The Board-ID is made up of an array of resistors, placed or not in a small area next to the Flash chip on the mainboard:
Each ID-Position drawn represents a Bit in the Board-ID.It is used that the software "knows" what kind of radio it is. This implies that the Firmware installed on the devices are commonly the same, but behave differently on the setup of this ID.
They differ for the different models. Here for example here is the ID-area of an FX-Board: and here one for an MCA board: The Board-ID is also shown as parameter in the Engineering-Mode of the radio (push and release NAV+CLIMATE+HOME simultaniously), like in this example for an MCA: and here another one for an NX: The value is given in Hex and, in parenthesis, as Decimal value also. The MCA from the example above had hex "0x42" which is as binary value "0b01000010". Each bit corresponds to an ID-Resistor on the board. Those Bits are read, together with other signals from the serviceport, on start of the OMAP and stored in SDRAM at location 0x0800 0000 for runtime.
The signals are routed to the EMIFS-Interface of the OMAP. EMIFS means "External Memory Interface Slow" and describes pins and functionality to use e.g. Flash memory chips. In contrast there is also a EMIFF (External Memory Interface Fast) where the SDRAM-Chips are connected, but that's only for information. Let's focus on this interface. It is made up from 25 address lines called "EMIFS_A1" up to "EMIFS_A25" which are connected to the address lines of the Flash memory. The reason why there is no "EMIFS_A0" used it, that the flash is set to 16-Bit mode (word-mode).
As you expected, there are also 16 data lines, called "EMIFS_D0" to "EMIFS_D15" connected to the flash.
And, of course there are several signal lines, controlling the IO of the Flash:
"EMIFS_WP" (Write protect) => set to 0 (low) if the flash should behave like it is readonly
"EMIFS_WE" (Write enable) => set to 0 (low) if the data is send from OMAP to Flash, or 1 (high) if OMAP reads from flash
"EMIFS_OE" (Output enable) => if set to 0 (low) data on the address and databus is valid. If set to 1 (high) the IO-Ports are in high-impedance mode.
"EMIFS_CS0" (Chip enable) => also another activation signal for the flash. If set to 1 (high), all the signals of the flash are high-impedance.
Now, what i found out it, that the address lines als also connected to some resistors or transistors. The part of the ID i mentioned above is made up of resistors only. If they are not placed, the internal pulldown resistors of the OMAP EMIFS-Interface let the line behave like a 0 (low). If a resistor is in place (4,7kOhm, connected to 3,3V) it is like 1 (high).
This is the legend of the EMIFS-Signal and the corresponding ID (resistor):
EMIFS_A12 = ID0
EMIFS_A11 = ID1
EMIFS_A10 = ID2
EMIFS_A9 = ID3
EMIFS_A8 = ID4
EMIFS_A7 = ID5
EMIFS_A6 = ID6
EMIFS_A5 = ID7
EMIFS_A4 = ID8
EMIFS_A3 = ID9
If we put the resistor placements of the MCA-Board-ID picture into a binary representation, assume the ID0 is the least significant bit, we get "0000001101" which represents 0x0D.
I've also discovered that the Radioprocessor (V850) uses some kind of ID-mechanism itself, but as an analog value, formed from an voltage divider going into an A/D pin of it. But that's another story...
