Mainboard hardware (teardown)

Component-level teardown of the Aiways U5 head-unit mainboard (Adayo / 华阳, board RN4J2 MB PP1 V2.1, P/N LB3300013J/A0, 2019). Identified from a second, spare board used as a bench / dev sandbox — so risky experiments (OEM patches, reading the MCU) don't touch the car.

⚠ Part numbers and photos are from one board revision — yours may differ.

Front	Back

Front: the i.MX6 SoC sits centre under an EMI shield; the companion MCU, audio codec and radio/GNSS modules ring it. Back: the two DDR3 chips, a board-to-board connector to the display, and the main harness connector's solder side (silk-screened with pin names — see the connector section below).

Main application processor — the large BGA under the peeled-back metal shield (embossed “00299”). Runs Android 4.4.2 with 1 GB DDR3. OS/board details in Hardware & OS.

The companion microcontroller — a Renesas RL78 (automotive), 100-pin QFP, marked R5F10PPJL / 1946EM478. It is the gatekeeper between the SoC and the vehicle:

• Talks to the SoC over UART (/dev/ttymxc3 @115200) — see canbus.
• Runs the ACC/ignition + power on/off/standby state machine — it can cut the SoC's power.
• Reads the physical keys and the volume knob.
• Bridges to the vehicle CAN bus.
• Drives the on-board buzzer (the hardware chime / mcu_beep).

Firmware: runs from the RL78's internal flash (no external flash chip). The update image is a file MCU.bin delivered over-the-air — OEM cloud → TBox (cellular) → ABUpdate FOTA → flashed by the AdayoMcuUpgrade app — then deleted; it is not kept on the Android side. To obtain the binary you'd read the RL78 flash directly (Renesas 1-wire serial programming, TOOL0 + RESET) if read-protection is off, or dump the TBox (likely only a delta patch).

Automotive audio codec + DSP (AK7738VQ). Drives the speaker outputs and does the EQ / volume / mixing. The OEM “speech level” alert path — loud + ducking, independent of the volume knob — partly lives here (used by the over-speed warning; see speedwarning).

2-mic voice processor (echo cancellation / far-field), marked fortemedio FM1388GA12. Handles MIC1/MIC2 for hands-free and voice.

The analog AM/FM tuner — NXP TEF6635 (TEF66xx-family car-radio tuner). Not photographed close-up here; identified from the Android audio HAL (system/lib/hw/audio.primary.imx6.so and audio.gis.imx6.so both embed the string tef6635). It is driven by the companion MCU via the OEM CarService (radio_* calls), not directly by Android.

DAB (digital radio) has a separate native driver vendor/lib/libdab.so plus a com.adayo.dab app — so DAB hardware is present, but the specific DAB demodulator chip is not yet identified (a close-up of the chips near the FAKRA antenna jacks would settle it). Confidence: tuner part high (HAL string); DAB demod unknown.

GNSS (GPS / BeiDou) positioning module, UM220-IV NV (unicorecomm), beside the FAKRA antenna jacks (蓝色/blue = GPS, 粉色/pink, 棕色/brown).

Two SK hynix H5TC4G63EFR DDR3 chips — 512 MB each = 1 GB total (board back).

Main DC-DC / PMIC (TPS65265), generating the core/IO rails from 12 V (next to the power inductors). Fed by the B+ pins on the main connector.

Pin labels (back)	Power / CAN cluster

The main harness connector is silk-screened on the back with pin names, so a spare board can be bench-powered by wiring directly to the back-side through-hole pins:

• B+ / B+B — battery positive (12 V); the square/notched pads are the high-current power pins.
• GND / Batt GND — ground.
• KEY — ignition/ACC input (assert high to boot; the MCU keeps the SoC off otherwise).
• CAN… — vehicle CAN (bottom-left cluster).
• RL±/FL±/FR±/RR± — speaker outputs (do not put 12 V here). MIC1-/MIC2+, TBOX_IN, TF1_POWER/TFT_POWER (display power out).

Bench power: +12 V → B+ (and B+B), GND → GND, +12 V → KEY, using a current-limited supply (~3 A), ground lead first.