Need help finding UART (TX/RX)

[BasimNasser]

Hi everyone,

I am trying to reverse engineer a Panasonic car head unit (OEM, not an Android unit, likely running Linux or QNX) to find the UART (TX/RX) lines and access the boot log/console.

The main processor is a Panasonic BGA chip, which makes tracing directly from the pins impossible. I'm hoping to get some expert eyes on the PCB to help narrow down the test points or vias.

Here is what I have identified so far:
* Board Part Number: PANEL. MAIN 84-38520Z01
* System Logic Level: 3.3V (Confirmed by measuring the large tab on the LDO voltage regulator).
* Main Processor: Panasonic (BGA).
* Flash Memory: Spansion S25FL512SA1F01 (64MB SPI Flash).
* Audio IC: Toshiba TCB001FNG.

What I have tried:
I flipped the board and looked at the backside of the BGA CPU. There are several vias on the outer edges of the CPU footprint. I probed the ones that output 3.3V and monitored them during the first 5 seconds of boot-up to catch the TX voltage fluctuation (dropping to ~2.8V and bouncing back), but I haven't had any luck catching the exact TX line yet.

I have attached high-res pictures of the board:
1. Overall board view.
2. The backside of the Panasonic CPU (showing the vias).

Has anyone worked with this specific board or similar Panasonic OEM designs? Based on the via layouts in the pictures, where would you usually expect the UART test points to be?

Any hints or suggestions for probing would be greatly appreciated! Thanks in advance.

[moffy]

Above the Micro and to the right there are 6 pads, unpopulated, that looks suspiciously like a test header that has been removed. Directly above the Micro there are 8 pads that appear connected to the 6 pads, maybe for jumpers?

[Doctorandus_P]

... maybe for jumpers?

No. That looks like a footprint for one of those multi resistor SMD's.



Is four enough for JTAG?

For the rest, I have no idea why there should even be an (exposed / working) uart on this PCB.

[Renate]

Usually UART connections are very conspicuous with a 3 or 4 pin JST XH header layout and often even labeled.
I don't see anything.

[Jeroen3]

There aren't even any test pads on this board... What are the chances it's in one of the headers?

[Berni]

Not everything has a UART.

Unless there is a clear unpopulated low pin count connector in an odd place then there is likely no debug UART.

Not everything needs one, while other times they might reuse another type of bus to do the same job. For example in a automotive setting they might do it trough secret CAN commands.

[Jeroen3]

Looking at it again, there is one flat flex connector that is odd.
Almost all traces go to the chip directly.

It most certainly interferes with the screw, so it must be for debugging use. It probably isn't for production testing, it's not easy enough to use.

[BasimNasser]

Yes I noticed that, is there any known debugging connectors which looks like this?
Thank you

[Jeroen3]

I have never seen one. But "standards" for these things are shallow.

It looks like it has 15 pins, which is plenty for the standard 14-pin jtag-swd, which leaves two pins reserved... for uart for example.

[BasimNasser]

Update, I found a hole in the bottom of the outer shell , it exposes 2 pads,
I tested them, one outputs 3.3v and the other 0v , I think they are connected directly to CPU, I tried USB TTL on them but got nothing (steady 3.3v) , images attached, what do you think it’s purpose? Interesting that it is exposed out of the shell

[Renate]

They could be test points to get this device in PBL mode or just a normal reset.
Without a ground I doubt that it's a UART.
The location and layout indicate more something designed to be shorted briefly.
OTOH, such test points are normally at core voltage (~1.8V).