---
title: EinarBoard v6 — On-Board GNSS + 4G Integration — Design Brief & Execution Prompt
tags: [project-drogheda, hardware, einarboard, v6, gnss, rtk, 4g, lte, rf, design-brief, prompt]
project: Project Drogheda
author: Helgen CTO + Claude (decisions opened 2026-08-24)
date: 2026-08-24
status: Draft v1.0 — planning. §0 decisions locked by Leo 24-Ago; §1 GNSS choice is the one open gate.
authority: supplements [[watchdog-electrical-design-state]] (canonical) and inherits the fix list of
  `2026-08-22_Drogheda_EinarBoard-v5_EMC-Audit_v1.0.md` in full. Where this conflicts with the 3.0
  brief on v6 scope, THIS file wins.
---

# EinarBoard v6 — Design Brief ("the prompt")

> **What this is.** The instruction set for turning `hbox-watchdog-v5` (EinarBoard 3.0 / v5.5,
> 15 pcs in fab since 22-Ago) into **EinarBoard v6** — the first HBOX board with the **GNSS
> receiver and the 4G modem soldered on**, retiring the simpleRTK2B Pro shield (MOD1) and the
> XBee-socket 4G NTRIP Master (J7/J8).
>
> Standing rules unchanged: **file-level KiCad edits only**; git checkpoint after every phase;
> every structural edit verified by an independent parse; bench gates before fab.

---

## 0. Decisions locked 2026-08-24 (Leo)

| Topic | Decision |
|---|---|
| Scope | **Full integration** — GNSS + 4G both on-board; MOD1 and J7/J8 deleted |
| Board outline | **Keep 140.000 × 100.000 mm** (x ∈ [60.19, 200.19], y ∈ [40.32, 140.32]) — no enclosure rework |
| SIM | **MFF2 soldered SIM** (DFN 5×6). No tray, no spring contacts, no opening a sealed IP67 box in Veracruz |
| **GNSS receiver** | 🔒 **LOCKED — ZED-F9P-04B, LCSC `C5120257`** (Leo, 24-Ago). Rationale §1. LG290P stays as the documented v7 cost-down |
| **4G module** | 🔒 **LOCKED — SIMCom A7670SA-LASC, LCSC `C18548276`** (Leo, 24-Ago). LTE Cat-1 + **2G GSM** fallback; 3G answered in §2.3 |
| Inherited | The **entire v5.5 EMC fix list** is day-one scope, not a wish list (§7) |

**Still open — need Leo:** antenna interface (§4.4), modem VBAT source sign-off (§3.2),
homologación path (§9.4), and gate **T1** (§2.4) — which does **not** block the schematic, only
the decision to stay on the A7670SA if the cabinet runs hot.

---

## 1. GNSS receiver — "cheapest" vs "best value" are not the same part

### 1.1 The hard constraint that eliminates the truly cheap tier

Your base is the Ardusimple **AS-PRO-CORS = ZED-F9P = L1/L2**, and Mexican public CORS (INEGI
RGNA) are overwhelmingly **GPS L1/L2 + GLONASS**. RTK requires the rover to track the same
frequencies the base broadcasts.

That **disqualifies the entire cheap L1/L5 tier**: Quectel LC29H (all variants, $22–33),
ZED-F9P-**15B**, NEO-F9P, LG69T. They are L1 + L5, **no L2**. Fed from an L1/L2 base they
degrade to effectively single-frequency — you would be paying for RTK silicon and getting
float. Do not let the $22 LC29H price tempt anyone: it is the right part for a product where
you also own the base, and the wrong part for a fleet you diagnose remotely from Querétaro.

Also permanently out: ATGM332D / ATGM336H / AT6668 ($1.44–4.75, huge LCSC stock) — **single-band
L1, no carrier-phase RTK at all.**

### 1.2 The three that survive

| | **ZED-F9P-04B** | **LG290P03AAMD** | **UM980** |
|---|---|---|---|
| Vendor | u-blox (CH) | Quectel (CN) | Unicore (CN) |
| Bands | L1/L2 | **L1/L2/L5/E6** | all incl. E6/B2b |
| RTK rate / convergence | 7–24 Hz / <12 s | 20 Hz / **5 s** | 50 Hz / <5 s |
| Package | 54-LGA 22×17×2.4 | **12.2×16×2.6** | 54-LGA 22×17×2.6 |
| Supply / current | 2.7–3.6 V, 85 mA trk (130 pk) | 3.15–3.45 V, **91 mA** | 3.0–3.6 V, **145–180 mA / 480 mW** |
| Internal LNA | **No — active antenna mandatory** | ambiguous (see §1.5) | **No** |
| USB | **Yes** | **No** | No |
| qty 1 | **$84.82 LCSC** (C5120257) / $131.74 Mouser | $79.89 | ~$94.88 |
| qty 100 | $116.56 Mouser | **$59.54** | ~$80.65 |
| JLCPCB | C5120257, Extended, 104–129 stk | **not listed** — consign | C9900015354, Extended |

### 1.3 The money, honestly

| Volume | ZED-F9P (LCSC) | LG290P | Saving by switching |
|---|---|---|---|
| 30 units | $2,545 | ~$2,100 | **~$450** |
| 100 units | $8,482 (if stock holds) | $5,954 | ~$2,500 |
| 300 units | ~$34,968 (Mouser $116.56) | $17,862 | **~$17,100** |

Against that saving, switching away from u-blox costs you, **once**:

- **The entire config toolchain.** u-center, UBX-CFG-VALSET, your saved receiver configs, your
  RAM-vs-BBR/Flash lesson from the June RCA — all of it is u-blox-specific. LG290P configures
  with `$PQTM…` sentences.
- **The backend decoder.** htracker already ingests `$PUBX,00` (retranslator +138, delivered
  10-Ago). LG290P does not emit PUBX. That's a protocol change on the server too.
- **A fresh RTCM-compatibility unknown**, in a program whose *actual* June root cause (free
  rtk2go caster, RAM-only config, unverified UART2 path) is still not fully closed.

