Luca Berti

Laetitia Giraldi

Christophe Prud'homme

Swimming at Low Reynolds number

We address the swimming problem at low Reynolds number. This regime, which is typically used for micro-swimmers, is described by Stokes equations. We couple a PDE solver of Stokes equations, derived from the Feel++ finite elements library, to a quaternion-based rigid-body solver. We validate our numerical results both on a 2D exact solution and on an exact solution for a rotating rigid body respectively. Finally, we apply them to simulate the motion of a one-hinged swimmer, which obeys to the scallop theorem.

Resumé. Nous considérons le problème de la nage à bas nombre de Reynolds. Ce régime, typique des micro-organismes nageurs, est décrit par les équations de Stokes. Nous couplons un solveur d'EDP des équations de Stokes, construit à l'aide de la librairie aux éléments finis Feel++, avec un solveur de corps rigide basé sur les quaternions. Nous validons les deux solveurs à l'aide d'une solution exacte en 2D pour le fluide et d'une solution exacte pour un corps rigide qui tourne. Nous les appliquons pour simuler la nage d'un micro-organisme qui obéit au théorème de la coquille de Saint-Jacques.

Introduction

One of the first works in the field of microswimming was proposed by E. Purcell, who presented in 1977 his observations regarding micro-swimmers' swimming strategies. In [START_REF] Purcell | Life at low reynolds number[END_REF] he noticed that, at the microscale, Reynolds number is small, which means that viscous dissipative forces overcome inertial ones. This observation has two consequences: firstly, Navier-Stokes fluid equations, at the swimmer's scale, can be approximated very well by Stokes equations. These have the characteristics of instantaneously diffusing any change in momentum, and they also guarantee the adherence of the fluid to the boundary of the swimmer at every instant; secondly, certain types of deformations, that usually at human scale produce a net displacement, do not give any motion at the micro-scale. The well-known Scallop theorem [START_REF] Chambrion | Generalized scallop theorem for swimmers[END_REF][START_REF] Purcell | Life at low reynolds number[END_REF] specifies some of them.

Since Stokes equations are time-invariant, the important factors, in terms of swimming, are just the body configurations and not the speed of deformation.

A typical value of Reynolds number Re = U L ν at the microscale is 10 -5 . In this case the length-scale of microscopic swimmers is taken to be L ≈ 10 -6 m, their mean velocity U ≈ 30 µm/s and water kinematic viscosity ν ≈ 10 -6 m 2 /s.

Mathematical analysis of microswimming has mainly developed in the field of control theory, due to its applications to micro-robotics. In fact, it is a matter of great importance to understand how the propelling mechanisms of a robot influence its motion and its controllability. As microrobots might be used as vessels for targeted drug administration or as microsurgery devices, the necessity of control theory becomes clear. In [35, chapter 16] some applications are mentioned: they can range from medical imaging of regions that cannot be reached through endoscopy, to targeted drug delivery or micro-surgery. Different propulsion techniques can be devised: in [START_REF] Ahmed | Artificial acousto-magnetic soft microswimmers[END_REF] a combined acoustic and magnetic control was proposed, while in [START_REF] Oulmas | 3d closed-loop motion control of swimmer with flexible flagella at low reynolds numbers[END_REF] a magnetic control alone was studied.

Microswimming (under the approximation given by the Stokes regime) has already been analyzed from the ODE point of view using Resistive Force Theory [START_REF] Gray | The propulsion of sea-urchin spermatozoa[END_REF]. This theory allows the approximation of fluid effects via appropriate coefficients. Such coefficients, inserted in the ordinary differential equations that arise from the Newton equations of motion, approximate horizontal and vertical drag forces for a variety of swimmers made of simple shapes, like segments or circles. The approximation deriving from Resistive Force Theory makes it possible to use ODE control techniques in this framework [START_REF] Alouges | Self-propulsion of slender microswimmers by curvature control: N-link swimmers[END_REF][START_REF] Alouges | Can magnetic multilayers propel artificial microswimmers mimicking sperm cells?[END_REF][START_REF] Giraldi | Local controllability of the two-link magneto-elastic micro-swimmer[END_REF][START_REF] Giraldi | Addendum to "local controllability of the two-link magneto-elastic microswimmer[END_REF][START_REF] Giraldi | Optimal design of purcell's three-link swimmer[END_REF].

Swimming simulations have been addressed also in the PDE setting by several authors studying fluidstructure interaction. In this case, fluid forces could be computed for swimmers with different shapes. Several techniques can be applied, like level set methods [START_REF] Bergmann | Modeling and simulation of fish-like swimming[END_REF][START_REF]Bioinspired swimming simulations[END_REF], fictitious domain methods [START_REF] Aguillon | Modelling and simulation of 2d stokesian squirmers[END_REF] or immersed boundary methods [START_REF] Fauci | Sperm motility in the presence of boundaries[END_REF]. Other schemes, like boundary element methods, can be applied when the governing equations have an associated Green function, like Stokes problem does (see [START_REF] Pimponi | [END_REF]).

Up to now, literature has mainly considered microswimmers that can be represented by finite dimensional control systems, and very often the effects of fluid forces on the body and of its elasticity are modeled in a simplified manner, in order to still use tools from control theory of ODEs. Swimmers of different shapes have been investigated: among them there are Purcell 3-link microswimmer, the N-link microswimmer [START_REF] Alouges | Self-propulsion of slender microswimmers by curvature control: N-link swimmers[END_REF], sphere-based microswimmers [START_REF] Montino | Three-sphere low-reynolds-number swimmer with a passive elastic arm, The European physical journal[END_REF] and some other models that add elasticity effects through torsional springs or control the swimmer through an externally imposed magnetic field. An important challenge, coming from microrobot control and linked to the applications we have mentioned earlier, is controlling the object close to walls or obstacles. Some results concerning controllability in the half space have been obtained by L. Giraldi [START_REF] Alouges | Enhanced controllability of low reynolds number swimmers in the presence of a wall[END_REF][START_REF] Gérard-Varet | Rough wall effect on micro-swimmers[END_REF].

Other studies about control of microswimmers have been presented in [START_REF] Lohéac | Contrôle en temps optimal et nage à bas nombre de Reynolds[END_REF], where a deformable amoeba was studied, and in subsequent papers by Lohéac and Munnier [START_REF]Controllability of 3d low reynolds number swimmers[END_REF]. Other studies focused on the geometry arising from microswimming, for example [START_REF] Chambrion | Generalized scallop theorem for swimmers[END_REF][START_REF] Shapere | Geometry of self-propulsion at low reynolds number[END_REF]. In [START_REF] Chambrion | Generalized scallop theorem for swimmers[END_REF] the scallop theorem is extended using Riemannian geometry and in [START_REF] Chambrion | Optimal strokes for driftless swimmers: A general geometric approach[END_REF] optimal control of a finite-dimensional swimmer moving on a straight line is studied.

