Welcome to dealing with materials data. In this course we learn about the collection analysis and interpretation of data from material science and engineering. We have been looking at dealing with probability distributions using R and we have discussed some discrete distributions and now we are looking at normal distribution. And in this session we are going to learn about error function and how the normal distribution is related to the error function. Just to remind ourselves the normal distribution is given by this expression it is also known as Gauss function. So sigma is the standard deviation and mu is the mean of the normal distribution. So it is an exponential minus x minus mu whole squared by 2 sigma squared and there is a normalization factor in the front which is 1 by sigma root 2 pi. It is possible to carry out a transformation of variable from x to z and that makes the mu 0 and the standard deviation 1. So we take x minus mu by sigma as the z and then we get the standard normal distribution which has the normalization factor 1 by root 2 pi and it is just exponential minus z squared by 2. And we have also learnt that random errors are nice always follows the normal distribution and we saw an example of electrical conductivity in electrolytic tough pitch copper and we saw that repeated measurements if you make because of random errors you get normal distribution. Now we want to learn about error function and the error function is related to the cumulative distribution function of standard normal variable. So capital F of z is related to the error function and by definition error function is 1 by root pi minus x to plus x exponential minus t squared dt but because we are going to and error function is symmetric so we are going to make it 0 to x and multiply it by 2. So error function of x is 2 by root 2 pi and integral 0 to x exponential minus t squared dt. So this is the definition that we are going to use 1 minus error function of x is known as the complementary error function and sometimes it is denoted as fc of x. And for x less than 0 the cumulative distribution of standard normal variable is just half error function x by root 2 and for x greater than or equal to 0 it is half 1 plus error function of x by root 2. So we are going to plot these functions and see how they are related. So in other words if we can take a standard normal variable and get its cumulative distribution function from that we can actually calculate the error function. For example 2 times f of x minus 1 will give you the error function of x by root 2. So that is what we are going to look at and we will also learn how the error function is related to the diffusion problem. To understand the diffusion problem diffusion flux and concentration gradient are related by a constitutive law and it is given as a fixed first law of diffusion. It says that the diffusion flux is proportional to the concentration gradient and the proportionality constant is called diffusivity and the negative sign indicates that the diffusional fluxes are such that concentration gradients will get evened out over a long period of time. Now if you add to fix first law the law of conservation of mass you get the so-called fixed second law. So it is a conservation law so there is no really new law called fixed second law. Fixed first law is a constitutive law, second law is just combination of the constitutive law with the law of conservation of mass and that gives you dou c by dou t that is the rate of change of concentration with time as del dot d del c. So d del c is the term that comes from the first law which is just the concentration gradient and the proportionality constant d and so there is another del operator which is operating on this and at this point it is useful to note that Fourier law of heat conduction which is also a constitutive law and if you add to it law of conservation of energy you get a very similar equation and that is the equation for heat conduction so that it is given in terms of temperature and instead of d you have alpha which is the thermal diffusivity. So dou t by dou t is alpha del square t is a common form for the heat conduction and because of the similarity between the two forms as you can see the solutions for both are very similar in mathematical terms it is just the interpretation that varies. However, in this part of the session we are going to stick to the diffusion equation so we are going to concentrate on this equation dou c by dou t is del dot d del c and if you assume that d is a constant you can pull it out it will become d del square c which is alpha del square c so they are very similar. So if you look at the solution to the fixed second law in what is known as a semi infinite bar for the boundary conditions at x equal to 0 there is a concentration it is called C s to say that it is a surface concentration and at x equal to infinity that is far away from the surface there is a concentration C naught and in this case the solution is shown to be concentration as a function of position and time x and t and they always appear in this combination x by root dt and root dt is actually known as the diffusion distance and so this is nothing but surface concentration minus the difference between surface concentration and far field concentration error function of x by 2 root dt and this solution of fixed second law is relevant for cases such as doping and carburization etc because in these cases you can think of a material which has some given amount of concentration and on the surface we start increasing the concentration so that there is diffusion that takes place into the material so as the time goes by the concentration keeps changing in the material so this is what is described by this equation and all this solutions and the next couple of solutions that I am going to show they are all described in Portland distilling phase transformation in metals and alloys. So the next is also a semi infinite bar solution but in this case the solution is slightly different because instead of surface concentration being a specific concentration it is kept at 0 but the far field concentration is at the same value C0 let us say so this is relevant for things like decarburization because if you have a material that has some amount of concentration of one of the species and at the surface beyond the surface you will see that there is no concentration of the species so there is a concentration gradient so this will start leaving the material and in that case the solution is C0 error function x by 2 root dt you can also think of another solution which is 2 semi infinite bars which are attached to each other so this is for the boundary condition at x equal to 0 you have a combination that is so it should be a plus sign here 0.5 C1 plus C2 and if you go on the one side to the left side say at x equal to minus infinity the far field composition is C1 and x equal to plus infinity on the right side the composition far field composition is C2. So in other words we take two bars one has a far field composition C2 other one has a far field composition C1 and we put them together at time t equal to 0 so obviously at the interface where they are put together the net concentration will be an average of the two and then the solution is given by this expression so it is C1 plus C2 by 2 minus C1 minus C2 by 2 error function x by root dt. So this is relevant for cases where if you take two different compositions of a particular material and weld them together as a function of time how the composition changes for example. You can also think of other cases you can make C1 and C2 to be 0 and you can imagine putting a small amount of material at the centre and allow it to diffuse for example and that solution is relevant for radioactive tracers and even for calculating diffusivity for example. So all these things are described in detail in Polter and Distilling phase transformations in metals and alloys in brief. There are also other classic textbooks for diffusion such as Schumann's diffusion textbook there are also mathematical textbooks which describe the solution of diffusion equation for different boundary conditions. Because diffusion equation is a partial differential equation the solution depends on what boundary conditions you assume so depending on boundary condition the solution will change. So in other words the complete description of the partial differential equation includes the boundary conditions so if you give the equation and give the relevant boundary conditions then you can get solutions and they are different for different boundary conditions. So here are the three cases where error function turns out to be the solution and as we have seen error function is related to the cumulative distribution function of the standard normal variable. So you can now use R to plot the error function solution for these three scenarios and that is what we are going to do in this session. Just to summarize so we have been looking at normal or standard normal distribution we have noticed that distribution of random errors or noise follows this distribution. We have also seen that the cumulative distribution function of standard normal distribution is related to error function which happens to be a solution for the partial differential equations that describe diffusion and heat conduction and so on. So it is relevant from that point of view also and there is another reason why normal distribution is common. In fact the word normal itself says that this is expected to be the most common distribution. Irrespective of distribution from which you sample if there are random fluctuations which are result of many independent random components and they also tend to be distributed normally. There are exceptions, highly skewed distributions and distributions with no finite variance do not follow this but in general you will find that normal is very common and that is why in many many things we use normal distribution or standard normal distribution as a sort of benchmark and we describe everything else with respect to the normal distribution. So we will see a couple of examples of this and in many a times we are actually interested in knowing if a particular data that we have received is normal or not or does it follow normal distribution or not. How to look at those things etc will be things that we will look at in the following sessions. But in this session now let us go back and look at the diffusion solution and try to use R to get the diffusion solution. As usual we will get R, so this is version 3.6.1 action of the source is what it is called and we need to look at the working directory we need to make sure that we are at the right directory and the first thing to do is to actually plot the error function. So let us do this, so we are going to plot error function from between minus 5 and plus 5 and what we are going to plot is, so you can see that P norm z01 is nothing but the cumulative distribution function of the standard normal variable 2 times that minus 1 is actually going to describe the error function that is what we have seen and that is what we are going to use here. So if you do this you see that the function as it goes to minus infinity goes to minus 1, as it goes to plus infinity goes to plus 1 that is because error function of minus x is nothing but minus of error function x, so it is about 0 it is just negative of this, so that is why the function looks like this. So if you go to Portland distilling for example you will see the error function plotted and here is