**Read: at 30 units the saving is $450 — less than a week of firmware and backend work. At
300 units it is $17k — real money.**

### 1.4 🔒 DECIDED 24-Ago — ZED-F9P-04B

> **v6 = ZED-F9P-04B, sourced from LCSC (C5120257) at $84.82.**
> It is $32/unit cheaper than Mouser with *zero* engineering change, it is the receiver your
> base station is paired to, and it keeps u-center as your field-diagnosis tool while you are
> simultaneously taking on an RF front end, a cellular radio, and an NTRIP client you've never
> shipped. **One new unknown at a time.**
>
> **Documented cost-down for the 300-unit phase = LG290P.** Scope it as a bounded respin of the
> GNSS island only (§5 puts the receiver in its own corner precisely so this stays cheap), plus
> the firmware/backend work, and pull the trigger when volume pays for it.

⚠ **Sourcing caveat that applies either way:** LCSC shows ~104–129 pcs of ZED-F9P-04B. A
100-unit run eats the entire bin. Mouser has 573 + 834 arriving, 18-week factory line. **For a
30–100 unit run, buy the receivers yourself and consign them to JLCPCB** — you control the most
expensive, longest-lead line item instead of being hostage to an LCSC bin.

*(If you want the LG290P now anyway, say so and I'll re-baseline §5/§6 — but then Phase 1 in
§10 grows a receiver-bring-up spike and the backend decoder becomes v6 scope.)*

### 1.5 Open verification if LG290P is ever chosen

Its datasheet says "external active antenna"; Mouser's part description says "**w/ LNA
(KT5030)**". These cannot both drive the RF section. **Resolve against the LG290P Hardware
Design doc before laying out one millimetre of RF.**

---

## 2. 4G modem

### 2.1 Bands decide the variant before anything else

Telcel = **B4** (bulk) + B7 + B66. AT&T MX = B2/B4/B5/B7. Altán "Red Compartida" = **B28**
(700 MHz — the best-propagating band in the country). Movistar rides AT&T's RAN.

→ You need **B2/B4/B5/B7/B28/B66**. That is exactly the **`-SA`** (SIMCom), **`-LA`** (Quectel
EG915x) and **`-AU`** (Quectel EC200x) suffixes. **Any `-EU` / `-E` / `-CN` / `-C` part is
useless here** — no B4, no B66. This is the single most common way this decision goes wrong.

### 2.2 🔒 DECIDED 24-Ago — SIMCom A7670SA-LASC

> **SIMCom A7670SA-LASC — LCSC C18548276, $7.58 @1, $7.39 @10, ~$6.3–6.9 @1k, 220 in stock,
> already in the JLCPCB parts library** (Extended, X-ray inspection required, MSL3).

Why it wins on your criteria:

- **Cheapest thing that is actually assemblable at JLCPCB.** The only real alternative in the
  JLC library is Quectel EG915U-LA (C19185632) at ~$9–13.
- **Correct LatAm bands**: LTE-FDD B1/2/3/4/5/7/8/**28**/**66**, plus GSM 900/1800.
- **Single antenna.** Cat-1bis-class: one `RF_ANT` pin, no RX-diversity port. One less 50 Ω
  path, one less antenna, one less thing to get wrong. (This is also why **Cat-4 is the wrong
  choice** — EC200A/SIM7600 add a second antenna port, a 29×32 mm footprint and 2–4× the price
  for throughput you will never use on a 50–200 MB/month NTRIP + NMEA stream.)
- **Public docs, no NDA**, and the A76xx AT set is SIM7600-compatible → **TinyGSM works**, which
  is what makes the §2.5 firmware estimate credible.
- **Feature-variant upgrade path with no respin**: `-LASC` (bare) → `-LASE` (+BLE) → `-FASE`
  (+GNSS +BLE) are the same 88-LGA footprint.

**Not interchangeable, do not confuse:** A7670 = 88-LGA · A7672 = 124 hybrid LCC+LGA ·
SIM7070 = 68-LCC. All 24×24 mm, all different footprints. Migration = respin.

### 2.3 On your 3G question — the honest answer

**3G is not the lever you want, and it is on its way out.** Mexico's 2G/3G shutdown is still
under negotiation rather than executed (operators were still discussing it in July 2026 —
millions of handsets block it), so 3G *exists* today. But designing a 2026 board with a 5–10
year fleet life around a network the regulator and all three carriers are actively trying to
switch off is buying a fallback with an expiry date.

