---
title: EinarBoard v6 — Phase 2 — Schematic Delta (v5 → v6) — Build Spec
tags: [project-drogheda, hardware, einarboard, v6, schematic, kicad, gnss, 4g, rf, delta]
project: Project Drogheda
author: Helgen CTO + Claude
date: 2026-08-24
status: Active — THE schematic spec for v6. Every net/pin below is verified against the
  as-drawn `hbox-watchdog-v5.kicad_pcb` netlist (extracted 2026-08-24), not assumed.
authority: implements Phase 2 of `2026-08-24_…EinarBoard-v6_GNSS-4G-Integration_Design-Brief_v1.0.md`.
  Supplements `watchdog-electrical-design-state.md` (canonical) and
  `watchdog-production-schematic-delta.md` (the v3 precedent for this document's format).
---

# EinarBoard v6 — Schematic Delta

> **Base:** `kicad/hbox-watchdog-v5` (EinarBoard 3.0 / v5.5, 15 pcs in fab since 22-Ago,
> git checkpoint `c3e8e48`). **Target:** `kicad/hbox-watchdog-v6`.
>
> **Method rules, unchanged and non-negotiable:** file-level KiCad edits only (the MCP backend
> clobbered disk state on 24-Jul — read-only MCP queries are fine); git checkpoint after every
> block; every structural edit verified by an independent parse; `%.10g` coordinates; footprint
> rotation = R(−θ); zone refills in the GUI only.
>
> ⚠ **Before starting:** clear the stale `.git/*.lock` files and confirm the v5.5 fix commit
> actually landed. This has bitten two sessions running.

---

## 0. ⚠ Two corrections to the v6 brief, from the extracted netlist

The brief was written before the netlist was pulled. Both of these were wrong:

1. **"Spare PCF8574 pins" — there is only ONE.** `U13` (PCF8574T, SOIC-16 **WIDE**) has
   P0–P3 on `/BATLED1–4`, P4–P6 on `/RGB_R/G/B`. **Only `P7` (pin 12) and `~INT` (pin 13)
   are free.** All new control signals therefore go on **MCU pins**, of which there are
   plenty (§3).
2. **`/MODEM_RST` is not MCU-controlled today.** It connects only `J7.5` and `SW4G1.1`
   (a pushbutton). The firmware has **never** been able to reset the modem in software — its
   only tool is killing `SW_5V` via `PWR_CTRL`. **v6 fixes this** (Block T).

A third finding worth recording: **`/3V3_MODEM` is made by `U7` (MP1584) → `L7` → `3V3_MODEM`**,
input `/SW_5V`. `U7`'s job changes completely in v6 (§Block P).

---

## 1. Verified v5 baseline (extracted 2026-08-24)

### 1.1 STM32F411RET6 (`U16`) — as drawn

| Pin | Port | Net | Pin | Port | Net |
|---|---|---|---|---|---|
| 2 | PC13 | `/LED_C13` | 41 | PA8 | `/CHRG_EN` |
| 8 | PC0 | `/ETH_INT` | 42 | PA9 | `/USART1_TX` |
| 14 | PA0 | `/BAT_SENSE` | 43 | PA10 | `/USART1_RX` |
| 15 | PA1 | `/PWR_CTRL` | 44/45 | PA11/12 | `/DFU_DM` `/DFU_DP` |
| 16 | PA2 | `/GNSS_TX` | 46/49 | PA13/14 | `/SWDIO` `/SWCLK` |
| 17 | PA3 | `/GNSS_RX` | 50 | PA15 | `/ETH_RST` |
| 20 | PA4 | `/5V_SENSE` | 55 | PB3 | `/CHRG_STAT` |
| 21 | PA5 | `/IGN_SENSE` | 56 | PB4 | `/CHRG_FAULT` |
| 22 | PA6 | `/FAN_PWM` | 57 | PB5 | `/BYP_CTRL` |
| 26 | PB0 | `/EXT_LED` | 58/59 | PB6/PB7 | `/I2C_SCL` `/I2C_SDA` |
| 27 | PB1 | `/NTC_TEMP` | 61 | PB8 | `/SER_IRQ` |
| 28 | PB2 | `/BOOT1_STRAP` | 33–36 | PB12–15 | `/ETH_CS/SCK/MISO/MOSI` |

**Free (unconnected in v5): PC1, PC2, PC3, PC4, PC5, PC6, PC7, PC8, PC9, PC10, PC11, PC12,
PD2, PA7, PB9, PB10** — 16 pins. **USART6 = PC6/PC7 is free**, which is what makes v6 possible
without disturbing anything.

