====== Instrument cluster — board teardown & chip map ======

A look inside the U5 instrument cluster (the [[hardware:ip|IP]] module, board marked **MAS861 EXCITE**,
hardware **861921104**, built 2022-05). It is a small embedded-Linux computer: an NXP i.MX6 application
processor driving the dashboard panels, with a companion safety MCU for the warning lamps. Photos and
chip identification below.

{{ :ip_cluster:ip_board_overview.jpg?900 |Instrument cluster main board (MAS861 EXCITE) }}

===== The main chips =====

^ Ref ^ Part ^ What it is / does ^
| **U100** | **NXP i.MX6 Dual** (``MCIMX6D6AVT08AD``) | The main processor — two Arm Cortex-A9 cores at 800 MHz, automotive grade. Runs the Linux UI and draws all the gauges, drive-mode artwork and start-up animation. |
| **U500** | **NXP MMPF0100** (PMIC) | Power-management IC. Generates every voltage rail the i.MX6 needs from the board's supply. |
| **U300** (+ U301) | **ISSI ``IS46TR16128C``** DDR3 SDRAM | The processor's working memory (DDR3). Two devices for a 32-bit bus. |
| **U401** | **TI ``DS90UB940A``** FPD-Link III deserializer | The single coax (FAKRA) link to the head unit. The head unit sends the cluster the **reverse/backup-camera video** over it (shown on the cluster when you select reverse — handled by ``libmas861video.so`` on ``/dev/video0``), and the same link is the bidirectional **data + firmware-update back-channel** to the head unit. |
| **U900, U902** | **TI/National ``DS90CF386``** LVDS receivers (two of them) | Convert the LVDS display signal into the parallel RGB that drives the **two LCD panels** (left "trip data" and the centre speedometer). |
| **U804** (pair) | **NXP ``TJA1044``** CAN transceivers | The physical interface to the vehicle CAN bus. Everything the cluster shows (speed, gear, lamps) arrives as CAN messages through these. Paired with EPCOS **B82793** common-mode chokes. |
| companion MCU | **NXP S12 / HCS12** | Separate safety microcontroller that drives the **legally-mandated warning lamps**. Deliberately independent of Linux, so the tell-tales keep working even if the UI hangs. |
| UGSP3708 | buzzer | The chime/gong speaker for the warning sounds. |

Also on the board: a **20-pin debug header**, a **USB** port, the **FAKRA coax** for the FPD-Link video,
the blue **32-way vehicle connector** (power, ignition, Infotainment CAN), and the display ribbon (FFC)
connectors.

===== Photos — front side =====

**U100 — NXP i.MX6 Dual (the processor)**\\
{{ :ip_cluster:ip_u100_imx6.jpg?700 |U100 NXP i.MX6 Dual MCIMX6D6AVT08AD }}

**U500 — NXP MMPF0100 (power management)**\\
{{ :ip_cluster:ip_u500_pmic_pf0100.jpg?700 |U500 NXP MMPF0100 PMIC }}

**U300 — ISSI DDR3 memory**\\
{{ :ip_cluster:ip_u300_ddr3_issi.jpg?700 |U300 ISSI IS46TR16128C DDR3 }}

**U401 — TI DS90UB940A (FPD-Link III: reverse-camera + head-unit back-channel)**\\
{{ :ip_cluster:ip_u401_fpdlink940.jpg?700 |U401 TI DS90UB940A FPD-Link III deserializer }}

**U900 / U902 — TI DS90CF386 (LVDS display receivers)**\\
{{ :ip_cluster:ip_u900_lvds386.jpg?700 |U900 TI DS90CF386 LVDS receiver }}
{{ :ip_cluster:ip_u902_lvds386.jpg?700 |U902 TI DS90CF386 LVDS receiver }}

**U804 — NXP TJA1044 (CAN transceiver)**\\
{{ :ip_cluster:ip_u804_can_tja1044.jpg?700 |U804 NXP TJA1044 CAN transceiver + B82793 chokes }}

===== The other side of the board =====

The reverse of the PCB carries the **companion microcontroller** and the cluster's audio and
power-supervision support. The board-ID sticker reads **型号 (model) 861921104E** and
**名 (name) S22060123-1** — a hardware-revision **E** (the EU track), matching the ``861921104E``
part number the cluster reports over UDS.

