Helen Monkhouse

Ibrahim Habli

John Mcdermid

Keywords: controllability, system safety, ADAS, autonomous I

For decades, the automotive industry has used the notion of controllability as a way of assessing the likelihood that, when subject to a hazardous situation, the vehicle driver avoids an accident. The introduction of semi-and fully-autonomous vehicle systems has the potential to fundamentally alter the driver's tasks and role during all or part of the journey, and challenges the notion of controllability as used in existing automotive risk models. This paper explores the notion of controllability and highlights areas where increasing autonomy may impact the use of controllability in risk assessment.

When developing a new automotive feature, or adding an existing feature onto a new vehicle platform, consideration must be given to potential hazards. When hazard risk is determined using the ISO 26262 standard [START_REF]ISO 26262: Road Vehicles -Functional safety[END_REF], the severity of the accident, the probability of exposure to, and the controllability of, the hazardous events are used to determine the Automotive Safety Integrity Level (ASIL). The activities undertaken to develop and integrate the feature can then be tailored for the highest ASIL identified; with the highest integrity level demanding the highest design rigour [START_REF] Habli | Software safety: relating software assurance and software integrity[END_REF].

When the automotive industry considers controllability, the rating for a hazardous event often relies on domain experts combining their knowledge of the feature behavior with their experience in vehicle handling. This may seem un-scientific. However, this is a mature industry that has slowly evolved its products over decades, and the user interface has remained relatively stable for a century, thus a subjective engineering judgement based assessment seems defensible.

However, today this gradual product evolution is being challenged with the introduction of autonomous vehicle features. This not only changes the driving task and the way in which the driver interacts with the vehicle, but also challenges the implicit assumptions made about the driver's ability to control the vehicle should a failure occur. This, in turns, leads us to question the validity of current automotive risk models, particularly those used in standards such as ISO 26262 [START_REF]ISO 26262: Road Vehicles -Functional safety[END_REF].

This paper is organised as follows. Section II discusses the origins of controllability and the assumptions made about the driver, their role in the control loop and the driving task. Familiar vehicle systems are used to illustrate the notion of controllability when the driver is viewed as part of the control loop for a fully manual vehicle. Section III discusses two pivotal human factors papers and explores how greater autonomy may affect the notion of controllability. Emerging Advanced Driver Assistance Systems (ADAS) are used to illustrate the points raised. Finally the paper concludes with a summary and a discussion of next steps in Section IV.

II. CONTROLLABILITY

A. Origins of Controllability

In control theory controllability is viewed as the ability to 'steer' a dynamic system from an initial to a final state using admissible inputs [START_REF] Klamka | Controllability of dynamical systems. A survey[END_REF]. The notion traces back to the work of Kalman in the 1960s [START_REF] Berger | Controllability of linear differential-algebraic systems-a survey[END_REF].

From a vehicle handling perspective controllability refers to the relationship between the driver's ability and the vehicle's handling qualities [START_REF] Abe | Vehicle handling dynamics: theory and application[END_REF]. In the aerospace domain various studies have been undertaken to facilitate the qualitative evaluation of controllability. One notable pilotrating scheme is the Cooper Harper Rating Scale devised in the late 1960s to help pilots and engineers evaluate aircraft handling and stability [START_REF] Cooper | The use of pilot rating in the evaluation of aircraft handling qualities[END_REF].

The notion of controllability can also be found in civil and military aerospace standards. MIL-STD-882C [START_REF]MIL-STD-882C: System safety program requirements[END_REF] included controllability in its software control categories, with Category I software exercising full autonomous control over the system (with no potential for intervention to mitigate the hazard), Category IIb software providing display information needing immediate operator action, and so on. Civil aviation standards use a similar notion of controllability, for example DO-178C [START_REF]DO-178C Software Considerations in Airborne Systems and Equipment Certification[END_REF] includes system failure categories that consider "the flight crew's ability to cope", from which software levels are derived.

From an automotive system safety perspective the notion of controllability traces back to the Dedicated Road Infrastructure for Vehicle Safety in Europe (DRIVE) I project, DRIVE Safely, undertaken in the early 1990s [START_REF] Jesty | The development of safe advanced road transport telematic software[END_REF]. Here controllability is the probabilistic attribute linking a hazardous event to an accident; by indicating how likely the driver will be able to control the hazardous situation and thus avoid harm. Thus a hazard categorised as nuisance only implies a zero probability of that event becoming an accident. Whereas, a hazard categorised as uncontrollable cannot be influenced by human intervention to give a positive outcome. The DRIVE Safely project categorised controllability into five levels (Fig. 1) linking it to integrity levels directly. With the driving environment complicating hazard classification -at the extreme it is possible to identify numerous, even fatal, outcomes from the same seemingly benign hazard [START_REF] Jesty | Safety analysis of vehicle-based systems[END_REF] controllability categorisation was left to expert engineering judgement.

The 1994 MISRA Guidelines [START_REF]Development Guidelines for Vehicle Based Software[END_REF] included example 'influencing factors' to help guide controllability categorisation. This was refined further by the 2007 Guidelines [START_REF]Guidelines for safety analysis of vehicle based programmable systems[END_REF]; with the risk model separating controllability and severity and Appendix D including a method for considering and using 'influencing factors' under various circumstances (including greater autonomy). 'Influencing factors' were not included in ISO 26262 [START_REF]ISO 26262: Road Vehicles -Functional safety[END_REF], with a less structured assessment being required.

The Controllability of Automotive Safety Targets (CAST) project [START_REF]Use of Controllability for Classification of Automotive Vehicle Hazards[END_REF] used vehicle simulation to validate the assumptions made by the DRIVE Safely project about the inverse relationship that exists between controllability and the probability of having an accident following a hazard. The study was able to correlate the simulation results with an expert assessment of controllability completed beforehand, showing the soundness of the concept.

B. Assumptions Made

Although not explicitly stated, ISO 26262 makes three assumptions about the driver. Firstly, the driver is always part of the control loop; with the origins of this assumption routed in the 'Vienna Convention' [START_REF]Vienna convention on road traffic[END_REF]. Secondly, the driver is integral to control, as illustrated by Fig. 2 [START_REF]Guidelines for safety analysis of vehicle based programmable systems[END_REF], implying that the driver is fully aware of their surroundings. Thirdly, that the 'safe state' can be to shut-down the system; i.e. 'fail passive'.

C. Controllability of Familiar Automotive Examples

To illustrate the notion of controllability the following vehicle features are discussed: an engine control system, an air suspension system, and an electric driveline incorporating inwheel motors (see Fig. 2).

Emissions legislation, fuel economy, performance and cost all contributed to engine control systems evolving from a purely mechanical design to a complex programmable control system. Although the earliest mechanical systems could cause Unintended Acceleration (for example, by the accelerator cable becoming stuck) the introduction of electronic throttle control systems increased focus on the hazard.

The early electronic control systems typically mimicked previous mechanical designs, whereas modern engine control systems utilise complex control algorithms expressed in the torque domain. This leads to a complex relationship between the acceleration pedal position and the resultant vehicle acceleration. Typically layered monitoring strategies [START_REF]Standardized E-Gas Monitoring Concept for Gasoline and Diesel Engine Control Units[END_REF] are used to continuously monitor the relationship between the driver's torque demand (via the accelerator pedal) and the delivered engine torque (estimated from measured engine parameters); any hazardous discrepancy between demanded and delivered torque is mitigated by limiting the engine's performance or ultimately by shutting it down.

This concept naturally reflects the notion of controllability and the assumptions described in Section II.B. For an experienced driver the longitudinal control task is generally a subconscious process, with the driver modulating the accelerator pedal position (Driver Control), based on their current Driver Strategy and given their knowledge of the current Traffic Environment, to achieve the desired vehicle acceleration. If vehicle acceleration (Complete Vehicle Behaviour) is too slow then the accelerator pedal can be pressed harder. Conversely, if acceleration is too great then the accelerator pedal can be released, and once completely released the brakes applied.

To mitigate the hazardous effects of engine control system failures, controllable acceleration targets can be defined, e.g. "Vehicle positive longitudinal acceleration shall not exceed driver demand by > 1.5 m s 2 for longer than 1 s", knowing the driver's likely response [START_REF] Birch | Safety cases and their role in ISO 26262 functional safety assessment[END_REF]. The mitigating action "outputs are electronically 'limited' to a fixed value" can then be defined, thus ensuring that any engine torque anomalies detected are prevented from exceeding a level where the resultant acceleration might be difficult to control. With these targets defined the torque monitor's internal parameters can then be set to achieve the required response.

Controllability works well for air suspension systems of the type used on large luxury four-wheel drive sport utility vehicles to change the vehicle's ride height; with ride height being raised to facilitate off-road driving and lowered to make ingress and loading easier [START_REF] Habli | Modelbased assurance for justifying automotive functional safety[END_REF]. As selecting an incorrect ride height could affect the vehicle's handling characteristics (changing the relationship between Driver Control and Complete Vehicle Behaviour in Fig. 2) vehicle speed limits constrain when ride height changes can be made. However, a failure leading to the vehicle being at the wrong ride height, for a given vehicle speed, may result in a hazard.

