Disassembly Analysis of SAIC Feifan R7 Intelligent T-BOX

Source | Automotive Electronics and Software

This column will introduce the disassembly analysis of intelligent vehicle controllers, presenting readers with the latest reference designs and selection schemes for mass-produced controllers. Today, we will share the intelligent domain controller module – TBOX of SAIC Feifan R7.

The electronic architecture of SAIC Feifan R7 is developed by Zero Bundles, consisting of four domain controllers: Intelligent Connection, Intelligent Calculation, Intelligent Driving, and Cockpit. The Intelligent Connection domain controller is similar to the traditional T-box module.

1. T-BOX Introduction

TBOX stands for: Telematics Box, also known as Remote Communication Terminal in Chinese, is an automotive electronic module that integrates intelligent information processing and communication technology. It enables wireless communication between the vehicle and the outside world, providing various conveniences and safety guarantees for drivers and vehicles. The Intelligent Connection TBOX is generally installed below the vehicle dashboard. Through the TBOX and mobile app, many functions can be realized, such as controlling door locks, honking, flashing lights, turning on air conditioning, starting the engine, etc.; it can also query vehicle status remotely, including remaining fuel, battery level, vehicle location, and whether the vehicle is locked. In short, TBOX provides a very convenient travel experience for car owners. Below, we will analyze the magical aspects of the SAIC Feifan R7 Intelligent T-BOX from the shell, internal circuit, and system composition.

2. Shell and Terminals

2.1 Shell

As shown in the figure, the TBOX shell consists of two metal parts, with the front metal shell designed with a heat dissipation groove.

Figure 1 TBOX Front

Figure 2 TBOX Back

2.2 Terminal Description:

Figure 3 TBOX Wiring Terminals

The TBOX has terminals for power, UART/CAN bus, Ethernet ports, 4G/5G antennas, and GPS antennas.

3. TBOX Composition

The TBOX mainly consists of SOC chips, MCU chips, communication modules, encryption chips, switch chips, storage chips, power management chips, and GNSS modules. As shown in the figure:

Figure 4 Feifan R7 TBOX Composition Mind Map

Functions and Common Schemes of Each Module:

3.1 Role and Common Models of SOC Chips

SOC chips are important components in automotive TBOX, responsible for processing vehicle information and implementing various functions. SOC chips usually consist of multiple cores, each responsible for different tasks, allowing the TBOX to process multiple tasks simultaneously. Common SOC chip models include NXP’s IMX6 and IMX8. These chips have powerful computing and image processing capabilities, supporting high-definition video playback and real-time image analysis, providing strong computing and processing power for the TBOX.

3.2 Role and Common Models of MCU Chips

MCU chips are important components that control various sensors and actuators in vehicles, responsible for monitoring vehicle status in real time and controlling the operation of various systems as needed. Common MCU chip models include Infineon’s TC2x and TC3x series, NXP’s S32K14X, and Renesas’ R7F7X, etc. These chips feature high performance and low power consumption, meeting the TBOX’s needs in vehicle control and monitoring.

3.3 Function and Common Models of Communication Modules

Communication modules are key components in the TBOX that enable communication between the vehicle and the outside world. They can connect to the internet via wireless networks, facilitating the transmission of vehicle information and remote control. Common communication module models include Huawei’s ME909s, MH5000 series, and Quectel’s AG35, AG550, AG520, etc. These modules support 5G, 4G, and 3G networks, with Quectel’s AG520, AG550, and Huawei’s MH5000 supporting V2X, providing stable and reliable connectivity, enabling high-speed data transmission and remote control functions.

3.4 Function and Common Models of GPS Modules

GPS modules are key components in the TBOX used for positioning and navigation. They can receive satellite signals and calculate the vehicle’s exact position using positioning algorithms. Common GPS module models include: Hchips’ UM960, UM982 and ublox’s ZED-F9K, ZED-F9P, ZED-F9H, etc. These modules feature fast positioning, high precision, and stability, meeting the TBOX’s needs in navigation and positioning.

