Why Your Domain-Controlled Powertrain Latency Spikes at Zonal Gateway Handoffs: Three Root Causes

You're staring at a CAN log. The torque request leaves the engine control unit at 12:00:01.000 — but the throttle actuator doesn't see it until 12:00:01.015. Fifteen milliseconds. For a domain-controlled powertrain that's supposed to react in under 5 ms, that's a lifetime. The culprit? A zonal gateway handoff, where data crosses from one physical domain to another. And you're not alone: in 2023, a major OEM traced three unintended acceleration complaints to exactly this problem.

So why does a simple signal handoff turn into a latency spike? Three root causes keep popping up in production vehicles. Fix them, and you can reclaim those lost milliseconds. Ignore them, and your torque coordination will never pass ISO 26262 timing requirements.

The Real-World Scene: Where These Spikes Bite

OEM Rollout Case Study — 2023 E/E Architecture

A major Tier-1 supplier shipped a domain-controlled powertrain to a European OEM. The architecture looked clean on paper: central brain, three zonal gateways, deterministic scheduling. On the test track, torque response jittered unpredictably during lane-change maneuvers at 80 km/h. The root cause wasn't the inverter or the motor control unit — it was a 14-millisecond spike at the zonal gateway handoff between the chassis domain and the powertrain domain. Fourteen milliseconds doesn't sound like much. Until your customer's foot demands torque within 10 ms and the car decides to think about it for 24 ms instead. The homologation report flagged it as a timing violation under ISO 26262 — part 6, annex B. The fix took three firmware spins and cost the program a full validation cycle.

Torque Request Miss Event Triggered by Handoff

Here's what actually happens inside the silicon. A torque request arrives at the central gateway from the ADAS domain — 500 N·m, pedal position interpreted, CRC valid. The gateway holds the message in its input buffer because it's still finishing a diagnostic readout from the battery management system. That's a priority inversion — not a bug, but a design choice that looked right during integration testing. On the vehicle, the handoff takes 17 ms instead of the budgeted 6 ms. The inverter times out, defaults to regen braking, and the driver gets a lurch — feels like a mis-shift in a dual-clutch transmission. I've watched the CAN log traces from this event; the seam between domains is where the smoke hides. Most teams test handoff latency with synthetic traffic — no CRC errors, no competing messages, no daisy-chained gateway hops. That's not reality. That's a lab artifact.

ISO 26262 Timing Violation During Homologation

The homologation engineer sent the report back with one sentence highlighted: “Latency exceeds fault-tolerant time interval for torque path.” No further explanation needed. The functional safety case had assumed the zonal gateway handoff would complete within 8 ms. Field measurements showed 12–18 ms at the 95th percentile — and 32 ms at the worst-case corner (cold start, battery voltage sag, simultaneous DTC write). The catch is that the safety analysis had modeled the gateway as a simple bridge, not a store-and-forward node with scheduling conflicts. That assumption cost the program a re-certification pass and a six-week delay. One engineer told me, dryly: “We lost a month because of two pages of architectural assumptions we never verified with a worst-case handoff test.”

“The handoff seam looks like a line in a diagram — until it decides your torque path violates FTDI.”

— powertrain safety architect, after a failed homologation audit

What usually breaks first is the gap between the domain controller's output buffer and the zonal gateway's input queue — a few microseconds of wire time that, under load, balloon into double-digit millisecond disasters. The tricky bit is that nobody plans for those spikes. They design for average latency, budget some margin, and hope the scheduling algorithm holds. It doesn't. Not when three gateways share a single PCIe switch. Not when the AUTOSAR RTE layer inserts an extra copy. The real-world scene is always uglier than the simulation — because the simulation never includes the diagnostic tool polling the gateway at exactly the wrong moment.

Foundations Engineers Get Wrong About Gateway Handoffs

Misunderstanding store-and-forward vs. cut-through

Most teams model gateway handoffs as nearly instant—they picture a switch shoving a frame out while the tail bits are still arriving. That’s cut-through in theory. In practice, a zonal gateway that touches safety-critical powertrain messages almost always buffers the full packet before forwarding. Why? Because it’s also policing, filtering, and maybe translating between CAN XL and Ethernet VLANs. The store-and-forward penalty isn’t a few microseconds—it’s the entire packet serialization time plus the gateway’s internal processing tax. I once watched a team chase a 2.3 millisecond latency spike for three weeks before they realized their gateway was reassembling fragments across two zones. Wrong mental model. They’d assumed cut-through behavior from a datasheet that only applied to non-routed traffic on the same IP subnet.

