# A (Power tree) + F-5x (temperature sensors / fan) — v6 audit findings
Snapshot: sch ecee9fed… / pcb 6ddec80d… (evidence pack 2026-09-28)

Auditor: POWER (block §4-A plus the temperature-sensor and fan parts of §4-F). All values come from the evidence pack (`nets.json`, `ref_pins.json`, `components.csv`, `pcb_pads.csv`, `pcb_tracks.csv`, `vias.csv`, zone fills parsed from `src/hbox-watchdog-v6.kicad_pcb`) and from datasheets fetched this session. Scratch scripts and results are in `/home/claude/v6audit/work/A_power/` (`q.py` net/ref dump, `segs.py` segment lists, `path.py` widest-path bottleneck and resistance per current path, `pdist.py` pad edge-to-edge distances, `islands.py`/`island_of.py` GND-pour island map, `under.py` copper under parts).

Conventions: "edge" = pad-copper to pad-copper distance (shapely, true pad shapes); "ctr" = pad centre distance. Track resistance assumes 1 oz (35 µm) copper, ρ = 1.72e-8 Ω·m. Trace temperature rise uses IPC-2221 (k = 0.048 external, 0.024 internal). IPC-2221 is known to be pessimistic for inner layers next to planes, and IPC-2152 gives roughly half the internal rise. Both are quoted where it matters. The GND-island analysis uses the **zone fills stored in the file**. Refill before fab and re-run `islands.py`.

## Sources read
- `findings/_COMMON_BRIEF.md`, `INDEX.md`, `evidence/MANIFEST.md`, master brief §3–§5, §4-A, §4-F (temperature/fan).
- `docs/2026-09-28_Drogheda_EinarBoard-v6_Review-vs-V5.5-Lessons_v1.0.md` (§1 F1/F4/F5/F6/F7/F8, §2, §3, §4 checklist).
- `docs/2026-09-27_Drogheda_EinarBoard-V5.6_ECO_ES_v1.0.md` (§0 R1–R5, §A, §C, §D, §E, §F, §H, §I).
- `docs/2026-09-28_Drogheda_EinarBoard-V5.6_Schematic-Change-Report_v1.0.md` (§1, §2, §6).
- `docs/2026-09-28_H0008_charging-overnight-log.md`.
- `docs/project/claude__2026-09-27_HBOX-V5.5-V4_Modem-on-battery_Diagnosis-and-0.5.8-Field-Strategy.md`.
- Memory copies in `docs/memory/`: `drogheda-battery-hightemp`, `drogheda-einarboard-modem-rail`, `drogheda-backup-lowpower`, `drogheda-power-cost`, `drogheda-fan-policy`, `drogheda-einarboard-v5-audit`, `drogheda-einarboard-harness`, `drogheda-einarboard-short-incident`, `drogheda-einarboard-v6-brief`, `preferences`.
- Evidence: `components.csv`, `nets.json`, `ref_pins.json`, `ic_pins_U6/U25/U20/U2/U12/U17/U21.csv`, `mcu_pins.csv`, `pcb_footprints.csv`, `pcb_pads.csv`, `pcb_tracks.csv`, `vias.csv`, `zones.csv`, `net_routing_summary.csv`, `drc_summary.md`, `clearance_24v.md`, `diff_v56_v6.md`, `sch_pcb_sync.md`, `bom.csv`, `firmware_constants.csv`; firmware `src/fw/hbox_v5_bringup.ino`, `board_v5.h`.
- Datasheets (fetched this session):
  - **LTC4040** Rev B (ADI `4040fb.pdf`): pin functions p.10–11; EC p.3–5 (ICHG 950/1000/1050 mA at RPROG 2k, VCLN 23.5/25/26.5 mV, VBSTFB 0.78/0.80/0.82 V, PFI 1.17/1.19/1.21 V falling with 30 mV hysteresis, RSTFB 0.74 V, NTC hot 34.9 %VIN / cold 76.5 %VIN, safety timer 4.25 h Li-ion, ILIMBST 5.5/6.5/7.5 A, IBATQ 40 µA, IINQ 570 µA); "2.5 A from a battery as low as 3.2 V" p.15; "external load prioritized … charge current drops to zero" p.13/16; RPROG = 2000 V/ICHG p.18; CSYS "at least 100 µF low-ESR ceramic" p.10, "≥75 µF transient" p.21; θJA 43 °C/W; overtemperature protection only (no charge-current thermal regulation), p.5 Note 2; layout p.22–23; abs max VIN 6 V steady / 7 V transient, VSYS/BAT/SW 6 V p.2; OVSNS "6.2 k to the connector if OVP used, else short to VIN" p.11.
  - **TPS54360B** (TI `tps54360b.pdf`): Vref 0.792/0.800/0.808 V; fSW = 92417·RT^-0.991 (162 k → 600 kHz); tON,min 135 ns; peak switch limit 4.5/5.5/6.8 A; EN 1.2 V, Ip 1.2 µA, Ih 3.4 µA, VIN UVLO 4.1–4.3 V; gmps 12 A/V, gmea 350 µS; compensation equations; 5 V/3.5 A example design (53.6k/10.2k, 13k/6.8 nF/39 pF, 8.2 µH, 2×47 µF ceramic, B560C, 2×2.2 µF/100 V); soft start 1024 cycles; θJA 42 °C/W; abs max VIN 65 V.
  - **AP64350** (Diodes DS41976 Rev 5-2): abs max VIN 42 V DC / 45 V 400 ms, EN 42 V; VIN 3.8–40 V; UVLO rising 3.5–3.7 V, hysteresis 400 mV; EN high 1.18–1.25 V / low 1.03–1.09 V, EN pull-up 5.5 µA; FB 792–808 mV; RT = 100000/fSW (200 k → 500 kHz); HS limit 4.25/5/5.75 A; tON,min 100 ns; Table 1 (5 V: 14.0 k/3.3 nF/47 pF, 5.5 µH, 2×22 µF); R5 = 4.67e3·fc·VOUT·COUT; θJA 45 °C/W.
  - **MP1584** (MPS Rev 1.0): abs max VIN 30 V, all other pins (EN, FB, COMP, FREQ) 6 V; VIN 4.5–28 V; EN rising 1.5 V/hysteresis 0.3 V; UVLO 3.0/2.6 V; FB 0.776/0.8/0.824 V; switch limit 4.0–4.7 A.
  - **AMS1117** (AMS `ds1117.pdf`): dropout 1.1 V typ/1.3 V max at 0.8 A; ground current 5/11 mA; output cap 22 µF tantalum; VOUT 3.251–3.399 V.
  - **A7670X series Hardware Design V1.03** (SIMCom, Table 8 p.26–27): VBAT 3.4/3.8/4.2 V; 2 A peak (GSM max-power TX); supply ≥ 2 A for < 300 mV drop; ≥ 300 µF bulk (≥ 600 µF if the supply cannot give 2 A); VBAT trace ≥ 3 mm; off leakage 20 µA; PWRKEY ≥ 50 ms, STATUS ~7 s; A7670SA includes GSM 850/900/1800/1900.
  - JLC DB (`get_jlcpcb_part` / `search_jlcpcb_parts`): C524806, C2071691, C15051, C6186, C51118, C15578, C840531, C5440143, C2827940, C165527, C88734, C88744, C116241, C881921, C206910, C206912, C206914, C20627123, C699039, C224019, C152082, C50603, C85100, C8678, C2624, C35349, C105362, C687163, C17700165, C17700167, C17700171, C153036, C440198, C86817, C15849, C138687, C28695, C22843, C22840, C25957, C23082, C23080, C99269.