3.5 Function and Common Models of Switch Chips

Switch chips are important components in the TBOX that enable data exchange and communication. They facilitate data transmission and interaction between various subsystems within the vehicle. Common switch chip models include Broadcom’s BCM89x series and MARVELL 88Q5050 series. These chips feature high bandwidth and low latency, enabling fast data transmission and real-time system interaction.

3.6 Function and Common Models of Encryption Chips

Encryption chips are key components in the TBOX that ensure data security and prevent malicious attacks. They can encrypt and decrypt data, implementing access control and identity authentication functions. Common encryption chip models include Infineon’s SLE 95250, SLS32 series, Maxim’s DS28E25 series, and Shanghai Xintai’s TTM2000, TTM3000 series. These chips feature advanced encryption algorithms and security performance, protecting the data in the TBOX from illegal access and tampering.

4. Analysis of Feifan R7 TBOX

Feifan R7 TBOX composition block diagram:

Figure 5 Composition Diagram of Feifan R7 TBOX

Figure 6 PCB Front View

Figure 7 PCB Back View

Figure 8 PCB Side View

4.1 SOC – NXP MIMX8QX6AVLFZAC

Figure 8 MIMX8QX6AVLFZAC Physical Picture

NXP MIMX8QX6AVLFZAC Introduction

The i.MX 8X series processors are highly integrated and support graphics, video, image processing, and voice functions, meeting the demands for security certification and high energy efficiency. Suitable applications include industrial automation and control, HMI, robotics, building control, automotive dashboards, video/audio, in-vehicle infotainment systems, and in-vehicle information services.

Figure 9 i.MX 8X Block Diagram

Features:

Processor Composite Device	· 2-4 Cortex-A35 cores · 1 Cortex-M4F core for real-time processing · 1 Tensilica® HiFi 4 DSP
Multimedia	· 2-4 Vec4-Shader GPUs, OpenGL® ES 3.1, OpenCL™ 1.2 EP, OpenVG™ 1.1, Vulkan® · Video: 4K H.265 dec | 1080p H.264 enc/dec
Memory	· 16/32-bit DDR3L-1866 and LPDDR4-2400 · 1 Octal SPI or 2 Quad SPI · ECC function ①. Cortex-A35 L1 cache parity ②. Cortex-A35 L2 cache ECC ③. ECC protection on sDDR interface
Display & Camera	· 2 combined MIPI DSI (4-channel) / LVDS (1080p) · 24-bit parallel display I/F (WXGA) · SafeAssure® fault recovery display · 1 4-channel MIPI CSI2 · 1 parallel 8-bit CSI (BT.656)
Connectivity	· 2 SDIO3.0 [or 1 SDIO3.0 + 1 eMMC5.1] · USB 2.0 and 3.0 OTG support, with PHY · 2 Ethernet AVB MACs · 3 CAN / CAN FD · MOST 25/50 · PCIe 3.0 (single channel), providing L1 sub-state · 1 12-bit ADC (6 channels) · 4 SPIs, 1 ESAI, 4 SAIs, 1 keyboard · 4 I2Cs (high speed), 4 I2Cs (low speed) · 1 SPDIF
Security	· High reliability boot, SHE · TRNG, AES-128, AES-256, 3DES, ARC4, RSA4096, SHA-1, SHA-2, SHA-256, MD-5 · RSA-1024, 2048, 3072, 4096 and secure key storage · 10 tamper pins (active and passive) · Online encryption engine (AES-128)

4.2 MCU – Renesas R7F7015833

Figure 10 R7F7015833 Physical Picture

R7F7015833 is the Renesas automotive-grade chip RH850. RH850 product combination diagram:

RH850 Introduction:

RH850/C1M-Ax microcontroller is equipped with RH850 series G3MH (C1M-A2 is dual-core) CPU core (C1M-A1 working frequency is 240MHz, C1M-A2 working frequency is 320MHz), with excellent processing capabilities. In addition to ROM, RAM, and DMA, this microcontroller also integrates various timers (such as motor control timers), multiple serial interfaces (such as CAN, CAN FD compatible), 12-bit A/D converters (ADC), R/D converters (RDC3A) that convert rotary transformer output signals into digital angle information, CPU, and parallel motor control units (EMU3), among others, and is equipped with various peripheral functions suitable for HEV/EV motor control. Additionally, C1M-A2 can control two motors simultaneously.