Typically safety mechanisms detect failures within the air suspension system. Having detected a failure, and dependent on the current Vehicle Manoeuvre, the safety mechanisms can then either disable the system (Fail Passive) and issue driver warnings (dashboard warning lights, messages or audible chimes) or disable the system and limit the speed. In either case the failure mitigation makes assumptions about the driver's place within the overall control loop. In the first case, once the driver has been warned about the potential changes to vehicle handling they will change their Driver Control accordingly. In the second case, where the vehicle speed is limited, the vehicle's operating envelope (or choice of Vehicle Manoeuvres) is constrained into the region where the vehicle is known to be controllable.

For novel technologies, such as an in-wheel motor electric driveline system [START_REF] Ellims | ISO 26262: Experience applying part 3 to an in-wheel electric motor[END_REF] the notion of controllability is still valid because the assumption that the driver is a part of the control loop is still holds. Although the ability to control torque delivery to each road wheel independently is a vehicle dynamists dream, and a major benefit of in-wheel motors, applied incorrectly this torque asymmetry causes the hazard Induced Yaw. Empirical driver response studies [START_REF] Neukum | Controllability of superposition steering system failures[END_REF] set yaw rate and lateral acceleration controllability limits giving a power asymmetry target of 30 kW / tonne [START_REF] Ellims | Using Vehicle Simulation to Investigate Controllability[END_REF]. Safety mechanisms monitor the torque being produced by a pair of motors, and either shut-down or modify motor control if the asymmetry exceeds the limit. Thus, system failures having the potential to adversely affect the Vehicle Control System can be detected and Vehicle System Behaviour influenced so that the Complete Vehicle Behaviour remains controllable by the driver.

III. THE IMPACT OF GREATER AUTONOMY

To this point we have used automation and autonomy somewhat interchangeably. This has been done to facilitate a practical rather than theoretical discussion, as in the strictest sense all features discussed represent automation.

A. Pivotal Literature

Could Lisanne Bainbridge's seminal paper, "The Ironies of Automation" [START_REF] Bainbridge | Ironies of automation[END_REF] provide insight into how the driver's relationship with the car will change with greater autonomy? And could it give insight into how engineering design assumptions may need to change to preserve safety?

Bainbridge discussed how greater automation in an industrial process context might actually increase rather than decrease human operator problems, particularly if automation changes the human's role to that of a supervisor required to intervene only under abnormal conditions. This relationship between the human operator and automation is discussed through a number of 'ironies'; see below for examples.

A second paper potentially holding more clues is "Humans and Automation: Use, Misuse, Disuse, Abuse", written by Raja Parasuraman and Victor Riley 14 years after Bainbridge published her work. Again ideas presented by these authors are considered in the context of vehicle autonomy below.

B. The Use of Automation

As vehicle systems gain greater autonomy, it is perhaps logical to expect Driver Control to become a shared task, between the human driver and the autonomous system, but how does this affect controllability?

One motivation behind the introduction of autonomous vehicle systems is the reduction in accidents resulting from human error in the Driver Control task. The first challenge is choosing which tasks to automate, as deploying automation when it is not the right option is an abuse of automation, potentially leading to increased driver workload [START_REF] Parasuraman | Humans and automation: Use, misuse, disuse, abuse[END_REF].

Automation has supported the driver in the longitudinal vehicle control task for many years. The earliest cruise control systems essentially enabled the driver to set a constant vehicle speed while manually undertaking the remainder of the Driver Control task. Assuming that the vehicle is in a Physical Environment where the driver has sufficient space and time in which to react, cruise control failures are normally easily controllable. This assumption can be met by constraining the use of cruise control, e.g. via a minimum set speed.

Adaptive Cruise Control (ACC) supports the Driver Control task further. Although the ACC fulfils the longitudinal control aspects of Driver Control, the driver is not relieved of all responsibility. In some operational situations, such as the preceding vehicle braking sharply, the ACC may require the driver to resume manual control because the ACC system does not have sufficient authority over vehicle brake pressure to achieve a full emergency stop. Therefore while ACC is active the driver inherits a new monitoring task, and the driver must understand ACC operation sufficiently to know when manual control may be required [START_REF] Parasuraman | Humans and automation: Use, misuse, disuse, abuse[END_REF], and remain vigilant and ready to intervene when required [START_REF] Bainbridge | Ironies of automation[END_REF].

A vehicle fitted with an ADAS, such as ACC, also places new responsibility on the driver, mainly knowing when to give longitudinal control to the ACC system and when to undertake Driver Control manually. Automation misuse can occur when users become over-reliant on automation [START_REF] Parasuraman | Humans and automation: Use, misuse, disuse, abuse[END_REF]. For example attempting to use ACC when environmental factors (in fog or on very winding roads) limits system performance or leads to unexpected system behaviour and potentially system disuse because the driver's confidence in the system is lost [START_REF] Parasuraman | Humans and automation: Use, misuse, disuse, abuse[END_REF].

People use different strategies when choosing whether to use automation [START_REF] Parasuraman | Humans and automation: Use, misuse, disuse, abuse[END_REF] adding complexity and uncertainty into the design task. Also, gathering the verification evidence that enables the design team to demonstrate system safety becomes a far bigger task. This is because relatively simple automation leads Fig. 2 to become multi-dimensional; with a separate dimension existing for each Driver Control combination.

C. The Driver's Task with Autonomy

As previously stated one intuitively knows that the driver's role (Fig. 1) will change, but what might the new role become and will the driver remain effective in that new role? ACC showed how the driver's role might become a monitoring task. The irony here is that humans are less good at monitoring automated tasks than they are at carrying out the task manually [START_REF] Bainbridge | Ironies of automation[END_REF]. If the manual task was largely achieved subconsciously then automating that task and asking the driver to monitor it could actually add to the driver's workload [START_REF] Parasuraman | Humans and automation: Use, misuse, disuse, abuse[END_REF]. For example, with Lane Keeping Assistance (LKA), automation supports a subconscious task. Steering is a Driver Control task requiring little driver cognition; the driver practices constantly during each journey, so it quickly becomes completely subconscious even for the most novice driver. LKA is designed to support lateral vehicle control by applying a corrective torque (either through the steering system or by an asymmetric brake application), if the driver allows the vehicle to stray from its lane.

The automation of a task of this type raises questions about the actions that should be taken in the presence of failure. For systems like LKA, Fail Passive is not a viable option. It also challenges the controllability assumptions that would have been made regarding other systems fitted to the vehicle. For example the power assisted steering system and the hazard loss of steering assist. The introduction of LKA effectively adds a use case. As such, will controllability assumptions made previously still hold true? Additionally, the use of LKA may lead to loss of situational awareness which is known to adversely affect driver reaction times [START_REF] Merat | How do drivers behave in a highly automated car[END_REF], complicating further the choice of mitigation.

D. The Designer's Task with Autonomy

Both papers [START_REF] Parasuraman | Humans and automation: Use, misuse, disuse, abuse[END_REF][START_REF] Bainbridge | Ironies of automation[END_REF] discuss the importance of the design team's view of the human operator. If ADAS features are developed with the sole motivation of removing the unreliable and inefficient driver from the control loop then Bainbridge warns of two potential outcomes [START_REF] Bainbridge | Ironies of automation[END_REF]: design teams may target the easily automated Driver Control tasks first leaving the driver with the more difficult tasks to be performed manually! An inevitable consequence of greater autonomy is also increased complexity and as the control systems view of a vehicle may become a multi-dimensional problem; with the potential for subtle interactions between the dimensions. The desire to remove human error may simply move the errors to the design task, as "one cannot remove the human error from a system simply by removing the human operator" [START_REF] Parasuraman | Humans and automation: Use, misuse, disuse, abuse[END_REF]. Thus today's vehicle is a complex system of systems having the potential to exhibit both good and bad emergent properties.

IV. SUMMARY Human factors models have been used to 'test' the notion of controllability and the control system view of a vehicle (Fig. 2). Although these models work when there is no automation, even for function specific automation (like ACC) deficiencies become apparent. The most notable omission is perhaps the lack of feedback from Vehicle System Behaviour to Driver Control or Driver Strategy.

The notion of controllability has been used to good effect in the past. However greater autonomy challenges the model, which should be re-evaluated and the term controllability better defined. The Control Systems View of a Vehicle (Fig. 2) is indeed useful, but it needs to change to consider situational awareness and the multi-dimensional nature of the problem.

Fig. 1

 1 Fig. 1 Controllability and Integrity Categories from DRIVE

Fig. 2

 2 Fig. 2 Control System View of the Vehicle


Roger Rivett

Ibrahim Habli

Tim Kelly

Automotive Functional Safety and Robustness Never the Twain or Hand in Glove?

