Good morning everyone and welcome to CFA. My name is Mike Forshu. I'm the executive manager of ICT Services, responsible for leading the team that brought us here today. Thank you very much for coming out on such a wonderful day. This is a very large project for CFA, 42 odd million dollars, and the number of people who are here today, and the number of organisations who are being represented here today, I think says a couple of things. It says this is a broad-based project that relies on a number of people coming together in a partnership and we value that partnership. A robust and reliable communication system is critical for firefighter safety, and again with firefighter safety in mind that will allow us to enable an automatic vehicle location technology. So this is more than simply a dispatch communication service. It will provide a life blood of communications for our firefighters. It will enhance community safety and allow us to move to the next generation of safety technology for our firefighters. Again I want to reinforce that a strategic direction that CFA has adopted over the last three or four years has been one that we are shaping the organisation to support the safety of our communities and to focus our resources and supporting our frontline firefighters and community educators. Thank you Ewan. As Ewan mentioned, this is a partnership between CFA and a number of other organisations. Critical to this has been the involvement from other members of not only the emergency services being ESTA, but also our partners in this particular project being Telstra. With that in mind I would like to welcome Chris Pierce from Telstra who is the Executive Director of Government and not-for-profit sales. Telstra is proud of the strong working relationship we have with the Government of Victoria and key agencies including the CFA. Through our work with the CFA as well as ongoing efforts with programs such as emergency alert Telstra is providing the infrastructure to help keep regional Victoria a safe place. This partnership with the CFA is designed to give fire brigades faster information on a more reliable platform through the Telstra network. Since 2009 the CFA have been negotiating on behalf of the emergency services in Victoria. The aim was to deliver a world class radio communication system for the exclusive use of Victorian public safety organisations. Today a milestone has been reached with the announcement of the execution of the contracts. Telstra has been chosen as the successful tenderer. Under the new contract Telstra will build and maintain infrastructure for CFA digital radio services in regional Victoria. The Hume, Grampians, Lodden Mallee CFA operational districts will be the first to receive the new service and technology. The new service is due to be implemented by June 2014. I've put a circle around June 2014 ensuring every regional brigade is able to access clear and reliable radio communications no matter where they are. The dispatch service will allow brigades to speak directly with emergency call centre operators from the fire ground, reducing the risk of communication failures and improving safety for both the CFA members and the community. It will improve communications between agencies such as police, ambulance and ensure a consistent approach for the dispatch of CFA and SES units. Improving CFA communications was a key recommendation of the Victorian Bushfires Royal Commission. The upgrade from the analogue to digital radio service is an important step in delivering on this recommendation.


DCU welcomes students from over 110 countries, including Shepard Machea from Zimbabwe. But how he got to DCU is a tale more fraught than most. On the run from his home, Shepard sought asylum in Ireland and is staying in a direct provision centre in Port Leish. I was under persecution from the ruling party. I was being forced to protect the activities that they do in like forcing people to join the party and forcing people to go and attack other people like the opposition parties and those that are not interested in joining the party. So I refused. I'm not a politician myself and I'm not interested in politics. So the things like when I refused, I then became an enemy to them. And they kept trying to force me and I kept refusing until I became a target and they started persecution me. And they were beating me up and they took me several times and they tortured me until one day I just like got a chance to keep out of the country. That's how I ended up in Ireland. After studying in Port Leish College for a year, he applied through the CIO to go to university but didn't have the money. Luckily, the University of Sanctuary programme helped him out. I applied through the CIO and when I made my application I actually put DCU on top. This is where I wanted to study. For some reason I don't know but I've just heard some people like making very good recommendations about DCU. Then well, I didn't have money to go to university. All of a sudden we got a reception here. They put a link saying that DCU were offering scholarships so I applied and in God I was accepted. DCU took on 15 students through the programme which has been a major success in its first year. We had a very successful colloquium at the start of September. We're running again or many projects every week for two hours when we bring in people from Moznik. We're doing a storytelling project for DCU students. There's a few things going on like this and it's been really good energy. Shepard now plans to work in IT after graduation and his education is helping him to build a better life. I've learnt a lot of things. I've been in school now close to six months, five months, six months. But I've actually learnt a lot of things to be honest with you and though I'm studying online it's a very, very tough thing to do. It's very challenging. It comes with a lot of challenges. It comes with a lot of discipline. I'm studying online. I'm studying on my own. I'm spending a lot of time like reading and to be honest it has done a lot of good. It made a lot of changes in my life in terms of like how far I can push myself.


I remember that summer very clearly like we never hire anybody in my family. It's always why do you think I had a kid?  My dad put me to work as usual having me lay a brick patio back there So they could put a table out there and I remember the trucks showed up first process was getting all the brick back There and then my dad was just like this goes there that goes there and I was just working like a dog But it was a good time. We had a good time together doing it We did a lot of things like that around the house like built a little a little Like wine cellar in the basement. I could imagine there are a lot of different lessons that you learned from that Yeah, definitely think there was a lot of self-sufficiency there too like not hiring just going and hiring somebody just knowing that you Can do this on your own like you just research what to do make a plan and then execute that plan You know just a little hard work I mean never better learn that lesson I guess


Hi, I'm Rob Randall, Chief Executive Officer of Akara. Since 2009, Akara has achieved a lot across its curriculum, assessment and reporting areas. We know that our work generates much interest here and overseas, and we're confident that Akara will continue to be recognised as a leader in education. While Akara has been set up as an independent authority, our success has not been accomplished alone. We recognise and appreciate the generous and often passionate contributions of our partners and stakeholders in developing the Australian curriculum, delivering our assessment programs and monitoring and reporting on both of these. We know that in developing world-class curriculum, assessment and reporting functions for all young Australians that everyone has focused on high quality. I now invite you to listen to Akara's Director of Communications and Strategic Relations, Robin Zeno, who will talk about the ways we've been working with our partners and stakeholders and I'll invite you to continue your engagement with us. Thank you. Hi, at Akara we are focused on improving the learning outcomes for all young Australians. We don't do this alone and we know the vision is a shared one. We recognise the generous and often passionate contributions of our partners and stakeholders in shaping and providing direction for Akara's work and reaching agreements and consensus on important educational issues impacting the next generation. Akara's staff work proactively with partners and stakeholders to engage them in our organisation and our projects around curriculum, assessment and reporting. This occurs in many ways, from regular formal meetings through to interaction via social media. At meetings we share information about our projects, discuss issues and aim to resolve concerns. We hear the views of a wide range of people, including federal, state and territory education representatives. Akara engages with thousands of people in these planned meetings over the course of any year. Without the support of our partners and stakeholders, major educational events such as the completion of the Australian curriculum, My School, NAPLAN and the NAP program would not occur. But there are many other ways that we communicate and engage with those who are on the journey with us. These include our Akara update sent monthly to over 20,000 subscribers, our websites which contain information about the major projects related to the Australian curriculum, NAPLAN and My School, many forms of social media and comments, opinion and articles that are published in mainstream media and specialised education journals. Importantly, we are constantly working to learn more about the best ways to communicate with you, our partners and stakeholders, and striving to ensure that communication is two-way. Our social media channels are increasing in importance for us. They allow us to talk directly to stakeholders such as schools, teachers, parents and students on a daily basis. Gathering feedback from our stakeholders influences our communication plans. I encourage everyone to join our conversation on social media. We want to hear from you about how we can better communicate with you. Please complete the three-question survey on the homepage of our website at any time or send us an email at info at akara.edu.au. Thank you.


