1What's different
- Power — "12 V" (cars) and "24 V" (commercial vehicles) are nominal. Voltage rises while the alternator charges and drops sharply during cranking. A sudden battery disconnection dumps alternator energy onto the supply line as a large surge (load dump). Reverse battery connection and jump starts happen during servicing.
- Temperature — cabin units often need −40 to +85 °C; under-hood units more.
- Vibration and humidity — solder joints, connectors and board mounting must survive years of vibration.
- Lifetime — vehicles stay on the road for over ten years, and parts supply must last as long.
- Safety — failures in braking, steering or propulsion can cause accidents, so the design and verification process itself is standardized (section 4).
In practice
Even devices not directly tied to driving safety, such as HVAC controllers, face the same harsh power. That is why input protection and behavior during cranking are settled before features.
2Vehicle networks
| Network | Characteristics | Typical use |
|---|---|---|
| CAN | Two-wire differential, up to 1 Mbit/s, up to 8 data bytes per frame. The message ID is the priority; built-in error detection and automatic bus-off of faulty nodes | Across the vehicle: powertrain, body, comfort |
| CAN FD | Faster data phase (commonly 2–5 Mbit/s) and up to 64 data bytes | Data-heavy controllers, faster firmware updates |
| LIN | Single wire, up to 20 kbit/s, one master polling slaves; low cost | Windows, seats, mirrors, small HVAC actuators and sensors |
When several CAN nodes transmit at once, the message with the lower ID (higher priority) wins without data loss (arbitration). ID assignment therefore defines system response times. A gateway controller connects the different networks.
In practice
Define message IDs and periods early in a CAN database (a file defining each message's and signal's ID, period, bit position and units — commonly in DBC format), and leave headroom in bus load. When firmware, test tools and analyzers share the same database, nothing is misinterpreted. Priority conflicts from messages added later are a common problem.
3Diagnostics: UDS and DTCs
Service tools talk to controllers using UDS (ISO 14229, Unified Diagnostic Services): the tool sends a request by service ID and the controller responds. Long messages are segmented into CAN frames under ISO 15765-2.
| Service | Purpose |
|---|---|
| 0x10 Diagnostic session control | Default, extended, programming sessions |
| 0x11 ECU reset | Restart the controller |
| 0x19 Read DTC information / 0x14 Clear diagnostic information | Read and clear fault codes |
| 0x22 / 0x2E Read / write data by identifier | Read and write values by DID |
| 0x27 Security access | Unlock before writing or programming |
| 0x31 Routine control | Run built-in test routines |
| 0x34 · 0x36 · 0x37 | Request download · transfer data · request transfer exit |
A DTC (diagnostic trouble code) records a fault the controller detects itself — the code, its status (pending, confirmed) and the conditions at the time, such as voltage and temperature.
OBD-II is the legally mandated, emissions-related diagnostic system. Its connector and basic requests are standardized, so an external device on the port can read driving data such as vehicle speed and engine RPM.
In practice
Diagnostics is not a feature bolted on at the end. Deciding which anomaly becomes a confirmed fault under which conditions is diagnostic design, and it belongs with the control logic. In devices on the diagnostic port, the structure for handling many requests and responses without missing any determines performance.
4Functional safety: ISO 26262 and ASIL
ISO 26262 is the international functional safety standard for electrical and electronic systems in road vehicles. It defines how to keep failures from becoming hazards, from concept through production to decommissioning.
At its core is the ASIL (Automotive Safety Integrity Level), derived from three ratings of each hazard:
- Severity — how badly people could be hurt
- Exposure — how often the driving situation occurs
- Controllability — whether the driver can avoid the harm
The combination yields ASIL A to D (D the strictest), or QM (ordinary quality management) when safety is not involved. Higher levels demand more traceability, stricter design methods, broader testing and more documentation.
In practice
At the start, confirm with the customer whether the device is in scope for functional safety and at which level. The required process, documents, schedule and cost differ greatly.
5Coding guidelines: MISRA C
C has many behaviors that differ between compilers or are undefined by the standard. Harmless in a desktop program, they become malfunctions in a vehicle. MISRA C is a set of guidelines that restricts these risky uses, widely applied in automotive and other high-reliability fields. The current edition, MISRA C:2023, consolidates MISRA C:2012 and its amendments.
- Guidelines are Mandatory, Required or Advisory.
- Most are checked with static analysis tools.
- Necessary departures are documented with rationale and impact (deviations).
In practice
Applying the guidelines is not the same as claiming compliance. A compliance claim requires a defined process and deviation records. Agreeing on the required level with the customer at the start avoids rework later.
6Parts and power design
Automotive-grade parts — semiconductors for vehicles are usually chosen from parts qualified to AEC (Automotive Electronics Council) stress tests: AEC-Q100 for integrated circuits, AEC-Q101 for discrete semiconductors, AEC-Q200 for passives. AEC-Q100 grades parts by operating temperature:
| Grade | Operating temperature |
|---|---|
| Grade 0 | −40 to 150 °C |
| Grade 1 | −40 to 125 °C |
| Grade 2 | −40 to 105 °C |
| Grade 3 | −40 to 85 °C |
Power protection
- Reverse polarity — a diode or MOSFET keeps a reversed battery from damaging the circuit.
- Overvoltage and surges — TVS diodes absorb load dump and other transients; power parts are chosen with ample input voltage rating.
- Cranking dips — decide whether the device may reset or must keep running during the dip, and design the supply accordingly.
Sleep and wake-up — controllers stay connected to the battery with the engine off. Excess quiescent current drains the battery in days, so the device sleeps deeply and wakes on CAN/LIN activity or a switch input.
In practice
"My battery keeps going flat" complaints usually trace back to quiescent current. Check every current path in sleep mode at the schematic stage.
7AUTOSAR in brief
AUTOSAR standardizes the architecture and interfaces of vehicle controller software. The Classic Platform, for MCU-based controllers, places a defined runtime layer (RTE) between basic software (communication, diagnostics, memory, OS) and application software, making applications portable between controllers. The Adaptive Platform targets high-performance processors. Controllers supplied directly to vehicle manufacturers are often required to be AUTOSAR-based. For low-volume proprietary products or aftermarket devices, tooling and configuration costs may be excessive, and the layered architecture described in our other note is often enough. Commercial use also requires checking AUTOSAR partnership terms and tool costs.
8Vehicle power test standards: ISO 7637 and ISO 16750
- ISO 7637-2 — applies defined pulses that reproduce short transients on supply lines (switching of inductive loads and similar).
- ISO 16750 — environmental conditions and tests for vehicle electronics. Part 2 covers electrical loads (operating voltage range, cranking dips, reverse voltage, load dump), Part 3 mechanical loads (vibration, shock), Part 4 climatic loads (temperature, humidity). Its unsuppressed load-dump test pulses reach about 100 V on 12 V systems and about 200 V on 24 V systems.
In practice, vehicle manufacturers issue their own, more specific test specifications based on these standards.
In practice
Receiving the test specification as a design input lets protection circuits and voltage ratings be settled once. Seeing it for the first time at the test stage means redesign.