RH850 Features:

CPU Core:	C1M-A1: 240MHz core (includes lock-step dual core x1) C1M-A2: 320MHz core x2 (includes lock-step dual core x1) FPU
Timer:	Main oscillator: 20MHz PLL with optional SSCG mode: 240MHz or 320MHz PLL without SSCG mode: 80MHz On-chip low-speed oscillator: 240kHz Data transmission: DMAC / DTS
Timer:	Timer array unit D (TAUD) 2 or 4 units Timer array unit J (TAUJ) 1 or 2 units Motor control timer (TSG3) 2 or 3 units Encoder timer (ENCA) 2 units
Analog:	SAR A/D converter 30 or 48 channels, 3 units
Communication Interface:	Clock serial interface H (CSIH) 3 channels CAN interfaces (RS-CANFD) 4 channels LIN interface (RLIN3) 3 channels Serial communication interface (SCI3) 3 channels RSENT 4 channels
Motor Control:	Motor control timer (TSG3) 2 or 3 units R/D converter (RDC3A) 1 or 2 units Enhanced motor control unit (EMU3) 1 unit
Security:	Multi-input signature generator (MIST) Clock monitor Watchdog timer Security watchdog timer Memory protection function
Power Voltage:	1.15V – 1.35V (CPU core) 4.5V – 5.5V (I/O, system, AD converter, RD converter)
Temperature:	Tj= -40° – +150°

4.3 5G+V2X Module – Quectel AG550

AG550 Introduction:

AG55xQ is a series of automotive-grade 5G NR Sub-6 GHz modules developed by Quectel, supporting both standalone (SA) and non-standalone (NSA) modes. Based on 3GPP Rel-15 technology, this module can support a maximum downlink rate of 2.4 Gbps and uplink rate of 550 Mbps in 5G NSA mode, and a maximum downlink rate of 1.6 Gbps and uplink rate of 200 Mbps in LTE-A networks. Through its C-V2X PC5 direct communication function (optional), AG55xQ can be widely applied in the field of vehicle networking, providing reliable solutions for the establishment of intelligent vehicles, autonomous driving, and intelligent transportation systems. Meanwhile, the module supports dual SIM dual standby (optional) and rich functional interfaces, greatly facilitating application development for customers. Its excellent ESD and EMI protection performance ensure strong robustness in harsh environments.

AG55xQ includes AG550Q (5G + DSSS + C-V2X), AG551Q (5G + DSSS), AG552Q (5G + DSDA) and AG553Q (5G + DSDA + C-V2X) series; to meet different market demands, each series includes multiple models: AG55xQ-CN, AG55xQ-EU, AG55xQ-NA and AG55xQ-JP. At the same time, each series module is backward compatible with existing GSM, UMTS and LTE networks, thus enabling connectivity even in areas without deployed 5G NR networks or remote areas without 3G/4G network coverage.

AG550 Features:

· Complies with IATF 16949 and automotive industry quality management processes such as APQP, PPAP, developed based on Qualcomm SA515M chip (AEC-Q100 compliant) automotive-grade solution

· 5G NR Sub-6 GHz module, supports standalone and non-standalone modes

· Backward compatible with 4G (Cat 19)/3G/2G networks

· MIMO technology meets the requirements for data rate and connection reliability in wireless communication systems

· Optional C-V2X PC5 Mode 4 direct communication

· Optional dual SIM dual standby technology (DSDA) to meet different application needs of customers

· Optional single-frequency GNSS, dual-frequency GNSS, PPE (RTK) and GNSS/QDR combined navigation solutions to meet different requirements for positioning accuracy and speed in different environments

· Enhanced features: DFOTA, VoLTE, QuecOpen®, high security, etc.