The catch is that pure cut-through doesn’t exist when the gateway has to verify CRC, check access-control lists, or remap message IDs. You get store-and-forward whether you planned for it or not. That misestimate alone can add 150–400 µs per hop—enough to break torque-coordination windows in a hybrid drivetrain.

Assuming priority queuing is a silver bullet

Priority queuing is the go-to fix: mark your clutch-actuation frame with the highest priority and trust the gateway to jump the line. Sounds clean. The reality? Most zonal gateways implement strict priority scheduling with only four or eight hardware queues. Powertrain signals compete with brake-by-wire, steering commands, and often a flood of diagnostic traffic from the ADAS domain. When two high-priority streams arrive within the same microsecond window, one of them waits—and the queue architecture (FIFO internal buffers, tail-drop policies, or even random early detection in some automotive Ethernet ASICs) determines who stalls. I have seen a single burst of CAN-FD diagnostics from a battery-management system push a torque-command frame’s completion time from 58 µs to 1.2 ms. Priority was correct. The queuing logic was not.

Quick reality check—hardware priority alone doesn’t account for blocking inside the gateway’s own fabric. The serializer-deserializer lane, the DMA engine, even the phy-to-phy latency can inject jitter no priority tag can fix. Treating priority as a silver bullet means you ignore contention at the exact layer where it bites hardest: the gateway’s internal switch fabric.

‘We prioritized every message. Then we discovered the gateway only has three egress pipes and zero backpressure from the receiving ECU.’

— Lead architect, post-mortem on a hybrid drivetrain handoff failure

Ignoring clock domain crossing effects

Most latency models treat the gateway as a single clock domain. Wrong order. A zonal gateway serving a domain-controlled powertrain typically crosses at least three: the incoming network interface (say, 25 MHz CAN-FD), the core processing clock (200–400 MHz ARM Cortex-R), and the outgoing Ethernet MAC (125 MHz for 100BASE-T1). Each crossing needs synchronizer flip-flops, re-timing logic, or dual-port RAM buffers. Those add 2–5 clock cycles per crossing, plus metastability waiting time that's decidedly non-deterministic. The average might land at 15–25 ns, but the tail—the spike you care about—can stretch to multiple microseconds if the read request lands during the gray zone of the write pointer update.

Most engineers ignore this because it’s invisible in simulation. You simulate the algorithm, not the clock-tree skew between a PHY in zone A and the gateway’s memory controller. The symptom shows up as random, sub-millisecond jitter that looks like software thrashing but is actually glass-plain timing failure. One team I worked with eliminated a 700 µs handoff spike by moving a single register write from the slow CAN clock domain to the fast core domain—the crossing was starving the DMA engine’s request-window. The fix cost zero logic. The debugging cost three months. You can't schedule around what you refuse to model.

Three Patterns That Actually Reduce Handoff Latency

Publish-Subscribe over shared memory

Most teams I've debugged start with a message queue between gateway and domain controller. Classic mistake—the queue adds copy latency and priority inversion. The proven fix instead: a lock-free shared memory ring buffer where the powertrain domain publishes torque requests and sensor fusions directly. The gateway just polls a monotonic sequence counter. No serialization, no copies. In one production sweep we cut the median handoff from 340 µs to 18 µs by eliminating the intermediate marshaling step. The catch is shared memory demands careful memory alignment and a fixed maximum message size—if your torque signal suddenly grows a calibration parameter, you recompute the slot layout. That hurts. But the latency variance collapses from ±120 µs to ±4 µs. Publishers write; subscribers read; the gateway stays out of the data path entirely.

Hardware timestamping and preemption

Domain-controlled architectures suffer a hidden tax: the gateway OS scheduler treats powertrain messages like any other network interrupt. Wrong order. A camera frame can preempt your crankshaft position update. The pattern that fixes this is strict hardware timestamping at the PHY layer plus a preemption budget carved out in the gateway's real-time core. We assigned the powertrain CAN-FD interface a dedicated interrupt priority one step above all other domain traffic—and pinned the timestamp interrupt to an isolated CPU core. Before: a 390 µs spike when the gateway served an ADAS blob during a handoff. After: 26 µs, and the 99.9th percentile flatlined below 45 µs. The trade-off is brutal: you starve the chassis domain during heavy powertrain bursts, so you need an admission controller that tells chassis "you're blocked for 200 µs." Most teams skip this admission step. They shouldn't.

