Felly, mae'r gwneud yn fwy hwyl, so mae'n chweilio i'n cael ei swyddfa amser ac yn ymerddur gan y ddweud. Mae'r ddwy ffa tewch yn ymwybod i'n chweilio i'r cyfasydd ymddangos cyfysgddiaeth, mae'r ddweud i'r ddweud i'r ddweud i'r llwylliant, a'r ddweud i'r cystafllwyr yn ymdweud o'ch cyfysgffredig. I'm going to try and explain why that is, and also some work that Code Think is doing to try to fix it, particularly for Linux-based software, but also more generally for open source. So the work that we're doing is not just about taking one Linux operating system and trying to certify that, it's about how we would do that systematically. So here it goes. So I'm going to talk a bit about safety, what people think of as safety. Then I'm going to talk about certification, which is somewhat different from that. And then I'm going to talk about our method, which we're calling RAFIA, because it's nice and catchy, and hopefully people will remember it. Then some of the things we've learned, and then where we're going from here. So people talk about safety critical systems or safety relevant systems. That's broadly systems that could cause harm if they did something wrong, or are expressly trying to prevent harm happening. These days loads of those systems require software. I don't know if you've realised, but pretty much all of the safety critical systems in your car these days have been driven by software since pretty much the 80s, right? So drive by why it was happening from the 80s onwards. These days, every time you press the brake pedal, there's software telling the braking, whether it's a disc or whatever it is, to actually do the braking. So we've been relying on software to achieve safety for a very long time. But these days we're trying to make safety demands of much more complex systems. So it's one thing to do a microcontroller serving a braking system. It's quite another to munch all of this software, including a whole load of AI machine learning models into a big multi-core processor, and then hope that that's safe. So we're on a journey, aren't we? As I said, most of these systems, most of these solutions that claim to be safe are proprietary, and there are good reasons so far why open source has not been properly considered, I would say. So when we get to an organisation trying to make safety claims, they can say, oh we think we're safe, but then someone's going to look from outside and say, how do you think you're safe? Why do you think you're safe? And that will boil down to have you complied with standards, and there are a whole plethora of standards. The kind of parent standard of them all is this ISO 6158. I'm sure that most of you here haven't read it because it costs 2,000 euros or something to buy a copy for your personal use. So I'll be very surprised. ISO 26262 is cheaper, I think it's only about a grand, but you can see already why this little interest in open source people, why on earth would we pay? To access that stuff, which was written by guys some decades ago now. But I'm not saying the standards are completely useless, they're not. They have lots of interesting ideas in them and lots of well-learned lessons from big systems and complex systems in multiple industries. But in practice, to read the standards, digest them and figure out how you're going to adapt all of your stuff to satisfy them, it's a big undertaking. It tends to be done by commercial organisations and you end up with VxWorks, QNX integrity. So Green Hills and QNX are still very active, Wunder River is still very active. And they kind of have a domination of the safety critical operating systems market broadly. And you ask why isn't Linux or Zephyr even at the moment being used in safety and the real answer ultimately, when people say it changes too fast or it's too big or whatever, but what they'll really boil down to if you push them hard is well, it's not certified, we can't use that. Now ISO 26262 is a standard that particularly rates to automotive and for those who don't know, code think is relatively active in automotive, about half our work is with automotive OEMs or the people that make cars and sell them with the T1s who supply systems to those companies. So this standard determines whether something is safe for use in an automotive system. And it not only specifies things about software, it specifies things about how you would manage software, how you would engineer it, so it's a whole load of stuff about processes. And again, open source, I categorically assert that most of the open source projects in the world have little to no interest in complying with the kind of processes that were invented by those guys contributing to an ISO standard some decades ago. Really, a lot of the processes that they specified were waterfall, they predated Git, they predated CICD, right? So it's just a shitload of paperwork, which frankly no one these days has much interest in. But still, as I say, there are some valuable things to glean from those standards. It's just it's very hard to make open source aligned with them. Think about certification. Certification is not safety. Certification is someone independent, someone qualified, someone who understands the standard, comes in, looks at your process, the way you're working, your software, and gives you an assessment that says, oh yes, we agree with your assertion that this is safe. But frankly, we could get a certificate for a know-up for some software that did nothing, provided the process was right and the management was right and the coding standard was followed. In practice in automotive, and Arm did a research project into this, and I'm going to quote Chris Temple from Arm who last year said that they looked at an actual automotive project and found that there were 100 different certified safety components. Each of those components makes its own assumptions of use, which is pretty much saying, oh, and you've got to do this stuff safely because we're not doing that. So imagine bringing 100 of these things together and someone has got to wrestle with all of those assumptions and try to make a safe thing out of the result. It tends not to be as easy as it seems from just putting together 100 things that are certified safe. I'm not going to name names today. Normally I do name names and I swear more than I'm going to swear today but I can see that the camera is on so I'm going to try to avoid it. I could, if we were so inclined, certify a microkernel, couldn't we? And then we could say that it does these things absolutely safely guaranteed, but then we could exclude all of the drivers, couldn't we? And then we could have a viable business which could actually dominate an industry. That is the state of play today, kind of ridiculous, but that is the position. Now, ISO 262 demands that you have requirements, architecture, traceability between the requirements, code and code analysis. So right at the end, as we've been on our journey, we discover that ideally ISO 262 would like a description for every single file that contains C code showing what it does and how it's intended to work. Imagine the gargantuan task that would face us trying to retrofit all of that stuff to Linux, just the kernel, never mind the whole operating system. So it's a lot of hard work. Now, in practice, there is at least one example where an organisation has done that. There's a company called Wittenstein, I think. They took FreeRTOS, which I'm not sure how many lines of code it is, but it's not very many. And they went through a process of, in effect, reverse-engineering or retrofitting all of this documentation, and they achieved something which they call SafeRTOS. There was a vulnerability in FreeRTOS' network stack. I did ask Wittenstein in public whether SafeRTOS had already established and fixed that vulnerability, but no one replied, so I don't know. Maybe they did, maybe they didn't. So, where people have tried to certify Linux, they've mostly failed. The few successors have taken a very specific version of Linux and hardened it, chopped a whole load of stuff out or turned stuff off, and then they specifically say you can only use this subset of the functionality. So, it's kind of a crippled but guaranteed version of Linux Lite. Where people tried to do the whole thing, the scale of the task has overwhelmed multiple teams. There's some work, I think Red Hat and others are in the process of working on this PAS, which is an addendum, in effect, or a revision to try to bring new practices, but that's a long way away from becoming accepted. So, at the moment we're stuck with in Automotive ISO 2662 is how we would mark our homework. And, as I said, it was written so long before and it really does not take into account, even the 2018 version still does not take into account things like Git and CI CD, I'm afraid. So, from our point of view as software engineers, we can categorically say that we would take our modern techniques over your old paperwork any day of the week, but I've given up trying to argue with people about standards in public because they don't like me. So, just to get this point across, I've shown these diagrams before, I'm going to do it again. So, when originally the thinking that led to safety standards and safety certification was happening, this was the kind of picture, so we would have some certified tools making some certified software. More than 20 years ago we ended up with this kind of situation where there's a shitload, sorry I've sworn, a shitload of software which is not certified in the environment and also another humongous load of software which is not certified in the target. And now we're into that plus all of this virtualisation, hypervisor nonsense and machine learning. So, good luck on claiming that your whole thing is safe, right? So, from Coddick's point of view, that whole certification stuff is kind of a sideshow. We are software engineers, we're helping customers to deliver real product and we know that it's important so we're trying to do the right thing from a software engineering point of view. Apparently this idea of the Romans or the ancient bridge builders being required to sleep under their bridges is apocryphal. So, it didn't really happen but it's a good concept. So, we internally in Coddick do talk about, we're not aiming for certification, certification is a byproduct, we want to actually believe from a software engineering point of view that we have a safe solution. And that actually has allowed us to, first of all, avoid the traps that the standard might lead people into but also it's given us a strength of purpose and a belief which allows us to push back when the standard is demanding stuff that we think clearly it's not necessary. And to be fair, the standards do allow for, if you've got a better way of doing something then document it and explain why and that can be considered. So, that's in effect the path that we're on. Okay, so, Raphia, as I said, hopefully a catchy name, people will remember it. It's specifically an approach for dealing with huge software, software that's connected and therefore because it's connected it's going to be subject to potentially security implications and we might need to update it in the field quite frequently. It's specifically taking into account that a lot of the stuff that we're going to use is open source as well as custom software and it takes into account that the kind of projects we see, the software is never finished so it's going to be developed on an ongoing basis and that means we would need to make the safety argument on an ongoing basis. We need no point in certifying something once and then, you know, three months later everything gets updated and our safety argument is defeated. That would be a shame since it's still going into a car. And the other thing we have to handle is multiple suppliers so open source plus vendors of this, that and the other. We know for sure that traditional safety engineering approaches don't get to this scale. We were asked about