Electronics Guide

ECU Architecture

A typical ECU consists of several key components:

• Microcontroller: The processing core, typically a 32-bit device with integrated flash memory, RAM, and peripherals optimized for automotive applications
• Power supply: Voltage regulators that convert the vehicle's nominal 12 V or 48 V supply to the regulated voltages required by electronics
• Input conditioning: Circuits that interface with sensors, switches, and other input signals, providing protection and signal conditioning
• Output drivers: Power electronics that control actuators such as motors, solenoids, and relays
• Communication interfaces: Transceivers for CAN, LIN, Ethernet, and other vehicle network protocols
• Protection circuits: Components that guard against reverse polarity, load dump transients, and electrostatic discharge

ECU hardware must comply with automotive qualification standards. Components are rated for extended temperature ranges, typically -40 to +125 degrees Celsius, and must pass rigorous qualification testing defined by standards such as AEC-Q100 for integrated circuits and AEC-Q200 for passive components. The electrical environment is harsh: the ISO 16750 and ISO 7637 standards characterize the supply transients, such as load dump, that ECUs must survive without damage or malfunction.

ECU Categories

ECUs are commonly categorized by their function within the vehicle:

Powertrain ECUs control the engine, transmission, and related systems. The Engine Control Module (ECM) or Engine Control Unit manages fuel injection, ignition timing, emissions control, and numerous other engine functions. Transmission Control Modules (TCM) handle gear selection and shift timing in automatic transmissions.

Chassis ECUs manage vehicle dynamics and safety systems. Anti-lock Braking System (ABS) controllers prevent wheel lockup during braking. Electronic Stability Control (ESC) systems detect and reduce loss of traction. Adaptive suspension controllers adjust damping based on road conditions and driving style.

Body ECUs control comfort and convenience features. Body Control Modules (BCM) manage lighting, power windows, door locks, and other body functions. Climate control systems regulate heating, ventilation, and air conditioning. Seat and mirror controllers handle position adjustments and memory functions.

Infotainment ECUs provide entertainment and information services. Head units manage audio, navigation, and display functions. Telematics Control Units (TCU) handle cellular connectivity, over-the-air updates, and emergency services such as eCall.

ADAS ECUs implement advanced driver assistance features. These specialized controllers process sensor data and execute the algorithms that enable features such as adaptive cruise control, lane keeping assistance, and automated emergency braking.

AUTOSAR Classic Platform

The Classic Platform defines a layered software architecture for traditional embedded ECUs:

Application Layer: Contains Software Components (SWCs) that implement vehicle functions. SWCs communicate through standardized interfaces defined by ports and interfaces, enabling them to be developed independently of the underlying hardware.

Runtime Environment (RTE): Acts as an abstraction layer between application software and basic software. The RTE routes communication between SWCs and provides access to services, hiding the details of inter-ECU communication and task scheduling.

Basic Software (BSW): Provides standardized services to applications. The BSW is organized into several layers:

• Services Layer: Operating system, communication services, memory services, and diagnostic services
• ECU Abstraction Layer: Hardware-independent interfaces to ECU peripherals
• Microcontroller Abstraction Layer (MCAL): Hardware-specific drivers for the microcontroller

The Classic Platform uses a static architecture where software configuration is determined at design time and compiled into the ECU. Its real-time operating system follows the OSEK/VDX heritage and provides priority-based, statically configured task scheduling. This approach optimizes resource usage and provides deterministic timing behavior suitable for hard real-time applications.

AUTOSAR Adaptive Platform

The Adaptive Platform addresses requirements of next-generation vehicles, particularly for high-performance computing applications such as autonomous driving and connected services.