the plot that gives the same thing for us. So the next step is to get the semi-infinite bar solution and for that we have to assume certain coefficients for diffusion and so on and so let me first get the full code. So what we are trying to do in this is to actually reproduce some of the figures that are there in Portland distilling. So let us assume that the surface concentration is 1.4, so let us assume that the surface concentration is 1.4 and for fill composition is 0.1 and diffusivity is 4e power minus 11 meter square per second and we are going to look at some 0.5 millimeter distance to which we are going to starting from surface some 0.5 millimeter is the distance to which we are going to look at diffusion and we are going to consider time of 10 seconds, 50 seconds and 100 seconds. So if you look at for these numbers Portland distilling tells you that is about 1000 seconds is what it will take for the composition to penetrate the entire 2 millimeter distance for example. But we are going to plot the early stages 10, 50 and 100 seconds. So z1 is x by 2 square root dt and this is the parameter that goes into the error function solution that we saw. So the solution itself is given in terms of error function. So this is the parameter for error function. So for that parameter we have to calculate the cumulative distribution function from the standard normal distribution multiplied by 2 subtract 1, so that is the error function actually. So this is the parameter of the error function because the t is changing for every x, so we need to calculate that parameter from that parameter for the given x and t we can find the solution and x is a sequence. So it goes from 0 to 0.5 millimeter and then for time t equal to 10 seconds for example, so we are getting the solution and parameter and from the parameter we are getting the solution and we are going to plot and remember the solution had surface concentration minus the difference between surface and far field concentration multiplied by the error function solution. So this is the first solution for 10 seconds, similar thing for 50 seconds and 100 seconds and so they are the 50 second, 100 second solutions are going to be marked in blue and red. So after we do that I also want to plot certain lines. So this is the 0 that is the surface we are going to plot. I am going to also draw a line at root dt different lines and I am going to show you, so if you look at the figure in Portland distilling it shows that the distance from the surface into the material is actually proportional to square root dt, so this from the surface the distance to which penetration happens is actually. So that is what this line, horizontal line is going to show us. So here is the solution, so this is the surface and this is the 10 second solution. So you can see that this is proportional to root dt because this is the root dt value that we have plotted for 10 seconds and this is for 50, this is for 100 and you can see as the time proceeds the diffusion, the flux increases into the material because there is a concentration gradient this is 1.4, this is 0.1. So the material will keep accumulating in the system so that the concentration gradients are getting evened out. So that is where we are moving towards and that is what is shown and this is a figure that is there in Portland distilling for example. So you can generate the same solution using R, of course we can also generate the other solutions and the second solution is of course we want to keep the surface concentration to be 0 and we want to look at for field composition to be 0.1 and then we want to look at what happens to the solution, so let us do that. So we are doing the same thing, surface concentration is 0, for field composition let us say is 0.6 and same diffusivity and we are again looking at some 0.5 millimeter and we take 10 seconds, 50 seconds and 100 seconds and we are going to use the same formula because when you substitute Cs to be 0 it reduces to C0 times Z11 the error function solution so that is what we saw. So because this is also a semi-infinite bar solution so it should be the same solution and again we have drawn certain vertical and horizontal lines to show what is happening to the solution. So if you plot, so in this case the material has very high concentration 0.6, at the surface the concentration is 0, so obviously there is a concentration gradient between what exists inside the material and at the surface, so the concentration starts changing, the carbon atoms start leaving from the surface, this is known as decarburization and that leads to this kind of profiles and as you can see again here also we see that as time goes on the extent to which decarburization takes place, the concentration for example in the bulk is falling and how much does it fall depends on the square root dt which is the diffusion distance that is why we call it diffusion distance because dimension wise it is a distance and it basically tells you for a given time for a given diffusivity how much will be the depth to which considerable diffusion would have taken place, so that is what is shown by this line to indicate that as time goes by 10, 50, 100 seconds the depth also keeps increasing to which decarburization takes place. Of course the last solution that we want to look at is the two semi-infinite bars put together with the fulfill compositions which are given by C1 and C2, so that is what we have done here, so let us assume again that C1 is 1.4, C2 is 0.1, so we are taking two steels which compositions with composition 1.4 on one side and 0.1 on other side and we are putting them together and diffusivity is the same 4 e power minus 11 meter square per second and we are going to look at, so now the origin is at where we have put this material together, so on the minus you will see the material with composition 1.4 on the positive side you will see composition, material with composition 0.1 and at 0, so it will be an average of these two compositions, so it will be 1.5 divided by 2 which is like 0.75 and again we are going to look at solutions for time 10, 50 and 100 and for solution you just have to evaluate this parameter which is x by 2 square root dt and for that parameter you have to evaluate the error function, error function is given by the cumulative distribution function of the standard normal distribution, 2 times that minus 1 actually is the error function solution and remember error function is an integral and the quantity that is inside the integral gets integrated out, so it is the boundary condition, so the solution is 0 to x by 2 square root dt, so that is what gets substituted and that is why it is a function of this value and that is what is happening here and then we want to plot the solution. So, it is 0.5 c1 plus c2 minus 0.5 c1 minus c2 times error function, so that is the solution and this is for 10 seconds, 50 seconds, 100 seconds as usual we draw some lines to show for example where the interfaces where these two things are put together and what is the fulfill composition on either side c1 and c2 for the left and right respectively, so let us do this. So, this figure is also there in Portland distilling, so you see that we took a material with 1.4 and we took another material with 0.1, so initially this was the composition profile and as time goes by in this the composition keeps decreasing, in this the composition keeps increasing, so the area under this part should be exactly equal to the area under this part by mass conservation because the carbon that is leaving from here is entering here and this depth of penetration of the diffusion curves is proportional to root dt, so as you can see 10, 50, 100 etcetera you will see that it is penetrating more and more in this case it is losing carbon, in this case it is gaining carbon and of course the after an infinite amount of time you expect that everything becomes 0.75, so that will be the composition that the system is trying to reach at the end after a infinitely long time that is the composition that is going to take place. But as you can see as the time proceeds you will see that for example in 10 seconds how much diffusion took place and 50 and 50 to 100 it is less because the concentration gradients are coming down as diffusion progresses which means that it will take longer and longer to achieve the same amount of diffusion, so things also get slowed down compared to the initial stages, so it will take really long time for composition to reach the uniform value everywhere. So we have looked at 3 different solutions for diffusion equation and all these solutions are based on the cumulative standard normal distribution function and it is related to the error function through this formula 2 times cumulative distribution function minus 1 is basically the error function and that happens to be the solution for the diffusion equation and you can get this solution using R because R can calculate this cumulative distribution function. Typically if you look at textbooks like Raghavan or Porter and Distilling you will find that they list out error function solution for different values, so you have to manually calculate and for values in between you have to either do interpolation or find tables that will calculate it for you or write programs that will do it for you but of course with R you can just call this P norm and get the solutions, so to summarize we have looked at normal distribution, it is a continuous distribution and random errors give rise to this distribution irrespective of from which distribution is sampled if there are random errors they also follow this distribution, so it is very very common to see this. It also has relevance to material science and engineering specifically because the solution for the diffusion equation which happens to be one of the important mechanisms by which atomic movement happens in materials especially in solids which leads to lots of phase transformations and microstructural changes which are very very important from an engineering point of view because all of the heat treatment is basically based on phase transformation and how fast or slow these phase transformations take place namely diffusion, so it is very very important to have an idea about the solution for the diffusion and it so happens that this normal distribution function has a relationship to the solution of the diffusion equation for certain boundary conditions and that is what we have explored in this session, we will continue looking at normal distribution a little bit more before we move on to the other probability distributions, thank you.


Did you know colon cancer is the third most common cancer diagnosed in both men and women in the United States? Hi, I'm Sarah Leidy, NDSU Extension family and community wellness agent. Six years ago my dad was diagnosed with colon cancer and shortly after passed away. If he would have been more proactive he may still be here today. Regular screening is one of the most powerful tools for preventing colon cancer. Because I have a family history, I visit with my health care provider about screening options such as having a colonoscopy. Lower your risk with these steps, get plenty of physical activity, re-nutrition labels to help you eat fewer foods high in saturated fats, and try eating foods that are high in fiber such as beans and other legumes, veggies, fruits, and whole grains. Search online for NDSU Extension food and nutrition for more information about health. Brought to you by NDSU Extension and the North Dakota Department of Health.


