|
4. What needs to be done
It is recognized that the approach described below will require a significant learning curve for many manufacturers. In addition, functional safety assessors (e.g. those already qualified to assess to [7]) will need to develop the necessary skills to assess good EM engineering practices and their verification. Perhaps some EMC testing laboratories will also develop the necessary skills to assess the EMC for Functional Safety of a product's design.
But in a changing world, where electronic technologies are continually advancing and being applied in more areas where they could have impact on vehicle safety, we should not expect that the verification techniques we use to ever stand still. The use of electronics in safety-rated applications in products sold in high volumes to consumers is still new enough that the safety verification and validation processes have not yet caught up with what is actually needed.
This paper should be seen as part of the process by which acceptable safety and financial risks are maintained despite the increasing use of high technology in vehicles.
4.1 We can't afford to rely solely on EM testing, where safety risks are concerned
The main problem with automotive electronics is that everyone in the process is subordinate to the vehicle manufacturers. It is anything but a collaborative process, and engineering success is almost totally dependant on the depth of knowledge of the vehicle manufacturer. ESAs go through several stages of EMC test during development, both at component level and at system or vehicle level. Development proceeds based on ESA testing, acceptance is dependant on system level performance.
All testing is performed to standards produced by the vehicle manufacturer; sometimes based on international test standards with deviations. Some deviations have a minor impact; some introduce fundamental errors. By the time a vehicle 'platform verification program' is disseminated to the lowest levels in the Tier 1 or Tier 2 suppliers, it can often be reduced to nothing more than poorly resourced and poorly educated people being required to tick a series of boxes.
The problems described in the above paragraph apply to the usual issues of EM compliance to the traditional EMC test regimes. But as has been shown in Section 3, when it comes to safety risks the traditional EMC test regimes are insufficient for many reasons, and their benefits (or not) for controlling safety risks is unknown.
Sufficient confidence in achieving acceptable safety risks, using EM testing alone, would require fully addressing all of the issues raised in section 3 above. This would require a test program that no organization (or government) could afford, either in terms of cost or timescale.
Since we cannot afford to rely solely on EMC testing, we need to be cleverer, to be able to demonstrate that the EM performance will reliably ensure the required levels of safety risks over the anticipated lifetime, despite the inevitable cost constraints.
The cleverness required is achieved by appropriate EM design, so that vehicles' safety-related systems are confidently expected to achieve the necessary EM performance over the anticipated lifetime, given the reasonably foreseeable EM and physical environments [32].
In addition, the EM design must be verified and validated, in a manner that is capable of achieving the necessary confidence given the acceptable levels of risk and cost. Greater risks require more confidence in the EM design and its verification, than lesser risks. Verification and validation of the EM design should use a wide range of techniques, and will generally include some affordable EM testing [33].
|