Keywords: quality engineering, FMEA/FMEA, robustness, failure mode avoidance, risk, functional safety, safety case

The FMEA/FMECA analysis technique has been used for over 30 years in the automotive industry in the context of product quality and robustness. More recently the discipline of functional safety has been adopted by the industry for analysing software-based control systems. Both of these approaches seek to predict undesirable outcomes that may occur and then take steps to avoid them. Despite these similarities, and their joint use within the industry, the quality and robustness process and the functional safety process have very little alignment in terms of risk assessment and mitigation. This paper makes the case for a better alignment and proposes a means of achieving it.

I. INTRODUCTION

Man-made machines suffer from malfunctions. Malfunctions are undesirable for end users for many reasons, e.g. loss of service, inconvenience or injury. Malfunctions are undesirable for the manufacturer as they may lead to damaged reputation, loss of sales and court cases. As a response to the potential negative consequences of malfunctions, manufacturers have developed an approach to anticipating and preventing malfunctions under the general heading of Quality Engineering. Quality Engineering can refer to a set of techniques, but it can also be used to refer to a whole quality management framework such as Six Sigma or Total Quality Management (TQM) [START_REF] Feigenbaum | Total quality management[END_REF]. Failure Mode Effects Analysis (FMEA) / Failure Mode Effects Criticality Analysis (FMECA) is a quality technique that is included in these quality management frameworks, but is also sometimes used to refer to a whole quality management framework. This is often the case in the automotive industry. In mechanical systems where the functionality is constrained by the continuous nature of physical properties and there are only a few modes of operation it has generally been the case that quality techniques have been sufficient to also address the safety issues. This is in stark contrast to the software aspects of of software-based control where there are typically many modes of operation and the control algorithm is not constrained by physical properties.

With the growing use of software based control systems the inadequacy of relying upon a reliability-oriented approach has become apparent. This has led to the development of new disciplines such as functional safety, promoting new safety management frameworks and standards such as IEC 61508 [START_REF]61508-3: Functional safety of electrical/electronic/programmable electronic safetyrelated systems. Software requirements[END_REF] and ISO 26262, [START_REF]ISO 26262 Road Vehicles --Functional Safety[END_REF]. In these standards FMEA/FMECA is referenced as one of the many possible analysis techniques.

The motivation for this paper is borne primarily out of experience, justifying the safety of systems comprising both mechanical and software-based systems. We provide a brief history of the development of the FMEA/FMECA technique, its use in the automotive industry and the recent trend towards its use for failure mode avoidance in a quality and robustness engineering context (Section II). We then describe the process implied by the automotive functional safety standard ISO 262626 (Section III). In section IV the functional safety and FMEA/FMECA processes are compared and a case for the alignment of the two is made. Section IV concludes with a proposal for how this alignment may be realised.

II. FAILUDRE MODE AVOIDANCE

A. Early use of FMEA

The first standard for FMEA was issued in 1949 by the US Armed Forces, [START_REF] Defense | MIL-P-1629 : Procedures for Performing a Failure Mode, Effects and Criticality Analysis[END_REF]. The Ford Motor Company started to use FMEA in the late 1970s, [START_REF] Company | Instruction Manual Process FMEA[END_REF], as did many other automotive companies. In 1994, SAE published J1739, [START_REF] Engineers | SAE Reference Manual J1739, Potential Failure Mode and Effects Analysis in Design and Manufacturing[END_REF], which was jointly developed by Chrysler Corporation, Ford Motor Company and General Motors Corporation. The use of J1739 was required by QS9000, which until 2006, was widely used as the automotive version of ISO 9000. QS9000 has now been replaced by ISO/TS 16949, [START_REF] Iso | TS 16949 Quality management systems. Particular requirements for the application of ISO 9001:2008 for automotive production and relevant service part organizations[END_REF], which also requires the use of J1739.

B. FMEA Process Steps

All of the FMEA standards mentioned in section A describe the process in a number of steps. The steps are largely the same but differ to some extent in wording or order. For the sake of comparison the following generic set of process steps is defined, Fig. 1. FMEA/FMECA-Step 1 defines the object of the analysis. This definition will differ depending on the level of abstraction at which the analysis is being performed. If performed at the Concept level, then the FMEA is often referred to as a Concept FMEA. If it is performed at any of the lower levels then it is referred to as a Design FMEA (DFMEA). The material used in this step is intended to be produced as part of the regular product design work and collated in FMEA/FMECA-Step 1 as a reference for the analysis. When performed at the Concept level this step will help ensure that the concept is properly documented. The remaining steps are discussed below. The main variations arise in how FMEA/FMECA-Step 5 is performed. This is discussed in the next section.

C. Processing Failure Modes, Affects and Causes

In the 1980 version of Mil 1629, [START_REF] Defense | Military Standard Procedures for Performing a Failure Mode, Effects and Criticality Ananlysis AMSC N3074 MIL-STD-1629A[END_REF], FMEA/FMECA-Steps 1 to 4 are part of Task 101 and FMEA/FMECA-Step 5 is Task 102. Task 101 is referred to as an FMEA and its purpose is "to study the results or effects of item failure on system operation and, to classify each potential failure according to its severity". Task 102 is referred to as Criticality Analysis and its purpose is "to rank each potential failure mode identified in the FMEA Task, according to the combined influence of severity classification and its probability of occurrence based upon the best available data". Criticality Analysis has two methods: qualitative and quantitative. The significance of the failure mode, referred to in this paper by the generic term, consequence ranking, and in Mil 1629 as the Criticality Number, is arrived at by taking account of the severity of the outcome and the probability of the occurrence of the failure mode. The quantitative method uses failures rates and follows a reliability engineering approach. After determining the Criticality Number, Mil 1629 requires the identification of means to eliminate the failure or control the risk, e.g. failure detection methods and compensating provisions, corrective design, redundant items, safety devices, backup systems and logistics support.

J1739 takes the conventional approach of estimating the potential severity, S, of the outcome and the likelihood that the outcome will occur. However, the likelihood is split into two aspects:

 The likelihood that the failure mode that leads to the undesired outcome will occur, O; and  The likelihood that the failure mode will be detected before the undesired outcome occurs and hence the undesired outcome will be prevented from occurring, D.

To capture the assessed value of each of the three aspects, three scales are defined taking values in the range of 1-10. These scales are a ranking based on an informal description which captures the intuition of greater severity and higher probability. The scales represent a relative ranking within the scope of the individual FMEA. The overall consequence ranking can be arrived at in a number of different ways. A classification may be assigned based on the values of Severity, Severity & Occurrence or Severity & Detection. Alternatively, or as well as, the 3 values are multiplied together to produce a Risk Priority Number (RPN). This approach has been criticised on the basis that the scales are ordinal and that an interval scale is required in order for the multiplication operation to be valid [START_REF] Gilchrist | Modelling Failure Modes and Effects Analysis[END_REF].

For countermeasures, J1739 calls for the use of prevention and detection controls that are used in the same or similar designs. Prevention controls describe how a cause, failure mode or effect is prevented, e.g. published design standard, design redundancy, corporate best practice standard design, system detection and driver notification for service and system detection and operational status displayed to driver. Detection controls describe how a cause and/or failure mode is detected before the item is released to production, e.g. Computer-Aided Engineering analytics, tolerance stack analysis and validation testing (fatigue, water intrusion, vibration, ride and handling, etc.). Finally actions may be recommended to reduce the likelihood of failure and/or improving the ability to detect failures, e.g. revised design geometry and/or tolerances, revised material specification, design of experiments, revised test plan and confirmation/verification of information.

D. Criticisms of a Reliability Approach

In striving for better performance of the FMECA/quality approach one could try to move more to the reliability approach, i.e. use component failure rates, notionally making more use of real world data and less use of judgement. However, there is large uncertainty concerning the nature of the environment in which the product will be used. Brown, [START_REF] Brown | Probabilistic Reliability vs. Failure Mode Avoidance Methodologies Within the Automotive Industry[END_REF], highlights the problem of knowing the stated conditions and specified period of time which would have to take into account the field usage, speeds, loads, duty-cycle of loads, temperature dynamics, humidity, corrosive environments and shock loads. Davis [START_REF] Davis | Science, engineering, and statistics[END_REF] highlights the lack of closed-loop feedback from units in the field when data outside the warranty period is not collected.

E. Alternative Approaches

Given the criticisms noted above, there has been a move away from reliability to an approach known variously as Robustness Engineering and Failure Mode Avoidance (FMA).

FMA has its roots in the work of Taguchi, [START_REF] Taguchi | Robust Engineering[END_REF]. Taguchi defines robustness as the "state where the technology, product, or process performance is minimally sensitive to factors causing variability (either in the manufacturing or user's environment) and aging at the lowest unit manufacturing cost". Robustness recognizes 2 types of quality: customer quality, i.e. features the customer wants, and engineered quality, i.e. features the customer does not want. Robustness is about engineered quality, i.e. removing the features that the customer does not want such as failures, noise, vibrations, unwanted phenomena and pollution. It does this by identifying the "ideal function" and then selectively choosing the best nominal values of design parameters that optimise performance reliability at lowest cost. The classical metrics for quality/robustness, e.g. failure rate, are considered to come too late in the product development. The Taguchi measure for robustness is signal-tonoise ratio. The signal-to-noise ratio measures the quality of energy transformation as expressed by Level of performance of desired function / variability of desired function. The signal-tonoise ratio is increased by reducing variability and specifying nominal values of the design parameters such that the design is insensitive to noise factors, e.g. the customer environment, aging and wearing and manufacturing variations. In reducing variability in this way the Robustness approach has some similarities with the Six Sigma approach.