Key characteristics of the Adaptive Platform include:

• POSIX-based operating system: Runs on a POSIX-compliant OS (specifically the PSE51 profile), enabling use of standard programming languages and tools
• Service-oriented architecture: Applications communicate through services discovered at runtime rather than statically configured, commonly using the SOME/IP protocol over automotive Ethernet
• Dynamic execution: Applications can be started, stopped, and updated during vehicle operation
• High-performance computing: Designed for multi-core processors with multiple gigabytes of RAM
• C++ language: The platform interface is specified to be compatible with C++14, and projects are free to adopt newer language standards

The Adaptive Platform is particularly suited for ADAS, autonomous driving, and vehicle-to-everything (V2X) applications that require high computational performance and the flexibility to update software throughout the vehicle's lifecycle. In practice, a single vehicle often combines both platforms: Classic ECUs for deeply embedded, hard real-time control, and Adaptive ECUs for the high-performance domain and zone controllers.

AUTOSAR Benefits

AUTOSAR provides several advantages for automotive software development:

Portability: Standardized interfaces allow software components to be reused across different ECUs and vehicle platforms without modification.

Scalability: The architecture supports ECUs ranging from simple body controllers to complex domain controllers while maintaining consistent development practices.

Tool ecosystem: A robust ecosystem of commercial and open-source tools supports AUTOSAR development, including code generators, configuration tools, and verification frameworks.

Supplier integration: Standardized interfaces simplify integration of software from multiple suppliers, reducing development time and improving quality.

Controller Area Network

CAN (Controller Area Network) is the most widely used automotive network technology. Originally developed by Bosch for automotive applications, CAN provides reliable, real-time communication between ECUs.

Classical CAN supports data rates up to 1 Mbps with 8-byte payloads. Its message-based protocol with priority-based arbitration ensures that critical messages are transmitted first. CAN's robust error detection and fault confinement mechanisms make it highly reliable in the electrically noisy vehicle environment.

CAN FD (Flexible Data-rate) extends CAN with payloads up to 64 bytes and data rates up to 8 Mbps during the data phase of message transmission. CAN FD addresses growing bandwidth requirements while maintaining compatibility with existing CAN infrastructure.

CAN XL, the latest evolution, further increases payload capacity to 2048 bytes and supports data rates of 10 Mbps and higher, bridging the gap between traditional CAN and Ethernet for backbone and sub-backbone networks. CAN XL and the underlying CAN protocols are standardized in the ISO 11898 series.

Local Interconnect Network

LIN (Local Interconnect Network) is a low-cost, single-wire network used for low-speed applications where CAN's capabilities would be excessive. LIN operates at speeds up to 20 kbps and uses a master-slave architecture where a single master node schedules all communication.

Typical LIN applications include seat controls, mirror adjustments, rain sensors, and other body functions. LIN reduces wiring complexity and cost compared to point-to-point connections while providing sufficient bandwidth for these applications.

FlexRay

FlexRay is a deterministic, fault-tolerant network designed for safety-critical applications requiring high bandwidth and guaranteed timing. FlexRay supports data rates up to 10 Mbps and uses time-triggered communication to provide deterministic message delivery.

FlexRay's dual-channel architecture enables fault-tolerant operation, making it suitable for brake-by-wire and steer-by-wire systems. However, its complexity and cost have limited adoption primarily to premium vehicles for chassis control applications, and CAN FD and automotive Ethernet have absorbed many roles once envisioned for FlexRay.

Automotive Ethernet

Automotive Ethernet brings the benefits of standard Ethernet technology to vehicles while meeting automotive requirements for cost, weight, and electromagnetic compatibility. Unlike office Ethernet, automotive Ethernet uses single twisted-pair cabling with special physical layer standards.

Key automotive Ethernet standards include:

• 100BASE-T1: 100 Mbps over a single twisted pair, defined by IEEE 802.3bw
• 1000BASE-T1: 1 Gbps over a single twisted pair, defined by IEEE 802.3bp
• 10BASE-T1S: 10 Mbps with multidrop capability, defined by IEEE 802.3cg
• Multi-gigabit: Standards for 2.5, 5, 10, and 25 Gbps (IEEE 802.3ch and 802.3cy) target high-bandwidth applications such as sensor and display backbones

Automotive Ethernet enables high-bandwidth applications including camera and lidar data streaming for ADAS, over-the-air software updates, and high-resolution display interfaces. Time-Sensitive Networking (TSN) extensions provide the bounded latency and deterministic timing guarantees required for safety-critical and time-synchronized applications.