The aim of this paper is to compute the displacement of a microscopic scallop in order to illustrate the Scallop theorem of Purcell, using the finite element library Feel++.

The paper is organised as follows: in Section 1 we will present the mathematical model and the governing equations of swimmer's displacement. Section 2 introduces the associated discrete problem. Section 3 gives some details about the implementation of it. Section 4 presents our numerical results on the scallop swimmer. A paragraph with remarks and perspectives concludes the paper.

The model

In this section, the equations that are considered along the paper are introduced. Section 1.1 is devoted to the description of the fluid model. Section 1.2 describes how the rigid body motion can be recovered given an imposed swimmer body deformation.

The fluid equations

In our problem we consider a micro-swimmer immersed in an incompressible fluid which is modeled, in the Eulerian reference frame, by Navier-Stokes equations

∂u ∂t + (u • ∇)u = ν∆u - ∇p ρ + f, ∇ • u = 0.
where u(t, x) : R × R d → R d , d = 2, 3, is the fluid velocity field, p(t, x) : R × R d → R is the fluid pressure field, ν is the fluid kinematic viscosity, ρ is the fluid density and f (t, x) : R × R d → R d is the distribution of external forces per unit mass. The Navier-Stokes system, in the case of micro-swimmers, can be simplified to the Stokes equations by neglecting the inertial contributions of the flow. This simplification is justified by the small value of the Reynolds number associated to the flow regime in which we are interested. This can be seen in the adimensionalized version of Navier-Stokes equations (here without external forces, for simplicity)

Re ∂u ∂t + (u • ∇)u = ∆u -∇p , ∇ • u = 0,
where u = u U , p = pL µU , t = L U and U is the swimmer's characteristic swimming speed, L is its characteristic length and ν is the fluid kinematic viscosity. In the momentum conservation equations, Reynolds number multiplies the inertial terms, which can therefore be neglected, since in the case of micro-swimmers Re ≈ 10 -5 .

As a result, the set of equations we will be using to model the fluid behaviour is the Stokes system µ∆u -∇p = 0,

∇ • u = 0.
Denoting by σ(t, x) = -p(t, x)I + µ(∇u(t, x) + ∇u(t, x) T ) the Newtonian fluid stress tensor and considering a time-dependent family of open sets Ω t ⊆ R d ∀t, we can therefore write the fluid problem as follows: find u(t, x), p(t, x) such that

∇ • σ = 0 in R + × Ω t , ∇ • u = 0 in R + × Ω t , u(t, x) = ū(t, x) on R + × ∂Ω t D , -p(t, x)I + µ ∇u(t, x) + ∇u(t, x) T n(t, x) = ḡ(t, x) on R + × ∂Ω t N , (1)
where

(Ω t )] d × L 2 (Ω t ), notably ū ∈ H 1/2 (∂Ω t D
) and ḡ ∈ H -1/2 (∂Ω t N ) provide such result [START_REF] Brezzi | Mixed and hybrid finite elements methods[END_REF]. In the case of our interest, Ω t will be R d deprived of the region occupied by the swimmer, and the Dirichlet boundary conditions correspond to the velocity field on the swimmer boundary. Such vector field can be decomposed in two parts: one represents the rigid motion and the other comes from the deformation of the swimmer's body ū(t, x) = V + ω ∧ (x -x 0 ) + v(t, x), where x 0 is the center of mass of the swimmer. When this latter is known in advance, it is possible to recover the linear velocity V and the angular velocity ω by solving a linear system as presented in [START_REF] Lohéac | Controllability of 3d low reynolds swimmers[END_REF]. This method exploits the linearity of Stokes equations with respect to pressure and velocity, producing a system of equations which is linear in (V, ω) and that depends on the stresses produced by a number of "fundamentally-driven" flows.

The rigid body dynamics

Following Newton's second law of dynamics and Euler's equations for angular momentum, we can write the equations describing the dynamics of the swimmer. However, in our case, the microscopic nature of the immersed object and the Stokes approximation of fluid equations lead us to neglect the inertial terms. As a result, the aforementioned equations read respectively (see [START_REF] Lohéac | Controllability of 3d low reynolds swimmers[END_REF])

∂Ω t σ(t, x) n(t, x) dS(x) = 0, ∂Ω t σ(t, x) n(t, x) ∧ x dS(x) = 0.
The equations above are written in the swimmer's reference frame. As proposed and developed in [START_REF] Lohéac | Controllability of 3d low reynolds swimmers[END_REF], the linearity of the Stokes equation in pressure and velocity allows a decomposition of the two fields as a sum of solutions to fundamentally driven Stokes equations. Each of these problems is characterized by the boundary conditions on the swimmer's surface. If we denote the canonical basis of the swimmer's reference frame by {e i } 3 i=1 and by v(t, x) the deformation velocity we already mentioned, the fundamental boundary conditions are of the form ū(t, x) = e i for i ∈ {1, 2, 3}, ū(t, x) = e i ∧ x for i ∈ {1, 2, 3} and ū(t, x) = v(t, x). They provide seven different Stokes problems and allow an expansion of the velocity and pressure fields as

u(t, x) = 3 i=1 V i u i (t, x) + 6 i=4 ω i u i (t, x) + u 7 (t, x) and p(t, x) = 3 i=1 V i p i (t, x) + 6 i=4 ω i p i (t, x) + p 7 (t, x),
where problems 1 to 3 are characterized by ū(t, x) = e i , problems 4 to 6 are characterized by ū(t, x) = e i ∧ x and problem 7 by ū(t, x) = v(t, x). This decomposition carries onto the fluid stress tensors, since they are linear with respect to pressure and velocity: σ(u, p) =

3 i=1 V i σ(u i , p i ) + 6 i=4 ω i σ(u i , p i ) + σ(u 7 , p 7 ).
Substituting this decomposition into (1.2) and appropriately rearranging the terms brings us to the solution of a linear system in (V, ω) of 6 × 6 matrix M and right-hand side N ∈ R 6 as follows

M ij =        ∂Ω t e i • σ(u j , p j ) n dS for i ∈ {1, 2, 3}, j ∈ {1, . . . , 6}, ∂Ω t e i-3 • σ(u j , p j ) n ∧ x dS for i ∈ {4, 5, 6}, j ∈ {1, . . . , 6}, (2)
N i =        - ∂Ω t e i • σ(u 7 , p 7 ) n dS for i ∈ {1, 2, 3}, - ∂Ω t e i-3 • σ(u 7 , p 7 ) n ∧ x dS for i ∈ {4, 5, 6}. (3)
Once the velocities (in the swimmer's reference frame) are recovered by solving the previous system, as done in [START_REF] Lohéac | Controllability of 3d low reynolds swimmers[END_REF], we can determine the position and orientation of the swimmer in the laboratory reference frame by solving a set of ODEs of the form [16]

     dq dt = 1 2 [0, R(q)ω] * q, dX dt = R(q)V, (4)
where q is the unit quaternion representing the orientation of the body in the laboratory fixed frame, R(q) is the rotation matrix associated to the unit quaternion q, * denotes the quaternion product and X is the position of the swimmer's centroid in the fixed reference frame. Appropriate initial conditions for the ODEs have to be chosen. The derivation of the quaternion equation and definition of the quaternion product are described in section 2.