So why is Dwayne Johnson your favorite actor? He's not. Since when? Ever. Oh. He's hot-ass garbage. Oh! Leo. Your favorite actor. Not hot-ass garbage, but... No, not my favorite. Tom Cruise. Hot-ass garbage. Keanu Reeves. Nice guy. Ha ha ha ha! Josh! Hey, welcome to Right Tourist, David Rakes, it's The Corbin. I'm Rick. And you can follow us on Instagram, Twitter, for more juicy content. So, pay attention to our friends, you can subscribe, get like, right now! That's it. That's it. It's actually confetti-like content today. You should go to the doctor if your juicy content is coming out like confetti. Ooh. Yeah.  Today, we got a video. That would be fun. Today. Hey! So, you know the Indian who wants to be a millionaire show, right? Yes. I'm gonna talk much on this. Yes. But... This time, Shahrukh Khan is hosting. What? Yes. Since when? I guess they've kind of done that a couple times, like, change off sometimes like that. But this is a kind of little clip of an episode of a lady that is just not a fan of Shahrukh Khan. On the show as a contestant. On the show as a contestant. Like, is she somebody who is oblivious to his existence or someone who just doesn't like this? It doesn't like us. Wow! Okay. Which is obviously a hot take. Wow! That is a hot take. Especially to say, to his face. Which, but that's fun. And then so... What's not to like? Oh, man. I don't know. All right. But, so... Hey, if she's honest. I never reacted to clips from this. So, one, hopefully it doesn't get blocked. Two, if there's more, just let us know. Yeah, this is a very unusual thing. Here we go. I watch your films. Yes. Earlier, I didn't like your films. And I noted this. If you are honest, you can feel that your mannerism meets Mr. Shabani Kapoor. Oh! Yahoo! No! Oh! In the field of intensity. You are very expressive wise. Did he ask for these critiques? Just roasting it. Lifelines are over. One last option. Don't take tea. That's why I'm not telling you. But, it's my duty to tell you. You can leave the game. But, don't leave the game here. Sharukh says, I'm going to hug you. No. But, you're going to hug me. Straight up, no. Okay, Mr. Khan. I don't want to risk anything on this stage. I don't want to get hugged by you in this show. Wow! You're crazy, girl. You're going to shed tears in my eyes. What do you mean? You wanted to say, I'm going to hug you. No, no. I'm in the mood to hug you. Because, you're so beautiful. And, I wanted to share that beauty with you. Can I take your blessings? You're asking for my blessings. She'll stay with me even after that. God willing. You come here. I'll request you, I'll request you. You're very strict. You're standing here. Would you mind if I take a look at your mother? Yes, yes. Because she'll definitely hug me.  I'm sorry, she's terrible. Wow, the side eye. Take the blessing from the mom. I love that. She's fun at parties. I love you. And I wish you all the best in life.  Yeah, so what? The very first thing of like, the flat out critique of his acting. Where did she get off doing that? Like, what was the setup for her? Seriously, I watched you in movies. I didn't think you'd continue to be a good actor before. I know who you are. Who told you to say that? For what? Like, if I'm on the show with Dwayne The Rock Johnson, I won't be like, hey, I think you suck at acting, bro. Exactly. No, there's this thing called... But I do. Decorum, where in the public setting like that, you have a level of decency.  And Johnny, is the Indian who wants to be a millionaire still on? I don't know. I used to watch it way back when Amitabh Bachchan was... Yeah, yeah. I mean, my dad, everybody used to watch it. I think he's still the host. I think that's... I don't think he's still on. You don't think it's on? Okay. I thought it was still on. I used to get gates. Yeah, yeah. Oh yeah. Now, it was huge here in the late 90s, early 2000s. Yeah, with... Did he have Foxworthy hosting? He took it over after Regis. It was mostly popular with Regis. When Regis hosted it, it was when it was massive. Yeah. It was like the biggest game show in all of television. Yeah, it was huge. But that's just good on him for not taking it personally. I mean, I guess he can't. Well, obviously, he can't do anything. No. He can't be like, I'm rude, because then all the tabloids are going to be like... Of course.  No, but I don't believe... Because I think all I've ever heard about the guys, he's a nice guy. And also, I don't think he thinks too much of himself. No, exactly. I don't... Okay, if you don't like me, that's fine. Yeah. It's okay. I don't know why you're telling me all this, right? Like, it's just so weird that she's like... I have this personal vendetta against you on the show that I'm trying to win money on. I don't think you're a good actor. I've always wanted to tell you that. Okay. Okay.  Well, when you're done, I'll give you a hug. All right, well, I'm done, but I don't want the hug. Yeah, don't touch me. Don't touch me. I'm afraid your bad acting will come all over me and I'll become a bad actor myself. She must be like... Because it looks like she's like a teacher or professor or something. Yeah. She must be just hardened by all of her students that she hates so much. How many kids have missed class to go see SRK films? She's so mad. She said to give so many kids lower grades because they've loved his movies more than her class. Wow. I just don't even understand it. She's got the look on her face like that, like... Even if you don't like the guy, why are you so mean? My job's far more important and I don't know how much money you make. I can't stand how much money you make compared to how much money I make. It was really weird. I'm glad we saw it. Yeah, that was fun. Let us know if there's other clips or stuff like that. I don't know how this is going to do in terms of copyright issues because I don't know how who owns the copyrights for the show. Right, yeah. But... It'll pick up somewhere real quick. The algorithm will go... Yep. She's got a copyright straight down to her. Yeah, I know. Stupid. From the same stupid... From somebody who does not own the content. Does not own the content and still YouTube lets them get the copyright strike. Oh, my God. Weenies. Makes...  I don't have a problem with people. Companies. No. Claiming their stuff if it's theirs. If it's yours. I get it.  It's your content. I understand. No, and it's also one thing to claim a copyright or to block a video. It's another thing to strike a channel for it. If a channel is abusing your content, yeah, strike them. But when they're just innocently posting it and they have no idea... Makes no sense to me. Makes no sense. And... So, yeah, anyways. Anyway. There's other stuff from this show or other shows that we can rack to from our talk box on Shovercon, other Shovercon stuff we can rack to. Let us know. Down below.


A battery is made out of particles, the cathode is made out of this grounded material, usually lithium cobalt oxide, lithium agonist oxide. The anode is made out usually of graphite particles of carbon which stores the lithium. When you charge them and discharge them, lithium comes from the cathode side, goes through the separator and then gets inside the particles. But sometimes there are local conditions on the surface that then the lithium instead of going inside they prefer to start forming a little nuclei and when they form that little nuclei of lithium is what we call dendrites. They have been all sorts of competing accounts on how to describe them and what we did is to try to take these different descriptions on how they happen and try to unify them and explain at least two or three of the mechanisms that are the most prevalent descriptions on dendrite growth. There are two types of dendrite growth. The main one is called tip control which is basically lithium comes from the top, from the counter electrode, deposits on the surface of the dendrite and that advances the surface one step. In some cases lithium still comes and instead of depositing there what happens is it just gets redistributed and induces some stresses in the dendrite which will cause the dendrite to basically squeeze itself up from the base. Basically that's called base control growth. If you discharge your battery slowly you don't give time for this lithium to accumulate on the surface. What instead will happen is that lithium will have time to go inside the anode graphite particles and then you can reuse it. If you do it very fast that will induce a large voltage drop between the anode and the cathode and that could give you enough potential to nucleate one of these dendrites and once you form it under normal conditions you will never be able to get rid of it. Now we're going to be trying different types of separators which is the layer that you can actually design in between and the idea is to find structures that will promote one type of mechanism of dendrite growth with respect to the other one or a combination of any of these two mechanisms to suppress the lithium growth completely. We have electrical, chemical and mechanical aspects to play with and since we have the opportunity to not only explore one combination of parameters but also to actually explore everything commercial and even non-existent out there. So there's a lot of interesting opportunities to propose new separator layers.