Network Architecture

Modern vehicles use hierarchical network architectures that combine multiple network technologies. Domain controllers or central gateway ECUs bridge different networks, routing messages between domains and managing network security.

The trend toward centralized computing architectures consolidates functions from many distributed ECUs into fewer, more powerful computing platforms. These domain-centric or zone-based architectures reduce wiring complexity and simplify software updates while enabling more sophisticated features. In a zonal design, zone controllers aggregate the sensors and actuators in a physical region of the vehicle and connect to central compute units over an Ethernet backbone.

Engine Management

Modern engine management systems control numerous parameters to optimize combustion:

Fuel injection: The ECU precisely controls when and how much fuel is injected into each cylinder. Direct injection systems require microsecond-level timing precision and high injection pressures, exceeding 2000 bar in modern common-rail diesel engines.

Ignition timing: In spark-ignition engines, the ECU determines the optimal spark timing for each combustion event based on engine speed, load, temperature, and knock sensor feedback.

Air management: Electronic throttle control, variable valve timing, and turbocharger boost control work together to optimize the air-fuel mixture for current operating conditions.

Emissions control: The ECU manages exhaust aftertreatment systems including catalytic converters, diesel particulate filters, and selective catalytic reduction systems to meet emissions regulations.

Engine control software is structured around angle-synchronous tasks that execute in step with crankshaft position as well as fixed time-based tasks, processing data from dozens of sensors while maintaining emissions compliance across all operating modes. The ECU must handle both steady-state optimization and rapid transient conditions such as tip-in and gear changes.

Transmission Control

Automatic transmission controllers determine gear selection and execute smooth shifts. Modern transmissions, whether traditional planetary automatic, dual-clutch, or continuously variable, rely heavily on electronic control.

Transmission control systems:

• Determine optimal gear based on throttle position, vehicle speed, grade, and driving mode
• Control clutch engagement and hydraulic pressure during shifts
• Adapt shift points and characteristics based on driver behavior
• Coordinate with the engine controller for torque reduction during shifts
• Manage torque converter lockup for efficiency optimization

Electric and Hybrid Powertrains

Electric and hybrid vehicles introduce additional control complexity:

Motor control: Inverters convert DC battery power to AC for driving electric motors. Control algorithms implement field-oriented control or direct torque control at switching frequencies on the order of 10 to 20 kHz while managing thermal limits and efficiency. Silicon-carbide power devices increasingly enable higher switching frequencies and higher-voltage 800 V architectures.

Battery management: Battery Management Systems (BMS) monitor cell voltages and temperatures, estimate state of charge and state of health, balance cells, and protect against overcharge, over-discharge, and thermal events.

Energy management: Hybrid vehicles require sophisticated control strategies to determine when to use electric power, when to engage the combustion engine, and how to blend power sources for optimal efficiency.

Regenerative braking: Control systems coordinate between electric motor regeneration and conventional friction brakes to maximize energy recovery while maintaining consistent brake feel.

Sensor Technologies

ADAS systems rely on multiple sensor technologies to perceive the vehicle's environment:

Cameras: Provide high-resolution visual information for lane detection, traffic sign recognition, pedestrian detection, and parking assistance. Multi-camera systems create surround-view images. Modern camera systems capture at high dynamic range to handle varying lighting conditions.

Radar: Uses radio waves to detect objects and measure their range and velocity. Radar works reliably in adverse weather conditions including rain, fog, and darkness. Automotive radar systems operate primarily in the 76 to 81 GHz band; the legacy 24 GHz band has been largely phased out for new designs.

Lidar: Measures distances using laser pulses to create detailed 3D point cloud representations of the environment. Lidar provides precise distance and shape information but has traditionally been expensive. Solid-state lidar technologies are reducing costs and improving reliability.