Choosing unit quaternions to represent rotations in R d is dictated by the fact that they cover SO(3), sending the pair {q, -q} to a unique R(q) ∈ SO(3), and avoid the classical complications that arise when Euler angles are used [START_REF] Featherstone | Rigid Body Dynamics Algorithms[END_REF][START_REF] Landau | Mechanics[END_REF].

The self-propulsion constraints

In the previous section we addressed the computation of the linear and angular velocity of the swimmer in its reference frame. In order to model the displacement of a swimmer, the deformation velocity v(t, x) has to satisfy two constraints ensuring that the motion is entirely due to internal forces and is not relying on external actions. In particular, these constraints express the fact that in the swimmer's reference frame, linear and angular momenta remain unchanged because no external forces are applied [START_REF] Chambrion | Locomotion and control of a self-propelled shape-changing body in a fluid[END_REF]. In the linear momentum case, such invariance writes

d dt Ω 0 x dm(x) = 0. (5)
Following [START_REF] Chambrion | Locomotion and control of a self-propelled shape-changing body in a fluid[END_REF], [START_REF] Alouges | Enhanced controllability of low reynolds number swimmers in the presence of a wall[END_REF] and its angular momentum analogue can be rewritten as

∂Ω t v(t, x) dS(x) = 0, ∂Ω t v(t, x) ∧ x dS(x) = 0.

Numerical method

In subsection 2.1 we address the discretization of the Stokes system and in subsection 2.2 we will address the derivation and discretization of the ODE system for rigid body motion.

The fluid model

This part presents the PDE discretization that is used in the rest of the paper to numerically recover the swimmer's motion using finite element method. The indices denoting the time dependence of the fluid domain are abandoned and the focus is placed on the stationary problem to be solved at each time instant. The solution of the Stokes equations was performed via mixed finite elements, where the approximation spaces were chosen in order to guarantee the inf-sup stability of the discrete problem. The variational formulation is the following: find (u, p)

∈ [H 1 (Ω)] d ∩ {v = ū| ∂Ω D } × L 2 (Ω) such that µ Ω (∇u + ∇u T ) : ∇φ dx - Ω p(∇ • φ) dx = ∂Ω N g • φ dS(x), Ω q(∇ • u) dx = 0, for all (φ, q) ∈ [H 1 0 (Ω)] d ∩ {v = 0| ∂Ω D } × L 2
(Ω) such that the boundary conditions in (1) are satisfied. For the finite element translation, we chose the pair of Taylor-Hood spaces (X k h , M k-1 h

) for velocity and pressure, where

X k h = {u h ∈ [C 0 (Ω)] d | u h is piecewise polynomial of order k on each element of the triangulation} M k-1 h = {p h ∈ C 0 (Ω)| p h is piecewise polynomial of order k -1 on each element of the triangulation} provided that k ∈ N, k > 1.
They are characterized by different approximation orders on u and p in order to guarantee the inf-sup stability of the discrete problem. Namely, a continuous, piecewise polynomial approximation of order k is performed on each velocity component and a continuous, piecewise polynomial approximation of order k -1 is performed on the pressure.

In the following, we assume that the computational triangulated domain coincides with the continuous one. X k h and M k-1 h are subsets of the functional spaces in which (u, p), solutions of the continuous problem, are chosen. We can write the discrete version of the finite element problem as follows: find

(u h , p h ) ∈ X k h × M k-1 h such that µ Ω (∇u h + ∇u T h ) : ∇φ h dx - Ω p h (∇ • φ h ) dx = ∂Ω N g • φ h dS(x), Ω q h (∇ • u h ) dx = 0, for all (φ h , q h ) ∈ X k h × M k-1 h
. Dirichlet boundary conditions are applied strongly at the algebraic level.

The rigid body dynamics

As shown in subsection 1.2, from the finite element solution of the fluid problem it is possible to recover the rigid body dynamics of the swimmer. Unit quaternions are a good option to represent the orientation of a rigid object, since they avoid parametrization issues that can affect other representations, like the gimbal lock for Euler angles [START_REF] Featherstone | Rigid Body Dynamics Algorithms[END_REF][START_REF] Landau | Mechanics[END_REF]. A quaternion q is defined by a scalar q 0 and a 3-dimensional vector q v = (q v1 , q v2 , q v3 ), q = (q 0 , q v ). The conjugate of q will be denoted by q = (q 0 , -q v ) and the quaternion product is defined as q * r = (q 0 r 0 -q v •r v , q 0 r v +q v r 0 +q v ∧r v ). The norm of a quaternion is defined as ||q|| = √ q q = q 2 0 + q 2 v1 + q 2 v2 + q 2 v3 . Each quaternion of unit norm represents a reflection in 3D space, and together with its conjugate concurs to describe a rotation in space. The rotation matrix linked to a unit quaternion q = (q 0 , q v ) is given by

R(q) =   q 2 0 + q 2 v1 -q 2 v2 -q 2 v3
2(q v1 q v2 -q 0 q v3 ) q v1 q v3 + q 0 q v2 2(q v1 q v2 + q 0 q v3 ) q 2 0 -q 2 v1 + q 2 v2 -q 2 v3 2(q v2 q v3 -q 0 q v1 ) 2(q v1 q v3 -q 0 q v2 ) 2(q v2 q v3 + q 0 q v1 ) q 2 0 -q 2 v1 -

q 2 v2 + q 2 v3   .
In what follows we present how to get the swimmer frame dynamics in the laboratory frame. Coordinates X in the laboratory frame are expressed in the swimmer frame by [0, x] = q * [0, X] * q. Performing time differentiation we get

d[0, x] dt = dq dt * [0, X] * q + q * [0, X] * dq dt = dq dt * q * [0, x] + [0, x] * q * dq dt . Since d[0, x] dt = [0, 2v ∧ x],
in our case 2[0, v] = 2 dq dt * q = [0, R(q)ω]. Then, multiplying both sides of the equality by q gives the following dynamics for the quaternion

dq dt = 1 2 [0, R(q)ω] * q. ( 6
)
3 Implementation

The implementation part combined the FEEL++ finite element library [START_REF] Prud'homme | Feel++: A computational framework for galerkin methods and advanced numerical methods[END_REF] to solve the Stokes problems with an ODE solver for the solution of the rigid body motion. Matlab and Paraview were used for the post-processing. Since the methodology giving the rigid body problem was posed in the swimmer's reference frame and the swimmer's motion in the computational domain produced strong deformations on the underlying triangular mesh, at every time-step the domain was displaced and remeshed. This procedure was case specific, since both the shape and the deformation velocity on the swimmer's boundary were externally imposed.