Welcome to the 16th meeting of 2015 in the Rural Affairs, Climate Change and Environment Committee. Before we move to the item, remember to switch off your mobile phones if they're noisy. We can interfere with the thought processes of the members here. There are, of course, tablets being used for the business of the committee. We have apologies from Alec Ferguson and Dave Thomson. The agenda item 1 is the decision on taking items in private. The first agenda item is the decision on whether to consider the draft letter through the Scottish Government on mandatory public sector climate reporting in private future meetings of the committee. Is there anybody who has any comments to make? Mr Russell. I have no comment to make on that item but I'd like to raise another item on the agenda, which is my request that the committee recall a representative of first milk. I would suggest that the invitation be given to the chairman and to the new chief executive to give evidence to the committee about milk pricing. Members will be aware that, on Friday, First Milk communicated with its Scottish suppliers reducing the price by 0.2 pence a litre, which is very serious indeed, but even more seriously, for the 13 butte producers, the price is reduced by 1.2 pence a litre, which makes the price something just over 16 pence a litre. That is utterly uneconomic and disastrous, but it also breaches what the co-operative has done up until now, which is to pay the same price to everybody for their milk. The reason being given to the butte farmers is because of cost of transportation, but the figure suggests that the cost of transportation is something between £350,000 and £400,000 a year. That is nearly double what the actual cost of transportation is. That is deeply resented in butte. There is huge anger. A director of First Milk attended a meeting on Sunday, and I think that he realised that it is very important that the committee understands what First Milk is doing, particularly as it appears to be a threat to the viability of dairy farming in butte. Thanks for that. We have agreed previously to take the work programme in private, and I suggest to members that we discuss that matter in private during that work programme period, because we will have to review items that we have dealt with before. Thank you for that, Mike. We can accept then that we will take the item on the mandatory public sector climate reporting issue in private. Are we agreed? We are agreed. Thank you very much. Agenda item 2, subledge. This is the committee consideration of the draft climate change additional greenhouse gas Scotland order instrument to be laid under the affirmative procedure, which means that Parliament must approve it before provisions may come into force. Following this evidence session, the committee will be invited to consider the motion to approve the instrument under agenda item 3. I welcome the minister, Dr Irene McLeod, and her official George Burgess, the Deputy Director of Environmental Quality Division. I ask the minister to speak to the instrument. Thank you, convener, and good morning. Thanks for inviting me to discuss the draft climate change additional greenhouse gas Scotland order 2015. The order adds nitrogen trifluoride to the list of greenhouse gases covered by the Climate Change Scotland Act 2009 and designates 1995 as the baseline year against which progress to reduce emissions will be measured. This addition means that emissions of nitrogen trifluoride will be accounted for in determining progress towards emission reduction targets set under the act. Nitrogen trifluoride is a potent greenhouse gas that is highly effective at trapping atmospheric heat. Every ton of nitrogen trifluoride emitted into the atmosphere has an equivalent warming potential to 17,200 tonnes of carbon dioxide. Globally, emissions of nitrogen trifluoride are small but rising. In recognition of the impact on climate change, the United Nations Framework Convention on Climate Change has added nitrogen trifluoride to the list of kaiote greenhouse gases for the second kaiote commitment period, which runs from 2013 to 2020, and that should be reported in national inventories. In light of international agreement, Scottish ministers sought advice from the UK Committee on climate change, who advised that it is appropriate that Scotland's contribution to meeting the global climate objective should include domestic nitrogen trifluoride emissions. In the UK, nitrogen trifluoride is emitted in extremely small quantities and its only source is in the semiconductor manufacture industry. The Committee on climate change has advised that at the UK level, emissions of nitrogen trifluoride are currently less than 1,000 tonnes of carbon dioxide equivalent per year, with no significant rises expected to 2050. Inclusion of nitrogen trifluoride in Scotland's accounting will not require any changes to legislated emissions reduction targets. Scottish greenhouse gas emissions data for 2013 will be published in June, and it will include nitrogen trifluoride for the first time, so that order will require those emissions to be included in determining progress towards the targets that are under the Climate Change Scotland Act 2009. Adding nitrogen trifluoride to the list of targeted gases under the Climate Change Scotland Act 2009 will ensure consistency with international agreements, and it is consistent with advice from the UK Committee on climate change, so I commend the Climate Change additional greenhouse gas Scotland order 2015 to the committee, and I'm happy to answer any questions the committee may have. Thank you, minister. Members have any questions? Yes, I think that the minister has kind of answered this, but I just want to be clear. Changes to the baseline, the important baseline, have contributed to our failure to reach the reduction targets that we'd set. Is there any potential or any significant potential in that move, having the same effect, or adding to the problem? No. The emissions of nitrogen trifluoride are estimated using a UK-wide model, and we won't know the level of nitrogen trifluoride emissions in Scotland until the 2013 greenhouse gas emissions data is published in June. However, as I've said in opening remarks, the Committee on Climate Change advises that, at the UK level, emissions of nitrogen trifluoride are currently less than one kiloton of carbon dioxide equivalent per year, with no significant rises expected until 2050. Thank you. Mike Russell. I think that this comes into the category of an unknown, unknown in the Donald Runtsfields categorisation, but I want to ask it anyway. Adding additional gases to the package seems to be unusual. Are there a range of other gases that are being considered, or are there unknown issues that are constantly being thought about? It's a curious thing, but I think that people will be slightly surprised that, at this stage, we will be adding gases to the gases that we're concerned about. I'll just say a bit of background. In its second phase, the Kyoto Protocol limits developed countries' emissions of seven greenhouse gases released by human activities such as carbon dioxide, methane, nitrous oxide and the four types of fluorated gases that have been developed specifically for industrial applications. However, there are certain other industrial gases such as chlorofluorocarbons and hydrochlorofluorocarbons, which contribute to global warming and the depletion of the ozone layer. However, they are not covered by the Kyoto Protocol as they are being phased out under the Montreal Protocol in protecting the ozone layer. In other words, that might be the end of the matter. You can't imagine that there will be other ones added. Are there other gases that are developed for manufacturing purposes? I think that your comment about it being an unknown is very accurate. If we look back at the history of that, when the Kyoto Protocol was first introduced, there was virtually no use of nitrogen trifluoride at all in the semiconductor industry. What happened was that other gases such as the hexafluorethane, which were used, were identified as being potent ozone-depleting substances, and therefore the industry moved towards this other category, nitrogen trifluoride, which did not have that effect on ozone. Now the industry is moving to a different set of gases, elemental fluorine in particular, which has neither of the harmful effects, but yes, at an international level. These are manufactured gases that are then considered to be damaging. In manufacturing new gases, it is not only ozone depletion, but other considerations have taken into account. Anybody else wish to comment? I would ask the minister about the fact that there is clearly being a reassessment made from this discussion just now about the impacts of particular gases, but a recognition of the strengthening in our targeting of methane, an increase in parts per 1,000. I can see from the UK climate change and the UK and the Scottish Government's target lists, would you say therefore that this toughening of the targets opens up the big questions for the creators of those gases and for the industries that use them to be playing a major part in making sure that we do reduce the use of these harmful gases at this time and that that is part of the ways in which the Government will meet the targets that the Parliament set back in 2009? I think that the answer to that simply is yes. You mentioned methane in particular, the global warming potential of that has been uprated from 21 to 25. It is now considered to be 25 times more potent than carbon dioxide. Therefore, we need to look ever more closely at those areas, particularly agriculture and waste management, which are the main methane emitters that contribute to our Scottish inventory. Both of those are areas in which there is already a considerable amount of work being done on. We will look at that ever more closely. There was a debate yesterday on peatlands. One of the issues that we need to look at very closely is that, in the long term, peatland is a very good carbon dioxide emitter, but in the very initial stages of restoration, there is actually a small methane spike, so we need to balance those effects as we consider how we go forward and count the benefits of peatland rewetting. I think that this exchange has been very useful in flagging up that when we come to the RPP, this is a new issue that needs to be on the agenda, partly for business, partly for agriculture. We can really explore that when we get to that point later in the year. It is clearly something that we need to pass. There is more scientific information now and the challenges for us as people scrutinising what the Government does to see how it fits in the Government's challenge, but also more widely for business, industry and agriculture to pick up the fact that we are I think going to pass this today and it becomes another challenge for people in tackling climate change. Indeed, thank you. I do not know if you want to respond or not, but if not, thank you very much. I think that we will move on to agenda item 3 on the debate just now, which would be the consideration of motion S4M 13047 and asking the committee to recommend approval of the affirmative instrument climate change additional greenhouse gas Scotland order draft. We have a lot of time to discuss that if required. However, I hope that probably we may not. I invite the minister to speak and move the motion. I move the motion to recommend that the dry fraud will be approved. I wonder if there are any members who wish to comment. If there are none and the minister does not wish to wind up, no wish to wind up. The question is that motion S4M 13047 in the name of Aileen McLeod be approved. Are we all agreed? We are all agreed, so we will record the result that the committee's report confirms the outcome of the debate. I thank Aileen McLeod and her official. We now move on to future meeting details. At the next meeting of the committee on 13 May, we will consider two negative instruments, the welfare of animals at the time of killing, Scotland amendment regulation 2015, SSI 2015-161, Haud me back, has been said. The common agriculture policy non-IAX support schemes appeals Scotland amendment regulations 2015, SSI 2015-167. The committee will also consider a draft letter to the Scottish Government on mandatory public sector climate reporting. As agreed at the previous meeting, the committee will now move into private session to consider its work programme. I now close the public part of the meeting and ask the public gallery to be cleared.


