Chat

How can I help you?

Explain this part

Write a part description

Describe each pin

Files

Pins

Symbol

Layout

3D View

Head Unit Pinout and Reverse-Engineering Guide

Scope and confidence

The photographs show two unrelated head-unit designs:

A black aftermarket Android board, PCB 002701-000-B92-03, dated 2022-12-17.
A green OEM multi-board head unit containing Panasonic control silicon and a wireless module labeled MediaTek MT7902.

A silkscreen label identifies the intended signal, but it does not prove voltage, direction, connector pin number, or whether firmware enables it. The tables therefore use:

Confirmed — conventional label plus visible routing/function makes the meaning strong.
Probable — strong engineering interpretation, but must be measured.
Unknown — label is incomplete, blurred, or merely an assembly/reference mark.

Never connect a logic adapter until the pin's idle voltage has been measured. Never use an RS-232 serial cable directly; it uses destructive positive/negative voltages. Begin with a high-impedance meter or oscilloscope and then a 1.8/3.3 V USB-TTL adapter through a 1–4.7 kOhm series resistor.

Black aftermarket Android board

Vehicle harness solder pads

The large two-column pad field is the vehicle power, control, and amplified-speaker interface. Orientation below follows the readable silkscreen, not an inferred connector pin number.

Table

Label	Meaning	Direction	Expected electrical behavior	How to interface	Confidence
`B+`	Permanent battery supply	Input	Nominal automotive 12 V; about 12–14.4 V normally, with real vehicles producing transients	Bench-power through a fuse and current-limited 12 V supply	Confirmed
`ACC`	Ignition/accessory sense	Input	Usually expects switched battery voltage	Apply fused +12 V after B+ is present to request wake/boot	Confirmed
`GND`	Battery/chassis return	Power	0 V reference	Connect supply negative here before any signal connection	Confirmed
`ILL`	Illumination/headlamp sense	Input	Usually 12 V when parking/head lights are on	Apply fused 12 V to test day/night dimming; do not feed logic voltage	Confirmed
`ANT_P`	Powered antenna or external-amplifier remote	Output	Usually switched battery voltage while radio/unit is active; low-current only	Drive a relay or amplifier REM input, not a motor/load directly	Probable
`AD1` / blurred `AD`	Analog key/steering-wheel-control input 1	Input	ADC reads resistor-ladder voltages	Use dry switches and a resistor ladder to GND; characterize pull-up voltage first	Probable
`AD2`	Analog key/steering-wheel-control input 2	Input	Second resistor-ladder ADC channel	Same as AD1; never inject 12 V without measurement	Probable
`IN`	Ambiguous vehicle sense input	Input	Often reverse, brake, or another option sense; board label alone is insufficient	Observe voltage and software reaction; use a fused resistor-limited 12 V test only after tracing input protection	Unknown
`FL+`, `FL-`	Front-left speaker bridge output	Output	High-power BTL audio; neither terminal is ground	Connect only across one floating 4–8 ohm speaker or differential dummy load	Confirmed
`FR+`, `FR-`	Front-right speaker bridge output	Output	High-power BTL audio	Same rule: never ground either side	Confirmed
`RL+`, `RL-`	Rear-left speaker bridge output	Output	High-power BTL audio	Connect as a pair to one speaker	Confirmed
`RR+`, `RR-`	Rear-right speaker bridge output	Output	High-power BTL audio	Connect as a pair to one speaker	Confirmed
`+14.4V`	Raw/conditioned automotive rail test node	Power/test	Near battery/alternator voltage	Measurement point only unless the trace and current capacity are established	Confirmed label, use restricted
`VCC`	Internal supply rail	Power/test	Voltage not determined from photographs	Measurement point only; do not use as an accessory output	Unknown voltage
`VRF18`	Likely 1.8 V RF/reference rail	Power/test	Name suggests 1.8 V, but must be measured	Scope/meter only; do not back-power	Probable
`2V?`	Blurred internal rail label	Power/test	Unknown	Measurement only	Unknown