What actually fixes poor coverage, in order of effect:

1. **Band coverage at low frequency.** B28 (700 MHz) and B5 (850 MHz) penetrate buildings and
   container stacks far better than B4/B66 (1700/2100 MHz). The A7670SA has all of them.
2. **Cat-1bis link budget.** A narrower, lower-order category has a better link budget than
   Cat-4 at the cell edge. The cheap choice is also the more robust one here.
3. **A proper external antenna on a bulkhead SMA**, not a chip antenna inside a metal-adjacent
   cabinet. §4.4.
4. **2G/GSM fallback** — which the A7670SA already has (GSM 900/1800). At 20–40 kbps GPRS you
   will not hold RTCM at full rate, but you keep telemetry and remote command alive, which is
   what "never vanish" (invariant #2) actually requires.

**If you still want WCDMA/3G**, the cheap route is **SIM7600SA-H** (Cat-4 + WCDMA + GSM, LatAm
bands) at ~$25–40 — but you pay ~4× the module cost, a second antenna port, a 29×32 mm
footprint, and more heat, for a network that is being switched off. **My recommendation is no.**
Take the A7670SA's 2G fallback and spend the difference on the antenna.

### 2.4 Temperature — the one place I'd push back on "cheapest"

Your own RCA names the 4G modem as a heat casualty in the nested cabinet under Veracruz sun.

| Part | Operating range |
|---|---|
| SIMCom A7670SA | **−30…+80 °C** (−40…+85 degraded) |
| Quectel EG915U-LA | **−35…+75 °C** (−40…+85 extended) |
| Telit LE910C1-LA (~$48) | **−40…+85 °C full** |
| u-blox LARA-R6001 (~$43–55) | **−40…+85 °C full** |

> 🔴 **GATE T1 — cabinet temperature. YOU ALREADY HAVE THIS DATA. DO NOT INSTRUMENT ANYTHING.**
>
> Fielded V3 units already report **P12 = 10 k NTC → PB1 → `tntc` ("Cámara" = cabinet
> interior)** and **P5 = SHT40 → `tair`**, inside `$PHLG` every 30 s, and the htracker
> retranslator has been ingesting `$PHLG` in production since 10-Ago. **Query the existing
> telemetry history for the max `tntc` per unit over the hottest days.**
>
> That query — free, today, no hardware, no truck roll — settles the single largest cost
> decision in v6: an **$8** A7670SA versus a **$48** Telit LE910C1-LA. Across 300 units that
> is a **$12,000** decision sitting in a database you already own.
>
> Decision rule: **max `tntc` < 70 °C → A7670SA.** 70–75 °C → A7670SA **plus** the M2.5
> heatsink clamp (§5) and re-measure on the first article. **> 75 °C → escalate the tier**;
> you already know what a modem failure costs at ICAVE.

### 2.5 What the modem costs you in firmware

**Neither the A7670SA nor any Quectel module has a built-in NTRIP client.** That was the
Ardusimple 4G NTRIP Master's entire value, and you are giving it up. You implement NTRIP v1
yourself: `GET /MOUNTPOINT HTTP/1.0` + `Authorization: Basic …`, then read raw RTCM3 off a
transparent TCP socket and shovel it into the receiver.

Realistic budget: **1–2 weeks**, not 1 day — the AT/socket layer is a day; reconnect/backoff
logic, watchdog integration, TLS-on/TLS-off caster handling, signal-quality telemetry into
`$PHLG`, and field failure modes are the rest.

> ✅ **This risk can be retired for free, right now.** See §10 Phase 1: the **XBee socket on the
> v5.5 boards currently in fab** will host an A7670SA breakout. You can prove the entire
> NTRIP-in-STM32 stack on hardware you already paid for, while the boards are in transit,
> before a single v6 trace exists.

---

## 3. Power architecture — the biggest new electrical work

### 3.1 What the modem demands

| Parameter | A7670SA | Consequence |
|---|---|---|
| VBAT | 3.4–4.2 V (typ 3.8) | **Not the 3V3 rail. Ever.** |
| Peak current | **2.8 A** (GSM TX burst) | |
| Droop limit | **≤300 mV** at the burst | |
| Bulk | **≥300 µF** if the source truly delivers 2.8 A; **≥1000 µF** if not | |
| VBAT trace | **≥3 mm** wide or equivalent pour | |
| VBAT pins | **All three (55/56/57) must be connected** | RF performance depends on it |
| I/O rail | **1.8 V** | **Level shifting to the 3.3 V STM32 is mandatory** |
| VDD_1V8 | output, 50 mA max | level-shift reference only, not a system rail |

### 3.2 🔴 The 10-Ago fleet boot-loop makes this decision for us

**Read the 10/11-Ago incident before designing this rail.** Root cause on record: a flat 12 Ah
pack demanding 2.42 A **plus the LTE attach burst** exceeded the **SD-15B-05's 3 A**, while the
**LTC4040 input limit (3.12 A) is set ABOVE the supply's rating** → rail sagged to the PFI
4.60 V trip → failover to a flat pack → brownout → reboot → loop. The modem stayed "invisible"
because it never finished its 30–60 s LTE attach inside the loop. Standing HW errata: *"input-limit
resistor must come DOWN below PSU rating (or bigger PSU)."*

**v6 adds ~1.6 A of on-board modem to that same 5 V rail.** Naively bucking 3.8 V off MAIN5V
would aim the new radio straight at the failure mode that already took the fleet down.