Clausing [START_REF] Clausing | Operating Window: An Engineering Measure for Robustness[END_REF] has suggested a new definition for reliability, "reliability is failure mode avoidance", with failure being any customer perceived deviation from the ideal condition. As reliability is being equated to failure mode avoidance it is necessary to a have a way of measuring it. Clausing proposes the "operating window", (OW) as a metric for robustness. The OW is the range in some input noise that produces a fixed failure rate in the failure modes.

Davis [START_REF] Davis | Science, engineering, and statistics[END_REF] accepts Clausing's view of reliability as failure mode avoidance and proposes a robustness metric called the "distance from the failure mode". The distance is captured as measurements of physical properties in SI units, the greater the distance the higher the reliability.

III. FUNCTIONAL SAFETY / ISO 26262

The main automotive standard for functional safety is currently ISO 26262 [START_REF]ISO 26262 Road Vehicles --Functional Safety[END_REF]. This standard defines a process for functional safety engineering and management. A simplified description of this process is shown in Fig. 2. The process description is shown in a similar manner to that of the FMEA/FMECA process for ease of comparison. ISO-26262-Step 1, referred to as the Item Definition in ISO 26262, is always defined at the vehicle level includes some specification of the actuation, and so is similar, but not identical, to FMEA/FMECA-step 1 for a concept FMEA. ISO-26262-Step 2 is performed using an inductive method of analysis on the Item Definition and does not assume an implementation except for some specification of the actuation. The purpose is to determine what vehicle level behaviour, if any, related to the item under consideration can initiate a sequence of events that results in harm to people. The analysis considers all the vehicle lifecycle phase, e.g. manufacturing, normal usage, servicing/repair, emergency services rescue and vehicle disposal. For normal usage the analysis considers the operational situations and operating modes, which may include current vehicle state and manoeuvre, the user state, the vehicle surroundings and external environment.

ISO-26262-Step 3 is equivalent to the consequence ranking. It considers the severity of the injuries that may be incurred; the qualitative probability that the vehicle may be in the lifecycle phase and operational situations and operating modes when vehicle level behaviour occurs (exposure); the qualitative probability that the persons at risk can avoid the harm by their own actions (controllability). This produces a value on the scale QM, ASILA, ASILB, ASILC and ASILD, where QM stands for Quality Management and ASIL stands for Automotive Safety Integrity Level. Unlike the FMEA/FMECA scales, this scale is defined industry-wide and applies to every automotive electrical and/or electronic (E/E) system. ISO-26262-Step 4 produces a hierarchy of safety requirements from initial high-level safety goals, through implementation-independent design (functional) safety requirements, down to technical hardware and software safety requirements.

ISO-26262-Step 5 is comparable to the use of prevention and detection controls in the FMEA/FMECA process. Guidance on these as a function of ASIL value forms a large part of the standard. ISO 26262 has more steps than given here, including verification and validation but these are outside the scope of this paper.

ISO 26262 recognises FMEA/FMECA as an inductive analysis method [ISO 26262-9:2011, Clause 8] and the use of inductive analysis is specifically required at the system, hardware and software levels. These analyses do not use FMEA/FMECA-step-5. The criticality analysis is not used as this comes from the risk assessment in ISO26262-step-3. For the prevention controls, error detection and reaction are a part of the ISO 26262 safety requirements process. For detection controls, design practice, further analysis and testing are part of the ISO 26262 process measures as shown in ISO26262-step-5.

ISO 26262 also acknowledges that FMEA/FMECA may play a part in hazard identification, safety requirements determination and safety validation. It is also used for assessing random hardware failures.

IV. ALIGNMENT OF FUNCTIONAL SAFETY & ROBUSTNESS

For a defined vehicle level E/E feature/system, following ISO 26262 will result in the following:  a set of risk assessed hazardous events;

 safety requirements at different levels of abstraction from system to hardware and software intended to mitigate the risk associated with the hazardous events;

 verification evidence that safety requirements implemented and achieve risk mitigation; and

 evidence of having used appropriate processes, based on risk, for deriving, implementing and verifying the safety requirements Having produced the above, it is possible to present an argument that the safety issues related to the E/E feature/system will not occur in service [START_REF] Birch | Safety Cases and their Role in ISO 26262 Functional Safety Assessment[END_REF] [START_REF] Birch | A Layered Model for Structuring Automotive Safety Arguments[END_REF]. By meeting the requirements of ISO 26262, this argument can be presented with a level of confidence that is commensurate with the risk associated with the safety issues. The formal requirement in ISO 26262 is for the creation of a safety case. This is defined as an "argument that the safety requirements for an item are complete and satisfied by evidence compiled from work products of the safety activities during development". Whether or not the level of confidence at the time of product release was justified or misplaced can only be determined once the product has been in service for its design lifetime.

For a defined mechanical component/system, if the FMEA/FMECA is followed, then, the result will be a set of failure modes, set of causes, set of effects and a set of countermeasures for each cause.

The quality issues may include issues that functional safety would consider to be hazards. Having produced the above, it would be possible to present an argument that the quality issues related to mechanical component/system will not occur in the field. At present this is not done as it is not called for by any standard. This also means that there are no criteria concerning the level of confidence it is necessary to achieve. Many, if not most, of the E/E control systems have an associated mechanical component/system. If a user is injured by the product when it is in service, it could be due to a failure of the mechanical component/system part or the E/E /system part. The distinction between the two is irrelevant from the perspective of the user who will only focus on the injury and not the cause of the injury. There is an obvious question of whether the level of confidence achieved by following the functional safety process is commensurate with the level of confidence achieved by following the robustness approach. Intuitively one would expect them to be commensurate if the risk was the same. At present it is not possible to answer this question. The task is made more difficult as the two use different approaches to consequence ranking and one is targetoriented and the other is achievement-oriented.

A. Way Forward

One means of aligning the functional safety process with the quality and robustness process is to extend the safety case required by the functional safety process, perhaps using the generic term 'assurance case', so as to include the argumentation and evidence emerging from the robustness process. ISO 26262 notes that the safety case could be extended to cover issues beyond the scope of the standard.

A prerequisite is to find a way of aligning the consequence ranking of FMEA/FMECA with that of ISO 26262. This task should be made easier as the quality process adopts a more failure mode avoidance approach. It will also be necessary to have a good knowledge of the current FMEA/FMECA practice and the underlying rationale by which the work is judged to be sufficient. This underlying rationale can then be captured in the argument of the extended safety case.

In addition to an argument that covers both the E/E system and mechanical components there are many potential benefits of aligning the functional safety process and the robustness process. An alignment at the processes level could improve the efficiency of functional safety and quality processes by reducing duplication of effort, or through producing work products that can be used by both disciplines. Alignment could bring greater consistency in the engineering effort expended in handling safety issues that arise from the failure of E/E systems or from failure of mechanical components. Alignment could also lead to improved ability to assess confidence in the results of the quality process. Finally, it may provide a more transparent and rational way of assessing the quality of the FMEA based on the reasoning and evidence that it produces.

Fig. 1 .

 1 Fig. 1. Generic FMEA/FMECA Process FMEA/FMECA-Step 0 is intended to represent the first task of product creation. It corresponds to the Voice of the customer level of abstraction and is only relevant if the FMEA is performed at the concept level.

Fig. 2 .

 2 Fig. 2. Simplified ISO 26262 Process ISO-26262-Step 0 is very similar to FMEA/FMECA-step 0 at the concept level.


Michel Planat
email: michel.planat@femto-st.fr

Alain Giorgetti
email: alain.giorgetti@femto-st.fr

Frédéric Holweck
email: frederic.holweck@utbm.fr

Metod Saniga
email: msaniga@astro.sk

F R Éd

Éric Holweck

Quantum contextual finite

Keywords: Grothendieck's dessins d'enfants, quantum contextuality, finite geometries

HAL is

Introduction

If one draws a (connected) graph -a particular set of vertices and edgeson a smooth surface, then such graph inherits extra local/combinatorial and global/topological features from the surface. If the latter is, for example, a (compact) complex one-dimensional surface -a Riemann surface, then the combinatorics of edges is encapsulated by a two-generator permutation group and the Riemann surface happens to be definable over the field Q of algebraic numbers. This observation is central to the concept of dessins d'enfants (or child's drawings) as advocated by Grothendieck in his Esquisse d'un programme (made available in 1984 following his Long March written in 1981) in the following words: In the form in which Belyi states it, his result essentially says that every algebraic curve defined over a number field can be obtained as a covering of the projective line ramified only over the points 0, 1 and ∞. The result seems to have remained more or less unobserved. Yet it appears to me to have considerable importance. To me, its essential message is that there is a profound identity between the combinatorics of finite maps on the one hand, and the geometry of algebraic curves defined over number fields on the other. This deep result, together with the algebraic interpretation of maps, opens the door into a new, unexplored world -within reach of all, who pass by without seeing it [1, Vol. 1], [START_REF]The Grothendieck Theory of Dessins d'Enfants[END_REF].