### 1.2 The three nets that carry the whole GNSS/4G architecture

| Net | v5 members | Meaning |
|---|---|---|
| `/USART1_RX` | `U16.43` (PA10) · `Rdfu1.1` (22k) · **`K1.1` (NC)** · **`MOD1.23`** (F9P TX2) | receiver's UART2 uplink; MCU taps it passively |
| `/DIN_4G` | **`K1.5/6` (COM)** · `J7.3` | modem's data-**in**; fed from the relay |
| `/DOUT_4G` | `J7.2` · **`MOD1.17`** (F9P RX2) | **RTCM downlink, hardwired, never switched** |

`K1` (G5V-1 DC5): `1`=NC=`/USART1_RX` · `5/6`=COM=`/DIN_4G` · `10`=NO=`/USART1_TX` (PA9) ·
`2`=`/SYS5V` · `9`=`/KCOIL` ← `BYP_CTRL` (PB5) via `R40`→`Q6`.

### 1.3 Power tree (verified)

```
P1.1 ─/24V_IN─┬─ D10 (SMBJ33A)
              └─ Q10 (IRFR5305, rev-pol) ──/24V── U2.7 (MP1584 fan buck) ──/SW_FAN─► 5V_FAN
P2.1 ─/VEH5V── RS1 (8 mΩ) ──/VIN_SW── U6.7 (LTC4040 VIN)
U6 (LTC4040) ──/MAIN5V── Q7 (AO4406A cutoff, gate /IGATE) ──/SYS5V── F1 (PPTC 3A)
                                                             ├─ U12 (MP1584) ─► /3V3_ETH
                                                             └─ K1.2 (relay coil supply)
/SW_IN ── Q1 (AO3401A, gate /GATE_LS ← PWR_CTRL) ──/SW_5V──┬─ MOD1.5   (shield 5 V)
                                                            └─ U7.2/7 (MP1584) ─L7─► /3V3_MODEM
U17 (AMS1117-3.3) ──/3V3
```

---

## 2. Deletions

| Ref | What | Action |
|---|---|---|
| `MOD1` | simpleRTK2B Pro, Arduino UNO R3 socket, 32 pads @ (90.6, 129.9) | **DELETE** — nets `/GNSS_RX` `/GNSS_TX` `/DOUT_4G` `/USART1_RX` `/SW_5V` re-terminate on `U18` |
| `J7`, `J8` | XBee 2.0 mm sockets, 10 pads each @ (174.2 / 196.5, 74.8) | **DELETE** — nets re-terminate on `U19` |
| `SW4G1` | modem RESET pushbutton | **DELETE** — replaced by MCU control (Block T) |
| `Rmled1`, `MODEM_LED_A` | modem LED + resistor | **KEEP**, re-source from the A7670SA `NETLIGHT` pin |
| `MH7`, `MH9`, `MH10`, `MH11` | shield / heatsink M2.5 bolt holes | **DELETE MH7/MH9/MH10**; **KEEP MH11** and add one partner near `U19` for the modem heatsink clamp |
| `U7`, `L7`, `C41`, `C43` | the 3V3 modem buck | **REPURPOSE** — see Block P |

**Do not delete `K1`.** It is rewired (Block T), not removed — it is the fail-safe that keeps
corrections flowing with a dead MCU.