You wanted it in Dallas, so you want it in Houston. That's one of my things, man.  But you know this, they may have come out of here, but where did they sell the most records at?  If you want to go back and do the history, look who sold the most records in Dallas. Look who sold the most records in Houston. A-Ball and MJG ain't on that level. Yeah, we on Boss Talk 101. Check it, check it, check it. This is your unique host, this is your boy, E-C-E-O, man. Hey, man, I got a couple of guys in here today, man, they don't need no introduction. They frequent the show, man. They really, they might want to be hosts and stay with me. If I can get them over here, how we- Yes, those. Hey, it's going down, man. Every time, man, I got my boy, Lil Deasy and Bobo Luciani in the building. What's going on? Yo, yo, yo, what's good, what's happening, man? I don't really know. Man, man, you know, just want to sit down with a few good minions. Hang out a little bit. Just, you know, talk about that versus you went down to Atlanta, so that's one of the first things I wanted to jump into, man. Yeah, I smelt it. Yeah, you went down there, man. I think, when you cried surfing or something. Man, I could have. I could have, I was so, that's the first time I sat in the crowd in a long time, bro. I didn't know crying. I had to feel it though. Especially, I ain't never been in the crowd on the UGK show, so I had to feel that, man. So being down there, walk us through how they, how did, because it was so short notice. Remember, we talked on the phone when he was down there. It was such a short notice, man, on just getting everything together. Can you speak on that or you can't speak on that? Well, go ahead. Anyway, basically something about how the previous versus had gone. You know, it was, I guess, when successful enough to where it didn't get streamed and they just, you know, it was a bad taste in a lot of people's mouths. So they wanted to, you know, kind of fix that. So I don't want to go into deep, deep, deep into it, but basically that's it in the nutshell. When you think about just the verses that you've seen over the past, cause it looked like it was better during COVID.  It seemed like, cause everybody was in the house, it seemed like it was, when one come on, it was going down, you know what I'm saying? Yeah, yeah. Is that when they first started on? Yeah, that's when, you know, people, due to people not being able to go out and tour and attend concerts and, you know, things of that nature. It was a play to, you know, get everybody to tune in to something while they was in the house. Okay.  You know, the one that, you know, that one that Bizzy born him was on against three six. Yeah. That whole went hard, man. It did. It went hard. I liked that one. I liked the G's in. G's in Gucci was good. That might be the best one for me. My old school, you know, the Bruna Island Versa, that was my favorite one. That was my favorite one, man. That was my favorite one. Boy.  The Islebrow is my favorite one, long time. That ain't what you said when you picked your top three on here, nigga. Yeah, nigga, yeah. No, no, no, no. Groob, whatever. I knew you were gonna say that. I got you on camera. Well, I said, I'm gonna slash it back. Slash it back. You know why I got you. You know why I got you? You didn't even ask me. I didn't. No. Damn. See, he tried to do me like that and see you can't see me up.  But see, I had my top, you know, rap groups and then I had my top, you know, on the O and B, you can't do that. You can't run this show. That's what you ain't gonna do. Miss Jamaica. That's what I did, though. You did that. We did, well, I cut that point. He do look like the movie. I did. No, don't even do that. I cut it out. No, no, no. That was on her. I said no. Yeah.  Like, I mean, first of all, it looked like it, you know, I don't know that. That was no Dallas or Houston crowd. Well, think about this. Well, I asked you a question. Don't try to get up. I'm about to. I'm answering the question. You knew it and them folks in that crowd. Well, let me tell you what happened. Think about this and think about yourself. Put yourself in this situation and you think about concerts at the same time. First of all, people were so stoked and hyped. Everybody was sitting like this. They was filming, right? Everybody was filming. So that's that's that's the first thing. They couldn't clap because everybody was so, you know, they had to get that nerve off of them.   It was a different energy level. So yeah, everybody had to get warmed up into it. You know, I know y'all are biased to Texas and wanted it in Texas. I've been here in your shit, man. You wanted it in Dallas or you want it in Houston. That's one of my things, man.  But you know this, they may have come out of here but where did they sell the most records at?  Okay, if you want to go back and do the history, look who sold the most records in Dallas. Look who sold the most records in Houston. A-ball, NMJG ain't on that level. They still got a chance to take it, man. Same thing with Memphis. I'm pretty sure A-ball, NMJG. So way more records in Memphis and probably Atlanta as well, because they're so close. You know what I'm saying? So it was kind of a neutral ground. I mean, how many times have you seen the Super Bowl play? But one time in the history of the NFL you seen the Super Bowl play home field, right? Yeah. So that's- Campbell Bay. Yeah, you got a neutral ground. Yeah, you know, Tripp says mafia and bombs, she was in LA. Yeah, neutral ground, baby. You don't want the home craft to get in there. Well, Trina was in the home ground. Who Trina? Wait a minute, Trina, who Trina and what was Trina's at? It was in, and Trina's was, Cameron there was in New York. Trina there was in Florida. Who was Cameron? Cameron there was in New York. Both groups from New York. Let's stop. This is what I'm saying. This is what I'm saying to New York. The Swab House was really from Houston. Hey, they won! They come from Memphis. Draper from Memphis, for sure. But he got Houston roots and he built his company in Houston. Okay, who sold the most records? In what state? Of course, UGK sold it. Well, they got more fans down here then. If you're gonna say that. If we buy a more product of you in this state, that means I have more fans than you in this state. Right? Right? That's black and white. But still though. No, you're very good. I understand what you're saying. I understand what you're saying. You just... That energy would have been better if it would have been in Texas and y'all both know that. Well, we... You know that. I mean, it was a small crowd. No, wait. Even if it was a small crowd, it still would have been different. Y'all can play that game. Y'all know already how we ride for UGK and we ride for A-Bow over here. Oh, yeah. Both of them, like you said, started in Houston. That Tony Draper, Mr. Mike, all them different people. That was down there in Houston, man. I really think they just started in Memphis and then they moved to Houston. I don't know about that. You better go to research. I don't know about that. They went to school and everything. I know, but A-Bow and the M-J-G was in... If you knew the story, if you know the story, because I kind of recall it. The album, The Lyrics of a Pimp was done on another label in Memphis, too. That's right. And they really already had their product. And then when they moved to Houston, to live with Draper, they was living on couches, living with Draper. So A-Bow and the M-J-G is from Memphis, Tennessee. Orange man. Of course. They said they wrapped it hard in Houston. Now Swive House is based out of Houston. And also Tila, same way. Memphis, but he came to Houston. Come on now.


Hello, thank you for joining us for this talk about the Prisma 2020 Flow Diagram app and the significant updates that have been made over the past year. My name's Chris Pritchard, I'm the current maintainer of the app and I'm a senior lecturer in paramedic practice and emergency care in the Institute of Health and Allied Professions at Nottingham Trent University. My colleague Neil Hadaway, who is the founder and organiser of EsmerConf, has also been a great help with this presentation and was the previous maintainer of the package. In addition to myself and Neil, Luke McGinnis did a lot of work at the start in turning a lot of the concepts into reality and we've also had some additional contributions this year from Hosam Hamadi who works for Rayan and they wanted to implement a function to enable the app to be called directly from within Rayan so they did so and contributed the code back to our community and also to Brennan Chapman who contributed a feature to enable the app to work with tibbles as well as data frames. So what is the app for? Well, the Prisma reporting standards were updated in 2020 as I'm sure you're all aware but within that updated set of standards there was an updated flow diagram to aid in the reporting and visualisation and reviews and I think they're really important in making it clear where articles were identified and which stage in the process they were excluded or reached inclusion. The reporting standards when they're in their update contain a bit more information than in previous versions of the Prisma statement and that made the flow diagram a bit more complex and even before the 2020 update they could be quite time consuming to create so no one's idea of fun is sitting around trying to move text boxes on a word processor but that was often what was needed was some quite fiddly work. So this app was born. So it provides an R package so you can use it directly from within R but also as a hosted shiny app that requires no coding knowledge whatsoever to enable these flow diagrams to be generated and created and then exported in the function in interactive HTML so you can use click on links to take you to other parts of a review but also in PNG SVG and PDF formats for example. In order to actually populate the flow diagram you can enter values directly within the web app or pass them to the functions themselves. You can use a provided template CSV or and this is new for this year. You can call the app directly with some URL parameters to complete the auto fill some of the boxes. So over the past year we've made some significant updates. So there was a big code cleanup last summer and the automatic calculation of node positions is now part of the app so instead of relying on manually calculated and entered values for where each box goes they're calculated relative to each other. This was really needed because otherwise we couldn't move on to the next thing which is conformity to the Prisma extension so for additional reporting standards for the literature search part of your review by being able to include specific databases or registers as you can see from the image in the top left and also then this addition of URL parameters which enable the app to be embedded more easily within other tools. As I said Rayan built this into the premium version of their product and then contributed the code back to the community. So within the code cleanup this was done because the code was a bit difficult to read so lots of functions were perhaps all on one line which made them a bit harder to deal with but also had hard coded figures for example for box heights and box positions variable names that weren't always clear and also lacking comments in places so the code was very functional it did what we wanted it to do but didn't really allow for extensibility and building on that to build in new features. So as such a code review took place so I used Visual Studio code and a package called lintar to really support with that so was able to sort of analyse the source code files and work out what was needed to make them more readable and more consistent. But also within that code review was able to replace hard coded numbers and values with ratios and variables so boxes are positioned relative to each other instead so that's the Prisma getPOS function that enables us to do that and we're also able to programmatically alter the height of a box depending on the number of lines of text in them which again is really useful because it makes it easier to add new nodes to the package. So if for example a new updated