\section{Extending the Bindini-De Pascale construction}

Let $\bP$ be a symmetric  $N$-particle probability measure over $(\R^d)^N$ and let
$$\rho_\bP(x_1)=\int_{(\R^d)^{N-1}}d\bP(x_1,x_2,...,x_N)$$
be its one-particle marginal. We assume that $\sqrt{\rho_\bP}\in H^1(\R^d)$, as is appropriate in Density Functional Theory (DFT)~\cite{Harriman-81,Lieb-83b}. An interesting question, important for applications in DFT, is to approximate $\bP$ by a regular $N$-particle probability density $\bP_\epsilon$ with the same density $\rho_{\bP_\epsilon}=\rho_\bP$. A more challenging problem, considered first in~\cite{CotFriKlu-13,BinPas-17} for $N=2,3$ and solved for all $N\geq2$ in this note, is to find a fermionic quantum state $\Gamma_\epsilon$ with the same density $\rho_{\Gamma_\epsilon}=\rho_\bP$ and a controlled kinetic energy.

Consider a radial function $\chi\in C^\infty_c(\R^d,\R)$ with support in the unit ball of $\R^d$, such that $\int_{\R^d}\chi^2=1$, and denote $\chi_\epsilon(x)=\epsilon^{-d/2}\chi(x/\epsilon)$. In~\cite{BinPas-17}, Bindini and De Pascale have introduced the following elegant regularization
\begin{multline}
\bP_\epsilon(x_1,...,x_N)\\=\iint_{\R^{2dN}}\prod_{k=1}^N\frac{\rho_\bP(x_k)\chi_\epsilon(x_k-z_k)^2\chi_\epsilon(z_k-y_k)^2}{\rho_\bP\ast\chi_\epsilon^2(z_k)}d\bP(y_1,...,y_N)\;dz_1\cdots dz_N.
\label{eq:Bindini-Pascale}
\end{multline}
We assume in the following that $\bP$ has its support in
$$D_\alpha^c:=\left\{X=(x_1,...,x_N)\in (\R^d)^N\ :\ |x_i-x_j|\geq \alpha,\ \forall i\neq j\right\},$$
for some $\alpha>0$, a condition which is satisfied for minimizers of the Coulomb $N$-particle energy~\cite{ButChaPas-17}. Since $\chi$ is supported in the unit ball, $\bP_\epsilon$ is then supported on the set $D^c_{\alpha-4\epsilon}$ where all the particles are at a distance $\alpha-4\epsilon$ to each other. In the following we always assume that $\epsilon<\alpha/4$.
The purpose of the integration over the $y_k$'s in~\eqref{eq:Bindini-Pascale} is to regularize the probability $\bP$, since the convolution
$$\bQ_\epsilon(z_1,...,z_N)=\int_{(\R^d)^N}\prod_{k=1}^N\chi_\epsilon(z_k-y_k)^2d\bP(y_1,...,y_N)$$
is now $C^\infty$. However its density is $\rho_{\bQ_\epsilon}=\rho_\bP\ast\chi_\epsilon^2$
and the purpose of the integration over the $z_k$'s is to map back the density to $\rho_\bP$. Indeed, integrating~\eqref{eq:Bindini-Pascale} over $x_2,...,x_N$, we get $\prod_{k=2}^N\rho_\bP\ast\chi^2_\epsilon(z_k)$ in the numerator, which cancels with the denominator. The corresponding integrals over $z_2,...,z_N$ give $(\int\chi_\epsilon^2)^{N-1}=1$ and we end up with
\begin{align*}
\rho_{\bP_\epsilon}(x_1) =\rho_{\bP}(x_1)\int_{\R^d}\int_{\R^d}\frac{\chi_\epsilon(x_1-z_1)^2\chi_\epsilon(z_1-y_1)^2}{\rho_{\bP}\ast\chi_\epsilon^2(z_1)}\rho_{\bP}(y_1)\,dy_1\,dz_1=\rho_\bP(x_1).
\end{align*}
A somewhat different method was introduced in~\cite{CotFriKlu-13} by Cotar, Friesecke and Kluppelberg.

In~\cite{BinPas-17}, Bindini and De Pascale prove that
\begin{equation}
 \int_{\R^{dN}}|\nabla\sqrt{\bP_\epsilon}|^2\leq N\left(\int_{\R^d}|\nabla\sqrt{\rho_\bP}|^2+\frac{1}{\epsilon^2}\int_{\R^d}|\nabla\chi|^2\right)
 \label{eq:estim_kinetic_Bindini_dePascale}
\end{equation}
and use this to get some information on the semi-classical limit of the Levy-Lieb functional (to be discussed later in Section~\ref{sec:Levy-Lieb}).
Unfortunately, the probability~\eqref{eq:Bindini-Pascale} is really a classical object. Although for bosons one can use the symmetric wavefunction $\Psi_\epsilon=\sqrt{\bP_\epsilon}$, for fermions the wavefunction must be anti-symmetric with respect to the permutations of its $N$ variables. In space dimensions $d=1$ and $d=2$, one can use the multiplication by
$$U(x_1,...,x_N)=\prod_{1\leq j<k\leq N}\frac{x_j-x_k}{|x_j-x_k|}$$
which maps bosons onto fermions and conversely, whatever the value of $N$ (if $d=2$ we identify $\R^2$ with $\C$). Since $U$ is $C^\infty$ on $D_\alpha^c$ where $\bP_\epsilon$ is supported, $U\sqrt{\bP_\epsilon}$ has the same regularity as $\sqrt{\bP_\epsilon}$ and satisfies an estimate similar to~\eqref{eq:estim_kinetic_Bindini_dePascale}, with a worse dependence in $N$. In dimension $d\geq3$, the situation is more complex, due to some well known topological obstructions~\cite{LeiMyr-77,Myrheim-99,Ouvry-07}. Indeed, for $N\geq2$ and $d\geq3$, there does not exist any anti-symmetric function $U:D_\alpha^c\subset (\R^d)^N\to \C$ which is continuous and satisfies $|U(x_1,...,x_N)|=1$. Otherwise, consider for instance the odd function
$$z\mapsto U(y+z,y-z,x_3,...,x_N)$$
for fixed $y,x_2,...,x_N$. By the Borsuk-Ulam theorem, it must vanish on any sphere $\{|z|=R\}$, and this would contradict $|U|=1$ for $|y|$ and $R$ large enough. In~\cite{CotFriKlu-13,BinPas-17} the authors use the spin variable to antisymmetrize $\sqrt{\bP_\epsilon}$ but, in dimension $d=3$, this has so far limited the results to $N=2$ and $N=3$.

Our idea in this short note is to overcome these difficulties using the concept of mixed states. We propose the following simple quantum extension of~\eqref{eq:Bindini-Pascale}, for fermions:
\begin{multline}
\Gamma_\epsilon
=\iint_{\R^{dN}\times \R^{dN}}
\sqrt{\rho_\bP}^{\otimes N}\;|\chi_{\epsilon,z_1}\wedge\cdots\wedge\chi_{\epsilon,z_N}\rangle\langle\chi_{\epsilon,z_1}\wedge\cdots\wedge\chi_{\epsilon,z_N}|\;\sqrt{\rho_\bP}^{\otimes N}\\
\times\prod_{k=1}^N\frac{\chi_\epsilon(z_k-y_k)^2}{\rho_\bP\ast\chi_\epsilon^2(z_k)}d\bP(y_1,...,y_N)\;dz_1\cdots dz_N.
\label{eq:quantum_state}
\end{multline}
Here $\Gamma_\epsilon$ is a non-negative self-adjoint operator which acts on the $N$-particle fermionic space $L^2_a((\R^d)^N)=\bigwedge_1^N L^2(\R^d)$. For simplicity we do not consider spin here. It is easy to extend the trial state~\eqref{eq:quantum_state} to the case of particles with $q$ spin states, for instance by putting all the particles in the same spin state. One can also construct any desired eigenvector of the total spin operator by adding an appropriate spin state to each function $\chi_{\epsilon,z_k}$.

In~\eqref{eq:quantum_state}, we use the notation $\chi_{\epsilon,z}(x)=\chi_\epsilon(x-z)$ and recall that $\epsilon<\alpha/4$ such that the functions $\chi_{\epsilon,z_1},...,\chi_{\epsilon,z_N}$ have disjoint supports.  We use the ket-bra notation $|\Psi\rangle\langle\Psi|$ for the orthogonal projection on $\Psi$, defined by $|\Psi\rangle\langle\Psi|\phi=\pscal{\Psi,\phi}\Psi$. We call
$$
\phi_1\wedge\cdots\wedge\phi_N(x_1,...,x_N)=\frac{1}{\sqrt{N!}}\sum_{\sigma\in\mathfrak{S}_N}\epsilon(\sigma)\phi_{{\sigma(1)}}(x_1)\cdots \phi_{\sigma(N)}(x_N
$$
the Slater determinant. Finally, the $N$-fold tensor product is defined by
$$\sqrt{\rho_\bP}^{\otimes N}(x_1,...,x_N)=\prod_{j=1}^N\sqrt{\rho_\bP}(x_j).$$
In~\eqref{eq:quantum_state}, $\sqrt{\rho_\bP}^{\otimes N}$ is understood as a multiplication operator on $L^2_a((\R^d)^N)$. In particular, we have
\begin{multline*}
\sqrt{\rho_\bP}^{\otimes N}\;|\chi_{\epsilon,z_1}\wedge\cdots\wedge\chi_{\epsilon,z_N}\rangle\langle\chi_{\epsilon,z_1}\wedge\cdots\wedge\chi_{\epsilon,z_N}|\;\sqrt{\rho_\bP}^{\otimes N}\\
=|\sqrt{\rho_\bP}\chi_{\epsilon,z_1}\wedge\cdots\wedge\sqrt{\rho_\bP}\chi_{\epsilon,z_N}\rangle\langle\sqrt{\rho_\bP}\chi_{\epsilon,z_1}\wedge\cdots\wedge\sqrt{\rho_\bP}\chi_{\epsilon,z_N}|.
\end{multline*}
The integral kernel of $\Gamma_\epsilon$ is given by
\begin{multline}
\Gamma_\epsilon(x_1,...,x_N;x_1',...,x_N')=\frac{1}{N!}\iint_{\R^{dN}\times \R^{dN}}\det\big(\chi_{\epsilon,z_i}(x_j)\big)\det\big(\chi_{\epsilon,z_i}(x'_j)\big)\\
\times\prod_{k=1}^N\frac{\sqrt{\rho_\bP}(x_k)\sqrt{\rho_\bP}(x'_k)\chi(z_k-y_k)^2}{\rho_\bP\ast\chi_\epsilon^2(z_k)}d\bP(y_1,...,y_N)\;dz_1\cdots dz_N.
\label{eq:quantum_state_kernel}
\end{multline}
Since the $\chi_{\epsilon,z_k}$ have disjoint supports, we have
\begin{align}
\Big(\det\big(\chi_{\epsilon,z_i}(x_j)\big)\Big)^2&= \sum_{\sigma,\sigma'\in\mathfrak{S}_N}\epsilon(\sigma)\,\epsilon(\sigma')\prod_{k=1}^N \chi_{\epsilon,z_{\sigma(k)}}(x_k)\chi_{\epsilon,z_{\sigma'(k)}}(x_k)\nonumber\\
&=\sum_{\sigma\in\mathfrak{S}_N}\prod_{k=1}^N \chi_{\epsilon}(x_k-z_{\sigma(k)})^2.
\label{eq:formule_carre}
\end{align}
Using the symmetry of $\bP$, we have
$$\int_{\R^{dN}}\prod_{k=1}^N\chi_\epsilon(z_k-y_k)^2d\bP(y_1,...,y_N)=\int_{\R^{dN}}\prod_{k=1}^N\chi_\epsilon(z_{\sigma(k)}-y_k)^2d\bP(y_1,...,y_N)$$
for every $\sigma\in\mathfrak{S}_N$. Therefore, in~\eqref{eq:formule_carre} the terms in the sum over the permutations $\sigma\in\mathfrak{S}_N$ all contribute the same 	amount.
We thus find that the diagonal of~$\Gamma_\epsilon$ coincides with the Bindini-De Pascale probability density:
$$\Gamma_\epsilon(x_1,...,x_N;x_1,...,x_N)=\bP_\epsilon(x_1,...,x_N).$$
From this we conclude that
\begin{multline*}
{\rm Tr}\,(\Gamma_\epsilon)=\int_{(\R^d)^N}\Gamma_\epsilon(x_1,...,x_N;x_1,...,x_N)\,dx_1\cdots dx_N\\
=\int_{\R^{dN}}d\bP_\epsilon(x_1,...,x_N)=1.
\end{multline*}
and $\Gamma_\epsilon$ is a proper fermionic (mixed) state. We recall that the one-particle density of $\Gamma_\epsilon$ is defined by duality, requiring that ${\rm Tr}\,(\phi(x_1)\Gamma_\epsilon)=\int_{\R^d}\phi\,\rho_{\Gamma_\epsilon}$ for every $\phi\in L^\infty(\R^d)$. For a continuous kernel such as $\Gamma_\epsilon$, we have
$$\rho_{\Gamma_\epsilon}(x_1)=\int_{\R^{dN}}\Gamma_\epsilon(x_1,...,x_N;x_1,...,x_N)\,dx_2\cdots dx_N=\rho_{\bP_\epsilon}(x_1)=\rho_{\bP}(x_1).$$
From the Cauchy-Schwarz inequality we have
$$\int_{(\R^d)^N}|\nabla\sqrt{\bP_\epsilon}|^2\leq {\rm Tr}\,(-\Delta)\Gamma_\epsilon,$$
which is in the wrong direction to conclude anything about the kinetic energy of $\Gamma_\epsilon$ using the estimate~\eqref{eq:estim_kinetic_Bindini_dePascale} of Bindini-De Pascale. But we can prove the following theorem, which implies~\eqref{eq:estim_kinetic_Bindini_dePascale}.