Thanks to FEEL++, a Stokes solver with a syntax closely resembling the finite element variational formulation is achieved. Moreover, implementation of the finite elements was strongly simplified: Taylor-Hood spaces of order P 2 /P 1 are chosen, but also spaces of higher order (ex. P 3 /P 2 ) could be supported easily.

The solution of the ODEs (4) describing rigid-body motion was embedded in the code through an external ODE solver in C++. A Runge-Kutta scheme was performed. At the end of each time-step, before the new rotation matrix is computed, the quaternion needs to be normalized to have unit norm: the propagation of numerical errors does not preserve the norm of the quaternion. Remark that, if this renormalization is not performed, the rotation matrix won't be orthogonal and the body would suffer a deformation.

Numerical tests 4.1 Validation of fluid solver

To validate the fluid solver presented in this paper, we compared the analytical solution of Stokes problem presented in [START_REF] Bercovier | A finite element for the numerical solution of viscous incompressible flows[END_REF] to the numerical results given by our simulations. The analytical solution to Stokes problem on the unit square

-∆u + ∇p = f on [0, 1] × [0, 1], ∇ • u = 0 on [0, 1] × [0, 1], (7)
with forcing function

f (t, (x, y)) = 128[x 2 (x -1) 2 12(2y -1) + 2(y -1)(2y -1)y(12x 2 -12x + 2)] + y -0.5 -128[y 2 (y -1) 2 12(2x -1) + 2(x -1)(2x -1)x(12y 2 -12y + 2)] + x -0.5 ,
Dirichlet boundary conditions derived from the exact solution presented below and zero-mean pressure is given by

u(t, (x, y)) = -256y(y -1)(2y -1)x 2 (x -1) 2 256x(x -1)(2x -1)y 2 (y -1) 2 , (8)
p(t, (x, y)) = (x -0.5)(y -0.5).

Figure 1 presents this latter Stokes solution. We solve the Stokes equations using the pair (X 2 h , M 1 h ) for the mixed finite elements. Figure 2 shows a third order convergence of the L 2 norm of the velocity and a second order convergence for both the L 2 norm of the pressure and the H 1 norm of the velocity are obtained. These results are those we expected from the finite element method theory, see for instance [START_REF] Girault | Finite element methods for Navier-Stokes equations: theory and algorithms[END_REF]Thm 4.3,pag 181].

Remark that, even though the solver is made for the 2D case, Feel++ allows to easily obtain a three dimensional Stokes solution when providing an appropriate 3D mesh.

Velocity magnitude

Pressure Figure 2: Error convergence of the numerical solution given by our solver. The errors are in good agreement with the classical errors given by the finite element method: the experimental order of convergence for the velocity in L 2 norm is approximately 3, and in H 1 norm it's approximately 2. The experimental order of convergence for the L 2 norm of the pressure is approximately 2.

Validation of rigid body solver

In order to validate the rigid body solver, we considered the results presented in [START_REF] Longuski | Analytical solutions for a spinning rigid body subject to time-varying body-fixed torques, part i: Constant axial torque[END_REF]. The solution to

dX dt = R(q)V, (9a)
dq dt = 1 2 [0, R(q)ω] * q, ( 9b
) dV dt = F/m, (9c)
I dω dt + ω ∧ Iω = T, (9d)
complemented with adequate initial conditions, is searched.

Let us remark that the exactness of the translational part of the rigid body motion is easy to check. As a result, we will consider only equations (9b) and (9d).

We validate the rotational part of the rigid body motion by extracting a set of sample points from the graphics of [START_REF] Longuski | Analytical solutions for a spinning rigid body subject to time-varying body-fixed torques, part i: Constant axial torque[END_REF] and compared qualitatively such results with ours. The case we will consider is the following: the time-varying torque in the body frame will be given by T =   1.0 + 2.7 × 10 -2 t -2.4 × 10 -4 t 2 + 5.7 × 10 -7 t 3 -1.5 -9.0 × 10 -3 t + 1.2 × 10 -4 t 2 -3.0 × 10 -7 t 3 13.5

  N • m.
The body reference frame at t = 0 coincides with the laboratory reference frame, which in terms of quaternions is expressed as q(0) = (1, 0, 0, 0). The components of the angular velocity ω at t = 0 along the three principal axes are (0, 0, 0.329) rad/s, while the inertia matrix is given by

I =   2985 0 0 0 2729 0 0 0 4183   kg • m 2
Since in [START_REF] Longuski | Analytical solutions for a spinning rigid body subject to time-varying body-fixed torques, part i: Constant axial torque[END_REF] the results about the frame orientation are given in terms of Euler angles (φ x , φ y , φ z ), we use the following relationship to obtain them from a quaternion q = (q 0 , q 1 , q 2 , q 3 ):

  φ x φ y φ z   =    arctan 2(q0q1+q2q3) 1-2(q 2 1 +q 2 2 )
arcsin(2(q 0 q 2 -q 3 q 1 )) arctan 2(q0q3+q1q2)

1-2(q 2 2 +q 2 3 )   
Figure 3 shows that our results are in agreement with the numerical results in [START_REF] Longuski | Analytical solutions for a spinning rigid body subject to time-varying body-fixed torques, part i: Constant axial torque[END_REF]. We remark that, even though we will be focusing on a two-dimensional simulation for the swimmer, the previous validation confirms that such solver can be used also on a 3D experiment. The resulting angular velocity is the one required in (4) to obtain the body orientation.

Figure 3: Comparison of the sampled solution from [START_REF] Longuski | Analytical solutions for a spinning rigid body subject to time-varying body-fixed torques, part i: Constant axial torque[END_REF] and our numerical solution from equations [START_REF]Bioinspired swimming simulations[END_REF]. On the left, the results on Euler angle φ x are compared. On the right, the results on the component ω x of the angular velocity are compared.

