It is recognized that the approach described below will require a significant learning curve for many manufacturers. In addition, functional safety assessors (e.g. those already qualified to assess to [7]) will need to develop the necessary skills to assess good EM engineering practices and their verification. Perhaps some EMC testing laboratories will also develop the necessary skills to assess the EMC for Functional Safety of a product's design.

But in a changing world, where electronic technologies are continually advancing and being applied in more areas where they could have impact on vehicle safety, we should not expect that the verification techniques we use to ever stand still. The use of electronics in safety-rated applications in products sold in high volumes to consumers is still new enough that the safety verification and validation processes have not yet caught up with what is actually needed.

This paper should be seen as part of the process by which acceptable safety and financial risks are maintained despite the increasing use of high technology in vehicles.

4.1 We can't afford to rely solely on EM testing, where safety risks are concerned

The main problem with automotive electronics is that everyone in the process is subordinate to the vehicle manufacturers. It is anything but a collaborative process, and engineering success is almost totally dependant on the depth of knowledge of the vehicle manufacturer. ESAs go through several stages of EMC test during development, both at component level and at system or vehicle level. Development proceeds based on ESA testing, acceptance is dependant on system level performance.

All testing is performed to standards produced by the vehicle manufacturer; sometimes based on international test standards with deviations. Some deviations have a minor impact; some introduce fundamental errors. By the time a vehicle 'platform verification program' is disseminated to the lowest levels in the Tier 1 or Tier 2 suppliers, it can often be reduced to nothing more than poorly resourced and poorly educated people being required to tick a series of boxes.

The problems described in the above paragraph apply to the usual issues of EM compliance to the traditional EMC test regimes. But as has been shown in Section 3, when it comes to safety risks the traditional EMC test regimes are insufficient for many reasons, and their benefits (or not) for controlling safety risks is unknown.

Sufficient confidence in achieving acceptable safety risks, using EM testing alone, would require fully addressing all of the issues raised in section 3 above. This would require a test program that no organization (or government) could afford, either in terms of cost or timescale.

Since we cannot afford to rely solely on EMC testing, we need to be cleverer, to be able to demonstrate that the EM performance will reliably ensure the required levels of safety risks over the anticipated lifetime, despite the inevitable cost constraints.

The cleverness required is achieved by appropriate EM design, so that vehicles' safety-related systems are confidently expected to achieve the necessary EM performance over the anticipated lifetime, given the reasonably foreseeable EM and physical environments [32].

In addition, the EM design must be verified and validated, in a manner that is capable of achieving the necessary confidence given the acceptable levels of risk and cost. Greater risks require more confidence in the EM design and its verification, than lesser risks. Verification and validation of the EM design should use a wide range of techniques, and will generally include some affordable EM testing [33].

4.2 Assessing the reasonably foreseeable lifetime EM and physical environments

This requires much more effort than simply copying the test levels from the relevant test standards. As well as the usual focus on EM frequencies and amplitudes, it should include assessments of the reasonably foreseeable real-life possibilities over the anticipated vehicle lifetime for

• EM disturbances in the near field (e.g. crosstalk in cable bundles) and far-field (e.g. radio, TV and radar transmitters)

• Intra-system interference (between the ESAs comprising a vehicle system in a vehicle)

• Inter-system interference (between different systems within a vehicle e.g. via their connection to the battery, and between a vehicle system and non-vehicle systems, including electronic devices introduced by drivers or passengers, and the world outside the vehicle)

• Modulation types, and their frequencies and/or waveshapes

• Simultaneous EM and/or physical disturbances; continuous, extreme, cycling and transients

• Use and misuse, and their effects on the EM performance

• Physical environment(s) (e.g. mechanical, climatic, biological, wear-and-tear, etc.), and their effects on the EM performance

• The effects of ageing on the EM performance

• Future changes to the EM and physical environments

• Component tolerances; future changes to components (e.g. obsolescence, die shrinks, etc.) " see [34] and [35] for more on how to do this.

