How formal microkernel isolation prevents untrusted telematics code from interfering with high-voltage PWM drivers and safety interlocks.
Tasks cannot open IPC channels or map memory buffers to physical contactor registers without explicit, unforgeable capability tokens.