Validation of force and torque computations

Given (u, p) solution of Stokes equations, this part addresses the numerical computation of fluid forces and torques. Since the swimmer motion depends on them, it is fundamental to validate the techniques we use to compute them. Two methods are compared: the first method consists in approximating the integrals describing surface forces and torques ∂Ω σ(t, x) n(t, x) dS(x), ∂Ω σ(t, x) n(t, x) ∧ x dS(x), via surface quadratures, while the second method consists in exploiting the variational formulation to resort to volume integrals

∂Ω σ(t, x) n(t, x) dS(x) = Ω f dx + Ω σ(t, x) : ∇ x u dx, ∂Ω σ(t, x) n(t, x) ∧ x dS(x) = Ω f ∧ x dx + Ω (σ(t, x) : ∇ x u) ∧ x dx, (10)
that are subsequently approximated via 3D volumic quadratures. Feel++ library was used to perform these computations. The numerical results will be compared to approximate and exact solutions. We considered two test cases: the first one is the 3D Stokes example of a translating and rotating sphere, for which the approximate solutions are provided in [23, p.67-68], while the second one is a 3D example taken from [START_REF] Ethier | Exact fully 3d navier-stokes solution for benchmarking[END_REF]. In the moving sphere case, the experimental setting is composed of a sphere of radius r = 0.01 placed in the middle of a cubic box of size 1, µ = 1 and U = ω = 2. The approximated forces and torques, given by the formulas F = -6πµrU and T = -8πµr 3 ω, give a qualitative target for the numerically derived forces and torques.

The results regarding the 3D Stokes case are collected in Tables 1 to 4. Tables 1 and2 show the numerical results that were obtained when using X 2 h /M 1 h finite elements on a piecewise linear approximation of the geometry: Table 1 shows that the surface quadratures give better approximation of forces while Table 2 show that torques are better approximated when using volumic quadratures. Tables 3 and4 show the numerical results that were obtained when X 3 h /M 2 h finite elements on a piecewise quadratic approximation of the geometry were used: in this case volumic quadrature performs better than surface quadratures in both cases. Table 4: Torques comparison for the translating and rotating sphere with piecewise quadratic approximation of the geometry and X 3 h /M 2 h finite elements. In the last column, the numerical result of the Stokes formula T = -8πµr 3 ω is reported.

h
The second benchmark that was considered regarded the exact computation of forces from an exact and fully three-dimensional solution to Navier-Stokes equations (where we neglected the time variation) [START_REF] Ethier | Exact fully 3d navier-stokes solution for benchmarking[END_REF] u = -a   e ax sin(ay + dz) + e az cos(ax + dy) e ay sin(az + dx) + e ax cos(ay + dz) e az sin(ax + dy) + e ay cos(az + dx) in the cube [-1, 1] 3 , with a = π 4 and d = π 2 . The exact forces were calculated using the symbolic mathematics package Sympy, and they were compared to forces issued from surface and volume quadratures. The results in Figure 4 show that, after fixing a high quadrature order for both surface and volume quadratures (13 in our case), forces are better approximated when using volume quadratures on (10) than surface quadratures. These two benchmarks encouraged us to use the volume formulation to compute forces and torques for the Scallop simulation in the next section. Since it has only one degree of freedom, the scallop does not experience a net advancement over a period.

  , (11)

Scallop theorem

In this section we will address the simulation of the so called "Scallop theorem". This theorem was first presented by Purcell in [START_REF] Purcell | Life at low reynolds number[END_REF], and later generalized in [START_REF] Chambrion | Generalized scallop theorem for swimmers[END_REF] for other types of swimmers, highlighting the underlying geometrical properties of the problem. Swimming is characterized by periodical strokes, and the scallop theorem specifies when they do not provide a net advancement. Scallop theorem, as in [START_REF] Purcell | Life at low reynolds number[END_REF], was specialized to Stokes flows, and stated that a swimmer which performs time-reversible shape changes will not be able to advance over a period. A particular case, from which the theorem takes his name, is the case of one-hinged swimmers. Having just one degree of freedom, swimmers like the scallop are forced to perform time-reversible shape changes and are not able to obtain a net advancement over a period of time. Figure 5 shows an example of these shape changes. The aim of this part is to verify that our numerical solver is able to reproduce the scallop theorem. Problem ( 1) is solved and coupled with (4) to obtain the swimmer's displacement and change in orientation.

Here Ω 0 is the complement in [0, 0.1] × [0, 0.1] of the scallop and the deformation velocity on the swimmer's boundary point x is given by v(t, x) = dA dt (t)x, where A(t) is the rotation matrix imposing the desired opening and closing of the valves.

We imposed on the boundary of the swimmer a displacement field which caused its hinges to open and close in a periodical fashion. We also allow a slight deformation of the body, to see whether any changes can be experienced with respect to the invariance predicted in [START_REF] Chambrion | Generalized scallop theorem for swimmers[END_REF]Section 3.5].

The computational domain coincides with Ω 0 , hence it consists in a pierced square whose hole has the shape of the swimmer. The mesh is conformal to the swimmer's geometry and the approximation is linear: interior and boundary edges are straight.

Figure 6 shows that the scallop theorem is not exactly satisfied due to the domain discretization, but the errors over a period, and the errors cumulated between two consecutive periods, are negligible. We chose a period T = 2 s and a swimmer with total valve opening equal to 14 mm. The smallest triangulation edge size in is of 0.025 mm.

We also located the scallop close to a no slip boundary of the computational domain. In that case the scallop theorem is not satsfied since the wall breaks the symmetry of the whole system. Figure 7 shows the displacement over a complete stroke period as a function of the proximity to the wall. In that case we noticed that the displacement at the end of the period was sensibly larger than what Figure 6 showed, and it exemplifies both the attractive effect that walls have on swimmers (Figure 7 right) and the enhanced displacement parallel to no slip boundaries (Figure 7 left). Let us quote the recent study [START_REF] Bagagiolo | Swimming by switching[END_REF] that overcomes the scallop theorem by opening and closing the shell with different speeds.

The pseudocode for the simulation of the swimmer motion is presented in Algorithm 1.

