at home; however, difficulties in performing daily tasks increase with age. [START_REF] Fulton | Physical functioning of the aged[END_REF] Bilateral cataract surgery has markedly improved vision-related limitations in activity. [START_REF] Harrer | Impact of bilateral cataract surgery on visionrelated activity limitations[END_REF] Previous study noted a difference in surgical frequency by gender, [START_REF] Lundström | Gender and cataract surgery in Sweden 1992-1997. A retrospective observational study based on the Swedish National Cataract Register[END_REF] which was also observed in the present analysis. The proportion of women who underwent cataract surgery in Sweden was 61.0% in 2009. [START_REF] Behndig | One million cataract surgeries: Swedish National Cataract Register 1992-2009[END_REF] In the present study, the proportion of women was 59.1%. Furthermore, a delay of surgery was observed for men with lower incidence in younger patients and higher incidence in older ones (figure 2). The transition to the phacoemulsification technique for surgery occurred in France during the 1990s and in the present study, was used for 99.3% of surgeries. The extracapsular extraction remained used for some patients and decreased between 2009 and 2012 (0.8% to 0.6% of surgeries). We documented the rate of vitrectomy for capsular tear, which was 0.20%, with higher occurrence with extracapsular extraction than phacoemulsification (7.9% vs 0.15%; P<.0001). This difference is probably due to the need for extracapsular extraction being limited to patients with very dense cataracts or loose zonules who are at increased risk of capsular tear. This rate was consistent over the 4-year period. Because of the high association of this complication with incidence of post-operative retinal detachment [START_REF] Erie | Risk of retinal detachment after cataract extraction, 1980-2004: a population-based study[END_REF] and endophthalmitis, [START_REF] Cao | Risk factors for acute endophthalmitis following cataract surgery: a systematic review and meta-analysis[END_REF] a close follow-up of patients with capsular tear is necessary.

In the Swedish population, the proportion of patients with cataract surgery in the second eye increased from 28.5% to 40.4% from 1992 to 2009. [START_REF] Behndig | One million cataract surgeries: Swedish National Cataract Register 1992-2009[END_REF] We found that in France, the proportion of patients undergoing surgery in the second eye within 1 year increased between 2009 and 2012 (40.6% to 51.2%) and also within 7, 15, 30 or 60 days after surgery for the first eye. This trend in cataract surgery practice explains the increased number of operated eyes even though the number of people undergoing surgery slightly decreased over the 4-year period. One hypothesis to explain this effect in France is the shift to earlier and more frequent second-eye surgery. In regions with a low density of surgeons, the delay for cataract diagnosis is increasing. Thus, when the patient consults for cataract, both eyes need surgery. Conversely, in regions with a high density of surgeons, the more frequent second-eye surgery could be due to the documented benefits of bilateral surgery [START_REF] Harrer | Impact of bilateral cataract surgery on visionrelated activity limitations[END_REF] and higher demand for high-quality vision in older people.

Furthermore cataract surgery has undergone significant developments in order to become an effective procedure that provide early recovery of vision. The higher proportion of surgery between eyes observed in younger patients may be related to higher demand in working people.

Strengths of the study are the population size, the national recruitment, the importance of its findings and potential impact on public health. Given the reliance on PMSI codes for the selection of patients and the ascertainment of outcomes, there was a potential for misclassification-or underdetection-related biases. However this may have only a minor impact on the findings. Finally, the results of the present study may be specific to the French healthcare system and its financial resources and cannot be generalized a priori to other countries with different healthcare systems or different levels of funding.

In conclusion, this study documented trends in cataract surgery and age-specific rates for the incidence of surgery in the overall population in France. Between 2009 and 2012, the number of people who underwent surgery slightly decreased, but the total number of operated eyes increased because the proportion of surgeries on the second eye increased; as well, the time between surgeries for both eyes decreased, with a higher proportion of younger than older patients undergoing surgery on both eyes within 15 days.

  data. Routinely collected medical data include the principal diagnosis, secondary diagnoses, and procedures performed. Diagnoses identified during the hospital stay are coded according to the International Classification of Diseases, Tenth Revision (ICD-10). The French data from the national institute of statistics was used to obtain population census data between 2009 and 2012 by sex and age group.10

Figures legendsFigure 1 .

 1 Figures legends

Figure 2 .

 2 Figure 2. Age-and sex-specific incidence of cataract surgery in the total cohort of patient

Figure 3 .

 3 Figure 3. Relationship between the time interval for bilateral surgery and probability of

Figure 4 .