Welcome to your time talk operation, and this is a presentation about ramen, a platform that will be developed to make education and research in the automotive systems more accessible. The automotive industry can be inaccessible to many people because automotive projects may involve prohibitive costs and be tied to NDAs that not everybody is willing to sign. What we want to propose with this project is an expensive testbed to study and research automotive systems, which is both open source and developed with open source tools so that at least anyone can get access to a good alternative for education and research. The main focus of this testbed is security, but you will see that the usage of the testbed is not limited to security, and I will keep the security talk mostly for the end of the presentation. I will start by giving a short introduction about automotive systems, then I will present the design details of the testbed with various demonstrations and concrete details about its hardware and software. As an example of how the testbed can be used, I will spend some time experimenting with rules control, and by that I mean I will go through the whole development process starting from evaluating differential equations of a simple mechanical model. I will experiment with various control strategies, implement them in C, and make measurements in a driving simulator using early data from the canvas. And I will do all that using early open source tools. This is to demonstrate how the testbed can be used, but also to have a concrete project that I can use as a reference to explain after, what concretely would have been different if we were experimenting with a real electronic control unit. I will also explain how we can get close to automotive hardware and software without signing NDAs. So the second part of the talk is mainly here to give you more information about the automotive industry in case you are not familiar with it. Before I start, let me just clarify that this is not an advertisement, we are not selling anything we present here, and we do not profit financially from it. We are simply sharing design files with permissible licenses and without royalties. Okay, so first let me give you a very quick introduction about automotive systems. You can see a car as a collection of systems divided in four different domains, the parturing domain, which includes the engine and the transmission, the chassis domain, which includes the steering column and suspensions, the body domain, which includes the lights, the doors, and heating, and the input element domain, which includes navigation and connectivity. Many of the different systems that can be found in a car are controlled by electronic control units or ECUs or short. There are many kinds of ECUs in the car, sometimes hundreds of them, and usually they are not hard to understand. They have a limited number of inputs, generally data from sensors and actuators, and they have a limited number of outputs, generally to control actuators. So for example, an airbag ECU may use an accelerometer as its input, and an airbag trigger as its output. The role of the ECU will be to use data from the accelerometer to detect a shock and output a signal at its actuator to detonate an airbag when a shock is detected. It is very common for ECUs to need data from other ECUs. Most of the time, ECUs, we need to share data with other ECUs on the same domain. In the case of an automatic car, for example, the transmission of proper units needs input from the engine ECU to determine the current gear. If that data is critical, that connection may even be redundant. ECUs may also need to communicate with ECUs on a different domain. For example, the brake system, usually the chassis domain, we need to communicate its state to the stockman, usually in the body domain. Most of the time, the technology that is used for communication is CAN. And CAN technology uses a burst topology, which means a CAN message will be received by all ECUs on the same CAN bus. There is no authentication or encryption at the link layer, so any message can be sent by any ECU, and security features need to be implemented at higher layers. A startup CAN frame consists mainly of an arbitration ID of 11 bits and a payload of 8 bytes. CAN HD is a recent evolution of CAN, where the payload size may be extended up to 64 bytes. For an ECU network, manufacturers will assign a meaning to each arbitration ID and each bit in their payload. The file that determines the traffic on the CAN bus is often referred to as a DBC file. For example, assuming a long controller and two lamps on the CAN bus, the manufacturer may decide that ID123 is used by the long controller to communicate the command of both lamps, that ID124 is used by the left lamp to give feedback about the status, and that ID125 is used by the right lamp to give feedback about its status. Each of those messages will be broadcasted periodically by the assigned ECU on the CAN bus and will serve as the basis for most data exchange between ECUs. So that is for the introduction. There are many reasons why people may be interested in auto-test systems and ECU networks. The activity that gets by far the most attention from the media is vulnerability research, but there are also other reasons. For example, owners may want to check their class compliance with regulations, such as emissions regulations and privacy regulations, for example, GDPR. Other owners may want to exercise their rights to RIPR if they are guaranteed by the countries they live in. And finally, some owners may want to experiment and innovate with DIY features, or simply satisfy their curiosity and educate others. And while those may be valid reasons to experiment with a car, manufacturers are typically against people tinkering with a car because they may be worried about their intellectual property being stolen, about vulnerabilities being exploited, or people hurting themselves and others while tinkering. And what probably suffers the most from this delicate situation is education and research in automotive security because people cannot easily get access to safe equipment or access to the information that they would need. In the long term, this may mean that manufacturers will have less security technologies to choose from to secure their cars, and that less talents will be available to develop and evaluate them. And the development, of course, involves many people from many companies, so it is important to make sure that everyone involved is competent in automotive security. And some people are pushing for more open-sourcing cars and who knows, maybe one day a car will be 100% open source, but if it happens, it is going to take a long time. And manufacturers themselves do not have access to 100% of the source code of the cars they make because ECUs contain intellectual property from other companies. So this is mostly a political topic, so there is not much we can contribute to as researchers. However, one way we can contribute technically right now is to try the other way around and use what is publicly available to make it accessible to learn and research automotive systems. And that is what we try to do with Raven, which is a topic of this presentation. The objective is to provide a platform for research that is open and by that we mean it should be easy to modify the source code and reprogram the ECUs. Accessible and by that we mean inexpensive, small and requiring no prior skills in automotive systems, safe with no risk of accidents or legal repercussions, and motivating, something that you can interact with. So that you get the same kind of experience as you do when you experiment with a real car. So there are already some solutions available if you want to experiment with an EC network, besides, of course, a real car. So the first one is making your own test bed from real ECUs. So we can see many hackers sharing that test bed at security conferences. And usually if you see something like this, you stop and you immediately get interested. So it is a nice way to motivate people to learn. Unfortunately, those are not easy to reprogram because manufacturers do not share information about the ECUs, and they require a lot of skills to build. So it's not accessible to everyone. Another option is to use development boards, such as Arduino. And that is what you can see mostly on academic papers. They have the advantage of being reproducible and you can modify the source code as you want. So they can be used in many cases for research, but they lack many safety features for open phone and actual ECU hardware and software. Even if you are able to simulate a CAN bus, you don't get the same level of direction as you do with a car. So it's not something that motivates people and makes them want to learn more. And the third option is to use a professional test bed, such as Pasta, another work from our team. This is a good option because you get access to the source code and you can reprogram the ECUs and the CAN bus network is already simulating a full car. So the groundwork is already done. It's a major drawback, so that it is very expensive. So it is not accessible to everyone. So there are some options to study and research automotive systems, but none of them seem to be both accessible and motivating at the same time. So many people don't even think of learning about automotive systems because it never occurred to them that they could like it. And in comparison with other industries, you have so many ways to get started. If you want to learn about Linux, you can start with a Raspberry Pi. If you want to learn about electronics, you can start with an Arduino and so on. So we wanted some things that would give a similar experience, but for automotive systems. So we noticed that most of the test beds that people are using to experiment with ECUs are made of four ECUs. So the ECUs are often communicating with each other using a CAN bus. So we tried to fit all that in a ECB, the size of a credit card, and we named that PCB ramen. It features four ECUs connected over a CAN bus which is accessible from outside by your terminal block. One of the ECUs is also connected to connect to USB, which is also the power supply. Pins sockets can be used to connect