A statistical threat analysis is very useful, but usually only possible to establish the types of EM phenomena (see Figure 5) and their worst-case levels and modulation types with any certainty.

Figure 5: Examples of foreseeable EM disturbances over a vehicle lifetime

Where safety risks are high, it is important to consider even very low-probability EM disturbances that could arise from electrical faults (e.g. insulation failures, with associated operation of overcurrent protection devices) in the vehicle itself, or nearby. In some applications it is becoming increasingly necessary to consider intentional EMI (IEMI) [36] caused by competitors, disgruntled employees, terrorists, criminals, and even unwitting troublemakers.

There are IEC and military standards that describe the physical characteristics of a wide variety of environments, including storage, transport and operation, but any 'compatibility levels' (or test levels) they suggest should be treated with caution and not applied unquestioningly.

Each new design should also consider reasonably foreseeable use and misuse, such as failing to follow the user instructions. 'Brainstorming' techniques are often required to do this effectively.

Where a model of vehicle is to be sold into an EM or physical environment not fully taken into account by its original design " an assessment of the new EM and physical environment is required. This could lead to design changes, and their verification and validation, to maintain safety risks at acceptable levels.

4.3 Design details

Safety work should include a description of the EM and physical design, including technical arguments showing how they will achieve the required levels of safety risks over the lifetime, given the reasonably foreseeable EM/physical environments (see 4.2).

There are a great many publications on good EM design techniques that can be applied at different levels of assembly (integrated circuit; circuit design (schematic); printed circuit board (PCB); modules; sub-assemblies; interconnections (e.g. cable harnesses); enclosures; vehicle structure, etc.). [32] includes a more detailed discussion of well-proven good EM and physical design techniques for functional safety, the use of which is generally preferred to inventing anything from scratch for each new vehicle design.

4.4 Hazard identification and risk assessment

Part of the design process (above) is to assess how it could possibly be affected by its reasonably foreseeable EM and physical environments over its lifetime, taking into account faults, misuse, etc.

A documented hazard identification and risk assessment process is required, that takes the above EM/physical issues fully into account. It should then document how any excessive safety risks were reduced to an acceptable degree by design changes.

There is no standard, correct and formal way to analyze safety: there is always the need to include human judgment in an ordered approach that considers and documents safety issues during the design process [37]. The assessment should be systematic, but there is no guarantee that the analysis will be 100% effective and complete, so there is always the need for competency and expertise to improve the 'coverage' of the analysis as far as is possible.

'Inductive' methods (sometimes called 'consequence' or 'bottom-up' methods), such as Failure Mode Effects Analysis (FMEA) or Event Tree Analysis, are described in section 5.4 of IEC 60300-3-1 [38]. They generally start with a low-level error or failure, and try to determine whether it could lead to a hazardous situation.

'Deductive' methods (sometimes called 'causal' or 'top down' methods), such as HAZOP or Fault Tree Analysis are described in section 5.3 of [38]. They start with the hazardous situations and try to determine what could have caused them.

'Brainstorming' techniques identify any possibilities, placing no limits on the participants. They apply inductive methods to see if the possibilities could have any hazardous consequences, and " if so " they apply deductive methods then discover what could cause them, and also their likelihood.

Brainstorming techniques rely on teams of experienced people guided by a chairperson who is experienced in conducting brainstorming sessions, and who is independent of the design team. It also helps if the chairperson is independent of the company, and this could be very important where very large risks are concerned, to avoid accidental corporate bias. Brainstorming meetings should involve users, field service engineers, maintenance personnel, etc. " never just (or mainly) designers.

In safety engineering it is usually considered necessary to employ at least one inductive and one deductive method to improve the accuracy of the hazard and risk assessment. For this reason FMEA and HAZOP are often used together. Another common pairing is Fault-Tree Analysis (FTA) with Event Tree Analysis (ETA). 'Brainstorming' is always recommended, to help identify faults and foresee use/misuse that would otherwise be overlooked.