---

## 3. MCU pin allocation — v6 additions

| New net | Pin | Dir | Function |
|---|---|---|---|
| `/USART6_TX` | **PC6** | OUT | MCU → modem (AT, GGA uplink, `$PHLG`) — **via `K1` NO** |
| `/USART6_RX` | **PC7** | IN | modem → MCU (AT responses, RTCM tap) |
| `/MODEM_PWRKEY` | **PC8** | OUT | open-drain via `Q20` (2N7002) |
| `/MODEM_STATUS` | **PC9** | IN | level-shifted 1.8 → 3.3 V |
| `/MODEM_PWR_EN` | **PC10** | OUT | enables `U20` buck — the `HARD_CYCLE` path |
| `/MODEM_RST` | **PC11** | OUT | open-drain via `Q21` (2N7002) — **new MCU control** |
| `/GNSS_RESET_N` | **PC12** | OUT | open-drain; `U18` needs a 7–13 kΩ pull-up |
| `/GNSS_ANT_DETECT` | **PC1** | IN | antenna-open telemetry |
| `/GNSS_ANT_SHORT_N` | **PC2** | IN | antenna-short telemetry |
| `/GNSS_TIMEPULSE` | **PA7** | IN | TIM3_CH2 input capture |

**Unchanged:** `/GNSS_TX` PA2 · `/GNSS_RX` PA3 (USART2, `HardwareSerial GNSS(PA3, PA2)`) ·
`/USART1_RX` PA10 (receiver UART2 tap) · `/BYP_CTRL` PB5 (K1 coil).
**Freed:** **PA9** — `K1.10` moves to PC6. Leave PA9 as a test point.
**Still spare after v6:** PC3, PC4, PC5, PB9, PB10, PD2, PA9 — **7 pins.**

> ⚠ **Verify no double-allocation** with an independent netlist parse before ERC. That check
> is the reason this table exists.

---

## Block N — GNSS island (`U18`)

**Part:** `ZED-F9P-04B`, 54-pin LGA 22.0 × 17.0 × 2.4 mm — **LCSC `C5120257`, Extended.**
*(Alternative under evaluation for v7: LG290P, 12.2 × 16 mm — see brief §1.4. **Do not**
attempt a dual footprint; the pad rings overlap and the pin functions do not align.)*

| Signal | Connect to | Note |
|---|---|---|
| `VCC` | `/3V3_GNSS` | **from `U21` LDO only** — never the shared `/3V3` |
| `V_BCKP` | `/3V3` via 1 kΩ + Schottky | 45 µA hot-start; keeps ephemeris across a power-cycle |
| `GND` | GND | full pad-under-module via field |
| `UART1 TX/RX` | `/GNSS_RX` / `/GNSS_TX` | ⚠ net names are **MCU-relative** in this design: `/GNSS_TX` = MCU PA2 out → receiver RX |
| `UART2 RX` | `/DOUT_4G` | **RTCM in — hardware path, unswitched** |
| `UART2 TX` | `/USART1_RX` | uplink NMEA → `K1.1` (NC) and PA10 |
| `RESET_N` | `/GNSS_RESET_N` | **7–13 kΩ pull-up to `/3V3_GNSS` required** |
| `TIMEPULSE` | `/GNSS_TIMEPULSE` | 4 mA drive |
| `ANT_DETECT` / `ANT_SHORT_N` | `/GNSS_ANT_DETECT` / `/GNSS_ANT_SHORT_N` | free antenna-fault telemetry — you have already lost H0005 and H0014 to antenna faults |
| `VCC_RF` | Block S bias tee | 50 mA typ / **300 mA abs max** |
| `D_SEL` | leave open (UART mode) | open/high = UART; low = SPI |
| `SAFEBOOT_N` | leave open | |
| `USB` (`V_USB`, D+/D−) | **test pads only**, not a connector | u-center access at first article; 90 Ω pair, ESD if ever fitted |

**Decoupling:** 100 nF per supply pin **≤ 2 mm**, 10 µF + 1 µF bulk ≤ 10 mm, per the
Capacitor-Placement-Map rules.

### `U21` — GNSS LDO

**3.3 V, ≥ 300 mA, low noise.** Candidates: `TPS7A2033PDBVR` (low-noise, preferred) or
`AP2112K-3.3TRG1` (cheap, LCSC `C51118`).

**Input = `/SW_5V`, output = `/3V3_GNSS`** — deliberately *not* the shared `/3V3`. Two reasons:
the receiver stays on the MCU-gated stack rail, so `PWR_CTRL` (PA1 → `Q1`) still power-cycles
it exactly as it does today; and an LDO fed from 5 V has ~1.7 V of headroom, which is what
gives it the PSRR to reject the three MP1584 switchers this board carries. The ZED-F9P has
**no internal SAW** — it will lock onto buck harmonics given the chance.