sensors, actuators, and additional hardware. And the port features many probes to easily access important electric signals. The four ECUs simulate a CAN network with messages identical to pasta. The name ramen is obviously a reference to pasta because it is a cheap alternative, mostly aimed at students. In real course, CAN messages typically have different payload sizes, but by default we operate with maximum payload size to demonstrate heavy traffic. So the basic format is like this, arbitration ID, two bytes of the data, two bytes for a counter, and four bytes of additional data, random data used as a placeholder for additional data such as checksum or MAC. You can easily modify the CAN messages arbitration ID in format, and here we are assuming a full by-wire vehicle, which means all physical functions of a car are accessible to the CAN bus, which is usually not the case on current cars. The block diagram of ramen looks like this, and as I explained earlier, all ECUs are periodically exchanging messages on the CAN bus. If you connect a CAN adapter and have a look at the traffic, it will typically look like this. So the port itself is enough to simulate an EC network, but it does not look very motivating. What we wanted on top of this was some sensors and actuators to make it more interactive. So we created four expansion boards for sensors and actuators to simulate the infotainment domain we simply use a screen. For the body domain, we use an engine key and some LEDs. For the chassis domain, we mainly use a slide switch to simulate the side brake and a rotating potentiometer to simulate the steering wheel. And for the powertrain domain, we use slide potentiometers for the brake and accelerator, and a joystick for the shift lever. The EC connected to USB implements a standard CAN or KFD interface, either over a standard serial port using SL CAN or over a native interface on Linux, thanks to the Kondalight firmware projects. If you connect the port to USB ports on a computer, it should be recognized as a USB to CAN adapter. So it is not necessary to own an external CAN adapter to get started. This is a little more of what it looks like to use ramen. Just connect it over USB if you use Linux. You can get it to be recognized as a standard CAN network interface. So it will show up in this config. Then you can use various tools available on Linux to observe the traffic. For example, CAN sniffer. Here you can see the traffic explained earlier, the CAN IDs on the left, and the payload on the right. So with this, we can simulate an EC network with sensors and actuators that is enough for basic interactions, but it still does not feel like you are actually experimenting with a car. Ideally, the ECU should be performing realistic ECU functions, not just lighting up LEDs based on some switches and potentiometers. And for this, we thought that the connection in a closed loop with an open source driving simulator would be an affordable and safe solution to feel like you are driving the ECU network. Fortunately, there is a great open source driving simulator for autonomous driving research. It is called Cora. It features a Python API which is very easy to interact with it. And it also comes with an example central algorithm. So you can immediately start experimenting with a virtual safe driving car. So we wrote some scripts so that most sensors value, for example, speed and altitude would be simulated on the computer running car then broadcasted on the canvas. On the other side, we made it so that all controls of car such as throttle, steering, and brakes would be decided by the ECU network. And this is what you could refer to as hails or hardware in the loop simulation in the automotive industry. Ramen is not as advanced as professional tools but at least it is accessible. So to achieve manual control, it is not complicated with Cora. On the manual control example provided with the API, there is a wide true game loop that reads events of the keyboard, applies controls, then updates the physics simulation. So Cora does not simulate a canvas by default. So we created a Python class to easily interact with the canvas using the canvas as a specification of Ramen. To integrate it with Cora, we just need to replace keyboard controls with accurate control data read from the canvas. To close the loop, we broadcast sensor data using CAD messages based on data retrieved from the Python API of the physics simulator. Every piece we're able to control the car manually is the potentiometers on the board. Here, identity press accelerator, release the handbrake, and I can control the car using the steering wheel as the expansion board. So manual control is nice but automatic control is better because ultimately we want to focus on working on the canvas. So on the original Cora project, there is also an example script for automatic control. Again, there is a wide true loop where the code basically simulates the physics, lets the server in AI make a decision, then applies the controls to the physics simulation. To integrate Ramen with the server algorithm, again, we need to replace the applied control part with the controls from the EC network. We also need to send CAD messages with sensor data retrieved from the Python API of the physics simulation that is identical to having manual control. What we need to do more is also send message to broadcast the status of the AI to the EC network. So that the EC network knows what controls the AI algorithm is requesting. So periodically, the AI will broadcast its status by sending messages over USB, which are converted into CAD messages by the EC connected to USB. All ECUs on the network will receive those messages and will decide the actual controls of the car based on their own algorithm. For example, the partner ECU may decide to apply breaks depending on the highest value between the AI breaks and the break potentiometer. All ECUs will receive the CAD message that applies the control. Some ECUs may filter that message if they do not need it. Some ECUs, like the body ECU, may process it and take action. For example, if the breaks are engaged, the body ECU will light up the stop lamp on the expression board. Finally, the ECU connected to USB will forward the break controls to the simulator that will apply the breaks in the physics simulation. So this is what it actually looks like. All I need to do again is release the handbrake and the car will drive itself. So the car is controlled by the EC network. So when the car stops in the simulation, it is because the controls were applied as a pro-trail ECU. You can see that the stop lamp lights up because the body ECU also received and processed the break CAD message. Since the ECU is in charge of the controls, I can force the car to stop anytime by forcing breaks of the pro-trail ECU potentiometer. So if you connect an external CAD adapter to the CAN bus, you will be able to send and receive messages. So using Raman, you can experiment with the CAN bus of a self-driving virtual car. When you want to reprogram an ECU, in the real world, you have two options. Either you interact with the hardware bootloader as the ECU's microcontroller, which depends on the microcontroller's model and manufacturer, or you interact with diagnostics and calibration software, which depends on the car model and manufacturer. Diagnostic and calibration are often done on the CAN bus, but other options may be available. Protocols are defined by standard documents. You often hear about UDS and OBD2, which both rely on the same transport layer IsoTP, but there are also other protocols, such as Keyword Protocol 2000 or XCP. All those protocols can often also be implemented over other layers. For the hardware bootloaders, it depends on the microcontroller manufacturer. For example, for an XTM32 microcontroller, you can reprogram the firmware by interacting over CAN, according to the application note 3154. Over USB, according to the application note 3156, are using other protocols defined in other application notes. In the case of RAMEN, we use the hardware bootloader to reprogram the ECU's, and we can also use the UDS protocol over CAN. And in the future, we may consider adding XCP and KWP 2000. How to reprogram an ECU using calibration and diagnostic software is a topic that is already heavily discussed at automotive security talks, so I will not spend time on this topic. You can find the definition of the standards online. Usually, you need to pay for them, but you can also find summaries for free on some websites. For example, Wikipedia. What is more interesting to discuss here is the hardware bootloader. The various ways to force a microcontroller into bootloader mode are described in the application note 2606. The format of CAN messages you need to send to interact with the bootloader is defined in the application note 3154, and it's not complicated. The format is simply command byte plus argument, all that within the same CAN message payload. So we wrote some script to make it easier to interact with the bootloader. So here I am showing the script that we used to interact with the bootloader. First thing I do is retrieve all information from the bootloader, including the version, to supported commands, and the chip ID. I then use the read memory command to dump all known sections of memories. This includes the ECU firmware. So it can be a good start to start experimenting with reverse engineering. You can also activate memory without protection and see what happens when you try to dump the memory again. And in this case, it's not allowing memory dumps anymore. You can remove the memory protection, which will wipe out the memory. And after you do that, you can use the bootloader to reprogram the ECUs. For the hardware, we also designed additional expansion boards with various features. First one is an expansion to connect a JTAG debugger. Second one is a board to add external quad-SPA memories, which are SYC packages, such as EEPROM, F-RAM, FlashNOR, NAN, S-RAM, and so on. The third one is a board to add a trusted platform module. And the last one is an interface to easily connect a chip whisperer. All those expansions are compatible with each other, so you can stack them and create a very advanced EC network with all ECUs