set of guidelines was released that required reporting of additional information that would now be easier to add into this package than it was before. That moves us on to talking about the Prisma S conformity so the Prisma S extension is specifically for reporting the literature search part of your review and I'd encourage everyone who's writing up a systematic review to absolutely follow those but they require the number of records retrieved from each individual database or register. So as you can see we now have a way of doing that both through the R package and the template CSV but also from the website so you can see here we've got each database separated by semicolons and that creates a nice straightforward easy to use package. So that's great and finally we can now pre-populate fields in the Shiny app via URL parameters and I'll talk more about that in the tutorial that I'm going to produce in terms of how that actually works but the real valuable and exciting thing about this is it means it can be integrated much more easily within other tools and packages and any numeric field within the CSV file can be passed as a pre-populated field and I would like to work on passing the non-numeric field so for example those specific databases and registers I'd like to work on passing them as values in the near future but for now it supports any numeric field within the CSV file and finally I'd like to talk a little bit about you know what the reach of this package is and the impact so within the hosted version on the Shiny apps.io we use some analytics they're just aggregated statistics rather than any personally identifiable information but we can see that this has been accessed globally and in the last 90 days for example over 18,000 unique visitors to the site so it's a big tool it's being used by lots of people and in part that's because it's recommended on the Prisma statement website it's part of the editorial guidelines for journal submission in some journals including BMJ evidence-based practice but I think the big thing is because it's useful and I just want to say thank you to all of our users because if it wasn't used this much then we wouldn't put the work into making it better so I just want to say yeah again a big thank you for that so thank you for listening to this talk as I said my name is Chris Pritchard I'm more than happy to take questions of our master's on or Twitter and thank you once again for watching


So one of the new areas of cryptography involves the finding of rational points on elliptic curves. And this emerges as follows. Suppose I have some curve defined implicitly, f of x, y equals zero, and it's some curve, and I have these points x, y in R2, and what I would call the rational points are going to be the points on the curve whose coordinates are both rational numbers. And there's a couple of ways we can approach this. Sometimes, once we have one rational point on the curve, we can use it to find others. And for example, if P is a rational point on a circle, then any non-tangent line with a rational slope that passes through P will intersect the circle at another point Q, which will also turn out to be a rational point. This is actually something that's fairly easy to prove, and I suggest you try and work your way through a proof because it's a fairly nice proof that involves a little bit of algebra and a little bit of the theory of equations. For elliptic curves, for historical reasons, curves of the form y squared equals xQ plus ax plus b are known as elliptic curves. They actually have almost nothing to do with ellipses, but suppose I have a rational point on an elliptic curve. And for right now, we'll assume that we're not dealing with the x-intercept because that'll cause a little bit of a complication. So I have some rational point on the elliptic curve, and so what I'm going to do is I'm going to draw the tangent line through that point. And this tangent line has to intersect the curve at some other point, and it turns out that this other point of intersection will also be a rational point. Again, there's a fairly short proof of this that, again, involves a little bit of calculus, a little bit of algebra, and a little bit of the theory of equations, and it's a nice little proof that you should be able to work your way through. Now because of the symmetry of the elliptic curve, y squared equals xQ plus ax plus b, this y squared means that the curve is going to be symmetric about the x-axis. So if I have my point Q as a rational point, its reflection, Q prime, is also going to be a rational point. So now given this first rational point, I now have another, and I have another. Now I have two distinct rational points on the curve, and what I can do is I can draw the line through that point, and this will intersect at another point, r, which turns out to be rational, and again its reflection is also going to be a rational point, r prime. So now I have a bunch of distinct rational points, and I can do the same thing once again. And the proof that the line PQ prime will intersect at another rational point, fairly easy proof relying on the properties of algebraic equations. And what this means is that given one rational point on the elliptic curve, I can find many. So now I have this point P, I have this point r prime, the line between these two will intersect at another point, and again the reflection and the point itself will also be rational. Now what you should notice here is that what we're doing is we're taking, in some sense, we're taking two points, P and Q prime, and we're adding, for want of a better term, these two points, and we're constructing a third point, r prime, or r, depending on how you want to view that. And so what we have is we have the beginnings of an arithmetic of the rational points on an elliptic curve. And that arithmetic will emerge as follows. So let's say I take two points on an elliptic curve, I'm going to define the sum of those two points in the following way. So to begin with, if P is not equal to Q, for example, here's another elliptic curve, and I have P and Q distinct points, then what I'm going to do is I'm going to draw the line from P to Q, and it's guaranteed to intersect the curve at some point r, which will be a rational point. Again, simple proof verifies this. And I'm going to take the reflection of r across the x-axis to r prime. So I'm going to find that point of intersection. I'm going to reflect it. And this reflection is going to be what I'll define as the sum of the two points P plus Q. Now if P is the same as Q and P is not on the x-axis, so here I have P and Q being both at the same point, then what I'm going to do is I'm going to define the tangent line, and I'm going to extend it until it meets the curve at r. And again, what I'm going to do at that point is I'll reflect it across the x-axis to r prime, and I'll define P plus P to be r prime. Finally, the peculiar case we have if P is on the x-axis, if P is actually one of these points on the x-axis, the tangent line is going to be vertical. I'll draw the vertical tangent. And I'm going to define a new point, E, which is the point, so to speak, at infinity and its way up there someplace. And that's going to be what I'll define as the sum of P with itself in the case where P is the point on the x-axis. Now what's worth noting here is that I can do these things purely geometrically. These have meaning whether or not P, Q, and R are rational points. This is actually an arithmetic that holds for any point on an elliptic curve, whether they're rational or not. Now our interest is rational points on the elliptic curve, and for that we have to use a little bit of algebra. And so we'll take a look at that in the next video.


You need a financial advisor with the freedom to focus on your specific needs. Whatever your goals, Reid Potter can create a game plan tailored to you. Call Reid at 432-0777 at Pikeville, Kentucky to learn more. Governor Andy Beshear joined Kentucky Transportation Cabinet District 12 in opening the new Mini DeHero Highway on Route 680. The people who live right along this route are going to be able to get to school, to work, and to church that much faster, and it's going to be a jobs magnet. Having a type of road like this today is a good day for infrastructure. It's a good day for Floyd County and the entire region. The connector, which was 30 years in the making, provides a direct and time-saving link between Kentucky Highway 80 at Mini and US Highway 23 in Herald. The link will cut nearly eight miles off of the drive from Pikeville to Hazard. What you see are people excited about the future, who see a better life, a commonwealth, and a better world in front of us that are pushing out the pessimism and realizing we have so much potential right now. It's really exciting to celebrate with everyone. Along with the highways ribbon-cutting, the governor also gave out more than $4.1 million in funding and grants to various Eastern Kentucky organizations. For Mountain Top News, I'm Kelsey Dean.


What makes a busker a street musician successful? How much do street musicians earn on average? That's what my co-author Klee Mirisch, a former business student of the University of Cologne, and I investigate. Every year in the morning of December 24, my brother, Jonathan, and I stand on the main shopping street in Karlsruhe, Germany, and perform street music. We always donate the money we collect to a charitable cause, such as a children's home in Asinzion in Paracord. Believe it or not, in three hours we make about 150 euros. That's far more than I will probably ever earn as a professor. I conducted an intensive empirical study. We observed how more than 80,000 consumers donated to street musicians in Cologne, Germany. In fact, we investigated 72 street musicians over three months. The results of our project are really exciting and also surprising because they contradict what musicians perceive to be important. This study is published in the journal Marketing Letters. A street musician in Cologne earns on average, and that's what our study shows, about 23 euros per hour. But if a musician plays classic music instead of rock, jazz, or country music, she or he can increase income to 27 euros per hour. The quality of the music is also essential. We recorded each musician on video and had three professional musicians evaluate the quality of the music and the execution of the instruments. If the quality is above average, the street musician earns 28 euros per hour instead of 23 euros. By the way, groups with children who perform music on the street in Cologne get the most. On average, 45 euros an hour. So these were all musician-specific factors, factors that musicians can influence themselves. Consumer-specific factors also play a critical role. For example, we find that passers-by, accompanied by a colleague, friend, or partner, are more likely to donate. This could potentially be explained by the principle of social recognition. Research has shown that consumers also donate because they expect that they will be perceived more favorably by those around them and gain a social advantage. Most interesting are our findings on environmental factors that influence the success of a street musician. Contrary to the expectations of musicians, consumers are more likely to donate when it's cold outside. So relatively more people donate when the outside temperature drops. Most likely consumers feel greater sympathy with the basket when it's cold outside. In addition, on an emotional level, a street musician may warm us up when it's cold outside. But not only the outside temperature is informed, but also the days of the week. What do you think? On which day of the week does a street musician earn the most on average? The right answer is on Sundays. On Sundays, a street musician earns on average 35 euros. This may be related to the so-called Sunday effect. Emotions such as empathy, compassion, and guilt may play a bigger role on Sundays because of the salience of religious norms. This Sunday effect on donations has been supported by prior empirical literature, albeit in different contexts. This video gives us some first insights into the results of our study. Please check out the full paper for more details.


