Project Overview
This project focused on a SIMTEK NAV panel installed in a Boeing 737 simulator. The unit exposed 28V inputs and an RS232 connection, but the firmware and control protocol were not documented. The goal was to restore the panel to service and make it usable from X-Plane without relying on any vendor-side tooling.
The starting point was a dusty, inactive unit in storage.
Reverse Engineering
The panel was opened up and the MCU was extracted for analysis. Once on a breadboard, the chip documentation was identified and the bootloader path was mapped through UART. This made it possible to access the device directly and dump the memory contents.
The bootloader prompt confirmed the Dallas Semiconductor loader path:
With the firmware dumped, the image was loaded into Ghidra and analyzed as a standard 8051 target. That made it possible to inspect the control flow, identify the output frames, and correlate panel actions with the data sent over the serial link.
Decoding the Protocol
Once the firmware was understood, the next step was to determine how the panel expected to be driven. The decoded frames revealed the relationships between button presses, active frequency values, and display updates. An initial test confirmed basic functionality even before the backlighting and decimal formatting were fully restored.
From there, a Python wrapper was written to translate X-Plane state into the command frames expected by the panel. The wrapper also handled the return path so hardware inputs from the NAV panel could be reflected back into the simulator state.
Result
The final result was a working NAV panel that could be driven from X-Plane while preserving the original hardware behavior. The panel now displays the intended frequencies and responds to the simulator in real time through the custom Python interface.
This project is a good example of using firmware extraction, 8051 analysis, and protocol reconstruction to bring an undocumented cockpit component back into active service.