between a TPM and one gigabit of memory. And it looks better when many expansions are stacked on top of each other. Since we would like to use Raman for education, we try to vary the type of electrical signals used in the expansions. And we added many external probes to easily connect external tools. You can use one of the many external probes to connect an oscilloscope and have a look at analog signals. For example, here's a bright potentiometer. Or connect a logic analyzer and have a look at digital signals. For example, to analyze SPI communication between the ECU and the screen. For the hardware design, we kept it simple, using only two layers and keeping all components on the same side. We designed the hardware with large tolerances so it should be easy to produce with most PCB fabrication services. We used components with large size, so if you have some skills in soldering, you should be able to solder one yourself. We designed the hardware using PCAD, which is an open source tool for designing hardware. You can easily modify the schematics layout and even generate nice PD views. So firmware is designed using STM32 cube ID. It is accessible to beginners and you can easily reconfigure peripherals and clocks from the graphical interface. You will even get some statistics such as estimated power consumption. But of course, you do not need to use the graphical interface in libraries if you would rather program everything yourself by interacting directly with registers. We use FreeRcast as a real-time operating system. The basic software of ECUs has several tasks running in parallel, one for receiving messages, one for sending messages and several periodic tasks to take care of the ECU control loops. Those tasks receive data from different interrupt services within, using queues and DM memory overrides. The task can also exchange data between each browser using queues or memory overrides. Again, to keep the project accessible to beginners, we did the OS configuration using the graphical interface where you can see all tasks as a configuration, for example, the priority. You can add or remove interrupts and you can also configure the values queues and memory. There is still a lot of memory left and then even on the memory controller with less performances. So you can easily add your own application on double this. All that's all for the hardware and software section. You can find more details on GitHub. I would like to move to the next section now and show you a usage example. There are usually two patterns for people working in automotive security. Either there are automotive engineers who run about security or there are security engineers who run about automotive systems. Since this is a security conference and I assume most people do not need me to explain how the platform can be used to study and research basic security topics, I will focus on the automotive side. The diagnostics and calibration topic is already covered by many security talks so I will not spend time on this. So I will spend time on something that is not often mentioned in security conferences, control algorithms and safety critical hardware and software. And for this, I would like to demonstrate the design of the PID controller for cruise control as an example. I will show you how being knowledgeable in control systems may be relevant to security engineers and how many of the activities that are done by engineers in the automotive industry can also be simulated using open source tools including ramen. Once we have an implementation in C that works, I will then use it as a reference to talk about safety critical systems and the differences with real ECU hardware and software. So let's get started. Cruise control is very simple. When a human is controlling the portal with the accelerator pedal, depending on the skill that the car may have an available speed, what we want is an ECU that optimizes the control of the throttle so that we can maintain a steady speed. An automatic car can be very easy to model. If you press the accelerator pedal which opens the throttle, it will get speed out of your car. But the relationship between speed and throttle is not as simple as a multiplication. Now, we have to follow the laws of dynamics. In this case, that's a sum of forces on the car is equal to its mass times its acceleration. We can consider that there is a force pushing the car that is proportional to the throttle and that there is an opposing force proportional to the speed due to friction. When we solve this differential equation, what we expect to see is the speed to follow an exponential curve. And a simple way to control the speed that may come to your mind is open look control. We make some measurements on a flat road of the relationship between throttle and maximum speed and you keep it in a lookup table. When the user asks the ECU to reach a certain speed, the ECU can use the lookup table to find what throttle control should be applied based on path measurements. And this may work in some situations but according to the laws of dynamics, as soon as we reach an upward slope, the car will lose speed because of gravity. So at least that is what we expect but we should verify that on the canvas. This is something we can use random for. Here, I am using an external can adapter connected to a second PC. On that PC, I simply receive data from the physical canvas. For the rest of the section, I will only be modifying the firmware on the portrait ECU. I will not change the simulator, I will not even reboot it. So in the simulator, I drove around in the city to find a nice place to experiment. More precisely, I looked for a place with a flat road followed by an upward slope. Then I programmed the portrait ECU to apply a constant throttle, which is only one line of code. And after reprogramming the ECU, I left the car drive straight and I recorded data from the canvas. I use an open source tool for canvas analysis called Bus Master. Bus Masters allows you to load DVC files or to input manually the format of your canvas. Here, I simply told Bus Master what were the kind of application ideas of the throttle control message and the speed sensor message and what was the format of the payload. Once I do that, I can pull the evolution of the throttle and speed over time. And the results we get are exactly what we expected from our differential equations. So speed of the vehicle is following an exponential curve and as soon as we reach the upward slope, we start using speed because the throttle is constant. There are some notes and non-linearities at low speed, but overall it seems our model of the car is correct. We are approaching the problem correctly. What we can see here is that it takes around 40 seconds for one test drive. And 40 seconds, it's already too long. So before testing the ECU in the driving simulator, we want to use a software that can simulate differential equations so that we can see the impact of the cruise control algorithm directly without having to wait 40 seconds. Most of the time, this is done using a professional tool such as MacLab or Simulik, MacLab and Simulik, but here we will use the open-source tool SyLab. It has a graphical interface where we can connect inputs and outputs from a block diagram. Differential equations are a bit hard to deal with because the relationship between inputs and outputs is complicated. What you typically do in control theory is use the Laplace transform, which will change the variable from time t to a complex number called s. This may be complicated with our control theory background, but you just need to know that a differentiation is equivalent to a multiplication by s and that an integration is equivalent to a division by s. And our system is easier to model with the Laplace transform because we now have a simple relationship between spotter and speed. Speed equals transfer function of car times spotter. And based on the measurement from the canvas, we can evaluate the transfer function of the car to be equal to approximately one over one plus four s. We can simulate the car in SyLab by using a block function which has the exact same transfer function. Using SyLab, we can notice various scenarios and get the results immediately. Here I am testing the scenario in which we start from zero speed, apply a constant throttle, and after 20 seconds we add a new force, gravity, which corresponds to the slope. And this is what we call here the disturbance. And with SyLab simulation, we can verify we get waveforms similar to our measurements on the canvas. With a constant throttle, the speed follows an exponential curve that is close to maximum speed after around 14 seconds. And as soon as there is a disturbance, the gravity here showing green, we can check that the car loses speed because there is no reaction from the throttle. So to fix that, the solution is obvious. The ECUs need to have feedback. We need the ECU to make use of the speed sensor data that it can find on the canvas so that it can adapt the throttle to the actual speed of the vehicle. The first solution that may come to mind to software engineers is bang-bang control. Bang-bang control is quite simple. You measure the speed and if it is above a certain threshold, you stop applying the throttle. If it goes below a certain threshold, you apply the throttle again. This is extremely easy to implement in C on the ECU. And once we reprogram the ECU, the ECU on runway, we can make measurements on the canvas and verify that this time we are not losing speed anymore when we reach a slope. But as you can see, there are some oscillations. And as you can imagine, the oscillations are not something very nice for passengers. Apparently, people driving like this is the reason cruise control was invented. I did not know that story is true, but I can't believe it. So bang-bang control may be a good start, but it is not good enough for cruise control. And the most famous algorithm used in control theory is a PID controller. You can find a lot of resources online. A PID controller is one of the control mechanisms used in software with the central AI of KARA. In the PID controller, you measure the difference between the target speed and the current speed. You call that difference the error. And you