Tutorial · vehicle E/E architecture

Zonal architecture, built up one step at a time

Zonal architecture reorganises a vehicle's electronics by where things are instead of what they do. Below, a conventional vehicle is converted into a zonal one in six steps. After that, the trade-offs are weighed honestly, and the same idea is compared against a real truck that was divided by subsystem, not by zone: the Kenworth T280 fuel-cell truck, Big Red.

Zone controllersCentral computeAutomotive Ethernet · TSN eFuse power distributionService-oriented softwareOTA

01 — Tutorial

From one-ECU-per-function to zones

top-down vehicle · front on the leftinteractive — step through, or auto-play
Zonal architecture tutorial diagram Step 1 shows fourteen function-specific ECUs wired back to a central gateway. Step 2 overlays four location zones. Step 3 replaces the ECUs with sensors and actuators wired to one zone controller per zone. Step 4 moves functions into a central compute unit. Step 5 connects zones and compute with an Ethernet ring that reroutes when a link is cut. Step 6 updates the whole vehicle over the air through the central compute. FRONT ZONELEFT ZONERIGHT ZONEREAR ZONE lamp Llamp Rbrakesteer door FLdoor FRseatHVAC door RLdoor RRBMSinverter tail Ltail R gateway zone Fzone Lzone Rzone Rr ZONE CONTROLLER = LOCAL I/O + SMART POWER DISTRIBUTION (eFUSES) + GATEWAY FOR LOCAL CAN / LIN Centralcompute FEATURE LOGIC MOVES INTO SOFTWARE ON CENTRAL COMPUTE · ZONES KEEP THE I/O ETHERNET RING BETWEEN ZONES · COMPUTE DUAL-HOMED · CAN / LIN STAY SHORT AND LOCAL signed update ONE SOFTWARE IMAGE UPDATES VEHICLE FEATURES · ZONE FIRMWARE STAGED BEHIND IT

Step 1 of 6

Start: one ECU per function

Drawn as a teaching model. Fourteen ECUs and four zones keep the picture readable; production vehicles have many more functions, and zone counts vary by platform. The mechanism is what the figure shows accurately.

02 — Trade-offs

What zonal buys, and what it costs

Zonal architecture does not remove complexity — it moves it. Copper and connectors come out of the vehicle; software, networking and safety analysis move into the centre. Every "con" below has a known mitigation, and every mitigation has its own price.

Pros

Shorter, lighter harnessSensors and actuators wire to the nearest zone, not back across the vehicle. Fewer long runs, fewer inline connectors, easier automated assembly.
Fewer ECUs to source, package and flashFunctions consolidate onto compute; zone controllers are a handful of similar parts rather than dozens of different ones.
Whole-vehicle software updatesFeatures live in one software stack, so OTA changes behaviour across domains in one coordinated release.
Hardware and software decoupleServices talk over the network by interface, not by wire. A feature can move or grow without re-routing copper.
Smart power distributioneFuses in zone controllers replace fuse and relay boxes: per-load current diagnostics, software load-shedding, and controlled wake and sleep.

Cons

Central compute concentrates failureWhat used to fail one function can now fail many.redundant compute or fail-operational partitioning, dual-homed network, ASIL decomposition between zone and compute
Timing is no longer freeA control loop that crossed one CAN wire now crosses zones, a switch and a scheduler.TSN for bounded latency; keep fast inner loops inside smart actuators
Integration burden shifts to the OEMSuppliers deliver hardware and software components rather than finished black-box ECUs.owned software platform, interface contracts, continuous integration from day one
Bigger security blast radiusOne compromised central node reaches more of the vehicle.secure boot, signed updates, network segmentation, intrusion detection
High up-front cost and schedule riskThe savings arrive per unit; the engineering arrives first.only pays back at volume or across a platform family
weigh it for a specific programinteractive — set how much each factor matters

Weighted fit

Zonal–
By subsystem / domain (non-zonal)–

Each architecture's 0–2 fit per factor is my engineering judgement, shown in the row labels so it can be argued with. The weights are yours.

03 — Applied

Big Red as built, next to Big Red as a zonal design

The truck in the FCEV case study was not zonal. It was divided by subsystem: a supervisory controller in the cab, each subsystem's ECU near its hardware, six CAN buses and 12 V / 24 V fuse and relay maps running between them. Below is that layout next to how the same chassis would look if it had been organised by location instead.

Kenworth T280 FCEV · top-down · front on the left · placement schematicinteractive — switch between the two
Big Red wiring, by subsystem and zonal As built: wiring is grouped by subsystem, with runs from the supervisory controller in the cab out to each subsystem's ECU along the frame. Zonal redesign: three zone controllers along the frame connect to a central compute unit over an Ethernet backbone, and each component wires a short stub to its nearest zone; supplier ECUs remain as smart nodes on those local links. GROUPED BY SUBSYSTEM · SIX CAN BUSES · FUSE + RELAY MAPS zone 1zone 2zone 3 GROUPED BY LOCATION · ETHERNET BACKBONE · ZONES REPLACE FUSE / RELAY BOXES Fuel cellmodule H2tanks Battery packsBMS HVPDUcontactors DC/DCOBC eAxleinverter Brakechopper HVAC supervisoryRCM112 centralcompute ABS modulators at wheels HV · hard-wired
drawn LV harness length: –
Both layouts are schematic — component placement is for a box-body Class 6 truck, not the build drawing, and the as-built wire routes are simplified. The length figure is measured from the lines in this figure, so it compares the two drawings to each other; it is not a harness estimate for the real truck.
On Big RedAs built · by subsystemZonal redesign
How the system is dividedby function — fuel cell, hydrogen, battery, eAxle, brakes, thermalby position on the chassis — cab, mid-frame, rear axle
Supplier ECUs (fuel cell, eAxle, ABS, BMS, HVAC)integrated as deliveredkept as smart nodes on zone-local CAN — replacing them needs their software
Supervisory logicRCM112 supervisory controllermoves to central compute
12 V / 24 V fuse and relay mapshand-authored, relay boxeseFuse channels in each zone, with current diagnostics
Parasitic draw and wake / sleepsolved per ECU, with a dedicated wake CANzones switch loads off centrally
Network loadover 85% on a shared segment, 60% after gateway re-segmentationEthernet between zones; CAN runs stay short
HV contactors, precharge, lock-out energy isolationhard-wiredstill hard-wired — not moved into software
Single point of failuresupervisory controllercentral compute — needs a degraded mode
Software updatessix ECUs flashed individuallyone coordinated release
Cost and schedule for a few prototype truckslownew zone hardware and software
Comparing the two

By subsystem was the right call for Big Red. Supplier ECUs were fixed, the program built a handful of trucks, and schedule was the constraint.

Zonal would have paid off at fleet volume. It removes the fuse-and-relay wiring between subsystems, makes wake / sleep a zone-level job and turns six separate flashes into one release — at the cost of new zone hardware, a central compute unit that needs a degraded mode, and owning more of the software. High-voltage isolation stays hard-wired either way.

Scope: the as-built column is the truck I worked on, which was divided by subsystem. The zonal column is design analysis — it was never built.