## Findings

### A-01 24 V front end: the `/24V` branch is unfused and outside the D32 clamp, and it feeds parts rated 30 V / 42 V
- **Severity:** Blocker
- **Block / refs:** §4-A (input protection; lead "F2 only protects the U25 branch"); lesson F8; memory `drogheda-einarboard-v6-brief` (T9 "9–36 V in"), `drogheda-einarboard-short-incident`, `drogheda-power-cost` (MP1584 finding).
- **Evidence:**
  - Topology (netlist): `P1.1 /24V_IN` splits into two branches.
    - Branch 1: `F2 (0154002.DR, 2 A fast) → /VIN_FUSED → Q23 IRFR5305 → /VIN_PROT` (D32 SMCJ33A, C149/C150/C151) → U25.
    - Branch 2: `Q10 IRFR5305 → /24V` = {C10 47 µF/50 V, C11, C22, Ren1, **U2.7 (MP1584EN VIN)**, **D20 → /VIN_MODEM → U20.2 (AP64350 VIN)**}. It has **no fuse**, and its only clamp is **D10 SMBJ33A** on `/24V_IN` (600 W, VC 53.3 V @ 11.3 A, C224019). D32 (1.5 kW) sits on branch 1 only.
  - Ratings on branch 2:
    - U2 MP1584EN: VIN operating 4.5–28 V, **abs max 30 V**. EN = /24V·20k/120k = 6.0 V at 36 V vs **EN abs max 6 V**.
    - U20 AP64350: **abs max 42 V** (45 V for 400 ms).
    - D21 PMEG3050EP (VRRM 30 V, leakage 8 mA @ 30 V per JLC) is reverse-biased by VIN_MODEM − MAIN5V = 36 − 0.45 − 4.79 ≈ **30.8 V at the 36 V spec limit** and ≈ 48 V during a D10 clamp event.
  - Standards: 24 V truck systems see 28–28.8 V charging, ISO 16750-2 overvoltage 36 V/60 min, and ISO 7637-2 pulse 2a (+112 V, 2 Ω, 50 µs). Pulse 2a through D10 gives ≈ (112 − 45)/2 ≈ 33 A, above its 11.3 A 10/1000 µs rating, with a clamp ≥ 53 V. U2 dies at the 36 V overvoltage test and U20 is over its 42 V abs max during pulse clamping.
  - Layout: the `/24V` branch is 1.5 mm on In1 at **0.15 mm** from the In1 GND pour and has a via **0.15 mm** from the B.Cu `/3V3` pour (`clearance_24v.md`). An inner-layer breakdown there is an unfused vehicle-battery short, or 24 V straight onto 3V3.
  - F2 sizing today: U25 input at 2.5 A/5 V is 0.60 A @ 24 V, 1.25 A @ 12 V and 1.67 A @ 9 V. The Littelfuse 154 continuous-current derating (~75 %, lower when hot) puts a 2 A fuse at its limit on a 12 V machine.
- **Consequence:** (1) A short of C10/C22, U2, U20 or D22 (a U20 high-side short puts 24 V on VBAT_MODEM and SMAJ5.0A D22 crowbars it) draws vehicle-fuse current through 0.3–1.5 mm board copper. That is a fire and harness risk. (2) U2, and in pulses U20 and D21, are over their absolute maximum ratings on the v6 target supply (9–36 V, 24 V trucks). (3) This design also carries the V5.5 U2 exposure forward.
- **Fix:** Make U25 the only consumer of vehicle voltage. Everything else then runs from protected 5 V.
  1. **Fan from VEH5V, delete the 24 V fan buck.** DNP U2, L2, Dbk1, Cbst1, Rcomp1, Ccomp1, Rfreq1, Ren1, Ren2, R20, R21, and close JP1 (`/5V_FAN` = `/VEH5V`, upstream of RS1, so fan current is outside the LTC4040 limit). JP1 today is an *open* solder jumper: change the footprint to `Jumper:SolderJumper-2_P1.3mm_Bridged_RoundedPad1.0x1.5mm`, or fit a 0 Ω 0805. Fan current (assumed 0.2–0.3 A) adds to U25: ≤ 2.68 + 0.3 = 2.98 A vs 3.5 A rating and 4.5 A minimum current limit. Fan stays dark on battery, as today (ECO D4). This also retires the MP1584 cost item ($2.21 @100, C15051) and EMC items E3/E4 for U2.
  2. **Modem buck input from MAIN5V only ("Option A").** Delete D20 and its 48 mm `/VIN_MODEM` run, and replace D21 with a copper bridge or 0 Ω link. U20 then never sees vehicle voltage. On battery its input rises from ~4.4 V to ~4.74 V (no 0.30 V diode drop; see A-05). On vehicle power the modem load (≤ 1.8 A peak at 5 V) becomes LTC4040 system load. The LTC4040 prioritises system load over charge current (datasheet p.13), and U25 is stiff: estimated 0.16 V dip for a 1.8 A step, against PFI rising max 4.66 V and U25 min 5.18 V with A-04. **Needs the modem auditor's agreement.** Option B, if the 24 V modem feed must stay: fuse and clamp as below and replace U20 with a ≥ 60 V synchronous buck, because the 42 V AP64350 cannot live behind a 53 V clamp.
  3. **Q10 branch.** With (1) and (2) done, `/24V` has no loads. DNP Q10, DzG1, Rrp1, C10, C11, C22, and keep Q23 as the single reverse-polarity FET.
  4. **F2.** Keep it on the (now only) branch. Rate it **3 A (0154003.DR, C206912, 2217 in stock)** for 24 V-only fleets, or **4 A (0154004.DR, C206914, 778 in stock)** if 12 V machines are in scope. Same holder footprint. Optional layout: put F2 ahead of D10 so a shorted TVS opens the board fuse.
  - Effort check: every item is a schematic change (DNP/value) plus one short re-route (D21 bridge). No new parts.
- **Effort:** both (mostly schematic/BOM; D21 → bridge and removal of the D20 run are layout)
- **Confidence:** high on topology and ratings (netlist plus datasheets). Medium on the Option A system impact until the modem auditor reviews it and a bench test runs U25 with a 2 A modem step.