Next talk will start now and will be Unpatchable Living with a Vulnerable Implanted Device by Dr. Marie Moe and Erin Leverett. Give them a warm round of applause please. So I'm here today to talk to you about a subject that is really close to my heart. I have a medical implant, a pacemaker that is generating every single beat of my heart. But how can I trust my own heart when it's being controlled by a machine running on proprietary code and there's no transparency? So I'm a patient but I'm also a security researcher. I'm a hacker because I like to figure out how things work. That's why I started a project on breaking my own heart together with Erin and a couple of friends because I really want to know what protocols are running in this machine inside my body? Is the crypto correctly implemented? Does it even have crypto? So I'm here to inspire you here today. I want more people to hack to save lives because we are all becoming more and more dependent on machines. Maybe some of you in the audience also have medical implants. Maybe you know someone that's also depending on medical implants. Imagine that this is your heartbeat and it's being controlled by a device. A device that might fail due to software bugs, due to hardware failures. Wouldn't you also like to know if it has security vulnerabilities? If it can be trusted? Something to think about, right? Marie is an incredibly brave woman and when she asked me to give this talk it made me nervous, right? It's such a personal story, such a journey as well and she's going to talk to you about a lot of things, right? Not just hacking medical devices from a safety point of view but also some of the privacy concerns, some of the transparency concerns, some of the consent concerns. So there's a lot to get through in the next hour, but I think you're going to enjoy it quite a lot. So let me tell you the story about my heart. So four years ago I got my medical implants. It was kind of an emergency situation because my heart was starting to beat really slow, so I needed to have the pacemaker. I had no choice. After I got the implant, since I was a security researcher, of course I started to look up information about how it worked and I googled for information. I found the technical manual of my pacemaker and I started to read it and I was quite surprised when I learned that my pacemaker has two wireless interfaces. There's one interface that is really close field communication, near field communication that is being used when I'm at checkups at the hospital where the pacemaker technician or doctor uses a programming device and places it really close to my pacemaker and it's possible to use that communication to adjust the settings. But it also has another wireless interface that I was not aware of that I was not informed of as a patient. It has a possibility for remote monitoring or telemetry where you can have an access point in your house that will communicate with the pacemaker on a couple of meters distance and it can collect logs from the pacemaker and send them to a server at the vendor and there's a web interface where the doctor can log in and retrieve my information. And I have no access to the data that is being collected by my device. So imagine for a moment that you were buying a new phone or buying a new laptop. You would do your homework, right? You would understand what interfaces were there, but in Marie's case she's just given advice and then later she gets to go and read the manual, right? So she's the epitome of an informed consumer in this space and we want a lot more informed consumers in this space, which is why we're giving this talk. Now I don't know about you, but I'm used to hacking industrial systems. I haven't done as much medical research in the past. So when I first started this project, I knew literally nothing about Marie's heart or even my own and she had to teach me how the heart works and how her pacemaker works. So would you mind explaining some details to the audience that'll be relevant through the rest of the presentation? Yeah actually I think we're going to show you a video of how the heart works. So it's a little bit of biology introduction here before we start with the technical details. So just play the video. A normal heartbeat rate and rhythm is called normal sinus rhythm. The heart's pumping action is driven by electrical stimulation within the heart muscle. The heart's electrical system allows it to beat in an organized, synchronized pattern. Every normal heartbeat has four steps. Step one, as blood flows into the heart, an electrical impulse from an upper area of the right atrium, also known as the sinus node, causes the atria to contract. When the atria contract, they squeeze the blood into the ventricles. Step three, there is a very short pause, only about a fraction of a second. And step four, the ventricles contract, pumping the blood to the body. A heart normally beats between 60 to 100 times per minute. Electrical signals in your heart can become blocked or irregular, causing a disruption in your heart's normal rhythm. When the heart's rhythm is too fast, too slow, or out of order, an arrhythmia, also called a rhythm disorder, occurs. When your heart beats out of rhythm, it may not deliver enough blood to your body. Rhythm disorders can be caused by a number of factors, including disease, heredity, medications, or other factors. So for those of you who are already aware of that, apologies, but I needed to learn that. I needed to learn the basics before we even got started, right? So this is a diagram of the electrical system of the heart. So as you see, it's a sinus node that is generating the pulse. And in my case, I had a problem with the signal being generated by the sinus node, not reaching the lower heart chamber. It's something called the AV block, or heart block. So occasionally, this will cause an arrhythmia that makes the heart pause. If you don't have a heartbeat for like eight, 10 seconds, you lose your consciousness. And that was what happened to me. I just suddenly found myself lying on the floor, and I didn't remember how I got there. And it turned out that it was my heart that had taken a break. So that's how I discovered that I had this issue. So this is where the signal is blocked on the way down to the lower heart chamber. But there is a backup function in the heart that can make a so-called backup pulse. And I had that backup pulse when I went to the emergency room. So I had a pulse around 30, 40 beats per minute. And that's generated by some cells in the lower heart chamber. So after I got the pacemaker, my heart started to become a little bit more lazy. So it's not certain that I will have this backup pulse anymore if the pacemaker stops working. So currently, my heart is 100% running on the pacemaker. So let's also look at how the pacemaker works. I have another video of that. So this is my little friend that is running my heart. A pacemaker is a miniaturized computer that is used to treat a slow heartbeat. It is about the size of a couple of stacked silver dollars and weighs approximately 17 to 25 grams. It is usually surgically placed or implanted just under the skin in the chest area. The device sends a tiny electrical pulse down a thin coated wire called a lead into your heart. This stimulates the heart to beat. These impulses are very tiny and most people do not feel them. While the device helps your heart maintain its rhythm, it also stores information about your heart that can be retrieved by your doctor to program the device. Remember that. Yeah, you did see the ones and zeros at the end of the video. That's what we want to know more about because this information that is being collected by the pacemaker, how it works, how the code looks like, it's all closed source, it's proprietary information and that's why we need more security researchers. We need more third-party testing to be sure that we can trust this code. And you can imagine that we're doing some of this research as well, but I'm not going to break Marie's heart on stage. I'm not going to drop Ode on some medical devices. So if you came for that, it's not worth staying. The rest of the presentation will be about some of the things we've found and how this works and how you might approach this research and some of the people who did this research before because there's plenty of others and we'd like to give a shout out to those who've done great research in advance. But essentially this point is very relevant, that the internet of medical things is already here and Marie is wired into it. She's a bit younger than your average pacemaker patient but she was thrust into this situation where she had to think about things in a very different way. Like you did a master's break in crypto and also a PhD in information security. Did you imagine the things you learned about SSHing and network security might one day apply to your heart and your own body? No, I never figured out that my research would eventually end up inside my own body. That's something I never talked about. And also there's a lot of people that don't think about how the medical devices actually work. So when I ask this question to health care professionals, they look at me like I'm crazy. They have never talked about this before that there actually is code inside my body and someone has programmed it. Someone has written this code and did they think about that this would actually control someone's life and be my own personal critical infrastructure? Yeah, personal infrastructure, right? On a physical level.  But Marie used to head up the Norwegian computer emergency response team for a couple years and knows a lot of hackers and knows what she's talking about, right? So when she asks her doctor these questions, they're very legitimate questions and the doctors probably don't know anything about code but they need to move towards a place where they can answer those questions with some honesty and certainty and treat them with the dignity that they deserve. Shall we show them a little bit more about the total ecosystem of devices that we're talking about at least in this particular talk? Okay, so this was all new to me. I mean I've moved around in networks and done some penetration testing and some stuff in the past but I didn't know much about implantable medical devices. So we've got a couple of them there, the ICD, which is the in-cardio defibrillator, that's some of the work that you saw from Barnaby Jack, which we'll mention later was on those particular devices. We've got the pacemakers and of course other devices could be in this diagram as well, like we could be talking about insulin pumps or other things in the future. The device itself speaks to box number two, which we'll tell you a little bit more about in a moment using a protocol commonly referred to as MIX. A number of different devices use this medical implant communication service and Marie shocked me yesterday when she found a couple of devices that potentially use Bluetooth. So would you like to tell them a little bit more about the access point and I'll join in? Yeah, so the access point is the device that you can typically have on your bedstand that will, depending on your configuration, contact your pacemaker at regular intervals, for instance once during the night. It will start communication with the pacemaker, a couple of meters distance and we start collecting logs and these logs will then be sent. It can be via SMS or other means to a server. So there's a lot of my personal information that it can end up different places in this diagram. So of course it's in my own device. It will be then communicated via this access point and also then via the seller network and then it will also be stored in the telemetry server. Potentially when I go for the checkups my personal information will also end up in my doctor's workstation or in the electronic patient records and there's a lot of things that can go wrong here. Yeah, you can see it's using famously secure methods of communication that have never been backdoored or compromised by anyone ever before, even here at this conference, probably even this time around. So these are some things that are concerning. The data also travels often to other countries and so there are questions about jurisdiction in terms of privacy laws in terms of some of this data and some of you can go and look deeper into that as well. The telemetry store thing I think is important. Some of this is a telemetry store such as the server at the vendor. So the vendor owns some machine somewhere that collects data from Marie's heart.  