Ultrasonic sensors: Short-range sensors primarily used for parking assistance and low-speed maneuvers. Ultrasonic sensors are cost-effective and well-suited for detecting nearby obstacles.

Sensor fusion: ADAS systems combine data from multiple sensor types to create robust environmental models. Fusion algorithms compensate for individual sensor limitations and improve detection reliability through redundancy.

ADAS Functions

Current ADAS functions include:

Adaptive Cruise Control (ACC): Maintains a set speed while automatically adjusting to maintain safe following distance from vehicles ahead.

Lane Keeping Assistance (LKA): Monitors lane markings and provides steering input to keep the vehicle centered in its lane or warns the driver of unintentional lane departures.

Automatic Emergency Braking (AEB): Detects imminent collisions and applies brakes automatically if the driver fails to respond to warnings.

Blind Spot Detection: Monitors areas beside and behind the vehicle, warning drivers of vehicles in blind spots during lane changes.

Traffic Sign Recognition: Identifies and displays speed limits and other traffic signs to the driver.

Parking Assistance: Ranges from simple ultrasonic warnings to fully automated parking systems that steer the vehicle into parking spaces.

Levels of Automation

SAE International, in standard J3016, defines six levels of driving automation:

• Level 0: No driving automation. The driver performs all driving tasks, though warning and momentary-assistance features may be present.
• Level 1: Driver assistance. The system provides either steering or acceleration/braking support, but not both simultaneously.
• Level 2: Partial driving automation. The system provides both steering and acceleration/braking support, but the driver must supervise the system and remain ready to take control.
• Level 3: Conditional driving automation. The system handles all driving tasks within its operational design domain, but the driver must be ready to take control when requested.
• Level 4: High driving automation. The system handles all driving tasks within its operational design domain without requiring driver intervention.
• Level 5: Full driving automation. The system handles all driving tasks under all conditions that a human driver could manage.

Most current production vehicles offer Level 1 or Level 2 features. Level 3 systems are appearing in limited deployments, and Level 4 operation is being introduced in geofenced robotaxi services. Achieving widely available Level 4 and Level 5 automation remains an active area of research and development.

ADAS Computing

ADAS applications demand significant computational resources. Processing sensor data, running perception algorithms, and executing vehicle control requires specialized computing platforms.

Modern ADAS computing architectures use:

• High-performance SoCs: System-on-chip devices combining multiple CPU cores, GPUs, and specialized accelerators for neural network inference
• Hardware accelerators: Dedicated processing units optimized for computer vision, sensor fusion, and machine learning operations
• Redundant architectures: Multiple processing units with diverse implementations to meet safety requirements
• High-bandwidth memory: Multiple gigabytes of RAM to handle sensor data streams and algorithm working sets

Power consumption is a significant constraint, with high-performance ADAS and automated-driving platforms consuming from tens to hundreds of watts. Thermal management and energy efficiency remain active areas of development, particularly because waste heat and power draw affect range in electric vehicles.

ISO 26262 Overview

ISO 26262 adapts the general functional safety standard IEC 61508 for automotive applications. The standard covers the entire safety lifecycle from concept through decommissioning. A complementary standard, ISO 21448 (Safety of the Intended Functionality, or SOTIF), addresses hazards that arise from performance limitations of correctly functioning systems, such as a perception sensor failing to recognize an object; this is especially relevant to ADAS.

Key concepts include:

Automotive Safety Integrity Level (ASIL): A risk classification scheme ranging from ASIL A (lowest) to ASIL D (highest), based on the severity, exposure, and controllability of potential hazards. Functions without safety requirements are classified as Quality Management (QM).

Safety goals: Top-level safety requirements derived from hazard analysis that define acceptable behavior in the presence of faults.

Functional safety concept: The allocation of safety requirements to system elements and the definition of how those elements achieve safe operation.

Safety mechanisms: Technical solutions that detect faults and transition the system to a safe state, such as redundancy, monitoring, and fail-safe designs.