can control the throttle using the sum of three control blocks. The error multiplied by Kp, the integral of the error multiplied by Ki, and the derivative of the error multiplied by Kd. Kp, Ki, and Kd are constants called gains. And you need to have a very fine tuning of those gains to achieve optimal control. Here, I can simulate the Kd controller using SIDA with different blocks. Remember that the division by S is an integration and the notification by S is a derivation. Thanks to the simulation, I am able to try many values without having to actually drive the car. And when we are able to find correct values, when we are able to find correct values for the PID controller, we get this. So ECU is able to reach a target speed quickly without oscillations and without overshooting the maximum speed. And when there is a disturbance to gravity, it will dynamically add up the controls of the throttle so that the target speed will maintain. So this is good because this is what we want for a cruise control. But if the gain of only one control block isn't correct, the speed of the vehicle may look like something totally different, potentially dangerous. And this is why the integrity of calibration data is important, not only from a safety point of view, but also from a security point of view because an attacker should not be able to make an ECU have a dangerous behavior with only one small change. And last thing I need to explain is how to implement this algorithm in C. And this is not obvious because we are dealing with integration and derivations which are not possible for digital functions. So there are many ways to implement this in a digital PID controller in C. I will just explain two approaches. The first approach is to stay in the time domain and approximate the derivation by the difference between two successive errors divided by the sampling time. And we can approximate the integral operation with a Riemann sum, which is a running sum of errors so far multiplied by the sampling time. This may look a bit intimidating, but when you look at it closely, you can see it is just a combination of constants and values that can be computed from current and past tense of values from the canvas. So actual implementation in C looks like this. We need to define two variables, one to store the surrounding sum of errors and one to store the error from the previous control loop execution. In the control loop, we define constant gains for each stage. We compute the current error. We add the error to the sum of all errors. We compute the difference between current errors and previous error. We then add all those value with that respective gain to the output variable and we clone that output in case it goes out of bound. We then apply the total control and save the current error in the previous error variable for use in the next iteration. The second approach is to use the Laplace transform of the PID controller. We first need to convert it to a Z transform, the equivalent of Laplace transform, but for digital signals. It looks a bit complicated, but there are many tools to do the conversion for you. If you want to do the conversion by hand, one way is to use the binary binary transformation, in which you replace S by this. To approximate the Z transform of your ECU. And again, this may all look a bit intimidating, but you can actually compute the total output by using the total output from two iterations ago, the current error, the previous error and the error before that, which can all be computed from sensor values on the canvas. And while this control algorithm is equivalent to our previous implementation, it looks totally different. And what I would like to stress here is that identical control algorithm may have very different software implementations, which may be relevant for reverse engineers. I only show the first implementation not waste time, but you can see now that the ECU in ramen is able to make the car maintain a constant speed if a dynamic control of the throttle. So that's it for the example. I just wanted to show that ramen can be used for realistic activities on the canvas, and that the ECUs are not just doing some random easy work. The control theory part may be complicated, and if that was going too fast for you, at least I hope it proves there is a lot of things to discover and experiment with, and that all that learning can be done with open source tools. Now I would like to discuss what would have been different with ECUs, because as you can imagine, the actual ECU software is not as simple as this. I will also show you what technologies we have, technologies hidden behind NDAs, so that we can get as close as we can to real ECUs. We show that ramen in ramen that this cruise control ECU worked, but we only tried it on a single scenario, namely a flat road followed by an upward slope. But what about the scenario in which a car in front is driving slowly? Or what about the scenario in which we are in a downward slope? In this case, the ECU will not be able to prevent the car from going too fast because it does not have access to the brakes, which could lead to an accident. And the difficult problem here is not whether you can think of one more scenario. The difficult problem is, can you think of them all? And are you sure? And thinking of all dangerous scenarios, quantifying the risk and implementing contravengers is what makes automotive systems really different. And to prove that an ECU is reasonably safe, you ideally need to follow ISO 262 standard, which is a standard for functional safety. The standard safety, the standard defines different requirements at many levels. Not all ECUs are equally critical, so safety relevant ECUs are assigned an automotive safety integrity level or ACL for shots. And ACLA is the less critical level, and SLD is the most critical level. So if you were to design a real cruise control ECU for use in a real car, you could not just connect some random ECU to the canvas and try it on the highway. You will need to go through a lot of analysis, just such as hazard, error, FMEA, STPA, and so on. Usually there are so many requirements that it cannot be tracked with only a human and a sheet of paper. They are managed using dedicated tools such as rational doors. So let's discuss how the software will be different. The main contribution of automotive software is to realize control algorithm safely. But without countermeasures, many things could go wrong. For example, there could be bugs in the ECU application code. And then without any bug, the software may not be robust enough when there are transient errors in the hardware. There could also be problems with the tool chains that compare to firmware, and problems with the libraries and RTOS. And when we have a close look at the PID controller implementation, which seemed good enough in our testing, you can see it is actually a terabyte implementation. We are mixing integers and unsigned integers and floats before proper checks and typecasting. We are not checking for overflows and other random software issues. And this is not acceptable above for safety and security. And in this case, the problems were obvious on purpose, but sometimes it can be very hard to spot because they stand from very subtle computing issues. And those issues may lead to system failures. So to avoid such scenarios, the automotive industry usually mandates the use of a language subset, which restricts what developers can do, but make sure that numerical errors are less likely to happen. So usually, usually in the automotive industry, the start of this use is MISRACI. And it is very similar to SIRT-C, which is popular in the safety industry. Using a language subset is only one of the requirements that are dictated by ISO 26262. So many other requirements at a high level, they try to enforce a low complexity of the software. For example, by restricting the size of components, restricting the coupling between software components and making sure the scheduling is appropriate. And that's not too many interrupts. But they also have more concrete requirements, such as restricting functions to one entry and one exit point, forbid dynamic memory, avoid global variables, limit the use of pointers, and so on. The other issues we have to deal with, which is additive to bugs, is transient errors. In a harsh environment, data is not always reliable. There may be bitflips occurring outside of memory, for example, because of noise and communication lines, but there may also be bitflips occurring inside of macro-controllers' memory, for example, because of cosmic rays. Those issues do not originate from software, they originate from hardware, but they do need to be addressed by software, because, remember, in the case of the example cruise control ECU, just one bitflip could lead to unwanted behavior of the ECU on the car. So to address these issues, automatic micro-controllers need special control measures, for example, having redundant memory or having redundant CPUs. In ECUs, you will typically find micro-controllers that have been designed specially for automotive use. All those micro-controllers require you to sign an NDA, so you cannot just buy them and start programming them. So that makes it a bit hard to study an actual ECU microcontroller and read automotive software, but ISO 26262 is not the only standard for safety-critical systems. ISO 26262 is actually derived from IEC 61508, so they are both similar in their concepts. And IEC 61508 microcontrollers, they do not require NDAs for most other activities you may be interested in. And more concretely, Raven can be used with STM32L4 or STM32L5 microcontrollers. And for those microcontrollers, you do not need an NDA to download guidelines on how to implement safe software. For example, you can find a list of features that are required for safety applications. And you can request more data that you would need to actually achieve compliance with IEC 61508, such as the FMEA and FMEDA. But to obtain those data, you would need to sign an NDA. No, I personally do not think that those data are essential for education and research. So using such microcontrollers is a good alternative. But again, let me stress that this is an attempt for learning and researching, not for