this by Bosch in 2016 and we have literally been walking slowly on this journey ever since trying to understand how we would help Bosch and others to make safety promises around this scale of software. As of this talk, I think it's the first time I can actually say that and I'll show you why, we believe we'll get an ISO 262 cert for a Linux based operating system. So just to give you a broad understanding of what RAFIA is, it's more things than just risk analysis, fault injection and automation which is how I originally coined the term but the others as you can see we can't pronounce. So it's a combination of risk analysis and we achieve that via STPA. I'm not going to bore you with STPA at this point that there are lots of presentations online about STPA. It's a methodology established by MIT. There are some problems with it for software. It's not really designed for software specifically so we had to do a lot of work around how to make STPA work for us in our specifics scenario. We combine that with testing to verify that the risks we identify don't occur. We then use fault injection to prove that our tests work and that we can cause the risks that we've identified to happen and then we can use the results of that to see what the implications are, what mitigations might need to be taken against the potential that the software misbehaves because ultimately we're not aiming for bug-free software. That ship sailed decades ago. By the way, on the code coverage stuff. Tall nonsense, I'm afraid. You can have 100% coverage and clearly still not be testing anything. Just because you put a test in to say this code path happens does not mean it does the right thing when it happens. We see many projects crippled by hitting that coverage metric so people end up writing as much test code as the target code but no one's testing the test code, so who knows. In order to satisfy the standard, whatever approach you take, you've got to generate evidence to support your assertions so that becomes then a big part of the work. We establish a reason why we think we can be safe and then we need to demonstrate that we're complying with our assertions of how we work. Great thing is we've got CICD so we can automate most of that. STPR said I won't bore you so I won't... I'll just leave this. The slides will be published afterwards obviously and as I said there's plenty of resources around for STPA and at the point that we get to where we're going this year we expect to make hours detailed explanations of how we use STPA and how RAFIA works open source and public as well. Broadly it's a structured approach where you start by defining what you care about and then you work through a modelling exercise to get to what are the key outputs of this which are unsafe control actions, things that if they happen then harm insurers or hazards are triggered and then that leads to analysis which we can use to form the basis of automated testing. That's a crucial thing. In practice automated testing means we need to be able to verify the behaviour of software at all expected states during startup, during shutdown, under stress as well as normal operation. This leads to a load of automated stress testing in effect and also we need to break those tests on a regular basis to prove that the tests are really doing what we say they do. I have to tell this story. Back in 2011 or 2012 it was we were working on an automotive project and every day there was a test results email got sent around to test results, test results, test results. After about six weeks one of our guys opened up the email was interested to see and it was just a spreadsheet. Clicks on the spreadsheet and there's only one cell filled in and the cell says Valgrind not found. We need to know that the tests actually do what we think they're doing and that the results are what we think they are. We use fault injections as a way of checking our homework effectively and I've talked previously about how trivial it is to do fault injection. Any software you give me, if you give me the source code and say it definitely does this, I am absolutely sure that I or one of my brighter colleagues can break it just by changing one line of code. We can definitely make it not fulfil the promises. So we can use that principle to check our tests and also to generate broken versions of the software to explore whether our mitigations later in the process work. And we think that's innovative and our certifying authority has confirmed as far as they are aware no one has taken that systematic approach to software scale in this safety context before. So that's I think the key trick that we're using to maybe break the log jam. I've talked about that so I'll skip. How am I doing for time? So compliance, now historically compliance means you get someone reviewing your work and they will ask for your requirements specifications, your design architecture, your test results, all of this stuff and then there'll be an ongoing engagement to review and assess. And that's frankly where we are still at today. Working with Exeter, who we're very comfortable with now, we spent some years with them on figuring out the wrinkles of this process. We did achieve an ACLD tool certification for our tooling and some of the core integration approach in 2021. And one of the good things about that proof point was that we managed to do that without even bothering about whether the software was open source or not. In effect it's GitLab and a combination of techniques that we learned from and have applied since the reproducible builds project. The fact that it's open source is just not relevant. We managed to demonstrate that the result is what matters and we could use the results to verify. We could also use the results of that discipline to confirm whether anything in our tooling changing was going to actually affect our output. So reproducibility gives us a clear checkpoint to say if we want to change anything, do we still get the same results as we used to? So that's been a great trick. So the compliance process now, we're working towards continuous compliance and I know other organisations have made claims about that. That's going to reach wide changes on both sides of this equation. Exeter is, we would assert, approximately at the state of the art of safety and cyber security certification. They are still heavily manual and relying on interviews and reviewing manual documents. They're not yet at the point where they offer an API which we push all this stuff into. But I would suggest within a few years that's where everyone would want to be. We'd want to be having a standard way of presenting evidence and getting assessment mostly automated so that the experts can focus on understanding whether the argument really holds up and doing spot checks to work out whether the things are lying or not. I've made it sound simple, haven't I? That's quite simple. So that's a reasonable picture of the kind of approach we're taking. As you can see, there's a whole load of stuff that ends up in Git. I'm not going to go through all of the steps. All I would say is that it's normal CICD but plus risk analysis for safety and then some extra steps around fault injection and automated testing for mitigations, as I've said. Everyone get a picture of that? Good. Then we recognise that iteration is bound to happen. We can't get anything right first time and I still come across, certainly on mailing lists, people saying, oh yes, we deliver software right first time. Fantastic. I just never met you so I'm not sure what you're saying is true. I've been doing software since the early 80s and I've never worked on a project where it was done right first time. I'm surrounded by people who are great at coding but most of the things we've done, we've ended up doing multiple times and learning from what we did. So iteration is inbuilt. We have to expect that. We go through this process repeatedly.  It's fantastic having a five to nine person process for your five to nine person team but when you took it to Nokia with 5,000 people and then screwed them up by making their Scrum, what is it, product owners, Scrum masters, be in 11 stand-up meetings every day because they're managing a Scrum of Scrums of Scrums of Scrums.  Can I have an X-File given the rent? No I'm not. I've always been a supplier but I know lots of people from Nokia so I made a huge software services sale to Nokia in 1999. I'm an old guy. So yes I know where the bodies are buried there and in lots of other companies I'm afraid. Anyway so iteration, I digress don't I? Iteration is unavoidable and we need to reapply this process on an ongoing basis. We are working at two week sprints and that seems to be giving us good results. I think one week would not give us enough time to learn the lessons from each time. We're still wrestling with how we get to sufficiency and I won't be able to talk about that today. We have some other parallel strands to try to get us to a quantitative review of what our actual risks are because it may not be obvious from all of this but what this really boils down to is risk management. No amount of certification or safety process or anything else guarantees that there won't be a problem and if you think about automotive all automotive OEMs have to contend with their cars are involved in accidents every year and some of the people involved in those accidents claim that the car is at fault as opposed to the driver and they almost certainly have a case so there will be these lawsuits people harmed by cars and the question is how to manage the risk of that overall. We're not guaranteeing that the software is never going to be at fault the question is how often is it going to be at fault how much is it going to cost per incident so this is all about risk management in the end and sufficiency really boils down to figuring out how to minimise the risk to a level that it's acceptable or it's defensible and defensible and acceptable will vary from jurisdiction to jurisdiction it's a function of what the law is stating in a given country. Okay so just briefly this is some stuff from our current ongoing project we're calling it Zesan by the time we kind of start engaging with customers Zesan is not the name that we'll be using but it's our code name and that's a lake in Kazakhstan I had to ask so at the top right you can see the controls structure diagram from STPA we use that as the basis for the modelling and then the modelling leads us to some structured YAML and it defines in effect all of the safety requirements and we work down from there so everything that we're doing ends up in YAML and then we can parse that and use it to trigger automated tests and generate all of the compliance documentation and everything else same thing for the test analysis and fault injection so we use the YAML to keep track of all of the tests and also to do the traceability so we can parse this and generate the matrix that people would require to see whether we've actually complied with what we said we were going to do we do a combination of pre-merge testing and post-merge testing and this again is practice that we've had to learn and evolve in reality with our customers has everyone here heard of trunk-based development? hold up your hands if you have very few, excellent the reason I'm saying it's excellent is because that's a very widespread paradigm for cloud-based and IT type systems the idea is that you have to land your changes every day into mainline so you don't have long branches unfortunately we've seen a couple of customers that have tried to bring that to embedded in car software and because testing for some of this stuff takes way longer than a day if you keep landing in mainline then you have something which is never working because it's always broken you get the results two days down and say no no sorry your change didn't work so trunk-based development is no good for this so you have to combine some pre-merge stuff which is not going to be complete