Conclusion and perspectives

In this note we present a solver able to provide the dynamics of a derforming swimmer moving into a Stokes flow. Here all the framework could fit a 3D model but the numerical results are given in 2D. All the numerical computations of this note relied on the finite element library Feel++. We applied a method proposed in [START_REF] Lohéac | Controllability of 3d low reynolds swimmers[END_REF] to extract rigid body motion from computation of fluid stresses. We validated our code and model using

Figure 1 :

 1 Figure 1: Analytical solution of the Stokes problem [7].

  0.1958 -4.97575 • 10 -5 -5.0582 • 10 -5 -5.02655 • 10 -5 0.00052 0.1546 -4.96165 • 10 -5 -4.98904 • 10 -5 -5.02655 • 10 -5 0.00036 0.1211 -5.03447 • 10 -5 -5.03904 • 10 -5 -5.05423 • 10 -5

  0.1958 -5.02279 • 10 -5 -5.02783 • 10 -5 -5.02655 • 10 -5 0.00052 0.1546 -5.02507 • 10 -5 -5.02577 • 10 -5 • 10 -5

Figure 4 :

 4 Figure 4: Comparison in L 2 norm between exact and approximated forces, normalized by the L 2 norm of the exact force. These pictures show that volume quadratures give a better approximation of forces and torques as the mesh size decreases. All the figures were obtained using a linear approximation of the geometry (G1). The left figure shows the results for X 2 h /M 1 h finite elements. The center figure shows the results for X 3 h /M 2 h

Figure 5 :

 5 Figure 5: Screenshots of the scallop's body configurations over a period. The opening and closure of the swimmer's valves produce the motion. Since it has only one degree of freedom, the scallop does not experience a net advancement over a period.

Figure 6 :

 6 Figure6: Position of the swimmer's center of mass in the laboratory reference frame. In this case the swimmer is located far from the no slip boundaries of the computational domain. The figure on the left shows its horizontal displacement, along the x axis: it's globally negligible and imputable to numerical errors. The figure on the right shows the swimmer's vertical displacement: it is periodic of period T = 2, and the net motion value on a period is also imputable to numerical errors.

Figure 7 :

 7 Figure 7: Absolute value of the net displacement of the swimmer's center of mass, as a function of its distance to a wall. When the swimmer departs closer to the no slip boundary, it experiences a larger displacement over a time period, both in the horizontal and vertical direction.

  ∂Ω t D and ∂Ω t N are the portions of ∂Ω t where Dirichlet and, respectively, Neumann boundary conditions are imposed, and n(t, x) is the outward unit normal to ∂Ω t . In particular, one requires ∂Ω t = ∂Ω t D ∪ ∂Ω t

	N N = ∅. Conditions on ū and ḡ are imposed so that the problem has a unique solution in D ∩ ∂Ω t and ∂Ω t
	[H 1

Table 1 :

 1 Forces comparison for the translating and rotating sphere with piecewise linear approximation of the geometry and X 2 h /M 1 h finite elements. In the last column, the numerical result of the Stokes formula F = -6πµrU is reported.

	min	h max	Surface quad. Volume quad.	Stokes
	0.00099 0.1958	-0.397501	-0.395855	-0.376991
	0.00052 0.1546	-0.394835	-0.395245	-0.376991
	0.00036 0.1211	-0.393037	-0.393478	-0.376991

Table 2 :

 2 Torques comparison for the translating and rotating sphere with piecewise linear approximation of the geometry and X 2 h /M 1 h finite elements. In the last column, the numerical result of the Stokes formula T = -8πµr 3 ω is reported.

	h min	h max	Surface quad. Volume quad.	Stokes
	0.00099 0.1958	-0.39264	-0.392629	-0.376991
	0.00052 0.1546	-0.392439	-0.392408	-0.376991

Table 3 :

 3 Forces comparison for the translating and rotating sphere with piecewise quadratic approximation of the geometry and X 3 h /M 2 h finite elements. In the last column, the numerical result of the Stokes formula F = -6πµrU is reported.

  2ax + e 2ay + e 2az + 2 sin(ax + dz) cos(az + dx)e ay+az + 2 sin(ay + dz) cos(ax + dy)e az+ax + 2 sin(az + dx) cos(ay + dz)e ax+ay ] (12)

	p = -	a 2 2	[e

Algorithm 1 Solution procedure for the swimming problem Choose ∆t, d, T f inal Initialize X, q, V, ω

Displace the swimmer according to X, q, V, ω and Remesh for 1 ≤ i ≤ N Stokes do Solve Stokes problem i from subsection 1.2 Compute surface forces and torques issued from Stokes problem i end for Find V, ω by using ( 2) and (3) Find X, q by solving (4) time ← time + ∆t end while different benchmarks. The goal of this project was to lay the foundations of a numerical method which allowed the simulation of swimmers with more complex geometries.

The passage to several swimmers or to 3D are beyond the scope of this paper. The technique could be applied to several swimmers, but the basis onto which the Stokes solution has to be expanded is larger and the computational cost might increase noticeably. Another issue is that, in the Stokes regime, forces can become infinite when two swimmers are close, and collision avoidance strategies would need to be implemented.


Adrien Chan-Hon-Tong

Machine learning based crash-allowed area detection for autonomous UAV

Machine learning based crash-allowed area detection for autonomous UAV

Introduction

Machine learning is the only conceptual way to deal with unformulated problems.

Of course, machine learning tools can be used on other contexts: deep networks have been applied in Go game [START_REF] Silver | Mastering the game of go without human knowledge[END_REF], in control task [START_REF] Byoung | Nonlinear flight control using neural networks[END_REF], and, to replace classical anti collision airborne system (ACAS) [START_REF] Katz | Reluplex: An efficient smt solver for verifying deep neural networks[END_REF]. But, these examples have almost nothing to do with machine learning, because, they concern somehow formalized problems.

Typically, [START_REF] Katz | Reluplex: An efficient smt solver for verifying deep neural networks[END_REF] presents a code which could prove or disprove that a given deep network implements correctly ACAS specifications. This result is very interesting as it is a pioneer result. But, from industrial point of view, a simple (yet large) tabular can also correctly implements an ACAS, so using a deep network is not unavoidable. And, from machine learning point of view, this result is irrelevant because machine learning problems never come with specifications.

Indeed, the downside of handling problems with no specification is that there is (and will) no way to prove that a machine learning system behaves correctly on a specific but unformulated problem [START_REF] David | The lack of a priori distinctions between learning algorithms[END_REF].

Because of this impossibility to specify the tackled problem (and, thus, the impossibility to have proof of correctness), DO-178 rules seems to forbid learning based system to be embedded in autonomous vehicle to perform critical function.

This point of view is also strengthen by the fact that most machine learning problem can be tackled using other way. Typically for autonomous driving, obstacle detection can be tackled by radar or lidar offering more dependable data than passive optical detection. It can be more expensive to use lidar, it can be frustrating to stop in front of plastic bag on which the car could safely move, but, a lidar brings the guarantee to not miss obstacles. And, such guarantee will never be offered by passive optical detection.

