Inside a Xiaomi SU7 T-Box: 5G, Automotive Ethernet, Backup Power and Component Sourcing

What a T-Box actually does

A telematics control unit, commonly called a T-Box or TCU, is the vehicle's gateway to cellular networks and cloud services. It supports functions such as remote vehicle access, telemetry upload, over-the-air update transport, positioning and emergency calling. That role explains why a T-Box needs much more than a 5G modem: it also needs local control, in-vehicle networking, storage, timing, audio, backup power and protection.

A teardown attributed to a Xiaomi SU7 T-Box shows this system-level design in a compact board. The visible components include a Quectel AG571Q-CN automotive 5G module, Infineon TRAVEO T2G MCU, automotive Ethernet PHY, CAN FD transceiver, eMMC, backup-battery charger and an eCall-oriented audio path.

This is not an official Xiaomi BOM. Teardown identification applies to the inspected unit and its hardware revision. Vehicle electronics can change by region, model year, supplier lot and engineering revision without changing the consumer-facing vehicle name. Some devices also use abbreviated top markings, and several Qualcomm components do not have full public data sheets. The table below therefore separates confirmed public specifications from teardown-only identification.

The architecture visible on the board

1. Quectel AG571Q-CN: the central 5G module

Quectel describes AG57xQ as an automotive-grade 5G NR Sub-6 GHz module family supporting standalone and non-standalone networks. Within the family, AG571Q is the 5G + DSSS route, while other variants add DSDA or C-V2X. Regional forms include CN, EU, NA and ROW.

That distinction matters. The `-CN` suffix is not decorative; it identifies a regional configuration. Engineers must review supported bands, carrier approval, SIM/eSIM configuration, GNSS, emergency-call requirements and local cybersecurity rules before moving a telematics design to another market.

The AG57xQ platform offers interfaces such as USB, PCIe, RGMII, UART, I²C, SPI, SDIO and digital audio, depending on configuration. It also supports features such as DFOTA, secure boot and QuecOpen. This explains why the module can act as more than a simple modem, but it does not mean every optional feature is enabled in the inspected SU7 unit.

What appears inside the module

Removing the shield in the referenced teardown exposes markings attributed to an SK hynix MCP and Qualcomm devices including SA515M, PMX55AQ, QET5100AQ, SDR867AQ, QPA2920AQ and PM980AQ. Together they are consistent with a modem, memory, power-management and RF-front-end implementation.

Only the broad architecture should be inferred publicly. Qualcomm lists SA515M as an automotive modem product and describes its Snapdragon Auto Connectivity platform at a family level. Full specifications for the other observed orderable markings are not publicly available. Claims about their internal converter topology, RF band coverage or exact function require controlled Qualcomm/Quectel documentation—not guesswork from package location.

The SK hynix `S6AA8803AA10` marking was reported as a 1 GB NAND + 1 GB DRAM MCP in the source teardown. Because an authoritative public data sheet was not located, those densities should be treated as a teardown claim until confirmed through the module BOM or supplier documentation.

2. The Infineon MCU keeps the T-Box connected to the vehicle

The observed `CYT2B97` device belongs to Infineon's TRAVEO T2G CYT2B9 family. The family combines an Arm Cortex-M4F core for primary processing with a Cortex-M0+ core for peripheral and security work. Infineon positions it for automotive body and connected control applications with functional-safety and cybersecurity support.

In a T-Box, an MCU of this class can supervise power states, watchdogs, vehicle bus communication and the higher-level cellular subsystem. It is reasonable to describe that architectural role; it is not reasonable to claim from the chip alone that it independently uploads specific brake or airbag messages. That behaviour depends on Xiaomi's software, network architecture and safety design.

For procurement, the exact suffix is essential. `CYT2B97CACQ0A2` may be a package marking or shortened identification rather than the complete orderable part number. Quote requests should use the manufacturer's full OPN from the approved BOM, together with package, temperature, flash, security and packing options.

3. Automotive Ethernet and CAN FD serve different jobs

The Broadcom device is identified in the teardown as `BCM89887A1AFBG`, an automotive Ethernet PHY. Broadcom's BCM8988x portfolio covers 100BASE-T1 and 1000BASE-T1 single-pair automotive Ethernet, a natural fit for telematics, infotainment and gateway links.

However, the exact BCM89887 public product page and feature table were not available during verification. The original claim that this exact device provides IEEE 1588 time synchronisation should therefore not be presented as a confirmed part-level fact without the restricted product brief.

The TI TCAN1145-Q1 handles the CAN physical layer. TI specifies CAN FD data rates up to 5 Mbps and partial networking through selective wake, allowing inactive nodes to stay in a lower-power state until a qualifying wake-up frame arrives. One subtle detail matters: selective-wake frame detection uses a Classical CAN wake-up frame; engineers should not assume that an arbitrary CAN FD-format frame can trigger selective wake.