with some post-merge stuff and just keep on landing stuff every day in mainline is not a safe way of working oh no I won't talk about this so the actual use case we're using and actually I should have mentioned this earlier one of the other things that we're doing is a way of constraining the work we do we're not trying to constrain the versions of Linux or the number of APIs that we can use but we are saying we need to know what the use case is we're not going to aim for generic safety you can do whatever you like with Linux and it'll all be fine we're saying give us a real case where you need Linux to do something so we chose this rear-facing camera application so in fact anyone that drives a car knows these days instead of just having a mirror which clearly doesn't have any software so it's unlikely to break due to a bug we're going to have a camera and then we're going to have it on the screen in front of us and we're going to use the video feed as a surrogate for the camera so that application is safety relevant and we've done the risk-alances for that and we've ended up with an architecture and tests and fault injections and mitigations around that specific topic and this thing at the bottom one of the things is we need to be sure that the camera feed gets to the display and that the lag between the camera feed and the display is small enough so if you get a frozen screen or a frozen frame that's exactly the problem that could lead to someone being hit because if you're showing an empty drive and then a kid runs across the back of the car then you had your one job and you screwed it up so we found some open-source software which generates a real-time clock as a bitmap and we're using that this gives us also a verification of what's getting under this display as readable because we can actually confirm that the clock signal is still interpretable as a clock signal and we're using that as part of our soak testing and our overall test framework to verify that what we send in through the camera input is arriving at the display output at the right time without excessive lag then we're combining that with gathering of the information gathering the data over an extended period of time and I don't think you can see the guts of these pictures but it's broadly plotting latency and plotting failures over time and then looking for trends and working out what is triggering the exceptions so we've already gone through again with iterations we established that a lot of our early problems were not down to the target system it was down to our test environment things that we thought were working and looked like they were working most of the time but you run it over some days and you start realizing you get these occasional spikes and when we drill in nothing to do with the target it's all about the system testing environment so we fix those over time and those graphs get better where we from the tests identify situations where the actual software is not behaving as required for the safety case then we either have bugs or limitations which need to be managed either by fixing the software which we expect will be quite rare because we've chosen well established open source or it may require changes to components we might find we're using the wrong approach I think some people still have a religious ongoing war about system D versus everything else you know I can tell you we've not found any reason to say that system D is not fit for this purpose we're sticking with system D in some cases it may not be possible to fix the defects we may need other mitigations certainly one piece of software on one system and the system crashes then you will need a mitigation that's outside that system so everyone needs to understand that ok, here's some lessons let me just check on time ok, so first of all STPA when I first heard about this I thought wow this is great this is going to literally save us because I was kind of at the point we'd done some discussion with lots of people in public around how you would make this kind of promise and I was starting to think this is too big there is no way of dealing with safety and then STPA brought to my attention and it's a top down approach which means I don't have to look at all of the lines of code and it gives me a way of reasoning about the risk from the top level and the claim was it's going to be a lot less work than traditional approaches fantastic, I'm all for that we started we did a public investigation with MIT in a project called AV STPA you can find that on GitLab and it kind of worked we did the first level STPA and we identified some real hazards but we kind of ran out of steam because the guys argued well we've done this one level but that's not enough, we're going to need to do level 2 and level 2 will be that much work and then there were some people saying it we might even have to do level 3 which would be to the end of Prague so so we stopped because we weren't sure how far we needed to go but we did actually manage to cause the work the project that this was aligned to to stop so we did actually potentially save some people from harm because there was a plan to take some vehicles put this Apollo autonomous vehicle software into vehicles and run them around Vegas at CES and we and MIT categorically demonstrated in two different ways that that was a stupid thing to do so it didn't happen we then did another project the first attempt of what is now the Zesan initiative and the STPA particularly bogged us down the question was how do we know what our scope is how do we know that we're applying STPA how do we know that our analysis is correct how much analysis is enough and how do we know we're even analysing the right things software engineers as I'm sure most of you know either directly or through working with them we tend to worry about making sure we know what we're doing cause corner cases can kill us trying to interpret this very wordy description of STPA and be sure that we've got it right hard for the frontiers third attempt frankly it came down to distilling the STPA and saying procedurally we're going to do this we're going to do this we're going to do this and this and this and only that so rather than boiling the ocean it was let's just do STPA once one level and see what results we get and I noticed that the team got halfway through that and then said we're going to have to do level 2 I said have you finished level 1 yet no then finish level 1 so eventually the team stuck with it over multiple iterations and we get to a full level 1 analysis which is a huge value cause now we have a thorough assessment of the risks and some lost scenarios which we can generate tests for so our current thinking is we don't need to keep doing level 2 level 3 because we can use different methods against that from the bottom up and that seems to be working so we already get a lot of value from the automated tests and the fault injection to probe whether our analysis is holding up we can map all of the results that we find back and see whether is anything exposing something we missed in our analysis and so far the results are good and the final lesson I would suggest for this morning is that tying up all of the paperwork is still a huge amount of work saying CICD is going to solve it magically mostly it does but you've got to do all of the work of plugging all of these mappings together once we've done that the first time it will clearly be a lot less for subsequent certifications so we do think we gain the benefit of the ongoing process speed up and here's where we are now I'm just checking for time have I got 5 minutes is that right yes so we work with Exeter for those who don't know Exeter is we would assert a very well established certifying authority they provide consultancy on safety as well they're all around the world we work with them in the US and in Germany particularly and they've been doing that for 20 or 25 years so they're very well established particularly in the industry that we care about we've been working on this specific iteration for 18 months I would say it's a team of around about 10 people in total which is large for code think but when we discuss that and say how far we've got with our customers their jaws drop at times we've been building on the tools that we certified a couple of years ago and we're confident that we're on a path now to achieving this and this year we've started literally just in last weeks we've received commitment to go ahead with a proof of concept with one of our first customers so things are so far looking good and I checked with Exeter that they were happy for me to share this they did our first safety assessment in April this year this is what they said to our customer so they've done the preliminary functional safety assessment they've done written they've had written responses to their questions and they've analysed them they think that the system level analysis is very solid and they were keen to point out that in general they find the people aren't doing that because the way the standards work people are driven to certify this component and once you've got enough ticks in those boxes then you guys just make it work now because it's safe which is flawed so the fact that we're calling it out and showing a way to deal with it is where I think there's some real innovation and some chance for better sanity and more progress and they said fault injection needs some clarification the reason for that is just that the standard places very strict guidance on what a fault injection is and we're using fault injection for way more than that so we're using fault injection to probe as many different things as we can so in effect they're just saying that using those words we need to call it out and explain what we mean by that and the key thing is they believe and they believe when they did the assessment that we are on a route to certification and they're hoping that we can achieve that in time for their symposium in October this year so we're very excited about that and I will finish by saying I don't have a slide for this that our intention is that all of RAFIA will be open source with we could have done all of this in the open from the start but why would we first of all we'll just get a lot of people saying oh that's crap and second there's a reason why most people don't publish their STPA analyses I asked MIT we were talking about autonomous vehicles I said they said they've done this about five or six times I said oh great can you share your STPA because I expect they'll all be the same because we're on the same planet same laws in the different countries same weather, same vehicles so you would end up with the same result oh yes but no one will allow us to publish why not, well because it exposes risk it exposes them to liability so we were breaking ground to do the AV STPA analysis in public because we did it open source from the get go but we're a tiny company I really don't need world and dog in large operating systems companies hurling crapparders at the moment so by the time we open we'll be able to defend by saying we've used this to certify two things now and we want the open source community organisations to take an interest sorry to take an interest in this categorically I don't see how an open source project on its own would normally want to do certification because it's just exposing a whole lot of risk that nobody would need it's got to be done by companies that have a commercial interest in managing the risk so we're certainly wanting to encourage companies to take up this process and get to safer solutions with open source but I'm not expecting a flurry of oh, you know Yocto is certified because I'm pretty sure can correct me if I'm wrong Linux foundation won't want to be on the hook for making those promises it's got to be the organisations making product that carry the can for making those promises so that was it, thank you Paul, I have a question as you're using mainly the STPA and