actual use in the car. I don't have time to detail all the safety features. Let me just talk about memory redundancy since this one impacts the code of the application of the example cruise control EC. So in this example, we wrote the gain of each stage in code memory, defining them as constants. For a safer application, they should not be here. They belong to another section, the data flash where ECC protection can be activated. If possible, calibration data should be stored twice with text sums and preferably max. If you are not familiar with ECC memory, it is a kind of memory that can detect B-flips and sometimes automatically correct them. But not that memory is also available for the RAM, but not that hard addresses. So in the application, we have to ensure that safety critical variables are placed in a section of RAM in which B-flips can be detected. In this case, in section S1-2. For data in RAM that are actually constant, such as the gains, you may also want to activate write protection, a feature that is only available in S1-2. Okay, last slide about software. In the example cruise control, we are using GCC tool chain. In ISO 26262, it is a requirement to have what is called a tool confidence level to ensure that tool chains will not introduce errors, as it could be the case with some optimizations. So normally you could not use GCC. Real-time operating systems and libraries may also have problems, that is why they need to be certified. Both STM32-HAL and free RTOS are compliant with Biswasi, which is nice, but they are not compliant with ISO 262. However, it looks like ST is breaking all zero RTOS into the ecosystem, and that one is actually pre-certified ISO 26262. So maybe in the future, it would be an option to experiment with an actual ISO 26262 operating system. So now let's talk a bit about hardware. In case it was not clear to you, you cannot use commercial electronics to implement an ECU. Smartphone vendors will often warn you why not to let a device in your car, because a parked car can reach extreme temperatures that commercial electronics are not designed to resist. And if you think that the life inside the cabin is hard, you should think about an ECU, which has to stay in the engine compartment and operate without failures. And you would not think of putting a smartphone on an Arduino here and trust your life with it. And extreme temperatures are just one of the many environmental factors that make it difficult for an ECU to stay reliable. The ECU also needs to resist high humidity, corrosive gases, vibrations, microcuts, load dumps, electrostatic discharges, electromagnetic noise, and so on. And when subjected to such a harsh environment, many things could go wrong with electronics, you probably know about corrections, but many other physical phenomena are at risk of happening to the components. Solder cracks, incalmetallic growth, whiskers, dendrites, electron migration, et cetera. For example, whiskers are metal growing out of electrical components, and dendrites are metal leaving the plus side towards the minus side. And many other phenomena may result in a dangerous failure. So obviously, ECUs need to be designed to resist harsh environments and hard contra-measures against all those potential failures. ECUs need to pass various tests that simulate harsh environments. Those tests are usually defined by manufacturers and the test specifications are not made public. What is made public, however, is the test specifications for individual electronic components. And those tests are usually defined by AC, so the automotive electronic console. And you can have a look at them online. For RAMEN, we try to follow design daylights similar to those of real ECUs, but of course we cannot follow actual rules as it would be much less accessible. Completely, we selected AC-Q100 grade zero components for everything except collectors and microcontrollers because those may require NDA or not be easily accessible. Depending on the part reference, ECU microcontrollers may be usable from minus 40 to 125 degrees. RAMEN tried to stay close to automotive grade, but it is still not automotive grade, especially in the reliability department, so it can't be used as a real ECU. And the reason we try to stay close to automotive hardware is to help researchers evaluate the impact of manufacturing tolerances and environments because remember, manufacturers are making millions, of course, then need to operate on a large operator range. So if you are developing, for example, a security technology that relies on hardware characteristics such as the clocks of the ECUs, you will need to prove that the technology works despite manufacturing tolerances and harsh environments. And with RAMEN, it is easy to have a large sample of ECU networks and since they are small, they can easily fit in various testing equipment. And now let's move on to the last section, security. So in the automotive industry, you just cannot apply the same reasoning as you do in many other industries. For example, a credit card, if it detects the temperature is too cold, it may think that it is a tampering attack and decide to shut down because it is not safely critical. On the other hand, a card needs to start quickly because the user should not be left out in the cold. And also credit cards have an expiration date, so they do not need to guarantee security for more than a few years, but cards do not have an expiration date. If they are well maintained, they may be used for several decades and the security technologies should keep on working. So in the end, automotive security technologies have different requirements. Unfortunately, according to past research, a security technology is often less reliable when you extend its operating temperature range and its lifetime. For example, at low temperatures, you may become vulnerable to cold boot attacks. At high temperatures, it has also been shown that electrolytes tend to be less reliable concerning glitching attacks and in those papers, high temperature means something like 60 degrees or 100 degrees Celsius. Far from the maximum temperature, we call it for some ECUs. Also, it has been shown that the higher age for electronics usually results in different security properties. And you may think that the safety features of automotive microcontrollers will prevent some attacks such as glitching attacks, but it has been shown that ECC memories are also susceptible to glitching attacks and that even ISO 2662-ACLT microcontrollers is the highest level of safety may be susceptible to glitching. So safety features often help, but they are really enough to ensure security. What is also different with automotive is what you need to rethink your strategy in case of security problems. For example, with credit cards, it is not uncommon for authentication to fail randomly. When a credit card fails to work, usually you just need to try once more and it will probably work. And even if it fails again, no light is at risk. But the card cannot have the same strategy. If you add authentication to the can break, if you add authentication to the break can message and you start receiving break request messages that fail authentication, what should the card really do? Should the card really do? Because it may be a cyber attack which you want to avoid, but you should not rule out the possibility of a random malfunction or a false positive for an intrusion detection system. And by adding complexity into the system, you always increase the odds of a problem. And which one would be worse between breaking because of a cyber attack or not breaking because of a malfunction? And there is no easy way to answer that question, but what I want to stress here is that many security countermeasures that people suggest for car, such as encrypting the canvas, permanently disabling debug ports or obfuscating the firmware, they may not necessarily be the best ideas because if you suspect a malfunction with an ECU, you need to investigate the problem seriously because it may harm people. You cannot just replace the car as you would with your credit card or a smartphone. So technologies that can truly take into account both automotive requirements and security requirements are better and we should make sure that education and research in these areas are accessible to many researchers without NDAs or prohibitive costs. Now, of course, you can use ramen to try out different attacks. The first obvious one is to inject messages to alter the behavior of the car. Here, for example, the brakes. Another kind of security that I did not mention in this presentation is physical security for sensors and actuators. Here, I am demonstrating what happens when I overtake the control of the steering wheel actuator. A human will probably brake in this situation. The state driving algorithm in CARLA here does not realize it has lost control of the steering wheel and it is still trying to correct the trajectory when a better decision will be to stop the car. So this is the end of the presentation. We developed an inexpensive, safe and interactive platform to study and research automotive systems. The platform is accessible to beginners. It is not automotive grade but it is close enough for research and educational purposes. The project is open source and with permissive licenses. If you have questions or ideas, do not hesitate to contact us, especially if you are involved with education, research, trainings, CTF, et cetera. And thank you for watching. Camille, thanks for this comprehensive talk. This was amazing. We unfortunately don't have much time for your question and answers, but there's one question that popped up which is about the hardware and your PCB. How did you design it? How much does it cost actually? How can you get actually hold of that thing? Yes, so I designed everything with KiCad. And I mean, I think a few years ago, it was very hard to design hardware, but now you have footprint libraries available online. It has become very easy. So BOM was between 50 to 100 euros for a quantity of one. The microcontrollers are obviously the expensive parts. And the PCB and assembling part, it is up to the PCB fabrication service. If you have questions, just ask me on GitHub. I will be happy to answer.