\begin{theorem}[Estimates on $\Gamma_\epsilon$]\label{thm:estimates}
Let $\bP$ be a symmetric $N$-particle density with support in $D^c_\alpha$ for some $\alpha>0$ and such that $\sqrt{\rho_\bP}\in H^1(\R^d)$. Let $\Gamma_\epsilon$ be defined by~\eqref{eq:quantum_state}. Then, for $\epsilon<\alpha/4$ we have
\begin{equation}
 {\rm Tr}\,(-\Delta)\Gamma_\epsilon = N\left(\int_{\R^d}|\nabla\sqrt{\rho_\bP}|^2+\frac{1}{\epsilon^2}\int_{\R^d}|\nabla\chi|^2\right).
 \label{eq:estim_kinetic}
\end{equation}
In addition, for every symmetric function $\Phi\in C^2(D^c_{\alpha-4\epsilon})$, we have
\begin{multline}
 \left|{\rm Tr}\,(\Phi\Gamma_\epsilon)-\int_{\R^{dN}}\Phi\, d\bP\right|=\left|\int_{\R^{dN}}\Phi\, d\bP_\epsilon-\int_{\R^{dN}}\Phi\, d\bP\right|\\
 \leq \epsilon^2\,\Bigg\{\sum_{j=1}^N\norm{\nabla_j\Phi}_{L^\infty(D^c_{\alpha-4\epsilon})}\left(\int_{\R^{d}}|\nabla\rho_\bP|\right)\left(\int_{\R^d}|u|^2\chi(u)^2\,du\right)\\
 +2\sum_{j,k=1}^N\norm{\nabla_{j}\nabla_{k}\Phi}_{L^\infty(D^c_{\alpha-4\epsilon})}\Bigg\}.
 \label{eq:estim_potential}
\end{multline}
In particular, $\bP_\epsilon\rightharpoonup\bP$, as was proved in~\cite{BinPas-17}.
\end{theorem}

\begin{proof}
We have
\begin{multline*}
{\rm Tr}\,(-\Delta)\Gamma_\epsilon= \sum_{\ell=1}^N\iint_{\R^{dN}\times \R^{dN}}
\left(\int_{\R^{dN}}\left|\nabla_{x_\ell}\left( \sqrt{\rho_\bP}^{\otimes N}\chi_{\epsilon,z_1}\wedge\cdots\wedge\chi_{\epsilon,z_N}\right)\right|^2\right)\times\\
\times\prod_{k=1}^N\frac{\chi_\epsilon(z_k-y_k)^2}{\rho_\bP\ast\chi_\epsilon^2(z_k)}d\bP(y_1,...,y_N)\;dz_1\cdots dz_N.
\end{multline*}
Similarly as in~\eqref{eq:formule_carre},
\begin{multline*}
\left|\nabla_{x_\ell}\left(\sqrt{\rho_\bP}\chi_{\epsilon,z_1}\wedge\cdots\wedge\sqrt{\rho_\bP}\chi_{\epsilon,z_N}\right)\right|^2\\
=\frac{1}{N!}\sum_{\sigma\in\mathfrak{S}_N}\left|\nabla\big(\sqrt{\rho_\bP}\chi_{\epsilon,z_{\sigma(\ell)}}\big)(x_\ell)\right|^2\prod_{\substack{k=1,...,N\\ k\neq\ell}} \rho_\bP(x_k)\chi_{\epsilon,z_{\sigma(k)}}(x_k)^2.
\end{multline*}
Integrating over $x_1,...,x_N$, we obtain
\begin{multline*}
\sum_{\ell=1}^N\int_{\R^{dN}}\left|\nabla_{x_\ell}\left( \sqrt{\rho_\bP}^{\otimes N}\chi_{\epsilon,z_1}\wedge\cdots\wedge\chi_{\epsilon,z_N}\right)\right|^2\\
=\sum_{j=1}^N\left(\int_{\R^d}\left|\nabla\big(\sqrt{\rho_\bP}\chi_{\epsilon,z_{j}}\big)(x)\right|^2\,dx\right)\prod_{\substack{k=1,...,N\\ k\neq j}}\rho_\bP\ast \chi_\epsilon^2(z_j).
\end{multline*}
Finally, integrating over the $y_k$'s and $z_k$'s, we conclude that
\begin{align*}
{\rm Tr}\,(-\Delta)\Gamma_\epsilon&=N\int_{\R^d}\int_{\R^d}\left|\nabla\big(\sqrt{\rho_\bP}\chi_{\epsilon,z}\big)(x)\right|^2\,dx\,dz\\
&=N\left(\int_{\R^d}|\nabla\sqrt{\rho_\bP}(x)|^2\,dx+\frac{1}{\epsilon^2}\int_{\R^d}|\nabla\chi(x)|^2\,dx\right).
\end{align*}
To prove~\eqref{eq:estim_potential}, we remark that
$$\iint_{\R^{2dN}}\prod_{k=1}^N\frac{\rho_\bP(x_k)\chi_\epsilon(x_k-z_k)^2\chi_\epsilon(z_k-y_k)^2}{\rho_\bP\ast\chi_\epsilon^2(z_k)}dx_1\cdots dx_N\;dz_1\cdots dz_N=1.$$
Hence, using the shorter notation $X=(x_1,...,x_N)$, $Y=(y_1,...,y_N)$ and $Z=(z_1,...,z_N)$, we have
\begin{multline*}
\int_{\R^{dN}}\Phi\, d\bP_\epsilon-\int_{\R^{dN}}\Phi\, d\bP\\
=\iint_{\R^{3dN}}\big(\Phi(X)-\Phi(Y)\big)\prod_{k=1}^N\frac{\rho_\bP(x_k)\chi_\epsilon(x_k-z_k)^2\chi_\epsilon(z_k-y_k)^2}{\rho_\bP\ast\chi_\epsilon^2(z_k)}
d\bP(Y)\;dX\;dZ.
\end{multline*}
Since $|x_j-y_j|\leq 2\epsilon$ due to the support of $\chi$, we conclude from the fundamental theorem of calculus that
\begin{multline*}
\bigg|\int_{\R^{dN}}\Phi\, d\bP_\epsilon-\int_{\R^{dN}}\Phi\, d\bP
-\iint_{\R^{3dN}}d\bP(Y)\,dX\,dZ\left(\sum_{\ell=1}^N\nabla_{\ell}\Phi(Y)\cdot (x_\ell-y_\ell)\right)\times\\
\times\prod_{k=1}^N\frac{\rho_\bP(x_k)\chi_\epsilon(x_k-z_k)^2\chi_\epsilon(z_k-y_k)^2}{\rho_\bP\ast\chi_\epsilon^2(z_k)}
\bigg|
\leq 2\epsilon^2\sum_{\ell,m=1}^N\norm{\nabla_{x_\ell}\nabla_{x_m}\Phi}_{L^\infty(D^c_{\alpha-4\epsilon})}.
\end{multline*}
It remains to estimate the term involving $\nabla_\ell\Phi$. By symmetry, it is sufficient to look at the case $\ell=1$, which can be expressed in the form
\begin{multline*}
\iint_{\R^{3dN}}\nabla_{1}\Phi(Y)\cdot (x_1-y_1)\prod_{k=1}^N\frac{\rho_\bP(x_k)\chi_\epsilon(x_k-z_k)^2\chi_\epsilon(z_k-y_k)^2}{\rho_\bP\ast\chi_\epsilon^2(z_k)}d\bP(Y)\,dX\,dZ\\
=\iint_{\R^{dN+2d}}\nabla_{1}\Phi(Y)\cdot (x_1-y_1)\frac{\rho_\bP(x_1)\chi_\epsilon(x_1-z_1)^2\chi_\epsilon(z_1-y_1)^2}{\rho_\bP\ast\chi_\epsilon^2(z_1)}d\bP(Y)\,dx_1\,dz_1.
\end{multline*}
Here we can replace $x_1-y_1$ by $x_1-z_1$ since
$\int_{\R^d}(z_1-y_1)\chi_\epsilon(z_1-y_1)^2\,dz_1=0,$
due to the symmetry of $\chi$. We then estimate
\begin{align*}
&\bigg|\iint_{\R^{3dN}}\nabla_{1}\Phi(Y)\cdot (x_1-z_1)\frac{\rho_\bP(x_1)\chi_\epsilon(x_1-z_1)^2\chi_\epsilon(z_1-y_1)^2}{\rho_\bP\ast\chi_\epsilon^2(z_1)}d\bP(Y)\,dx_1\,dz_1\bigg|\\[0.2cm]
&\ \leq\norm{\nabla_1\Phi}_{L^\infty(D^c_{\alpha-4\epsilon})}\times\\
&\quad\times\iint_{\R^{2d}}\left|\int_{\R^d}(x_1-z_1)\rho_\bP(x_1)\chi_\epsilon(x_1-z_1)^2\,dx_1\right|\frac{\chi_\epsilon(z_1-y_1)^2}{\rho_\bP\ast\chi_\epsilon^2(z_1)}\,\rho_{\bP}(y_1)\,dz_1\,dy_1\\
&\ = \norm{\nabla_1\Phi}_{L^\infty(D^c_{\alpha-4\epsilon})}\int_{\R^{d}}\left|\int_{\R^d}(x-z)\rho_\bP(x)\chi_\epsilon(x-z)^2\,dx\right|\,dz.
\end{align*}
By the symmetry of $\chi$ and the fundamental theorem of calculus, we have
\begin{align*}
&\left|\int_{\R^d}(x-z)\rho_\bP(x)\chi_\epsilon(x-z)^2\,dx\right|\\
&\qquad\qquad=\left|\int_{\R^d}(x-z)\big(\rho_\bP(x)-\rho_\bP(z)\big)\chi_\epsilon(x-z)^2\,dx\right|\\
&\qquad\qquad\leq \int_0^1\int_{\R^d}|\nabla\rho_\bP(z+tu)|\,|u|^2\chi_\epsilon(u)^2\,du.
\end{align*}
Integrating over $z$ we find the claimed estimate
\begin{multline*}
\bigg|\iint_{\R^{3dN}}\nabla_{1}\Phi(Y)\cdot (x_1-y_1)\prod_{k=1}^N\frac{\rho_\bP(x_k)\chi_\epsilon(x_k-z_k)^2\chi_\epsilon(z_k-y_k)^2}{\rho_\bP\ast\chi_\epsilon^2(z_k)}d\bP(Y)\,dX\,dZ\bigg|\\
\leq \epsilon^2\norm{\nabla_1\Phi}_{L^\infty(D^c_{\alpha-4\epsilon})}\left(\int_{\R^{d}}|\nabla\rho_\bP|\right)\left(\int_{\R^d}|u|^2\chi(u)^2\,du\right).
\end{multline*}
\end{proof}