you have been in discussion with Exida does the STP or is the STPA sufficient because typically the questions come on have you done a forgery analysis have you done an FMEA and that's what I typically hear in automotive so these are the masses, STPA is new can it replace a traditional FMEA forgery analysis Well, our position is that yes it clearly can because we don't need to do those alternatives that doesn't mean that there might be no value in running those methods as well so one of the things we've established is having someone else look at the problem from a different perspective may always give us some new value so we're not saying don't do forgery analysis or BOTI or whatever it is but we don't believe we need it to make the promises that we're making Okay, thanks Any more questions? One here Are you familiar with you talk about how do you stop testing how do you know when you stop testing the only thing I know from what objective is something that I've run into with telephone companies I know AT&T and Nokia have used these where they have they assume a constant testing rate and then from that they predict basically a defect backlog curve which rises as they do testing and then tapers off as things are actually fixed which is it has its limitations certainly doesn't work well for small organisations just because the statistics aren't there Are there other objective ways that can, the only other thing I've seen companies use is they just say we will have no more than one serious bug and three not so serious bugs is there anything else that we can use? I mentioned that we've got a couple of other paths because this is just risk management to a certain extent is what I've been describing today we have a research project underway trying to identify appropriate metrics for open source projects in general and particularly the open source projects that we are hoping to make safety claims about so that will look at large scale statistics and the great thing about open source there is the data is available so we can with scripts gather bug rates and if we can establish the kind of trends you've mentioned then that will be great obviously there's false positives there or false negatives because there's loads of bugs that are not relevant to the hardware we've chosen or the specific version the other path that we're on we've engaged with an organisation that specialises in quantitative risk management so this is a company called Hubbard Decision Research they're relatively small but they're very well established they've been doing this for decades and literally the brief we've set them is can you help us figure out how we would measure the risk for this kind of situation and also how you could measure the value what risk reduction we get from these measures so we're identifying all of the measures we're taking and then we're trying to put dollar values against those versus the risks so I would say that's not a solved problem but we're on paths to assess that yeah, thanks for the question any more questions there is one question online it's not about coverage is it no let's see are you targeting to certify against any aviation standards such as DO178C DO330 yeah so our approach at the moment is to focus on automotive because we have a number of customers in that industry that are really interested but absolutely the hope is that we can broaden from there so the trick is to establish a method that we can show works in one place and then build out so it's not we're not thinking about that today but with a trailing wind maybe next year or the year after and certainly we'd welcome interest from people in those industries great, thank you I'll say one more here just a sec run yep great I'm in one of those industries we don't use DO178 because that's specifically for human rated vehicles and ours is unpiloted but when you talk about code injection one of the mantras that happens a lot services development area is test as you fly and fly as you test the tricky thing there is to do fault injection you do have to make an exception and we do make exceptions, you just have to to do good testing but any thoughts on making that as painless as possible it's a totally valid point obviously because from our point of view we want to have broken versions of the software and we want to slip them into people's testing to check whether they're really testing but we can't do that if it's going to actually cause a risk to humans so we have to weather up, so no I don't think we've got any magic bullet there but we are worrying about exactly that that topic we would want fault injection as far as possible down that and we certainly would want it in our use case in vehicles on a test track without wet when we can simulate the reality of the real environment it should be possible to use fault injection all that way once you're flying I think it's it's harder okay great thank you for the questions okay thanks a lot folks


Hi everyone, Joe for Jaspy's case breaks.com with the last break of the night 2020 Panini Donner's Optic football six box half case pick your team number four We're over a little bit tonight, but hey things were things were rolling. I don't I don't I don't mind going over time a little bit For you if you dig deep fill up some breaks later at night, I'll dig deep I'll do my best to knock these out All right, EA needs some jail in Hertz is this is Did not see too much action in the first one. This is the second half though. Remember, I marked all these four So we they're all from the same case We're talking little hooves to EA pointing out that Carmella Anthony playing some good basketball EA saying think Jared Alan cards go up if you get traded to my Lakers. Is that actually a conversation? Is that conversation actually happening? Because I'll be honest with you I Kind of like Jared Alan a lot. I don't know if he's gonna be If he's becomes an all-star, I think that that would be fantastic, but I mean, I think he's he's excellent off the bench An excellent rim protector. You've been reading it. I would honestly I would love that I think You know and I know I'm sure I'm sure some people who hate the Lakers are like They're gonna hate me for saying this and I apologize about that but especially coming off the championship and I don't think the Lakers have Won like six games in a row and stuff like that. So an embarrassment of riches on the team, but after Dwight left You know, and I think there was a little bit of I think after Mark Heath left to know Morris is on team mainly Dwight Howard think that The oh Jovel McGee left Which are two kind of just big dudes just just tall dudes that just take up space and You know, they're not dominant But you know, they're gonna slow down the likes of them bead and yokich and and then let LeBron and ad do their work right and they can They can they just have the length and the size to do that. But since those two are gone That's been sort of the secret The sort of low-key weakness quote-unquote for the Lakers is that well What happens when they got to go seven games against yokich or got to go Seven games against the Sixers and the NBA finals or something like that with a healthy MB You know are the Lakers do they have the the length to kind of to kind of at least No, it's really gonna stop and be to yokich but to slow those guys down.  I hope that deal gets done. I don't know what assets the Lakers actually have to move because You know, they've a lot has been moved around to accommodate the likes of Anthony Davis and whatnot, but He's brown to 99, but I would love that if his cards are cheap. It's pretty good, too. I mean What in the basketball hobby what? drives And we got we got a lot of panini basketball to do tomorrow too if you want to ladies and gentlemen, but What what what do basketball players need to do to to just really gain? The foothold in the hobby in terms of value right big markets help You know, there's got to be some hype around him you know and maybe Some highlight real plays and maybe a streak of good games Jared Allen can do that The way he can he can block shots the way he can dunk There's there's been there's been to new chief to 79 pink velocity. There's been some highlight plays that that that I've seen Jared Allen Make that makes like sports enters top tens So imagine if he's doing that in the LA market 78 out of 99 that could be a good ROI there. All right, there's Dalton Keen For the Patriots Karen steel So if you if you bought a hollow PSA 10 for $80, that's it I mean worse that happens. It's it's gonna stay around that price, right? There's Denzel Mims to 199 and our first Jalen Hertz rated rookie card for EA and the Eagles EA GLES Eagles Not a hollow, but it's so nice So yeah, what's the worst happened it it drops to like 60 bucks or goes up to a hundred bucks, maybe You know a little bit here and there, but I wonder that's interesting if he does get traded to the Lakers The nice hollow Antonio Gibson He's automatically gonna get gonna get playoff minutes, right as opposed to being in Cleveland Cleveland's praying playing pretty well Mark Bassett with the Washington football team It'd be very interesting it's clave on chasing for the Jags to 299 that's for Patrick and Denzel Mims To 199 for the Jets that'll be for Mark But yeah, I don't think that's I think that's that's a low enough risk EA to kind of go with the Jared Allen and then And hopefully and hope he gets traded to the to the Lakers or another he wasn't a big market team But I guess the Nets had to do what they had to do But I yeah, I would love to see him in LA He goes to Lakers. You think it jumps to about 400. Yeah, I'm not super good with prices So that sounds about right. I was gonna say I was always under I was under estimate Under promise over deliver I was gonna say like 200, but it's sure fought 400 Goes to the Lakers maybe automatically to 250 300 maybe a little more attention to playoffs And then you get some if you get some playoff hype Although, I mean, I don't know why I don't know why Why the calves wanted the calves want to trade Because with the calves, I mean, maybe they're just looking to get looking to get younger I guess if I'm the calves, I mean, let's let's go to Yeah, Cavaliers are 10 and 16 but Nice one Travis It's a good joke But the calves are a good team they got Darius Garland who hasn't I think hasn't reached his full potential yet Colin Sexton is playing some great basketball And then I mean, I guess they got they got Isaac Acoro Toran Prince Chetty Osmond, Giavel McGee. I Feel like I feel like they should just move. I mean you're you got to build around Sexton and Garland, right? You got to move Andre Drummond send him to the Lakers and Jared Jared or Jared Allen or both move those guys There's Jalen Johnson to 179 move move move those guys and Those guys get some assets get younger I mean, they're already pretty young but get even younger You know and then You kind of evolve and grow with that with that sexton team. Oh, oh Travis just got back into got back from work I thought you were watching I was like Hear the whole intro No, but yeah, we're in the middle of pick your team for and we're only two boxes in this is a second box JK Dobbins Right apparently they don't like that nickname got Denzel Mim 57 out of 75 Tiny Auto going to the Jets Mark Basette Yeah, I heard the calves have to I don't know what the what do the Lakers have to offer? What are the Lakers have to offer? The calves though, I don't think they they don't really have any fun draft picks I think those have all been moved around or owed to someone else Unless they're them unless they're accepting future picks feet way down the future picks Coppola with the Bucks Pink velocity Adam Thielen mark the set But if they could build around 79 If they could build around that young backcourt Get some assets. I think they could quickly especially in a weaker east could look Pretty good pretty quickly yet That cut is kind of bad right there on that van Jefferson as