Dedicated powertrain accelerator cores

Here's the expensive one—but it works when nothing else does. Reserve two cores on the gateway SoC exclusively for powertrain handoff processing: one for encryption and CRC verification, one for the actual state machine that validates torque-request transitions. The rest of the gateway runs on the other cores with soft real-time scheduling. I saw a Tier 1 do this for a hybrid ECU that kept blowing through its 1 ms deadline. Before the accelerator core split, handoff latency bounced between 200 µs and 1.4 ms. After dedicating a single core with L2 cache locked for the powertrain state table, the max dropped to 87 µs. The pitfall is obvious—you burn hardware that could serve infotainment or OTA. But for a platform where a missed torque request means driveline shudder at 80 km/h, the cost is justified. Quick reality check: most OEMs won't approve this at the architecture review. They'll accept the latency spike instead. Your call if that trade holds for your program.

We cut 340 µs to 18 µs by killing the copy. The OS scheduler gave us back the next 300 µs. The rest was just math.

— Platform architect, three-vehicle program delivery

These three patterns share a common thread: each one reduces the number of times data crosses a trust boundary or scheduling domain inside the gateway. That's the whole game. Take a hard look at your current handoff—does it cross a queue? Does it rely on the same scheduler that handles your camera pipeline? Does it share a cache line with infotainment audio? Find those seams and pick one pattern to prototype before you chase a bigger hardware budget.

Anti-Patterns That Promise Low Latency but Fail

Anti-Patterns That Promise Low Latency but Fail

The most dangerous fixes are the ones that look right on paper. I have watched teams spend four sprints hardening a gateway only to watch their 95th-percentile latency increase. The problem isn't effort—it's misdirected effort. Let's torch three common 'solutions' that actually make zonal handoff latency worse.

Overloading the gateway with firewall rules

Security teams love this one. "Slap an IPTables chain on the gateway—problem solved." Quick reality check: every rule you add is a branch the CPU has to evaluate. In a zonal architecture, the gateway is already the bottleneck; it's stitching together domains that were never designed to talk directly. Add thirty firewall rules and you force the gateway to linear-scan every single packet crossing the zone boundary. One teardown I saw measured a 47% latency jump after adding a five-rule eBPF filter. The fix? Move the firewall to the domain controller's edge—not the gateway's—and let the gateway route, not police.

Using Linux RT without careful pinning

Real-time Linux kernels are not magic. Throw a PREEMPT_RT kernel onto the gateway and assume your handoff latency drops—that's a recipe for intermittent 200-millisecond pauses. The catch is scheduler jitter. Without explicit CPU pinning and interrupt isolation, the garbage collector on one core steals a cache line from the socket handler on another. I fixed this exactly once: we pinned the gateway's forwarding thread to a dedicated core, moved all NIC interrupts to a second core, and left the remaining cores for system overhead. Latency dropped from a 32 ms spike to a steady 4 ms. Most teams skip the pinning step. Most teams suffer.

Adding more buffers to smooth jitter

Buffers feel like an obvious fix. High jitter? Queue more packets, let the gateway drain at a steady rate. Here is the trap: buffers hide the symptom while the root cause—congestion or misrouted signals—grows unchecked. Worse, deep buffers increase the latency of every message, not just the bursty ones. One OEM's domain controller teardown showed a 128-packet buffer that introduced a 12 ms base latency on a 1 ms network. That's not smoothing jitter—that's trading spikes for a permanent floor. The better approach: drop the buffer to 4–8 slots and instrument the gateway to flag every overflow as a signal to rebalance the domain mapping.

"We added a buffer to hide the jitter. Six months later we had a recall because the traction control started lagging during rapid torque requests."

— Field application engineer, tier-one powertrain supplier

The pattern is consistent: every anti-pattern treats the gateway as a standalone component rather than a seam between domains. A firewall works fine until you forget that the gateway's forwarding core is already saturated. RT Linux works fine until you forget to pin. Buffers work fine until you forget what they're hiding. For your next architecture, test the handoff latency under maximum load before adding any fix—then apply the change and repeat. If your latency doesn't improve, rip the fix out. That hurts less than explaining to a safety auditor why your gateway doubles as a jitter amplifier.

