תודה רבה ניסים. ניסים נכון, ובאיינתן, אני חייבה שאני עשיתי על פורטי, ואני לא נשמע שם, אבל לא הרבה. אז אני usually give this talk in front of molecular biologists, biochemists, sometimes cancer specialists, but never before mathematicians or philosophers ולכן לפני סיסטון ביולוגיה ובאינפורמטציה, אז אני חושב שאולי אני מבחינסים טובים. אז כשאתה יכול לבין, אני מבחינס קצת קצת. עוד אוטיזם, כשאנחנו already עוד פשוטים, אני חושב שזה קצת קצת קצת קצת קצת קצת. אז אני חושב שזה קצת קצת קצת קצת, ואני עוד פשוט, אני עוד פשוט, שזה פשוט שייתה, שאנחנו לא נתפליש עד. אז אנחנו נראה איך זה ידעה. אז כשזה מה ניסים הולדה, כשאנחנו נשארים, אני נשאר את זה 4 דקה כך, To try to find out which is the protein, this was part of my post-do, which is the protein that binds here to this very unusual structure that was discovered in 1975, more than 40 years ago, that was called the cap. It was called the cap because it was the first nucleotide at the 5-prime end of the mRNA, so it's a cap for the mRNA, very unusual. It's a 7-metal G that is linked to the rest of the messenger RNA that is going this way via a 5-prime to 5-prime triphosphate bridge, which is very unusual. Again, all along the messenger RNA, the bases are connected via the ribals in a 3-prime to 5-prime phosphodiester bond. So, of course, this was the first question that came up. How does it work? And it asked to usually everything works through protein, what's the protein? So I purified this protein. This doesn't work. So I did this experiment that turned out to be, you see it was published here in 1978, so exactly 40 years ago, and it turned out to be the best experiment I ever... It works.  So this is the best experiment that I did in my life, and this is cross-linking a labeled cap to a mixture of protein in the cell, just a cell mixture, and see what cross-links specifically. And I got a very good advice from an excellent chemist, Charlie Cantor, without him, I wouldn't have been able to do it. It's using sodium cyanobuara highlight to stabilize the bond, the shift bond. And basically what we found, I found is that there is a protein here, we call it later EIFOE. Is that cross-link specifically to the cap?  So of course the next step was to purify it, and then later it was called EIFOE, standing for eukaryotic initiation factor 4E. So there are many initiation factors that are involved in recruiting the ribosome to the messenger RNA. There are 13 of them, many of them are multi-subunits, so there are at least 40 different polypeptides associated, maybe not as complex as transcription, but still complex, sufficiently complex to make life difficult. But this one behaves in a very clear way, it recognizes the cap structure, but it's not by itself, it's in a complex. And the complex is rather stable complex, consists of EIFOG, which is a scaffolding protein, and which binds the EIFOE, the cap-binding protein, and another protein EIFOE, which is a helicase, which unwinds the secondary structure of the messenger RNA in the 5-prime-mount translated region. That's very important in order to enable the ribosome to move and get to that initiation column. So this is a simplified model because there are many other proteins involved assisting in this. There is an EIFOB, EIFO-Rage, et cetera. But this is the core mechanism of all this process. Once you have the unwinding, then the ribosome can bind and then continue with the translation, basically what we have is an ordered process here is the messenger RNA. This is here the AUG, where you start a translation making the protein. Sometimes this is very long, it could be about 3,000 nucleotides. And you have this interaction of the EIFOF or the EIFOE. This recruits now another factor, which is EIF3, a multi-subunit. This recruits now the ribosome, the small subunit with other factors. Only one of them is shown here, a ternary complex which brings the MET-TRNA. And all this big complex that assembled here at the end of the messenger RNA has to now scan or traverse the 5-prime-UTR to reach here the AUG and then the 60S joins the large subunit and then you start to make the polypeptide, adding amino acid to make the polypeptide. So now this is a very important process in the cell as to be tightly regulated and there are many mechanisms. One of the major mechanisms we found are proteins which are called 4EBPs, 4E binding proteins, small molecular weight proteins that binds to EIFOE prevents the assembly of the complex and then you in a bit translation. And I'm not telling to you today about this mechanism and the consequences, but it's very important in cancer because it turns out that this is a reversible complex and as you can see here these 4EBPs can dissociate when you apply hormones, ghost factor and mitogen and then of course the 4E can function again as part of the complex and the key to all this regulation is that this 4EBPs is via the mTOR pathway through this PI3 kinase and all these components that are involved in cancer. So you see here downstream of this mTOR complex there is a 4EBPs which are first correlated here and released from the EIFOE. So I won't tell you about this pathway today. I want to show you another pathway in which EIFOE is involved and can be activated and this is the last pathway. Again, very important in cancer but I won't tell you the cancer part that we are doing. I tell you about the neurodevelopmental and the disease, the fragile X syndrome and I tell you about depression. So the EIFOE as I told you is a part complex with EIFOG. So it's part of a complex with EIFOG and it can be phosphorylated on one side, 0 to 9. And there is a very specific enzyme, the only enzyme that we know that can phosphorylate, only kinase, phosphorylate EIFOE is called mink. There are mink 1 and mink 2 first discovered by Tony Anto 20 years ago and mink gets a signal from the arc pathways. We see here arc make rough rust. And once the mink binds to the carboxyterminal part of EIFOG and phosphorylate the EIFOE. So we wanted to study this in cancer we make a knocking mouse so you have a serine to alanine mutation it cannot be phosphorylated so very clearly turns out that in cancer these mice are resistant to cancer and we have all ideas how it works and all this but again I won't tell you today about cancer I'll tell you about the Fragile X syndrome and I'll tell you why we got into that. So first of all once you have the phosphorylation of EIFOE you have a subset of mRNAs that became better translated and the way to do it is what you do is a polyzone profile actually you separate the number of ribosomes on the messenger RNA on the sucrose gradient so when the messenger RNA is translated well it has many ribosomes on it because the initiation rate is fast so you can have 5 up to 10 maybe more depends on the length of the messenger RNA and then in the sucrose gradient you have them at the bottom a messenger RNA that doesn't is a poor translator we'll have 1 or 2 or maybe 3 we'll have it close to the top of the gradient you separate them so now you can do different treatments and see how you change the position of the polyzone for different mRNAs depending now on the condition so we looked one condition here is comparing wild type fibroblast to fibroblast in which the serine 209 was mutated so instead of serine you have an alanine you cannot get phosphorylate and then we came up with a list so I don't give you this traditional IPA ingenuity pathway analysis and all the rest because we didn't have enough targets to do the statistic so basically I have a list here very short list it's a cut off of 1.5 as you see and just when you look by eye you don't need all the bioinformatics et cetera and you start to see the poor inflammatory you know aggressive behavior for cancer et cetera so you see all the CCL1 CCL2, CCL7, CCL9 the inhibitor of NFKB you see MMP9 you see MMP3 for some reason here is MMP3 so this led us some experimenting cancer but also led us to experiment on Fragile X syndrome because of MMP9 what happens in Fragile X syndrome many proteins change because the proteins that is can you imagine what is a Fragile X syndrome? that's what I'm going to tell you so yeah, so better instead of giving the introduction by words maybe I'll show you what it is this is the Fragile X syndrome so it's X linked it's encoding one protein which is called FMR Fragile Mental Retardation protein and what you can see here this is the Fragile site it breaks, you see it here and then what you have is I'll show you in a minute in this patient in males you don't make the protein I'll show you why so Fragile X syndrome is the most common form of inherited