And she hasn't told him, right? Like he just can look at the data and see that her heart rate was up for a couple hours. That's true though, right? You did actually run a half marathon. Yeah, I did run the half marathon. So the telemetry store is one part but there's also the doctor's workstation which contains a lot of this medical data. So from a privacy perspective that's part of the attack surface. But there's also the programmers, right? There's the device programmers. So that's an interesting point that I hope a lot of you are interested in already that there is a programmer for these devices. Yeah, so we actually went shopping on eBay and we found some of these devices. You can buy them on eBay? Yeah. So I found a programmer that can program my device on eBay and I bought it. And also I found a couple of these access points. So that's what we're starting to look at. We just wanted to give you an overview of this system and it's fairly similar across the different device vendors and we're not going to talk about individual vendors. But if you were going to go and do this kind of research, you can see that some of the research you've already done in the past applies to different parts of this process, right? And talking about patient privacy. When we got the programmer from eBay, it actually contained patient information. So that's the really bad thing. So I found this very odd. I had this similar reaction to yourselves because I usually do industrial system stuff. One of my friends picked up some PLCs recently and they had data from the nuclear plant that the PLCs had been used in. So decommissioning is a problem in industrial systems, but it turns out also in medical devices, right? I guess that's a useful point to make as well about the cost of doing this kind of research. It is possible to get some devices, some implants from people who have sadly passed on, but that comes with a very high cost of biomedical decontamination. So that raises the cost of doing this research on the implants themselves, not necessarily on the rest of the devices. Yeah. So I also want to say that in this research, I have not tinkered with my own device. So that would not be a good thing. You're not going to let me SSH into your heart and just delete some stuff, no? No. I wouldn't do it anyway, but it's an interesting point, right? So there are a lot of safety precautions that we and the rest of the team have to take when we're doing this research. And one of them is not pairing Maria's pacemaker with any of the devices that are under test. Do you want to say a bit more about connectivity and vulnerability? Yeah. So I was worried when I discovered that I had this possible connectivity to the medical internet of things. In my case, this is switched off in the configurations, but it's there. It's possible to turn it on. It's possible for me to be hooked up to this internet of medical things. And for some patients, this is really benefit. So you always have to make a risk-based decision on whether or not to make use of this connectivity. But I think it's really important that you make an informed decision about that and that the patient is informed and has given his or her consent to have this feature. The battery lifetime of my pacemaker is around 10 years. So in six years time, I will have to have a replacement surgery and I'm going to be a really difficult patient. So I really want to know how the devices work by then and I want to make an informed decision on whether or not to have this connectivity. But of course, for a lot of patients, the benefit of having this always the risk because people that have other heart problems than me, they have to go for more frequent checkups. I only have to go once a year. So for patients that need to go frequently for checkups, it's really good for them to have the possibility of having telemetry and having connectivity to have remote patient monitoring. Yeah, I imagine you have mobility problems or you even just live far from a major city and making the journey to the hospital is quite arduous. Then this kind of remote telemetry allows your doctor to keep track of what's going on. And that's very important. We don't want to like have a big scary testosterone field talk where we like hack some pacemakers. We want to talk about how there's a dual use thing going on here and that there is a lot of value in having these devices. But we also want them to be safe and secure and preserve our privacy and a lot of other things. So these are some of the issues. Of course, the last one, the remote assassination scenario, that's everyone's favorite one to fantasize about or talk about or make movies about. But we think there's a lot of other issues in here that are more interesting, some quality issues even, that we'll talk about in a little bit. Battery exhaustion, again, something many people don't think about. But I'm very interested in cyber-physical exploitation. And so some of those elements were interesting to me that you might use the device in a way that wasn't expected, right? So personally, I'm not afraid of being remotely assassinated. I've actually never known you to be afraid of anything. I'm more worried about software bugs in my device, of things that can malfunction. Is that just theoretical? No, actually software bugs have killed people. So think about that. People that are not here, they don't have their voice and they can't really give their story. But there are stories about persons, depending on medical devices, dying because their device malfunctioned. There's even some great research from academics about how the user interface design of medical devices can have an impact on patient safety and how designing UX much more clearly and concisely, specifically for the medical profession, might improve the care of patients. Do you want to say more about this slide or should we go on to the previous work? Yeah, I think it's really important also to the issue of trusting the vendors. So as a patient, I'm expected to just trust that my device is working correctly. Every security vulnerability has been corrected by the vendor and it's safe. But I want to have more third-party testing. I want to have more security research on medical implants. And as a lot of things like history has shown, we can't always trust that the vendors do the right thing. I think this is a good opportunity for us to ask a very fun question, which is, any fans of DMCA in the room? No? No fans? All right, well then you'll really enjoy this. Marie has some very exciting news about DMCA exceptions. Yeah, so October this year, there was a ruling of an DMCA exemption for security research on medical devices, also for automotive security research. So this means that as researchers you can actually do reverse engineering of medical implants without infringing copyright laws. It will take effect I think October next year, but it's really a big step forward in my opinion and I hope that this will encourage more research. And also I want to mention that there are fellow activist patients like myself that was behind this proposal of having these exemptions. So Jay Redcliffe, who hacked his own insulin pump, Karen Sandler, who is a free and open software advocate, and Hugo Campos, who has an ICD implant, he wants to have access to his own data for quantified self-reasons. So these patients, they actually made this happen, that you're allowed to do security research on medical devices and I think that's really great. Do you want to say something about Scott Irvin's presentation that you saw at DEF CON? Yeah, that was a really interesting presentation about how medical devices have really poor security and they have like hard-coded credentials and you can find them using Shodan on the internet. These were not pacemakers but other types of different medical devices, but there are like hospital networks that are completely open and you can access the medical equipment using default passwords that you can find in their manuals. And the vendors claim that no, these are not hard-coded, these are default, but then the manuals say, do not change this password. Because they won't integrate with other stuff, right? I've heard that excuse from Skada so I wasn't having it. They also put up some medical device honeypots to see if they would get any targeted hacking attempts, but they only picked up like regular malware on them, which is also of course of a concern. Anything else prior Kevin? Yeah, I guess you should mention that the academic research on hacking pacemakers, which was started by a group led by Kevin Fu, and they had this first paper in 2008 that they also follow up with more academic research and they show that it's possible to hack a pacemaker. They show that this was possible on like a couple of centimeters distance only. So like the attack scenario would be if you have a device similar to the programmer device and you attack me with it, you can turn off my pacemaker. That's not really scary, but then we have the research by Barnby Jack where this range of the attack is extended to several meters. So you can have someone with an antenna in a room scanning for pacemakers and starting to program them. We have a saying at Cambridge about that. Some of the other people in the university have been doing attacks a lot longer than I have and one of the things they say is attacks only get worse, they never get better. So the range might be short one year and then a couple of years later it's worse. So the worst case scenario I think would be remotely via the internet being able to hack pacemakers, but there's no research so far indicating that that's possible. And we don't want to hype that up, we don't want to get that kind of an angle on this talk. We want to make the point that hacking can save lives, that hackers are a global citizens resource to save lives. So this is the result of hacking of the drug infusion pumps earlier this year. The FDA actually issued the first ever recall of a medical device based on cybersecurity concerns. I think that's amazing. They've recalled products because of cybersecurity concerns. They used to have to wait until someone died. In fact, you had to show something like 500 deaths before you could recall a product. So now the FDA at least in the US can recall products just based on security considerations. So this is also I guess the first example of that type of proactive security research where you can make a proof of concept without killing any patients and then that causes the security holes and that potentially saves lives and no one has been hurt in the research. I think that's great. I'm also really excited because we give a lot of presentations about security that are filled with doom and gloom and depression. So it's nice to have two major victories in medical device research in the last few years, one being the DMCA exceptions and the other being actual product recalls. Yeah and the FDA are starting to take these issues seriously and they are really focusing on cybersecurity of medical implants now. I'm going to go to a workshop arranged by the FDA in January and participate on a panel discussing cybersecurity of medical implants. And it's great to have this type of interaction between the security community, medical device vendors and the regulators. So things are happening. Yeah how do you feel as an audience? Are you glad that she is going to be your representative in Washington for some of these issues? And we want you to get involved as well right? This is not just about Marie and myself and the other people who worked on this project. It's meant to say you too can do this research and you should be. You have to be a little sensitive and a little bit precise and articulate about some of the concerns. We take some inspiration from