\section{Semiclassical limit of the Levy-Lieb functional}\label{sec:Levy-Lieb}

Here we restrict ourselves for simplicity to the physical space $\R^3$ and the Coulomb potential.
Density Functional Theory is based on the following functional~\cite{Levy-79,Lieb-83b,CanDefKutLeBMad-03}
\begin{equation}
\mathcal{E}(\rho)=\min_{\substack{\Gamma=\Gamma^*\geq0\\ {\rm Tr}\,(\Gamma)=1\\ \rho_\Gamma=\rho}}{\rm Tr}\,\left(-\sum_{j=1}^N\Delta_{x_j}+\sum_{1\leq j<k\leq N}\frac{1}{|x_j-x_k|}\right)\Gamma,
\label{eq:Levy-Lieb}
\end{equation}
of the density $\rho$, a given non-negative function such that $\int_{\R^3}\rho=N$ and $\sqrt{\rho}\in H^1(\R^3)$. In the minimum $\Gamma$ is an operator acting on the fermionic space $\bigwedge_1^NL^2(\R^3)$. Motivated by arguments of Hohenberg and Kohn~\cite{HohKoh-64}, Levy introduced in~\cite{Levy-79} a functional similar to~\eqref{eq:Levy-Lieb} but with the additional constraint that $\Gamma=|\Psi\rangle\langle\Psi|$ is a rank-one orthogonal projection (pure state). The latter was rigorously studied by Lieb in~\cite{Lieb-83b}, who proposed to extend the definition to mixed states, as in~\eqref{eq:Levy-Lieb}. The minimum over mixed states~\eqref{eq:Levy-Lieb} has better mathematical properties than with pure states~\cite{Lieb-83b}. For instance, $\mathcal{E}$ is convex and, by the linearity in $\Gamma$, we have the dual formulation
\begin{multline*}
\mathcal{E}(\rho)=\sup \bigg\{\int_{\R^3}\rho(x)\,V(x)\,dx\ :\ V\in L^{3/2}(\R^3,\R)+L^\infty(\R^3,\R),\\ -\sum_{j=1}^N\Delta_{x_j}-\sum_{j=1}^NV(x_j)+\sum_{1\leq j<k\leq N}\frac{1}{|x_j-x_k|}\geq0\bigg\},
\end{multline*}
which is the quantum equivalent of the Kantorovich duality used in optimal transport~\cite{Villani-09}. The last inequality is in the sense of self-adjoint operators.

It is possible to introduce an effective semi-classical parameter $\eta=\hbar^2$ by scaling the density $\rho$. Namely, for $\rho_\eta(x)=\eta^{3}\rho(\eta x)$ we have
\begin{equation}
\frac{\mathcal{E}(\rho_\eta)}{\eta}=\min_{\substack{\Gamma=\Gamma^*\geq0\\ {\rm Tr}\,(\Gamma)=1\\ \rho_\Gamma=\rho}}{\rm Tr}\,\left(-\eta\sum_{j=1}^N\Delta_{x_j}+\sum_{1\leq j<k\leq N}\frac{1}{|x_j-x_k|}\right)\Gamma.
\label{eq:Levy-Lieb_eta}
\end{equation}
In the limit $\eta\to0$, we prove the convergence to the Coulomb multi-marginal optimal transport problem
\begin{equation}
\mathcal{E}_{\rm OT}(\rho)=\min_{\substack{\bP\ \text{symmetric}\\ \text{probability on $(\R^3)^N$}\\ \rho_\bP=\rho}}\int_{(\R^3)^N}\sum_{1\leq j<k\leq N}\frac{1}{|x_j-x_k|}d\bP(x_1,...,x_N),
\label{eq:OT}
\end{equation}
which has recently received a lot of attention~\cite{ButPasGor-12,CotFriKlu-13,CotFriPas-15,ColMar-15,MarGerNen-15,SeiMarGerNenGieGor-17}

\begin{theorem}[Semi-classical limit]
Let $N\geq2$ and let $\rho\geq0$ be such that $\int_{\R^3}\rho=N$ and $\sqrt{\rho}\in H^1(\R^3)$. Then we have for a constant $C$ (depending on $N$ and $\rho$)
\begin{equation}
\mathcal{E}_{\rm OT}(\rho)\leq \frac{\mathcal{E}\left(\eta^3\rho(\eta\,\cdot)\right)}\eta\leq \mathcal{E}_{\rm OT}(\rho)+C(\sqrt{\eta}+\eta).
\label{eq:estim_semiclassics}
\end{equation}
In particular,
$$\lim_{\eta\to0}\frac{\mathcal{E}\left(\eta^3\rho(\eta\,\cdot)\right)}\eta= \mathcal{E}_{\rm OT}(\rho).$$
\end{theorem}

This theorem generalizes the results in~\cite{CotFriKlu-13,BinPas-17} for $N=2,3$ in the pure state case. Results for $N\geq3$ have been announced
in~\cite[Ref. 7]{FriMenPasCotKlu-13} but they were not yet available at the time this note was written. It would be interesting to extend our findings to pure states.

Semi-classical analysis suggests that the behavior in $\sqrt\eta$ is optimal for small $\eta$. The next order (in $\sqrt{\eta}=\hbar$) in the expansion of $\mathcal{E}(\rho_\eta)/\eta$ was predicted in~\cite{GorVigSei-09}.

\begin{proof}
Let $\bP$ be an optimizer for $\mathcal{E}_{\rm OT}(\rho)$. It has been shown in~\cite{ButChaPas-17} that $\bP$ has its support on $D^c_\alpha$ for some $\alpha>0$. Taking then our $\Gamma_\epsilon$ as a trial state, we find by Theorem~\ref{thm:estimates}
\begin{multline*}
\frac{\mathcal{E}(\rho_\eta)}\eta \leq \eta N\left(\int_{\R^d}|\nabla\sqrt{\rho}|^2+\frac{1}{\epsilon^2}\int_{\R^d}|\nabla\chi|^2\right)+\mathcal{E}_{\rm OT}(\rho)\\
+C\epsilon^2\left(\frac{N^3}{(\alpha-4\epsilon)^2}\int_{\R^{d}}|\nabla\rho_\bP|\int_{\R^d}|u|^2\chi(u)^2\,du+\frac{N^4}{(\alpha-4\epsilon)^3}\right).
\end{multline*}
We have used here that $\Phi(X)=\sum_{1\leq j<k\leq N}|x_j-x_k|^{-1}$ is $C^\infty$ on $D^c_{\alpha-4\epsilon}$.
Optimizing in $\epsilon$ gives the result.
\end{proof}

\begin{remark}
The convergence of states in the limit $\eta\to0$ can be proved as in~\cite{BinPas-17}.
\end{remark}

\subsection*{Acknowledgement} This project has received funding from the European Research Council (ERC) under the European Union's Horizon 2020 research and innovation programme (grant agreement MDFT No 725528).


\section{Introduction}\label{seq_intro}

As an historically data-intensive science, astrophysics has obviously to deal with significant data-processing issues. Projects such as the Gaia
 survey \cite{gaia2}
 or LSST\footnote{https://www.lsst.org/}
are acquiring and will acquire a lot of data, both in terms of number of samples and in terms of amount of data by sample
We are interested in methods able to extract as much physical content as possible from such large volumes of data.

Our problem deals with high dimensional data-processing.
Similarly to \cite{Paletou15}, our goal is to infer stellar fundamental parameters such as effective temperature, surface gravity or metallicity. We also want to infer an important physical parameter which may significantly affect the appearance of stellar spectra, the projected rotational velocity.

These physical parameters values are to be estimated from the stars measured spectra. Nowadays precision optical spectroscopy relies on observations made over large spectral bandwidths, of the order of about 500 nm or more (without any gap), and at high-spectral resolution, typically of several $10^4$ in resolvance (resolvance is related to sampling properties of these instruments $R = \frac{\lambda}{\Delta\lambda}$).

For these problems, there is no direct linear relationship between the data and the physical parameters. To ease the search for such a function or relationship, we use methods based on a reduction of the dimensionality of our data-space.
These methods should extract from the data the information related to the physical parameter we want to infer.
One of the most popular among these methods is PCA \cite{Jolliffe} which is the method used by \cite{Paletou15}.
In this study, our aim is to find the best subspace for the estimation of an explanatory variable $y$ from a data vector $x$. This subspace is to be estimated from a database containing many examples of pairs ($x_i$,$y_i$). Once the subspace is found, a k-Nearest-Neighbours method will give the estimator $\hat{y}_i$ of the unknown value $y_i$ associated with the data vector $x_i$.
Hereafter we will propose an alternative solution based on SIR \cite{li91} to improve the results. Unlike PCA, SIR is a supervised method. Hence, when building the projection subspace, we will be able to add the information about the physical parameters (or explanatory variables) we want to retrieve from the data. These parameters are considered independently one at a time. SIR method has already been used in \cite{bernard-michel}. One of the differences with our case is that we have no information about the dimension of the subspace consistent with the one-dimensional manifold described by the physical parameter; and we cannot use a physical modelling to determine the dimension of this subspace.

SIR suffers from a limitation due to the ill-conditioning of the variance-covariance matrix. Thus, it will sometimes require some preprocessing in order to perform a stable inversion of the variance-covariance matrix. This preprocessing will consist in applying a PCA on the data before applying SIR.

The first section briefly recalls the basic principles of PCA and SIR methods. The second section presents the implementation of SIR and some examples to enlighten how it basically works. The third section is about testing SIR method on a simplified data set which mimics the astrophysical data we want to deal with. The fourth section discusses the tuning of the method and the pre-processing.

\section{Methods}
\subsection{Principal Component Analysis}
PCA is a method which aims at finding the subspace that preserves the most the variance of the projected data.

Considering a data matrix $\textbf{X}$ of dimension $\textit{M} \times \textit{N}$ with each line being an element from the database, PCA finds the projection matrix $\textbf{V}$ such as $\textbf{X}^T\textbf{V}$ has the maximum variance. The first vector $v_1$ is the one that maximizes $Var(\textbf{X}^Tv_1)$ under the constraint $v_1^Tv_1 = 1$, the second vector $v_2$ is the vector orthogonal to $v_1$ that maximizes $Var(\textbf{X}^Tv_2)$ under the same constraint, and so on until the number of components reaches the specified dimension of the projection subspace.
To find these vectors, one can perform an eigen-decomposition of the variance-covariance matrix of $\textbf{X}$ denoted by $\boldsymbol{\Sigma}$. Thus we will find these vectors by solving: $(\boldsymbol{\Sigma} - \lambda \textbf{I}_M)v = 0$ \cite{Jolliffe}.

