The FCCU is built on an Infineon AURIX TC377 microcontroller – a 3-core, 2-core-lockstep architecture running at 300MHz, with 6MB flash and 1.1MB RAM, rated ASIL-D/SIL-3. When a control fault in a fuel cell system can mean a valve failing to close or a compressor failing to stop, ASIL-D is the integrity level the function actually requires – and lockstep execution on two of the three cores means safety-relevant computations are independently verified in hardware, not just checked in software after the fact. The unit integrates a hardware security module (HSM) with asymmetric cryptography accelerators, supporting the full EVITA standard for automotive-grade cybersecurity.

Power Supply and Voltage Architecture
The FCCU operates across a 5V to 32V input range, with tolerance up to 36V for 1 hour, covering both 12V and 24V vehicle electrical architectures per ISO 16750-2 – a single hardware variant for both voltage classes, rather than separate SKUs. For OEMs developing platforms across light-commercial and heavy-duty vehicle classes, this means one qualification and one bill-of-materials line instead of validating two separate hardware variants. Load dump transient tolerance is rated at 34V on 12V systems and 58V on 24V systems, for up to 350ms. Power delivery runs through a permanent battery supply line with reverse-voltage protection and a wake-up switch designed to minimize quiescent current draw in sleep mode, with continuous voltage monitoring.

I/O and Communication
Fuel cell balance-of-plant control typically requires separate boxes for motor drivers, valve control, and safety monitoring – each with its own qualification, wiring harness, and failure point to manage. The FCCU consolidates all three into a single ASIL-D-rated unit, managing pumps, valves, solenoids, and sensor networks directly, without an external I/O expansion module:

• Low-side outputs: 4x discrete/PWM (0.4A, PWM up to 500Hz) with output readback; 4x reverse-battery-protected discrete (0.4A); 8x discrete (0.4A)
• Configurable high-side/low-side outputs: 6x PWM with closed-loop current control (1.3A @ 2.5kHz, 50mA @ 20kHz), output readback, parallelizable up to 5.2A; 18x PWM with closed-loop current control (1.3A @ 2.5kHz), parallelizable up to 5.2A
• High-side outputs: 3x discrete (10A) with readback; 2x discrete/PWM (5A, up to 250Hz) with readback; 1x discrete/PWM (5A, up to 250Hz) with optional readback; 2x discrete/PWM (2.5A, up to 250Hz) with readback
• Full H-Bridge: 3x outputs (3A hold / 7A peak @ 4kHz) with current feedback – for DC motor control (e.g., compressor or pump actuation)
• Analog inputs: 13x (0–5V or digital 0-Batt, selectable pull-up/down); 4x NTC temperature sensor inputs; 4x dedicated pedal/brake position inputs
• Frequency inputs: 7x (0–5V, up to 15kHz)
• Flexible inputs: 7x fully configurable digital/frequency/analog inputs; 8x high-accuracy resistance measurement channels (accuracy from 1.45% in the 100Ω–5kΩ range to 8.00% at 165kΩ–400kΩ)
• High-voltage interlock monitor: 1x HVIL loop (0–40mA current monitoring, 0–100Hz frequency monitoring) – HVIL monitoring is typically a mandatory precondition for safely enabling high-voltage systems like fuel cells and EV batteries; without it, the system cannot power up its high-voltage side at all
• Communication: 6x CAN FD (2 with wake-up capability, 1 isolated CAN optional), 2x LIN, 4x SENT, 1x automotive Ethernet (100Base-T1, 2-wire, 100 Mbit/s) optional
• Digital inputs: 1x wake-up, 1x inhibit input

Environmental and Mechanical Specifications
The FCCU operates across an ambient temperature range of –40°C to +85°C (ISO 16750-4, temperature class G) and carries an IP6K9K environmental protection rating, validated for vibration per ISO 16750-3 in a chassis-installed configuration. EMC performance is validated to ISO 11452-4, IEC CISPR 25, ISO 10605, and ISO 7637-2/3 – the combination of ratings typically expected for a unit mounted directly on-chassis in transportation environments, exposed to washdown, road vibration, and electromagnetic interference from adjacent high-power systems. Housing dimensions are 235 x 215 x 35 mm (die-cast/metal sheet construction), weighing 1.2 kg, with connector header included. Connection is via a 186-pin Molex Compactus system split across two bays (114-way and 72-way).

Compliance and Certification
Development follows ISO 26262 (Functional Safety) and AUTOSAR architecture standards. The FCCU is designed and developed in line with ISO/SAE 21434 cybersecurity engineering principles. The manufacturing site operates under IATF 16949 automotive quality management certification.

Customization and Software Integration
Fuel cell control strategy is often a competitive differentiator in its own right – hydrogen consumption optimization, stack degradation management – and being locked into a supplier’s fixed control logic means either exposing that know-how to a third party or waiting on a firmware change request for every iteration. The Open Platform Toolkit and Simulink-based rapid prototyping keep that control logic in the OEM’s hands, running on hardware that’s already safety-qualified underneath it. Note: the FCCU hardware itself does not include cellular or wireless connectivity – over-the-air (OTA) software updates require pairing with an external telematics or radio module. Hardware and software are fully customizable to application-specific requirements, with proven deployment across automotive, commercial vehicle, agricultural, marine, and aviation platforms.

Typical Applications

• Platforms spanning both 12V and 24V architectures, avoiding separate hardware qualification for each voltage class
• Consolidating pump, valve, and high-voltage safety monitoring into a single ASIL-D-rated control unit, reducing wiring complexity and qualification points
• OEMs prototyping proprietary fuel cell control strategies in Simulink before committing to production firmware, without depending on Dumarey’s control logic