Fix Nissan satnav unit

[Shuher]

As this was previously a part of other discussion I've corrected the text - below a small reasoning for the stuff I do around my sat nav unit.

Many thanks!
Yep, I drive Nissan, last several years I spent on dissecting their ECU and this made me interested in the HW reversing stuff
So now I'm on a exaclty Bosch/Blaupunkt made radio just for fun as for me lower grade one with the only Bluetooth handsfree & AD2P Audio profile support is more than enough.

For now I'm about to make it booting as it restarts couple of times after the logo showed for the first time and I already replaced RAM chips (I know that I used crappy PC-class ones from my old computer but for testing purposes that's ok) and reballed flash chip. No luck so now it's time to doublecheck all voltages as I can see that after ~15 seconds something pulls down RUNx inputs on LTCxxxx voltage regulators.

Just couple of pictures of it and what's interesting that debug connector on the bottom of the board seems to be just a 30-pin concatenation of both debug connectors that are used on Ford's radios. Hopefully I can do direct mapping of them and debug UART may be accesse form it - will see...

[Go4IT]

I've moved your post into this new topic. As it is a Bosch-Unit also, it perfectly fits here.
I never had such a unit at hand, but the similarities are great.

The fact the you see the bootlogo should tell that all the hardware i okay. You won't see this else! So i guess the turn off/reboot after 15s is similar to the problem known in NX, the software in the flash have a problem. You could read it from some working device and copy it over to yours and it should work.

[Shuher]

Once I get my J-Link delivered and spare flash IC as well - this will the next step I'll try.
I also ordered another one unit which is reported as fully functional exactly to extract the firmware (The only difference between man and boy is the price of toys, huh ) Hope the owner will be able to send it out with all this quarantine stuff.

The thing that pointed me into HW issues direction was strangely floating voltages for +2,5V and +1,6V sources, but today I udnderstood that it was beacuse of bad connection for voltmeter - ground was taken directy on my lab power source which seemed to be too far for good measurement. Connecting the ground directly on board shown that all voltages are indeed okay. And meanwhile I put back original RAM chips trying to power the unit on without one of them to confirm that graphics board is not too independat and doesn't try to show logo by itself just being powered on even if OMAP is dead. It's not Just making some research...

So now I'm pretty convienced that this seem to be really SW issue. At least everything points to that. Will see.

[Go4IT]

As you max habe read from the unit will start partially even without RAMs, but graphics is solely drive from OMAP (HMI) and so should it be on this Nissan unit. What works without RAMs is accessing the flash. Also the radioprocessor (RU, V850) starts up. Power will be applied to OMAP, RAM, Flash. But beware the without Tuareg-Mode, the RU will power everything down after 15 secs not receiving watchdog-info from HMI.

There should be a service-connector, or even header-pads exposed on the board. If not try to follow the FLMD-Pins of the V850 chip.

Please give more info about the unit. There must be part number on mainboad, graphicsboard and case. Even photos of everything would be great to know.

[Shuher]

It doesn't have V850 RU in it Probably this strange IC from ST does it in this unit. Or maybe OMAP controls it all - if the unit is powered on being fully equipped with RAM chips I see logo for ~5 seconds, then there are couple of backlight blinks and then screen goes blank, but the supply voltages for OMAP and RAM stay there for ~10 seconds more and then get disabled by something via RUNx pins.

But, if I power the unit on without one of RAM chips soldered it keeps OMAP and RAM voltages (+2.5V and +1.6V) enabled and they are there for all the time indefinitely. That makes me thinking that here OMAP controls the voltages by itself.

As for toareg-mode - I believe I can prevent unit from rebooting by using "EXT_BOOT" equivalent of concatenated 30-pin service port. Yesterday I tried to make a mapping of this port to X3806 and X800 connectors and see with logic analyzier what's happens there.

So far I found that pulling the EXT_BOOT pin (equivalent of pin 8 in X3806) down prevents device from showing logo but supply voltages stay enabled for very long time so I believe this mode may be used for JTAG session to avoid interruptions.
Another thing I noticed that equivalent of pin 7 in X3806 (which is called UART_OUT on the service connector schematics) in this condition after power on gives something transmitted out, but it seems to have extremely small baudrate - even for 9600 bps it should be faster.

Also the equivalent of V850_UART_OUT (pin 5 of X800) seem to send something out every power on at 19200 bps regardless of EXT_BOOT pin state but again it could be either not human readable console or I'm just failing to choose proper baudrate basing on LA capture.