The first step of PCA is to compute the variance-covariance matrix $\boldsymbol{ \Sigma }$:

\begin{equation}\label{eq_sigma}
\boldsymbol{\Sigma}_{i,j} = \frac{1}{M}\sum_{k=1}^{M} (\textbf{X}_{k,i} - \overline{\textbf{X}_i})  (\textbf{X}_{k,j} - \overline{\textbf{X}_j} )
\end{equation}
where $N$ is the dimension of the original data-space, $\textbf{X}_k$ is the $k^{th}$ column containing all the $x$ vectors projected on the $k^{th}$ component of the original data-space. $\overline{\textbf{X}_i}$ and $\overline{\textbf{X}_j}$ are the mean values computed on lines $i$ and $j$.

The subspace obtained by PCA is spanned by the eigenvectors of $\boldsymbol{\Sigma}$ associated to its greatest eigenvalues.

Let $\textbf{V}$ be the $N \times P$ matrix with every column being one of these $P$ selected eigenvectors, and $N$ being the dimension of the original space. The $x$ vectors can be projected on the subspace associated with PCA:
\begin{equation}
x_p = (x^T - \overline{\textbf{X}}) \textbf{V}
\end{equation}
where $x$ is the representation of an element from the database in the original data-space, and $\overline{\textbf{X}}$ is the mean of the elements from the database in the original data-space. $\overline{\textbf{X}}$ is computed on all the lines of the matrix $\textbf{X}$.

The main drawback of PCA on our application is that this method does not take into account the prior knowledge on the explanatory variable we want to infer, as it is an unsupervised method. This is why we decided to investigate SIR as an alternative.

\subsection{Sliced Inverse Regression}

SIR \cite{li91} aims at finding the directions that explain the best the variation of the explanatory variable $y$ (taken one by one) from the data $x$. The principle of the method is very close to the one of the PCA: it relies on the estimation of a linear projection subspace. However SIR takes into account the information on the variation of the explanatory variable in the building of this subspace. The database is divided into $H$ slices along the variation of the explanatory variable, each slice being composed of pairs ($x$,$y$) which have close values of the explanatory variable. SIR builds a subspace that maximizes the variance between the slices while minimizing the variance within the slices. Somehow, SIR can be compared to a Linear Discriminant Analysis (LDA)\cite{LDA} in a classification problem. Thus, SIR finds a linear projection that drives apart the elements that have very different values of the explanatory variable while bringing together the elements which have close values of the explanatory variable.
Let us denote by $\textbf{X}_h$ the elements from the database in the slice $h$. For every slice we compute the mean $\overline{m}_h$
\begin{equation}
\overline{m}_h = \frac{1}{n_h} \sum_{\textbf{X}_i \in h}  \textbf{X}_i
\label{eq_mh}
\end{equation}
where $n_h$ is the number of elements in the slice $h$,
so that we have the matrix $\textbf{X}_H$ with every line being the mean $\overline{m}_h$ associated with the elements of the slice $h$. We then compute the variance-covariance of the slices means:
\begin{equation}\label{eq_gamma}
\boldsymbol{\Gamma} = \frac{1}{H}(\textbf{X}_H - \overline{\textbf{X}_H})^T(\textbf{X}_H -  \overline{\textbf{X}_H}).
\end{equation}

The directions computed by SIR will be given by the eigenvectors associated with the greatest eigenvalues of $\boldsymbol{\Sigma}^{-1}\boldsymbol{\Gamma}$. The vectors spanning the sub-space we are looking for are the solutions of  $(\boldsymbol{\Sigma}^{-1}\boldsymbol{\Gamma} - \lambda \textbf{I}_M)v = 0$.
\vspace{-0.2cm}
\section{Sliced Inverse Regression}

\subsection{Implementation}

SIR can be computed the following way:

\begin{itemize}
\item compute the variance-covariance matrix $\boldsymbol{\Sigma}$ as in eq. \ref{eq_sigma}
\vspace{-0.2cm}
\item sort the parameter vector $y$ so it becomes $y_{sorted}$
\vspace{-0.2cm}
\item split the sorted vector $y_{sorted}$ in $H$ non-overlapping slices
\vspace{-0.2cm}
\item for each slice $h$ compute the mean $\overline{m}_h$ according to eq. \ref{eq_mh}
\vspace{-0.2cm}
\item set the $\boldsymbol{\Gamma}$ matrix as in eq. \ref{eq_gamma}
\vspace{-0.2cm}
\item build a projection matrix $\textbf{V}$ so that the columns of $\textbf{V}$ are the eigenvectors associated with the greatest eigenvalues of $\boldsymbol{\Sigma}^{-1}\boldsymbol{\Gamma}$.

\end{itemize}

One of the critical point of this method may be the inversion of $\boldsymbol{\Sigma}$. Indeed, $\boldsymbol{\Sigma}$ can be ill-conditioned as discussed in section~4. In that case, we propose to apply a PCA to project the data on a subspace that maximizes the variance. Doing so, PCA will lead to an inversion of $\boldsymbol{\Sigma}$ more stable, and in the meantime, it will reduce the dimension of the dataspace and thus requires less  computational resources. There is a compromise to find between improving enough the conditioning and loosing information held by the data. This will be discussed in section 5.

\subsection{Examples}

\subsubsection{Linear example}\label{sec_linex}

As a first example we will consider a linear relationship between $x$ and $y$ such as $y = \beta^Tx +\epsilon$. The dimension of $x$ is 4 and the database contains 1000 elements. $\textbf{X}$ follows a normal standard distribution $\textbf{X} \sim N(\mu,I_4)$, where $\mu$ is a null vector of dimension $\textit{4} \times \textit{1}$ and $I_4$  is a dimension 4 identity matrix, $\beta^T = [1,1,0,1]$ and the noise $\epsilon \sim N(0,0.1 I_4)$.

\begin{figure}[H]
\centering
\includegraphics[height = 4cm,width =8cm]{y_vs_x_ex_lin.png}
\caption{Values of $y$ versus the realisations of $\textbf{X}$ for the example of section~\ref{sec_linex}. We can observe that none of these directions $x_i$ of the original data-space is relevant to explain the variations of the explanatory variable $y$. This can be explained by the $x_i$ varying independently from one to another, $y$ being a linear combination of these $x_i$, and all these components having the same weight.}
\label{ex1}
\end{figure}

\vspace{-0.6cm}
Fig. \ref{ex1} shows that from every component of $\textbf{X}$, it is impossible to determine precisely $y$. It appears in these four sub-figures that for any value of the $x_i$, $y$ looks like it is randomly distributed. This is why one must find the correct linear combination of the $x_i$ to explain $y$.

\begin{figure}[H]
\centering
\includegraphics[height = 4cm,width =8cm]{y_vs_x_p2_ex_lin.png}
\caption{Values of $y$ versus the realisations of $\textbf{X}$ projected on the first direction given by PCA for the example of section \ref{sec_linex}. Such a cloud of points indicates that the variance is nearly irrelevant to infer the value of $y$ from a known value of $x$.}
\label{PCA_ex1}
\end{figure}

The first direction $v_1$ given by PCA, displayed in Fig. \ref{PCA_ex1}, is the one that maximizes the variance in the data, and it appears that this criterion is not relevant here, because as in Fig. \ref{ex1}, $y$ seems to be randomly distributed for any value of the projected data $x^Tv_1$.

\begin{figure}[H]
\centering
\includegraphics[height = 4cm,width =8cm]{y_vs_x_p_ex_lin.png}
\caption{Values of $y$ versus the realisations of $\textbf{X}$ projected on the first direction given by SIR for the example of section \ref{sec_linex}. This figure clearly shows that SIR is able to find the linear projection which explains $y$ from the components presented on Fig.\ref{ex1}.}
\label{SIR_ex1}
\end{figure}

Fig. \ref{SIR_ex1} shows that SIR provides a direction $v_1$ that allows us to determine quite precisely $y$ from $x^Tv_1$. Indeed for every value of $x^Tv_1$ the range of values that $y$ can take is limited.

This first example shows that the first direction given by SIR (Fig. \ref{SIR_ex1}) finds a much more relevant combination of $\textbf{X}$ to explain $y$ than PCA (Fig. \ref{PCA_ex1}) even though it is quite difficult to infer that relationship from $\textbf{X}$ in the original space (Fig. \ref{ex1}). In this case, the condition number associated with $\boldsymbol{\Sigma}$ is 1.26, so there is no need for any preprocessing.

\subsubsection{Nonlinear example}\label{sec_nonlinex}

The second example focusses on a non linear case. All the components of $\textbf{X}$ are independent and follow a standard uniform distribution $U[0,1]$ and $y(x) = 2x_1x_2+x_3+0  x_4 + \epsilon$, where the noise is $\epsilon \sim N(0,0.01 I_4)$.

\begin{figure}[H]
\centering
\includegraphics[height = 4cm,width =8cm]{y_vs_x_ex_nonlin.png}
\caption{Values of $y$ versus the realisations of $\textbf{X}$ for the example of section \ref{sec_nonlinex}. As in the case of the linear example, it is not obvious to find a relationship between the data in its original space and the explanatory variable even if we can see that the three first components (top-left, top-right, and bottom-left) of the data-space hold information about $y$. This is due to the fact that the range of the values taken by $y$ is rather wide whatever the value of $x_i$ is.}
\label{ex2}
\end{figure}

Once again in this example, we have to find a good combination of the components $x_i$ shown on Fig. \ref{ex2} to explain $y$.

\begin{figure}[H]
\centering
\includegraphics[height = 4cm,width =8cm]{y_vs_x_p2_ex_nonlin.png}
\caption{Values of $y$ versus the realisations of $\textbf{X}$ projected on the first directions given by PCA for the example of section \ref{sec_nonlinex}. It appears that the first direction given by PCA holds almost no information about the explanatory variable because no matter what $x^Tv_1$ is, $y$ cannot be precisely determined.}
\label{PCA_ex2}
\end{figure}

We show with Fig. \ref{PCA_ex2} that, using PCA, a relationship appears between $x^Tv_1$ and $y$. Indeed, the scatter-plot (Fig. \ref{PCA_ex2}) exhibits a shape and is not fully random. Nevertheless, this so-called 'shape' is far from being sufficiently narrow to determine precisely $y$ from $x^Tv_1$.

\begin{figure}[H]
\centering
\includegraphics[height = 4cm,width =8cm]{y_vs_x_p_ex_nonlin.png}
\caption{Values of $y$ versus the realisations of $\textbf{X}$ projected on the first direction given by SIR for the example of section \ref{sec_nonlinex}. Even though the direction is not as efficient as in the linear case, we can see here that SIR projects the data on a direction which highly correlates the data with the explanatory variable.}
\label{SIR_ex2}
\end{figure}

Again in the case where the relationship between the data and the parameter is not linear, SIR (Fig. \ref{SIR_ex2}) provides more relevant directions to explain $y$ from $\textbf{X}$ than PCA. Of course, since it is a linear projection method more than one direction can be necessary to estimate correctly the one dimensional explanatory variable which is non-linearly linked to the data. In this example, a preprocessing of the data was not necessary because the condition number associated with $\boldsymbol{\Sigma}$ is 1.17.

