Yes, multiple instances of a domain should be allowed. In the scenario, it states how this would be handled in the model; the navigation model would identify a “left rear braking” domain, and probably three other braking domains. The thing that the navigation model would not know is if the braking domains are all instantiations of the same domain.
Of course, this could also be handled by the navigation model defining a required service that included the target brake system as a parameter, which would then be distributed by the architecture to the correct domain instance.
.