Cooper Cup To 179 that'd be some centering issues here on this van Jefferson Yeah, who's who's reporting those? rumors is it just Is it just kind of? speculation of another kind of bad cut right there from like talk radio hosts just like messing around on the on the On the trade On the trade builder there's Gardner Minshew to 299 or is this like some serious talk? from front offices There's the guy that maybe Jalen Hurts will be throwing the ball to Jalen Ray Gore rated rookie hollow. Oh So the calves are over the cap so you think so everyone I think maybe maybe people are putting putting two and two together They got to pay sexton calves are over the cab Lakers need a big man. I feel like Lakers are right up against the cap, too So I guess it would be pigs and who'd you send the other way is The is the thing I'm looking at the Lakers roster right now It was Rex Rex just wanted to mess with everybody by throwing Jared Allen rumors out there Rex has like a in the know an ITK Twitter account with an egg as a profile picture and it's just like Been hearing Lakers want Jared Allen Dot dot dot hmm emoji Yeah, I don't know who the I don't know who the players wise the Lakers can move not gonna move shooter They just got him. They like him. They're not gonna move Caruso With the calves want Quinn cook They're not I don't I don't like this but I this makes sense. What if they move Talon Horton Tucker The calves want Talon Horton Tucker be unfair to Marcus all if they just sign them and then send them away Trez is great. I don't think they're moon Trez I think they like they just paid Kuzma a couple years might keep Kuzma Think they like what West Matthews can do. I hate the idea of Talon Horton Tucker being moved but I mean that's kind of a young exciting up-and-coming talent who might benefit from from getting like 15 20 Minutes a game and then maybe creeping up from there not that I don't maybe maybe a straight-up won't work, but Maybe it would actually I don't know how the money works. So Talon Horton Tucker for Jared Allen Town Horton Tucker No, you don't think you don't think THT is going anywhere now that what LeBron's co-signed on Signed off on Talon Horton Tucker. Yeah, maybe not There's Jake Luton to 179 and a Justin Herbert rated rookie And the centerings are a little rough on these cuts here, but a Justin Herbert nonetheless going to the Bolts Travis, I've not seen any I've not seen any Giants just yet. Nothing significant. Anyway, Nerminch who You got Jason Kelsey to 199 005 out of 199 for EA the Eagles that press got to 99 Yeah Might be super wishful thinking for the Lakers to get The big man like that like Jared Allen. No, what's Jared Allen do right now? He's getting about 25 30 minutes a game after about 26 minutes 11.8 points Close to nine rebounds couple assists couple blocks and maybe in in in a Frank Vogel kind of defensive scheme Some better players around him be a space to operate Love that 611 Get a seven footer out there. That'd be great And we got a 60 out of 99 LeVisca Chanel. Oh, I thought it's gonna be autographed just flipped around I Think so too eBay number in retrospect well, he Well, I don't know if they let him go. I feel like he had you remember He had that tweet that came out saying hey, it's glad to be back with the Lakers but then it'll it was quickly deleted and then he had signed with Charlotte whoever he signed with There's Christian Fulton for the Titans four out of 50 that there's the autograph So I think it was maybe just a money thing I don't know if the Lakers were able to pay him any more than they were paying him just for because of their own sort of budgetary reasons They were kind of up against the cap to there's Patrick Davis and the Titans It's Cam Newton to 179 Denzel Mims Yeah, there was a hollow DK in there, but yeah, I kind of wish then in a lot of like You know whenever there's a game there's Darian to Nevins to 299 and by the time the game's overall I'll be listening to like the postgame show on the radio As I drive home and on a lot of the calls are It's ready to rookie hollow Jacob Eason Colts mark upset all the calls are like I wish Got got problems in the paint giving up too many points in the paint Sixers Sean at every right sixers That's great for that's a great move for the Sixers because you know you can give a Give Joe on beat a little bit of rest But yeah, I wish the Lakers would have kept white Howard Don't Howard was excellent for the Lakers last year. I think I think he really kind of bet on himself.  I'll bet against that any day of the week But that's what that's what he's become and I think I think in his second scent with the Lakers By then he kind of already felt like That was gonna be his Legacy and it's still and it is to a certain extent But I think his the way he approached the game I think definitely changed and it seems like he's doing well for the Sixers, right? Yeah, Sean saying great off season signing by this by the Sixers But his attitude just completely changed You know, I think he was definitely like Just knew what he needed to do as a player, you know, he kind of but he kind of realized hey I'm not a starter anymore. Hey, I don't have to be You know, I think a little more maturity. I think even even a little bit later, but But yeah, oh, I agree. Yeah, I mean, I liked I liked the Montrez Herald move for our Lakers Yeah, absolutely But you know when I'm thinking playoffs and I'm thinking who's gonna who's gonna defend Yolkic for for seven games If they see the Sixers in the finals Like who's gonna who's gonna take care of Joel M. B for seven games One game I see the Lakers They've been taking care of business In a couple games here and there but of over the course of Over the course of seven games in a seven game series. That's that's gonna be a big question mark for the Lakers Just Harrell's just energy which he has oodles of is just not enough just when it just comes to size He'll be exhausted after the first few games There's Aaron Donald's a 25 nice I think someone's mentioning that these out of 25s look really sharp and they weren't lying That goes to the Rams Steve with that one This batch of cards that Definitely miscut 23 at 75 Tristan works for the buccaneers. That'll be for capola. True. Yeah. I mean, I think I think Clippers are definitely weaker in the playoffs Without that off the bench across the seven game series But I would feel a lot better if if if there was like That Jared Allen deal that EA was mentioning those rumors actually turned into Turned into actual discussions and turned into an actual trade at the very least Jared Allen's like a seven footer who can At least gobble up some minutes and and at least slow down some big names like uh Like in bead and yokich Yeah, well, this is not even panini. This is these these are the guys cutting at the factory it looks like uh It looks like maybe maybe friday five p.m. At the factory people You know people with one eye out the out the door one eye on the weekend There's jay watt pink velocity Maybe not not putting the Not carefully putting the cards into the sheets into the machine. There's Tyler Johnson buccaneers super bowl champion polo again Still a rivers To 199. What are the Colts gonna do fill that qb spot? Carson wence hollow. What's gonna happen to Carson wence? Antonio Gibson nice. Antonio Gibson Sky sky blue. I have not memorized all these colors too many colors, but it's nice at a 299 mark With Antonio Gibson. There's Jaylin regor Patrick queen and two more box to go here and pick your team four. This is the last break of the night folks Thank you If there's anything else that's sold out I'm fortunate we'll have to do it tomorrow I think i'm a bit We've gone over a little bit which is fine, but I think after series one and this is kind of a longer break too I think if we didn't do that series one that late at night, I think I might might have had the energy to do a few more, but Don't worry. We'll be back tomorrow one o'clock Pacific four o'clock Sean wants wence to the Colts of the Eagle start Jaylin. We've got mixed opinions amongst the Eagles fans here, Sean we got We got some some couple Eagles fans I don't know. I think they go back and forth. I think sometimes they're like, well, maybe you got to keep wence So you're not affected cap wise Maybe Jaylin's not ready Teal maybe says jimmy not that internet do some Can you get more for Jaylin Hertz and you just ride out wence's contract and give him some more weapons? Or do you anoint Jaylin Hertz now? But he doesn't get this maybe the same weapons in a in a wence trade There's different ways you can play Went to the Colts makes sense because the because the frank right connection obviously I don't know if Colts fans that we had a couple Colts fans here. I don't know if they were super thrilled with that idea They got to get someone Yeah, yeah, you think went to the Colts as well I'm sure they're so they have to be talking But isn't that contract kind of brutal? Jimmy would like to see jake of eason get gets get some play Well, I think the rams screwed everything up now. Well, I think originally they wanted a lot But then after they what they saw with Stafford What the rams gave Detroit? that's the So wence still has 2021 I guess he has a potential out in 2022. I don't know what the out is I think maybe a him option player option, which I don't think That he's gonna exercise Right, so it's 2021 22 23 24. He's got four full seasons left before he's an unrestricted again All right behind myles sanders is Adam Thielen to 299 Can't fight the Thielen Going to mark and the vikings There's collin johnson to 199 man. That did just a bad bad cutting at the factory That's rough rated rookie Justin jeffrey. He's pretty good too. Sorry mark I mean you might just contact panini might get might be able to get a replacement card just on the visual itself Yeah, I heard that too be man Trouble in paradise in seattle Russell wilson finally get frustrated getting getting frustrated about about years of just poor uh poor offensive line and He's got the past catching weapons, but I feel like that offensive line. Maybe the running game has never really materialized I don't know is is is it time for Seattle to look to a major overhaul He carol's not getting any younger There's jerry judy 79 out of 79 pink velocity You know, maybe maybe they could they could use a Use a bit of a fresh Fresh start. Maybe I don't know And we got daring to nevins eight out of 25 three color patch and autograph the rpa I think is Russell to rugs I was talking about this before you heard me talking about this before at ea eric that Patrick davis with the titans Offense isn't the problem. It's the defense for the raiders But that often still went eight and eight with that terrible defense As tempting as it might be Rubin with the bangles to move mountains for Russell or doshawn lottson for that matter, you know I think As tough as it might be.  