Debug, factory-test, and control labels

Table

Label visible in photos	Likely function	Practical use	Confidence / warning
`GND`, `PRINT_TX`, `PRINT_RX`	Factory UART console	Capture boot logs, kernel messages, MCU diagnostics; RX may accept console input if firmware permits	High confidence. Determine idle level first. Connect board TX to adapter RX and common GND; initially leave adapter TX disconnected
`TCK`, `TMS`, `TDI`, possible `TDO`	JTAG boundary-scan/debug signals	CPU/MCU halt, memory inspection, programming, or production test if not disabled	Probable. Labels are characteristic of JTAG, but target device and voltage remain unknown
`MCLK`	Master clock, likely audio or processor clock	Identify codec/audio timing; synchronize a logic analyzer	Probable. Output/test point, not a control input
`CK1`, `CK2`, `D0`/blurred digital labels	Clock/data test points, possibly I2S audio or memory/factory test	Passive protocol capture	Unknown bus until frequency and routing are measured
`WATCHDOG`	Watchdog/reset supervision node	Observe reset pulses and boot-loop causes	Probable. Do not force it until active polarity and source impedance are known
`SRCLKEN` or similar blurred label	Clock-enable/control test node	Diagnose sleep/wake or clock gating	Low confidence; passive observation only
`RST`	Reset	Force or observe reset after voltage/polarity confirmation	Probable; usually active-low but do not assume
`EN`	Regulator/module enable	Observe power sequencing or request module wake	Probable; unsafe to drive before tracing
`SCL`, `SDA`	I2C clock/data	Sniff commands to display, touch, tuner, audio processor, or peripheral MCU	High confidence label. Determine whether bus is 1.8 or 3.3 V; use a high-impedance analyzer and no extra pull-ups initially
`3V3`	3.3 V logic rail/test point	Reference voltage for a level shifter or logic analyzer	Probable. Measure first; avoid powering external loads from it
`MIC+`, `MIC-`	Differential microphone input	Attach the intended electret/active microphone through the proper harness	High confidence. Bias may be present; not line-level audio
`TS1+`, `TS1-`	Likely touch-sense or differential test pair	Possibly legacy resistive-touch axis, temperature sensor, or production test	Low confidence
`LED-P`	Likely LCD backlight LED positive	Diagnose/backlight interface	Probable, potentially tens of volts—treat as hazardous to logic equipment
`KEY1`, `KEY2` or blurred `K?1/K?2`	Key/steering-control inputs	Read button resistor ladders	Probable
`MRS1`, `MRS2` or similar	Blurred test labels	Unknown	Do not drive
`P01`, `P06`, `P12`	Connector/reference identifiers, not necessarily signal names	Locate harness/assembly positions	Not pin functions

Flat-flex connectors

The long FFC connectors likely carry high-speed display/video, touchscreen, camera, USB, or daughterboard buses. They are not safely reusable from photographs alone. Differential pairs visible in parallel routing may be LVDS, MIPI DSI/CSI, eDP, USB, or a proprietary parallel display bus. Required work is continuity mapping from every FFC contact to IC pins and power rails, followed by powered waveform measurements.

Green OEM multi-board unit

What the printed markings mean

Most visible labels on this board are reference designators or manufacturing marks, not external pin names:

Table

Marking	Meaning
`CNxxxx`	Connector reference designator
`ICxxxx`	Integrated-circuit reference designator
`Rxxxx`, `Cxxxx`, `Lxxxx`, `Dxxxx`	Resistor, capacitor, inductor, and diode identifiers
`1/4`, `2/4`, `3/4`, `4/4`	PCB panel/assembly or board-section indexing
`LF`, `KD`, `SYS`	Internal assembly/function codes; not enough information to infer a pinout
Triangles/arrows and boxed dot arrays	Pin-1, inspection, test, or production-programming landmarks

Identifiable functional blocks

Table

Device/block	What it does	Interface opportunity	Confidence
MediaTek `MT7902` module label	1x1 Wi-Fi 6E plus Bluetooth/BLE combo radio. The publicly documented card uses an NGFF M.2 2230 PCIe host interface.	In theory reusable with the correct host interface, power sequencing, antennas, firmware, and regulatory constraints; the pictured implementation may be a custom module/variant and must be traced	Confirmed family; exact board integration unverified
Panasonic `MN103...` device	Automotive 32-bit control MCU family	Likely controls startup, vehicle network, audio, buttons, and safety supervision; family supports serial peripherals and on-chip programming/debug mechanisms	Confirmed family, exact suffix/pin map not readable enough
Panasonic large BGA/SoC	Main infotainment/application processor or custom multimedia controller	Potential boot console, storage, display, audio, USB and update interfaces	Probable; exact part marking needed
Large paired memory packages	DRAM and/or nonvolatile storage	Firmware/data storage and working memory	Probable; do not probe high-speed buses directly with long wires
Inductors and large electrolytic capacitors	Automotive input filtering and switching power supplies	Useful rail test points for sequencing and fault diagnosis	Confirmed function class
RF cans/outlined RF regions and coaxial-style pads	AM/FM/GNSS/Wi-Fi/Bluetooth radio sections	Passive RF identification with correct 50/75 ohm equipment	Probable
Wide FFCs	Display/video and board-to-board data	Capture only after identifying voltage and differential standard	Probable

Public Panasonic MN103 family material describes an on-board debugger and serial flash-programming support. The JTAG/DWire32A statement is specifically documented for the MN103S subset, not every MN103-family device. This does not establish which exposed pads on this exact head unit implement them. Exact mapping requires the complete MCU suffix and continuity tracing.

Candidate test footprints

The long unpopulated dual-row footprints and small boxed arrays are typical production fixtures for boundary scan, flash programming, board test, or inter-board options. They may include:

Ground and one or more internal rails
Reset and boot-mode straps
UART transmit/receive
JTAG or proprietary debug clock/data
CAN/LIN or internal serial-bus access
Manufacturing GPIO and analog-test nodes

A connector-shaped footprint is not proof that all features are available. Debug may be fused off, authenticated, password-protected, or only accessible during a short boot window.