intellectual disability boys are 30 to 60% called diagnosed with autism but there are many many other syndromes you can recognize them if you once learned what is Fragile X you recognize them you know, the long ear long face the way they behave like autistic and repetitive behavior and this is what happens so this is the gene as I told you encoded by the Fragile X site so there are always repeats in humans in males there are no repeats 145% repeats of this triplet CGG there is no disease and this isn't the first in turn which has a promoter activity so you make the messenger RNA you make the Fragile X FMRP protein between 45 and 200 repeats you have some disease not all the penetrance is not 100% but sometimes you have disease when you have 200 then you have the the critical disease and this accumulates generation by generation yeah, yeah, it's from generation to generation and then you have expansion generation between parents and children right, exactly so here what happens once you have this many repeats this C come hyper-metallated once you are hyper-metallated you don't have a promoter activity so you don't have a messenger RNA you don't get now the protein, the FMRP FMRP is a translation inhibitor right so many people did different assay especially the clip etc they found out a subset of mRNAs but there are too many about 4 of them 4% of the mRNAs are substrate to FMRP so you don't know which one are the important one of course it's always a problem it's not just specific to this this one but we wanted to concentrate on MMP9 because we saw the MMP9 in our list of mRNAs that are affected by the serine phosphorylation so what we know we know that MMP9 proteins levels are elevated in fragile X and I have to say that MMP9 plays a major role now in the function of the synapses in the brain and we don't know exactly the mechanism but you need them in order to get a synaptic plasticity and learning in memory what was shown also before we started the experiment some inhibitors of MMP9 and 2 they are not specific so you see 2 is a target some others they rescue the fragile X behavior in mouse so you can make a mouse look out of the fragile X of the FMRP and then you can get as you see in a minute the very very very similar symptoms to what we see in humans so this is the symptoms so this is the fragile X FMR1- so in females it contains 1 X chromosome in the humans it doesn't have so most of the experiments are done in males not humans in males most of the experiments are done in males and these are the things we are looking we are looking at impaired preference for social novelty which is a classical markers of this patient and that's also for autistic children in general hyperactivity or geogenic seizures this is the electrophysiological measurement which is called long term depression so it measures synaptic activity so you give this drug DHPG and then you see a depression and the potential so you see in wild type you see a depression and goes up almost to normal when you see it in the knockout this knockout you see this exaggeration it's exaggerated it goes lower and never reaches back so this is a classical now again electrophysiological measurement of this disease so here are just some other things that we can measure as I mentioned already the repetitive behavior repetitive behavior social interaction or geogenic seizure, hyperactivity these LTDs that I just explained we can also look at the glintic spine abnormalities that always correlates with synaptic activity and learning and memory and it's part of the synaptic transmission so basically this is what I described before in the world where we do the polyzone fractionation and we got so just to show it to you I should have put it before so this is the polyzone we separate them and we can hybridize them to see DNA and that's how we got the list that I showed you and this is the list and again the MMP9 is the one that we picked up to study the fragile X so how do we show now that it's really important that it's associated this MMP9 reduction and the phenotype are associated with the EIF-4E phosphorylation so first we did genetic manipulation so in the genetic manipulation what we did is we took the knockout mouse for the FMR we crossed it to our EIF-4E which is the knock in the serine 209 to alanine and we crossed it also to heads of the mink 1 and 2 just the kinase that phosphorylates and as I said this is the only kinase phosphorylated serine 209 what we expect now is the lower amount of phosphorylated EIF-4E and because the amounts are lower then you expect less MMP9 you have less MMP9 if MMP9 is really important as really advertised we should rescue the phenotype and that's as you can see we published in 2014 we showed the rescue of most of the phenotype actually all and I'll show you just one of them and this is the exaggerated LTD, the long term depression and basically what you can see here in this case we didn't use a genetic genetic test we used a drug so this is an acute recovery and rescue so this is a sarcosporamide we developed with lily for cancer it's toxic but still we can use it here and this will reduce inhibit the mink 1 and 2 and reduce the phosphorylation of EIF-4E so you see here the reduction in the phosphorylation of EIF-4E and it's more than 70% and here is the test of the long term depression as I told you when you use the knockout mouse, the black one you see that the exaggerated LTD goes very low and doesn't recover this is the wild type the white one and here is the one when you are the sarcosporamide you see you completely rescue it you know it goes behaves exactly like the white one so now the problem is we use drugs that could never be used for this children with the fragile ex we have to come up with something better and we of course everybody thought about something and I had a poster he came up with the ideal drug and you will see why I say ideal because it indeed seems ideal and this is metformin so before going into that what cells is it working and what cells is it working in the neurons which neurons the pyramidal neurons for example they pockampus also in the PFC SH RNA for mink SH RNA for mink would be much more specific no it is that SH RNA for mink but it is the mink but it is a mink no car so it is very specific but we use for other thing but when we published I told you 2014 we published sometime came up a paper that actually showed it even in a clearer way than we did they asked a simpler question and the question was there is always to find this the question was let's take a knockout for the MMP9 so we remove it and to see what it goes to the fragile ex knockout if it can reverse the symptom and that's exactly what they did we thought it's an excellent complimentary story we sent together to sell the papers so the reviewers want us to do their experiment and she was asked to do our experiment so there was no use so we tried to convince this is etel etel and we tried to convince them that maybe we should do but they had a grant they had to submit anyway so they submitted this and we submitted somewhere else so as I told you Arkady Kortursky came up with this bright idea to use it for me this was two years ago took us a long time until it got published published in nature medicine in 2017 why do I say ideal metformin is an FDA approved drug used to treat diabetes type 2 type 2 diabetes 100 million people take it every day around the world this is a drug with the least side effects that you can imagine so you the worst you can get is diarrhea of course if you have a kidney, a damaged kidney then you have a problem you're not allowed to use it you get the ketosis et cetera so that's why this is the first line drug for diabetes and most importantly it's cheap, extremely cheap for a very long time so why did we use metformin because metformin suppresses mRNA translation via inhibition of arc and mTOR we saw that it will go through the mTOR but it actually worked through the arc as I told you arc is upstream of the mink which is upstream of the phosphorylation why metformin that's the big question we don't know we know we don't know actually most people don't know I know that don't have a list of things that metformin says right, right, right yeah, yeah, yeah so in answer to your question look at this paper so you have one, two, three, four yeah, yeah, don't believe everything so we have five papers but we could by ourselves because you don't believe everything you do the experiment yourself and mink inhibits arc one in our hands so again you can challenge even the people who did it in the lab but then you ask