Our aim is to show that Grothendieck's dessins d'enfants (see, e. g., [START_REF] Zapponi | What is . . . a dessin d'enfant[END_REF][START_REF] Lando | Graphs on surfaces and their applications[END_REF] as well as [START_REF] Koch | From Matrix Models and quantum fields to Hurwitz space and the absolute Galois group[END_REF]) have, as envisaged in [START_REF] Planat | It from qubit: how to draw quantum contextuality[END_REF], great potential to become a proper language for a deeper understanding of various types of sets of Hermitian operators/observables that appear in finite-dimensional quantum mechanical settings and for furnishing a natural explanation why eigenvalues of these operators are regarded as the only available tracks in associated measurements. The main justification of our aim is provided by the fact that dessins lead very naturally to already-discovered finite geometries underlying quantum contextuality (like the grid, GQ(2, 1), behind Mermin's magic square and/or an ovoid of PG(3, 2) behind Mermin's magic pentagram) and also to those underlying commutation relations between elements of the twoqubit Pauli group (the generalized quadrangle of order two, GQ [START_REF]The Grothendieck Theory of Dessins d'Enfants[END_REF][START_REF]The Grothendieck Theory of Dessins d'Enfants[END_REF], its geometric hyperplanes and their complements, see, e. g., [START_REF] Planat | On the Pauli graphs of N-qudits[END_REF]).

The paper is organized as follows. Section 2 gathers some basic knowledge about dessins d'enfants, their permutation group and topology, their isomorphism with conjugacy classes of subgroups of finite index of the cartographic group C + 2 , as well as about associated Belyi functions. Section 3 focuses on a rather elementary application of our ideas by interpreting Bell's theorem about non-locality in terms of the geometry as simple as a square/quadrangle, which is found to be generated by four distinct dessins defined over the field Q[ √ 2]. Section 4, the core one, starts with a complete catalog of all connected geometries induced by dessins having up to 12 edges and a sketch of important ones with more edges. In the subsequent subsections, we analyze in detail the non-trivial cases by selecting, whenever possible, a dessin of genus zero and having the smallest number of faces. As in most cases Quantum contextual finite geometries from dessins d'enfants 3 the edges of dessins dealt with admit labeling by two-or three-qubit observables, on our way we not only encounter already recognized quantum-relevant finite geometries like the Fano plane, the grid GQ(2, 1), the Petersen graph, the Desargues configuration and the generalized quadrangle GQ(2, 2), but find a bunch of novel ones, some already surmised from different contexts, starting from the Pappus 9 3configuration and the Hesse (9 4 , 12 3 )-configuration (aka the affine plane AG [START_REF]The Grothendieck Theory of Dessins d'Enfants[END_REF][START_REF] Zapponi | What is . . . a dessin d'enfant[END_REF]) to arrive at the generalized quadrangle GQ(2, 4) -and its close siblings, the Clebsch and Schläfli graphs -known to play a role in the context of the black-hole-qubit correspondence [START_REF] Lévay | Black hole entropy and finite geometry[END_REF]. Section 5 is reserved for concluding remarks.

Dessins d'enfants and the Belyi theorem

Dessins d'enfants and their symmetry groups

A map is a graph drawn on a surface -a smooth compact orientable variety of dimension two -such that its vertices are points, its edges are non-intersecting arcs connecting the vertices, and the connected components of its complement, called faces, are homeomorphic to open disks of R 2 . They may exist multiple edges as well as loops, but the graph has to be connected. Denoting the number of vertices, edges and faces by V , E and F , respectively, the genus g of the map follows from Euler's formula V -E + F = 2 -2g. A map can be generalized to a bicolored map. The latter is a map whose vertices are colored in black and white in such a way that the adjacent vertices have always the opposite color; the corresponding segments are the edges of the bicolored map. The Euler characteristic now reads 2 -2g = B + W + F -n, where B, W and n stands for the number of black vertices, the number of white vertices and the number of edges, respectively. Given a bicolored map with n edges labeled from 1 to n, one can associate with it a permutation group P = α, β on the set of labels such that a cycle of α (resp. β) contains the labels of the edges incident to a black vertex (resp. white vertex), taken, say, in the clockwise direction around this vertex; thus, there are as many cycles in α (resp. β) as there are black (resp. white vertices), and the degree of a vertex is equal to the length of the corresponding cycle. An analogous cycle structure for the faces follows from the permutation γ satisfying αβγ = 1.

Bicolored maps (allowed to have any valency for their vertices) are in one-toone correspondence with hypermaps [START_REF] Walsh | Hypermaps versus bipartite maps[END_REF]. They correspond to the conjugacy classes of subgroups of finite index of the free group on two generators H + 2 = ρ 0 , ρ 1 . The number of hypermaps with n half-edges is given by the sequence A057005 in the OEIS [START_REF]The On-Line Encyclopedia of Integer Sequences[END_REF]. For n = 1, . . . , 7 these numbers are 1, 3, 7, 26, 97, 624 and 4163. Hypermaps are, of course, allowed to have any valency for their vertices.

We consider bicolored maps where the valency of white vertices is ≤ 2. They correspond to hypermaps of the so-called pre-clean type. As already observed by Grothendieck himself, who called them dessins d'enfants (child's drawings) [START_REF]The Grothendieck Theory of Dessins d'Enfants[END_REF]- [START_REF] Girondo | Introduction to Riemann surfaces and dessins d'enfants[END_REF], these bicolored maps on connected oriented surfaces are unique in the sense that they are in one-to-one correspondence with conjugacy classes of subgroups of finite index of the triangle group, also called cartographic group

C + 2 = ρ 0 , ρ 1 |ρ 2 1 = 1 . (1)
The existence of associated dessins of prescribed properties can thus be straightforwardly checked from a systematic enumeration of conjugacy classes of C + 2 ; with the increasing n > 0 the number of such dessins grows quite rapidly [START_REF] Grothendieck | Sketch of a programme[END_REF][START_REF] Zapponi | What is . . . a dessin d'enfant[END_REF][START_REF] Zapponi | What is . . . a dessin d'enfant[END_REF][START_REF]The On-Line Encyclopedia of Integer Sequences[END_REF][START_REF] Mermin | a) What's wrong with these elements of reality[END_REF]56,131,482,1551,5916,22171,90033,370199

, • • •

A dessin D can be ascribed a signature s = (B, W, F, g) and the full information about it can be recovered from the structure of the generators of its permutation group P (also named the passport in [START_REF] Lando | Graphs on surfaces and their applications[END_REF][START_REF] Zvonkin | Belyi functions: examples, properties, and applications[END_REF]) in the form [C α , C β , C γ ], where the entry C i , i ∈ {α, β, γ} has factors l ni i , with l i denoting the length of the cycle and n i the number of cycles of length l i .

Belyi's theorem

Given f (x), a rational function of the complex variable x, a critical point of f is a root of its derivative and a critical value of f is the value of f at the critical point. Let us define a so-called Belyi function corresponding to a dessin D as a rational function f (x) of degree n if D may be embedded into the Riemann sphere Ĉ in such a way that (i) the black vertices are the roots of the equation f (x) = 0 with the multiplicity of each root being equal to the degree of the corresponding (black) vertex, (ii) the white vertices are the roots of the equation f (x) = 1 with the multiplicity of each root being equal to the degree of the corresponding (white) vertex, (iii) the bicolored map is the preimage of the segment [0, 1], that is D = f -1 ([0, 1]), (iv) there exists a single pole of f (x), i. e. a root of the equation f (x) = ∞, at each face, the multiplicity of the pole being equal to the degree of the face, and, finally, (v) besides 0, 1 and ∞, there are no other critical values of f [START_REF] Zvonkin | Belyi functions: examples, properties, and applications[END_REF].

It can be shown that to every D there corresponds a Belyi function f (x) and that this function is, up to a linear fractional transformation of the variable x, unique. It is, however, a highly non-trivial task to find/calculate the Belyi function for a general dessin.

Finite geometries from dessins d'enfants

An issue of central importance for us is the fact that one can associate with a dessin D a point-line incidence geometry, G D , in the following way. A point of G D corresponds to an edge of D. Given a dessin D, we want its permutation group P to preserve the collineation of the geometry G D . We first ask that every pair of points on a line shares the same stabilizer in P . Then, given a subgroup S of P which stabilizes a pair of points, we define the point-line relation on G D such that two points on the same line share the same stabilizer. The lines on a geometry are distinguished by their (isomorphic) stabilizers acting on different G-sets. This construction allows to assign finite geometries

G D i to a dessin D, i = 1, • • • , m with
Quantum contextual finite geometries from dessins d'enfants 5 m being the number of non-isomorphic subgroups S of P that stabilize a pair of elements a . As a slight digression we mention that, presumably, this action of the group P of a dessin D on the associated geometry G D is intricately linked with the properties of the absolute Galois group Γ = Gal( Q/Q), which is the group of automorphisms of the field Q of algebraic numbers. Although Γ is known to act faithfully on D [START_REF]The Grothendieck Theory of Dessins d'Enfants[END_REF][START_REF] Girondo | Introduction to Riemann surfaces and dessins d'enfants[END_REF], its action on G D must be rather non-trivial because the map from D to G D is non injective. Further work is necessary along this line of thoughts to clarify the issue.