\section{Application to synthetic data}
\subsection{Inference of simple Gaussian lines parameters}

We showed that SIR can determine the combinations of $\textbf{X}$ that best explain $y$. We will try to use it to obtain $\hat{y}$ when it is unknown.
Hereafter, the database is a set of simplified Gaussian lines that mimic the astrophysical data of interest. It is a set of $10^3$ Gaussian $\textbf{X}$ in which 800 will be used as a reference ($y$ is known) database $\textbf{X}_0$ and the 200 others will be used as a test database $\textbf{X}_i$ ($y$ is to be determined). Each Gaussian $x_j$ is associated with a set of explanatory variables $h_j$ and $w_j$, respectively the depression and the width of a simplified Gaussian spectral line:
\begin{equation}\label{eq_gauss}
x(\lambda;h,w) = 1 - h \times e^{-\frac{1}{2}\left(\frac{\lambda-\lambda_0}{w}\right)^2} + \epsilon .
\end{equation}
$h$ and $w$ will be processed independently,
$\lambda_0=0$ is common to all the elements. $h$ and $w$ are uniformly distributed $h \sim U[0.1,0.9]$, $w \sim U[1,3]$ and the noise $\epsilon$ is normally distributed $\epsilon \sim N(0,\sigma_\epsilon)$.

For this example we will add a noise $\epsilon$ such as $\sigma_\epsilon = 0.005$ equivalent to a signal to noise ratio around 32dB.

Once the data is projected on the subspace computed by SIR we will proceed with a simple mean on a 10 nearest neighbours method, to infer the value of the explanatory variable $\hat{y}_i$ of an individual $x_i$:

\begin{equation}
\hat{y}_i = \frac{1}{10} \sum_{y_{0_j} \in W_i}y_{0_j}.
\end{equation}

Here, $W_i$ is the set of the values of the explanatory variable from the training data-base $x_{p}$, associated with the 10 nearest neighbours of $x_{p_i}$.

Because of the ill-conditioning of $\Sigma$ (about $3\cdot 10^5$), we chose to perform a PCA first on the data, in order to improve the conditioning.
SIR is ran on the data projected on the subspace of dimension 6 given by PCA, so that we can see the directions given by SIR on Fig. \ref{SIR_dep_dir} and Fig. \ref{SIR_lrg_dir}. The choice of the dimension of the subspace given by PCA as a preprocessing will be discussed in section 5.

\begin{figure}[H]
\centering
\includegraphics[height = 4.5cm,width =8cm]{SIR_dep_dir.png}
\caption{Values of the depressions of the Gaussians $y$ versus the realisations of $\textbf{X}_0$ projected on the 6 directions given by SIR. Most of the information we seek is held by the first two directions (top-left and top-center), but in some cases the directions 3 (top-right), 4 (bottom-left) or 5 (bottom-center) can add quite precise information about $y$.}
\label{SIR_dep_dir}
\end{figure}

We can see on Fig. \ref{SIR_dep_dir} that most of the information about the depression is held by the first 2 directions (top-right and top-center) given by SIR. Indeed we can get an accurate estimator of the depressions from the projection of the data on the second direction (top-center of Fig. \ref{SIR_dep_dir}) as these two quantities are linearly related.

\begin{figure}[H]
\centering
\includegraphics[height = 4.5cm,width =8cm]{SIR10_lrg_dir.png}
\caption{Values of the widths of the Gaussians $y$ versus the realisations of $\textbf{X}_0$ projected on the 6 directions given by SIR. In that case the link between the explanatory variable and the data is non-linear so it does not seem to be a subspace which explains correctly all the values that can be taken by $y$.}
\label{SIR_lrg_dir}
\end{figure}

We show on Fig. \ref{SIR_lrg_dir}, that the direction which is the most relevant to explain the width from the data highly depends on the value of the projected data on the several directions. For instance the first direction is relevant for high values of $x^Tu_1$ as the associated values of $y$ are narrow (top-left of Fig. \ref{SIR_lrg_dir}). The same first direction though is not very relevant to infer $y$ when the value of $x^Tu_1$ is around 0 because the corresponding values of $y$ spread from 1.5 to 3 which is 3/4 of the total range of values $y$ can take.

From Fig. \ref{SIR_dep_dir} and Fig. \ref{SIR_lrg_dir}, one can see that the directions which are relevant for estimating $y$ can vary from an individual to another.
So the question remains: which of these directions will be relevant to estimate $y$ from $x$?
We will suggest a way in the following section to individually select the most relevant sub-space for each of the elements $x$ one wants to determine the paired $y$.

\subsection{Direction selection}

As shown in Fig. \ref{SIR_dep_dir} and \ref{SIR_lrg_dir}, the directions computed by SIR that best explain $y$ from $x$ may depend on the value of $x$. This is why we suggest to select the directions that will minimize the variance on the values of $y$ associated with the $x^Tv$ which are in the neighbourhood of the $x_i$ one wants to determine the associated value $\hat{y}_i$.
We thus can have a variable number of directions that is optimal to determine $\hat{y}_i$ from an individual to another.
For every individual $x_i$, we look for the set of directions $D_i$ spanning the subspace which minimizes the variance of $y_0 \in W_i$, where $W_i = \{y_{0_j} | dists_{i_j} \leq dist_{10_i}\}$, $dist_{i_j} = \| x_i^TD_i - x_j^TD_i \|$ and $ dist_{10_i}$ is the distance between $x_i^TD_i$ and its $10^{th}$ nearest neighbour.

\subsection{Validation of the modified SIR method}

The first test we will run is a comparison of the results given with the first direction of PCA, the first direction of SIR, and one selected direction of SIR.

\begin{figure}[H]

\hspace{-0.5cm}
\includegraphics[height = 5cm,width =10cm]{comp1dir_sirpca2.png}
\caption{Results of the estimation of depressions and widths with PCA using only the first direction (blue spots), SIR using the first direction (green triangles).}
\label{comp1dir}
\end{figure}

We can observe in Fig. \ref{comp1dir} that the results given by SIR are much more precise than the ones given by PCA. The perfect estimation being the line $\hat{y}=y$, results given by the method using SIR are closer to that line than the PCA ones.

\begin{figure}[H]
\hspace{-0.5cm}
\includegraphics[height = 5cm,width =10cm]{comp1dir_sirsir2.png}
\caption{Results of the estimation of depressions and widths with SIR using the first direction (green triangles), and the modified version of SIR with the direction selection (red spots).}
\label{comp1dir2}
\end{figure}

As shown in Fig. \ref{comp1dir2}, the selection of the direction that minimizes the variance of $y_0$ in the neighbourhood improves the results of SIR, and the efficiency of these different methods can be assessed with the computation of the mean absolute error (MAE) defined as:
\begin{equation}\label{eq_ame}
MAE = \frac{1}{M} \sum_{i=1}^M \| \hat{y}_i -y_i \|
\end{equation}

\begin{table}[H]
\begin{tabular}{|c|p{2cm}|p{2cm}|p{2cm}|}
\hline
& Results with PCA first direction & Results with SIR first direction & Results with SIR one selected direction \\
\hline
Depressions &  0.097 & 0.012 & 0.010 \\
\hline
Widths &  0.616 & 0.223 & 0.029 \\
\hline
\end{tabular}
\vspace{.1cm}
\caption{\textnormal{Table of the mean absolute errors given by the three versions of the method using only one direction for the projection.}}
\label{table1}
\end{table}

The improvement given by the selection of the directions is very efficient in finding the best direction when the link between $x$ and $y$ is non linear.

We thus can compare the results given by the optimal version of PCA (keeping 6 components) with SIR on its optimal number of directions for either depression (2 directions) or widths (3 directions), and also the version of SIR which looks for the subspace which minimizes the variance on $y$ in the neighbourhood. The results of this comparison are shown on table \ref{table2}.

\begin{table}[H]
\centering
\begin{tabular}{|c|p{2cm}|p{2cm}|p{2cm}|}
\hline
 & PCA & Classic SIR \\
\hline
Depressions &  0.0063 & 0.0025 \\
\hline
Widths &  0.029 & 0.027 \\
\hline
\end{tabular}
\vspace{0.1cm}
\caption{\textnormal{Table of the mean absolute errors given by PCA with 6 directions, classic SIR with the optimal number of directions, and SIR with the selection of the directions which minimize the variance on $y_0$ in the neighbourhood of the individual one wants to estimate the value of $y$.}}
\label{table2}
\end{table}
\vspace{-0.8cm}

The results displayed on table \ref{table2} show that SIR provides better results than the ones we can achieve with PCA. The fact that the classical version of SIR yields accurate estimates regarding the depressions can be explained by its efficiency on linear relationships between $x$ and $y$. Maybe the criterion used to determine the best directions combination (variance on $y$) is not the best criterion. However there is a non negligible gain regarding the widths estimation with SIR combined with the direction selection. We can note that the dimension of the subspace varies from an individual to another as shown on Fig. \ref{histoh} for the depressions and Fig. \ref{histow} for the widths.

\begin{figure}[H]
\centering
\includegraphics[width =9cm,height = 4.5cm]{histoh2.png}
\caption{Histogram of the dimension of the subspaces chosen by the method for the depression estimation for each of the 200 elements of the test database.}
\label{histoh}
\end{figure}

We can observe in Fig. \ref{histoh} that, as in the classical SIR case, most of the time the subspace that best explains the depression value from the data is spanned by 2 directions.

\begin{figure}[H]
\centering
\includegraphics[width =9cm,height = 4.5cm]{histow2.png}
\caption{Histogram of the dimension of the subspaces chosen by the method for the widths estimation for each of the 200 elements of the test database.}
\label{histow}
\end{figure}
\vspace{-0.3cm}
Fig. \ref{histow} shows that the optimal number of directions to determine the width can either be 2 or 3. With classical SIR the optimal number of directions is 3, but Fig. \ref{histow} shows that it is not that often the best solution.

 \vspace{-0cm}
\section{Discussion about preprocessing}\label{seq_Test}

We chose to perform a PCA to improve the conditioning of $\Sigma$, as it is a way to reduce the dimension of the data-space, while loosing the least information. Doing that, we assume that the information held by the last directions given by PCA are, even if relevant, drawn into noise. Performing a PCA carefully should not cause any loss of information, except for the information we could not have retrieved anyway. But how many directions should be kept? If we keep too many, we will not make the conditioning decrease enough, and the directions given by SIR will not be accurate. If we do not keep enough directions, there is a risk of loosing information on the explanatory variable.

To get an idea of what the best solution would be, let us have a look at Fig. \ref{PCA_dep_dir} and Fig. \ref{PCA_lrg_dir} to the 10 first directions given by PCA on our dataset:

\begin{figure}[H]
\centering
\includegraphics[height = 5cm,width =9cm]{PCA10_dep_dir.png}
\caption{Value of the depressions of the Gaussians $y$ versus the realisations of $\textbf{X}_0$ projected on the 10 directions given by PCA. Directions given by PCA seem to enclose information about $y$ up to the fifth direction.}
\label{PCA_dep_dir}
\end{figure}

\begin{figure}[H]
\centering
\includegraphics[height = 5cm,width =9cm]{PCA10_lrg_dir.png}
\caption{Value of the widths of the Gaussians $y$ versus the realisations of $\textbf{X}_0$ projected on the 10 directions given by PCA. As in Fig. \ref{PCA_dep_dir}, the directions over the fifth seems to be irrelevant as the distribution of $y$ looks independent from the value of $x^Tv_i$.}
\label{PCA_lrg_dir}
\end{figure}

We can see in Fig. \ref{PCA_dep_dir} and Fig. \ref{PCA_lrg_dir} that from the sixth direction (bottom-left), the remaining directions do not seem to hold any information about the parameter, since the value of $y$ looks independent from $x^Tv_i$. This assumption is verified by a validation protocol based on the estimation of the explanatory variables with PCA for several noise realisations. It appears that the dimension of the subspace given by PCA that gives the best results is 6. It makes the conditioning decrease to about $4 \cdot 10^4$. Even if we only gain a 10 factor on the conditioning, we cannot reduce more the dimensionality because we would most probably loose important information about the explanatory variable.