| | (a) Direct from the 1S pack | (b) Buck from MAIN5V | (c) **Buck from OR(24V_IN, MAIN5V)** ← recommended |
|---|---|---|---|
| Load on the SD-15B 3 A budget, normal op | none | 🔴 **+1.6 A — the 10-Ago failure mode** | **none — runs off 24 V** |
| Alive during blackout | ✔ | ✔ | ✔ (falls back to MAIN5V ← pack ← LTC4040) |
| Bench without a pack | ✘ | ✔ | ✔ |
| Under-voltage risk | 🔴 pack sags below the 3.4 V modem floor | ✔ | ✔ |
| Couples TX bursts onto | 🔴 the LTC4040 BAT node — flagged 🔴 in the EMC audit | the 5 V rail | 24 V (normal) / 5 V (blackout only) |

**Recommendation (c) — one buck, two inputs.** A **4.5–40 V input, 3 A synchronous buck** (e.g.
MP4560 / AP64350 / TPS54331 class — *not* a fourth MP1584, which is already the source of EMC
findings 3 and 4) whose input is an **ideal-diode / PMOS OR of `24V_IN` and `MAIN5V`**, output
3.8 V, feeding the modem through a **P-FET load switch under MCU control (`MODEM_PWR_EN`)**.

Why this is the robust *and* cheap answer, for roughly **$1.50 more** than option (b):
- With the cabinet live, the modem's ~9.5 W comes off **24 V at ~0.45 A** — the SD-15B never
  sees it, and the 10-Ago brownout path is structurally removed rather than merely re-tuned.
- In blackout the same buck accepts MAIN5V and the radio keeps reporting — invariant #2 holds.
- One converter, one inductor, one BOM line. D10 (SMBJ33A) already clamps the 24 V input.
- `MODEM_PWR_EN` gives the watchdog authority to hard power-cycle a wedged radio — invariant #3.

> ⚠ **Still fix the input-limit errata.** Even with the modem off the 5 V rail, the LTC4040's
> input limit must come below the PSU rating (or the PSU must grow). v6 is the board where that
> gets corrected, not deferred again.

> ⚠ **And this makes the v5.5 🔴 EMC findings load-bearing.** In blackout MAIN5V does feed the
> modem, so the LTC4040 boost hits the ~4 A `/SW_BAT` case the EMC audit flagged. **`/SW_BAT`
> ≥2 mm polygon and `/BAT_PLUS` ≥1.5 mm + via farm are v6 hard requirements, not second-run
> nice-to-haves.**

### 3.3 GNSS rail — low-noise, non-negotiable

The F9P and UM980 have **no internal SAW**. This board carries **three MP1584 switchers**.
They will happily lock onto your buck's harmonics.

→ **Dedicated low-noise LDO** off 3V3 for the GNSS island (not a buck, not a shared tap),
placed on the GNSS island itself. Verify the **ZED-F9P VCC ramp rate ≤ 20 µs/V** — that is a
*damage* limit, not a guideline; check it against the LDO's soft-start.

### 3.4 Budget delta (worst case, backup mode)

| Load | Was (v5.5) | v6 |
|---|---|---|
| 4G | via 3V3_MODEM to XBee socket, ~1.5 A pk @3.3 V | **2.0 A pk @3.8 V ≈ 7.6 W → ~1.6 A from MAIN5V** |
| GNSS | via MOD1 shield off 5 V | 85–130 mA @3.3 V (F9P) |
| Everything else | unchanged | unchanged |

Recompute the LTC4040 backup runtime against the 1S4P ~12 Ah pack once (b) is locked.

---

## 4. RF — the part that decides the stackup before anything is placed

### 4.1 Stackup

Current topology is already correct and stays: **F.Cu signal+GND pour · In1 solid GND ·
In2 3V3 plane · B.Cu signal+GND pour.**

New requirement: **order the board as controlled impedance** (JLCPCB 4-layer, JLC04161H-7628;
F.Cu→In1 prepreg ≈ 0.2104 mm). Target **50 Ω CPWG on F.Cu referenced to In1** — roughly
0.35 mm trace / 0.25 mm gap at εr ≈ 4.4, **to be confirmed against JLCPCB's own impedance
calculator before layout**, not after.

Absolute rules for both RF traces:
- Referenced to the **In1 GND plane with no split, ever** — no plane cut, no via field gap, no
  In2 3V3 island underneath.
- As short and straight as possible; ground-stitched along **both** sides at ≤ λ/20.
- No other signal crosses them on any layer.

### 4.2 GNSS RF chain

Active antenna (mandatory for F9P/UM980) → bias tee: **≥68 nH 0603 inductor** (self-resonance
above 1.6 GHz) + DC block on the RF path + 100 nF ∥ 100 pF on the bias node + **ESD diode rated
>2 GHz** at the connector.

Wire **`ANT_DETECT` and `ANT_SHORT_N`** to the MCU (or a spare PCF8574 pin). Free antenna-fault
telemetry — and you have already lost two units (H0005, H0014) to 0-sats antenna faults you
could only diagnose by reading logs.

⚠ **Do not use `VCC_RF` as the antenna bias on UM980** — Unicore explicitly says its protection
is inadequate. Feed the antenna from a separate current-limited rail.