several people so at the end you run out of challenges so I accept now that mink that metformin inhibits arc so here what we do is we injected metformin if I find it again metformin 200mg per cure that's about a little bit more than you give to patient with diabetes and over 10 days so here you can see the schedule and then at 11 days we look at booming we look at social days a test after 12 days this is what I showed and this is the there's a very classical experiment to people study behavior so you have here two tests one is the social choice test one is the social novelty test and the first one basically what you do is you see here on the left there are three chambers and here you don't see anything here there is a stranger and the mouse that we testing always is social so most of the time not always will go here and sniff this mouse and sometimes it will go also to the other one goes around this it doesn't see anything and doesn't spend much time you see how fast it went out so this is the second test here and as you can see here here you have two mice on the left is a familiar mouse so you cohabituated your mouse with this one he already knows it, he's a friend here is a stranger he always likes to go more to a stranger so he will spend more time with them with the stranger rather with the familiar mouse so of course you can measure it very easily and here are the results so this is our mouse so it can be either a wild type or a knockout of fmr this stranger one, stranger two and you see now with the wild type as I told you it will go more to the stranger to the ones that he doesn't recognize rather the familiar when you look now at the black which is the knockout is no difference so no social preference for the stranger now this is the critical one you admit forming the way I described to you it corrected so now you do other test like grooming so this is the classical test of repetitive behavior so you groom yourself there are different stages of grooming you can learn from the old stages something and basically you can see that now the knockout mouse comes itself twice twice the time as the wild type but when you admit forming you correct it also the number of grooming bars is corrected something that very interesting that is corrected and still this we don't understand but tells us a lot the fact that it's corrected tells us something about the specificity and this is the macro-orchidism which is enlarged testis and again it's amazing that this is the same phenotype in males and also in the mouse and you can see here although it's not as strong as before you can see even here some correction of the size or the weight of the testis so I told you about the dlitix spine so here you can see again what you can see by microscopy and basically you can see the spine density in the knockout is increased and most of them are immature spines and again corrected by metformin and here you can see the spines that are increased so you see a lot of פילופודל which is immature and the mature one are less and again corrected by the metformin the LTD yeah I mean the effects are very clear but I have one problem I was told that metformin only works in the liver only the liver has the transporter for metformin right yeah that's another question whether the effect of metformin is systemic or cell-autonomous I am not sure that metformin even can go through the brain barrier yeah yeah and you find the metformin inside the brain so if you cell-autonomous you do IP is it the cell-autonomous or systemic effect is that still a question because what could be happening metformin reduces insulin level in the blood so therefore you get less insignia we thought about this and we have some experiment that shows that it's not it's not the case but I cannot hold it out completely so it's a very good point but as you know I put the emphasis on the correction of the disease not the mechanism so so the mechanism we are starting now we for example we know that there is an increase in the insulin receptor on the cells increase increase of insulin that's Eric what no insulin receptor so you get more more carapactin yeah so that's that shows that it's cell-autonomous so if we I'm almost convinced but 80% maybe it's a feedback effect they see less insulin dilavate the insulin etc. so these are all important questions but let me go through the data and basically the LTD is also corrected like I showed with the circus I don't have to show this again and so let's so here you do all this electrophysiology which I don't to myself look at spontaneous miniature excitatory post synaptic currents and you have always to do it if you want to really convince the people that know something about synaptic plasticity so again you can see the excitatory signal is much much much higher in the knockout and you correct it again with the metformin also where you correct the basic biochemical phenomena which is the increase of translation again this is inhibitor the fmr so it's inhibitor you increase it now you increase the translation there's the increase you reduce it now with metformin seizure you reduce and what I want to show here you see a lot of panel but the message of all this is everything that we actually predicted in terms of the signal now of the phosphorylation is exactly what we predicted so for example as you can see here this is the mech the phosphomech you see is increased now in the knocking you see the phosphorylation is increased you see the phosphoric is increased and what's most important the mmp9 is increased in the model and when you look now all the one the last one and the blueish one which is metformin all of them are corrected this can be done as you say both cells both in the hippocampus also in the prefrontal cortex so two major two major areas of it's not good so two major areas now of the brain to do now is the intellectual ability and the other syndrome so basically once you presented it we presented at golden conference they are sitting all the clinicians there is no good drug to fragile X and what's easier than to take metformin and give it to the patient so it's a very low hanging food and that's what exactly they did so Randy Hagerman she's not on this paper but Randy Hagerman she did and gave to her patients in Davis California and actually the slide I showed here shows you that you can get a similar phenotype in drosophila the phenotype is not similar, exactly similar to the mouse but the title is insulin signaling misregulation under lies circadian and cognitive deficits in drosophila for a gel X model and this are the now the clinical trials that will be done now a lot of patients now take metformin as off label right? so that's the kind of problem for the clinical trials because how could they get into this in the control group or placebo etc but still they found enough patients and they started it and this is the paper that came out almost together with us showing this metformin as a targeted treatment for a gel X syndrome as you can see again from Davis California from Niagara she didn't have many in this study like seven but in all of them there were improvement and then there is this anecdotal things that I get emails from people in Spain or whatever they are in the society the fragile X society so the father tells me this is big improvement of course it doesn't say anything scientifically but it still looks like if metformin is really helping him helping these patients this will be the from the beginning the ideal and as you know many people take it to extend life so they can live even longer than the average person so these are the different grants I should mention here Israeli he's a very rich developer he had a son yes he is dead but he has a son that had fragile X he was very interested he's giving a lot of money now the family for brain research and these are the people that did this work I still have time because I want to talk about depression so I mentioned Arkady Kudoski Christos Gokas is also one of the originator these are other postdocs that work on autism and fragile X and this is Jean-Claude Lacaille he has many many machines for doing the LTPLTD and we use them a lot so the role of here for reforestation depression so why did we do it some people noticed that the mice are depressed but maybe the students themselves were depressed they think that the mice are depressed there are many reasons to be depressed these days but there is another more scientific reason why we used it so first everybody knows about major depressive disorder so it's not this kind of depression that you have for a few days so