> 🔴 **`ZED-F9P` VCC ramp rate ≤ 20 µs/V is a DAMAGE limit, not a guideline** — 0 → 3.3 V in
> **≤ 66 µs**. Most LDOs with soft-start are far slower. **Measure the chosen LDO's rise time
> on the bench before fab.** If it cannot meet it, add a fast load switch or a supervisor.
> This is a fab gate, not a nice-to-have.

---

## Block O — LTE island (`U19`)

**Part:** `A7670SA-LASC`, 88-pin LGA 24 × 24 × 2.5 mm — **LCSC `C18548276`**, in the JLCPCB
library, Extended, **X-ray inspection required, MSL 3**.
⚠ **`-SA` only.** `-E`/`-C` variants have no B4/B66 and will never attach on Telcel.
⚠ A7670 (88-LGA) ≠ A7672 (124 LCC+LGA) ≠ SIM7070 (68-LCC). Not interchangeable.

| Signal | Connect to | Note |
|---|---|---|
| `VBAT` **pins 55, 56, 57** | `/VBAT_MODEM` | **all three, mandatory** for RF performance. Trace/pour **≥ 3 mm** |
| `GND` | GND | full via field |
| `UART_TXD` | `/DOUT_4G` (level-shifted, Block R) | → `U18` UART2 RX **and** → `/USART6_RX` |
| `UART_RXD` | `/DIN_4G` (level-shifted) | ← `K1` COM |
| `PWRKEY` | `/MODEM_PWRKEY_M` | via `Q20` open-drain. **Low ≥ 50 ms = on; ≥ 2.5 s = off.** Internal 50 kΩ to VBAT. **≤ 100 nF total capacitance** or you get spurious auto-power-on |
| `RESET` | `/MODEM_RST_M` | via `Q21` open-drain, low 2–2.5 s. Same ≤ 100 nF rule |
| `STATUS` | `/MODEM_STATUS_M` | 1.8 V out; asserts ≈ 11.2 s after power-on |
| `NETLIGHT` | `Rmled1` → `/MODEM_LED_A` | reuse the existing LED |
| `VDD_1V8` | `/1V8_MODEM` + 2.2 µF | **50 mA max — level-shift reference ONLY, never a system rail** |
| `USIM1_*` | Block Q | internal 4.7 kΩ pull-up on `USIM1_DATA` — no external needed |
| `USB` D+/D−, VBUS | `J9` (kept) | 90 Ω pair. **Reserve a `USB_BOOT` test pad** — the only recovery if a firmware update bricks it. `USB_BOOT` must **not** be pulled low at power-up |
| `RF_ANT` (pin 60) | Block S | **single antenna** — Cat-1bis, no diversity port |

**Decoupling at the VBAT pins:** 33 pF ∥ 10 pF ∥ 100 nF ∥ 1 µF ceramics, plus the Block P bulk.

---

## Block P — modem 3.8 V rail (`U20`) — replaces `U7`'s modem duty

> **Why this block exists, in one sentence:** the 10-Ago fleet boot-loop was caused by
> exceeding the SD-15B's 3 A, and putting a 2 A LTE modem back on that same rail would
> recreate it.

```
/24V ──────────► D20 (SS34) ──┐
                              ├──/VIN_MODEM──► U20 (buck, 3.8 V) ──L20──► /VBAT_MODEM ──► U19
/MAIN5V ──► D21 (PMEG3050) ───┘                    ▲
                                                   │ EN
                                          /MODEM_PWR_EN (PC10)
```