### A-02 LTC4040 (U6) thermal copper and placement repeat lesson F5 (the H0008 slow-charge mechanism)
- **Severity:** Blocker
- **Block / refs:** §4-A (LTC4040 thermal); lesson F5; ECO §D2 / §E1–E2; memory `drogheda-einarboard-v5-audit` (SW_BAT 0.3 mm critical); H0008 log.
- **Evidence (measured):**

| Item | v6 now | Target | Result |
|---|---|---|---|
| `/SW_BAT` U6.21/22 → L6.1 | F.Cu **0.50 mm × 11.9 mm** plus 0.25/0.30 mm necks at the pins; R ≈ 12.2 mΩ | ≥ 2 mm polygon | ❌ (V5.5 was 0.3 mm; improved but 4× short) |
| `/BAT_PLUS` P3.1 → L6.2 (battery current) | F.Cu **1.0 mm × 21.3 mm**, 10.4 mΩ | ≥ 1.5 mm + via farm | ❌ |
| `/BAT_PLUS` L6.2 → U6.23 (BAT pin, sense-class) | 1.0/0.5/0.25 mm, 18.8 mm | Kelvin from L6.2/CBAT | ⚠ acceptable electrically |
| U6 VSYS pins 1/24 → CSYS | 0.30 mm necks (1.5 mm) + 0.5 mm × 6.7 mm; C32/C33/C34 **3.9–5.3 mm** edge | pour, CSYS ≤ 2 mm | ❌ |
| CSYS GND return | C32.2 on F.Cu island 16 (the U6 EP island); **C33.2 on island 3**; C34.2 on its own 2.2 mm² island with 1 via | same island as EP, via array | ❌ |
| U6 EP (pad 25, 2.65 × 3.65 mm, solid zone connect) | **0 vias in EP**; nearest GND via **5.21 mm** (188.6, 102.7) | ≥ 9 vias to In1/In2 | ❌ |
| EP copper | F.Cu GND island 16 = **252 mm²** with 5 GND vias. Within 6 mm of U6: F.Cu GND 33.7 mm², In1 GND split between islands 0/1 (cut by 7 `/VFB_BST` + `/IGATE` + `/CHRG_*` In1 segments), In2 GND 99 mm², B.Cu = /3V3 pour | solid planes under U6 | ❌ |
| L6 distance | L6.1 ↔ U6.21/22 **8.65–9.10 mm** edge (10.7–11.1 ctr; footprints 15.25 mm) | ≤ 5 mm | ❌ |
| VIN caps C30 10 µF / C31 2.2 µF → U6.6 | **7.2 / 6.2 mm** edge | < 3 mm | ❌ |
| CBAT C35 22 µF | at P3 (192.0, 112.7): 5.2 mm from U6.23 but **21.9 mm** from L6.2 | at L6.2/BAT pin | ⚠ |
| Temperature sensor ≤ 10 mm of U6 | **none**; nearest is U3 SHT40 at **71.4 mm** | ≤ 10 mm | ❌ (F-51) |

  - Trace temperature rise (IPC-2221 external, `/SW_BAT` 0.5 mm): charging at 2.42 A (R50 825 Ω) **+32 °C**; at 1.40 A (A-03) +9 °C; sustained backup at 3.6 A battery current (2.3 A at VSYS) **+79 °C**. The same current at 2.0 mm gives +8 °C.
  - IC dissipation estimate (assumption: charger efficiency ≈ 90 % at 2.4 A, IC share ≈ 75 %):
    - At 2.42 A: ≈ 0.75 W. As-built θJA ≈ 60–70 °C/W (the datasheet's 43 °C/W assumes a via array), so ΔTj ≈ 45–53 °C, before the 45 °C port ambient and enclosure rise.
    - At 1.4 A: ≈ 0.25–0.3 W, so ΔTj ≈ 18–21 °C.
  - The LTC4040 has **overtemperature shutdown only, with no charge-current thermal regulation** (datasheet p.5 Note 2). The H0008 pulsing (60–70 mV at 30 s) and the ~1.3 A average versus 2.42 A programmed are what on/off thermal cycling would produce. This is not yet proven: the clamp-meter and IR checks in the H0008 "Pendientes" 1–2 are still open.
- **Consequence:** R5 (≥ 1.3 A without thermal cycling) is not met by layout. In continuous backup the boost node and the VSYS necks run hot. This repeats the V5.5 lesson.
- **Fix (layout instructions, for Michelle):**
  1. Re-cluster: L6 pad 1 ≤ 5 mm from U6.21/22. C32/C33/C34 ≤ 2 mm from VSYS pins 1/24, with GND pads on the EP island. C30/C31 ≤ 3 mm from pin 6. C35 (or an extra 22 µF 0805, C86817) at L6.2 next to BAT pin 23.
  2. `/SW_BAT`: F.Cu polygon ≥ 2 mm wide covering pins 21–22 to L6.1, kept compact (it is the switch node).
  3. `/BAT_PLUS` P3 → L6.2: ≥ 1.5 mm F.Cu (or a pour), plus ≥ 4 vias to an In2 copper area if routed inner.
  4. `/MAIN5V`: pour from pins 1/24 over C32–C34 to the Q7 drain pads, ≥ 2 mm, with no 0.3/0.5 mm necks.
  5. EP: 12 vias (3 × 4 at 0.9 mm pitch, 0.3 mm drill / 0.6 mm pad), plugged or capped (JLC via-in-pad). Or use the `QFN-24-1EP_4x5mm_P0.5mm_EP2.65x3.65mm_ThermalVias` footprint and add vias to reach ≥ 9.
  6. Keep In1 and In2 GND solid for ≥ 5 mm around U6/L6: move the `/VFB_BST` and `/IGATE` In1 runs (see A-14).
  7. Put the TMP102 from F-51 between U6 and L6.
- **Effort:** layout
- **Confidence:** high (measured from the board file). The OT-cycling causality stays medium until the H0008 clamp/IR test.

### A-03 R50 = 825 Ω programs 2.42 A. Set 1.43 kΩ to meet R5 at worst case
- **Severity:** Blocker
- **Block / refs:** §4-A (R50); lesson F4; ECO §C; R5; H0008 log; memory `drogheda-battery-hightemp`.
- **Evidence:**
  - Datasheet: ICHG = 2000 V/RPROG (p.18), accuracy ±5 % (950–1050 mA at 2 k, p.3).
  - R50 825 Ω/1 % (C50214): **2.42 A** nominal (2.28–2.57 A).
  - V5.6 value 1.5 kΩ: 1.333 A nominal, **1.254–1.414 A** worst case, so the low corner is **below the R5 floor of 1.3 A**.
  - **1.43 kΩ: 1.399 A nominal, 1.316–1.483 A** worst case, which is ≥ 1.3 A at every corner.
  - H0008 (V5.5, same R50): ≈ 1.3 A average delivered, 8.5 h to C/8, pulsing charge (A-02). At 1.4 A the IC loss drops by (2.42/1.4)² ≈ 3×, and delivered current is about what H0008 actually got, without the cycling mechanism. Charge time for the ~11.6 Ah pack from ~3.5 V is ≈ 6–7 h (CC plus CV taper). The Li-ion safety timer (4.25 h, 3.7–5 h) only runs in CV (p.14), so it does not cut CC.
  - Input side: 1.4 A × 4.0 V/(0.9 × 5.3 V) ≈ 1.17 A plus ≈ 0.35 A logic gives 1.52 A, against the RS1 limit of 2.14–2.41 A effective (A-07). The charger stops being input-limited.
- **Consequence:** At 825 Ω, v6 repeats the H0008 behaviour. U25 also sits at the RS1 limit (≈ 2.5 A continuous) whenever charging, which drives the A-06/A-07 thermal problems.
- **Fix:** R50 → **1.43 kΩ 1 % 0603, LCSC C22840** (Extended; 4965 in stock in the DB snapshot). If Leo prefers V5.6 BOM commonality, use 1.5 kΩ (C22843, Basic), but R5 is then met only nominally.
- **Effort:** schematic-only
- **Confidence:** high for the numbers. Medium that thermal cycling is the whole H0008 story (pending the clamp test).