the former research around hygiene. Imagine the first time some scientists went to some other scientists and said there's this invisible stuff and it's on your hands and if you don't wash your hands people get infections and everyone thought they were crazy. Well it's kind of the same with us talking about industrial systems or talking about medical devices or talking about hacking in general. People just didn't sort of believe it was possible at first and so we have to articulate ourselves very very carefully. So we draw inspiration from that early hygiene movement where they had a couple simple rules that started to save people's lives while they explained germ theory to the masses. Yeah so this type of research is kind of low hanging fruits where you just so what we show here is an example where there's a lot of medical device networks and hospitals that are open to the internet and that can get infected by normal type of malware like backing trojans or whatever and this is potentially a safety issue. So if your MR scanner or some other more life critical device is being unavailable because of virus on it that's a real concern for patient security and safety. So we need to think more about the hygiene also in terms of computer viruses not only just normal viruses. So you know sometimes people will treat you like this is an entirely theoretical concern but I think this is one of the best illustrations that we've found of how that should be a concern and I think all of you will get it but I'm going to give you a moment to kind of read what's about to come up on the slides right. So I'll just let you enjoy that for a moment. So if it's not clear or it's not your first language or something this guy basically sharded patient data across a bunch of Amazon clusters and then it was unavailable and they were very concerned about the unavailability of their customer patient data sharded across Amazon instances. He was complaining to support like can I get support to fix this. So all the data of the monitoring data of the cardiac patients is unavailable to them because of the service being down and well do you want to outsource your patient safety to the cloud really. I don't want that. I want to yeah I want to get into some other details we have sort of 10 minutes left if we can so we can have a lot of questions and I'm sure there will be some. But I want you to talk to them about this very personal story. This is remember before when we said is this stuff theoretical. I want you to pay a lot of attention to the story. It really moved me when she first told me so. Yeah so I know how it feels to have my body controlled by a device that is not working correctly. So I think it was around two or three weeks after I had the surgery. I felt fine but I hadn't really done an exercise yet. The surgery was pretty easy. I only had two weeks sick leave and then I came back to work and I went to London to participate in a course in ethical hacking and I did take the London underground together with some of my colleagues and we went off at this station at Covent Garden. I don't know if anyone of you have been there but that particular station is really low underground. They have elevators that you can use to get up but usually there are like long queues with elevators. You always have to do things the hard way. You have to take the stairs or they were just heading for the stairs and I was following them and we were starting to climb the stairs and I didn't read this warning sign which says those with luggage for shares and hard conditions please use the lift because I was feeling fine and this was the first time that I figured out it's something wrong with my pacemaker or with my heart because I came like halfway up these stairs and I felt like I was going to die. It was a really horrible feeling. I didn't have any more breath left. I felt like I wasn't able to complete the stairs. I didn't know what was happening to me but somehow I managed to drag myself up the stairs and my heart was really didn't feel right. So first thing when I came back from this course I went to my doctor and we started to try to debug me, try to find out what was wrong with my pacemaker and this is how that looks like. So there's a stack of different programmers. This is not me by the way but it's very similar situation. We'll come back to those programmers in a moment but the bit I want you to focus on is like they're debugging your pacemaker. Yeah I didn't know what was inside you. I didn't know what was happening at the time. We were just trying to get the settings right and it took like two or three months before we figured out what was wrong and what happened was that my upper rate limit was set too low for me for my age. So the normal pacemaker patient is maybe around 80 years old and the default upper rate limit was 160 beats per minute and that's pretty low for a young person.  You're fantastic at it and then a couple years go past and you know you gain some weight and you're not as good at it right but now imagine that happens in three seconds while you're walking up a set of stairs. Yeah so what happens is that the pacemaker detects oh you have a really high pulse and there's a safety mechanism that will cut your pulse in half so it would go from like so in my case it went from 160 beats per minute to 80 beats per minute in a second or less than a second and that felt really really horrible and it took a long time to figure out what was wrong. It wasn't until they put me on an exercise bike and had me on monitoring that they figure out what was wrong because the thing was that what was displayed on the on the pacemaker technicians view was not the same settings as my pacemaker actually had. There was a software bug in the programmer that caused this problem. So they thought they had updated her settings to be that of a young person. They're like oh we've already changed it but they'd lost the view they couldn't see the actual state of the pacemaker and the only way to figure that out was to put her on a bike and let her cycle until her heart rate was high enough you know literally physically debugging her to figure out what was wrong. Now stop and think about whether or not you would trust your doctor to debug software. So say a little bit more about those programmers and then we'll move on towards the future. Yeah so so we got all of one of these programmers as mentioned and looked inside it and well we named this talk unpatchable because originally my hypothesis was that if you find a bug in pacemaker it will be hard to patch it. Maybe it would require surgery but then when we looked inside the programmer and we saw that it contained firmware for pacemakers we realized that it's possible to actually patch to pacemaker via this programmer. One of the other researchers finds these firmware blobs inside the programmer code and like my heart stopped at that point right I was just going really you can just you can just update the code on someone's pacemaker. We also want to say something about standardization look at all those different programmers. Someone goes into the hospital with one of these devices they have many different programmers and they have to make an estimation of which you know which programmer for which device like which one are you running and so some standardization would be an option perhaps in this case. Yeah all right so we're going to need to move quickly through the next few slides to talk to you about the future but I hope that drives home that this is a very real issue for real people. So pacemakers are evolving and they're getting smaller and this is the type of pacemaker that you can actually implant inside the heart. So the pacemaker I have today is outside the heart and then I have the leads that are leads that are wired to my heart but in the future they're getting smaller and more sophisticated and I think this is exciting. I think that a lot of you also in the audience will benefit from having this type of technology when you grow older and we can have longer lives and we can lead more healthier lives. And keep in mind right you know some of you may already have devices and already have these issues but others of you will think ah that won't happen to me for quite a long time but it can be a sudden thing that you know you don't necessarily have a choice to run code inside your body. You know which OS do you want to implant? Do you want to tell them about the cardiac sock? This is also quite exciting maybe future type of implants that you can have. So this is actually a cardiac sock. It's really printed and it's making a rabbit's heart beat outside the body of the rabbit. So there's a lot of technology and sensors and things that are going to be implanted in the bodies and I think more of you will become cyborgs like me in the future. And there's a lot of work that you could be doing you know 3D printing these devices and open sourcing as much of this as possible. There's a lot to say here right I think it's time to address the really scary issue the consent the informed consent issue around patching right. Remember earlier we were talking about the programmers and we pointed out that there were firmware blobs in there and that these people you know your doctor or a nurse could upgrade the code running on your medical implant. Now is there a legal requirement for them to inform you before they alter the code that's running inside your body? As far as we can tell and we need to look at a lot of different countries at the same time so we're going to ask you to help us. As far as we can tell there are not laws requiring your doctor to tell you that they are upgrading the firmware in your device. Think about that. So quite scary thing. I want to know what's happening to my implant the codes if someone wants to alter the code inside my body I would like to know and I would like to make an informed decision on that and give my consent before it happens. You might even choose a device where that's possible or not possible because you're making a risk-based decision and you're an informed consumer but how do we help people who don't want to understand software and firmware and upgrades make those decisions in the future as well right. All right. So now if we're going to go through all of this but there are a lot of reasons why we are in the situation of having insecure medical devices. There's a lot of legacy technology because there's a long lifetime of these devices and it takes a long time to get them on the market and they can be patched but in some cases they are not patched or there are no software updates applied to them. We don't have any security third-party security testing of the devices and that's really needed. Right an underwriter's laboratory or consumer laboratory that's there to check some of these details and I don't think that's unreasonable right that sort of approach. And there's a lack of regulations also so there's also things that should be worked on. So there's a lot of ways to solve this and we're not going to give you the answer because we're not geniuses so we're going to say that these are some different approaches that we see all playing into a solution space. So vendor awareness is obviously important but that's not the only thing and a lot of the vendors have been very supportive and very open to discussion but there's a lot of transparency that needs to happen more in the future right. Security risk monitoring I've been working in the field of cyber insurance which I'm sure sounds like insanity to the rest of you and it is there are bad days but that could play a part in this risk equation in the future. What about medical incident response right or medical device forensics? Yeah if I suddenly drop dead I really would like to have a forensic analysis of my pacemaker. Please remember that all of you like if anything is going to happen to Maria everyone to ask that right like aren't you afraid of giving this talk and we thought about it we talked about it a lot and she's got a lot of support from her husband and her son and her family and a bunch of us. If anything happens to this woman I hope that we will all be doing forensic analysis of everything. So we'll say a little bit about I am the cavalry and social contract and then we'll wrap it up okay. So I am the cavalry does a lot of grassroots research and support and lobbying and tries to articulate these messages they have a medical implant arm that has a bunch of different researchers doing this kind of stuff. Do you want to say more about them? Yeah so we're both part of the cavalry because no one is coming to save us from the future of being more dependent on and trusting our lives on machines so that's why we need to do step up and do the research and encourage and inspire the research so that's why I joined I'm the cavalry and I think it's a good thing to have a collaboration effort between researchers between the vendors and the regulators as they are or we are working with. We also think that even if you don't do reverse engineering or you're not interested in the security details or the op codes that are inside the firmwares or whatever this question is a question any of you here can talk about for the rest of the congress and going forward into the future right.  