However, this paper presents a very simple and pragmatic autonomous plane/UAV use case in which perception is unavoidable (i.e. radar and/or lidar does not trivialise the problem), and, which is directly linked which safety issue. This use case is machine learning based crash-allowed area detection for autonomous UAV/plane.

It will be more precisely presented in next section, before discussion.

2 Crash-allowed area detection

When machine learning helps safety

UAV are today allowed to fly according to a set of rules including maintaining visual line of sight with the pilot. Yet, simultaneous failure of remote control system, and, GPS return to base system will let the platform into an unstable state irremediably leading to a crash (if no recovery happens). So, without autonomous perception, this hardware failure leads to an uncontrolled crash, even if flying capacity are not affected. Inversely, if the UAV has perception capacity, the UAV can try to reach crash-allowed areas in complete autonomous way. Yet, such controlled crash capacity requires the ability to decide crash-allowed areas.

And, this paper states that crash-allowed area detection is structurally a machine learning problem. First, it can not be trivialized using dedicated sensors (e.g. lidar or radar) because crash-allowed area detection relies on characterizing a signal not just receiving it. Then, there is no formal description of the task.

In addition, this is an interesting use case from safety point of view: even if the crash-allowed area detector is not perfect, it can hardly lead to worse output than an uncontrolled crash ! So, such module of crash control is clearly a tool to increase safety: here machine learning does not replace a safe way by a doubtful one. Here machine learning add a quite safe way.

Precisely, this task assumes a sensor providing an input datum x which should be characterized into crash-forbidden area (car, person, industrial stations, gaz stations, not-metal-roof building) or crash-allowed area (road, field, container, metal-roof building, cleared tree, cleared swimming pool). Given, data x 1 , ..., x N , a person can easily provide the desired classification y 1 , ..., y N . Yet, nobody can provide the mathematical function y(x). So, given a deep network f , there is no way to compute the measure of the set on which f = y. But still, it is easy to count the number of samples i for which f

(x i ) = y i .
So, it is easy to learn a deep network f using a training set, and, to evaluate empirically the offered performance (using a disjoint testing set and other good evaluation rules). This way, it seems relevant to integrate such algorithm it into a classical safety analysis.

Implementation

The simplest form of machine learning based crash-allowed area detection for autonomous UAV can be implemented as semantic segmentation problem in remote sensing image.

Hopefully there is a very large literature about semantic segmentation problem in remote sensing image. One pioneer work is [START_REF] Lagrange | Benchmarking classification of earth-observation data: From learning explicit features to convolutional networks[END_REF]. This work has quickly be extended [START_REF] Marmanis | Semantic segmentation of aerial images with an ensemble of cnns[END_REF][START_REF] Audebert | Semantic segmentation of earth observation data using multimodal and multi-scale deep networks[END_REF] using designed network like UNET [START_REF] Ronneberger | U-net: Convolutional networks for biomedical image segmentation[END_REF]. Such map can then be post processed to recover instance [START_REF] Audebert | Segmentbefore-detect: Vehicle detection and classification through semantic segmentation of aerial images[END_REF]. Literature trends are to perform instance detection simultaneously [START_REF] He | Mask r-cnn[END_REF].

There is also a very large number of datasets for such task including

• Data Fusion Contest -GRSS -IEEE (typically the 2015 one)

• 2D Semantic Labeling -ISPRS dataset (Potsdam and Vaihingen)

These datasets can be useful to empirically evaluate such pipeline. Just to support the discussion, a naive pipeline has been designed on Potsdam using a UNET network using organizer train/test splitting. Empirical pixel-wise accuracy measured on 10 runs is 86,26% with variance of 2%. Converted into a crash allowed/forbidden area, this pipeline which is a basic baseline already leads to an empirical pixel-wise accuracy of 97% ! Using latest state of the art algorithm will probably increase this last result (already very high).

This result highlights the relevancy of using machine learning based crashallowed area detector instead of accepting uncontrolled crash.

Discussion

This paper clearly calls for allowing machine learning module to perform critical function in embedded platform for specific use cases like for machine learning based crash-allowed area detection for autonomous UAV/plane. Now, given the discordance of the community about the safety issue of such embedding, this paper argues this claim by reviewing several possible objections (of course this list may be not exhaustive).

Interpretation of probability

Probabilities are completely acceptable in a safety analysis (indeed, safety objective is even given in term of probability: 10 -9 critical issue per hour for DAL-A module).

Yet, probability of breakdown of one hardware component is slightly different from probability that a machine learning algorithm fails on datum x. Indeed, in case of machine learning, the algorithm is deterministic (after training), so, if it fails on a datum x, then it will always fail on this datum. Indeed, machine learning performance is about computing the measure (let say the volume to give an image) of the part of input space on which the predicted and desired functions are not equal. This is often expressed in term of probability, but, it is more about measure.

This point may be a real issue for daily function. Typically, daily computer vision based landing could be problematic because if it does not work on an airport x, there would be an hazard at each landing on this airport, even if it works on all other airport in the world (so measured performance is still high).

Now, in the offered use case, this is not a problem because machine learning system is used only on probabilistic emergency context. So, the system may never work on the airport x, but, anyway, the system would be activated on this airport only with already low probability, because, the hardware failure leading to the activation is independent from the airport.

Typically, such kind of context is already accepted in certification process: a simultaneous breakdown of several CPU may or may not crash the plane depending on the piece of code being processed during the breakdown. But, the same combination breakdown -piece of code always crashes the plane. Hopefully, as the breakdown of a CPU is independent from the processed piece of code, the CPU breakdown probability is (somehow) multiplied by the probability of processing specific part of the code.

So, this reasoning stand for machine learning. The only difference is that probability of processing specific part of the code can be estimated exactly (at least with uniform prior), and, probability of hardware failure can be decreased by redundancy. While, for machine learning, the probability of failure can only be estimated empirically using testing data (and a set of good practices) i.e. like hardware failure but without redundancy option.

Unfairness

An other objection it about the risk of having the crash-allowed area detector performing less efficiently than uncontrolled crash. Of course, in average, it is hard to be worse than random ! Now, the answer is less clear on particular instance because the distribution of situation in which the detector is worse than random could be unfair.

Obviously, if the system prefers to crash into a low rent housing than into a expensive house, then this raise ethical issue.

Such issue should, of course, be tackled during evaluation (it is a part of good evaluation practices). But, again, this is just a matter of correct evaluation. Yet, a crash controlled system can not perform worse than an uncontrolled one (under correct evaluation process).