FMEA is a useful technique, when it takes into account the EM noise immunity characteristics of the hardware and firmware, and the reasonably foreseeable EM and physical environments over the lifetime.

Many vehicle manufacturers and Tier 1 companies apply FMEA and other risk assessment methods, but with increased time-to-market pressure its' depth of application appears to be diminishing. They generally apply it in a 'rote' way that is not recommended by functional safety experts [39] [40], for example by assuming that each node in a schematic could fail, one at a time, to the minimum or maximum supply voltage. But some failure modes (e.g. latch-up) can cause several or even all of an IC's output pins to change state at the same time. And some types of EMI are well-known to create common-mode errors in which erroneous noise voltages appear on many, even all nodes at the same time. EMI can also cause noise signals to appear, on one or more nodes at the same time, that lie within the range of signals accepted by a device and can 'fool' it into behaving erroneously.

It may be difficult to adapt traditional inductive or deductive methods to deal with the wide range of EMI possibilities. This is the main reason why competent EMC expertise should always be involved in such analyses, and also in brainstorming meetings, to try to ensure that all reasonably foreseeable possibilities for EMI to give rise to safety hazards have been thoroughly investigated and dealt with as appropriate.

There is usually an assumption that two or more independent faults are so unlikely that only 'single-fault' issues need to be considered " but even constant repetition as if it were a mantra of some sort does not make it true. A simple example will help make this point. An electrical connection that was not adequately designed to withstand its physical environment over the anticipated lifetime might become disconnected after an average of, say, three years due to some combination of oxidation, corrosion, fretting, mechanical movement, etc. Many other similar examples can be imagined.

On vehicles more than three years old, this fault would be a given, and any other fault would create a double fault situation " but the likelihood is simply that of the 'other' fault. So a proper risk assessment should consider all of the faults that could reasonably foreseeably occur over the anticipated lifetime, and the possible consequences of multiple independent faults, to reduce the overall safety risk to acceptable levels

Even when all the above is fully implemented, it is recommended to consider the implications of any humans who may be 'in the loop', using techniques such as Task Analysis and Human Reliability Analysis, which " amongst other things " take the design of the human-machine interface into account. This is clearly very important when designing a vehicle so that a person can drive it safely.

4.5 EM and physical specifications

To help manage the safety of a vehicle, an overall Safety Requirement Specification (SRS) is required for its safety-related systems (see [7]). This should include the EM and Physical requirements specifications resulting from the work described above.

The EM/physical specifications for each ESA to be used to construct a safety-related system should be derived from its SRS, taking into account any EM or physical mitigation measures applied by the system (e.g. shielding, filtering, surge suppression, anti-vibration mountings, forced air cooling, etc.).

4.6 A verification/validation plan

This plan must be capable of providing sufficient confidence in the EM/physical design, and also in the techniques used in serial manufacture of ESAs and vehicles. As described earlier, relying on EM testing alone could not provide sufficient confidence in achieving acceptable levels of safety risks, without a very time-consuming test plan that no-one could possibly afford " so this plan needs to employ a mixture of techniques, such as predictions, reviews or tests, for example:

• 'Calibrated' computer simulations

• Demonstrations

• Checklists

• Inspections

• Reviews and audits

• Independent assessments

• EM tests (e.g. factory acceptance tests) on ESAs, and on complete safety-related systems installed in vehicles

None of the above list of techniques can provide sufficient verification on its own. Testing can be a very powerful technique when it replicates the EM/physical characteristics of the real-world environment(s) as closely as possible. It is always best to base such tests on the standardized test methods and procedures, expertly modified as appropriate to better simulate real-life. A number of experts already do this, see [33].

Some design aspects may be able to be verified by calculation or simulation (using appropriately 'calibrated' computer software), and some by previous experience with similar designs used in similar environments. Specially designed checks or tests may need to be devised to verify that a particular design technique will meet the EM and physical specifications over the operational lifetime. All design verifications should relate to the foreseeable EM environment, for example the frequency range covered.