{{ :ip_cluster:ip_back_overview.jpg?900 |Instrument cluster board — reverse side }}

^ Ref ^ Part ^ What it is / does ^
| **U800** | **NXP / Freescale ``S912XHY256VLM``** (MC9S12XHY256) | The **companion 16-bit "safety" microcontroller** — an S12X automotive part made specifically for instrument clusters: on-chip CAN + LIN, stepper-motor control with stall detection, and LCD drive; 256 KB flash, 12 KB RAM, 8 KB EEPROM, 100-pin LQFP. It is the node actually on the **vehicle CAN bus**, and it guarantees the mandatory warning lamps independently of the Linux side. This is the chip that runs the ``mas861.s19`` MCU firmware. |
| **U301** | **ISSI ``IS46TR16128C``** DDR3 SDRAM | The **second** DDR3 device of the i.MX6's memory pair (its twin **U300** is on the front) — mounted on the back under the processor to complete the 32-bit bus. |
| **U700** | **ROHM ``BD4275FP2``** | Automotive **5 V / 0.5 A LDO regulator with a built-in reset / voltage-detector** (TO-263-5F). Supplies and supervises the microcontroller rail — it holds the MCU in reset until the rail is good (reset threshold ~4.6 V). |
| **U803** | **Nuvoton ``ISD2360SYI``** ChipCorder | A **voice record / playback IC** (SPI, up to 64 s of audio, 16-SOIC). This is the cluster's **chime / warning-sound** store-and-play engine — the source for the buzzer. |
| **U903** | **MPS ``MPSM24`` / ``M3387L``** (24-pin QFN) | A Monolithic Power Systems device next to the audio section — most likely the **amplifier** that drives the chime speaker from the ISD2360 //(identification tentative)//. |
| **U801** | **Microchip / Atmel ``AT24`` I²C EEPROM** (``ATMLH119 04CM``) | A small serial EEPROM for configuration / calibration data. |

Also on this side: the input-protection diodes **D701** / **D703**, a switching-supply module
(**TUS700**, top-left) and the bulk of the board's decoupling.

**U800 — NXP/Freescale S912XHY256 (the companion safety MCU)**\\
{{ :ip_cluster:ip_u800_s12xhy.jpg?700 |U800 Freescale S912XHY256VLM — cluster MCU }}

**U700 — ROHM BD4275FP2 (5 V LDO + reset supervisor)**\\
{{ :ip_cluster:ip_u700_bd4275.jpg?700 |U700 ROHM BD4275FP2 regulator }}

**U803 — Nuvoton ISD2360 (chime / warning-sound playback)**\\
{{ :ip_cluster:ip_u803_isd2360.jpg?700 |U803 Nuvoton ISD2360SYI ChipCorder }}

**U903 — MPS audio amplifier (chime speaker)**\\
{{ :ip_cluster:ip_u903_amp.jpg?700 |U903 MPS MPSM24 / M3387L }}

**U301 — ISSI DDR3 (second device)**\\
{{ :ip_cluster:ip_u301_ddr3b.jpg?700 |U301 ISSI IS46TR16128C DDR3 }}

**U801 — Atmel AT24 I²C EEPROM**\\
{{ :ip_cluster:ip_u801_eeprom.jpg?700 |U801 Atmel AT24 EEPROM }}

**Power input (D703 / TUS700 region)**\\
{{ :ip_cluster:ip_back_power_d703.jpg?700 |Reverse-side power-input section }}

//Chip markings read directly from the dies; U800 confirmed against NXP's ``S912XHY256`` product
listing. Date / lot codes: U800 lot ``QNH2202C``, U803 date ``2142`` (2021 wk 42), U301 ``IS46TR16128C-125KBLA1``.//

===== How it all connects =====

  * Vehicle CAN → **TJA1044** (U804) → the **S12 microcontroller** (U800, ``S912XHY256``): the MCU is the only node on the bus. It reads speed, gear, state-of-charge and the lamp requests, drives the mandatory warning lamps itself, and passes the rest to the i.MX6 over a private SPI link. The cluster cannot be driven by the head unit directly.
  * **i.MX6** (U100) → LVDS → **DS90CF386** (U900/U902) → the two dashboard LCD panels (it draws all the gauges and artwork).
  * Head unit → coax (FPD-Link III) → **DS90UB940A** (U401): the **reverse-camera** image, plus the data/firmware back-channel. (The right "media" strip itself is drawn locally by the i.MX6, not fed from here.)
  * **MMPF0100** (U500) powers the i.MX6; **BD4275FP2** (U700) supplies and supervises the **S12 MCU** rail, which independently holds the safety tell-tales.
  * Warning sounds: **ISD2360** (U803) stores and plays the chimes → audio amp (U903) → the **UGSP3708** buzzer on the front.

//Photos and identification from a bench teardown of a spare unit. Chip markings read directly from the
dies. The companion safety MCU — previously known only from the firmware — is now pinpointed as
**U800** on the reverse side (NXP/Freescale ``S912XHY256VLM``).//