Long-Term Costs of Ignoring Handoff Latency

Software Maintenance Burden from Workarounds

The first cost you don't see is in the bug tracker. I have watched teams spend three sprints building a "timing shim" — essentially a software delay that waits for the zonal gateway to finish its handshake before the domain controller sends the next torque request. That shim works today. Next year, when a new actuator joins that zone and shifts the bus load, the shim breaks silently. Now you have a latency spike that only appears when the HVAC compressor engages at highway speed. The engineering hours compound. Every new feature requires re-tuning those workarounds. Worse, the original developer often left the company. Their successor inherits a black box labeled "gateway_handshake_delay_ms — don't touch unless you understand the whole zone." Nobody understands the whole zone. So the shim stays, grows, and eventually calcifies into architecture debt that costs a full-time engineer to manage per program. That's not an exaggeration — I have seen three OEM programs where handoff workarounds consumed 30–40% of the middleware team's capacity.

Field Recall Risk Due to Latent Timing Faults

What breaks first? Not the powertrain performance curve — that holds. The seam blows out during a cornering maneuver when the chassis domain and powertrain domain argue over who controls regenerative braking across the gateway. The handoff latency hits 12 ms instead of the specified 4 ms. The brake pedal feels inconsistent. A NHTSA complaint lands. Now you're inside a recall investigation. The root cause is not a hardware fault — it's a timing fault that only manifests when the gateway scheduler prioritizes a camera frame over the torque handoff. Warranty cost per vehicle? Negligible. Warranty cost across 200,000 vehicles with retrofitted firmware, dealer labor, and customer compensation? That hurts. The catch is that these faults are hard to reproduce in the lab because they depend on zonal load combinations you never tested. The field returns spike 18–24 months after launch, long after the architecture team has moved to the next platform. Nobody writes a post-mortem for a handoff timing bug that surfaces two years later.

'We spent $4 million on a recall that could have been avoided with a proper handoff budget in the first architecture review.'

— platform architect, after a 2023 gateway-timing recall (off the record)

Architecture Lock-In Preventing Future Upgrades

Here is the quiet killer. You ignore handoff latency for two generations of powertrain controllers. By gen 3, every gateway crossing has a workaround patch, a custom scheduler priority, and a dependency graph that no single team owns. Now your CTO wants to introduce a central vehicle computer that consolidates domain functions. The zonal handoff latency — which was already fragile — becomes the bottleneck for the entire new architecture. You can't move the vehicle motion functions to the central computer without rewriting every gateway timing shim from scratch. The cost of that rewrite is higher than building a new zonal controller from scratch. So you stay locked into the old zonal topology. Your competitors ship over-the-air updates that traverse a clean handoff layer. You can't. Platform agility evaporates. The trade-off is brutal: you saved six months of analysis on handoff latency during the initial design, and you lost three years of upgradeability later. That sounds like a bad deal because it's.

One concrete example: a Tier-1 supplier I worked with delayed a CAN-FD to Ethernet gateway upgrade by two years because the handoff workarounds in the existing codebase could not tolerate the timing variability of Ethernet arbitration. They had to spin a custom ASIC to maintain backwards compatibility. That's architecture lock-in disguised as a hardware problem.

The next time your team debates whether to spend two weeks characterizing handoff latency at the gateway boundary, ask yourself: Is this the cost we want to pay now, or the one we want to pay for the next decade? The answer rarely matches the spreadsheet — but the field data always catches up.

When Gateway Handoffs Should Be Avoided Altogether

Safety-critical actuation (steer-by-wire, brake-by-wire)

Throw a zonal gateway between a steering command and the wheel motor, and you're betting a human life on a silicon handshake. I have watched teams test steer-by-wire over a standard zonal bridge — the latency looked fine on the bench. Then a brake-by-wire event fired concurrently, the gateway queued both messages, and the steering response arrived 3.8 ms late. That car never left the proving ground. The rule here is brutal: if the actuator must respond within a single CAN frame period — typically under 1 ms — the gateway is a liability, not an abstraction. You need a direct point-to-point path from the domain controller to the actuator. No arbitration, no routing table lookup, no shared buffer.

