SKU-9 · 130 nm CMOS and BCD Zonal controller & gateway
SKU-9 switches 16 smart fuses and routes eight CAN-FD buses inside one vehicle zone.
Every figure on this page is a design target unless marked otherwise.
- Networking
- TSN switch; 2 × 100BASE-T1, 8 × CAN-FD, CAN-XL, 8 × LIN, FlexRay
- Power
- 16 smart electronic fuses with programmable trip and I²t
- Safety island
- Dual-core two-cycle lockstep
SKU-9 switches 16 smart fuses and routes eight CAN-FD buses inside one vehicle zone.
SKU-9 combines network and power-distribution functions within a vehicle zone; the central vehicle computer remains separate.
- Job
- Bring power distribution and network connections into a vehicle zone.
- Replaces
- Imported zonal controllers and CAN, LIN and FlexRay to Ethernet gateways.
- Status
- RTL ready; prototype on the December 2026 shuttle, a 130 nm chip at 100 MHz.
The business case for SKU-9
Assess the loads, network traffic and failure isolation of a specific zone before considering consolidation.
What it replaces
Imported zonal controllers and CAN, LIN and FlexRay to Ethernet gateways.
Customer opportunity
Zonal and gateway controllers for software-defined vehicles.
Policy and demand
Zonal design replaces the relay-and-harness box, saving cost and weight, so the carmaker makes the case.
The delivery trade-off
A gateway needs many channels and predictable timing, not a fast clock: the Ethernet switch bounds the delay, not the processor. Central vehicle computers need sub-10 nm chips and are not part of this plan.
What SKU-9 claims, what it is worth, and what gates it.
The following mechanisms explain the proposed customer benefit. Each still needs to be validated in the complete product.
SKU-9 switches 16 smart fuses and routes eight CAN-FD buses inside one vehicle zone.
SKU-9 combines network and power-distribution functions within a vehicle zone; the central vehicle computer remains separate.
Gateway, fuses and safety island share one zone; central compute stays separate.
Assess the loads, network traffic and failure isolation of a specific zone before considering consolidation.
Brake-message latency and fuse trips are proven in the vehicle, not on the chip.
Network timing, power protection and the vehicle safety case remain adoption gates.
Architecture targets, not datasheet values.
Every figure is a design target stated in the SKU Blueprint, page 34. None is a measurement of manufactured silicon.
- 16Smart electronic fuses
- 8 × CAN-FDBeside TSN, LIN and FlexRay
- 2-cycleLockstep safety island
Detailed architecture and specifications
- Process
- 130 nm CMOS and BCD at 100 MHz
- Safety island
- Dual-core two-cycle lockstep
- Security
- Full hardware security module, secure boot with two firmware slots, over-the-air update
- Networking
- TSN switch; 2 × 100BASE-T1, 8 × CAN-FD, CAN-XL, 8 × LIN, FlexRay
- Power
- 16 smart electronic fuses with programmable trip and I²t
- Scope
- Zonal edge only; central compute is out of scope
- Process
- 130 nm CMOS and BCD
- Maturity
- Architecture scope
- Designed toward
- ISO 26262 ASIL-D · EVITA Full · AUTOSAR Classic 4.4 · AEC-Q100 Grade 1
- Source
- SKU Blueprint, October 2026, page 34
Standards the architecture is designed toward. No DeepGrid part holds a certification or qualification today.
System architecture, signal flow and engineering references
Marker ①: Messages arrive on Ethernet, CAN, LIN and FlexRay
Traffic enters at In-vehicle network · gateway: 100BASE-T1 × 2 for automotive Ethernet, CAN-FD × 8, CAN-XL × 1, LIN × 8 masters and FlexRay × 1. The gateway routes and rate-limits between domains, so a flood on one bus cannot starve another. Every port lands on the AXI4 crossbar, in a 130 nm chip at 100 MHz.
In-vehicle network · gateway
Marker ②: The TSN switch schedules traffic against precision time
In Real-time control, the TSN switch applies an 802.1Qbv time-aware shaper, and PTP keeps an 802.1AS clock in sub-µs sync. Brake-by-wire messages get reserved time slots on a shared link while bulk data waits its turn. Bounded latency is designed into hardware rather than left to software scheduling.
Real-time control
Marker ③: The service router forwards each message across the crossbar
The Service router handles SOME/IP and DoIP, turning network messages into service calls and diagnostics. It forwards each one across the AXI4 crossbar to the block that owns the action: the safety island, the security module or the zone’s power outputs. One crossbar carries every path, which is why isolation matters.
Real-time control
Marker ④: Sixteen smart fuses replace the relay box at the loads
Commands reach Zonal power + I/O and become switched power. Smart fuse × 16 pairs an eFuse with sensing and a programmable I²t trip, replacing the relay box. HS driver × 8 handles load control, PWM × 12 drives actuators, and a 12-bit ADC senses 24 channels. BCD power devices sit beside the logic to switch 12 V and 48 V loads.