\section{Conclusion and future work}\label{seq_ccl}

In this article we have shown that SIR, being a supervised method, provides a subspace more relevant to link the data to the explanatory variable than the PCA one. We have also tried to give an answer to the problem of the number of directions which would be relevant. We also considered the problem of the choice of that relevant directions which can change with the location of the studied sample. We have shown that the method can be adapted to give the optimal subspace to locally contain the manifold where the explanatory variable is best explained. Preliminary results for this method using the same data set as in \cite{Paletou15}, show that, compared to the PCA-based method, the proposed SIR-based method decreases the estimation error by $20\%$ for the effective temperature and the surface gravity while we obtain similar estimation errors for the metallicity. However, the error increases by $30\%$ for the projected rational velocity.
The adaptation of the method to real astrophysical data is still in progress. Because the data are a lot more complex, the dimension of the original data-space can be 10 or 100 times larger than the one used for this study, and the conditioning of $\boldsymbol{\Sigma}$ can reach $10^{23}$. We will need to run more tests to determine the optimal number of components to keep with PCA as a preprocessing, and also to know the best way to consider the neighbourhood depending on the number of directions kept by the method. We believe that better results should be achieved by finding a way to correctly tune the method for this particular case.

\bibliographystyle{IEEEtran}


\section{Introduction}

In the last few years, we have witnessed the growing complexity of hardware and software systems for the automotive industry, with the aim of both providing safety and useful driver assisting systems (e.g., parking sensors, cruise control, brake assist, etc.) while having a rich infotainment package with all connectivity features. In this context, the idea of deploying both kinds of subsystems, one with safety-critical functions (often linked to soft/hard real-time constraints) and safety-related standards to comply with and the other with less demanding time constraints in a single platform board is tempting. Indeed, both the integration and development efforts are extremely cut down due to the reduced size, weight, power, and cost of the hardware itself.

To this aim, Mixed-Criticality Systems (MCSs) integrate functionalities of different safety and/or time-critical into a common platform \cite{burns2022mixed}. This kind of system is gradually expanding towards several application fields thanks to the ever-increasing CPU capabilities of modern chips, which have now spread the implementation of MCSs to the embedded domain where power consumption is a major concern. Moreover, the rapid development of virtualization technologies can nowadays easily support mixed-criticality compositions since it implicitly provides software support for resource partitioning and running tasks on heterogeneous Operating System (OS) (real-time and general-purpose) environments \cite{heiser2011virtualizing}. Indeed, due to the recent COVID-19 pandemic, there were estimated losses within ~\$60 to ~\$100 billion in 2021 sales for chip shortages in the automotive industry \cite{bloomberg_chip_shortage}. Thus, virtualization technologies are becoming a prominent way for the industry to consolidate multiple software systems on the same system-on-a-chip (SoC) in a flexible way \cite{blackberry_qnx_chip_shortage, cinque2021virtualizing}.

Generally, MCSs require safety certification evidence, which includes cumbersome and demanding tasks. The problem is even exacerbated when MCSs are virtualized since further critical factors come into play during the process of choosing the proper virtualization solution, which include hypervisor type, memory footprint, certification level (if exists), the license, support to high availability, fault tolerance, and security \cite{cinque2021virtualizing}. Regarding these issues, virtualizing MCSs could be an unfeasible task. However, the reference safety standard in the automotive domain, i.e., the ISO 26262 \cite{iso26262}, allows supplementing an already certified piece of software (e.g., a real-time OS) with a new software element (e.g., a software library) that is not certified, called the \textit{Safety Element out of Context} (SEooC). Including a SEooC in the whole system will not invalidate the former certification level if we can provide proof that this software has been developed following the guidelines specified by ISO 26262, i.e., ensuring that SEooC integration does not negatively affect existing pieces of software. In particular, the standard proposes, among others, to precisely analyze failure modes according to anomalous conditions. In the literature, several studies exploit fault injection techniques to assess complex systems' behavior and unveil potential bottlenecks and critical components under these abnormal inputs and conditions \cite{cotroneo2013fault, cotroneo2018run, nfv_dep_guidelines, winter2015no}. Also, the ISO 26262 standard prescribes the use of error detection/handling mechanisms, and their verification through fault injection, by ``\textit{corrupting hardware or software components}''.

In this short paper, we provide a preliminary investigation on integrating a partitioning hypervisor, namely Jailhouse, in a safety-critical deployment as SEooC. Jailhouse \cite{ramsauer2017look} promises to easily comply with safety or other certification requirements that are difficult to achieve with general-purpose hypervisors \cite{cinque2021virtualizing}.
We decided to focus on fault injection testing, which is an established technique to assess fault tolerance mechanisms via deliberately inject representative faults into a system under test. In our context, we need to provide evidence about isolation guarantees needed for treating a hypervisor as SEooC. To this aim, we propose a preliminary fault injection framework to deliberately inject faults according to the classical bit-flip fault model \cite{natella2016assessing}. Finally, we showcased the results of our initial experiments, highlighting the underlying criticalities of the current version of this hypervisor.

The other sections are organized as follows: section \ref{sec2} provides a general overview of the Jailhouse hypervisor and a discussion about SEooC; section \ref{sec3} describes our testing framework along with preliminary results; section \ref{sec4} delineates the state-of-the-art hypervisors in the automotive industry; section \ref{sec5} concludes the paper.

\section{Jailhouse and ISO 26262}
\label{sec2}

\subsection{Jailhouse Overview}

Jailhouse is a hypervisor announced publicly in November 2013 and currently published as open-source under the GNUPLv2 license and available for x86 and ARM-based boards (both 32 and 64 bit) \cite{ramsauer2017look}. Jailhouse is a partitioning hypervisor, which is a type of virtualization where the hardware resources such as cores, peripherals, and memory are divided into partitions (virtual machines) which are allocated statically following the concept of \textit{asymmetric processing}. While this approach may hinder the overall performance, it is desirable in a safety-critical application, as isolation is crucial to ensure no interference for running critical tasks. Further, a partitioning solution also keeps the overall codebase small, making easier (theoretically) the certification process. In Jailhouse, every partition is called \textit{"cell"}. As previously said, every cell has its own resources which cannot be accessed by the others. When Jailhouse is started, the only cell placed in the system is the \textit{root cell}. This cell contains every resource that Jailhouse can share between all the other cells, and thus it can not be removed from the system. Jailhouse allows creating a static configuration for a cell by writing a source file according to special C structures, where each field is filled according to the customer needs (e.g, assigned CPU cores, memory areas and access permissions, IRQ enabled, etc.).
Generally, Jailhouse statically assigns to each cell one guest OS (optional for bare-metal applications) and its applications called \textit{inmates}. Despite the main objective being partitioning resources, inter-cell communication is allowed through the \textit{ivshmem} device model. \figureautorefname{}~\ref{fig:jailhouse} shows the architecture of Jailhouse.

\begin{figure}
    \centering
    \includegraphics[width=0.83\columnwidth]{Jailhouse}
    \caption{The Jailhouse architecture}
    \label{fig:jailhouse}
\end{figure}

\subsection{Jailhouse as Safety Element out of Context (SEooC)}

Jailhouse is currently still in beta, as the latest version is the v0.12 on February 2020. However, this hypervisor was recently used as building block in different European research projects \cite{selene_project, hercules2020} and academic studies.
In this short paper, our aim is to understand whether this kind of software can be leveraged as a Safety Element out of Context, as described in the ISO 26262 road safety standard. Citing this latter, \textit{"An SEooC can be [...] a software [which is] developed, based on assumptions, in accordance with ISO 26262. It is intended to be used in multiple different items when the validity of its assumptions can be established during integration of the SEooC."}
Jailhouse can fall into this category: while it has not been developed as a vehicle software component, it can still be certified as such if its development is considered compliant to the ISO 26262 standard, and if it is not, it can be suitable for certification with change. Unfortunately, at least in public documents, there is no official documentation which describes the software planning activity nor the design phase of Jailhouse, thus this whole documentation should be compiled from scratch. Moreover, following the ISO 26262 standard, the software has to be tested with a software component which is certified as ISO 26262 with a certain ASIL (Automotive Safety Integrity Level), and in case the safety assumptions can not fit the new context, an impact analysis has to be initiated.
Ultimately, the process of certifying Jailhouse as a SEooC would be far from near completion. However, granting that both root and non-root cells can't interfere with each other, thus avoiding any issues with potential safety-related tasks, is a starting point for it in order to leverage the application to more safety concerning industrial applications.

\section{Proposal and Preliminary Results}
\label{sec3}

Our preliminary work aims at verifying the Jailhouse isolation and integrity features regarding the ability to provide cell partitioning. \figureautorefname{}~\ref{fig:test-framework} shows the proposed testing framework: after we decided on a certain test plan, we settled for a fault injection test with a certain hardware setup that affected both the root and non-root cell deployed by the hypervisor. Results were therefore collected on a log file, used further for analytics. The proposed testing framework includes a dozen of lines of code added to Jailhouse that allows us to orchestrate the fault injection tests by controlling test duration and target. We leveraged the single bit-flip fault model commonly used to emulate transient hardware faults \cite{natella2016assessing}. Having the code source at our disposal, we decided to monitor some golden (fault-free) runs of the hypervisor in order to find preliminary fault injection points. This profiling operation yielded three candidates functions, which were the hardware interrupt request function ({\fontfamily{lmtt}\selectfont irqchip\_handle\_irq()}), the trap exception handler ({\fontfamily{lmtt}\selectfont arch\_handle\_trap()}) and the hypervisor call handler ({\fontfamily{lmtt}\selectfont arch\_handle\_hvc()}). These three functions refer to the virtualization extensions available for the ARMv7 architecture. We then chose the injection strategy, consisting of a random bit flipping of a random architecture register. Finally, we decided not to operate on the interrupt request handler as the only parameter passed is the IRQ vector number, and manumitting it means calling a different IRQ function, defaulting to an IRQ error, which is completely predictable and correct behavior.

\begin{figure}
    \centering
    \includegraphics[width=0.8\columnwidth]{diagrammassiv}
    \vspace{-0.3cm}
    \caption{Testing Framework}
    \label{fig:test-framework}
    \vspace{-0.7cm}
\end{figure}

The generated test plan consists of two classes of testing, defined by the fault intensity level: the \textit{medium level} refers to a discontinuous bit flipping of a single register, generated once every given number of calls to the target functions, while the \textit{high level} instead consists in a bit flip of multiple registers at the time. These are both transient fault injections, and the rate of occurrence is configurable. The showcased tests have an occurrence of once every $100$ and $50$ function calls for the medium and hard intensity, respectively.
Each test lasts 1 min. and the outcome is sent to an empty shell where the board serial port is connected. We then collected the test results into a log file, which is further analyzed to understand how the hypervisor reacted to injected faults. The tested hardware comprises a Banana PI, which is a dual-core Cortex-A7 board, equipped with 1 GB of RAM. We evaluated Jailhouse v0.12 with Linux Kernel v5.10, properly patched for Jailhouse.
Finally, the test plan was executed by exercising a workload consisting of a root cell where the general-purpose Linux was running and a non-root cell in which we run FreeRTOS, a market-leading real-time OS. In particular, within FreeRTOS we spawned several tasks to be managed, including a task to blink an onboard led, a couple of send/receive tasks, two floating-point arithmetic tasks, and fifteen integer ones. We statically assigned the board CPU core 0 to the root cell and the CPU core 1 to the non-root cell (FreeRTOS cell).