### 4.3 🔴 The #1 technical risk in this whole change: GNSS desense

A 23 dBm LTE transmitter drawing 2–3 A bursts, 3 cm from a GNSS front end, is a classic
RTK-killer — LNA compression and broadband noise will cost you exactly the fix you are paying
for. **The Ardusimple shield has been hiding this problem from you. A bare module hands it to
you.**

Mitigations, in order of effect:

1. **Maximum board separation** — §5 puts GNSS in the bottom-left corner and LTE at the right
   edge: **~149 mm apart, essentially the full board diagonal.** This is the whole reason the
   floorplan is shaped the way it is.
2. **Antenna separation ≥ 20 cm** on the enclosure. **Treat this as a design rule, not an
   optimization.** Two separate bulkheads, as far apart as the cabinet allows.
3. Route the modem's return path away from the GNSS island; no shared reference between the
   two RF regions except the solid In1 plane.
4. **Front-end filtering.** Straightforward for an L1-only receiver; **for a multi-band receiver
   a single 1575 SAW would kill L2/L5**, so rely on an active antenna with good out-of-band
   rejection + separation. Specify the antenna accordingly.
5. **Measure it.** Gate G3 in §10: fix quality with the modem idle vs. transmitting at full
   power. This is a pass/fail bench test, not an opinion.

### 4.4 Antenna interface — OPEN, needs Leo

Recommendation: **2× U.FL on board → pigtails → 2× SMA bulkhead on the enclosure**, placed as
far apart as the cabinet allows. This is what makes mitigation #2 possible; an on-board or
short-pigtail arrangement forfeits it.

Needs from you: does the current enclosure have room for a second bulkhead, and where? That
answer changes where the U.FL connectors sit, which changes the floorplan.

### 4.5 LTE link budget — the module is not the variable

**Every LTE module here transmits at the same power.** 3GPP Power Class 3 is **+23 dBm ±2 dB**,
and it is a conformance requirement, not a feature — the $8 A7670SA and the $48 Telit put out
the same watt. Receive sensitivity is likewise floored by 3GPP; premium parts buy perhaps
**1–3 dB** of margin, not a different class of performance.

What actually sets the link budget on this product, in descending order of effect:

| Factor | Typical swing | Notes |
|---|---|---|
| **Antenna type and placement** | **10–20 dB** | An antenna inside or flush against a metal cabinet on a metal crane is the whole ballgame |
| **Band in use** | 6–10 dB | **B28 (700 MHz)** and B5 (850 MHz) penetrate structure far better than B4/B66 at 1700/2100 MHz. The A7670SA has all of them |
| **Cable / pigtail loss** | 1–3 dB | Keep the LTE pigtail short; every extra 300 mm of thin coax at 1.9 GHz is real |
| **Cat-1bis vs Cat-4** | 1–2 dB in our favour | Lower-order category = better cell-edge behaviour. The cheap choice is also the more robust one |
| **Module vendor** | **1–3 dB** | The only line the extra $40 buys |

> **You already have the field measurement.** The `$GPTXT,NET,H00xx,TELCEL,-87,334 020` line
> the fleet emits carries the modem's **RSSI in dBm** and the operator's MCC/MNC (334/020 =
> Telcel MX). The example on record shows **−87 dBm**, which is a comfortable working level.
> **Query the fleet for the per-unit distribution over the last month, the same way as gate T1.**
> If the worst unit sits near −105 dBm you have an antenna/siting problem to solve — and no
> module in this survey would have solved it. Phase 1 also adds `csq` to `$PHLG` (field 30),
> which makes this permanently visible instead of a one-off query.

**Conclusion: spend on the antenna and its mounting, not on the modem.** A better bulkhead
antenna, a shorter pigtail and a clear mount are worth 10 dB; a more expensive module is worth 2.

### 4.6 🔴 GNSS multipath — the environment problem, and what actually fixes it

A container terminal is close to a worst case: stacked steel boxes, RTG and STS cranes,
reach stackers, all of it moving. **Multipath is a receiver-and-antenna problem. No modem
choice affects it, and no cabling change fixes it.**

**First, make sure it is actually the diagnosis.** As of 10-Ago the fleet showed **zero
corrections applied anywhere** — that produces SPS, full stop, and it looks nothing like
multipath. **Multipath presents as float-instead-of-fixed, or a fix that wanders**, and it can
only be diagnosed *after* RTCM is confirmed arriving. Phase 1's new telemetry separates the
two for the first time:

| `rtcm_msgs` | fix quality | Diagnosis |
|---|---|---|
| 0 / not rising | 1 (SPS) | **link or caster** — not multipath |
| rising | 1 (SPS) | receiver config, or base/rover **band mismatch** |
| rising | 5 (float), never 4 | **multipath / sky obstruction** — this is the real thing |
| rising | 4 but `hAcc` noisy | multipath, partially mitigated |

**Mitigations, cheapest and most effective first:**

1. **A ground plane under the patch antenna.** A metal disc **≥ 100 mm diameter** beneath a
   patch kills ground-bounce and is the single best return per peso in this list. Often free.
2. **Mount height and clear sky.** Highest point of the machine, away from vertical steel.
   On an RTG that is the top of the gantry, not the cabinet lid.
3. **A better antenna.** A multiband antenna with good **axial ratio** and suppressed gain at
   low elevation rejects reflections that arrive from below the horizon. Budget US$60–120 —
   still cheaper than a receiver upgrade and more effective for this failure mode.
4. **Raise the elevation mask** in the receiver (10–15°, `CFG-NAVSPG-INFIL_MINELEV`) to discard
   low-elevation reflected signals, and set the correct **dynamic model** for the machine.
5. **Keep L2.** Dual-frequency is materially better at ambiguity resolution under multipath —
   another reason the L1/L5-only cheap tier was the wrong answer (§1.1).
6. **Log C/N₀ per satellite** at a problem site. A healthy sky and a reflective sky look
   completely different, and it turns an argument into a measurement.