Ethernet does not simply replace CAN. Ethernet provides high-bandwidth packet transport, while CAN remains valuable for robust control and status networks. A telematics unit may need both because it bridges cloud connectivity with several in-vehicle domains.

4. Storage and timekeeping preserve software and evidence

Kioxia's `THGBMJG6C1LBAB7` is listed as an 8 GB eMMC 5.1 device with a -40°C to +105°C automotive Grade 2 temperature range. It can hold boot software, firmware, configuration and logs. The exact partition map and use of temporary data are software decisions and cannot be determined from capacity alone.

The NXP PCA2131TF/Q900 is a nano-power automotive real-time clock with an integrated quartz crystal, temperature compensation, battery switchover and four timestamp inputs. NXP specifies a -40°C to +105°C ambient range for the orderable device. In a telematics system, accurate time supports logs, communications and event correlation even when the main system changes power state.

Memory and RTC parts are easy to underestimate during spot sourcing. Replacing eMMC can alter controller firmware, endurance, retention and boot timing; replacing an RTC can change power, accuracy, interface and timestamp behaviour. Neither should be substituted only because the package looks compatible.

5. Backup power and audio point to emergency-call continuity

The BQ25171-Q1 is an automotive 800 mA linear charger for one- or two-cell Li-ion/Li-polymer/LiFePO4 batteries and one to six NiMH cells. TI specifies a 3–18 V operating input and 40 V load-dump tolerance. Together with the backup cell observed on the assembly, it supports the design principle that critical telematics functions should retain energy when normal vehicle power is lost.

The TAS5411-Q1 is an 8 W mono automotive Class-D amplifier designed for eCall, telematics and instrument-cluster applications. It includes I²C load diagnostics and load-dump protection. `6PAIC3104IRHBRQ1` is a valid TI automotive audio-codec ordering code. Their presence is consistent with a local microphone/speaker signal chain, but the precise emergency-call implementation is controlled by the vehicle system.

6. The power tree is designed for several operating states

The observed board includes MPQ2908A and MPQ3431A power devices, TPS709-Q1 and several MOSFETs. This reflects a T-Box requirement to move between active 5G transmission, standby, selective wake and backup operation while surviving an automotive electrical environment.

MPS demonstrates MPQ2908A in a 48 V automotive buck reference design. That does not prove that this SU7 T-Box is connected to a 48 V rail or that the board contains a dormant 48 V feature. Input rail, output voltage, phase arrangement and protection function require a schematic or measured circuit analysis.

TI's TPS709-Q1 is easier to state precisely: it is a 150 mA LDO with a 2.7–30 V input range, 1 µA typical quiescent current and reverse-current protection. Those characteristics suit an always-on low-power rail, although the exact load on the inspected board remains an engineering inference.

The Infineon P-channel marking should also be handled carefully. The reported `IPI80P04P4L-04` is a -40 V automotive OptiMOS-P2 part in an isolated TO-262 style package; the related package variants are end-of-life or legacy products in current Infineon listings. A buyer must match the full prefix and package, not shorten the request to “80P04”.

A sourcing table for the reported components

RFQ and inspection checklist

1. Supply the full approved manufacturer OPN, not only a package top marking or family name. 2. State whether the requirement is for component repair, module production, laboratory analysis or an approved automotive programme. 3. Confirm hardware revision, region, software/firmware baseline and approved manufacturer list before considering any replacement. 4. Require date code, lot, packing, MSL, storage history and traceability. 5. For BGA, eMMC, MCU and modem devices, inspect marking consistency, X-ray, solder-ball condition and moisture handling as appropriate. 6. For RF devices and modules, request applicable carrier/regional approvals and do not treat a CN version as an automatic substitute for EU, NA or ROW. 7. Review PCN/EOL status and service-life requirements; automotive availability must extend beyond the immediate production order. 8. Treat every electrical or firmware substitution as an engineering change, even when the package footprint appears compatible.

Current stock, date code, lot condition and delivery must be confirmed before purchase. A teardown is valuable for architectural understanding, but it is not an approved AVL and should not be used alone to release production material.

What this T-Box reveals

The important lesson is not that one vehicle contains a long list of famous chips. It is that reliable telematics is a system problem. The 5G module needs a local MCU, high-speed Ethernet and CAN links, managed storage, accurate time, backup energy, emergency audio and a carefully sequenced power tree.

For engineers, that means validating the interaction between hardware, firmware, vehicle networks and regional communications. For buyers, it means controlling full orderable codes, qualification, lifecycle and traceability across the complete T-Box BOM—not simply locating a visually similar device.

Primary references

• Quectel AG57xQ automotive module family
• Infineon CYT2B9 product family
• Broadcom automotive Ethernet PHY portfolio
• NXP PCA2131 data sheet
• TI TCAN1145-Q1
• TI BQ25171-Q1
• TI TAS5411-Q1
• TI TPS709-Q1
• Kioxia embedded-memory product guide
• Qualcomm automotive connectivity platform