persistent low mood irritability persistent diminished interest in all activity changes body weight appetite, sleep disturbances psychomotor acceleration and the lifetime this number is really alarming because the lifetime prevalence of 17% in the general population higher irritability the only drugs that are used today are not the only but the major are the serotonin reuptake inhibitor are commonly used but they are good only in 30 to 40% of the patient so this is not good so how do we get now from the EIFRE to depression and we get there because of the reduction in elk both you see in the pre prefrontal cortex and also in the apocampus there are other things that are going down but the one that of course is related to us is the elk so we wanted to determine whether the elk phosphorylation downstream of mob kinase, controlled depression and the anxiety barrier we wanted to determine the activity of the dorsal raffus or a tenorgic mpfc circuit so that's in the dorsal raffin most there are most of the cells that are producing the serotonin and maybe I don't get to this at the end but we'll see we saw a lot of changes in the dorsal raffin and we wanted to investigate the molecular mechanism underlying behavioral and surface alteration induced by deficit in the EIFRE phosphorylation this I think I took it from you you write a review on the EIF right? so I didn't give you credit here anyway so the next time actually it's my postdoc so he didn't give you credit so here are the tests so you start with a very simple test of course you need always everybody that knows about this behavior you need a lot of control because you can get this kind of things because of many many anxiety many other things so one of them is the first swim test the other one is tail suspension test as you imagine the first swim test if you put a mouse now that is depressed he won't try much so he will stay immobile the same is with the tail suspension test you see here is suspended by the tail and again if you have a depressed mouse he will stay immobile and what you see very clearly is there is a difference here when you take the mink wild type and knockout and you can see this time immobile you see here in the knockout you see there are much more immobile that here on the bottom both male and female are more in the wild type the same is true with the EIF-4E so the EIF-4E the wild type and the knockout and again you can see that the knockout or the knocking in this case it's the knocking there are much more immobile so in this case they will be counted as depressed the same is true also with the tail suspension test and you see the difference maybe in this time I will go a little faster so you have also basically just to mention that you have also other tests you cannot rely on two tests you have the novelty feeding so basically you put food food here in the middle and the mouse which is not depressed of course will go to the food the mouse that is depressed here you see stays in the corner again there could be other reason but this is just one test then you have the open field test it's exactly the same the depressed one will stay in the center they are afraid to go outside it's like also anxiety and it's true for the depressed one so here what you do is again to try to correct it like we did with the Fragile X so we use the circle's parameter I told you remember it's the mink so you have less EF4E for correlation and you see very clearly here that you have less 4E for correlation and you see that you correct now again so basically you see that the EF4E for for correlation is reduced and when you ask the amount of EF4E it's not reduced just the force for EF4E and here you can see with the circle a sporamide you correct so this is 20 mx per keg this time immobile you change it from 70 seconds to about 140 seconds okay again we go to the electrophysiology we change it and you can see very clearly the changes that you make here this is the EF4E the wild type and you can see here sorry with 50 micromolar here we didn't make a change but with 100 micromolar we could correct again so one question maybe in your physiology plot you have baseline and you have sedimentary yeah so I didn't explain because I was rushing sorry about that thank you for this so basically what you look here is now the signal in the electrophysiology so one lesson is not too harsh so you see with the EF4E here is the baseline you have here a serotonin you see now that you have an increase right when you do now with the knocking you see that you see that the increase here you can see at the blips at this you see that it's much less you say serotonin do you mean you are injecting serotonin or what does it mean how do you do the serotonin you inject it right so you inject the serotonin ICV ICV inside the prefrontal point exactly so here you have all this connection you know with the dorsal raffa here this is the region this is the prefrontal context and you see the projection so many experiment we did on this and we could show the really the importance of this connection for the depression and I want to go that's why I was rushing with this one because I want to go to the molecular explanation like we are right with the MMP MMP9 4 minutes so in 4 minutes I'll be able to explain you here what is now the target it's not MMP9 now so we look now through the list right and the ones that looks the most promising is this inhibitor of NF kappa B so the official name is nuclear factor of K like polypatterge in B cells inhibitor alpha which is called IKK alpha and the expert here I think in the room I kappa B alpha no I kappa B alpha but so he was sitting the expert in the first row so why why did we pick up because it's very important place a major role in inflammation and there are this idea in the field although no accept not completely accepted especially not by the not by the psychiatrists because when we are working with the psychiatrists we tell them okay you can inhibit the inflammation it's not sure it's not this etc but we thought that this could be a very nice clue to do experiment and you see inflammation in many papers in major depression disorder and again not everybody believes it but you see it in many days so this is a protein that is on the outer membrane in the microglia and goes up in inflammation and you see very and MDD you see in different regions in the brain you see here it's increases in the amount and you see the for elevated poor inflammatory cytokines IL-6 and TNF-alpha so as I told you what we saw and this is what we saw in the list of course we validated and basically you can see the inhibitor now and the knock in is much less and again you can see it also by the profiling that it translate less than acting for example so here is the inhibitor and you can see in the wild type it sediments at position 6, 7, 8 of the polyzone in the sucrose gradient in the knock in you see its position 2, 3 and 4 so the rate of translation initiation is lower which fits with the connection to the ear for ease that works for in the translation initiation so you can see very nicely that this is controlled by the mink 1 and 2 so here for so again here you can see the absorbance of this polyzone profile here you can see active on the polyzone profile you see that there is no difference here between the wild type and the knock in, the ear for in knock in and here you can see the inhibitor of NF kappa B and you can see a big change so you see in the wild type here it sediments in the every every fraction in the knock in it goes to the light fraction so we can show also increased increased TNF alpha expression in the prefrontal cortex of the ear for in knock in you can see here again the TNF alpha so what you see here some other marker this marker is is a marker of the microglia so again increased this is another marker here so again increased so the idea can we correct it now by reducing the amount of TNF alpha the depression so we use the dominant negative that has been described before and basically this treatment of 12 days and they use 10 milligram per ml and so this is the the fourth swim test and the novelty surplus feeding that I showed you before and you see very clearly that this is again the time immobile that present the depression this is increased in the knock in you are the dominant negative again this is ICV you do the dominant negative it's going down the other test the novelty surplus feeding the same thing so this is the model so this the model is based on many other many data in this your data actually so basically the NF kappa B alpha inhibitor is a target