| Item | Spec |
|---|---|
| `U20` | **4.5–40 V in, ≥ 3 A, synchronous buck.** Candidate: `AP64350` class. ⚠ **40 V rating required** — `D10` (SMBJ33A) clamps at ~53 V, a 28 V part such as TPS54331 is **not** acceptable. **NOT a fourth MP1584** — the existing three are the source of EMC findings 3 and 4 |
| Output | **3.8 V** (mid-window of the A7670SA's 3.4–4.2 V) |
| `D20` | SS34 — already in the BOM (`D2`, `D12`). Drop irrelevant on the 24 V leg |
| `D21` | **low-Vf Schottky** (PMEG3050 class, Vf ≈ 0.35 V @ 2 A). In blackout `MAIN5V` ≈ 5 V → `VIN_MODEM` ≈ 4.65 V → duty ≈ 0.82. **Verify `U20`'s max duty covers it**; if marginal, use a P-FET ideal diode (`AO3401A`, already in the BOM as `Q1`) |
| Bulk | **≥ 470 µF low-ESR** within 20 mm of the VBAT pins (spec floor is 300 µF; the extra is cheap insurance against the 2.8 A GSM burst) |
| `Cin` | **1 µF + 10 µF within 3 mm** of `U20`'s VIN-GND — EMC finding 4, mandatory |
| Feedback | divider **at the FB pin**, `/FB_MODEM` short and routed away from `/SW_MODEM` — EMC finding 3, mandatory |
| Enable | `/MODEM_PWR_EN` (PC10). **Power-cycle = EN low ≥ 2 s.** Add a 1 kΩ bleed across the bulk so it actually collapses |

**Behaviour:** cabinet live → modem's ~9.5 W comes from **24 V at ~0.45 A** and the SD-15B
never sees it. Blackout → same buck accepts `MAIN5V` (pack via LTC4040), unit keeps reporting
(**invariant #2**).

### `U7` / `L7` / `C41` / `C43` — disposition

`/3V3_MODEM` no longer feeds a modem. **Repurpose `U7` as the 3.3 V supply for the level
shifters and the LTE-island logic**, renaming the net `/3V3_LTE`, **or** delete `U7`/`L7`/
`C41`/`C43` entirely and take that logic from `/3V3`. **Decide before routing the 3V3 tree** —
this is the same open decision that was left dangling on `U12`/`L8` in the 3.0 brief, and it
should not be left dangling twice. Recommendation: **delete**, feed from `/3V3`; the shifters
draw milliamps.

### 🔴 Also fix in this block

**The LTC4040 input-limit errata.** `RS1` (8 mΩ) sets a 3.12 A input limit **above** the
SD-15B-05's 3 A rating. Bring the limit **below** the PSU rating, or specify a larger PSU.
This has been a standing errata since 10-Ago. **v6 is where it gets fixed.**

---

## Block Q — MFF2 SIM (`U22`)

| Item | Spec |
|---|---|
| Package | **MFF2 / DFN-8 5 × 6 mm (SON-8)** |
| Signals | `USIM1_VDD` · `USIM1_CLK` · `USIM1_DATA` · `USIM1_RST` · GND |
| Pull-ups | none — `U19` has an internal 4.7 kΩ on `USIM1_DATA` |
| Voltage | 1.8 V / 3.0 V auto-detect, no strapping |
| ESD | array at the SIM lines (`ESDA6V1W5` / `SMF15C` class) |
| Placement | **≤ 20 mm from `U19`**, short matched-ish traces, GND guard |

⚠ **Sourcing is a lead-time item, not an engineering task.** You need a real Telcel/AT&T MX or
Mexican-profile MVNO MFF2. Flat-rate sensor IoT SIMs (500 MB / 10 years) are **an order of
magnitude too small** for 50–200 MB/month. Start this in Phase 0.

---

## Block R — level translation (`U23`, `U24`)

**A7670SA I/O is 1.8 V. The STM32's V_IH ≈ 2.31 V — 1.8 V will not read as HIGH.**

| Line | Direction | Method |
|---|---|---|
| `/DIN_4G` (MCU/K1 → modem RX) | 3.3 → 1.8 | `SN74LVC2T45DCUR`, DIR fixed |
| `/DOUT_4G` (modem TX → MCU + receiver) | 1.8 → 3.3 | `SN74LVC2T45DCUR`, DIR fixed |
| `/MODEM_STATUS` | 1.8 → 3.3 | same device, 2nd channel |
| `/MODEM_PWRKEY`, `/MODEM_RST` | 3.3 → open-drain | `Q20`, `Q21` = 2N7002. **Not** through a shifter — MCU absent must leave them unasserted |

- `VccA` = `/1V8_MODEM` (from `U19`'s `VDD_1V8`, 2.2 µF); `VccB` = `/3V3`.
- **Prefer direction-fixed `74LVC2T45` over auto-direction `TXS0108E`** — auto-direction parts
  misbehave against strong drivers and multi-load nets, and `/DOUT_4G` drives **two** loads.
- ⚠ **The RTCM path passes through `U24`.** Add DNP 0 Ω bypass footprints across it so a
  suspect shifter can be jumpered out at bring-up.
- `/DOUT_4G` fan-out on the 3.3 V side: `U18` UART2 RX **and** `/USART6_RX` (PC7) through a
  **100 Ω series** resistor for isolation.

