====== Central gateway (GW) ======

The **central gateway** is the ECU every internal bus plugs into — the hub that ties the car's separate CAN networks together. Where the [[:hardware|head unit]], [[hardware:tbox|TBox]] and [[hardware:ip|instrument cluster]] are full Linux/Android computers, the gateway is a **single microcontroller running bare-metal real-time firmware** — no operating system, no filesystem. It is the first ECU a diagnostic tool reaches (**UDS address 0x700**). See [[:architecture|Architecture]] for the big picture.

===== System =====

  * **MCU** — a **Renesas RH850-family** automotive microcontroller (the "G3" CPU core), the standard body/gateway part. Little-endian, flash-based, ~290 KB of application code. No OS: a small routing/network-management firmware runs straight on the metal.
  * **I/O** — several **integrated CAN controllers (one per bus) plus LIN masters**. There is **no automotive Ethernet / DoIP** in this car; everything the gateway does is over CAN and LIN.
  * **Reflashable** — the firmware is field-updatable over the diagnostic bus: a small flash-programming routine is loaded into RAM and rewrites the code flash (the standard UDS download flow, behind Security Access).

^ Item ^ Value ^
| Assembly part | ''861983101A'' |
| Software parts | ''861975021 / 022 / 023'' (build **017** on the car) |
| Hardware version | ''G3SR01Bx00'' |
| UDS address | **0x700** |

===== What it does =====

The gateway is the hub of a **star of separate buses** — **powertrain, chassis, body/comfort, infotainment, telematics**, plus a dedicated **diagnostic CAN** and slower **LIN** sub-buses. It has five jobs:

  - **Selective routing (a firewall, not a bridge).** It forwards only the messages a fixed routing table allows between buses. This is the reason you can **poll** every ECU through the [[:obd2|OBD-II port]] but never **sniff** live traffic there — the gateway does not leak a functional bus's broadcasts onto the diagnostic CAN. To watch real traffic you must tap a functional bus directly. See [[:canbus|CAN bus]].
  - **Signal re-gatewaying.** Some values are retransmitted onto other buses, often with a different CAN ID — e.g. vehicle speed from the powertrain bus made available to the body and infotainment buses.
  - **Diagnostic gateway.** It routes diagnostic (UDS) requests from the OBD side to the target ECU on its home bus and relays the answer, and it **enforces Security Access** for anything that changes state — coding, actuator tests, flashing.
  - **Update distribution.** During a firmware update it is the routing entry point that carries the flash data to each target ECU across the buses.
  - **Network management.** It coordinates sleep/wake across the buses and watches for expected periodic messages; when one goes missing it records a **"lost communication / message timeout"** fault (the ''U…'' codes, e.g. the ''0x195'' and ''0x37F'' network timeouts).

===== Why it matters =====

The gateway is the **single chokepoint** between every subsystem. It is why the OBD port is a locked, request/response-only door rather than an open window; why sniffing or injecting real traffic means wiring into a functional bus; and why swapping or coding any control module has to pass through it under Security Access.

//What's understood so far. To be continued.//