of the ear for E and when it's not phosphorylated you make less of it so under normal condition the NF kappa B when there is no inflammation is inhibited by the inhibitor that doesn't let it go to the nucleus you don't get the TNF alpha and this is the last one before the last before doing the acknowledgement here what you have depressive state so basically you make less now of the inhibitor of the NF kappa B NF kappa B goes into the nucleus you make the poor inflammatory cytokines and depression so I want to finish with something that's the most difficult was the most difficult to do from all the experiment that I explained and this is how to get lymphocyte from patients with depression so you go all this bureaucracy you have to fill this and that and etc so we ended up only with 24 samples that we measure and we see something interesting you wanted to put in the paper but it's only 24 I told him don't put in the paper and basically what you see is that in female here in the major depression disorder you see less of force for EIFOE than in the wild so this if this turns out to be if we can get more samples etc it will be I think a major major breakthrough because we have all the work with the mouse and these are the people that did the work so again these are psychiatrists Gabriela Gobi all the group Gustavo Torecki and these are the people that did the work in the lab so basically this is again going for molecules to disease going from basic science to understanding disease and maybe treating disease and killing people thank you again we have time for one or two questions but before that I want to ask you for education so the inflammation is mediated by the microphase microglia microglia is the one that they secrete the TNF alpha what do you mean microglia? in the brain okay but you are testing the mRNA level where in which cells so we testing from so we test from all kinds of first of all we test the amount of protein no no you check the mRNA level with the inhibitor the mRNA level I don't remember which one oh yeah yeah yeah yeah so we test when you looked at the air for E so we test the hippocampus so but this is mediated by the by the hematopoietic cells no by microphase the inflammation so the microglia are the ones that are the microphases in the brain yeah they are microphages he is checking the mRNA level in which in all in all cells wherever you look you see a difference but the ones that secrete the TNF alpha and all these are to be the microglia לרמידל cells etc okay yeah so repurposing drugs I mean this can be extremely powerful and getting tools to develop more specific compounds and I mean having compounds are well tolerated is a great way of getting patients and so on the question though is as many of you know with diabetes the compensatory changes very rapidly eliminate the benefit depletion so I guess the question is in mice you can certainly use many erg specific inhibitors do those do those have benefit so the biggest problem with this erg specific one are the side effects right so that's why in cancer why didn't they become the you know the the major treatment but in mice you can do the experiment there are in clinical trials right now there are mac inhibitors in clinical trials I know but many of them are in this but so that's why you started with repurposing and you have one of the safest drugs in the world right so of course you will use that instead of this but again people try I don't know for some for one of the reason is this is out of pattern you cannot make much money so people try make the derivatives now of the drug of metformin for obesity so I don't know maybe this can be used but the erg for sure you cannot compare them to metformin there one more question good question so in your fragile eggs Have you tried rapamycin just to rule out that the poor pathway is also important and sort of a side question from this discussion why would an urchinivit that have side effects metformin not since it inhibits metformin okay so there was a paper with metformin actually published and it had the opposite effect you must admit I didn't read it very carefully why should it have the opposite effect but again metformin has many targets because it acts M-Tor and downstream of M-Tor there are about 40 different targets so metformin was tried and he's asking about the safety situation the metformin actually doesn't have side effects it's actually beneficial in general when you inhibit air you inhibit signaling everywhere in the body so everybody should take what about rapamycin rapamycin in this one in fragile eggs so that's why I said there was a paper but it made fragile eggs even more severe didn't correct so it's very interesting in terms of our data anyway we have to continue with the program you can ask


Hi, welcome. My name is Chris Tempore and this is the session on deploying Linux in Safety Critical Applications three key challenges. I am a Lead Safety and Reliability System Architect at ARM working out of the ARM office in Germany. So the work that I'm presenting is work we have conducted in the context of the open source project ELISA and the ELISA project is about enabling Linux in safety applications. It's not about providing a safety conform kernel and I'll explain in the next slide why I'm emphasizing this. Yeah and this presentation will now look at and lead you through three key challenges and solution ideas on enabling Linux in safety applications. So what is this about the difference between safety versus conformance? So safety is about the absence of unreasonable risk and it's a property of the system that is experienceable while conformance is defined as to be or act in accord with a set of standards expectations or specifications. Often you hear safety and conformance used in the same sentences. The reason is that there are a lot of safety standards which are actually safety integrity standards and there is a strong desire to be conformed to those safety standards but as I've illustrated here on the figure conformance does not automatically imply safety. So you can have systems that are not conformed to a safety standard and are not safe. You can have systems that actually conform to a safety standard but still aren't safe. In the ideal case can have systems that are safe and conform to safety standards. That's clearly the target area that one wants to be in and there are also reasons when you can have systems that are safe and maybe in some areas don't quite conform to the standards and the safety standards actually take this into account by using a language of highly recommended and recommended rather than mandatory for the requirements set forward in the standard. So that allows some areas of gray because in some cases there is good reason to not conform to a specific clause of the safety standard but that still ensures safety. So safety is the objective, safety engineering is the approach and conformance is an additional constraint that one wants to achieve in the quest of achieving safety. Now I already used the term safety integrity in respect to the standard so how do safety and safety integrity go hand in hand? So safety and the way that one achieves sufficient control of dangerous failure modes is done through safety claims and the safety claims state specific safety capabilities of the system or one of the system elements and it's expressed in form of safety requirements and the safety requirements clearly depend on the context. So the typical example that one frequently reads or hears about is an airbag system and the safety claim for an airbag system is two-fold on one hand it should deploy in the event of an accident that's the purpose of the airbag but there is another safety claim which is almost takes more engineering effort to fulfill and that is that the airbag should not deploy inadvertently when you are not in an accident and the reason is quite straightforward if the airbag deploys and flies into your face then that most likely will cause you to engage in an accident because it might knock your unconscious blind you or whatever it's a pretty massive experience having an airbag deployed and it's not something you want to experience for example why you're driving on the motorway but you're sitting the whole time behind the airbag and the airbag the squib is there so the potential for the airbag deploying is high it's there and you don't want that to happen outside of a crash so the key question is when you start engineering solutions for your safety claims the question so what how much effort do you put in and this is where safety integrity