Safest practical interface sequence

1. Establish identity before probing

Record the complete external head-unit model, vehicle/year, rear-panel connector labels, FCC/IC IDs, every sticker, and sharp perpendicular photos of both PCB sides. IC markings must be readable character-for-character.

2. Bench power safely

For the black board:

Use a regulated 12 V bench supply with adjustable current limit.
Put a 2–5 A fuse in the B+ lead for initial testing.
Start with current limit around 0.5 A and increase only if startup behavior shows it is required.
Connect GND, then B+; apply ACC through a separate fused lead.
Do not attach speakers until idle behavior and amplifier temperature are normal.

For the OEM green unit, do not guess power connector pins. Obtain the vehicle wiring diagram or trace protection components from the external connector first. Automotive units may require CAN messages in addition to B+ and ACC to fully wake.

3. Find ground and rails while unpowered

Use continuity/diode mode to locate ground planes and map every candidate pad. Do not use continuity mode on a powered board. Measure resistance to ground on suspected supply pads and record it.

4. Capture UART safely

Power the board normally.
Scope candidate TX pads relative to GND.
Determine idle voltage: commonly 1.8 V or 3.3 V.
Connect only adapter RX through 1–4.7 kOhm; do not connect the adapter's VCC pin.
Try common baud rates from captured edge timing, starting with 115200 8-N-1.
Only connect adapter TX after logs confirm the interface and a level shifter is used when needed.

5. Sniff I2C/SPI/audio without loading it

Use a logic analyzer rated for the measured logic level. For I2C, connect GND, SCL, and SDA only; avoid adding pull-ups. For suspected I2S, search for a continuous bit clock, frame/word clock, master clock, and serial data. Decode passively before attempting injection.

6. Identify JTAG/debug

Do not guess by applying signals. Map pads to the exact MCU/SoC, identify VREF and GND, then locate reset, clock, mode, and data pins. Use a level-aware probe. Production security can permanently lock or erase devices if programming commands are issued incorrectly.

Capabilities that may be exposed

These are realistic investigation targets, not promised “secret modes”:

Boot-log console — software version, bootloader, kernel, peripheral failures, and filesystem mount messages.
Service/diagnostic menu — touchscreen calibration, radio/audio tests, camera alignment, GNSS status, vehicle-signal status, and firmware version.
Firmware update/recovery — USB, SD, service-tool, or network update paths. Images may be signed and vehicle-specific.
Steering-wheel input emulation — resistor networks on AD1/AD2 can trigger volume, track, voice, or mode commands after values are characterized.
Reverse-camera and illumination automation — likely through vehicle sense inputs or CAN messages.
CAN/LIN monitoring — vehicle status such as ignition, lighting, steering buttons, reverse, parking sensors, climate, or amplifier control. An isolated automotive transceiver is required; never attach MCU logic directly to CAN wires.
Audio-bus capture or injection — possible around codec/DSP I2S/TDM lines, but clock format, sample rate, voltage, and bus ownership must be established.
Display/touch reuse — possible only after identifying the exact panel, connector pinout, backlight voltage, and protocol.
Wi-Fi/Bluetooth reuse — the MT7902 family supports modern Wi-Fi/Bluetooth, but host drivers, firmware, PCIe/USB wiring, antenna compliance, and module variant matter.
Memory/firmware analysis — storage can sometimes be read through a bootloader, service update, or chip-off process. Encryption, secure boot, and legal ownership constraints may apply.

Important limits

There is no reliable universal “secret feature” implied by a test pad.
Service menus are model- and firmware-specific.
A UART console may be output-only or disabled after production.
JTAG can be fused off or require proprietary Panasonic/DENSO tooling.
Signed firmware and secure boot may prevent modified images.
Defeating theft protection, vehicle safety interlocks, or access controls is not a safe reverse-engineering goal.
Speaker outputs are bridged and can damage grounded oscilloscopes. Use a differential probe or isolated measurement method.
LCD backlight rails may exceed logic-level voltages substantially.

Measurements needed to turn this into an exact pinout

Create a table for each exposed pad with:

Board and photograph reference
Physical pad number and orientation datum
Unpowered resistance to GND
Powered idle voltage in OFF, ACC, boot, and running states
Oscilloscope frequency/activity
Continuity destination/component
Direction and protocol
Confidence and test result

The current photographs support a strong functional map, but exact connector pin numbering and exact debug-pad assignments remain unverified until these measurements and full part markings are available.

Scope and confidence
Black aftermarket Android board
Vehicle harness solder pads
Debug, factory-test, and control labels
Flat-flex connectors
Green OEM multi-board unit
What the printed markings mean
Identifiable functional blocks
Candidate test footprints
Safest practical interface sequence
1. Establish identity before probing
2. Bench power safely
3. Find ground and rails while unpowered
4. Capture UART safely
5. Sniff I2C/SPI/audio without loading it
6. Identify JTAG/debug
Capabilities that may be exposed
Important limits
Measurements needed to turn this into an exact pinout