Component-level teardown of the Aiways U5 TBox (Telematics Box) — the always-on cellular gateway. It holds the SIM, terminates the vehicle CAN, and is the box the OEM cloud talked to: it is the FOTA relay that pushes MCU/system updates to the head unit (getTBoxInfo = 192.168.1.1:50000, see connectivity). Board marked XT7018L PA.2, IN060000P0, dated 2019.09.09.

⚠ Chip IDs below are read off the photos. Confidence is called out per part — several markings are house-coded (Adayo H2… numbers) or could not be fully decoded, and those are flagged rather than guessed.

Front	Back

Front: the Quectel LTE module (top, under the QR-coded shield) with three RF cans labelled MAIN ANTENNA / WIFI-1 / WIFI-2, the nFore WiFi/Bluetooth module and Micron memory beside it, and a row of FAKRA antenna jacks plus the white main harness connector down the right edge. Back: the NXP S32K144 MCU (large QFP, lower centre) and the CAN transceiver.

LTE Cat-4 automotive module, Quectel AG35 — shield marked R-C-QUT-AG35-E, FCC ID: XMR201907AG35E (XMR = Quectel's FCC grantee code), SN: P1A20LA19000906. The unit's IMEI: (redacted — unique to each car) is printed on the can. This is the box's uplink; its subscription comes from the soldered SIM below (see connectivity). High confidence.

This module is more than a radio. Its chipset bundles the cellular baseband with a full application processor running embedded Linux — so this chip is the TBox's on-board computer, not just its modem. Software analysis confirms the telematics application (the cloud client, OTA agent and eCall logic) runs here, on Linux. That Linux side has no CAN connection of its own — see the MCU below for what happens next.

The SIM — a soldered-down MFF2 embedded SIM (M2M form factor, which is why it looks like an IC rather than a card). Carrier: Deutsche Telekom, confirmed after desoldering. Markings: H2021875 (lot) / ICCID (redacted — SIM ICCID) / THA.

Because it is a solder-down MFF2 part, changing carriers means desoldering it (as was done here) and fitting a different SIM — directly relevant to running the car's cellular uplink on your own data plan once the OEM subscription lapses (see roadmap, connectivity). High confidence (confirmed physically).

The TBox's own microcontroller — NXP S32K144 (FS32K144HFVLL / 0N57U / QGU2034AC), 100-pin LQFP. Automotive Arm Cortex-M4F, ~512 KB flash. High confidence (clear marking + NXP logo).

Its role is narrower than it looks, but important: this is the only path from the Linux side to the vehicle CAN bus. The telematics software (above) reaches it over a serial link and hands it simple commands; the MCU is the one actually wired to the CAN transceiver below and is what would put anything on the vehicle's bus. So there is always a dedicated microcontroller standing between the general-purpose computer and the live CAN bus — the same pattern the head unit uses with its RL78 MCU (see architecture).

NXP TJA1042 high-speed CAN transceiver (TJA1042 / NXP), SO-8. This is the TBox's physical tap onto a vehicle CAN bus — an independent CAN path from the head unit's MCU. High confidence. (A second route onto the same data is what CAN bus access documents from the head-unit side.)

TI TLV320AIC3104 low-power audio codec (top-mark AC3104 / TI / AV5Y), QFN. In a TBox a codec almost always serves the emergency-call (eCall) voice path — mic + speaker for an automated 112/emergency call. Part read is high confidence; the eCall purpose is an inference.

A shielded RF module (metal-can lid, the same style as the AG35's own shield) marked nFore NF3304 201706, sitting next to the Micron memory. nFore Technology's actual business is automotive WiFi/Bluetooth combo modules, and software confirms this is exactly that: both the head unit and the TBox's own application are built on nFore's Bluetooth car-kit SDK (hands-free calling, music streaming, contacts sync), and the TBox's Bluetooth configuration names the underlying baseband as a Broadcom BCM4339 (a WiFi + Bluetooth 4.0/BLE combo chip) reached over a UART — nFore most likely packages that chip into their own automotive-qualified module under this part number. High confidence (role confirmed via software; exact die inside the module is an inference).

The Bluetooth stack isn't started by any background service — the TBox's software appears to bring it up only on demand. One function name stood out during analysis: a BLE-based remote wake feature — suggesting Bluetooth here is meant as a local trigger path, not just for phone pairing. Relevant to any future companion hardware placed near the car (see roadmap).

Micron FBGA chip (Micron “M” logo) marked ORAID JWD13, beside the nFore module — its working DRAM or flash. The FBGA code (ORAID) would need Micron's part decoder to resolve exact type/density, so capacity is unconfirmed. Vendor high confidence, exact part low.

Exar/Sipex SP3232E 3 V RS-232 transceiver (SiPEX 3232E 1930L), TSSOP — level-shifts a UART to RS-232 levels, typically a diagnostic / debug serial port. High confidence.

Buck-boost DC-DC	NXP power/RTC

• TI TPS63020 buck-boost converter (PS63020 / TI) — makes a stable rail from a battery voltage that can sag/spike. High confidence.
• NXP PF85163 (PF85163 / NXP), SO-8 — an NXP power/RTC-class device; exact part not confirmed. Low confidence.
• H2002235 (QFN) is a house-coded Adayo part number, not a real silicon marking — likely a load switch / protection / small PMIC or PHY, but not identifiable from the marking alone. The 12 V input also has an MCC SMBS36A transient-protection diode.

RF is broken out to FAKRA coax jacks (colour-keyed) plus the internal cans labelled MAIN ANTENNA, WIFI-1, WIFI-2 — i.e. cellular main/diversity + GNSS + Wi-Fi. The white connector on the right edge is the vehicle harness (power, ignition, CAN, audio for eCall). Exact pinout not yet traced.

• It is the cellular uplink and the OEM cloud endpoint — with the OEM servers dead, this is what a self-hosted backend would need to impersonate or replace. Its Deutsche Telekom MFF2 SIM is swappable (by desoldering) to your own data plan (see connectivity, roadmap).
• It is the FOTA relay that flashes the head-unit MCU (MCU.bin) — so a firmware dump might be reachable from here, though updates are delta patches (see the MCU section).
• It has an independent CAN tap and its own S32K144 MCU — a second, always-on foothold on the vehicle bus, separate from the head unit.