[Android Head-Units] looxonline:
This looks exciting. Lot's of effort resulting in an Android system that is put together the way it should be. Many kudos.

If you are looking at making some changes you could save some cash by dropping the optocouplers. I know that it sounds like the craziest idea ever but I swear all you need to protect a MCU pin from the outside automotive world is a 220k resistor and a 100nF cap. Cap is on the side of the pin, resistor connects to the outside world. When I first started work at an automotive dev company I saw this arrangement and nearly fell off my seat. Turns out that almost every single MCU/CPU/device with an IO pin out there has a very simple protection cct on each pin which consists of two internal diodes per pin. Anode on the pin with cathode to VCC for the high side protection, anode on 0V and cathode on the pin for the low side protection. Some manufacturers just used a single zener with the anode on 0v and the cathode on the pin and this offered both high and low side protection. By putting the signal from the car through the 220k you technically are driving the pin such that the protection circuit is coming into play but the energy that you are driving into the circuit is SO low that the diode easily handles it and the VCC rail just sinks the tiny current elsewhere. The cap is there to protect against induced noise and very low energy but high voltage spikes that may appear on the input line. I was skeptical until I learned that this had been used on a high seller that was installed into over 3 million vehicles... After working there for 8 years I had designed it into every product I worked on and swore by it. Maybe give it a try. I swear it won't disappoint.

By far the largest killers of products that I found was overshoot caused by jump starting and installers making silly mistakes. Installers would often connect outputs directly to the items they were meant to drive instead of going through a relay first. Ever tried driving a horn with a FET? We ended up using some pretty neat protected FETs to solve this but they were costly. Another common installer error is incorrect polarity on the power lines or on the IGN/ACC line. Simply solved by putting diodes in series with the VCC and IGN/ACC inputs. The jump start issue was more tricky to solve. At first we were using a MOV based circuit to try and absorb the energy from the spike and it would often work but it was costly and too "soft" in the turn on conditions which led to it sometimes not working as desired. We eventually moved across to a solution which was dirt cheap but absolutely brilliant in how well it worked. It was just a BJT, a FET and a few passives around them. As soon as the input voltage exceeded a certain rate of change (early warnings of a large incoming spike) or a certain voltage then it would completely cut power to the rest of the board for the duration of the spike. In the end the only limit to the level of spike it could handle was the reverse voltage of the FET body diode. The circuit passed all OEM load dump tests and is operating in several hundred thousand cars today. The only downside to it was that your product would lose vehicle power during a load dump condition and need to rely on an internal battery to continue operating. Since jump starting or any load dump condition is very infrequent this was not much of a negative for our applications.