comes into play and the idea is that if the probability of a hazardous event or the controllability of the hazard events by a human or the severity of the consequence is very low then clearly it makes sense to put less effort into substantiating the safety claim then if those are very high right if you're very exposed to the risk if the severity of the injuries you might experience is fatal and if the controllability is very low so there's not much you can do as a driver as a human engaged in the surrounding of the car then clearly you have to apply a much higher level of rigor and this is explained through the safety integrity and that expresses the degree of rigor that is taken to substantiate the specific safety claim and this is expressed in terms of safety integrity levels so these are the famous asils in the ISO 26262 standard uses A, B, C and D with A being the lowest level of safety integrity and D marking and denoting the highest level of safety integrity and the safety standards which really could be seen as safety integrity standards describe all the things you need to do to substantiate safety integrity for specific safety claims and then the system you build you have to ensure that the safety capability is met with the stated degree of rigor and lastly the idea of safety engineering is to provide a safety case as a structured argument supported by evidence to justify that a system or a safety element fulfills the safety claim with the stated safety integrity so this is a very very high level picture explaining how these different aspects fit together so apart from expressing the desire for a safety integrity level a key question clearly is what are the safety claims that one needs to fulfill and that in the context of the ELISA project has formed one of the challenges and pulled together now a simple model to explain how one can obtain necessary safety claims without necessarily having to dig into all possible applications because an operating system clearly is something quite generic so you can envision a magnitude almost any digital system you build will have some kind of operating system in there and then having to analyze that system context to derive requirements for the operating system is tedious so the idea is to use a simple model to start identifying some of the key requirements that need to be substantiated so that the ELISA project can look at how to enable the use of Linux safety applications so here is a simple model it's two applications a one a two each application has an application context and in very very general hand-waving terms the applications produce output based on input and the internal context within some deadline I think that's a fairly reasonable model for control system it's not outrageously complex and that's the whole idea of starting with something simple then we have an operating system that operating system also has a context the operating system again very simple model provides services to facilitate timely progress that will be everything to do with with scheduling and and and maintaining system timers and so on and so forth it provides services for maintaining the context of the application and it manages underlying hardware and then the third component the third level will be hardware with a hardware context and that also provides services to facilitate timely progress so so that is clearly the hardware implementation for example of of timers and interrupts and other hardware facilities and it also provides services for maintaining the context that that's all the instruction set that the underlying processor provides and and other services so the first thing I one can look at because I picked the simple stuff first to get it off the table is timing so we can look at this this list we just put together and we say okay there are the operating system provides services to facilitate timely progress and the hardware does the same thing what happens if those things go bad and basically there are two established techniques for dealing with that there is a technique in software that are typically applied using deadline monitoring so if you can see that the the system misses its scheduled deadlines you try to take some corrective action this is a gigantic field because it depends on the the scheduling requirements it depends on your application requirements but there are established solutions there are established puzzle pieces that can be obtained through which one can create a mitigation story for these timing problems and then on the hardware side it goes starting from hardware and clock and timing monitoring circuits starting very simple thing either you have a second oscillator and you cross check the clock or you have an RC based frequency monitoring circuits and you build monitoring circuits that this is not a complete list this is just an example but there is tons of art available to to prior art to to read and there are a lot of solutions of this kind already available and implemented so this is not really it's challenging but it's not super novel to look at on the the hardware context sides again what happens how can you deal with those problems and one area that is being used again as an example is a privileged based security architectures more and more the hardware processors are supporting privileged based systems and this is across the industry its arm has as very sophisticated support for security as well as x86 and and other process architectures and the security problem already brings a lot of mechanisms and techniques to isolate the applications from critical hardware accesses but also isolating the applications from from one another because you don't want one application snooping around in the data space of another application from a security perspective and that is the same that you don't want one application inadvertently modifying the context of another application from a safety perspective and in addition which is quite nice there is more and more a bigger and bigger number of products emerging that have safety built on the safety enabled hardware architecture so that includes things like split lock course to detect random hardware folds there are safety islands available to perform platform safety management internal SOC data paths are all covered with parity bits and error correcting control there are additional bespoke error detection mechanisms dealing with specific dedicated peripherals there are software test capabilities and hardware scan diagnostics available and there is memory based available so there are extensive feature sets available and more and more semiconductor manufacturers are actually certifying their products and the mechanisms they provide to ensure safety at the hardware level to certain safety integrity levels so now we cross off those problems we say okay that's again challenging but we you know there are solutions out there puzzle pieces are available so now we look at the application context right so we say there are really two challenges the one is we need measures that ensure that an application cannot corrupt another application context the context of the operating system or the context of the hardware in an undetected dangerous way and the second challenge is the OS itself shall not corrupt the context of the application the context of the OS or the context of the hardware again in an undetected dangerous way you can already see I'm I'm the language is chosen intentionally a little tricky because these are starting to get quite challenging problems and you need to be certain that you're not setting the bar too high so saying in an undetected dangerous way that means that if corruption can occur but it's detectable or it is not dangerous in the sense that it does not violate the safety claim then the corruption might be okay to live with otherwise you start running into the risk of intensely overengineering the system which is to nobody's benefit on the so so so what what solutions do we have at hand but for these problems and I already said that the measures that ensure that the application itself cannot be the source of corruption of other contexts in the system there are techniques available to to address that as I said right the the privilege based security architectures if you add sufficient safety integrity to those mechanisms you get very powerful techniques to address this problem they are very very sophisticated virtualization techniques available these days supported by the underlying hardware architecture that give additional ways of of establishing containers and other techniques to mitigate and