Highly-accelerated life testing (e.g. 'HALT') is a powerful tool for assessing the suitability of design methods, and of EM mitigation techniques such as shielding and filtering [26]. ESAs intended for use in safety-related vehicular applications will often be HALT tested anyway, so all that may be required is adding some EM tests (e.g. shielding effectiveness) during or after the life tests. It can be very easy and inexpensive to instrument a physical life test to detect degraded EM performance during the test, using appropriate test set-ups and methods (not necessarily using traditional EM test methods, e.g. EM test chambers).

Final verification/validation tests are always required on items of equipment for use in safety systems, and also for the safety systems themselves, when installed in the vehicle. But since traditional immunity tests are inadequate (see section 3) the tests often need to be specially designed to provide the required confidence without adding high costs.

For example, it is easy to test whether cellphones in close proximity or insulation faults could cause malfunctions " simply use cellphones in close proximity (using handsets modified to give full transmitted power), or create the insulation faults. And it is easy and quick to use 'close-field' probes to improve confidence at every stage in a project, such as checking for errors or defects in assembly/construction.

Reverberation chamber tests can be more representative of real-life operation than anechoic chambers [13] [14], and some military and aviation experts have developed such test methods for immunity to radiated EM fields. Some of these methods employ a range of modulation frequencies, not simply 1kHz sine or square waves.

Serial manufacture of vehicles can suffer problems that cause significant variations in EM performance, including

• Variations in purchased parts (e.g. semiconductor die-shrinks)

• Alternative or replacement parts

• Variations in plating, painting and fixing

• Differences in assembly (e.g. wiring)

• Design changes and improvements

• Firmware 'bug-fixes' and upgrades; etc.

Similar problems also afflict ESAs, and any hardware or firmware work done by subcontractors. So all of the build-state issues relevant for maintaining EM performance over the lifetime should be identified during the design process and controlled by Quality Control (QC) in serial manufacture. QC can use a range of techniques; including 'EM checks' on delivered goods and finished equipment; and sample-based testing designed to maintain an acceptable quality level (AQL). EM checks detect differences from the original build-state, and can be designed to require very little expertise in operation.

QC should employ competent personnel, backed up by appropriate testing, to assess every design change proposal for its EMC and functional safety implications.

4.7 The results achieved by the verification/validation activities

These should include details showing how any shortcomings in meeting the EM/physical specifications in the SRS, or in the specifications for the ESA, were dealt with, so as to fully achieve the SRS for each of the safety-related systems in vehicle.

4.8 Any measures necessary to maintain the EM performance over the lifetime

Any assumptions that were originally made about real-life EM and physical environments should be checked during the lifetime of a particular model of vehicles (typically 10 years from cessation of sales of that model), and appropriate actions taken if they turn out to be wrong.

Appropriate QC techniques are also required in Maintenance, Repair, Refurbishment, Modifications and Firmware Upgrades to ensure that the required EM and physical specifications are not compromised over the anticipated lifetime of a vehicle.

Regular vehicle service schedules might need to include certain checks and/or component replacements. Certain EMC tests might also need to be devised, and their equipment provided for use by relatively unskilled technicians in Dealers' service departments for use at scheduled intervals to help detect degraded EM performance of safety-related systems.

Automated diagnosis programs might need to be modified where EMI could be a cause of error, malfunction or damage in hardware or firmware.

Repair instructions might need to include techniques to maintain the vehicles required EM performance, and even for testing that it is acceptable, after the repair.

User Manuals might need to recommend some tasks for the user, to help maintain the required EM performance over the vehicle lifetime.

Instructions for servicing, maintenance and repair might also need to describe, in layman's terms, how to identify EMI as the potential cause of a problem, and maybe even how to deal with it.