 4 Figure 4. Relationship between age and time interval for bilateral surgery. A short interval

Table 1 . Incidence of cataract surgery from 2009 to 2012 in France by age group

 1

		2009	2010	2011	2012	Total
						2009-2012
	Age, meanSE	73.6 0.03	73.50.03	73.50.03	73.40.03	73.50.015
	< 40 y	32,539,507 32,498,504 32,440,658 32,363,744
	No. of cataract surgery	3,858	3,783	3, 970	4, 002	15, 613
	Incidence/1,000 person-years	0.12	0.12	0.12	0.12	0.12
	Gender, % women	41.6%	41.4%	40.6%	42.7%	41.6%
	40-49 y	9,007,052	9,009,993	9,027,087	9,060,930
	No. of cataract surgery	9,461	9,578	9,575	9,502	38,116
	Incidence/1,000 person-years	1.05	1.06	1.06	1.05	1.06
	Gender, % women	46.7%	46.3%	47.3%	46.4%	46.7%
	50-+59 y	8,506,949	8,499,268	8,490,633	8,522,516
	No. of cataract surgery	41,108	42,057	43,395	44,763	171,323
	Incidence/1,000 person-years	4.83	4.95	5.11	5.25	5.04
	Gender, % women	48.8%	49.7%	50.2%	50.0%	49.7%
	60-69 y	6,219,419	6,482,736	6,788,293	7,078,052
	No. of cataract surgery	119,197	130,359	142,176	154,834	546,566
	Incidence/1,000 person-years	19.17	20.11	20.94	21.88	20.57
	Gender, % women	54.2%	54.2%	54.4%	55.1%	54.5%
	70-79 y	4,764,103	4,755,154	4,697,361	4,625,310
	No. of cataract surgery	268,616	277,097	282,299	289,815	1,117,827
	Incidence/1,000 person-years	56.38	58.27	60.10	62.66	59.33
	Gender, % women	60.9%	60.5%	60.3%	59.9%	60.4%
	80-89 y	2,838,530	2,931,159	2,979,759	3,023,603
	No. of cataract surgery	182,180	191,121	198,469	204,493	776,263
	Incidence/1,000 person-years	64.18	65.20	66.61	67.63	65.94
	Gender, % women	64.3%	63.3%	63.0%	62.6%	63.3%
	≥ 90 y	428,940	436,125	509,609	577,582
	No. of cataract surgery	9,650	11,717	14,365	15,763	51,495
	Incidence/1,000 person-years	22.50	26.87	28.19	27.29	26.38
	Gender, % women	67.0%	67.0%	67.0%	67.0%	67.0%
	Total	64,304,500 64,612,939 64,933,400 65,251,737
	No. of cataract surgery	634,070	665,712	694,249	723,172	2,717,203
	Incidence/1,000 person-years	9.86	10.30	10.69	11.08	10.49
	Incidence of one or both eyes undergoing surgery	7.39	6.92	6.87	6.89	7.02
	Gender. % women	59.5%	59.1%	58.9%	58.7%	59.1%

Table 2 . Characteristics of cataract surgery in France from 2009 to 2012 among patients

 2

	>40 years
		2009	2010	2011	2012	Total 2009-2012
	Surgical technique
	Phacoemulsification (%)	99.2	99.3	99.4	99.4	99.3
	Extracapsular extraction (%)	0.83	0.70	0.64	0.58	0.68
	Anterior vitrectomy for per-operative capsular rupture (%)	0.23	0.20	0.19	0.21	0.20
	Phacoemulsification (%)	0.16	0.14	0.14	0.16	0.15
	Extracapsular extraction (%)	7.3	8.1	8.2	8.4	7.9
	Eye characteristics of patients
	High myopia (%)	0.56	0.51	0.47	0.43	0.49
	History of eye trauma (%)	0.21	0.23	0.20	0.19	0.21
	History of retinal detachment (%)	-	0.81	0.98	1.11	0.80

Table 3 . Proportion of bilateral surgery

 3

	Proportion of patient undergoing bilateral surgery	2009	2010	2011	2012	Total	P value 2009-2012
	Within 7 days	5.98%	7.16%	8.07%	8.91% 7.51%	<.0001
	Within 15 days	12.3%	15.3%	17.2%	18.8% 15.8%	<.0001
	Within 30 days	19.8%	24.4%	27.2%	29.9% 25.2%	<.0001
	Within 60 days	27.6%	33.0%	36.2%	38.7% 33.7%	<.0001
	Within 1 year	40.6%	46.6%	49.4%	51.2% 46.8%	<.0001

Ackowledgements

French National Health Authority