**If — after 1–6 — multipath is still the binding constraint**, then and only then does silicon
help, and the honest options are: **ZED-X20P (+$31/unit**, same 54-LGA 22×17 footprint, so
Block N accepts it with a pin-map check, plus better interference mitigation and 55 mA instead
of 85 mA) or **Septentrio mosaic-X5** (genuinely best-in-class multipath rejection, but 3–5×
the F9P and no LCSC/JLC presence). **Do not buy either on suspicion — buy it on a C/N₀ log.**

---

## 5. Floorplan on 140 × 100 — proposed

Verified from `hbox-watchdog-v5.kicad_pcb` (228 footprints, board x ∈ [60.19, 200.19],
y ∈ [40.32, 140.32]).

**Freed by deletion:**

| Deleted | Ref | Position | Area recovered |
|---|---|---|---|
| simpleRTK2B Pro UNO socket | **MOD1** (32 pads) | (90.6, 129.9) | **bottom-left, ~68 × 53 mm** |
| XBee sockets, 2.0 mm | **J7, J8** (10 pads each) | (174.2, 74.8) / (196.5, 74.8) | **right edge, ~27 × 20 mm** |
| Shield / heatsink bolts | MH7, MH9, MH10, MH11 | various | reclaim as GND stitching (the EMC audit found 8 empty 20 mm stitching cells, **mostly under MOD1**) |

**Proposed placement:**

```
  x=60 ┌────────────────────────────────────────────────────┐ x=200
  y=40 │  [J10 RJ45]  connector row: P5 P10 P2 P11 P6 P8 P12 P4  │
       │                                                    │
       │  [U11 W5500]      [U16 STM32F411]     [U2/L2 fan]  │
  y=70 │  [SW1 SW2 J11]    Y3 Y4  [U10 SC16IS]   ┌──────────┤
       │                          [U14][U15]     │ ★ LTE    │ ← freed XBee area
       │                          [U13 PCF8574]  │  U19 A7670SA
  y=100│                                         │  MFF2 SIM │
       │  ┌──────────────────┐   [U7]  [U6 LTC4040+L6]  │ 3.8V buck
       │  │ ★ GNSS ISLAND    │   [U12]              [P14]│
  y=140│  │ U18 + LDO + bias │  [P15][P16]  [J9]  [P1]   │
       └──┴──[U.FL GNSS]─────┴───────────────────[U.FL LTE]┘
```

- **GNSS island → the freed MOD1 area, bottom-left corner.** It is the furthest point on this
  board from all four switchers (nearest: U7 at 140.0, 112.9 — ~60 mm; L6/U6 LTC4040 at
  ~173, 110 — ~95 mm), and it puts the U.FL at a board edge. The island holds only the
  receiver, its LDO, its decoupling and its bias tee — **nothing else**, so a future LG290P
  swap (§1.4) is a contained respin.
- **LTE island → the freed XBee area at the right edge**, next to the existing power cluster
  where the current already lives. The 27 × 20 mm freed is **too tight for a 24 × 24 module +
  ≥300 µF bulk + buck + MFF2** — reclaim adjacent area by relocating **P14 (RGB_LED_EXT, at
  195.1, 101.4)** and shifting the **U2/L2 fan buck** north. Budget ~35 × 30 mm.
- **Resulting GNSS ↔ LTE separation ≈ 149 mm** — the full diagonal. That is the point.
- Keep **2× M2.5 holes** near the modem for a heatsink clamp (§2.4).

---

## 6. Signal & connectivity delta

### 6.1 The good news: the MCU side barely changes

These nets already exist in `hbox-watchdog-v5.kicad_sch` and simply terminate on solder-down
silicon instead of a socket:

`GNSS_RX` · `GNSS_TX` · `DIN_4G` · `DOUT_4G` · `MODEM_RST` · `MODEM_LED` · `3V3_MODEM`

**No MCU pin reallocation is required for the basic paths.** USART1/2/6 are all on the F411RET6;
RS-485/RS-232 stay on the SC16IS752 over SPI.

### 6.2 New signals needed

| Signal | Where it goes | Note |
|---|---|---|
| `MODEM_PWRKEY` | spare **PCF8574 (U13)** pin | ⚠ **timing is vendor-specific**: SIMCom = low ≥50 ms to power on, ≥2.5 s to power off. Quectel = low ≥2 s on, ≥3 s off. **Never copy timing between vendors.** |
| `MODEM_STATUS` | spare PCF8574 pin | asserts ≈11.2 s after power-on (A7670); UART ready ≈8 s |
| `MODEM_PWR_EN` | GPIO → P-FET load switch | the hard power-cycle path (§3.2) |
| `GNSS_RESET_N` | GPIO | F9P needs a 7–13 kΩ pull-up |
| `GNSS_ANT_DETECT`, `GNSS_ANT_SHORT_N` | PCF8574 | free antenna-fault telemetry (§4.2) |
| `GNSS_TIMEPULSE` | GPIO / timer input | optional but nearly free |
| **RTCM path** | **modem UART → GNSS UART2, direct in hardware** | this is what the Ardusimple shield did internally; replicate it. MCU does the NTRIP handshake, then the RTCM3 stream flows without touching the MCU — exactly the Modo B architecture already engineered |

> **Action:** confirm free PCF8574 pins against the v5 netlist before Phase 2. `F0_SEL`,
> `F1_SEL`, `F2_SEL`, `EXT_LED`, `MODEM_LED`, `CHRG_STAT`, `CHRG_FAULT` are already on it.