· Ultra-wide operating temperature range (-40 °C ~ +85 °C), eCall applications below +95 °C, superior anti-electromagnetic interference capabilities meet the application needs in vehicles and other harsh environments

4.4 Encryption Chip – Xintai TTM2000A11

Xintai TTM2000A11 Introduction:

Mizar TTM2000 is a flexible, reliable, secure, and compliant encryption chip product aimed at the automotive electronics field. This product is specifically developed for the security of vehicle networking V2X applications, capable of fully meeting the message authentication performance, secure certificate management, and other needs required by applications such as C-V2X and DSRC.

TTM2000 Features:

Standards and Certifications	– EVITA hardware security module Full-level architecture design – AEC-Q100 Grade 1 requirements – National Cryptography Administration Security Chip Grade 2
Product Features	– ARM® SecureCore® SC300™ 32-Bit RISC Core, 80Mhz – 120.0 DMIPS (Dhrystone v2.1); – Memory Protection Unit (MPU); – 24-bit SysTick timer; – 3.3V and 1.8V power supply, IO pin level is 3.3V – Operating temperature range: -40℃ – 125℃ – Package LQFP-64, QFN-64 (TBD)
Security Features	– Hardware “root of trust” anti-tampering detection function, physical shielding layer protection design, anti-side-channel attack protection design – Internally integrates hardware cryptographic algorithm units of international standards and Chinese National Cryptography Administration standards – 4 independent TRNGs – Hardware encrypted Flash, secure key storage – Watchdog timer (WDT) – High/low voltage abnormality detection – Temperature abnormality detection
Cryptographic Algorithm Unit	– High-speed ECDSA (NIST-P256) – High-speed SM2 – High-speed SM3 – RSA (up to 2048 bits) – ECC-256 – SHA-256 – AES – DES – SM4
System Protection	– Each chip has a unique 32-bit serial number – Comprehensive lifecycle state management – System security boot using domestic cryptographic algorithms
Communication Features	– 2 integrated SPI controllers, configurable as Master/Slave mode – 1 UART controller – 1 I2C – 5-channel GPIO, configurable as Input/Output, or as external interrupt input; – 1 external timer – 1 Watchdog – 8-channel DMA controller – Various, configurable IO connections for better performance and flexibility
Memory	– 512KB internal Flash, supports ECC – 160KB SRAM – Secure ROM
Key Cryptographic Unit Performance Design Goals	– Ultra-high-speed SM2/ECDSA (NIST P-256) unit: >4000 signature verifications/second; – High-speed general curve ECDSA unit: >1500 signature verifications/second; – High-speed SM3 unit: >500Mbps – High-speed SHA unit: >500Mbps

4.5 Switch Chip – MARVELL 88Q5050

Marvell 88Q5050 Introduction:

Marvell 88Q5050 is an 8-port, high-security automotive Gigabit Ethernet switch chip that fully complies with IEEE802.3 and 802.1 automotive standards, featuring advanced security functions to prevent network threats (such as hacking and denial of service (DoS) attacks). This 8-port Ethernet switch chip has 4 fixed IEEE 100BASE-T1 ports and 4 configurable ports, which can include 1 IEEE 100BASE-T1, 1 IEEE 100BASE-TX, 2 MII/RMII/RGMII, 1 GMII port, and 1 SGMII port. The switch chip provides local and remote management functions, allowing users to easily access and configure the device. Through AEC-Q100 Grade 2 certification, this solution implements Marvell’s highest hardware security features designed for automotive Ethernet chips to prevent malicious attacks or threats to data flow within vehicles. This advanced switch chip employs deep packet inspection (DPI) technology and secure boot functionality to provide the industry’s most secure automotive Ethernet switch. All Ethernet ports support address blacklisting and whitelisting functions to further enhance security.