4.9 Documentation — the 'Safety Case'

For a good defense in case of a legal challenge, for example under the Product Liability legislation in many developed countries such as the USA, Canada and the 27 countries forming the European Union, it is recommended to create a 'Safety Case' during product design and development that documents the following

• The worst-case EM and physical environments foreseen over the lifetime, and the evidence for them

• The hazard and risk analyses conducted, showing how they took the EM/physical environments into account to achieve acceptable safety risks despite EMI possibilities over the lifetime

• The specifications: the SRS and all the derived specifications for the ESAs, including how they were developed

• Details of the EM/physical designs and how they achieve the above specifications

• The verification and validation plans and how they achieve sufficient confidence in the designs

• The successful results of the verification and validation activities, and any modifications found necessary to achieve the above specifications

• The activities required to maintain the necessary EM performance over the anticipated lifetime (could include certain requirements for regular servicing by user or dealer, and requirements for repair and modification)

4.10 The amount of work required depends on the level of risk

Where safety risks are higher, and risk-reduction more important as a consequence, all of the work described in section 4 above should be more detailed, comprehensive and in-depth. It should also employ people who are more knowledgeable, and more expert in the techniques required.

5. Conclusions

This paper has described a dozen reasons why " for safety engineering " it is insufficient to rely solely on EM testing to cover the possibilities of EMI. An EM test plan that provided sufficient confidence could not possibly be affordable in time or cost.

Also, it has shown that rare EMI events that could cause a safety incident only once during a 10-year vehicle life, could still expose the driver to safety risks that are higher than those involved with the world's most dangerous occupations.

EMI is no different than any possible cause of hazards, including firmware [10]. Appropriate techniques in assessing the EM/physical environments, design; verification and validation; manufacture; maintenance and repair, are required for achieving acceptable safety risks over the vehicle's anticipated operational lifetime despite EMI.

The EM design must be appropriate for the foreseeable EM/physical environment. It must be verified and validated according to a control plan that uses a wide range of techniques to achieve sufficient confidence that acceptable levels of safety risks will be maintained over the vehicle's anticipated lifetime.

To be affordable, verification and validation should use a wide range of techniques, which will generally include some affordable EM testing. The EM testing techniques employed can use modified versions of traditional EM tests and a variety of non-standard EM tests designed to address specific issues (maybe even specific to a particular vehicle model) that are not covered by the traditional automotive test standards.

6. Acknowledgement

I wish to thank Simon Brown, Mark Bowell and John Cryer, all of the UK's Health and Safety Executive in Bootle, Lancashire; Tim Haynes of SELEX Sensors and Airborne Systems, Luton; Nigel Carter, now retired from Qinetiq, Farnborough; Gus Freyer, now retired from Universal Systems Inc., USA, and Dr Antony Anderson for sharing their knowledge and providing a great deal of advice and assistance to me in the area of 'EMC for Functional Safety' over the last 10 years.

I also wish to thank automotive industry experts Steve Offer, Robert Bosch Australia, and James Gordon-Colebrook of 3C Test, Silverstone, UK, for their assistance with this paper. I alone am responsible for all of the errors and shortcomings in this paper.

7. References

[1] D A Townsend et al, "Breaking All the Rules: Challenging the Engineering and Regulatory Precepts of Electromagnetic Compatibility", IEEE International Symposium on Electromagnetic Compatibility, Atlanta, 1995, pp 194 " 199.

[2] Automotive EMC Laboratory Recognition Program (AEMCLRP), a scheme organized by Ford Motor Company, General Motors, and DaimlerChrysler.

[3] Keith Armstrong, "New Guidance on EMC-Related Functional Safety", 2001 IEEE International EMC Symposium, Montreal, Aug. 13-17, ISBN 0-7803-6569-0/01, pp. 774-779.

[4] Keith Armstrong, "New Guidance on EMC and Safety for Machinery", 2002 IEEE International EMC Symposium, Minneapolis, Aug. 19-23, ISBN: 0-7803-7264-6, pp. 680-685.

[5] Keith Armstrong, "Review of Progress with EMC-Related Functional Safety", 2003 IEEE EMC Symposium, Boston, August 18-22 2003, Proceedings: ISBN 0-7803-7835-0, pp 454-460.