---

## Block S — RF front ends

### Stackup (unchanged topology, new requirement)

`F.Cu` signal + GND pour · `In1` **solid GND** · `In2` 3V3 plane · `B.Cu` signal + GND pour. ✔

**New: order as controlled impedance.** JLCPCB 4-layer `JLC04161H-7628`, F.Cu→In1 prepreg
≈ 0.2104 mm. Target **50 Ω CPWG on F.Cu referenced to In1** — roughly 0.35 mm trace / 0.25 mm
gap at εr ≈ 4.4. **Confirm with JLCPCB's own impedance calculator before layout, not after.**

**Rules for both RF traces, no exceptions:** referenced to an unbroken `In1` (no plane split,
no `In2` island underneath), as short and straight as possible, ground-stitched both sides at
≤ λ/20, nothing crossing on any layer.

### S1 — GNSS (`J12`)

```
J12 (U.FL) ─╥─ C_DC (100 nF) ─── U18.RF_IN
            ║
            └─ L_BIAS (≥68 nH 0603, SRF > 1.6 GHz) ─┬─ 100 nF ∥ 100 pF ─ GND
                                                     └─ VCC_RF (U18)
   D_ESD (>2 GHz rated, <0.5 pF) at J12
```

Active antenna is **mandatory** — the ZED-F9P has **no internal LNA**.

### S2 — LTE (`J13`)

```
U19.RF_ANT ─── π-match pads (series 0402 + 2× shunt 0402, series = 0 Ω default)
           ─── J13 (U.FL) ─── D_ESD (low-cap <0.5 pF)
```

### S3 — 🔴 GNSS desense — the #1 technical risk

A 23 dBm transmitter drawing 2–3 A bursts next to a GNSS front end is a classic RTK-killer.
**The Ardusimple shield has been hiding this. A bare module hands it to you.**

1. **Board separation:** `U18` in the freed `MOD1` area (bottom-left), `U19` in the freed
   XBee area (right edge) → **≈ 149 mm apart, the full diagonal.** The GNSS corner is also the
   furthest point from all four switchers (nearest, `U7` at 140.0/112.9, ~60 mm).
2. **Antenna separation ≥ 20 cm** on the enclosure — two bulkheads. **Design rule, not an
   optimization.**
3. Modem return path routed away from the GNSS island; no shared reference but `In1`.
4. **No 1575 SAW** — it would kill L2 on a dual-band receiver. Specify an active antenna with
   good out-of-band rejection instead.
5. **Measured at gate G3** (Phase 6): fix quality and C/N₀ with the modem idle vs. transmitting
   at full power. Pass/fail, not opinion.

### S4 — ESD everywhere (EMC finding 5)

**Every external connector gets a clamp within 10 mm.** `D14/D15/D16` move from the MCU to
within 10 mm of `J11`. `J9` gets the ESD array it never had (**< 2 pF** on the data lines).
`J12`, `J13`, `P1`, `P4`, `P15`, `P16` all get appropriate clamps.

---

## Block T — `K1` rewiring (one net change, big consequence)

| `K1` pin | v5 | **v6** |
|---|---|---|
| 1 (NC) | `/USART1_RX` | **unchanged** — receiver UART2 TX |
| 5/6 (COM) | `/DIN_4G` | **unchanged** — modem RX |
| 10 (NO) | `/USART1_TX` (PA9) | **`/USART6_TX` (PC6)** ← the only change |
| 2 | `/SYS5V` | unchanged |
| 9 | `/KCOIL` ← `BYP_CTRL` (PB5) | unchanged |

**What this buys.** Energised (normal operation) the MCU owns the modem's RX line: it can send
AT commands, forward the receiver's GGA byte-exact, and inject `$PHLG`. **De-energised — MCU
dead or absent — the relay relaxes and the receiver's own GGA goes straight to the modem, so
corrections keep flowing.** Invariants #2 and #3 both hold, with hardware, for the price of one
moved net.