Block Diagram

Features

Processor	Integrated ARM Cortex-M7 CPU, 250 MHz
IO Interface	• 4 IEEE 100BASE-T1 • The remaining four ports can be configured as follows: – IEEE 100BASE-T1 – IEEE 100BASE-TX – MII/RMII/RGMII – GMII – SGMII • 2 SMI – Master interface can connect to external PHY or other switches – Slave interface for managing the switch • Configurable GPIO • Configurable working clock frequency (19.2 MHz-83.3 MHz) QSPI interface • TWSI master interface • JTAG
Package Features	128-pin LQFP package, 0.5 mm pitch, 14 mm x 20 mm
EEPROM	Slave interface with bootloader for configuring the switch (32 Kb-512 Kb)
Switch Matrix	Gigabit switching matrix

4.6 Storage Chip

eMMC Samsung 8G KLM8G1GEUF

DDR4 Samsung 2G K4F6E3S4HM

① KLM8G1GEUF

Samsung eMMC is designed in BGA package form as an embedded MMC solution. eMMC operates the same as MMC devices, thus allowing for simple read and write operations on the memory using the MMC protocol v5.1 (industry standard).

eMMC consists of NAND flash and an MMC controller. The NAND area (VDDF or VCC) requires a 3V power supply voltage, while the 1.8V or 3V dual power supply MMC controller supports voltage (VDD or VCCQ). Samsung eMMC supports HS400 to improve sequential bandwidth, especially sequential read performance.

There are several advantages to using eMMC. It is easy to use, as the MMC interface allows for easy integration with any microprocessor with an MMC host.

Since the embedded MMC controller isolates NAND technology from the host, any revisions or corrections to NAND are invisible to the host. This leads to faster product development and quicker time to market.

② DDR4 Samsung 2G K4F6E3S4HM

K4F6E3S4HM-THCL is a multifunctional LPDRAM, making it an ideal choice for mobile solutions. Samsung’s LPDDR4 is a breakthrough product that not only provides faster data transfer speeds but also consumes less power, offering more design options for ultra-thin devices, artificial intelligence (AI), virtual reality (VR), and wearable devices.

Features:

· Double data rate architecture; two data transfers per clock cycle

• Bidirectional data strobe (DQS_t, DQS_c) sends/receives data together with the data used when the receiver captures data

• Differential clock input (CK_t and CK_c)

• Differential data strobe (DQS_t and DQS_c)

• Command and address inputs on the positive CK edge; data and data mask referenced on both edges of DQS

• Each module consists of 2 channels

• Each channel has 8 internal banks

• DMI pins: DBI (Data Bus Inversion) for normal write and read operations, DM for masking write data when DBI is off

– Count # of DQ 1 masked when DBI is on

• Burst length: 16, 32 (OTF)

• Burst type: continuous

• Read/write latency: Refer to Table 64 LPDDR4 AC Timing Table

• Auto precharge option for each burst access

• Configurable drive strength

• Refresh and self-refresh modes

• Partial array self-refresh and temperature-compensated self-refresh

• Write leveling

• CA calibration

• Internal VREF and VREF training

• FIFO-based write/read training

• MPC (Multi-Purpose Command)

• LVSTL (Low Voltage Swing Termination Logic) IO

• VDD1/VDD2/VDDQ:1.8V/1.1V/1.1V

• VSSQ terminals

• No DLL: CK to DQS is out of sync

• Data output edge-aligned, data input center-aligned write training

• Refresh rate: 3.9us

4.7 GNSS Module – UBLOX ZED-F9K-00B

ZED-F9K Introduction

The ZED-F9K module adopts the u-blox F9 GNSS platform, providing continuous decimeter-level positioning accuracy for the most challenging automotive use cases. LAP 1.30 supports L1/L2/E5B and L1/L5 frequency bands for maximum flexibility, satellite availability, and security. Complex built-in algorithms cleverly integrate IMU data, GNSS measurements, wheel ticks, and vehicle dynamics models to identify individual GNSS lane failures. The module natively supports u-blox PointPerfect GNSS enhancement services.

It provides multiple global navigation satellite systems and IMU outputs in parallel to support all possible architectures, including a 50 Hz sensor fuse with very low latency solutions. It also enables advanced real-time applications such as augmented reality, while optimized multi-band and multi-constellation capabilities maximize satellite visibility, even in urban conditions. The device is a standalone solution that delivers the best possible system performance.