The results can be summarized as follows. \textit{High level} intensity faults always return an "invalid arguments" when we target both the {\fontfamily{lmtt}\selectfont arch\_handle\_hvc()} and {\fontfamily{lmtt}\selectfont arch\_handle\_trap()} in the context of the root cell; thus, the root cell will be not allocated at all, which is a correct (and expected) behavior. On the other hand, when we filter the injection to activate only when the CPU core 1 is calling the function, the result is pretty peculiar, although wrong and inconsistent: the cell is allocated but, whether the CPU fails to come online as per the swap feature of the CPU hot plug or the cell is left in a non-executable state, the non-root cell doesn't do anything, as attested by the USART output left completely blank. Nonetheless, it is considered \textit{running} by Jailhouse, and the shutdown of the cell (i.e., {\fontfamily{lmtt}\selectfont jailhouse cell shutdown} command) gives the control of the CPU and the non-root cell peripherals specified in the configuration file back to the root cell. This inconsistent state is particularly dangerous as the Jailhouse user assumed that the allocated non-root cell is running, but instead, it is completely broken and unusable, and only destroying the cell and reallocating it fixes the problem.
We then decided to further investigate the non-root cell {\fontfamily{lmtt}\selectfont arch\_handle\_trap()} call to see the extend of the inconsistency, yielding the results summarized in \figureautorefname{}~\ref{fig:non-root-availability-measure}:

\begin{figure}[h]
    \centering
    \includegraphics[width=0.7\columnwidth]{test-results}
    \vspace{-0.3cm}
    \caption{Non-root cell availability in medium intensity tests}
    \label{fig:non-root-availability-measure}
\end{figure}

As we can see, the cell behaves correctly in the majority of cases, although in the $30\%$ a \textit{panic park} happens, i.e., the fault propagates to the whole system bringing the system itself to a kernel panic. Finally, a limited number of tests brings to a \textit{CPU park}: while the non-root cell is running, there is a critical fault injection that triggers the error code {\fontfamily{lmtt}\selectfont 0x24}, which is the unhandled trap exception. In this case, the {\fontfamily{lmtt}\selectfont cpu\_park()} function is called and the non-root cell stops working. However, the destruction of the non-root cell, which brings the CPU core 1 control back to the root cell, is accomplished without any issue. This means that the fault has been successfully isolated and the non-root cell has not damaged the other cells.

\section{Related Work}
\label{sec4}

\textit{PikeOS} \cite{pikeos} is a commercial hard real-time operating system that offers a separation kernel-based hypervisor. This real-time OS (RTOS) allows the creation of logical partitions which are completely isolated and can execute with different safety and security levels within the same computing platform. PikeOS is developed according to various safety standards, like DO-178C for avionic and also ISO 26262. The main advantage of the PikeOS architecture is that the microkernel consists of real-time OS and a type-1 hypervisor in one product. The system achieves resource partitioning by statically assigning the computing resources to its partitions and by using MMU.
\textit{MICROSAR} \cite{microsar} includes in its OS package a preemptive, real-time multitasking operating system for microcontrollers. It is based on the AUTOSAR OS specification \cite{autosar}, which is an extension of the OSEK/VDX-OS standard \cite{osek_vdx}, offering functions for time monitoring and memory protection. It also implements a high-resolution timer mechanism in order to provide time resolutions of less than $1ms$. The OS package is provided by a hypervisor module called LeanHypervisor (vLhyp) which initializes the System Memory Protection Unit (MPU) at start-up and manages the CPU cores' power on. Each core may have its own operating system image, which can be POSIX, Classic, or Adaptive AUTOSAR. Both the hypervisor and the Memory Protection Unit (MPU) task protect the OS partitions, which have to run without the risk of mutual interference due to incorrect data changes so that the system can operate in parallel partitions with different ASILs.
Other than the OS and hypervisor modules, there are plenty of other modules which compose the MICROSAR Safe basic software which have all been certified by the ISO 26262 ASIL-D standard as SEooC \cite{autosar-certified}.
\textit{VOSYSmonitor} \cite{lucas2018vosysmonitor} is an ASIL-C ISO 26262-compliant hypervisor, developed for both ARMv7 and ARMv8 architectures whose Cortex-A processors offer the \textit{Secure Monitor} mode. This feature allows executing a safety-critical RTOS and a general-purpose OS simultaneously; moreover, it allows the use of virtualization extensions like Linux/KVM, thus enabling the instantiation of multiple virtual machines. Furthermore, the hypervisor isolates the RTOS from the other VMs and offers several communication methods in order to provide a secure communication channel between the various subsystems. On multicore architectures, VOSYSmonitor can dynamically share cores between the \textit{secure} side and the \textit{non-secure} one: the idea is that the \textit{secure world} tasks should necessarily have priority compared to the other ones. This means that once a core is assigned to the safety-critical domain, the \textit{non-secure world} applications can run on that core only if there are no critical tasks to run, thus meaning that the resource has been freed by the \textit{secure-world} application. An interruption mechanism is finally deployed in order to guarantee an efficient context switch from one world to another.
Besides commercial products, also in research there is a trend toward the use of static partitioning hypervisors, mainly due to the isolation property that this kind of virtualization can offer to the user.
We choose Jailhouse as our testing platform due to its adaptability to multiple boards and the fact that it is open-source, but there are other successful examples of commercial hypervisors for automotive platforms currently available on the market. Other than Jailhouse, another example is \textit{Bao} hypervisor \cite{martins2020bao}, proposed as a static partitioning hypervisor for Armv8 and RISC-V platforms with a small codebase which differs from Jailhouse due to the fact that it does not depend on Linux to boot and manage the partitions. To the best of our knowledge, this is the first study that investigates fault injection techniques to support the certification of a hypervisor as SEooC in the automotive domain.

\section{Conclusions and future work}
\label{sec5}
In this short paper, we investigated the possibility of treating the open-source, non-certified, Jailhouse partitioning hypervisor as a Safety Element out of Context (SEooC) according to the automotive reference standard, the ISO 26262. More specifically, we opted for a fault injection methodology aimed at verifying the isolation and integrity features provided by the Jailhouse hypervisor. At the best of our knowledge, there are no other researches that tackle a fault injection approach towards verifying the hypervisor robustness and isolation features. In the end, we highlighted some possible criticalities which led to the hypervisor malfunctioning. Future plans aim at expanding the fault injection testing framework, by applying, e.g., a wider and customizable set of fault models in real scenarios. This will enable a framework that significantly helps this kind of hypervisor to become actual building blocks in virtualized mixed-criticality systems.

\bibliographystyle{IEEEtran}

\section{Introduction}

In the last few years, we have witnessed the growing complexity of hardware and software systems for the automotive industry, with the aim of both providing safety and useful driver assisting systems (e.g., parking sensors, cruise control, brake assist, etc.) while having a rich infotainment package with all connectivity features. In this context, the idea of deploying both kinds of subsystems, one with safety-critical functions (often linked to soft/hard real-time constraints) and safety-related standards to comply with and the other with less demanding time constraints in a single platform board is tempting. Indeed, both the integration and development efforts are extremely cut down due to the reduced size, weight, power, and cost of the hardware itself.

To this aim, Mixed-Criticality Systems (MCSs) integrate functionalities of different safety and/or time-critical into a common platform \cite{burns2022mixed}. This kind of system is gradually expanding towards several application fields thanks to the ever-increasing CPU capabilities of modern chips, which have now spread the implementation of MCSs to the embedded domain where power consumption is a major concern. Moreover, the rapid development of virtualization technologies can nowadays easily support mixed-criticality compositions since it implicitly provides software support for resource partitioning and running tasks on heterogeneous Operating System (OS) (real-time and general-purpose) environments \cite{heiser2011virtualizing}. Indeed, due to the recent COVID-19 pandemic, there were estimated losses within ~\$60 to ~\$100 billion in 2021 sales for chip shortages in the automotive industry \cite{bloomberg_chip_shortage}. Thus, virtualization technologies are becoming a prominent way for the industry to consolidate multiple software systems on the same system-on-a-chip (SoC) in a flexible way \cite{blackberry_qnx_chip_shortage, cinque2021virtualizing}.

Generally, MCSs require safety certification evidence, which includes cumbersome and demanding tasks. The problem is even exacerbated when MCSs are virtualized since further critical factors come into play during the process of choosing the proper virtualization solution, which include hypervisor type, memory footprint, certification level (if exists), the license, support to high availability, fault tolerance, and security \cite{cinque2021virtualizing}. Regarding these issues, virtualizing MCSs could be an unfeasible task. However, the reference safety standard in the automotive domain, i.e., the ISO 26262 \cite{iso26262}, allows supplementing an already certified piece of software (e.g., a real-time OS) with a new software element (e.g., a software library) that is not certified, called the \textit{Safety Element out of Context} (SEooC). Including a SEooC in the whole system will not invalidate the former certification level if we can provide proof that this software has been developed following the guidelines specified by ISO 26262, i.e., ensuring that SEooC integration does not negatively affect existing pieces of software. In particular, the standard proposes, among others, to precisely analyze failure modes according to anomalous conditions. In the literature, several studies exploit fault injection techniques to assess complex systems' behavior and unveil potential bottlenecks and critical components under these abnormal inputs and conditions \cite{cotroneo2013fault, cotroneo2018run, nfv_dep_guidelines, winter2015no}. Also, the ISO 26262 standard prescribes the use of error detection/handling mechanisms, and their verification through fault injection, by ``\textit{corrupting hardware or software components}''.

In this short paper, we provide a preliminary investigation on integrating a partitioning hypervisor, namely Jailhouse, in a safety-critical deployment as SEooC. Jailhouse \cite{ramsauer2017look} promises to easily comply with safety or other certification requirements that are difficult to achieve with general-purpose hypervisors \cite{cinque2021virtualizing}.
We decided to focus on fault injection testing, which is an established technique to assess fault tolerance mechanisms via deliberately inject representative faults into a system under test. In our context, we need to provide evidence about isolation guarantees needed for treating a hypervisor as SEooC. To this aim, we propose a preliminary fault injection framework to deliberately inject faults according to the classical bit-flip fault model \cite{natella2016assessing}. Finally, we showcased the results of our initial experiments, highlighting the underlying criticalities of the current version of this hypervisor.

The other sections are organized as follows: section \ref{sec2} provides a general overview of the Jailhouse hypervisor and a discussion about SEooC; section \ref{sec3} describes our testing framework along with preliminary results; section \ref{sec4} delineates the state-of-the-art hypervisors in the automotive industry; section \ref{sec5} concludes the paper.