Instability

A very large academic effort has recently put emphasis on adversarial example [START_REF] Kurakin | Adversarial examples in the physical world[END_REF][START_REF] Goodfellow | Explaining and harnessing adversarial examples[END_REF][START_REF] Carlini | Adversarial examples are not easily detected: Bypassing ten detection methods[END_REF][START_REF] Papernot | Practical black-box attacks against machine learning[END_REF][START_REF] Shafahi | Are adversarial examples inevitable?[END_REF][START_REF] Mahloujifar | The curse of concentration in robust learning: Evasion and poisoning attacks from concentration of measure[END_REF][START_REF] Gourdeau | On the hardness of robust classification[END_REF]]. Yet, does adversarial examples are an issue for crashallowed area detection use case ?

No: again, here, the machine learning system is activated only under several hardware failure. So either, the probability of meeting an adversarial is not low, and in this case, there will be such example in training data (natural training will be an adversarial training for free) and in the testing data, ensuring a correct estimation of the level of performance. Or either, the probability of meeting an adversarial is low, but, then the probability to meet and adversarial exactly during the hardware failure that activate the learning system is very low.

So, in the specific use case of crash-allowed area detection, it seems even not mandatory to required strong defence [START_REF] Wong | Provable defenses against adversarial examples via the convex outer adversarial polytope[END_REF][START_REF] Zhang | Theoretically principled trade-off between robustness and accuracy[END_REF], or, to consider performance under stress like in [START_REF] Hendrycks | Benchmarking neural network robustness to common corruptions and perturbations[END_REF] (even if requiring both could be considered).

In fact, for the use case of crash-allowed area detection, the real issue with adversarial examples is the confusion that adversarial attack create in the community: certifying a neural network has nothing to do with proving that it does not admit adversarial failure. Proving that a neural network does not admit adversarial failure can be interesting (should be more precisely defined because any continuous function from [-1, 1] D a compact to [-1, 1] will have a 0-surface), but it say nothing about the probability of failure of the network (it can not as the specification of the network are even unknown).

Incompatibility with the law

Despite previous reasoning, it seems clear that such system is today incompatible with the law at least the DO-178. Indeed, the DO-178 requires that software should cause no hazard. Dramatic hazard should only be due to hardware failure. Obviously, crash-allowed area detector is a software, but, failure in this software may lead to dramatic hazard. Indeed, in worst case, the software select the only dangerous area of crash leading to a worse situation than uncontrolled crash. Yet, this system is incompatible with current law. Now, in the very specific use case considered in this paper, the is no good reason to forbid such software. First, machine learning system activate only under hardware failure (remote control plus GPS failure) -this way combined hardware-software failure probability can be interpreted as real probability. And, then, there is no alternative between machine learning based crash or uncontrolled crash. Currently, there is always alternative, but, here alternative means no UAV, because as soon as there are UAV, remote control plus GPS failure will happens. And, already today, middle weight UAV (sufficient to cause causality in case of uncontrolled crash) are allowed to plane.

Risk increasing

An other objection could be that if allowed such system could lead to a risk increase because constructors may integrate the gain provided by such system to allow higher risk on the hardware.

Typically, today, the probability of remote control failure is 10 -α , GPS failure is 10 -β and probability of causality during uncontrolled crash is 10 -γ with α + β + γ > 10. But, tomorrow, by allowing machine learning based crashallowed area detection with failure probability of 10 -φ , constructors could use lower standard remote controller and GPS sensor with failure probability of 10 -ψ and 10 -ϕ such that α + β + γ = φ + ϕ + ψ with φ > γ, and, hence α + β < ψ + ϕ. Indeed, if there is more doubt about the estimation of φ than about the estimation of α+β. One could feel that the safety level has decreased.

Yet, in reality, the estimation of φ should be more accurate than the estimation of α, β, γ, ϕ + ψ: failure probability on hardware is estimated in empirical fashion, but, with a lower control of the experiment than during a data acquisition campaign like for φ. And, γ is very coarsely estimated. So, the level of safety would instead be estimated more accurately. Now, the question of the absolute level (10 -9 for DAL-A) is out of the scope of this paper, but, there is no control on γ (which is just linked to the population density) while φ can be increased with machine learning advances (and can hardly be lower than γ). So, globally, it is a safety increment and not a safety issue.

Evaluation

So, the claim of this paper is that machine learning can be embedded and considered into safety analysis in some situation. Yet, the requirement is to be able to measure the average performance of the system i.e. the probability of failure -probability regarding the native distribution of the data.

Formally, in binary classification (which is the basic machine learning problem), one can build a system f which takes input x ∈ Ω and produces estimated class f (x). The true class of x is y(x) ∈ 0, 1 but y is not known or decidable. Yet, one is able to evaluate y (for example by using human annotation) on sample. One is also able to drawn samples according to the native probability of the problem P . So, the real probability of failure e is

e = Ω |f (x) -y(x)|P (x)dx (1)
And, as one can drawn samples according to P and evaluate y on samples, then, one can approximate e using

1 N n∈[1,N ],x1,...,x N ∼P |f (x n ) -y(x n )| → N →∞ Ω |f (x) -y(x)|P (x)dx (2)
Issues with this empirical way to measure e are

• the measure has a variance with is problematic to measure small probability -yet this issue is a classical statistical problem with a large literature

• contrary to other probabilities appearing in a safety analysis, the probability P can change during the life of the system -this is an important machine learning issue to be able to mitigate this point For this last point, let remark that our goal is to estimate

e = max Q realistically close of P Ω |f (x) -y(x)|Q(x)dx (3)
For example, it is know that performance under adversarial example attack is just max Q realistically close of P Ω |f (x) -y(x)|Q(x)dx with Q close to P for a Earth mover's distance i.e. for each x such that Q(x) is high, there is x very close of x such that P (x ) is high i.e. x is an adversarial attack around x.

It is known that deep learning performance may strongly drop under such attack -it means that this issue of computing e the extended probability of failure is important.

Yet, this is not as crucial as making impossible to embed machine learning in critical application (in particular in case where machine learning is used only under real random failure).

Conclusion

Probably, deep learning will not be massively present in autonomous vehicle, even more, to implement daily critical function. Yet, depending on the use case, incorporating system trained with deep learning into critical autonomous vehicle can be useful for safety consideration.

Typically, the paper consider that machine learning based crash-allowed area detection for autonomous UAV could be a very relevant system for UAV where the double remote control failure and GPS failure will otherwise conduct to a uncontrolled crash.

So in this specific use case, machine learning can improve safety instead being a safety issue. And, one could hope that community may use such use cases to close the gap between safety community and machine learning community.

This paper is the point of view of the author, and, should not be considered as the official position of ONERA on this issue.