### A-04 U25 set-point 5.00 V (4.87–5.14 V) is incompatible with the charge governor. Set R121 = 57.6 k
- **Severity:** Major
- **Block / refs:** §4-A (U25 set-point); lesson F7; ECO §A/§C ("≥ 5.30 V"); `firmware_constants.csv` (CHG_RAIL_ON 5.05, CHG_RAIL_OFF 4.90, V5_PFI 4.60).
- **Evidence (Vout = Vref·(1 + R121/R122), Vref 0.792/0.800/0.808 V, resistors 1 %):**

| R121 / R122 | min | nom | max | vs CHG_RAIL_ON 5.05 | vs LTC4040 VIN max 5.5 |
|---|---|---|---|---|---|
| 53.6 k / 10.2 k (as-is) | **4.871** | **5.004** | 5.140 | nominal below the start line: charger never (or randomly) enabled | ok |
| 56.2 k / 10.2 k | 5.069 | 5.208 | 5.350 | low corner 0.02 V above | ok |
| **57.6 k / 10.2 k** | **5.176** | **5.318** | **5.463** | ≥ 0.13 V above | 37 mV margin |
| 57.6 k / 10.2 k, 0.1 % resistors | 5.256 | 5.318 | 5.380 | ok | 120 mV margin |

  - LTC4040 PFI from v6's R51 270 k / R52 100 k at 1.19 V: **falling 4.27/4.40/4.54 V, rising 4.38/4.51/4.66 V**. The firmware constant V5_PFI 4.60 V is stale (it comes from the old 287 k).
  - As-is margin U25 min → PFI rising max = 0.21 V. With 57.6 k: 0.52 V.
  - The ADC measures 5V_SENSE (R7/R8 10 k/10 k) against VDDA = the 3V3 LDO (±1.5 %, and lower on battery, A-08). Firmware thresholds carry ±2–3 % error unless calibrated with VREFINT.
  - With the as-is topology the modem does not load VEH5V (it runs from /24V), so the V5.5 LTE-sag argument is gone on vehicle power. It comes back if A-01 Option A is adopted.
- **Consequence:** With FW 0.6.0 thresholds, v6 as-is will not start charging on most units, so R5 fails. The margins are thin under modem bursts if the modem moves to MAIN5V.
- **Fix:** R121 → **57.6 k 1 % 0603, LCSC C23082** (Extended; 3673 in stock in the DB snapshot). Optionally specify R121/R122 at 0.1 % to take the upper corner to 5.38 V. In firmware v6 (FW 0.7.x), calibrate the ADC against VREFINT and set V5_PFI = 4.40 V.
- **Effort:** schematic-only (plus firmware constants)
- **Confidence:** high

### A-05 Backup mode: worst-case load reaches 93–97 % of the LTC4040 boost capability during a 2 A modem burst; W5500 always powered; U20 input weakly bypassed
- **Severity:** Major
- **Block / refs:** §4-A (backup path, budget); lessons F1/F2; ECO §A, §I-1; R1, R3; memory `drogheda-einarboard-modem-rail`, `drogheda-backup-lowpower`; modem-on-battery diagnosis.
- **Evidence:**
  - **What stays alive on battery (netlist):**
    - `BAT → L6 → U6 boost → /MAIN5V`. Backup VSYS = 0.8·(1 + 499k/100k): **4.60/4.79/4.99 V** (VBSTFB 0.78–0.82 V). R53 must stay at 499 k because the 5.0 V limit sits at the top corner.
    - From MAIN5V: (a) **D21 → /VIN_MODEM → U20 → modem** (D21 anode is *before* P5, so the cutoff switch does not cut this path; EN is held low by R113 when the MCU is unpowered). (b) **P5 (cutoff) → /SYS5V** → D12 → U17 (3V3: MCU and all logic), **U12 (3V3_ETH, EN tied to VIN → always on)**, F1 → Q1 (PWR_CTRL) → U21 → F9P, K1 coil (BYP_CTRL).
    - `/VIN_MODEM` falls to MAIN5V − Vf(D21) once 24 V is gone. There is no separate "D21/MAIN5V" rail.
  - **LTC4040 boost:** 2.5 A load from battery ≥ 3.2 V; switch limit 5.5 A min (p.4, p.15). It runs only when PFI < threshold (p.13). BAT quiescent 40 µA.
  - **CSYS:** C32/C33 47 µF/16 V X7R 1210 plus C34 10 µF/50 V 0805 = 104 µF nominal, which meets the 100 µF text. Effective at 4.8 V ≈ 59 µF (assumed DC-bias loss −40 % / −40 %), below the 75 µF transient guidance (p.21).
  - **U20 input (A7670 needs a 2 A-capable supply, HD Table 8):** C127 10 µF/50 V 0805 + C128 1 µF only. The V5.6 ECO specified 2×22 µF + 10 µF.
  - **U20 UVLO:** falling ≈ 3.1–3.3 V against VIN_MODEM ≥ 4.2 V on battery, so ≈ 1 V margin (V5.5 had 0.1 V). **The V5.5 failure mechanism is fixed**, and the residual risk is boost current limit.
  - **Worst-case current budget.** Assumptions:
    - Logic (3V3): 90 mA typ, 120 mA worst including 4 gauge LEDs, plus AMS1117 Iq 5 mA.
    - F9P (3V3_GNSS): 100 mA cold, 85 mA steady, including LNA (u-blox ~68 mA typ).
    - W5500: 132 mA at 3.3 V (100BASE-TX), through U12 at η 0.85.
    - K1 coil: 30 mA (G5V-1 5 VDC, 167 Ω).
    - Modem VBAT: 2.0 A GSM peak (HD Table 8). LTE TX average assumed 0.7 A (HD table is TBD). Idle 20 mA. R112 bleeder 3.8 mA.
    - Efficiencies: U20 0.88, U25 0.87, boost 0.88. Battery 3.5 V.

**On 24 V (as-is topology, charging with R50 825 Ω / with 1.43 k):**

| Rail | Cold start | Steady | Modem TX burst |
|---|---|---|---|
| /3V3 (U17 out) | 0.120 A | 0.090 A | 0.090 A |
| /3V3_GNSS | 0.100 A | 0.085 A | 0.085 A |
| /3V3_ETH | 0.132 A | 0.132 A | 0.132 A |
| /VBAT_MODEM | 2.0 A pk (0.3 A avg) | 0.024 A | 2.0 A pk |
| /VIN_MODEM @ 23.5 V (from /24V) | 0.37 A pk | 0.005 A | 0.37 A pk |
| /24V (+ fan 0.2 A @ 5 V via U2) | 0.42 A | 0.05 A | 0.42 A |
| /SYS5V | 0.35 A | 0.31 A | 0.31 A |
| /VEH5V (U25 out; charger held off 120 s at boot) | 0.36 A | **2.50 A (RS1-limited) / 1.48 A** | 2.50 / 1.48 A |
| /VIN_PROT @ 24 V | 0.09 A | 0.60 / 0.38 A | 0.60 / 0.38 A |
| P1 total @ 24 V | 0.50 A | 0.65 / 0.43 A | **1.02 / 0.80 A** |
| P1 total @ 9 V (12 V vehicle low) | — | 1.73 / 1.1 A | **2.8 / 2.2 A** |