You can't refuse but I doubt that Yeah, jimmy's. I think jimmy's out there. Yeah, I don't think he's going anywhere Just just like I think a lot of people were like, oh erin rogers going to be moved. I I think erin rogers is unhappy, but I think he's Wants to use that till maybe leverage some good good addition to the team But I can't see a guy like Russell Wilson or erin rogers actually demanding a trade or Or that those teams actually trading them But yeah, I think when I heard that it's like, oh trouble in paradise in Seattle. It's like Russell Wilson. Where does he go now? It's fun to talk about that's for sure Well, I bet on him going being in a different uniform By week one. Yeah, probably not You're not gonna let him go and and yeah and furthermore. Yeah Seattle, I mean You know that they don't have a lot of pigs. They got to keep Russell Wilson Wilson along If they are gonna trade him Do they have to package pigs with him? I mean, they could get a lot of pigs back Just for Russell Wilson alone That's the thing. Do they do they want pigs? I think if you're if you're Seattle Unless he asks for a trade you got a Or unless he just explores free agency He's got 2021 22 and 23 I think you just you just let it ride. You just You know, you spend the next three seasons trying to You know improve the team around him and if it doesn't work out it doesn't work out He walks 36 year old unrestricted free agent And then, you know, he can apply his trade elsewhere and Seahawks can just kind of try starting over again or if maybe trade him in 2023 if If it seems like things aren't going well, but I think for the next two years at least He Russell Wilson's pretty pretty set in Seattle. They're not they don't have to move. They're not gonna move Yeah, I'm kind of getting that feeling to be the first half was pretty good though Michael Thomas to 299 Levy on bell to 299 I see like a gold vinyl in here something like a big rookie gold vinyl would be awesome Dalvin cook another tb And all those cars that I'm sleeping, of course, it'll be top loaded before they're sorted and shipped out, of course And we got a Michael Pittman jr. Nine out of 50. He's pretty solid going to the blue horseshoes mark Collin johnson 13 out of 35 is your on-card autograph jags Pat there is Rayquan Davis To 299 for the dolphins that'll be for john or cj. Henderson That guy gets moved too, right? But the staffer deal. I think Made sam darnold expensive now We've got a karson wence We want the other guy. Yeah karson wence to 125 Very miscut zak mas Now we want the other guy Eric Come on. There's karson wence to 199 orange for ea and the ea gl es eagles And there's rated rookie chase clay plus not so bad stealers ryan with pittsburgh jimmy's thinking shawty Shot and hammer leaving made russell wilson mad as what happened. He wanted to pass first pete wants to run Philosophical differences then he gets fired. Yeah well, I feel like I feel like getting him a credible running game though is important to convince him that that's why we should run first If that's what pete carol wants to do. Here's a quick little recap in my opinion You know They got to give him an offensive line too All right. Anyway folks. Hey, listen, we've got all spring all the rest of the winter all spring all summer to rip football to talk football And of you know discuss all the trades crazy trades that happened leading right up to week one So stick with us folks join all of our group rakes on jaspy's case rakes.com You know, we love talking about this sort of stuff and we just like hashing all this stuff out I'm joe for jaspy's case rakes.com. I'll see you next time. No money I almost I was like I was extending that outro because I realized I was like I have something I need to do All right, let's flip back here giving away money ea. You still have a chance at money So if you bought at least two teams you get one entry four teams two entries so on and so forth top five wouldn't 50 bucks each Anyway, it's something else to do Let's sort by column a so ea you got the requisite two teams. That's one entry Garrett followed directions two I could pull it up four two entries john danine two one entry john wenzel two one entry Mark beset two one inch or four teams two entries Patrick davis two teams one entry ryan case and two teams one entry Steve long two teams one entry Travis kill just one team. Okay. Let me just spot check this really cool. So I got steve ryan patrick davis one teams here john with one john team Okay, all right, so that's just 11 spots. That's uh There's 11 spots right there. Let's roll it Let's randomize it six and a one top five After seven good luck one two three four five six And seven in final time after seven times. Here's your top five Right there capola patrick davis mark john steve I don't think I called your names out too often during the break So we got 50 bucks a break credit going your way as a little consolation prize Thanks for watching. I'm joe. I'll see you next time on jazby's case breaks.com. Bye-bye


So, I would like to welcome all to this first SIP virtual computational biology seminar series of the 17-18 seasons. Today, we have the pleasure to host online Karsten Bogwart, who is full professor of data mining at the National Learning and Computational Biology Lab in the Department of Biocystical Science and Engineering of the ETHZ, Zurich. So, I will give you a bit of information about his background and education before I give the floor. So, Karsten studied computer science at the Ludwig Maximilians University in Munich, in biology as well as the University of Oxford. In 2007, he completed his PhD on graph kernels at the same university. And from September 2007 to August 2008, he was a postdoctoral research associate in a machine learning group at the University of Cambridge in the UK. Then in September 2008, Karsten moved to a Tübingen to head a newly established joint research group for machine learning and computational biology of the Max Planck Institute for Biological Cybernetics and the Max Planck Institute for Developmental Biology as a W research group leader. In 2010, his position and his group were tenured and in 2011, his group joined the newly established Max Planck Institute for Intelligence Systems. And then in September 2011, he joined the University of Tübingen as professor of data mining in the Life Science of the Computer Science Department. He then moved to the ETH Zurich as an associate professor of data mining and he joined its Biosystems Department in June 2014. And since March 2017, he was promoted to the rank of full professor at the ETH Zurich and he's also one of our many SIDs, Succesive Bioinformatics group leaders. Just a few words about his lab. Big data analysis and biomedical research meet in Karsten's lab. They try to develop novel data mining algorithm to detect patterns and statistical dependency in large data sets from biology and medicine. So I will now give the floor to Karsten. He will now present a solution to the problems of the combinatorial association mapping through significant pattern mapping. And I will explain you more in details what this technique does. And so I want to thank you again Karsten for accepting our invitation. I will give you now the floor to the participants online. I will ask you if you have any questions, please write them down into the chat. And I will then take care of your question at the end of the talk and Karsten will be happy to answer all of your questions. So thank you Karsten and the floor is yours. Thank you for the very kind introduction and also for the very kind invitation to present my research here. As you've heard I'm a data miner. I'm a computer scientist from my background and as you have also heard we are working on developing new tools for biomedical research in the field of data mining. And one very important line of work in my lab is about combinatorial association mapping and I want to tell you more about this topic in the following. So my lab is among its research interests focusing on developing new techniques for genome-wide association studies and I would like to start by summarizing what a genome-wide association study is. In a genome-wide association study we are given a pool of individuals as you can see here in this example which only includes five individuals. And for these we have phenotypic information in a medical or clinical setting. This is often the disease status of an individual whether the person is a case or a control. Here is shown in red and blue. And we have genetic information about these individuals. The most common form of genetic properties that we know about these patients are so-called SNPs, single nucleotide polymorphisms, so single bases that differ between the genomes of different individuals. So we represent patients or individuals to put it more generally as a vector of these single bases that differ between individuals. And now a genome-wide association study is a genome-wide search for correlations between variations at one of the positions in the genome, at one of the SNPs, and the phenotype that we observe. So if we are observing half a million SNPs and one phenotype then we compute eventually half a million correlation scores or more broadly association scores to quantify which position in the genome is most associated with the phenotype, the disease of interest. Now using this approach more than 2,000 new disease loci have been found in human genetics since 2001 in the publication of the first draft of the human genome sequence. This is the successful part of the story. More of a failure, however, is the attempt to actually predict phenotypes using these associated loci. The correlations while being significant are often still very weak and the phenotypic variance that we can explain through these significant associations is disappointingly low. So when we look at typical examples of complex diseases, for instance cancer or diabetes and others autism, then the variance, the phenotypic variance that we can explain with these associated SNPs is typically less than 20% of the overall phenotypic variance and it's much lower than our heritability estimate of how heritable these phenotypes should be over generations. So there's a gap and the genetics community refers to this gap between the heritability that we expect and the heritability that we can explain by the term missing heritability. There is a phenomenon of missing heritability. We cannot explain with the SNPs that he has found through genome-bite association studies a large fraction of the phenotypic variance in heritable phenotypes. Now there are many reasons, potential reasons I should say for this that are being discussed in the genetics community. One of them that I would like to focus on today is that the standard methods, just like the genome-bite association mapping approach that I just presented, many approaches ignore interactive effects between loci. They just look at one SNP at a time and correlate it with the phenotype or they look at additive effects of several SNPs. However, there's Habianny method that looks at interactive multiplicative effects between different loci. Why is this a shortcoming? Well, there are a lot of hints and indicators that it's actually worth and very interesting to study such interactive effects between genetic loci and it is very likely or at least plausible that such interactions may have a non-negligible effect on phenotypic variation. An excellent review in this domain in this field is the one that I've pasted here by epistasis, important for tackling complex human disease genetics by Mackay and Moore. They list here several examples in this review by this is an interesting problem to study, in particular in model organisms. We have many examples of genetic interactions between different loci in the genomes of these model organisms. One well-known example are these large screens for synthetic lethal interactions. We are only knocking out two genes at a time, kills an organism, but knocking out a single one does not have this lethal effect. So this is an excellent review that I would recommend in this area. Now, with all of these genetic interactions playing an important role in model organisms, it's more than plausible to study the same phenomenon also in human genetics. And that's what we would like to do. So why can't we do it directly or easily? We can't do it easily because this form of searching genome-wide for interactions is an extremely challenging problem both from the computational and from the statistical side. So if we refer to this approach of finding combinations of SNPs as combinatorial association mapping, then we have to realize that first there's a huge computational challenge because we face a combinatorial explosion of the number of candidate sets of SNPs that could be associated with the phenotype. There's also a huge statistical challenge. There's a combinatorial explosion of the number of association tests that we perform. I'll give you a simple example. It's absolutely realistic to work with a data set where we