Normally they are seperated. Safety related features run on dedicated ECUs running a real-time OS like Autosar. They are communicating via bus systems (CAN, LIN

Normally they are seperated. Safety related features run on dedicated ECUs running a real-time OS like Autosar. They are communicating via bus systems (CAN, LIN, Flexray). Even the vehicle related features on infotainment systems normally run on a dedicated CPU in the headunit (running an RTOS) which communicates with the entertainment-related CPU (running WinCE, QNX, Linux...) by IPC. Some bad designs might neglect those guidelines and build everything in one box to save costs. However I hope that those only happens in the cheapest offerings. However I think the discussion between Ford and MS could be more due to political reasons. Automotive OEMs like to put all risks (whether likely or unlikely) to their suppliers and make them liable. Changes from standard automotive contracts are unlikely. And MS might not be not accept such a standard contract.