**On battery (as-is topology; VSYS 4.79 V; VIN_MODEM ≈ 4.4 V after D21):**

| Rail | Cold start (all on, modem registering) | Steady (registered, idle) | GSM TX burst | LTE TX |
|---|---|---|---|---|
| /VIN_MODEM | 1.96 A pk | 0.024 A | 1.96 A pk | 0.69 A |
| /SYS5V (logic + F9P + W5500 via U12 + K1) | 0.36 A | 0.32 A | 0.32 A | 0.32 A |
| **/MAIN5V = boost load** | **2.33 A (93 % of 2.5 A)** | 0.34 A | **2.28 A (91 %)** | 1.01 A (40 %) |
| same at the VSYS low corner 4.60 V (VIN_MODEM 4.2 V) | **2.43 A (97 %)** | 0.34 A | 2.38 A (95 %) | 1.04 A |
| Battery current (VSYS·I/(3.5 V·0.88)) | 3.62 A | 0.53 A | 3.55 A | 1.57 A |
| with fixes below + FW sequencing (W5500 off, K1 off, F9P deferred, D21 bridged) | **1.95 A (78 %)** | 0.15 A | 1.95 A | 0.85 A |
| with fixes + LTE-only on battery (peak ≈ 1 A assumed) | ≈ 1.2 A (48 %) | 0.15 A | — | 0.85 A |

- **Consequence:** As-is, a cold modem registration (or a GSM burst) with everything else on uses 93–97 % of the boost rating, with no allowance for bursts above 2.0 A or a hot, aged pack. Hitting the limit droops VSYS: U17 drops out first (A-08), then U20 → VBAT_MODEM < 3.4 V. That is the V5.5 "modem dark on battery" symptom through a different mechanism. **R1/R3 are not robust on hardware as-is. They are achievable with firmware sequencing (mandatory) plus the fixes below.** Without U12 gating, W5500 alone costs ≈ 0.5 W continuous on battery, against a 20–50 mW duty-cycle sleep target.
- **Fix:**
  1. **U12 EN (pin 2)** off `/SYS5V` onto a new net `/ETH_PWR_EN` from **PD2 (pad 54, free)**, with **100 k to GND** (C25803). MP1584 EN threshold 1.5 V and abs max 6 V are compatible with 3.3 V drive. Default OFF. (E auditor: W5500 reset/strap implications.)
  2. **CSYS:** add 2 × 47 µF 16 V X7R 1210 (**C5440143**) at U6 VSYS pins 1/24 (≈ 113 µF effective).
  3. **U20 input:** with A-01 Option A (5 V input), add 2 × 22 µF 16 V 0805 (**C86817**) ≤ 3 mm from U20.2, GND to U20.7/EP, plus 1 × 220 µF 16 V polymer (**C881921**) at `/VIN_MODEM`. If the 24 V feed stays (Option B), use 50 V parts (e.g. 2 × 10 µF 50 V 1210 **C138687**).
  4. **D21:** replace with a bridge (Option A), which removes 0.30 V and lowers U20 input current by ≈ 7 %.
  5. **MAIN5V from U6 to U20:** ≥ 1.5–2 mm the whole way (today 0.3/0.5 mm necks and 60 mm; A-07).
  6. **Firmware sequencing** (see firmware section): mandatory.
- **Effort:** both
- **Confidence:** medium. Datasheet limits are firm. Load currents for the modem (LTE average), F9P and fan are assumptions. Raise confidence with the ECO §I-1 bench test: MAIN5V and VIN_MODEM scope during a battery-only cold start at VBAT 3.5 V, plus a current probe on `/BAT_PLUS`.

### A-06 Switcher hot loops and exposed-pad grounding: loops close through inner planes via distant vias; no EP vias on any regulator
- **Severity:** Major
- **Block / refs:** §4-A ("input/output cap distance < 3 mm", compensation/BST); ECO §E4; Review §2 "Switcher EP vias"; datasheets TPS54360B/AP64350 layout sections.
- **Evidence:**
  - Board-wide there are **69 GND vias** (8 in the SE power quadrant x > 150, y > 85). The F.Cu GND pour is split into **71 islands** (stored fill). The EP-pad zone connection defaults to *thermal* (0.5 mm spokes) except U6.25 and U2.9, which are solid.

| Reg | Cin → VIN pin (edge) | Cin GND ↔ return (diode anode / GND pin) | EP vias / nearest GND via | Other |
|---|---|---|---|---|
| **U25** TPS54360B | C150 **2.88 mm** ✅, C149 6.37 mm | C149.2/C150.2 on **island 16**, D34.2 + U25 EP on **island 3** (3006 mm², only 3 vias at (145.7, 129.9), (148.1, 135.3), (198.8, 78.1): **≥ 30 mm** from U25). The input loop closes through In1/In2 via ≥ 11 mm and ≥ 30 mm detours. | **0 / 14.4 mm**; EP thermal-relief | D34 4.28 mm from SW; **L22 17.0 mm** from SW (`/SW_PWRIN` 20.4 mm at 1 mm); BST C152 1.49 mm ✅; FB/COMP/RT 1.0–2.9 mm ✅ |
| **U20** AP64350 | C128 0.72 mm, C127 2.38 mm ✅ | C127.2/C128.2 → U20.7 **6.9/8.5 mm**; EP on a different island (3) from pin 7 (island 20) | **0 / 5.15 mm**; EP thermal-relief | L20 2.24 mm ✅; BST 1.8 mm ✅; COMP 0.7/2.2 mm ✅; FB 3.2/4.1 mm |
| **U2** MP1584 (fan) | C22/C10/C11 **17.0–20.8 mm** ❌ | C22.2 ↔ Dbk1.2 11.7 mm | **0 / 19.7 mm** | Dbk1 6.5 mm, L2 11.9 mm from SW; FB divider R20/R21 **0.67/1.48 mm** ✅ (ECO E3 fixed) |
| **U12** MP1584 (3V3_ETH) | C101 6.40 mm | C101.2 (island 41, 0 vias) ↔ D11.2 (island 40) 14.9 mm; U12.5/U12.9 on island 39 (21 mm², **0 vias**) tied by **0.2 mm** GND tracks | **0 / 6.4 mm** | D11 11.9 mm, L8 15.1 mm from SW; Cout C102/C103 28–36 mm; FB top R87 24 mm |

  - **D34 (B560C) thermal:** average current (1 − D)·Io ≈ 0.78 × 2.5 = 1.95 A → ≈ 1.0 W at 24 V. The GND pad has thermal-relief spokes and the cathode sits on a 1 mm SW trace. Estimated +75–100 °C over local ambient at full load, which approaches Tj max 150 °C in a 45 °C box. It drops to ≈ 0.55 W with A-03.
  - U25 IC loss ≈ 0.5–0.75 W (24–36 V) with no EP vias.
- **Consequence:** For U25, SW-node and VIN-pin ringing and conducted/radiated EMI from a non-sync buck switching 2.5 A at 24–36 V. Ringing adds on top of the 53 V TVS clamp relative to the 65 V SW/VIN abs max. Poor regulator and diode thermals. For U12, a broken hot loop next to the Ethernet magnetics. U2 loses its local input bypass (MP1584 VIN abs max 30 V). U2 disappears if A-01 fix 1 is taken.
- **Fix:**
  - **U25:** place C149/C150 ≤ 2 mm from pins 2/7 with their GND on the same F.Cu copper as D34.2 and the EP. D34 ≤ 3 mm from pin 8. L22 ≤ 5 mm from pin 8, SW copper ≤ 1.5× pad area. EP: 8 vias (4 × 2, 0.3/0.6 mm) and `zone_connect` solid on pad 9. D34 GND pad solid to ≥ 150 mm² F.Cu GND with ≥ 6 vias.
  - **U20:** C127/C128 GND ≤ 2 mm to pin 7/EP. EP 8 vias, solid zone connect.
  - **U12:** Cin C101 ≤ 3 mm with GND next to pin 5. D11 and L8 ≤ 4 mm from pin 1. EP ≥ 6 vias. Replace the 0.2 mm GND ties with pour.
  - **Stitching:** GND vias every ≤ 5 mm around each regulator and on both sides of each hot loop. (Layout auditor F owns board-wide stitching.)
- **Effort:** layout
- **Confidence:** high on the geometry. Medium on the island picture because it depends on stored fills: refill, then re-run `islands.py`.