Using a computer program, we have been able to completely catalogize incidence geometries associated with dessins featuring up to 12 edges, and also found several dessins of higher rank that produce distinguished geometries. The results of our calculations are succinctly summarized in Tables 1 and2. The subsequent sections provide a detailed account of a variety of dessins computed, their corresponding point-line incidence geometries, and, what is perhaps most important, how these relate to the physics of quantum observables of multiple-qubit Pauli groups and related quantum paradoxes. In other words, we shall give a more exhaustive and rigorous elaboration of the ideas first outlined in a short essay-like treatise [START_REF] Planat | It from qubit: how to draw quantum contextuality[END_REF].

The square geometry of Bell's theorem and the corresponding dessins

In a theory in which parameters are added to quantum mechanics to determine the results of individual measurements, without changing the statistical predictions, there must be a mechanism whereby the setting of one measuring device can influence the reading of another instrument, however remote [START_REF] Bell | On the Einstein Podolsky Rosen paradox[END_REF].

The square geometry of Bell's theorem Suppose we have four observables σ i , i = 1, 2, 3, 4, taking values in {-1, 1}, of which Bob can measure (σ 1 , σ 3 ) and Alice (σ 2 , σ 4 ). The Bell-CHSH approach to quantum contextuality/non-locality consists of defining the number

C = σ 2 (σ 1 + σ 3 ) + σ 4 (σ 3 -σ 1 ) = ±2
and observing the (so-called Bell-CHSH) inequality [18, p. 164]

| σ 1 σ 2 + σ 2 σ 3 + σ 3 σ 4 -σ 4 σ 1 | ≤ 2,
where here means that we are taking averages over many experiments. This inequality holds for any dichotomic random variables σ i that are governed by a joint probability distribution. Bell's theorem states that the aforementioned inequality a Our definition follows an example of the action on the Fano plane of a permutation group of order |P SL(2, 7)| = 168 associated with a tree-like dessin (of the relevant cycle structure) given in [2, (a) is violated if one considers quantum observables with dichotomic eigenvalues. An illustrative example is the following set of two-qubit observables Here and below we use the notation X, Y and Z for the ordinary Pauli spin matrices and, e. g., IX is a short-hand for I ⊗ X (used also in the sequel). We find that

σ 1 = IX, σ 2 = XI, σ 3 = IZ, σ 4 = ZI. (2
C 2 = 4 * I + [σ 1 , σ 3 ][σ 2 , σ 4 ] = 4     1 . . 1 . 1 1 . . 1 1 . 1 . . 1    
has eigenvalues 0 and 8, both with multiplicity 2 ( 1 ≡ -1). Taking the norm of the bounded linear operator A as ||A|| = sup(||Aψ||/||ψ||), ψ ∈ H (H being the corresponding Hilbert space), one arrives at the maximal violation of the Bell-CHSH inequality [18, p. 174], namely ||C|| = 2 √ 2. The point-line incidence geometry associated with our four observables is one of the simplest, that of a square -Fig. 1a; each observable is represented by a point and two points are joined by a segment if the corresponding observables commute. It is worth mentioning here that there are altogether 90 distinct squares among two-qubit observables and as many as 30240 when three-qubit labeling is employed [START_REF] Planat | Distinguished three-qubit 'magicity' via automorphisms of the split Cayley hexagon[END_REF], each yielding a maximal violation of the Bell-CHSH inequality.

Dessins d'enfants for the square and their Belyi functions

As it is depicted in Fig. 1, the geometry of square can be generated by four different dessins, b 1 , • • • , b 4 , associated with permutations groups P isomorphic to the dihedral group D 4 of order 8. 1). Finally, the fourth dessin (b 4 ) has P = (1, 2, 4, 3), (2, 3) , the signature s = (1, 3, 2, 0) and cycle structure [4 1 , 2 1 1 2 , 2 2 ]. The Belyi function reads f (x) = (x-1) 4 16x 2 ; hence, f ′ (x) = (x-1) 3 (x+1) 8x 3 . The critical points are at x = -1 (with critical value 1) and x = 1 (with critical value 0), the preimage of 0 is the black vertex at x = 1 and the preimage of 1 consists of the white vertices at x ∈ {-1, 3 ± √ 8}. Summing up, one of the simplest observable proofs of Bell's theorem is found to rely on the geometry of a square and four distinct dessins associated with it. Although we still do not know how these dessins are related to each other, it is quite intriguing to see that all critical points live in the extension field Q( √ 2) ∈ Q of the rational field Q. Hence, a better understanding of the properties of the group of automorphisms of this field (which is itself a subgroup of the absolute Galois group Γ) may lead to fresh insights into the nature of this important theorem of quantum physics.

(x) = (x-1) 4 4x(x-2) . As f ′ (x) = (x-1) 3 (x 2 -2x-1) 2(x-2) 2 x 2

A wealth of other notable point-line geometries relevant to contextuality

It is also appealing to see the failure of the EPR reality criterion emerge quite directly from the one crucial difference between the elements of reality (which, being ordinary numbers, necessarily commute) and the precisely corresponding quantum mechanical observables (which sometimes anti-commute) [15, (a)]. As the geometries of index five are only trivial simplices (see Table 1), we have to move to index six in order to encounter non-trivial guys, namely the octahedron and the bipartite graph of type K(3, 3). The octahedron can be labeled by three-qubit observables, and one such labeling is given in Fig. 2a. The figure also illustrates one of the associated dessins (b), whose Belyi function of is f (x) = 27 32 x 2 (2 -x 2 ) 2 . The function has critical points at x = 0 and x = ± √ 2 (these being also the preimage of 0), and the white vertices of the dessin correspond to x = ± 2/3 and x = ± 8/3 (the preimage of 1).

A remarkable property of the graph K(3, 3) is that it lives in the generalized quadrangle GQ(2, 2), disguised there as a generalized quadrangle of type GQ(1, 2) [START_REF] Polster | Generalized flatland[END_REF]. And since GQ(2, 2) was found to mimic the commutation relations between elements of the two-qubit Pauli group [START_REF] Planat | On the Pauli graphs of N-qudits[END_REF], K(3, 3) thus naturally lends itself, like the above-discussed square, to a labeling in terms of two-qubit observables -as, for example, depicted in Fig. 3a. One of the associated dessins (Fig. 3b) possesses the Belyi function of the form f (x) = ax 4 (x -1) 2 , where a = 3 6 2 4 = 729 16 . Since f ′ (x) = ax 3 (x -1)(3x -2) the critical points are at x = 2/3, x = 0 and x = 1. The black vertices of the dessin correspond to x = 0 and x = 1; out of its five white vertices three answer to real-valued variable, namely x = -1 3 , x = 2 3 and x ≈ 1.118 (the latter being denoted as x 1 in Fig. 3b), and the remaining two -denoted as x 2 and x 3 in the figure in question -have imaginary, complex-conjugate one:

Quantum contextual finite geometries from dessins d'enfants 11 Fig. 4. The Fano plane portrayed in its most frequent rendering (a) and one of its ten stabilizing dessins (b).

x ≈ 0.36 exp (±iφ), with φ ≈ 99.4 • .

The Fano plane (everywhere)

The only non-trivial geometry of index seven is the projective plane of order two, the Fano plane (Fig. 4a). This plane plays a very prominent role in finite-dimensional quantum mechanics, being, for example, intricately related -through the properties of the split Cayley hexagon of order two [START_REF] Polster | Generalized flatland[END_REF] -to the structure of the three-qubit Pauli group [START_REF] Lévay | Three-qubit operators, the split Cayley hexagon of order two and black holes[END_REF]. A quick computer search for all permutation subgroups of C + 2 isomorphic to the group P SL(2, 7), the automorphism group of the Fano plane, shows that this plane can be recovered from 10 distinct dessins. One choice is depicted schematically in Fig. 4b; it corresponds to passport 8 (the fourth dessin) in the catalog of Bétréma & Zvonkin [START_REF] Bétréma | Arbres plans et polynomes de Shabat: catalogue (Catalog of plane trees and Shabat polynomials[END_REF]. The corresponding permutation group is P = (2, 7, 6, 5)(3, 4), (1, 2)(3, 5) and the Belyi function reads

f (x) = √ 8x 4 (x -1) 2 (x -a), with a = -1 4 (1 + i √ 7
); its critical points are located at x = 0 and x = 1 (yielding critical value 0) and at x = a (yielding 1).

The 16-cell, stellated octahedron and the completed cube

When moving to index eight, we encounter an appealing 16-cell on the one hand, and the remarkably "twinned" stellated octahedron and completed cube on the other hand.

