Any modern car is designed with load dump clamping (within the alternator), so 40 or 45V rating is OK. For the last 20 years I work in this field I haven't seen any automotive customer asking for anything more for the 14V power system.
So most of the common power management chips are indeed OK (in fact that is why the 40V rating is so common). So a 60V device is more than enough.
Normally the one second requirement is practically a DC requirement for electrical rating (no excessive current appearing like breakdowns,...). It just mean the thing does not need to be able to handle the load dump from the power dissipation perspective (e.g. a 5V regulator loaded by 100mA needs to be designed for 1.3DC, 2.8W for one minute and 3.5W just for that one second, but electrically it needs to be rated for the 40V on its input).
So a capacitor charged to 40V only adds extra thermal energy, for a 220uF (which should be way sufficient here) it will be about 0.176J, so a 300mW rated component will discharge it within half a second when the power dissipation is within its rating. So unless you plan to use 10's of mF, I do not see problem there...
The hysteresis feedbacks are indeed wrong there.
With hysteresis, the feedback loop forming it (so from the output back to the input) needs to be fast, without any low pass filter in it. Otherwise the inputs may be lingering for way too long time close to each other, so even a bit of wrong feedback or some noise and you have the output toggling erratically - exactly the behavior the hysteresis is supposed to prevent in the first place.
And for the same reason it needs to be as short as possible, so over as few stages as possible (you should not forget the comparator alone has at least 3..4 gain stages inside, normally when reviewing a circuit which is supposed to becoming part of an integrated circuit, I consider that as way too much and question such designs whether it is really necessary). Here you have no other option than go over the whole comparator, but the extra transistor inverter could be avoided.
So separate the filter capacitor by some extra resistor from the comparator input.
or (the better way, as it avoids the hysteresis loop to go via the extra transistor inverter) implement the hysteresis loop around the noninverting input on the reference.
For the "proper PWM":
The SG3525 would make sense, but it has somewhat restricted logic if you want to implement all 3 modes (100%, 50% and 0% when faults are detected), that logic needs to be glued on externally, so the simplicity goes away.
The symmetry with the frequency divider is indeed precise, but according to me not really needed for the task.
I would use very simple astable multivibrator (along
the first picture) using two gates from CD4001, while the second inputs are connected together to the "100%/50%" switchover signal (High means the multivibrator will be stopped, outputs permanently low, so the next stage will invert it to both transistors permanently ON), with the other two gates used to switch the output OFF when a fault is detected (over/under voltage, over temperature,...). The second pair of the gates then can practically directly drive the MOSFET gates via some NPN/PNP push-pull follower and few resistors to control the gate currents.
When the resistor feedback is not coming from the NOR gates output but from the drains of the output FETs (normally the supply voltage for the CD4001 and the lamps will be nearly identical, so the levels will be correct) and add some bleeder (e.g. 10kOhm) resistors parallel to the FETs, the circuit will stop oscillating once one of the lamps burns out, so prevent the circuit from kicking into the car supply system when one of the loads disappear, it will then leave the second lamp at full brightness.
Then a quad comparator IC will be used to observe the supply and do the UV/OV and the transistor temperature and destaturation monitoring and generate the High for the second pair of the NORs in order to shut the output down.
The CD4001 supply can be then done by just a series resistor of about 1kOhm and a 15V Zener diode, which will protect both the CD4001, as well as the MOSFET gates against overvoltage events (load dumps,...). Similar series 1kOhm could be used to supply the quad comparator. Then you need no voltage regulator and you push all the overvoltage events onto the resistors. To withstand the 40V load dump, the 1kOhm resistors will need to be about 0.5W rated and still have margin for the 1s load dump time.
Yes, the astable multivibrator won't be that precise, but if you make sure you connect the circuit in a symmetrical way (if one side the "A" input goes to the timing RC, on the other side it needs to be the "A" as well, the inputs are not equal) and use the same type of components, the timing may vary a lot, but both sides will vary the same way, wheather it is because of temperature drift, voltage dependence, the CD4001 process variation or aging, so the duty will stay close enough to the required 50% for this application.
Later on today I will try to draw what I mean...
Update:
This is the core of what I mean.But generally this application, even such simple, is really asking for a small microcontroller: An ATtiny13V with two pairs of gate driver transistors (to translate the outputs to 12V levels for the gates) would make the circuit way simpler, yet allow way more refined operation and mainly protection logic (e.g. ON state voltage drop monitoring, with decent debouncers and retry logic in order to allow protection against short to VBAT, yet to not shut down on any disturbance spike,...).
And by the way the "simple series resistor" would be way greater nightmare to design, even ignoring the corrosion problems.
\First 2x 100W dissipation is ridiculous power to handle in the crammed car environment without forced cooling. Then deal with the failure of such cooling.
Unlike 1mOhm MOSFETS, a lamp short circuit won't just blow the upstream fuse, because the resitors would limit the current (to about 45A, so not that much above the 20A normal working current of each lamp). But it would cause them to generate about 10x as much heat than in normal operation, so a short circuit would be an event really asking for severe car fire.
So no, something that may seem simple can really very quickly become unsolvable nightmare.