[6] IEC TS 61000-1-2,basic safety publication, draft second edition, January 2008, "Electromagnetic Compatibility (EMC) " Part 1-2: General " Methodology for the achievement of the functional safety of electrical and electronic equipment with regard to electromagnetic phenomena."

[7] IEC 61508, "Functional Safety of Electrical/Electronic/Programmable Electronic Safety-Related Systems", (seven parts).

[8] The IET, "Guidance document on EMC and Functional Safety", 2000, from: http://www.theiet.org/publicaffairs/sectorpanels/emc/index.cfm.

[9] "Commission Directive 2004/104/EC of 14 October 2004, adapting to technical progress Council Directive 72/245/EEC relating to the radio interference (electromagnetic compatibility) of vehicles and amending Directive 70/156/EEC on the approximation of the laws of the Member States relating to the type-approval of motor vehicles and their trailers", Official Journal of the European Union L 337/13 " L 337/58, November 13th 2004.

[10] IEC 61508-3: "Functional Safety of Electronic/Electronic/Programmable Electronic Safety-Related Systems " Part 3: Software Requirements".

[11] L. Jansson and M. Bckstrm, "Directivity of Equipment and its Effect on Testing in Mode-Stirred and Anechoic Chamber", IEEE Int. Symposium on EMC, Seattle, WA, August 1999.

[12] G.J. Freyer, "Distribution of Responses for Limited Aspect Angle EME Tests of Equipment with Structured Directional Directivity", The 2003 Reverberation Chamber, Anechoic Chamber and OATS Users Meeting, Austin, TX, April 2003.

[13] G.J. Freyer and M.O. Hatfield, "An Introduction to Reverberation Chambers for Radiated Emission/Immunity Testing", ITEM 1998, The International Journal of EMC, 1998.

[14] G.J. Freyer, "Considerations for EMC Testing of Systems with Safety and/or Reliability Requirements", EMC Europe 2004, Eindhoven, The Netherlands, September 6-10 2004.

[15] S. Wendsche and E. Habiger, "Using reinforcement learning methods for effective EMC immunity testing of computerised equipment", Proc. Int. Symp. Electromagnetic Compatibility (ROMA'96), Rome, Italy, Sept 1996, pp.221-226.

[16] R. Vick and E. Habiger, "The dependence of the immunity of digital equipment on the hardware and software structure", Proc. Int. Symp. Electromagnetic Compatibility, Beijing, May 1997, pp 383-386.

[17] RTCA/DO-160E December 9 2004, "Environmental Conditions and Test Procedures for Airborne Equipment, Section 20, Radio Frequency Susceptibiility (Radiated and Conducted)". See clauses 20.4 (conducted susceptibility) and 20.5 (radiated susceptibility) for a half-hearted attempt to include the actual sensitivity of equipment to modulation type or frequency. The same applies to RTCA/DO-160F (draft 061231).

[18] DaimlerChrysler Joint Engineering Standard DC-10614, "EM Performance Requirements ---Components", issued: 2004-01. See clause 7 for an ineffectual attempt to include the actual sensitivity of an ESA to modulation type or frequency.

[19] ISO 7637-2:2004, "Road vehicles -- Electrical disturbances from conduction and coupling -- Part 2: Electrical transient conduction along supply lines only"

[20] Colebrook et al, "Transient Test Requirements for "e"- Marking", Automotive EMC Conference 2003, 6th November 2003, page 6.

[21] Michel Mardiguian, "Combined Effects of Several, Simultaneous, EMI Couplings", 2000 IEEE International EMC Symposium, Washington D.C., Aug 21-25, ISBN 0-7803-5680-2, pp. 181-184.

[23] MIL-STD-464, "Electromagnetic Environmental Effects " Requirements for Systems", Department of Defense Interface Standard, 18 March 1997. [24] F Beck and J Sroka, "EMC Performance of Drive Application Under Real Load Condition", Schaffner Application Note, 11 March 1999.

[25] Martin Wright of British Telecom, Chair of CISPR/I, in a submission to the EMCIA/EMCTLA conference: "Interpretation of the EMC Directive 2004/108/EC", Newbury, UK, November 29, 2007.