**Consequence to state plainly: v6 makes Modo B the normal operating mode.** Consistent with
the EPCT decision already on record.

---

## 4. New net list

| Net | Members |
|---|---|
| `/3V3_GNSS` | `U21.out` · `U18.VCC` · decoupling |
| `/VBAT_MODEM` | `L20.2` · `U19.55/56/57` · bulk + ceramics |
| `/VIN_MODEM` | `D20.k` · `D21.k` · `U20.VIN` · Cin |
| `/1V8_MODEM` | `U19.VDD_1V8` · `U23.VccA` · `U24.VccA` · 2.2 µF |
| `/USART6_TX` | `U16.37` (PC6) · `K1.10` |
| `/USART6_RX` | `U16.38` (PC7) · 100 Ω → `/DOUT_4G` (3.3 V side) |
| `/MODEM_PWRKEY` / `_M` | `U16.39` (PC8) → `Q20` → `U19.PWRKEY` |
| `/MODEM_STATUS` / `_M` | `U19.STATUS` → `U24` → `U16.40` (PC9) |
| `/MODEM_PWR_EN` | `U16.51` (PC10) · `U20.EN` |
| `/MODEM_RST` / `_M` | `U16.52` (PC11) → `Q21` → `U19.RESET` |
| `/GNSS_RESET_N` | `U16.53` (PC12) · `U18.RESET_N` · 10 kΩ pull-up |
| `/GNSS_ANT_DETECT` | `U16.9` (PC1) · `U18.ANT_DETECT` |
| `/GNSS_ANT_SHORT_N` | `U16.10` (PC2) · `U18.ANT_SHORT_N` |
| `/GNSS_TIMEPULSE` | `U16.23` (PA7) · `U18.TIMEPULSE` |
| `/SIM_VDD` `/SIM_CLK` `/SIM_DATA` `/SIM_RST` | `U19` ↔ `U22` |
| `/RF_GNSS` `/RF_LTE` | 50 Ω, own netclass, **no autorouting** |

**Changed:** `/DOUT_4G` gains `U18`.UART2_RX, `U24` and the PC7 tap; loses `J7.2`, `MOD1.17`.
`/DIN_4G` gains `U23`/`U19`; loses `J7.3`. `/USART1_RX` loses `MOD1.23`, gains `U18`.UART2_TX.
`/USART1_TX` loses `K1.10` → PA9 becomes a test point.

**Netclasses:** keep `HV24`; add **`RF`** (50 Ω, no auto-route) and **`PWR_MODEM`**
(`/VBAT_MODEM`, `/VIN_MODEM` — min width 1.5 mm, target ≥ 3 mm).

---

## 5. Inherited EMC fixes — schematic-level, day-one

| # | Fix | Where it lands in the schematic |
|---|---|---|
| 🔴 1 | `/SW_BAT` ≥ 2 mm polygon | netclass + layout; **load-bearing** — blackout now feeds the modem too |
| 🔴 2 | `/BAT_PLUS` ≥ 1.5 mm + via farm | same |
| 🟠 3 | `R20`/`R21` at `U2` pin 4, `/FB_FAN` short | schematic grouping so layout can honour it |
| 🟠 4 | 1 µF + 10 µF ≤ 3 mm of every buck VIN — **including `U20`** | add the parts now |
| 🟠 5 | ESD < 10 mm of every external connector | Block S4 |
| 🟡 6 | Crystals → **3225** package, < 5 mm (`Y1`, `Y3`, `Y4` are HC-49 at 12–15 mm) | change footprints in the schematic pass |
| 🟡 7 | ETH RX pair coupled and length-matched | layout, flagged here |
| 🟡 8 | Fill the 8 empty 20 mm stitching cells | free — most were under `MOD1` |