### A-07 5 V power-path bottlenecks: VEH5V and VIN_SW run the full LTC4040 input current on inner 0.5/0.8 mm tracks
- **Severity:** Major
- **Block / refs:** §4-A; DRC `track_width` (183 warnings, T15 rules); lead "netclass patterns match no net". (A separate issue: the `24V`/`IGN_IN`/`Q10_GATE` patterns resolve nothing. Layout auditor owns clearance.)
- **Evidence (widest path, `path.py`):**

| Path | Bottleneck | Length / R | Current | IPC-2221 ΔT | Action |
|---|---|---|---|---|---|
| `/VEH5V` L22.2 → RS1.1 | **In1 0.5 mm × 13.6 mm** | 24.8 mm / 18.9 mΩ | 2.5 A (charging, as-is) / 1.5 A | **+168 °C / +52 °C** (internal; IPC-2152 ≈ half) | ❌ widen |
| `/VIN_SW` RS1.2 → Q7.1–3 | **In2 0.8 mm × 23.6 mm** | 26.0 mm / 15.9 mΩ | 2.5 A | +77 °C internal | ❌ |
| `/MAIN5V` Q7 → U6.24 / C32 | F.Cu 0.5 mm × 13.3 / 6.6 mm | 23 / 15 mΩ | 2.2 A (charger in) / 2.4 A (backup) | +26 / +32 °C | ❌ |
| `/MAIN5V` U6.1 → C32 | **0.30 mm** neck 1.5 mm | 12 mΩ | 2.4 A | +73 °C (short neck) | ❌ (A-02) |
| `/MAIN5V` Q7 → D21 (modem, battery) | 1.0 mm (In2 6.8 mm) | 40 mm / 20 mΩ | 2.0 A | +12 °C | ⚠ widen to ≥ 1.5 mm |
| `/VIN_MODEM` D21 → U20.2 | 0.5 mm × 5.8 mm | 5.7 mΩ | 2.0 A | short | ⚠ ≥ 1 mm |
| `/BAT_PLUS` P3 → L6 | 1.0 mm × 21.3 mm | 10.4 mΩ | 3.6 A backup peak / 2.42 A | +25 / +10 °C | (A-02) |
| `/VIN_PROT` Q23 → U25.2 | 0.5 mm × 9.8 mm | 13.5 mΩ | 0.6 A @ 24 V, 1.7 A @ 9 V | +14 °C @ 9 V | ok for 24 V |
| `/24V_IN` P1 → Q10 | In1 1.5 mm | 12.4 mΩ | ≤ 1.0 A (24 V) | small | ok |
| `/SW_BAT` | see A-02 | | | | |
| `/3V3_ETH`, `/SW_5V`, `/SW_IN`, `/SYS5V`, `/5V_FAN`, `/FAN_RET`, `/SW_FAN` | 0.25–0.5 mm (DRC-flagged) | | ≤ 0.4 A | < 5 °C | ok (DRC hygiene only) |

  - **RS1 Kelvin:** the CLN sense (U6.7) taps at the via (183.91, 104.21), **1.66 mm down the 0.8 mm trace** from the RS1.2 pad (+1.0 mΩ in the sense loop). The effective input limit is 25 mV/11 mΩ = 2.27 A typ (**2.14–2.41 A**) instead of 2.35–2.65 A. That is harmless (more conservative) but unintended.
- **Consequence:** Hot inner copper under U6/Q7 at charge current, extra drop, and the 2.5 A input path sharing heat with the U6 area.
- **Fix:** Put `/VEH5V` from L22.2 to RS1.1 on F.Cu ≥ 2 mm (or a pour) and move L22/C153/C154 toward RS1, or use ≥ 2 mm inner with ≥ 4 vias per transition. Put `/VIN_SW` on F.Cu ≥ 2 mm and move Q7 within 5 mm of RS1/U6. For `/MAIN5V`, see A-02, and run ≥ 1.5 mm to D21/U20. Route the U6.7 CLN and U6.6 VIN sense traces from the inner edges of the RS1 pads (Kelvin). Fix the netclass patterns (prefix `/`) so the T15 widths become rules instead of warnings.
- **Effort:** layout
- **Confidence:** high

### A-08 U17 AMS1117-3.3 drops out on battery and sets a 25–55 mW sleep floor
- **Severity:** Major
- **Block / refs:** §4-A ("dropout for the LDOs at the backup voltage"); memory `drogheda-backup-lowpower` (AMS1117 = #1 sleep-floor suspect); R1.
- **Evidence:**
  - `LDO_IN = SYS5V − Vf(D12 SS34 ≈ 0.30–0.35 V at 0.1 A)`. On battery SYS5V ≈ VSYS 4.60–4.99 V minus ≈ 0.02 V, so **LDO_IN ≈ 4.25–4.65 V**.
  - AMS1117 dropout: 1.1 V typ / 1.3 V max at 0.8 A, ≈ 1.0 V at 0.1 A, so it needs ≈ 4.3–4.4 V. At the low boost corner, and during every boost-limited dip (A-05), 3V3 sags by ≈ 50–150 mV.
  - VDDA = 3V3 via R104 10 Ω. The firmware assumes ADC_REF = 3.3 V, so BAT_SENSE/5V_SENSE read up to +4 % high. The 3.40 V low-battery cut then trips at ≈ 3.27 V real. The NTC channels (R42/R126 from 3V3) are ratiometric and unaffected.
  - Ground current is **5 mA typ / 11 mA max** (25–55 mW at 5 V).
  - The datasheet asks for a 22 µF tantalum output cap. The /3V3 rail is all ceramic (C118 22 µF 0805 plus many 100 nF), which is a stability question for genuine AMS1117 parts.
- **Consequence:** Degraded 3V3 exactly when running on battery, wrong battery-voltage telemetry, and a duty-cycle sleep floor already as large as the whole 20–50 mW target.
- **Fix:** U17 → **TI TLV1117LV33DCYR, LCSC C15578** (SOT-223, same 1-GND/2-OUT/3-IN pinout and footprint; 1 A; dropout 455 mV at 1 A, ≈ 0.1 V at 0.15 A; IQ ≈ 100 µA; ceramic-stable; VIN max 5.5 V vs LDO_IN max ≈ 5.3 V with A-04). **Do not use** C48937499: it is listed under the same MPN but its spec (1.2 V dropout, 12 V) is the wrong die. Firmware: VREFINT calibration anyway.
- **Effort:** schematic-only (value/LCSC; same footprint)
- **Confidence:** high (AMS1117 numbers). Medium for TLV1117LV at 0.1–0.15 A: check the TI dropout curve during sourcing.