The 16-cell (Fig. 5a) arises from a "straight-line" dessin with the signature (5, 4, 1, 0) and the permutation group isomorphic to D 8 . Its Belyi function is the fourth order of the map x → x 2 -2, that is f (x) = 8x(x 2 -2)(x 4 -4x 2 + 2), with critical points located at x -0, x = ± √ 2 and x = ± 2 ± √ 2. The dessin with signature s = (2, 6, 2, 0) , illustrated in Fig. 6c, has the permutation group P = (1, 2, 4, 3)(5, 7, 6, 8), (2, 5)(3, 7) , which is isomorphic to Z 3 2 ⋊ Z 2 and endowed with the cycle structure of the form [4 2 , 2 2 1 4 , 4 2 ]. The stabilizer of a pair of its edges is either the group Z 2 , leading to the geometry of a stellated octahedron (Fig. 6a), or the trivial single element group Z 1 , in which case we get the geometry of a (triangle free) completed cube, i. e. the ordinary cube where pairs of opposite points are joined (Fig. 6b). The latter configuration also appears in a recent paper [21, pp. 33-34 as well as Conjecture 6.1] as an 8-face Kepler-Poinsot quadrangulation of the torus. Note that, in addition the 6 faces shared with the ordinary cube, the completed cube contains also 8 non-planar faces of which four are self-intersecting. The completed cube can also be viewed as the bipartite graph K(4, 4). The Belyi function of the dessin has the form

f (x) = K (x -1) 4 (x -a) 4 x 3 , a = 8 √ 10 -37 27 , K ≈ -0.4082,
from where we find the positions of "critical" white vertices to be x ≈ 0.0566 ± 0.506i, with the other four white vertices being located at x = -1.069, x = -0.162 and x = 1.634 ± 0.6109i.

Quantum contextual finite geometries from dessins d'enfants 13 Fig. 6. The stellated octahedron (a), the completed cube (b) and their common stabilizing dessin (c).

4.4.

Geometries of index nine: grid (Mermin's square), Pappus and Hesse

In the realm of index nine we meet, in addition to our old friend, a 3 × 3-grid (alias generalized quadrangle GQ(2, 1)), also other distinguished finite geometries like the Pappus 9 3 -configurations and the Hesse 9 4 12 3 -configuration (aka the affine plane of order three, AG(2, 3)).

As already mentioned, the grid lives (as a geometric hyperplane) in GQ(2, 2) and underlies a Mermin "magic" square array of observables furnishing a simple two-qubit proof of the Kochen-Specker theorem [START_REF] Planat | It from qubit: how to draw quantum contextuality[END_REF][START_REF] Planat | On small proofs of the Bell-Kochen-Specker theorem for two, three and four qubits[END_REF]. A Mermin square built around Bell's square of Fig. 1a is shown in Fig. 7a. It needs a genus one dessin, with signature (2, 5, 2, 1), to be recovered, as shown in Fig. 7b. The corresponding permutation group is P = (1, 2, 4, 8, 7, 3)(5, 9, 6), [START_REF]The Grothendieck Theory of Dessins d'Enfants[END_REF][START_REF] Koch | From Matrix Models and quantum fields to Hurwitz space and the absolute Galois group[END_REF]

(3, 6)(4, 7)(8, 9) ∼ = Z 2 3 ⋊ Z 2 2 , having the cycle structure [6 1 3 1 , 2 4 1 1 , 6 1 3 1 ].
This dessin lies on a Riemann surface that is a torus (not a sphere Ĉ), being thus represented by an elliptic curve. The topic is far more advanced and we shall not pursue it in this paper (see, e. g., [START_REF] Girondo | Introduction to Riemann surfaces and dessins d'enfants[END_REF] for details). The stabilizer of a pair of edges of the dessin is either the group Z 2 , yielding Mermin's square M 1 shown in Fig 7a, or the group Z 1 , giving rise to a different square M 2 from the maximum sets of mutually non-collinear pairs of points of M 1 . The union of M 1 and M 2 is nothing but the Hesse configuration. The Hesse configuration (Fig. 8a), of its own, can be obtained from a genus-zero dessin shown in Fig. 8b (also reproduced in Fig. 3b of [START_REF] Planat | It from qubit: how to draw quantum contextuality[END_REF]). This configuration was already noticed to be of importance in the derivation of a Kochen-Specker inequality in [START_REF] Bengtsson | A Kochen-Specker inequality from a SIC[END_REF].

The Pappus configuration, illustrated in Fig. 9a, comprises three copies of the already discussed K(3, 3)-configuration (Fig. 3a); the three copies are represented by the point-sets {1, 3, 5, 6, 7, 8}, {2, 3, 4, 5, 8, 9} and {1, 2, 4, 6, 7, 9}, which pairwise overlap in distinct triples of points. A dessin d'enfants for the Pappus configuration is exhibited in Fig. 9b. It is important to point out here a well-known fact that the Pappus configuration is obtained from the Hesse one by removing three mutually skew lines from it (for example, the three lines that are represented in Fig. 8a by three concentric circles).

Realm of index ten: Mermin's pentagram, Petersen and Desargues

Apart from the two plexes (see Table 1), the only connected configurations generated by 10-edge dessins are Mermin's pentagram, the Petersen graph, the Desargues configuration and the bipartite graph K(5, 5). The dessin sketched in Fig. 10c, having s = (4, 6, 2, 0) and the alternating group A 5 with cycle structure [3 2 1 1 , 2 4 1 2 , 5 2 ], induces either the geometry of Mermin's pentagram (Fig. 10a) or that of the Petersen graph (Fig. 10b) according as the group stabilizing pairs of its edges is isomorphic to Z 1 or Z 2 , respectively. A particular three-qubit realization leading to a proof of the Kochen-Specker theorem is explicitly shown (see, e. g., [START_REF] Planat | Distinguished three-qubit 'magicity' via automorphisms of the split Cayley hexagon[END_REF][START_REF] Planat | On small proofs of the Bell-Kochen-Specker theorem for two, three and four qubits[END_REF] for more details on importance of these geometries in quantum theory). The dessin depicted in Fig. 11b also gives rise to a couple of geometries, one being again the Petersen graph (with the stabilizer group of a pair of edges isomorphic to Z 2 2 ) and the other being (Fig. 11a) the famous Desargues 10 3 configuration (with the group Z 2 ). The labeling is compatible with that in Fig. 10, which means that the Desargues configuration represents another way of encoding a three-qubit proof of contextuality; in particular, a line of Mermin's pentagram corresponds to a complete graph K 4 within the Desargues configuration as well as to a maximum set of mutually disjoint vertices in the Petersen graph. We now come to a perhaps most exciting, and encouraging as well, finding that there exists a dessin generating the configuration of a central importance for any quantum physical reasoning involving two-qubit observables, namely the configura- tion (illustrated in Fig. 12a) known as 15 3 Cremona-Richmond configuration, or the generalized quadrangle of order two, GQ(2, 2), or the symplectic polar space of rank two and order two, W [START_REF] Zapponi | What is . . . a dessin d'enfant[END_REF][START_REF]The Grothendieck Theory of Dessins d'Enfants[END_REF]. That this configuration is indeed one of corner-stones of finite dimensional quantum mechanics is also illustrated by the fact that many of the already discussed geometries, in particular the K(3, 3) graph, the 3 × 3 grid, the Pappus and Desargues configurations and the Petersen graph, are intricately tied to its structure, as explained in detail in [START_REF] Planat | On the Pauli graphs of N-qudits[END_REF], [START_REF] Saniga | The Veldkamp Space of two-qubits[END_REF]- [START_REF] Havlicek | Factor-Group-Generated Polar Spaces and (Multi-)Qudits[END_REF]. The associated dessin (Fig. 12b) is of signature (5, 9, 3, 0) and its permutation group has the cycle structure [6 1 3 2 2 1 1 1 , 2 6 1 3 , 6 2 3 1 ]. Unfortunately, the complexity of this dessin is already so high that with our current computer power we have not been able to find the corresponding Belyi function. Finding this function thus remains one important challenge of our dessin d'enfants programme.

The generalized quadrangle GQ(2, 4), the Schläfli graph and the Clebsch graph

As already mentioned, the generalized quadrangle of type GQ(2, 4) is a prominent finite geometry in the context of the so-called black-hole-qubit correspondence [START_REF] Lévay | Black hole entropy and finite geometry[END_REF], as it completely underlies the E 6 -symmetric entropy formula describing black holes and black strings in D = 5. We were thus very pleased to find a dessin that leads to the collinearity graphs of this geometry, and to its complement -the famous Final

Quantum contextual finite geometries from dessins d'enfants 17 Schläfli graph -as well (Fig. 13). Moreover, GQ (2 ,4) is also notable by the fact it contains (altogether 27) copies of the Clebsch graph, each such copy being the complement of a geometric hyperplane of particular type. And since the Clebsch graph is also a dessin-generated one (see Table 2), we will not be surprised if our dessin's formalism is also found of relevance for getting conceptual insights into the still-mysterious formal link between stringy black hole entropy formulas and properties of multi-qubits (for a recent review, see [START_REF] Borsten | The black-hole/qubit correspondence: an upto-date review[END_REF]).