Zonal power + I/O
Marker ⑤: A lockstep mismatch drives the zone to its safe state
The Safety island runs DGridRiscV × 2 in lockstep with a two-cycle skew, protected by PMP and ECC. The Comparator checks bus and retire outputs, and a mismatch drives the safe state. Freedom from interference, an MPU plus a bus firewall, keeps comfort functions such as lighting away from safety-critical registers.
Safety island
A security module checks every image before it runs
Security sits across the same paths. The HSM provides AES-256, ECC-256 and a true RNG. Secure boot starts from a root of trust in an OTP key store with A/B slots, and the OTA engine verifies each signed image and rolls back when one fails, so a bad update never replaces the working bank.
Security
Numbered markers
- ①Marker ①: Messages arrive on Ethernet, CAN and LIN.
- ②Marker ②: The TSN switch schedules them against precision time.
- ③Marker ③: The service router forwards them across the crossbar.
- ④Marker ④: They become switched power at the smart fuses.
- ⑤Marker ⑤: A lockstep mismatch drives the safe state.
Block responsibilities
- Safety island
Two DGridRiscV cores in lockstep with a two-cycle skew, memory protection and ECC, a bus and retire comparator, and a freedom-from-interference firewall.
Why Safety-critical and comfort functions share one chip, so the island is isolated by an MPU and a bus firewall.
Guide: Safety island- Security
A hardware security module with AES-256 and ECC-256, secure boot from an OTP key store with A/B slots, and an OTA engine with signed-image verification and rollback.
Guide: Security- Real-time control
A TSN switch with an 802.1Qbv time-aware shaper, 802.1AS precision time, and a SOME/IP and DoIP service router.
Why Brake-by-wire messages need bounded latency on a shared link.
Guide: Real-time control- In-vehicle network · gateway
The gateway ports: two 100BASE-T1, eight CAN-FD, one CAN-XL, eight LIN and one FlexRay. The gateway routes and rate-limits between domains.
Guide: In-vehicle network · gateway- Zonal power + I/O
Sixteen smart electronic fuses with sensing, eight high-side drivers, a 24-channel 12-bit sense ADC and twelve PWM actuator outputs.
Why Switching 12 V and 48 V loads in the harness needs BCD power devices beside the logic.
Guide: Zonal power + I/O
Primary sources
- SKU-9 architecture guideEvery block group, the data flows and the design targets.Opens in the site
- SKU Blueprint, October 2026SKU-9: what it replaces, who uses it, its status and its architecture diagram.PDF · 46 pages
4 integration and validation references
- IEEE 802.1Qbv: enhancements for scheduled trafficThe time-aware shaper behind bounded-latency TSN.IEEE Standards
- Introduction to the Controller Area Network (TI SLOA101)CAN arbitration, bit timing and the physical layer of ISO 11898-2.Texas Instruments · PDF
- Hercules safety MCUs (TI SPRY178)Lockstep CPUs with a cycle offset, and why a watchdog should be windowed.Texas Instruments · PDF
- Arm AMBA specifications, including AXI and AHBThe bus protocol family the on-chip bus is modelled on.Arm
Background reading explains the general technique each block uses. None of it describes this part or implies its certification.
Architecture from the SKU Blueprint, page 34. A functional view, not a floorplan.
7 questions SKU-9 has to answer before it can be relied on.
The Blueprint’s design and status notes raise these. Each is a question silicon, test or layout has to answer before SKU-9 can be relied on.
Switch and protect 12 V and 48 V loads in a harness.Physics
BCD power devices for the smart fuses alongside the logic.
Brake-by-wire messages need bounded latency on a shared link.Physics
A time-aware shaper (802.1Qbv) and precision time sync (802.1AS) in hardware.
Safety-critical and comfort functions share one chip.Physics
A lockstep island with memory protection and bus firewalls for freedom from interference.
Where the node line fallsOpen
Why does the zonal layer belong on 130 nm while central compute needs a sub-10 nm process?
Bounded latencyOpen
Can the shaper guarantee under 10 µs for brake-by-wire traffic while bulk data shares the port?
Solid-state fusingOpen
How do the smart fuses cut off in microseconds without avalanche damage from harness inductance?
IsolationOpen
Which memory-protection and firewall rules keep lighting commands away from steering registers?
An architecture, with its evidence named.
- Strongest evidence
- Architecture diagram and status in the SKU Blueprint.
- Development status
- RTL ready; prototype on the December 2026 shuttle, a 130 nm chip at 100 MHz.
System architecture; no measured harness-weight reduction or qualified vehicle implementation is claimed.
How every figure on this site was obtainedThe systems it goes into, and the parts beside it.
Zone loads, network timing, security and power-fault containment.
Parts beside it
Read the source behind every figure.
Each document opens inside the site at the cited section; the PDF is the edition of record.
Design files
Bring the socket. We will tell you what SKU-9 has to prove for it.
Send the platform, voltage and power environment, interfaces and qualification needs. The reply names what is architecture, what is evidence and what would have to be tested.