### A-09 Aluminium electrolytics: 85 °C/2000 h parts on the 5 V and modem rails (≈ 1-year life in a port box); modem bulk also over its ripple rating
- **Severity:** Major
- **Block / refs:** §4-A (Cout type/ESR); ECO §A (220 µF polymer); cross-ref modem auditor (C130/C131).
- **Evidence:**
  - C78 (VEH5V bulk), **C130, C131** (VBAT_MODEM bulk) = C2827940 SamYoung MVG 16 V 220 µF, **−40…+85 °C, 2000 h @ 85 °C, 130 mA @ 120 Hz ripple**.
  - C10 (/24V) = C165527 MVK 50 V 47 µF, **105 °C/1000 h**.
  - C3 = C88734 and C103 = C88744: Rubycon TZV, 105 °C/2000 h.
  - C151 = C116241: Nichicon UUD, 105 °C/5000 h ✅.
  - 10 °C-rule life at 65 °C local (45 °C ambient plus enclosure/board rise, assumption): MVG ≈ 8,000 h (**0.9 y** of 24/7). MVK ≈ 16,000 h. TZV ≈ 32,000 h. UUD ≈ 80,000 h.
  - C130/C131 take the modem's GSM/LTE burst edges (2 A, 577 µs, 217 Hz). Ripple current exceeds the 130 mA rating, so self-heating shortens life further.
- **Consequence:** Bulk capacitance and ESR drift within the first year. That affects the U20 loop (A-17), modem brown-out margin (HD: ≥ 300 µF) and U25 transient response.
- **Fix:** C78, C130, C131 → **Lelon OVZ221M1CTR-0608 220 µF 16 V polymer, C881921** (same 6.3 × 7.7 can; 105 °C/2000 h, polymer ≈ ×10 per −20 °C, so > 100,000 h at 65 °C). C10 is removed by A-01; otherwise use a 105 °C ≥ 5000 h part. After the swap, re-check U20 compensation (A-17), because polymer ESR moves the ESR zero from ≈ 2.4 kHz to > 15 kHz.
- **Effort:** schematic-only (same footprints)
- **Confidence:** medium (lifetime model plus assumed local temperature). High on the part ratings.

### F-51 No charger-die or cell temperature reaches the MCU; the firmware thermal inhibit has no source on v6 (R4)
- **Severity:** Major
- **Block / refs:** §4-F (temperature sensors), §4-A (sensor ≤ 10 mm of U6); ECO §D2/§D3/§D5; lesson F5/F6; firmware `CHG_CELL_HOT_C 45 / CHG_CELL_COOL_C 40` ("TMP102 on the cell"); memory `drogheda-fan-policy` (thermalCtlTemp ignores the NTC), `drogheda-battery-hightemp`.
- **Evidence — every temperature source on v6:**

| Sensor | Ref / net | Position (mm) | MCU pin / ADC | Distance to U6 (187.0, 107.7) | Notes |
|---|---|---|---|---|---|
| Board air + RH | U3 SHT40-AD1B (I²C 0x44) | (122.4, 77.3) | PB6/PB7 I²C1 | **71.4 mm** | 52 mm from U19, 28.8 mm from U20 |
| MCU die | U16 internal | (120.7, 67.4) | ADC1_IN16 (TS_CAL1/2 used) | 77 mm | |
| External probe 1 | P7 NTC-HOTSPOT → `/NTC_TEMP`, R42 10 k to 3V3, C24 100 nF | (109.75, 44.0) | **PB1 = ADC1_IN9** | ~100 mm | jack only |
| External probe 2 | P8 NTC-PROBE-2 → `/NTC2`, R126 10 k to 3V3, C157 | (133.0, 44.0) | **PC4 = ADC1_IN14** | ~83 mm | jack only |
| Pack NTC | P3.3 → `/NTC` → **U6.17 only** (R55 10 k from VEH5V) | (196.0, 110.5) | **none** | — | LTC4040 window: hot pause **42.4 °C**, resume 40.1 °C, cold −3.1 °C (B3380); 39.7/37.9/0.6 °C (B3950) |
| Modem die | A7670SA internal (AT) | (174.3, 72.0) | USART6 (AT) | — | firmware-only (F-53) |
| Accelerometer | U26 SC7A20 (has a temperature output, low accuracy) | — | I²C | — | not a thermal sensor |
| TMP102 | **absent** (V5.x U4 and the V5.6 U18 TMP102 were deleted in v6 T10) | — | — | — | |

  - Free MCU ADC pin: only **PC5 (pad 25, ADC1_IN15)**. Free digital pins: PB10, PA9, PD2.
- **Consequence:** CHG_CELL_HOT/COOL (45/40 °C) have no cell sensor unless an installer tapes P7 to the pack. There is no charger-die visibility, so the A-02/H0008 cycling is invisible in telemetry. R4 is not met in firmware. (The cell is still protected in hardware by the LTC4040 NTC pause.)
- **Fix:**
  1. **Charger temperature:** TMP102AIDRLR **C99269** (SOT-563) placed between U6 and L6, ≤ 5 mm from the U6 EP, on I²C1 at **0x48** (ADD0 → GND; confirm the U10 SC16IS752 strap stays at 0x4D), with 100 nF C14663.
  2. **Cell temperature to the MCU:** tap `/NTC` into **PC5** through 100 k (top, C25803) / 120 k (bottom) + 10 nF. PC5 ≤ 0.545·5.46 V = 2.98 V. The 220 k load shifts the LTC4040 hot threshold by < 0.6 °C. Firmware computes Rntc = R55·Vntc/(VEH5V − Vntc), using PA4 for VEH5V; it is valid whenever VEH5V is present, which is when charging is possible.
  3. Firmware: `tchg`, `tcell` appended to `$PHLG`. The governor inhibits on tcell (Li-ion 45 °C / LFP 55–60 °C) and on tchg (e.g. > 85 °C shed).
- **Effort:** both (2 parts plus 3 passives; place the TMP102 in the A-02 re-cluster)
- **Confidence:** high

### A-10 No over-voltage protection on VEH5V now that the 5 V source is a non-isolated on-board buck
- **Severity:** Minor
- **Block / refs:** §4-A (input protection); LTC4040 p.11 (OVSNS); memory `drogheda-power-cost` ("galvanic isolation lost").
- **Evidence:**
  - U6.16 OVSNS is tied straight to `/VEH5V`, so the OVP feature is not used (datasheet: short OVSNS to VIN when OVP is not used).
  - A TPS54360B high-side short puts `/VIN_PROT` (24–36 V) on VEH5V. LTC4040 VIN abs max is 6 V steady / 7 V transient, and Q7 then passes it to MAIN5V → SYS5V → U17/U21/U12/U20.
  - V5 used the isolated SD-15B, so v6 adds this failure mode.
- **Consequence:** A low-probability single-point failure destroys the whole board (F9P $85, modem, MCU).
- **Fix (pick one):** (a) use the LTC4040 OVP arrangement per the datasheet OVP application: OVSNS through 6.2 kΩ from the U25 output node, plus the series N-FET (≥ 40 V V_DS) the application shows. Verify the topology against the datasheet figure before committing. (b) Minimum: a 1.5 kW 5 V TVS (SMCJ5.0A class) on VEH5V as a crowbar that forces F2 open. This is imperfect, because VEH5V can exceed 7 V for the fuse's melt time.
- **Effort:** schematic + small layout
- **Confidence:** medium (topology of the datasheet OVP figure not fully extracted)