[26] W.H. Parker, W. Tustin and T. Masone, "The Case for Combining EMC and Environmental Testing", ITEM 2002, pp 54-60.

[27] See the Wikipedia entry on 'Emergence', at http://en.wikipedia.org/wiki/Emergence.

[28] Simon J Brown and William A Radasky, "Functional Safety and EMC", IEC Advisory Committee on Safety (ACOS) Workshop VII, Frankfurt am Main, Germany March 9-10 2004.

[29] Keith Armstrong, "Why EMC Immunity Testing is Inadequate for Functional Safety", 2004 IEEE International EMC Symposium, Santa Clara, USA, August 9-13 2004,ISBN 0-7803-8443-1, pp 145-149. Also published in Conformity, March 2005 pp 15-23, http://www.conformity.com.

[30] Keith Armstrong, "Functional Safety Requires Much More Than EMC Testing",

EMC-Europe 2004 (6th International Symposium on EMC), Eindhoven, The Netherlands, September 6-10 2004, ISBN: 90-6144-990-1, pp 348-353. [31] Keith Armstrong: "EMC in Safety Cases — Why EMC Testing is Never Enough", EMC-UK 2007 conference, Newbury, UK, Defence & Avionics session, Wednesday 17th October 2007.

[32] Keith Armstrong, "Design and Mitigation Techniques for EMC for Functional Safety", 2006 IEEE International Symposium on EMC, 14-18 August 2006, Portland Oregon, ISBN: 1-4244-0294-8.

[33] Keith Armstrong, "Validation, Verification and Immunity Testing Techniques for EMC for Functional Safety", 2007 IEEE International Symposium on EMC, 9-13 July 2007, Honolulu, Hawaii, ISBN: 1-4244-1350-8.

[34] Keith Armstrong, "Assessing an EM Environment", available from the 'Publications & Downloads' page at www.cherryclough.com. [35] Keith Armstrong, "Specifying Lifetime Electromagnetic and Physical Environments " to Help Design and Test for EMC for Functional Safety", 2005 IEEE International EMC Symposium, Chicago, USA, August 8-12 2005, ISBN: 0-7803-9380-5, pp 495-499.

[36] William A Radasky, "2007 Update on Intentional Electromagnetic Interference (IEMI) and High Altitude Electromagnetic Pulse (HEMP)", Interference Technology's 2007 EMC Directory and Design Guide, pp 143-148, www.interferencetechnology.com.

[37] IEC 60300-3-9 "Dependability management — Part 3: Application guide — Section 9: Risk analysis of technological systems"

[38] IEC 60300-3-1 "Dependability management " Part 3-1: Application guide " Analysis techniques for dependability " Guide on methodology"

[39] Erik Hollnagel, "The Reality of Risks", Safety Critical Systems Club Newsletter, Vol. 17, No. 2, January 2008, pp 20-22, www.safety-club.org.uk

[40] Tim Kelly, "Are 'Safety Cases' Working?", Safety Critical Systems Club Newsletter, Vol. 17, No. 2, January 2008, pp 31-33, www.safety-club.org.uk

[41] Ford Motor Company, "Component and Subsystem Electromagnetic Compatibility, Worldwide Requirements and Test Procedures", ES-XW7T-1A278-AC, Oct 2003, www.fordemc.com/docs/requirements.htm

This is part two of a two-part publication. For part one, click here

Keith Armstrong is founder of Cherry Clough Consultants, Stafford, U.K. He is also President of the EMC Industries Association (EMCIA) and chairman of the IET Working Group on "EMC and functional safety". Keith can be reached by email under keith.armstrong@cherryclough.com

This is an extended version of the paper titled: "EMC for the Functional Safety of Automobiles — Why EMC Testing is Insufficient, and What is Necessary" presented by Keith at the IEEE 2008 International EMC Symposium, Detroit, 18-22 August 2008, ISBN: 978-1-4244-1699-8.