[JHolland]

3 µC in the same design.... it's a strange design. Maybe there is one too many, no?

On most systems with onboard DBW I've seen I have found at least 4 independent processors, 3 for DBW only, and more for everything else. This is a redundant safety system similar to the Space Shuttle guidelines, that if all 3 agree you're fine, but if one does not agree it goes to "limp" mode and if none agree it is full shutdown (which one is right?).

The Space Shuttle was designed in the 1970s, now we have processors that support functional safety. Lockstep processors with EC memory and buses and fail safe clock switching is the norm, it must be 10 years since I saw a safety design that had more than one processor, other than a smaller 'limp mode' processor.
As an example, for an ETB controller, an MPC5744 with a safety supervisor, can meet IS0-26262 ASIL level D which is the highest level there is is and is required for ETB engines with an auto trans.

[PSIG]

Heh, the Space Shuttle flew on the equivalent of today's digital watch. But the point is that many readers think an Arduino or PIC chip for ETC is great and you're done. Lots of videos and projects (even here) show that. It's not, of course. My post was intended to be about the error safety concept and getting that across, not exploring slick and modern ways to do it once they get the idea. I figured that was next, and you're touching on it now.