Component-level teardown of the Aiways U5 TBox (Telematics Box) — the always-on cellular gateway. It holds the SIM, terminates the vehicle CAN, and is the box the OEM cloud talked to: it is the FOTA relay that pushes MCU/system updates to the head unit (getTBoxInfo = 192.168.1.1:50000, see connectivity). Board marked XT7018L PA.2, IN060000P0, dated 2019.09.09.

⚠ Chip IDs below are read off the photos. Confidence is called out per part — several markings are house-coded (Adayo H2… numbers) or could not be fully decoded, and those are flagged rather than guessed.

⚠ Privacy: the modem IMEI and the SIM ICCID shown below are device/subscriber identifiers — redact them before making this page public.

Front	Back

Front: the Quectel LTE module (top, under the QR-coded shield) with three RF cans labelled MAIN ANTENNA / WIFI-1 / WIFI-2, the nFore gateway chip and Micron memory beside it, and a row of FAKRA antenna jacks plus the white main harness connector down the right edge. Back: the NXP S32K144 MCU (large QFP, lower centre) and the CAN transceiver.

LTE Cat-4 automotive module, Quectel AG35 — shield marked R-C-QUT-AG35-E, FCC ID: XMR201907AG35E (XMR = Quectel's FCC grantee code), SN: P1A20LA19000906. The unit's IMEI: 860648040213311 is printed on the can. This is the box's uplink; its subscription comes from the soldered SIM below (see connectivity). High confidence.

The SIM — a soldered-down MFF2 embedded SIM (M2M form factor, which is why it looks like an IC rather than a card). Carrier: Deutsche Telekom, confirmed after desoldering. Markings: H2021875 (lot) / ICCID 8988228000 0010582704 / THA.

Because it is a solder-down MFF2 part, changing carriers means desoldering it (as was done here) and fitting a different SIM — directly relevant to running the car's cellular uplink on your own data plan once the OEM subscription lapses (see roadmap, connectivity). High confidence (confirmed physically).

The TBox's own microcontroller — NXP S32K144 (FS32K144HFVLL / 0N57U / QGU2034AC), 100-pin LQFP. Automotive Arm Cortex-M4F, ~512 KB flash. It runs the telematics logic, drives the modem, and bridges to the vehicle CAN via the transceiver below. High confidence (clear marking + NXP logo).

NXP TJA1042 high-speed CAN transceiver (TJA1042 / NXP), SO-8. This is the TBox's physical tap onto a vehicle CAN bus — an independent CAN path from the head unit's MCU. High confidence. (A second route onto the same data is what CAN bus access documents from the head-unit side.)

TI TLV320AIC3104 low-power audio codec (top-mark AC3104 / TI / AV5Y), QFN. In a TBox a codec almost always serves the emergency-call (eCall) voice path — mic + speaker for an automated 112/emergency call. Part read is high confidence; the eCall purpose is an inference.

Large QFP marked nFore NF3304 201706, sitting next to the Micron memory. nFore Technology makes networking / gateway silicon, so this is likely the communications/gateway processor (handling the link between the modem, CAN and the host) — but the exact function of NF3304 is not confirmed. Marking is legible; role is an educated guess.

Micron FBGA chip (Micron “M” logo) marked ORAID JWD13, beside the nFore processor — its working DRAM or flash. The FBGA code (ORAID) would need Micron's part decoder to resolve exact type/density, so capacity is unconfirmed. Vendor high confidence, exact part low.

Exar/Sipex SP3232E 3 V RS-232 transceiver (SiPEX 3232E 1930L), TSSOP — level-shifts a UART to RS-232 levels, typically a diagnostic / debug serial port. High confidence.

Buck-boost DC-DC	NXP power/RTC

• TI TPS63020 buck-boost converter (PS63020 / TI) — makes a stable rail from a battery

voltage that can sag/spike. High confidence.

• NXP PF85163 (PF85163 / NXP), SO-8 — an NXP power/RTC-class device; exact part not confirmed. Low confidence.
• H2002235 (QFN) is a house-coded Adayo part number, not a real silicon marking —

likely a load switch / protection / small PMIC or PHY, but not identifiable from the marking alone. The 12 V input also has an MCC SMBS36A transient-protection diode.

RF is broken out to FAKRA coax jacks (colour-keyed) plus the internal cans labelled MAIN ANTENNA, WIFI-1, WIFI-2 — i.e. cellular main/diversity + GNSS + Wi-Fi. The white connector on the right edge is the vehicle harness (power, ignition, CAN, audio for eCall). Exact pinout not yet traced.

• It is the cellular uplink and the OEM cloud endpoint — with the OEM servers dead, this is

what a self-hosted backend would need to impersonate or replace. Its Deutsche Telekom MFF2 SIM is swappable (by desoldering) to your own data plan (see connectivity, roadmap).

• It is the FOTA relay that flashes the head-unit MCU (MCU.bin) — so a firmware dump might be

reachable from here, though updates are delta patches (see the MCU section).

• It has an independent CAN tap and its own S32K144 MCU — a second, always-on foothold on the

vehicle bus, separate from the head unit.