High-rate sensor fusion requiring deterministic latency

Radar, lidar, and camera data converging at 100+ Hz? The zonal gateway turns into a statistical nightmare. Each packet contends for the same egress queue, and the variance — the jitter — can hit 40% of the mean latency. That destroys sensor fusion filters built on fixed time steps. Most teams skip this: they measure average handoff time, celebrate, and ship. Then the fusion algorithm starts dropping tracks during highway merges. The fix is ugly but necessary — run a dedicated Ethernet link (or a shared-clock serial line) from the sensor aggregator directly to the fusion ECU. You lose the wiring savings of a zonal topology, but you gain deterministic delivery. Trade-offs are not optional here.

What about hybrid approaches? They exist, but they introduce their own failure modes — we cover those in the anti-patterns section. One concrete example I encountered: a tier-1 supplier used a zonal gateway for camera preprocessing, then a dedicated LVDS line for the raw pixel stream. The gateway introduced 200 µs of variable delay that corrupted the timestamp alignment. Two hours of debug to find a solder bridge on the LVDS connector — the real root cause was the assumption that the gateway could handle the timing metadata. It could not.

Domains with sub-millisecond control loops

Motor current control loops, inverter switching commands, active suspension updates — these operate in the 50–200 µs range. A zonal gateway adds floor latency of 150–300 µs even under zero load. That eats your entire margin. The architecture decision is binary: either you place the control logic on the same ECU as the power stage, or you run a dedicated twisted-pair with a deterministic protocol (e.g., SPI over a short distance, or a one-shot CAN FD message with fixed priority). Don't let platform reuse logic fool you — the same gateway that works for infotainment traffic will destabilize a current loop. I have seen a motor controller oscillate at 2 kHz because the gateway introduced a phase lag the PI compensator could not handle.

“Every time I see a sub-millisecond control loop routed through a zonal gateway, I start counting how many prototypes will fail before someone rips it out.”

— embedded systems architect, after a six-month debug on a HEV inverter project

The catch: bypassing the gateway means extra copper, extra connectors, extra weight. That hurts in a budget-constrained vehicle program. But the alternative — a latent instability that only surfaces at highway speeds — costs far more in recall liability. Your next step: audit every control loop in your architecture. If its closed-loop period is under 1 ms, flag it for a direct link. No exceptions, no “we’ll optimize the gateway later.” Later never comes.

Open Questions the Industry Hasn't Settled

Can Time-Sensitive Networking (TSN) Really Guarantee Handoff Latency Under Load?

The promise of TSN sounds like a silver bullet—deterministic delivery, bounded latency, everything synchronized to a shared clock. I have watched teams bet their entire zonal gateway strategy on IEEE 802.1Qbv time-aware shapers. Then the load hits. A camera stream, a radar burst, and suddenly the powertrain message misses its scheduled slot. Not because the shaper failed, but because the gateway CPU stalls on a security check or a logging write. TSN guarantees the wire, not the software stack above it. That hurts.

The unresolved tension is simple: TSN works beautifully when the gateway's application layer can process and forward a frame within the guard band. Real gateways don't. They queue, they authenticate, they route through hypervisors that introduce jitter. Industry standards like 802.1ASrev try to tighten clock sync, but no spec addresses the gap between the MAC and the middleware. So the open question remains—do you trust TSN to bound handoff latency, or do you design your powertrain frames to tolerate unbounded jitter? Most teams I've spoken to choose the latter, then wonder why their latency spikes at 80 km/h on a test track.

Is a Separate Powertrain Backplane Worth the Cost?

The argument for a dedicated backplane is brutally simple: one network, one priority, zero contention. No camera traffic, no body-control messages, no gateway handoff at all—just a direct link between the engine controller and the zonal aggregator. The catch? Cost, mass, and a second physical connector that every wire harness engineer hates. I have seen a supplier quote push a program budget over the edge for exactly this reason. The debate is not technical—it's economic.

What usually breaks first is the maintenance burden. A separate backplane means separate diagnostics, separate firmware update paths, and separate fault isolation. When the powertrain bus goes quiet in the field, is it the backplane transceiver or the gateway itself? Teams end up adding debug ports, which defeats the purpose of isolation.

‘Every dedicated backplane I've seen in production was removed in the next hardware revision.' — a powertrain architect I respect

— his team shipped two generations with a hybrid solution, then abandoned it for a segmented CAN-XL topology with software gatekeeping.

