====== Mainboard hardware (teardown) ======

Component-level teardown of the Aiways U5 head-unit mainboard (Adayo / 华阳, board
**RN4J2 MB PP1 V2.1**, P/N ''LB3300013J/A0'', 2019). Identified from a **second, spare board**
used as a bench / dev sandbox — so risky experiments (OEM patches, reading the MCU) don't touch
the car.

**⚠ Part numbers and photos are from one board revision — yours may differ.**

===== Board overview =====

^ Front ^ Back ^
| {{:hw_overview.png?360|Mainboard front}} | {{:hw_backside.png?360|Mainboard back}} |

Front: the i.MX6 SoC sits centre under an EMI shield; the companion MCU, audio codec and radio/GNSS
modules ring it. Back: the two DDR3 chips, a board-to-board connector to the display, and the main
harness connector's solder side (silk-screened with pin names — see the connector section below).

===== SoC — Freescale/NXP i.MX6 =====

Main application processor — the large BGA under the peeled-back metal shield (embossed "00299").
Runs **Android 4.4.2** with **1 GB DDR3**. OS/board details in [[:hardware|Hardware & OS]].

===== MCU — Renesas RL78 (R5F10PPJL) =====

{{:hw_mcu.png?420|Renesas R5F10PPJL}}

The companion microcontroller — a **Renesas RL78** (automotive), 100-pin QFP, marked
''R5F10PPJL / 1946EM478''. It is the gatekeeper between the SoC and the vehicle:

  * Talks to the SoC over **UART** (''/dev/ttymxc3'' @115200) — see [[:canbus]].
  * Runs the **ACC/ignition + power on/off/standby** state machine — it can cut the SoC's power.
  * Reads the **physical keys and the volume knob**.
  * **Bridges to the vehicle CAN bus**.
  * Drives the on-board **buzzer** (the hardware chime / ''mcu_beep'').

**Firmware:** runs from the RL78's **internal flash** (no external flash chip). The update image is a
file ''MCU.bin'' delivered **over-the-air** — OEM cloud → **TBox** (cellular) → **ABUpdate FOTA** →
flashed by the ''AdayoMcuUpgrade'' app — then deleted; it is **not** kept on the Android side. To
obtain the binary you'd **read the RL78 flash directly** (Renesas 1-wire serial programming,
TOOL0 + RESET) //if// read-protection is off, or dump the TBox (likely only a delta patch).

===== Audio codec — AKM AK7738 =====

{{:hw_codec.png?420|AKM AK7738VQ}}

Automotive **audio codec + DSP** (''AK7738VQ''). Drives the speaker outputs and does the EQ / volume
/ mixing. The OEM "speech level" alert path — loud + ducking, **independent of the volume knob** —
partly lives here (used by the over-speed warning; see [[:speedwarning]]).

===== Voice processor — ForteMedia FM1388 =====

{{:hw_voice.png?420|ForteMedia FM1388}}

2-mic **voice processor** (echo cancellation / far-field), marked ''fortemedio FM1388GA12''. Handles
''MIC1''/''MIC2'' for hands-free and voice.

===== Radio tuner — NXP TEF6635 =====

The **analog AM/FM tuner** — NXP **TEF6635** (TEF66xx-family car-radio tuner). Not photographed
close-up here; identified from the Android **audio HAL** (''system/lib/hw/audio.primary.imx6.so'' and
''audio.gis.imx6.so'' both embed the string ''tef6635''). It is driven by the companion MCU via the
OEM CarService (''radio_*'' calls), not directly by Android.

**DAB** (digital radio) has a separate native driver ''vendor/lib/libdab.so'' plus a ''com.adayo.dab''
app — so DAB hardware is present, but the specific DAB demodulator chip is **not yet identified** (a
close-up of the chips near the FAKRA antenna jacks would settle it). //Confidence: tuner part high
(HAL string); DAB demod unknown.//

===== GNSS — Unicore UM220-IV =====

{{:hw_gnss.png?420|Unicore UM220-IV}}

**GNSS** (GPS / BeiDou) positioning module, ''UM220-IV NV'' (unicorecomm), beside the **FAKRA**
antenna jacks (蓝色/blue = GPS, 粉色/pink, 棕色/brown).

===== RAM — SK hynix DDR3 =====

{{:hw_ram.png?420|SK hynix DDR3}}

Two **SK hynix H5TC4G63EFR** DDR3 chips — 512 MB each = **1 GB** total (board back).

===== Power — TI TPS65265 =====

{{:hw_pmic.png?420|TI TPS65265}}

Main **DC-DC / PMIC** (''TPS65265''), generating the core/IO rails from 12 V (next to the power
inductors). Fed by the **B+** pins on the main connector.

===== Main connector (CN202) =====

^ Pin labels (back) ^ Power / CAN cluster ^
| {{:hw_connector1.png?360|CN202 back-side labels}} | {{:hw_connector2.png?360|CN202 power/CAN cluster}} |

The main harness connector is **silk-screened on the back** with pin names, so a spare board can be
bench-powered by wiring directly to the back-side through-hole pins:

  * **B+ / B+B** — battery positive (12 V); the square/notched pads are the high-current power pins.
  * **GND / Batt GND** — ground.
  * **KEY** — ignition/ACC input (assert high to boot; the MCU keeps the SoC off otherwise).
  * **CAN…** — vehicle CAN (bottom-left cluster).
  * ''RL±/FL±/FR±/RR±'' — speaker outputs (**do not** put 12 V here). ''MIC1-/MIC2+'', ''TBOX_IN'', ''TF1_POWER/TFT_POWER'' (display power out).

**Bench power:** +12 V → B+ (and B+B), GND → GND, +12 V → KEY, using a **current-limited supply
(~3 A), ground lead first**.