---

## 6. Part additions

| Ref | Part | LCSC | Note |
|---|---|---|---|
| `U18` | ZED-F9P-04B | **C5120257** | Extended, X-ray, ~104–129 in stock — **consign from Mouser for ≥ 100 units** |
| `U19` | A7670SA-LASC | **C18548276** | Extended, X-ray, MSL 3, 220 in stock |
| `U20` | 40 V / 3 A sync buck (AP64350 class) | verify | **40 V minimum** |
| `U21` | TPS7A2033 or AP2112K-3.3 | C51118 (AP2112K) | ⚠ verify the ≤ 66 µs ramp |
| `U22` | MFF2 SIM | carrier | lead-time item |
| `U23`, `U24` | SN74LVC2T45DCUR | verify | direction-fixed |
| `Q20`, `Q21` | 2N7002 | verify | open-drain PWRKEY / RESET |
| `D20` | SS34 | in BOM (`D2`) | 24 V leg |
| `D21` | PMEG3050 class | verify | low-Vf, 5 V leg |
| `J12`, `J13` | U.FL / IPEX MHF1 SMT receptacle | verify | + 2 pigtails, 2 SMA bulkheads |
| `L20` | buck inductor per `U20`'s datasheet | verify | ≥ 4 A saturation |
| — | 2× 220 µF low-ESR + ceramics | verify | Block P bulk |
| — | ESD arrays, RF ESD, bias-tee L/C, π-match 0402s | verify | Blocks S1–S4 |

> **All "verify" rows must be confirmed against the live JLCPCB library at upload**, not from
> a cached DB. The `v4-bom.xls` labels are on record as unreliable; check pin-counts vs
> pad-counts every time.

---

## 7. Execution order & verification

| Step | Work | Check |
|---|---|---|
| T0 | Clear stale `.git/*.lock`; confirm the v5.5 fix commit landed; branch `v6` from `c3e8e48`; copy v5 → `hbox-watchdog-v6` | parse-verify the copy opens clean |
| T1 | Deletions (§2) | netlist parse: `MOD1`/`J7`/`J8`/`SW4G1` gone, no orphan nets |
| T2 | Block T (`K1.10` → PC6) | 1-net diff, nothing else moved |
| T3 | Block N + `U21` | ERC on the GNSS island alone |
| T4 | Block O + Block Q + Block R | ERC; **confirm every 1.8 V line crosses a shifter** |
| T5 | Block P + LTC4040 input-limit fix | recompute the backup power budget vs the 1S4P ~12 Ah pack |
| T6 | Block S (RF + ESD) + netclasses | `RF` netclass exists and is excluded from autorouting |
| T7 | EMC list §5 | each row ticked individually |
| T8 | Full ERC + independent pin-map parse | **ERC 0**; no double-allocated MCU pin |

**Gate G2:** ERC 0 **plus** an external review of the RF and power sections. This is Helgen's
first RF design — do not let ERC-clean stand in for reviewed.

---

## 8. What is deliberately NOT in v6

- **A second GNSS footprint.** LG290P's pads overlap the F9P ring and the functions don't align.
  The cost-down is a v7 respin of one corner — which is exactly why Block N is an island.
- **A modem mezzanine daughtercard.** Rejected with "full integration" (brief §0); revisit only
  if gate T1's cabinet temperature forces the industrial tier.
- **eUICC.** MFF2 only, per the 24-Ago decision.
- **Cat-4 / WCDMA.** See brief §2.3.

---

## 9. Cross-references

- v6 brief: `2026-08-24_Drogheda_EinarBoard-v6_GNSS-4G-Integration_Design-Brief_v1.0.md`
- Phase 1 firmware: `2026-08-24_Drogheda_EinarBoard-v6_Phase-1_NTRIP-Firmware-Spec_v1.0.md`
- EMC fix list: `2026-08-22_Drogheda_EinarBoard-v5_EMC-Audit_v1.0.md`
- Canonical electrical state: `watchdog-electrical-design-state.md`
- Format precedent: `watchdog-production-schematic-delta.md`
- Cap placement rules: `2026-08-14_Drogheda_EinarBoard-3.0_Capacitor-Placement-Map_v1.0.md`
- Invariants: **#1** power-off safe (`Q20`/`Q21` open-drain, buck EN default off) · **#2**
  never vanish (Block P dual input, Block T fail-safe) · **#3** power-cycle recovery
  (`MODEM_PWR_EN`) · **#5** no head-of-line blocking · **#6** no secrets