Yeah so I really want to know what code is running inside my body and I want to know or I want to have a social contract with my medical doctors and my physician that is giving me this implant. It needs to be based on patient doctor trust relationship and also between me and the vendors so I really want to know that I can trust this machine inside of me. And we think many of you will be facing similar questions to these in the future. I have questions some of my questions are serious some of my questions are not serious like this one. Is the code on your dress from your pacemaker? No actually it's from the computer game doom but once I have the code of my pacemaker I'm going to make a customer address and get it which is pretty cool right with my own code so let's wrap up with what we want to have a future research so we encourage more research and these are some things that could be looked into like open source medical devices that doesn't really exist today at least not for pacemakers but I think that's one way of going forward. I think it's also an opportunity for us to mention a really scary idea which is you know should anyone have a golden key to Marie's heart? Should there be backdoor encryption inside of her heart? We think no. I understand the reason why the NSA should be able to have a backdoor to my heart. You would be an extremist that's why you don't want them to have a backdoor to your heart but this is a serious question right if you start backdooring any kind of crypto anywhere how do you know where it's going to end up it might end up in medical devices and we think that's unacceptable and we should also mention that we're not doing this alone we have we have other researchers helping us forward doing this. So thank you very much for this thrilling talk we're now doing a little Q&A for 10 minutes and for the Q&A please keep in mind to respect Marie's privacy so don't ask for details about this the implant or something like that. Yeah the brands and stuff. We're going to tell you what OS she's running. People who are now leaving the room they are not will not be able to come to come back in because of measures. So let's start with the Q&A let's start with this microphone there. Hi first of all thank you very much for a very fascinating talk I'm not going to ask you about specific vendors however I thought it was very interesting what you said that most vendors were really supportive I would like to know whether there have been exceptions to that rule not who it was or anything like that but what kind of arguments you may have heard from vendors for example have they referred to anything such as trade secrets or copyright or any other legal reasons why not to give you or not to give public access to information about devices thank you. So we haven't had any legal issues so far in this research and in general they haven't been concerned about copyright I think they're more concerned about press bad press and and the hype you know what they would see as hype they don't want to see us scaring people away from these things with you know these stories right. Yeah that's also something I'm concerned of of course as a patient I don't want to scare my fellow patients from having life critical implants in their body because a lot of people need them like me to survive so the benefits clearly outweighs the risks in my case. But that seems to be their main concern like you know don't give us too much bad press. Okay next question from over there. Hello I wanted to ask you if you know about any existing initiatives on open sourcing the medical devices on on mandating the open sourcing of the software and firmware through the legal system be it in European Union in United States because I think I've read about certain initiatives about a year ago or so but it was just a glimpse. So there are some patients that have reverse engineered their development pumps I know that there are groups of patients that like the parents of children with insulin pumps they have created software to be able to have an app on their mobile phone to be able to to monitor their their child's blood sugar levels so that's one way of doing this open source and I think that's great. But nothing in the legal systems now no initiatives to mandate this for example on European level. Not so far that we've seen but that's something that can be discussed now I think it's really interesting to look into the legal aspects and the regulations around this. Thank you. Okay can we have a question from the internet? Yes from the IRC someone asks does your peacemaker have a bio feedback so in case something bad happens it starts to defibrillate? No I don't have an ICD so in my case I'm not getting a shock in case my heart stops because I have a different condition I only need to to have my rhythm corrected but there are other types of conditions that require pacemakers that can deliver shocks. Okay one question from that microphone there. Thank you very much at one point you mentioned that the connectivity in your pacemaker is off for now and is that something that patients are asked during the process or is that something patients have to require and generally what role do you see for the choice not to have any connectivity or any security for that matter that technology would make available to you so how do you see the possibility to choose a more risky life in terms of trading in for privacy whatever. Yeah I think that's really a relevant question as we mentioned in the social contract I really would like that the doctors inform patients about their different wireless interfaces and that there's a form decision whether or not to switch it on so in my case I don't have it switched on and I don't need it so there's no reason why I need to have it switched on but then again why did I get the implant that has this capability I should have had the option of opting out of it but I didn't get that they didn't ask me or they didn't inform me about that before I got the implants it was chosen for me and at that time I hadn't looked into the security of medical devices and I needed to have the implants so I couldn't really make an informed decision and a lot of patients that are like older and not so that don't really understand the technology they can't make that informed decision like I can so it's really a complex issue and something that we need to discuss more. Okay another question from there. Yeah thanks as a hacker connected personally and professionally to the medical world how can I educate doctors nurses medical people about the security risks presented by connected medical devices what can I tell them do you have something from your own experience I could somehow yeah so the issue with with software bugs in the devices I think is a real scenario that can happen yeah if you can repeat that story of debugging her like I think that makes the point and then try and adopt that hygiene metaphor that we had before where you know people didn't believe in germs and these problems before we're in that sort of era and we're still figuring out what the scope of potential security and privacy problems are for medical devices in the meantime please be open to new research on this subject right and that story is a fantastic illustration that we don't need evil hacker type or you know bond villain we just need failure to debug programming station properly right thank you very much okay another question from the internet yes from the IRC 20 years ago it was a common it was common that a magnet had to be placed on the patient's chest to activate the peacemaker's remote configuration interface is that no longer the case today it's still the case with some devices but not with all of them I think yeah it varies between devices how they are programmed and how long distance you can be from the the device thank you for your talk I have some many cool devices in myself too for insulin pump and sensors to measure the blood sugar levels um I'm busy with hacking that and do better software for myself because the pump have doesn't have the software have you ever think about it to write your own uh software for your peacemaker no I haven't thought about that until now fantastic I think that deserves a round of applause those because that's exactly what we're talking about another question from there well uh first off I want to say thank you that you gave this talk because once it's quite interesting but it's not that talk anyone of that is affected could hold so uh yeah it takes quite some courage and I want to say thank you so secondly thank you for giving me the update I studied medical technology but I finished 10 years ago and didn't work in the area and it's quite interesting to see what happened in the meantime but now for my actual question you said you got devices on ebay is it possible to get the whole communication chain so you can make a sandbox test of a yeah it's possible to get the device it's not so easy to get the the pacemaker itself it's quite expensive and even when we get one we have some pairing issues and like Marie can't be in the same room when we're doing certain types of testing and right so that last uh piece is difficult but the rest of the chain is pretty available for research okay thank you okay sadly time is running out so only we have only time left for one question and from there please thank you uh I'm also involved in software quality checks and then software qsc in Germany also with with medical developments and as far as I know it's the most restricted yeah area of developing products I think in the world it's it's just easier to manipulate software in a car exhaust system or breaking guard or something like this where you don't have to show any testing certificates or something like this the FDA is very high regulation part there do you have the feeling that it's a general issue that patients do not have access to these FDA compliant tests and and software qa systems yeah I think that the we should have more openness and more transparency uh about around this issues really it's I mean it's fantastic you do quality assurance I used to be in quality assurance um at a large corporation and I got tired and went and started doing pen testing and then I just thought of myself as paramilitary quality assurance right like now I just do it on whatever I want to test right so thank you for doing qa and keep doing it um and hopefully you don't have too many regulations but companies sharing more of this information is really the transparency and the discussion the open dialogue with a patient and a doctor and a vendor is really uh what we want to focus on and and make our final note we see some progress already the last year so the I am the cavalry group has had some great progress on having good discussions with the FDA and also involving the medical device vendors in the discussions about cyber security of medical devices and implants so that's great and I hope that this will be even better next year and I think you wanted to say one more thing to congress before we leave which is hack to save lives thank you very much