address this this cross interference and it's possible to exploit specific application properties and I'll get to that point further on in the presentation to explain how that works so so we're left kind of with this question okay the OS itself shall not corrupt the context either of the application of itself or of the hardware in an undetected dangerous way and now the question is how can that be how can that be achieved so on the next slide I'll present some selected solution knobs this is by no means complete there are tons of ideas there are tons of ideas emerging in the ELISA project but these are I think some main knobs that are available to turn and see and try to to hum in on addressing this problem so on the left side I simply repeat the problem that we're trying to look at which is how can we what can we do to ensure that the OS itself doesn't become the source of context corruption and a very simple solution would be the choice of an operating system so there are operating systems available built based on micro kernels and separation kernels micro kernels go back all the way to the 1970s separation kernels go back to 1981 to work that John Rushby did and the benefit is that the the kernel is built around the idea of having hardware firmware software mechanisms to establish isolate and separate multiple execution partitions and to perform the control information flow between the subjects that that's the the term used by the NSA definition and exported resources allocated to those partitions so the operating system the kernel is really built around this whole idea of separation the con and there is literature out there to read through what mechanisms that performance impact emerges is is a performance impact under certain constraints and assumptions that impact can be taken to a lower level but there is still a performance impact and it is not off-the-shelf Linux which is not the target we have set ourselves for the ELISA project so we want to see how how can we enable linux in the safety critical applications examples if anyone's interested for for micro kernels is our QNX or Vx works and for separation kernels it's integrity or links to name a few examples so we say okay we want to use linux so an obvious approach is to say let's harden the operating system what what does it take right one key technique in hardening is scope reduction and features stripping right everything that isn't there and isn't used is something that can't go wrong and can't be a cause of of of interference and corruption except that a lot of linux people are quite stressed when when you tell them you know what what can you do away with because all the features in linux are there for a good reason and the more you strip away from it the less it still resembles the original intention of linux with all the good features that that have been built in I mean if you strip it down radically you take out a scheduler you take out tons of features you reduce the device drivers eventually you're gonna resemble something that's starting to look close to micro kernel but it's then not not Linux anymore then what we just said on the application side using hardware security and virtualization features is is is a good technique there are limits in linux to how far you can take those features into the kernel with the exception of features that the hardware provides that are transparent to the operating system and there are techniques of hardening the OS using inline checking and context signing that's also an established technique to secure a context the problem with inline checking and context signing of pure software approaches and they impose a significant overhead because really every context information that you use every time you use it you really would need to check whether it's corrupted or at least have a good argument that if you're using it at a certain point and it is corrupted you will eventually uncover that problem downstream so it won't be an undetected dangerous violation of your safety claim and and those arguments are very very sophisticated to lead so so the cons of hardening is is the overhead and the performance impact of monitoring and context signing it it can be taken to the point where the performance of the operating system becomes wiped away by all these additional checks that that have been added added to the code so this is important it cannot address the whole problem and we can't work with black and white arguments we're gonna have to put a puzzle together so this contains important puzzle pieces and the key is to find the right spots in the kernel where these arguments help without overdoing it and creating too many disadvantages then the next knob that one can apply is what I call correct by construction testing so what the argument is that you say we have tested a certain piece of code so extensively that we have a huge faith in the integrity of of that code and there are areas and today software engineering has advanced to the point that in some cases these arguments are used they use successfully in safety systems today that are in the field it's always a matter of of the complexity that you're looking at so again you the big benefit is that there is low or no runtime performance impact because you're saying I can test the code to this level of perfection before I deploy it and there are lots of new methods for testing software and the good thing is that the open source community is really very very active in adopting these methods for Linux and also developing and driving methods for testing so this is a really really interesting aspect the on the con side the correct by construction testing requires really some prerequisites right so the standard the ISO standard itself kind of suggests highly recommends that for these kind of arguments you have one entry and one exit point you use restricted use of pointers no unconditional jumps etc because else you're just facing a state space explosion when everything can continuously be interrupted by something else and all the cogs are spinning and turning simultaneously that the test space it gets gets immensely big I think this has a lot of value I think it forms a really important puzzle piece I personally I'm always a little doubtful whether that can be the sole argumentation and it reminds me of the shortest joke amongst computer programmers in a room I'd ask if everyone knows it I'll just share it with you it's two words the shortest joke is last bug so we looked at testing we looked at using runtime features and here isn't really really interesting knob and a way of achieving the goal of enabling Linux in safety application and that is by exploiting application properties this is largely how it is done today in many systems that use linux so a lot of people say why are you even struggling in the Eliza project I already heard about the system that uses linux but the key question is how much of the safety argumentation of that application actually pivots on safety claims made by the operating system and how much is done by putting the safety mitigation around the operating system or into external hardware and not relying on the operating system this was a crude example simply to show that there is a complete rainbow coloring of options how one can conceive applications I've simply for reasons of simplicity separated them into a class L and a class H the class L I've I've crudely labeled low safety complexity that this is not scientific just just take this with a grain of salt it's to put two stakes in the ground rather than to have an exact science typically in the low complexity safety systems transient faults are not that critical and I'll give an example in a second of such a system those systems have a high low pass characteristics so the transient fault just gets wiped out by the by the low pass characteristics of the applications permanent faults are critical the fault tolerance time compared to the execution speed of the system is long so you have quite a long time in which a fault can be present in the system before something dangerous happens very very often you will see a human in the loop which is very convenient because the human can do some additional plausibility checking and intervene and since the fault tolerance time is is low there is still time for the human to actually do something in many cases end-to-end plausibility checking at the application level is plausible you don't so often see arguments from its criticality where the system has to achieve multiple safety claims that are independent from another and require applications of