Hi Lorenzo,
Please let me know my understanding is correct for the below image as per your description.
The requirement proposed by FCA is very much an ASIL D requirement. But the implementation proposal cannot meet ASIL D by itself. As you see, the implementation is very much dependent on eDMA to transfer data from RAM to SIPI. Any error in eDMA to write data to SIPI would lead to deactivation of both the motors. I would suggest having additional checks to make sure the eDMA is sending data in a timely manner and there is a proper acknowledgment on SIPI. As eDMA is not replicated that totally doesn’t mean it cannot send safety critical data. As long the Safety software is implemented to make sure there are additional checks implemented like a checker to checker failsafe, this can meet ASIL D.
In this Scenario, an Additional check can be having an additional communication link between the two MCUs like sending the angular position information over CAN (just an example) and comparing it to the data received over Zipwire. Also, if the application has wheel speed sensors, master MCU can compare Speed on rear wheels not by just judging the data over Zipwire. There can be multiple ways this we can look at.