And some photos (apart from graphics unit interior - will add later, but it's same Altera FGPA and 8 Mb flash chip, nothing interesting )

[Go4IT]

With the fotos you provide i was able to get valuable informations. You are right, there is no V850, instead this unit uses the "ST 8928909289 BCG", a custom chip from ST which is named as "Digital Radio Receiver", whatever this means... i think "Digital" it not heading to DAB

- But i see that the RAMs should be good, because they are produced much later than the faulty series. The marking tells they are from Week 36/2012. I would not expect them to be faulty.
- Also the flash should be ok. For now i NEVER had a faulty flash device, only software was failed inside.
- Don't get me wrong, but i wonder that the unit is still working when i look at the "smoked" soldering joints What do you use there to get it that dark??
- I only see one blue Fakra connector, i gues for GPS-Antenne. Radio antenne could be a ISO-Connector.
- The red Micro-Match connector on the top is the one for the CD-drive, i guess.
- I don't see the debug-headers as like on FX, NX, MCA, but i'm shure the signals are on that unpopulated header pads on the downside (4th foto, upper left area).
- Right beneath the header we find a pad for video-cable. So this unit may also be produced with an video input.
- From the label we see that it uses Firmware version 0603.
- The serial of the device would be the first number in the barcode label "8323028 25915BH21C F 0603 009 034 412"
- The Bosch partnumber is 7612830095
- The Nissan partnumber is 25915BH21C
- The unit shortname is LCN (similar to "FX")
- Keep in mind, that measureing voltages against their GNDs. The Bosch-Units have several GNDs, depending on their use and to avoid distortions. It's best to find the power regulator and use a GND pad directly connected to the GND of the chip (often caps are usefull to get this).

My best bet for now was, that it simply has an software-failure which causes all what you see. A while ago i had an image of such an device, but cannot find it anymore...

- Texas Instruments - OMAP5948 - Application Processor
- Bosch / LSI Logic - DAB/VHF Digital Receiver - DFIRE2
- SDRAM - Micron Technology - MT46V64M8 - DDR, 512Mb (16Meg x 8 x 4 banks), 2.5V, 6ns@CL=2.5(DDR333)
- Spansion - S29GL512N10FFA02 - Flash - NOR, 512Mbit, 3V, 100ns
- ST Microelectronics ST 8928909289 BCG - Digital Radio Receiver - Dual-IF AM/FM, w DSP & Integrated ARM7 MCU
- ALPS - Bluetooth Module - CSR - BC57E687B-ITM-E4 - BlueCore5-Multimedia External - Single Chip Bluetooth Solution, V2.1+EDR
- ST Microelectronics - TDA7563B - Amplifier - 4 x 50W Multifunction, Quad, w Built-in Diagnostics, Class SB
- GPS Receiver - Texas Instruments - 74DKH6T
- Epson - L5F30705T03 - Display Module Value Line Item - 5.0' Diagonal, 400 x 240 Pixels
- Touchscreen Overlay - 4-Wire Resistive, w Integral Flex PCB, & PSA on Edges
- Tan Shin - CD Rom Drive - Slot Load, Single CD
- Altera - EP2C20F256I8N - FBGA - Cyclone II, 18,752 Logic Elements,239,616 RAM Bits, 4PLLs, 152 I/O's, 26 Multipliers
- Analog Devices - ADV7181BBSTZ - Video Decoder - SDTV\, Multiformat, w Integrated Three 54MHz/9-bit ADCs & 2-Wire Serial MPU Interface
- Altera - EPM240T100I5N - CPLD - MAX II, 240 Logic Elements, 80 User I/O's
- Flash - SST - SST39VF1601-70-4I-B3KE - NOR, 16Mbit, 70ns
- Flash - Spansion - S29GL064A90TFIR2 - NOR\, 64Mb\, 3V\, 90ns
- SDRAM - Elpida - EDS1232AATA-75T1 - 128Mbit (1M x 32bit x 4Bank)\, 133MHz/CL3\, 3.3V
- Receiver Front-End - Freescale - CF730DA
- SRAM - Cypress Semiconductor - CY62147DV30LL-70BVI - 4Mbit (256K x 16bit)\, 70ns
- Flash - Spansion - S29AL008D90BAI02 - NOR\, 8Mb\, 3V\, 90ns

[Shuher]

It operates exactly as it was at the time I got it

Don't worry, it's just a rosin-based flux, looks dirty but works perfect and I didn't bother too much washing it off. The better one is being delivered to me now along with J-Link and other stuff. Below I made small cleanup, not 100% perfect but I believe I will still make some soldering there so final cleaning will be made later on.

IMG_20200420_163029111.jpg

IMG_20200420_163009908.jpg

The device is declared to have rearview camera support so it should definitely have all necessary components soldered and I never heard of any other types of video supported. Documentation says that the video pin is in a "ISO"-connector as well. Moreover, it is said that camera support it's just a matter of firmware for these units and may be easily (if you got JTAG & TSOP48 NOR programmer, huh) added.

For the rest, according to what I managed to find out about it already, you are completely right, including firmware version. Luckily I managed to find firmware upgrade CD ISO file in internet with FW ver. 604 for it so I really hope that I would be able to put proper baseline for it after I fix broken flash contents with even partially fitting image (who knows all the variety...). Eagerly waiting for my J-Link

What's interesting for 30 pin debug connector - lower 16 pins seem to be direct mapping of 16 pin MicroMatch and JTAG layout is exactly the same (just mirrored) as for Ford satnavs.

[Go4IT]

I found this, which may help you to JTAG to the device:

nissan_service_header.png

[Shuher]

Yep, thanks - I was using it when I tried to make a FT2232 based JTAG board + OpenOCD work with the device without success. Will try with J-link once more

[Go4IT]

Maybe the 30 pin header is nothing else than the 16 and 14 pin on FX, just in one row?!

The video is available on the backside connector, that's true. If the systems are equiped with video, you should find a ADV7181 on the graphicsboard.