Differences

This shows you the differences between two versions of the page.

--- architecture [2026/08/09 11:31] – external edit 127.0.0.1
+++ architecture [2026/08/10 01:14] (current) – external edit 127.0.0.1
@@ Line 10: / Line 10: @@
   * **[[hardware:mainboard|Head unit]] (infotainment)** — a Freescale **i.MX6** running **Android 4.4.2**, paired with a **Renesas RL78** MCU. The SoC runs the UI; the MCU is the gatekeeper to the vehicle. They talk over a serial **UART**. This is the computer these pages mostly work on — see [[hardware|Hardware & OS]].
-  * **[[hardware:tbox|TBox]] (telematics)** — the always-on cellular gateway: a **Quectel AG35** LTE modem plus an **NXP S32K144** MCU. It reaches the head unit over **USB/IP**, taps the CAN bus, and used to phone home over cellular — see [[hardware:tbox|TBox teardown]] and [[connectivity|Connectivity]].
+  * **[[hardware:tbox|TBox]] (telematics)** — the always-on cellular gateway: a **Quectel AG35** LTE module (which runs its own embedded **Linux** and hosts the telematics software) paired with an **NXP S32K144** MCU. The same split as the head unit repeats here — the Linux side never touches the CAN bus itself; it hands commands to the MCU over a **serial link**, and only the MCU is wired to the vehicle CAN transceiver. It reaches the head unit over **USB/IP**, and used to phone home over cellular — see [[hardware:tbox|TBox teardown]] and [[connectivity|Connectivity]].
   * **[[canbus|Vehicle CAN bus]]** — the shared nervous system. The real ECUs live here: **VCU** (vehicle control), **BMS** (the HV battery), **BCM** (body), **HVAC**, **TPMS**, and more.
   * **Displays** — four panels, but only two are driven by the head unit: the **centre touchscreen** (LVDS) and the **right driver panel** (HDMI). The **main instrument cluster** and left panel are a **separate ECU** that reads the CAN bus directly — the head unit cannot draw on them.
@@ Line 16: / Line 16: @@
+===== The CAN network =====
+The modules are not all on one wire. A central **gateway** is the hub of a star of **five separate CAN buses** (plus slower LIN sub-buses), and it is the only thing that bridges them:
+  * **Powertrain CAN** — VCU (vehicle control), BMS (HV battery), motor controller, on-board charger, DC-DC converter, gear selector.
+  * **Chassis CAN** — ABS/ESP, electric power steering, brake booster, airbag, steering-angle sensor, cameras and parking radars.
+  * **Body / comfort CAN** — body control module, A/C control module, PTC heater and compressor, seat heaters, power tailgate, pedestrian low-speed warning.
+  * **Infotainment CAN** — the head unit, the instrument cluster, around-view and driver-monitor.
+  * **Telematics CAN** — a dedicated point-to-point link to the TBox.
+  * **LIN sub-buses** (hung off the body control module) — windows, sunroof, door handles, headlamps, steering-column lock, rain/light and 12 V battery sensors.
+The gateway **routes** selectively between buses — it is a **firewall, not a simple bridge**. This is why the **OBD-II port** (which lands on a dedicated diagnostic CAN into the gateway) can //reach// every ECU by request/response but never //sees// the live broadcasts on any functional bus. To sniff or inject real traffic you have to tap a functional bus directly. See **[[obd2|OBD-II diagnostics]]**.
+A few consequences worth knowing:
+  * The **instrument cluster** is its own ECU — it //displays// values (SoC, outside temperature, warning lamps) that other modules broadcast. If the module feeding it goes quiet, a value can look **stuck** on the last/substituted reading.
+  * The car keeps its **general-purpose computers one hop away from the live CAN bus** — twice over. The head unit's Android side and the TBox's Linux side both talk to the vehicle only through a dedicated microcontroller (RL78, S32K144) sitting between them and the wire. Neither general-purpose OS has a direct CAN connection of its own.
+  * **Drive-enable is gated by an immobilizer** — the body control module and the motor controller authenticate each other at power-on, and only then can the car reach "Ready". This blocks //driving//, not diagnostics or preconditioning.
+  * Swapping any control module needs **online coding** with a manufacturer tool — the main obstacle to keeping an orphaned car serviceable.
 ===== Diagnostics: the dealer tool & VCI =====