>> One way to avoid this is to design the HMI and functional >> logic as distinct communicating action systems Good heavens, woman - next you'll be suggesting that an unprotected head-unit should not be allowed to communicate directly onto the vehicle control bus? Regards Andrew