different criticality being integrated and usually and again right just as a stake in the ground you're looking at safety integrity levels up to A's and B's a very typical use case one that's also being considered in the ELISA project is IVI telltale so it's you can imagine the digital dashboard and the critical failure mode is if a warning telltale that's trying to inform the driver that something critical has occurred and it needs to take action doesn't appear at the TFT display and those systems usually use some kind of feedback loop for example by taking the bitmap from the TFT feeding it through an image detection algorithm and actually checking whether the whether the telltale is visible and if it isn't visible it tries to alert the driver in a different way by by using audio by by turning off the dashboard by switching to an emergency dashboard or there are a whole bunch of techniques that are established in the industry that's on the on the low end side of complexity and as you can see that fulfills the criteria of class L and then on the other side of the spectrum you have the class H which is a high safety complexity in those systems transient faults are critical so you don't really have a low pass characteristic that you can use in your safety argumentation permanent faults are critical and there is the fault tolerance time is short so there are only milliseconds left to react it's not really possible to engage the driver or human in the loop end-to-end plausibility checking at the application level is not that that feasible and very very often you're looking at mixed criticality systems going all the way up to ASLB so that I depicted now on the right which would be autonomous driving systems and then there are a whole bunch of systems in between gateway systems for example are usually still considered more towards the class H because there's no human there's no low pass characteristic in the loop and then the e-gas I'm not sure whether to what extent this is known I presented that last year that is basically the safety architecture that has been developed and is in use across most of the cars for the electronic throttle control so the accelerator pedal these days just goes to a sensor and then the signal is sent to the engine control unit to control the speed of the car and that is done using a system that's called e-gas which is higher than the telltale use case I would I would believe but it is is still in more towards the lower end of the safety complexity ballpark the good thing is this is a very very powerful knob that the challenges introduces this application property dependency so what we're trying to do in the Eliza project is engage with OEMs and trying to get them to provide us with the most interesting use cases they have so if we do want to resort to application properties into this technique we focus on the use cases that are of the biggest interest to the OEMs in the Eliza project rather than trying to solve a problem that has no relevance and the industrial team in the Eliza project I've now spoken all about automotive the industrial team is doing the same thing they've chosen specific use cases and that allows them to reach out to this knob and twist that knob and say okay we're limiting now our our enablement for Linux to this particular use case I the big risk is just that someone enables Linux for use in in in one class and someone else isn't aware of this class dependency and says hooray the problem has been dissolved and because Linux is running in this kind of system I can take it and put it into a different kind of system and I must be able to reuse the arguments and I think this slide hopefully shows that that is not necessary the case if you do transfer arguments you have to be really really careful that the constraints under which those arguments were met still remain valid so the the challenge to discuss is the integration challenge right so supposing now we have we have Linux we have put put all these arguments in place we've hardened it we've used application dependent aspect to to mitigate and address some of the critical faults and now we need to put it together and the way this is done typically is that the different constituents for integration so it's the operating system that has to be integrated with hardware with drivers with all kind of bits and pieces libraries you name it and typically those individual elements are developed and provided a safety element out of context the safety element out of context means it's a safety element so it fulfills some safety claims with a stated safety integrity but it has been developed using an assumed context by a supplier because the suppliers as I can you know I'm assuming this is for example going to be used in an airbag and they use these application constraints techniques to to argue the safety capability of that element so those elements come with integration requirements and they are really critical and typically those integration requirements are stated in the safety manual and the safety manual now contains the assumptions on the context that the supplier has made and the integration requirements that are usually stated as as assumptions of use requirements which are safety requirements allocated to the integrator in practice this has turned to be quite challenging because the person integrating all these different elements is now facing a challenging task the integrator needs to ensure that the safety claims are sufficient that the assumptions made by the supplier are valid and that the assumptions of use that the supplier has expressed for his safety element are addressed with a sufficient integrity and then and this is something I think that software programmers and current programmers will understand immediately when you start integrating things sometimes properties disappear so you have to make sure that the safety properties that the element had before you integrated are still there and you have to ensure that the safety claims that don't emerge until you have achieved integration actually emerged as desired and lastly which is really really ugly you have to ensure that no new critical failure modes have emerged so this integration challenge also puts a limit on the level of creativity that you can apply if your enablement of Linux in your safety application hinges on 100 assumptions and 2000 integration requirements it's gonna be almost impossible for anyone to take that operating system and integrate it in an intelligent way and still have confidence at the end of the day that that the safety is still maintained right so that automatically puts a bound to the to the extensity and the creativity of the arguments it kind of forces everyone back into a world of reason and sanity and saying it has to be a reasonably safe a reasonably simple solution to be able to to demonstrate safety and argue safety at the end and and typically an ECU when we did this on a particular autonomous driving system we within no time within a couple of hours we suddenly found a hundred safety elements different software drivers different hardware parts of the power management unit from the hardware that needs to that needs some in periodic engagement with software and so on and so forth it was quite amazing how complex this problem became and there is a very interested I present the paper the European Dependable Computing Conference about a month ago where I went into detail of this problem and we were discussing how what options exist to solve it so the conclusion of this presentation is really the safety argumentation that we pulled together in the Eliza project will require making trade-offs and it requires collecting multiple puzzle pieces and combining them in a smart way this is I think the challenge for the project today would be much easier we would have make or break arguments because then you can throw away all the weak ones and you're left with one argument that's the killer argument that is very unlikely to emerge it's more that there are a lot of arguments each one carrying a small weight of the overall argument and it's the combination of those arguments that actually enables the use of Linux in the safety application so all the pieces are needed someone at the end of the day will have to understand all the pieces to gain confidence that the combination of the pieces delivers a sufficient argumentation and the Eliza project is is now working on on solving the the puzzle and looking for new pieces that could be used to argument and justify the safety that that concludes my presentation and thank you for listening