have one million SNPs per individual. Now, if we only consider pairs of SNPs and do combinatorial association mapping with pairs of SNPs, then in an exhaustive search, we have to consider order 10 to the 12 SNP pairs for association with the phenotype. It's easy to see that this is a huge search space of 10 to the 12 candidate pairs and each of them represents one hypothesis that we are testing. There's also a huge problem of multiple testing correction that we have to perform here in combinatorial association mapping and this example I just gave is only the example for pairs of SNPs so everything gets much worse if you look at higher order interactions of SNPs. Well, if we consider associations of groups of C SNPs, where C is larger than 2, then our multiple testing problem gets even worse. Any of the K SNPs would correspond to a hypothesis that is tested and K would be of the order of D to the C so it would grow exponentially in the size of the SNPs that we are considering. Now, if you ignore multiple testing in this setup, then alpha percent of all steps that you are testing might be considered statistically significantly associated even in a dataset where there's actually no correlation with real dependence between genotype and phenotype at all. Alpha here is our significance threshold which is in most applications set to 5%. So if you ignore multiple testing, then 5% of 10 to the 12 SNPs would be false positive discoveries even if there is no dependence between genotype and phenotype in our dataset. And 5% of 10 to the 12, you can imagine how many these are so a really huge number that you would have to struggle with. It's therefore imperative as stated here on this slide to control for multiple testing, for example to control the family bias error rate which is the probability of having at least one false positive among your significant associations. However, there's a second problem in this correction for multiple testing. If we choose any of the popular approaches such as Bonferroni correction or false discovery rate control, then we have to, in Bonferroni correction, we have to divide the significance threshold by alpha, as stated here, by the number of tests K that we perform. But K, as I said before, is even in simple examples, order 10 to the 12. So the correct significance threshold that you'll get will be so small that no SNP set will pass this extremely stringent significance threshold anymore. We will lose all statistical detection power of true associations. Doing the same with false discovery rate control will not save the day. You'll still have extremely stringent significance thresholds. In fact, in many domains, both in genetics, but also in data mining and machine learning, this was long considered an unsolvable dilemma that you either suffer from extremely many false positives. Or you lose all statistical power when properly correcting for multiple hypothesis testing. However, recently, there was a number of advances in the field of significant pattern mining, mainly by the group of Koji Tzuda at the University of Tokyo in Japan, and by my lab, which are now bringing us closer to a solution of this problem and in some instances actually solves the problem in very interesting settings. Now, in order to explain how this solution works, I first have to define some terms, namely, first of all, features election. This may be known to everyone. Features election is the problem of finding features that let you distinguish different classes of objects. What I described in the genome byte association mapping setting is a features election problem. You try to find the SNPs that are correlated with disease status. Now, the method that I'm going to talk about is a member of the field of pattern mining. So what is pattern mining? Pattern mining is an instance of features election, in which we assume that our features are binary. And so state 01. And we try to find higher order combinations of these binary features. The so-called patterns distinguish one class from another. And now let's have a closer look at the example that is shown here. So we have again a toy example of two classes of individuals here. Plants that differ in the phenotype, yellow and blue. And you've highlighted here in blue, three SNPs, and they are summarized in a pattern here on the right. The pattern is just the product of the numerical values representing these SNPs. So only if your feature is one at each of these three positions in the genome, then the pattern is one as well. Because the pattern represents the product of these different SNPs or positions in the genome. This is one example for a higher order combination of binary features that you might be interested in. So these are these patterns that we will refer to in the following. Now what is the common way of testing an association between a pattern and a given output variable in our case a phenotype? Let's refer to this pattern as S and let's refer to the phenotype as Y. Now what you commonly do is that you create a contingency table. Here in the columns we have counts for individuals that contain the pattern. On the previous slide in our example, the first three plans would be examples of individuals that contain this pattern where the product of the three blue SNPs is one. And the second column represents those counts of those individuals that do not include the pattern. And now the roles tell us how many of these pattern carriers fall into class one and in class two and how many of the non-carriers of the pattern fall in class one and in class two respectively. Now after you've represented the data in such a contingency table, what you often or in most cases do is that you apply Fischer's exact test to test whether S, so the pattern, is over-represented in one of the two classes. Y equals one or Y equals two. So whether these carriers or one of the members of one of the two phenotypic classes are more likely to carry the pattern S than the other group. And the common way to compute p-values for this Fischer's exact test is based on the hypergeometric distribution. You don't have to go into mathematical details here but you have to be aware of one fact which is this hypergeometric distribution for computing p-values for Fischer's exact test assumes fixed total marginals X and one and N. X is the total frequency of our pattern in the data set, so the total number of individuals that carry the pattern. And one is the number of members of class one and is the total size of the data set. This is all assumed to be fixed in the calculation of the p-value. Now the lab by Zuda et al. discovered a very important piece of work from statistics that was published by Taron in 1990, four years ago. And I would like to explain the insight that Taron had 27 years ago here in now in the column. Taron noted that when working with discrete test statistics, for instance the Fischer's exact test, as I just described, there is a minimum p-value that a pattern can achieve. Now I would like to illustrate or explain this in a bit more detail. What do we mean by such a minimum p-value? You have a particular pattern S and it appears X times in your data set. Now which are the most extreme configurations of the data set that you can imagine? Well, the two most extreme configurations are that the carriers of this pattern S all belong to phenotypic class one to Y equals one, or they all belong to phenotypic class two, Y equals two. In these two cases we have the most extreme configuration of the contingency table and you'll get the lowest or most significant p-value that you can imagine for this given this frequency of a pattern. So with every frequency of a pattern there's an associated minimum p-value that this pattern can achieve if it follows one of the two extreme configurations of the contingency table. But what Tyrone now realized is that this minimum p-value for a given pattern S with frequency X is often larger than the Bonferroni corrected significance threshold, which is shown here, alpha divided by k. So in short, there are patterns where the minimum p-value that these patterns can achieve is larger than the Bonferroni corrected significance threshold, which means nothing less than that these patterns can never become statistically significant. Tyrone refers to them as the so-called untestable hypotheses, those hypotheses that can never become significant. And he shows in his paper that in Bonferroni correction one should only correct for testable hypotheses rather than for both testable and untestable hypotheses. So if we are correcting for k hypotheses and only m of k hypotheses are testable, then it suffices to correct for m of k hypotheses in multiple test corrections rather than k hypotheses. And as often the number of test hypothesis is much, much smaller than the total number of tests that we performed, this greatly improves our statistical detection power of true associations. This is a fundamental trick that now 27 years later becomes extremely relevant in data mining and in genetics. So as a first step in the research of my lab, we tried out empirically how well this trick works. And we used it on a future selection problem from graph mining. I don't have to go into the details here. Of major interest is the plot here on the left. It shows the so-called correction factor. That's the number of tests that we have to correct for in this application. And you see here in red the classic standard Bonferroni correction. And on the x-axis here you see the cardinality of the future set that we are looking at. So if we go for very large feature sets, then we have to correct for hundreds of millions at least tests that we perform. However, if we compute Tauron's reduced correction factor for multiple testing correction, then it suffices to correct for 10,000 hypotheses in this setting, even if we have no upper bound on the size of the feature sets that we are considering. This drastic improvement in statistical power then allowed us to find new interesting feature sets, patterns on this actually very well studied data set. And this impressed me very much and therefore four years ago I decided to further explore this topic of applying Tauron's trick in data mining and in statistical genetics. Now how do you actually compute the correction factor in Tauron's approach? So let me define some variables in order to answer that question. Assume K is number of tests that we correct for. M of K is the number of hypotheses that are testable if our significance level, our multiple testing corrected significance threshold is alpha divided by K. Obviously M of K is a function of K, that means the number of tests by hypotheses depends on the significance level and on the number of tests that we correct for. And we must require that K is equal or larger than M of K, which means that we correct at least for all testable hypotheses. Otherwise we are not correcting for all hypotheses that could become significant. So then the optimization problem that we solved is we want to find the minimum number of tests that we have to correct for K, such that this number of tests that we correct for is larger or equal to the number of testable hypotheses. And Tauron now proposes to solve this optimization problem by initializing the number of tests that we correct for to one and then iteratively increasing K by one until K exceeds M of K. That's the brute-force approach of finding the number of tests that we have to correct. However, there's one important question. How to efficiently compute M of K if you are given a particular value of K without running through all possible hypotheses in our huge space which grows exponentially in the size of the feature sets that we are considering? Because the brute-force approach of finding out how many patterns are testable would be that we run through all these patterns and compute their minimum P value. Unfortunately, we cannot afford this in these extremely large spaces that we are here facing in combinatorial association map. And