Safety Analysis

ISO 26262 requires systematic analysis of potential hazards and faults:

Hazard Analysis and Risk Assessment (HARA): Identifies vehicle-level hazards and assigns ASIL ratings based on severity of harm, exposure frequency, and driver controllability.

Failure Mode and Effects Analysis (FMEA): Systematically analyzes potential failure modes, their causes, and their effects on system operation.

Fault Tree Analysis (FTA): Traces top-level failures back to their root causes using Boolean logic to understand failure relationships.

Hardware metrics: Quantitative analysis of the single-point fault metric, the latent fault metric, and the probabilistic metric for random hardware failures (PMHF), used to demonstrate that a hardware design meets its target ASIL.

Safe Design Principles

Safety-critical automotive systems employ various design techniques:

Redundancy: Critical functions may be implemented with duplicate hardware or software to tolerate single failures.

Diversity: Using different implementations (different algorithms, different processors) reduces the risk of common-cause failures.

Monitoring: Watchdog timers, plausibility checks, and comparison monitors detect faults during operation. A widely used pattern is the three-level monitoring concept (the E-Gas or EGAS monitoring concept) used in electronic throttle and powertrain control.

Graceful degradation: Systems maintain partial functionality when faults occur rather than complete failure.

Safe states: Defining and transitioning to safe states when faults are detected, which may involve controlled shutdown or limp-home modes.

Security Standards

The automotive industry has developed standards to address cybersecurity:

ISO/SAE 21434: Defines cybersecurity engineering requirements for road vehicle electrical and electronic systems throughout the product lifecycle, from concept through decommissioning.

UN Regulation No. 155 (UNECE WP.29): Requires type approval for a certified cybersecurity management system, mandatory for new vehicle types in many markets including the European Union, Japan, and Korea. The companion UN Regulation No. 156 covers software update management systems.

AUTOSAR security: Both Classic and Adaptive platforms include security services such as secure boot, secure communication, and cryptographic libraries.

Security Measures

Automotive cybersecurity employs multiple layers of defense:

Secure boot: Cryptographic verification ensures only authorized software executes on ECUs, preventing installation of malicious firmware.

Secure communication: Message authentication and, where appropriate, encryption protect in-vehicle networks from message injection and eavesdropping. SecOC (Secure Onboard Communication) adds authentication and freshness to CAN and other in-vehicle messages.

Network segmentation: Gateways control traffic between vehicle domains, preventing compromised infotainment systems from reaching safety-critical networks.

Intrusion detection: Monitoring systems detect anomalous network traffic and ECU behavior that may indicate attacks.

Hardware security modules: Dedicated secure hardware, such as an on-chip Hardware Security Module (HSM) or Secure Hardware Extension (SHE), protects cryptographic keys and performs security-critical operations in isolated environments.

Development Process

The V-model development process is widely used in automotive development:

• Requirements engineering: Capturing and managing requirements from vehicle-level specifications down to software implementation details
• Architecture design: Defining system, hardware, and software architectures that meet requirements
• Detailed design: Specifying component-level designs and interfaces
• Implementation: Developing hardware and software according to designs
• Integration and testing: Verifying that components work together and meet requirements
• Validation: Confirming that the system meets customer needs and regulatory requirements

Automotive SPICE (ASPICE) provides a process assessment framework, derived from ISO/IEC 33000, that many OEMs use to evaluate the maturity of supplier development processes. Coding standards such as MISRA C and MISRA C++ further constrain the use of these languages to reduce defects in safety-related software.

Testing Methods

Automotive systems undergo extensive testing:

Model-in-the-Loop (MiL): Testing control algorithms in simulation environments before code implementation.

Software-in-the-Loop (SiL): Testing compiled software against simulated plant models.

Hardware-in-the-Loop (HiL): Testing ECU hardware with simulated vehicle systems, enabling realistic testing without physical vehicles.

Vehicle integration: Testing in prototype vehicles on test tracks and public roads.

Environmental testing: Verifying operation across temperature, vibration, humidity, and EMC conditions.