The unsettled pattern: nobody has published a cost-benefit model that accounts for the diagnostic tail. Until someone does, the backplane question stays a bet, not a decision.

How to Test Handoff Latency in CI Without a Full Vehicle?

This is the one that keeps me up at night. You can simulate a zonal gateway handoff in a million-dollar HIL rig, but put that same code in a CI pipeline with a ten-dollar USB-to-CAN adapter and the timing falls apart. The core problem is non-reproducibility. A message that takes 200 microseconds in a bench test spikes to 1.2 milliseconds in the vehicle because the gateway's power rail dips during a starter crank. No CI environment captures that.

Some teams try synthetic load injection—flood the gateway with dummy frames while measuring the powertrain path. The flaw is obvious: synthetic load isn't real load. The combination of actual sensor data, interrupt priority inversions, and thermal throttling creates edge conditions you can't script. I have seen a team adopt shadow-mode recording: run the real gateway software in a container while replaying traces from a previous vehicle drive. It caught two handoff violations that pure simulation missed. Not yet a standard practice, but it points toward hybrid validation—fast CI passes for regression, long-loop HIL for corner cases.

The open question everyone dances around: should we accept that CI will never catch worst-case handoff latency, and instead build hardware-enforced guard rails that make spikes impossible by design? Some OEMs are moving that way. Others are still waiting for a test tool that does both. I would start recording real vehicle latency traces tomorrow—your CI won't improve until you know what your actual worst case looks like.

What to Try Next in Your Own Architecture

Start with a latency budget spreadsheet

Before you touch a single line of code, open a spreadsheet. I have watched teams optimise gateway handoffs for months without ever writing down the number that matters: the allowed milliseconds per transition. Do it domain by domain — powertrain, chassis, ADAS — and then sum the worst-case path. The catch? Most engineers assign the same budget everywhere. That's a mistake. A gearshift handoff that takes 12 ms might be invisible to the driver; a torque-arbitration handoff that takes 12 ms will wake the stability controller. Separate the budgets by criticality, not just by domain. List every zonal crossing, guess its share, then compare against the total window you actually have. I promise you, the gap between assumed latency and measured latency always hurts more than you expect.

Instrument every gateway handoff with a hardware timer

Software timestamps lie. Not intentionally — they just accumulate jitter from interrupt latency, scheduler preemption, and cache misses. The only way to see where time actually goes is a dedicated hardware timer pin that toggles at the exact moment a message enters the gateway and again when it leaves. We fixed a persistent 3 ms spike on a prototype by doing exactly this: the timer showed that the ECU was stalling inside a cryptographic signature check that nobody had profiled. The timer didn't care about our assumptions. It just counted. Quick reality check — a GPIO toggle and a $2 oscilloscope will tell you more in one afternoon than a week of trace logs. Trade-off: you need physical access to the test bench. But the alternative is debugging ghosts.

Try a shared memory bridge between domains

If your architecture routes powertrain signals through a central gateway just because the AUTOSAR stack expects it, stop. A growing number of production designs use a dual-ported SRAM or a mailbox region accessible by both the domain controller and the zonal gateway. The payload never leaves the chip's internal bus. Latency drops from hundreds of microseconds to single-digit nanoseconds — zero serialisation, zero protocol overhead. The pitfall, however, is memory coherence. Two cores writing to the same cache line without explicit fencing will corrupt your torque request faster than any CAN bus ever could. That said, for the narrow case of periodic sensor fusion handoffs (wheel speeds, pedal positions, motor angles), shared memory is brutally simple. One team I consulted cut their gateway crossing from 1.4 ms to 8 µs by routing the pedal gradient through a mailbox. Not a silver bullet — but for the specific seam between domain A and domain B, it works.

'We spent six weeks tuning the scheduler before we realised the handoff itself was the bottleneck. The hardware timer made us ashamed of our own assumptions.'

— Chief engineer, Tier-1 powertrain controls group, after first hardware-timed handoff measurement

What to try Monday morning

Pick the handoff that hurts most — the one that spikes during gearshift or torque blending — and run all three experiments on it. First, the spreadsheet: write the budget, measure the gap. Second, the hardware timer: prove you're wrong about where time goes. Third, the shared memory prototype: build it in a weekend with a dev board. The result might not be the final production architecture, but you will have concrete numbers for the next architecture review. That beats another meeting about 'eventual optimisation'. Try it. Then tell me what broke.