now the insight that the Tudor lab had in 2013 is, and also the CESA lab I should mention is two labs in Tauron. The solution is that the minimum P value of a pattern is determined by the frequency of that pattern in the data set. I said before this is the number of individuals in the data set that carry this pattern. Now finding the frequency of a pattern in a given data set that's in fact a classic problem from data mining for which many algorithms have been proposed and you can now exploit this fact in solving this problem of combinatorial association mapping. How it works is illustrated here in the following plot that I would like to explain in a bit more detail. On the x-axis we have the frequency of a pattern, x it reaches from 0 to n the total size of the data set. On the y-axis we have the logarithm of the minimum P value of that pattern. So if we go down on the y-axis then the minimum P value gets more significant. And what we see here in this plot is that if we go from frequency 0 to frequency n1 which is the size of the smaller of the two phenotypic classes then the minimum P value decreases with the frequency of the pattern. So in this domain here from 0 to I'll highlight it here from 0 to n1 the minimum P value decreases with the frequency of the pattern. That means in this range the more frequent your pattern the smaller its minimum P value. And this is an extremely interesting insight because it means that we can find the castable hypotheses those that have a minimum P value of smaller than a predefined threshold by performing frequent pattern mining by finding patterns whose frequency is above a certain threshold. And this is exactly what Terada et al. then proposed in 2013. They proposed to determine the number of testable hypotheses m of k by doing frequent item set mining, frequent pattern mining on a data set E with a frequency threshold theta which is a function of our significance level here and let me illustrate this on the previous slide. So you see here the dashed bar in the middle if this is one possible significance threshold that we have to pass. So all patterns that are testable should have a minimum P value that is below this dashed bar. We can see on the x-axis that they have to have a minimum frequency of what we call here x-min. That means in this particular example we would run frequent pattern mining with a frequency threshold of x-min in order to find the testable hypotheses and that's exactly what Terada et al. proposed. However, if we start with very small case, so with very small correction factors then the corresponding frequency threshold theta of alpha divided by k will be very small. If you've ever used frequent item set mining or frequent pattern mining then you will know that frequent pattern mining with a very low threshold is a nightmare and your runtime will absolutely degenerate because there are so many different patterns that pass a very low frequency threshold. And this is where the work of my group started to kick in. So first of all, and I only summarize these contributions here now first of all we answer the question how to efficiently find the optimal case the optimal correction factor without running frequent pattern mining with very low frequency thresholds. This was solved in 2015 and I have the full list of references at the end if you are interested in the details of these methods. Second point is the patterns that we are looking at are in subset-super set relationships just imagine sets of features of different cardinality. How can we account for this dependence between the tests that we are performing and all that I presented right now we do not account for any dependence any subset-super set relationship between different patterns. Then in the life sciences it's extremely important in such tests to correct for covariates such as age and gender of the patient. So how can we retain our computational efficiency and statistical power if we account for these categorical covariates? In 2016 we found a solution to this very difficult problem. And the fourth and final question is can we develop new association mapping approaches based on Tyrone's trick? And the answer to this is yes and I'll very quickly describe one new association mapping approach that we developed based on Tyrone's trick. It is what we call genetic heterogeneity discovery and I'll jump straight to the toy example. Genetic heterogeneity in the classic clinical genetics meaning of the word means that a disease may be caused by more than one locus in the or allele in the genome. This is illustrated here in this toy example. We have again our six plants here. We have their snips represented as pits. And think of the zeros as snips that are... So think of the ones to be precise as rare variants and zero would then be the non-rare variant. So what we are looking for in genetic heterogeneity is groups of positions in the genome such that having a rare variant at any of these positions gives rise to the phenotype of interest or is at least correlated to the phenotype of interest. So in this example here we look at contiguous intervals, contiguous sequences of snips, a clock of length four and we check whether there's at least one rare variant within this clock and if that is the case then the state of that clock is one state of that pattern. You could say here on the slide it's called a metasnip. And we do this for all individuals. We check whether they contain a rare variant in this interval and then we represent this interval by one number depending on whether there is at least one rare variant in this interval. Now similar approaches that are called burden tests have been proposed in the genetic literature but they suffer from one shortcoming. They have to precisely define the intervals in the genome that they want to test and typically they then define these to be all the genes in the genome. What we would like to do is that we would like to scan the entire genome for such intervals. These intervals may lie in intergenic regions. They may overlap with parts of the gene. They may overlap with several genes. We want to allow for arbitrary start and end points of these intervals. Of course, if we allow for such flexible start and end points of the intervals then we are performing more tests than the classical burden tests so we have to correct for the inherent multiple testing problem and we want to do this computationally efficient and with high statistical power. To solve this problem we model it as a pattern mining problem given an interval an individual contains a pattern if it has at least one minor allele in this interval. This is what I just described. Having one rare variant or one minor allele in a particular interval makes you a carrier of the pattern. And then we can greatly prune the search space to make the search for these intervals that are associated with a phenotype of interest very efficient and statistically powerful. What is obvious is the statement here on this slide which is that the longer such an interval is that we are considering the more likely it is that it contains at least one rare variant so that it contains at least one one. Now this sounds like a basic fact but it helps us to prune the search space tremendously namely by two pruning criteria that I summarize in the following. If too many individuals in our dataset have a particular pattern the corresponding interval is not testable. You see this here again on this minimum p-value plot versus the frequency of a pattern. If the pattern gets extremely frequent shown here by the dotted blue line then the minimum p-value goes up again. So if a pattern is extremely frequent then it is not testable anymore. That means if we look at very long intervals it's very likely that most of the patients will have at least one rare variant in such a long interval and it's therefore very likely that it will not be testable and that we can prune it away. The pruning criterion two is if we have found such an interval and such a pattern that is too frequent to be testable then none of its supervolts is testable either. So we can prune away all intervals that include this non-testable interval and thereby we can reduce the search space very much. How much we can see in the following slides here I'll keep this very short. We show here the length of the sequence that we are considering so the length of the genome versus the time taken to search for significantly associated intervals. And our approach called Thys here scales only linearly in the number of snips in the genome although the number of tests that we would have to consider in a brute force approach is quadratic in the length of the sequence. So we can prune away so many candidate intervals that the runtime is still linear in the length of the sequence. That's a very good outcome. Our power is also as shown here in simulations higher than that of competing approaches. This is very short.  Well we tested this hypothesis in 21 binary phenotypes from Arabidopsis-Taliana, the plant model organism that has also been used for genome-bite association studies frequently and we looked at all the intervals that we found and we checked whether they overlapped or at least were in the neighborhood of a single snip association that we would find with a standard approach to genome-bite association method like a linear mixed model or a univariate Fisher's Exact Test. And it turns out that 70% of the intervals that we find are not located in a 10KB window around these single snip hits. So 70% are genuinely novel. And the other 30% are located in a 10KB window around the hits found by these other standard techniques. So to conclude with this approach which we call fast automatic interval search price we can search for intervals that makes Hippid genetic heterogeneity efficiently. We don't have to pre-define the boundaries of the intervals we can search genome-bite. We can properly correct for multiple testing at the same time. In the meanwhile solve the problem of how to account for covariates like age and gender. We are currently working on the problem of how to extend these from intervals, contiguous sequences along the genome to networks and sub-graphs of snips if you represent snips or genes in form of an interaction network. This is our current work. To summarize the entire talk combinatorial association mapping allows one to study epistasis, snips and interactions, one important potential reason for missing heritability. The high dimensionality of the problem leads to an enormous computational and statistical challenge. I hope I have convinced you of that. Solving both problems at the same time was largely unachieved in the past. We have developed several significant pattern mining approaches that achieve both these goals. Now, if you want to read up more on that, download our papers, presentations and the code that is online, then please go to Significant-Patterns.org. As some final pointers, I would like to point out some resources that my group has developed to the Swiss bioinformatics community. We have developed the platform EasyGvast.org, a machine learning platform for geneticists. It allows you to perform genome-wide association studies in the cloud. It's now a few months later than the May 9 shown here. We are approaching 1,000 users for this tool. If you're interested in running genome-wide association studies in the cloud, then please visit EasyGvast.org. And if you know my earlier work about network comparison, then if you're interested in the problem of comparing networks and biology to each other, then a very useful tool or a set of tools is available from graph- kernels.org. We had an application note accepted in mathematics yesterday, which includes an R and Python package for all the graph kernels, graph comparison methods that were developed in my group. Now, this concludes my talk. I would like to thank my group. I would like to thank our sponsors to support our research, and I would like to thank the SIB for inviting me.