Conclusion

We have demonstrated, substantially boosting the spirit of [START_REF] Planat | It from qubit: how to draw quantum contextuality[END_REF], that Grothendieck's dessins d'enfants ("child's drawings") -that is graphs where at each vertex is given a cyclic ordering of the edges meeting it and each vertex is also assigned one of two colors, conventionally black and white, with the two ends of every edge being colored differently -and their associated permutation groups/Belyi functions give rise to a wealth of finite geometries relevant for quantum physics. We have made a complete catalog of these geometries for dessins featuring up to 12 edges, highlighted distinguished geometries for some higher-index dessins, and briefly elaborated on quantum physical meaning for each non-trivial geometry encountered. We are astonished to see that a majority of dessin-generated geometries have already been found to have a firm footing in finite-dimensional quantum mechanical setting, like the K(3, 3) and Petersen graphs, the Fano plane, the 3 × 3 grid (Mermin's square), the Desargues configuration, Mermin's pentagram and the generalized quadrangles GQ(2, 2) and GQ [START_REF]The Grothendieck Theory of Dessins d'Enfants[END_REF][START_REF] Lando | Graphs on surfaces and their applications[END_REF]. We have also found a wealth of geometries, among them the Hesse 9 4 12 3 -configuration, the Reye 12 4 16 3 -configuration [START_REF] Aravind | How Reye's configuration helps in proving the Bell-Kochen-Specker theorem: a curious geometrical tale[END_REF], the 3 × 3 × 3-grid, the Kneser graph KG (7,2) and many others, that still await their time to enter the game. Our findings may well be pointing out that properties of dessins, as well as the Galois group G = Gal( Q/Q) acting on them, may be vital for getting deeper insights into foundational aspects of quantum mechanics. To this end in view, we aim to expand in a systematic way our catalog of finite geometries generated by higher-index dessins in order to reveal finer traits of the quantum pattern outlined above. Final

Fig. 1 ., √ 2 ,

 12 Fig.1. A simple observable proof of Bell's theorem is embodied in the geometry of a (properly labeled) square (a) and four associated dessins d'enfants, (b 1 ) to (b 4 ). For each dessin an explicit labeling of its edges in terms of the four two-qubit observables is given. The (real-valued) coordinates of black and white vertices stem from the corresponding Belyi functions as explained in the main text.

Quantum contextual finite geometries from dessins d'enfants 9 Fig. 2 .

 92 Fig. 2. The octahedron with vertices labeled by three-qubit observables (a) and an associated dessin (b).

Fig. 3 .

 3 Fig. 3. The bipartite graph K(3, 3) with one of its two-qubit labelings (a) and its generating dessin (b).

4. 1 .

 1 Two geometries of index six: the octahedron and the bipartite graph K[START_REF] Zapponi | What is . . . a dessin d'enfant[END_REF][START_REF] Zapponi | What is . . . a dessin d'enfant[END_REF]

Fig. 5 .

 5 Fig. 5. The 16-cell (a) and an associated dessin (b).

Fig. 7 .

 7 Fig. 7. A 3 × 3 grid with points labeled by two-qubit observables (aka a Mermin magic square) (a) and a stabilizing dessin drawn on a torus (b).

Quantum contextual finite geometries from dessins d'enfants 15 Fig. 8 .

 158 Fig. 8. The Hesse configuration (a) and an associated genus-zero dessin (b).

4. 6 .

 6 The Cremona-Richmond 15 3 -configuration, alias GQ(2, 2), or W[START_REF] Zapponi | What is . . . a dessin d'enfant[END_REF][START_REF]The Grothendieck Theory of Dessins d'Enfants[END_REF]

Fig. 9 .

 9 Fig. 9. The Pappus configuration (a) and a stabilizing dessin (b).

Fig. 10 .

 10 Fig. 10. The Mermin pentagram (a), the Petersen graph (b) and their generating dessin (c).

Quantum contextual finite geometries from dessins d'enfants 19 Fig. 12 .

 1912 Fig. 12. The Cremona-Richmond 15 3 -configuration (a) with its points labeled by the elements of the two-qubit Pauli group and a stabilizing dessin (b).

Fig. 13 .

 13 Fig.[START_REF] Girondo | Introduction to Riemann surfaces and dessins d'enfants[END_REF]. The dessin for both the collinearity graph of the generalized quadrangle of type GQ[START_REF]The Grothendieck Theory of Dessins d'Enfants[END_REF][START_REF] Lando | Graphs on surfaces and their applications[END_REF] and its complement, the Schläfli graph.

Table 1 .

 1 , vol. 2, p. 17 and p. 50]. A catalog of connected point-line incidence geometries induced by dessins d'enfants of small index ≤ 12. For each geometry, when represented by its collinearity graph, we list the number of points, edges (line-segments joining two points), triangles and squares it contains. Here, A-simplices should be regarded as trivial because their dessins are star-like and associated Belyi functions are of a simple form f (x) = x A , where A is the multiplicity of the singular point at x = 0.

	index	name vertices edges triangles squares
	3	2-simplex (triangle)	3	3	0
	4	3-simplex (tethahedron)	4	6	0
		square/quadrangle	4	4	1
	5	4-simplex (5-cell)	5	10	0
	6	5-simplex	6	15	0
		3-orthoplex (octahedron)	6	12	3
		bipartite graph K(3, 3)	6	9	9
	7	6-simplex	7	21	0
		Fano plane (7 3 )	7	21	0
	8	7-simplex	8	28	0
		4-orthoplex (16-cell)	8	24	6
		completed cube K(4, 4)	8	16	36
		stellated octahedron	8	12	0
	9	8-simplex	9	36	0
		Hesse (9 4 12 3 )	9	36	0
		K(3) 3	9	27	27
		Pappus (9 3 )	9	27	27
	10	(3 × 3)-grid 9-simplex	9 10	18 45	9 0
		5-orthoplex	10	40	10
		bipartite graph K(5, 5)	10	25	100
		Mermin's pentagram	10	30	15
		Petersen graph	10	15	0
		Desargues (10 3 )	10	30	15
	11	10-simplex	11	55	0
	12	11-simplex	12	66	0
		6-orthoplex	12	60	15
		bipartite graph K(6, 6)	12	36	255
		threepartite graph K(4, 4, 4)	12	48	108
		fourpartite graph K(3, 3, 3, 3)	12	54	54

Table 2

 2 ) , 116 , -2 8 , -8 2 ) 27 216 504 sp(16 1 , 4 2 , 1 12 , -2 8 , -5 4 ) 27 216 612

		Quantum contextual finite geometries from dessins d'enfants 7
	index	name vertices edges triangles squares
	15 Cremona-Richmond (15 3 ) (alias GQ(2, 2))	15	45	15
	16 18 20 21 22 27	Clebsch graph CG: sp(10 1 , 2 5 , -2 10 ) Shrikhande graph SG: sp(6 1 , 2 6 , -2 9 ) sp(8 1 , 0 9 , -4 4 , 2 4 ) sp(0 10 , -8 1 , 8 1 , -2 4 , 2 4 ) Kneser graph KG (7,2) : sp(10 1 , 3 6 , -2 14 ) L(IG(7, 3, 1)) : sp(4 1 , -2 8 , (1 ± √ 2) 6 ) √ 3 10 ) IG(11, 5, 2): sp(±5 1 , ± GQ(2, 4): sp(10 1 , 1 20 , -5 6 ) Schläfli graph SHG: sp(16 1 , 4 6 , -2 20 ) sp(16 1	16 16 18 20 21 21 22 27 27	80 48 72 80 105 42 55 135 216	0 32 48 0 35 14 0 45 720

. A few (non-trivial) connected point-line incidence geometries induced by dessins d'enfants of index greater than 12. The spectra of (collinearity) graphs, denoted as sp(• • • , a b , • • • ) where an eigenvalue a is of multiplicity b, are also displayed. IG(ν, k, λ) means the incidence graph of a symmetric 2 -(ν, k, λ) design and L(• • • ) stands for the line graph.

M. Planat, A. Giorgetti, F. Holweck and M. Saniga

M. Planat, A. Giorgetti, F. Holweck and M. Saniga

M. Planat, A. Giorgetti, F. Holweck and M. Saniga

M. Planat, A. Giorgetti, F. Holweck and M. Saniga

M. Planat, A. Giorgetti, F. Holweck and M. Saniga

M. Planat, A. Giorgetti, F. Holweck and M. Saniga Fig. 11. The Desargues configuration (a) and its generating dessin (b).

Acknowledgments

This work started while two of the authors (M. P. and M. S.) were fellows of the "Research in Pairs" Program of the Mathematisches Forschungsinstitut Oberwolfach (Oberwolfach, Germany), in the period from 24 February to 16 March, 2013. It was also supported in part by the VEGA Grant Agency, grant No. 2/0003/13.

Bibliography