\section{Jailhouse and ISO 26262}
\label{sec2}

\subsection{Jailhouse Overview}

Jailhouse is a hypervisor announced publicly in November 2013 and currently published as open-source under the GNUPLv2 license and available for x86 and ARM-based boards (both 32 and 64 bit) \cite{ramsauer2017look}. Jailhouse is a partitioning hypervisor, which is a type of virtualization where the hardware resources such as cores, peripherals, and memory are divided into partitions (virtual machines) which are allocated statically following the concept of \textit{asymmetric processing}. While this approach may hinder the overall performance, it is desirable in a safety-critical application, as isolation is crucial to ensure no interference for running critical tasks. Further, a partitioning solution also keeps the overall codebase small, making easier (theoretically) the certification process. In Jailhouse, every partition is called \textit{"cell"}. As previously said, every cell has its own resources which cannot be accessed by the others. When Jailhouse is started, the only cell placed in the system is the \textit{root cell}. This cell contains every resource that Jailhouse can share between all the other cells, and thus it can not be removed from the system. Jailhouse allows creating a static configuration for a cell by writing a source file according to special C structures, where each field is filled according to the customer needs (e.g, assigned CPU cores, memory areas and access permissions, IRQ enabled, etc.).
Generally, Jailhouse statically assigns to each cell one guest OS (optional for bare-metal applications) and its applications called \textit{inmates}. Despite the main objective being partitioning resources, inter-cell communication is allowed through the \textit{ivshmem} device model. \figureautorefname{}~\ref{fig:jailhouse} shows the architecture of Jailhouse.

\begin{figure}
    \centering
    \includegraphics[width=0.83\columnwidth]{Jailhouse}
    \caption{The Jailhouse architecture}
    \label{fig:jailhouse}
\end{figure}

\subsection{Jailhouse as Safety Element out of Context (SEooC)}

Jailhouse is currently still in beta, as the latest version is the v0.12 on February 2020. However, this hypervisor was recently used as building block in different European research projects \cite{selene_project, hercules2020} and academic studies.
In this short paper, our aim is to understand whether this kind of software can be leveraged as a Safety Element out of Context, as described in the ISO 26262 road safety standard. Citing this latter, \textit{"An SEooC can be [...] a software [which is] developed, based on assumptions, in accordance with ISO 26262. It is intended to be used in multiple different items when the validity of its assumptions can be established during integration of the SEooC."}
Jailhouse can fall into this category: while it has not been developed as a vehicle software component, it can still be certified as such if its development is considered compliant to the ISO 26262 standard, and if it is not, it can be suitable for certification with change. Unfortunately, at least in public documents, there is no official documentation which describes the software planning activity nor the design phase of Jailhouse, thus this whole documentation should be compiled from scratch. Moreover, following the ISO 26262 standard, the software has to be tested with a software component which is certified as ISO 26262 with a certain ASIL (Automotive Safety Integrity Level), and in case the safety assumptions can not fit the new context, an impact analysis has to be initiated.
Ultimately, the process of certifying Jailhouse as a SEooC would be far from near completion. However, granting that both root and non-root cells can't interfere with each other, thus avoiding any issues with potential safety-related tasks, is a starting point for it in order to leverage the application to more safety concerning industrial applications.

\section{Proposal and Preliminary Results}
\label{sec3}

Our preliminary work aims at verifying the Jailhouse isolation and integrity features regarding the ability to provide cell partitioning. \figureautorefname{}~\ref{fig:test-framework} shows the proposed testing framework: after we decided on a certain test plan, we settled for a fault injection test with a certain hardware setup that affected both the root and non-root cell deployed by the hypervisor. Results were therefore collected on a log file, used further for analytics. The proposed testing framework includes a dozen of lines of code added to Jailhouse that allows us to orchestrate the fault injection tests by controlling test duration and target. We leveraged the single bit-flip fault model commonly used to emulate transient hardware faults \cite{natella2016assessing}. Having the code source at our disposal, we decided to monitor some golden (fault-free) runs of the hypervisor in order to find preliminary fault injection points. This profiling operation yielded three candidates functions, which were the hardware interrupt request function ({\fontfamily{lmtt}\selectfont irqchip\_handle\_irq()}), the trap exception handler ({\fontfamily{lmtt}\selectfont arch\_handle\_trap()}) and the hypervisor call handler ({\fontfamily{lmtt}\selectfont arch\_handle\_hvc()}). These three functions refer to the virtualization extensions available for the ARMv7 architecture. We then chose the injection strategy, consisting of a random bit flipping of a random architecture register. Finally, we decided not to operate on the interrupt request handler as the only parameter passed is the IRQ vector number, and manumitting it means calling a different IRQ function, defaulting to an IRQ error, which is completely predictable and correct behavior.

\begin{figure}
    \centering
    \includegraphics[width=0.8\columnwidth]{diagrammassiv}
    \vspace{-0.3cm}
    \caption{Testing Framework}
    \label{fig:test-framework}
    \vspace{-0.7cm}
\end{figure}

The generated test plan consists of two classes of testing, defined by the fault intensity level: the \textit{medium level} refers to a discontinuous bit flipping of a single register, generated once every given number of calls to the target functions, while the \textit{high level} instead consists in a bit flip of multiple registers at the time. These are both transient fault injections, and the rate of occurrence is configurable. The showcased tests have an occurrence of once every $100$ and $50$ function calls for the medium and hard intensity, respectively.
Each test lasts 1 min. and the outcome is sent to an empty shell where the board serial port is connected. We then collected the test results into a log file, which is further analyzed to understand how the hypervisor reacted to injected faults. The tested hardware comprises a Banana PI, which is a dual-core Cortex-A7 board, equipped with 1 GB of RAM. We evaluated Jailhouse v0.12 with Linux Kernel v5.10, properly patched for Jailhouse.
Finally, the test plan was executed by exercising a workload consisting of a root cell where the general-purpose Linux was running and a non-root cell in which we run FreeRTOS, a market-leading real-time OS. In particular, within FreeRTOS we spawned several tasks to be managed, including a task to blink an onboard led, a couple of send/receive tasks, two floating-point arithmetic tasks, and fifteen integer ones. We statically assigned the board CPU core 0 to the root cell and the CPU core 1 to the non-root cell (FreeRTOS cell).

The results can be summarized as follows. \textit{High level} intensity faults always return an "invalid arguments" when we target both the {\fontfamily{lmtt}\selectfont arch\_handle\_hvc()} and {\fontfamily{lmtt}\selectfont arch\_handle\_trap()} in the context of the root cell; thus, the root cell will be not allocated at all, which is a correct (and expected) behavior. On the other hand, when we filter the injection to activate only when the CPU core 1 is calling the function, the result is pretty peculiar, although wrong and inconsistent: the cell is allocated but, whether the CPU fails to come online as per the swap feature of the CPU hot plug or the cell is left in a non-executable state, the non-root cell doesn't do anything, as attested by the USART output left completely blank. Nonetheless, it is considered \textit{running} by Jailhouse, and the shutdown of the cell (i.e., {\fontfamily{lmtt}\selectfont jailhouse cell shutdown} command) gives the control of the CPU and the non-root cell peripherals specified in the configuration file back to the root cell. This inconsistent state is particularly dangerous as the Jailhouse user assumed that the allocated non-root cell is running, but instead, it is completely broken and unusable, and only destroying the cell and reallocating it fixes the problem.
We then decided to further investigate the non-root cell {\fontfamily{lmtt}\selectfont arch\_handle\_trap()} call to see the extend of the inconsistency, yielding the results summarized in \figureautorefname{}~\ref{fig:non-root-availability-measure}:

\begin{figure}[h]
    \centering
    \includegraphics[width=0.7\columnwidth]{test-results}
    \vspace{-0.3cm}
    \caption{Non-root cell availability in medium intensity tests}
    \label{fig:non-root-availability-measure}
\end{figure}

As we can see, the cell behaves correctly in the majority of cases, although in the $30\%$ a \textit{panic park} happens, i.e., the fault propagates to the whole system bringing the system itself to a kernel panic. Finally, a limited number of tests brings to a \textit{CPU park}: while the non-root cell is running, there is a critical fault injection that triggers the error code {\fontfamily{lmtt}\selectfont 0x24}, which is the unhandled trap exception. In this case, the {\fontfamily{lmtt}\selectfont cpu\_park()} function is called and the non-root cell stops working. However, the destruction of the non-root cell, which brings the CPU core 1 control back to the root cell, is accomplished without any issue. This means that the fault has been successfully isolated and the non-root cell has not damaged the other cells.

\section{Related Work}
\label{sec4}

\textit{PikeOS} \cite{pikeos} is a commercial hard real-time operating system that offers a separation kernel-based hypervisor. This real-time OS (RTOS) allows the creation of logical partitions which are completely isolated and can execute with different safety and security levels within the same computing platform. PikeOS is developed according to various safety standards, like DO-178C for avionic and also ISO 26262. The main advantage of the PikeOS architecture is that the microkernel consists of real-time OS and a type-1 hypervisor in one product. The system achieves resource partitioning by statically assigning the computing resources to its partitions and by using MMU.
\textit{MICROSAR} \cite{microsar} includes in its OS package a preemptive, real-time multitasking operating system for microcontrollers. It is based on the AUTOSAR OS specification \cite{autosar}, which is an extension of the OSEK/VDX-OS standard \cite{osek_vdx}, offering functions for time monitoring and memory protection. It also implements a high-resolution timer mechanism in order to provide time resolutions of less than $1ms$. The OS package is provided by a hypervisor module called LeanHypervisor (vLhyp) which initializes the System Memory Protection Unit (MPU) at start-up and manages the CPU cores' power on. Each core may have its own operating system image, which can be POSIX, Classic, or Adaptive AUTOSAR. Both the hypervisor and the Memory Protection Unit (MPU) task protect the OS partitions, which have to run without the risk of mutual interference due to incorrect data changes so that the system can operate in parallel partitions with different ASILs.
Other than the OS and hypervisor modules, there are plenty of other modules which compose the MICROSAR Safe basic software which have all been certified by the ISO 26262 ASIL-D standard as SEooC \cite{autosar-certified}.
\textit{VOSYSmonitor} \cite{lucas2018vosysmonitor} is an ASIL-C ISO 26262-compliant hypervisor, developed for both ARMv7 and ARMv8 architectures whose Cortex-A processors offer the \textit{Secure Monitor} mode. This feature allows executing a safety-critical RTOS and a general-purpose OS simultaneously; moreover, it allows the use of virtualization extensions like Linux/KVM, thus enabling the instantiation of multiple virtual machines. Furthermore, the hypervisor isolates the RTOS from the other VMs and offers several communication methods in order to provide a secure communication channel between the various subsystems. On multicore architectures, VOSYSmonitor can dynamically share cores between the \textit{secure} side and the \textit{non-secure} one: the idea is that the \textit{secure world} tasks should necessarily have priority compared to the other ones. This means that once a core is assigned to the safety-critical domain, the \textit{non-secure world} applications can run on that core only if there are no critical tasks to run, thus meaning that the resource has been freed by the \textit{secure-world} application. An interruption mechanism is finally deployed in order to guarantee an efficient context switch from one world to another.
Besides commercial products, also in research there is a trend toward the use of static partitioning hypervisors, mainly due to the isolation property that this kind of virtualization can offer to the user.
We choose Jailhouse as our testing platform due to its adaptability to multiple boards and the fact that it is open-source, but there are other successful examples of commercial hypervisors for automotive platforms currently available on the market. Other than Jailhouse, another example is \textit{Bao} hypervisor \cite{martins2020bao}, proposed as a static partitioning hypervisor for Armv8 and RISC-V platforms with a small codebase which differs from Jailhouse due to the fact that it does not depend on Linux to boot and manage the partitions. To the best of our knowledge, this is the first study that investigates fault injection techniques to support the certification of a hypervisor as SEooC in the automotive domain.

\section{Conclusions and future work}
\label{sec5}
In this short paper, we investigated the possibility of treating the open-source, non-certified, Jailhouse partitioning hypervisor as a Safety Element out of Context (SEooC) according to the automotive reference standard, the ISO 26262. More specifically, we opted for a fault injection methodology aimed at verifying the isolation and integrity features provided by the Jailhouse hypervisor. At the best of our knowledge, there are no other researches that tackle a fault injection approach towards verifying the hypervisor robustness and isolation features. In the end, we highlighted some possible criticalities which led to the hypervisor malfunctioning. Future plans aim at expanding the fault injection testing framework, by applying, e.g., a wider and customizable set of fault models in real scenarios. This will enable a framework that significantly helps this kind of hypervisor to become actual building blocks in virtualized mixed-criticality systems.

\bibliographystyle{IEEEtran}