### 6.3 Level shifting — mandatory, do not skip

Modem UART is **1.8 V**; the STM32 is 3.3 V. Use **TXS0108E** (what Quectel recommends) or the
discrete MMBT3904 network SIMCom documents. This is not a "3.3 V is close enough" situation.

### 6.4 MFF2 SIM

- DFN 5×6, on the LTE island, close to the modem.
- **ESD array at the SIM lines** (ESDA6V1W5 / SMF15C class).
- A7670SA has an internal 4.7 kΩ pull-up on USIM1_DATA; **USIM2_DATA would need an external
  one** — you only need SIM1.
- 1.8 V and 3.0 V auto-detect, no strapping needed.
- ⚠ **Sourcing:** you need an actual MFF2 SIM from Telcel/AT&T MX or an M2M MVNO with a Mexican
  profile. **Flat-rate IoT SIMs sized for sensors (500 MB / 10 years) are an order of magnitude
  too small** for 50–200 MB/month. Start this conversation early — it has a lead time and it is
  not an engineering task.

### 6.5 USB

**J9 (USB-C) is kept** and becomes the modem's USB — recovery path if a firmware update bricks
it, plus PPP/RNDIS debugging. **Reserve VBUS/D+/D−/GND and a `USB_BOOT` test point**; USB_BOOT
must not be pulled low at power-up. Add the ESD array that v5.5 does not have (**<2 pF** on the
data lines). 90 Ω differential.

---

## 7. Inherited EMC fix list — v6 hard scope

Straight from `2026-08-22_…EMC-Audit_v1.0.md`. **None of these is optional in v6:**

| # | Fix | v6 status |
|---|---|---|
| 🔴 1 | `/SW_BAT` → **≥2 mm polygon** (was 0.3 mm × 15 mm carrying ~4 A) | **Now load-bearing** — the modem adds ~1.6 A to MAIN5V in backup (§3.2) |
| 🔴 2 | `/BAT_PLUS` final approach → **≥1.5 mm + via farm** | same reason |
| 🟠 3 | Fan buck FB: **R20/R21 at pin 4**, `/FB_FAN` short and away from `/SW_FAN` | mandatory |
| 🟠 4 | **1 µF + 10 µF within 3 mm** of every buck VIN-GND (was 5–8.5 mm) | mandatory — and applies to the new 3.8 V buck |
| 🟠 5 | **ESD at every external connector, <10 mm** (D14/D15/D16 were 41 mm from J11) | mandatory + J9 now gets ESD it never had |
| 🟡 6 | Crystals **3225 package, <5 mm** from their ICs (Y1/Y3/Y4 are 12–15 mm away in HC-49) | do it |
| 🟡 7 | ETH RX pair **coupled and length-matched** (Δ7.5 mm today) | do it |
| 🟡 8 | Fill the 8 empty 20 mm stitching cells | free — they were mostly under MOD1, which is being deleted |

---

## 8. BOM & cost delta

**Removed per unit:** Ardusimple **4G NTRIP Master** (€112 @≥50 ≈ **$121**) + Ardusimple
**simpleRTK2B Pro** shield *(price to verify)* + MOD1 headers + J7/J8 XBee sockets.

**Added per unit (indicative):**

| Item | Cost |
|---|---|
| ZED-F9P-04B (LCSC C5120257) | $84.82 |
| A7670SA-LASC (LCSC C18548276) | $7.58 |
| MFF2 SIM | carrier-dependent |
| 3.8 V/3 A buck + inductor + ≥300 µF bulk | ~$2.50 |
| Low-noise LDO + GNSS decoupling | ~$0.80 |
| TXS0108E level shifter | ~$0.50 |
| 2× U.FL + 2 pigtails + 2 SMA bulkheads | ~$6 |
| RF passives, bias tee, ESD arrays | ~$2 |
| Controlled-impedance fab option | per-order, small |
| **Subtotal added** | **~$104 + SIM** |

**The headline: the 4G side alone saves ~$113/unit** ($121 Ardusimple → $7.58 module). Add the
simpleRTK2B Pro's margin over a bare F9P on top. At 30 units that is meaningful; at 300 it is
the difference between a viable and a non-viable unit price.

⚠ JLCPCB notes: both modules are **Extended** ($3 one-time setup each), both flagged **X-ray
inspection required**, both **Standard PCBA tier only** — no Economic assembly. A7670SA is
**MSL3** (168 h floor life ≤30 °C/60 %RH) — matters for JLC and for your own rework.

---

## 9. Risk register

| # | Risk | Severity | Mitigation |
|---|---|---|---|
| R1 | **GNSS desense from LTE TX** — you buy RTK silicon and get float | 🔴 | §4.3: 149 mm board separation, ≥20 cm antenna separation, measured at gate G3 |
| R2 | **Modem thermal** — cheap tier is −30…+80 °C, cabinet may exceed it | 🔴 | **Gate T1 (§2.4): soak a fielded unit now.** Escalate to Telit/u-blox if >75 °C |
| R3 | **NTRIP client in STM32** — new firmware on the critical path | 🟠 | **Phase 1: prove it on v5.5's XBee socket while the boards are in fab** |
| R4 | **Homologación** — the host now contains a radio (§9.4) | 🟠 | Start the lab conversation in Phase 0; it is calendar time, not engineering time |
| R5 | **Pack sag below the 3.4 V modem floor** | 🟠 | Resolved by §3.2 option (b); if (a) is ever chosen, add UV inhibit |
| R6 | **v5.5 EMC findings carried forward** | 🟠 | §7 — day-one scope |
| R7 | **F9P LCSC stock (~104–129 pcs)** | 🟡 | Consign from Mouser for anything ≥100 units |
| R8 | **First RF design in this program** | 🟡 | Controlled impedance ordered, In1 unbroken, external review of the RF section before fab |

### 9.4 Homologación — start this early

The regulator changed: **IFT was dissolved 17 Oct 2025 and replaced by the Comisión Reguladora
de Telecomunicaciones (CRT)** from 21 Oct 2025. Existing IFT certificates remain valid and
labels still carry the IFT number; procedures continue under the same technical norms.

The certificate is issued to **your product** (applicant + brand + model + year), not to the
module. Modular relief exists in practice — the host is labelled *"Este producto contiene el
módulo aprobado modelo XXXX, IFT No. …"* — but there is **no blanket exemption**. Applicable:
**IFT-008** (cellular) and **NOM-208 / NOM-221**. Testing in an accredited Mexican lab or a US
MRA-recognized lab, ~3–5 weeks.

Two consequences that bite:
1. **Freeze on one module before you file.** Switching modules later = new or amended certificate.
2. Sources **disagree** on whether the certificate holder must be the importer. **Get this pinned
   down by the lab, in writing, in Phase 0.**

None of the cheap LatAm modules advertises an IFT/CRT certificate. **Do not assume one exists
because the datasheet says "Latin America."** A7670SA does carry FCC + Anatel, which shortens
the RF test scope without eliminating the filing.

Treat it as one fixed cost amortized over hundreds of units — which is an argument *for* the
cheap module, not against it.

---

## 10. Phases & gates

| Phase | Work | Gate |
|---|---|---|
| **−1** — 🔴 **before any of this** | **Fix the base / caster.** 10-Ago fleet truth: *zero corrections applied anywhere* → check `HelgenTestStation` @ rtk2go:2101. **No silicon in this brief produces RTK if the correction source is broken.** v6 would ship five units of new hardware into the same SPS-not-RTK result | **G0: at least one fielded unit holding GGA quality 4/5 for 1 h on the existing hardware** |
| **0** — now, parallel | **Run the T1 telemetry query (§2.4) — it is free and it decides the modem tier** · lock §1.4 GNSS · lock §3.2 rail · answer §4.4 antenna · **call a homologación lab** · order A7670SA breakout + M2M SIM (~$40 total) | Decisions in this doc, v1.1 |
| **1** — while v5.5 is in fab | **NTRIP-in-STM32 spike on a v5.5 board via the XBee socket** + A7670SA breakout: AT driver, TCP, NTRIP v1 GET, RTCM3 → GNSS UART2, reconnect/backoff, `$PHLG` signal telemetry | **G1: 24 h continuous RTK fix through the on-board modem path, ≥1 reconnect survived** |
| **2** — schematic | New blocks (GNSS island, LTE island, 3.8 V rail, MFF2, level shift, RF chains) + **all of §7** | **G2: ERC 0** + external review of the RF and power sections |
| **3** — stackup & floorplan | Confirm 50 Ω geometry against JLCPCB's calculator · place per §5 · verify GNSS↔LTE separation · confirm the enclosure takes a second bulkhead | **G3 (design): RF traces referenced to unbroken In1, no exceptions** |
| **4** — route | RF first, then power (wide from day one), then signal · zones · DRC | DRC 0 · independent netlist parse |
| **5** — DFM | BOM/CPL, LCSC pass, consignment plan, controlled-impedance order option | fab release |
| **6** — first article | Bring-up, DFU, **then G3 measured**: fix quality with modem idle vs. TX at full power | **G3 (bench): no measurable degradation in fix quality or C/N₀ under LTE TX** |

**Phase 1 is the whole trick.** It converts the largest unknown in v6 — firmware you have never
shipped talking to a radio you have never soldered — into a bench result you obtain on hardware
already paid for, weeks before committing a layout.

---

## 11. What I'd argue for, in one paragraph

Take the **A7670SA** — it is the cheapest part that is simultaneously band-correct, JLC-assemblable,
2G-capable and well-documented, and the money you save there is real ($113/unit against the
Ardusimple). But **keep the ZED-F9P for v6**. The $450 you would save at 30 units by switching
to an LG290P does not pay for a new configuration protocol, a new backend decoder, and a fresh
RTCM-compatibility unknown — in the same cycle where you are already taking on your first RF
front end, your first cellular radio and your first NTRIP client. Do the receiver cost-down as
a contained v7 respin of one corner of the board, once volume makes it worth $17k. **One new
unknown at a time** is the rule that gets this board to work on the first article.

---

## 12. Cross-references

- v5.5 EMC fix list: `2026-08-22_Drogheda_EinarBoard-v5_EMC-Audit_v1.0.md`
- Prior modem survey (bench-era): `2026-07-08_Drogheda_4G-Modem-Alternatives_v1.0.md`
- 3.0 brief & method rules: `2026-08-12_Drogheda_EinarBoard-3.0_MCU-Integration_Design-Brief_v1.0.md`
- Canonical electrical state: `watchdog-electrical-design-state.md`
- Invariants touched: **#1** power-off safe · **#2** never vanish (§2.3, §3.2) · **#3**
  corrections ride the 4G, recover by power-cycling (§3.2 `MODEM_PWR_EN`)