### A-11 CHGOFF (PA8) has a pull-DOWN: the charger runs at full programmed current whenever the MCU is not driving the pin
- **Severity:** Minor
- **Block / refs:** §4-A (EN default states); LTC4040 p.10 ("CHGOFF: GND = enable, > 1.2 V = disable"); firmware line 356 ("HIGH = charge OFF").
- **Evidence:** R56 100 k from `/CHRG_EN` to GND. During MCU reset, DFU, boot and unflashed boards, CHGOFF = 0, so the charger is enabled with no governor or thermal inhibit (2.42 A with R50 as-is). This contradicts the board's own policy that MODEM_EN (R113) and PWR_CTRL default OFF while the MCU is not in control.
- **Consequence:** An uncontrolled charge during DFU or boot loops. It is bounded by the LTC4040 input limit and NTC window, so there is no damage.
- **Fix:** R56 → 100 k from `/CHRG_EN` to **/3V3** (C25803, same footprint re-netted), so the default is charge OFF. On battery the charger is inactive anyway.
- **Effort:** schematic + one-track layout
- **Confidence:** high

### A-12 Q5 base floats during MCU reset: the F9P rail (Q1/U21) is not guaranteed OFF
- **Severity:** Minor
- **Block / refs:** §4-A (EN defaults); firmware "PWR_CTRL LOW = stack OFF".
- **Evidence:** `/BASE_LS` = {R1.2, Q5.1} only; `/PWR_CTRL` = {U16.15, R1.1}. The STM32 pins are floating inputs during reset. Datasheet-max pin leakage (1 µA) × hFE ≈ 100–300 µA into R2 10 k gives 1–3 V Vgs on the AO3401A, so partial turn-on is possible (typical leakage is nA, so it is benign in practice).
- **Fix:** add 47 k 0603 from `/BASE_LS` to GND (Basic 0603 1 %).
- **Effort:** schematic + small layout
- **Confidence:** medium

### A-13 PFO goes only to TP2 (and CLPROG only to TP1): no hardware power-fail interrupt to the MCU
- **Severity:** Minor
- **Block / refs:** §4-A (CHRG/FAULT/PFO); LTC4040 p.11.
- **Evidence:** `/PFO_TP` = {U6.20, TP2}. Firmware detects backup by polling 5V_SENSE (V5_OFF 3.80 V), but the LTC4040 has already switched to backup at PFI 4.40 V. `/CLPROG_TP` = {U6.3, TP1}: this is the VSYS current monitor, V = 32·(VIN − CLN), i.e. 0.8 V at the 2.5 A limit.
- **Consequence:** Tens of ms late on backup entry, and the firmware cannot shed the modem/K1/W5500 before the boost takes the full load. Input current is not measurable in telemetry.
- **Fix:** route `/PFO` to **PB10 (pad 29, EXTI10)** with 100 k to /3V3 (3V3 stays up on battery). Optional: CLPROG → an ADC pin through 1 MΩ (datasheet recommends isolation, PROG-side ≤ 40 pF). No ADC pin is left if F-51 takes PC5, so CLPROG is a Note.
- **Effort:** schematic + layout (two tracks)
- **Confidence:** high

### A-14 BSTFB divider 21–24 mm from U6 (feedback net 41 mm, 5 vias, cutting In1 under U6); IGATE 43 mm unguarded
- **Severity:** Minor
- **Block / refs:** §4-A (BSTFB); LTC4040 layout p.22–23 (guard IGATE with VSYS copper).
- **Evidence:** R53.2 → U6.18 **21.4 mm** edge, R54.1 **24.0 mm**. `/VFB_BST` is F.Cu 16.8 mm + In1 24.4 mm with 5 vias; 7 of its In1 segments lie inside a 6 mm radius of U6, splitting In1. `/IGATE` is F.Cu 6.0 mm + In1 37.0 mm, with Q7.4 ↔ U6.15 at 23.2 mm. The IGATE charge pump has µA-class drive, so leakage in a humid port box can partially enhance Q7. Its body diode at 2.5 A dissipates ≈ 1.2 W.
- **Fix:** R53/R54 ≤ 3 mm from pins 18/10, with the top leg Kelvin-tapped at the CSYS pads and the net on F.Cu. Q7 ≤ 5 mm from U6.15 with IGATE ≤ 8 mm on F.Cu, flanked by MAIN5V copper.
- **Effort:** layout
- **Confidence:** high (geometry). Medium (consequence).

### A-15 U25 footprint carries a second property `LCSC Part` = C2071691 (AP64350, pin-compatible)
- **Severity:** Minor
- **Block / refs:** §4-H cross-ref; `sch_pcb_sync.md`; INDEX gotcha 7.
- **Evidence:** U25 `LCSC` = C524806 (TPS54360B), `LCSC Part` = C2071691. The TPS54360B pinout (1 BOOT, 2 VIN, 3 EN, 4 RT/CLK, 5 FB, 6 COMP, 7 GND, 8 SW) is **identical** to the AP64350 pinout. If a BOM tool picks `LCSC Part`, the boards assemble and run, but with a **42 V-rated** part behind a 53 V clamp and the wrong compensation. That is a latent field failure nobody would notice at test.
- **Fix:** delete the `LCSC Part` property from U25 (PCB and schematic).
- **Effort:** schematic-only
- **Confidence:** high

### F-52 Modem temperature: no on-board sensor near U19 (ECO D3 dropped)
- **Severity:** Minor
- **Block / refs:** §4-F; ECO §D3 (TMP102 #2 at the modem); R4.
- **Evidence:** The nearest board sensor to U19 is U3 at 52.1 mm. The only modem temperature path is AT over USART6. SIMCom A76xx has `AT+CPMUTEMP`; availability on A7670SA firmware is not verified. That path also works only while the modem is powered and responsive.
- **Fix:** either firmware-only (poll `AT+CPMUTEMP` into a `$PHLG` `tmodem` field) or a second TMP102 C99269 at **0x49** (ADD0 → 3V3) between U19 and U20. The latter is cheap and independent of modem state.
- **Effort:** firmware-only, or schematic + layout
- **Confidence:** medium

### A-16 U25 EN/UVLO divider DNP: U25 runs from 4.1–4.3 V
- **Severity:** Note
- **Evidence:** R124 523 k / R125 84.5 k DNP. EN floats (1.2 µA pull-up), so the internal UVLO is 4.1–4.3 V rising with 325 mV hysteresis. Populating them gives a start of ≈ 8.0 V and a stop of ≈ 5.5 V (TI equations with Ip 1.2 µA, Ih 3.4 µA). Between ≈ 4.3 V and 5.8 V input, VEH5V sits in dropout inside the PFI band (4.27–4.66 V), so the LTC4040 toggles backup (hysteresis 0.11 V). This only matters for 12 V vehicles under crank.
- **Fix (optional):** populate R124 523 k/1 % and R125 84.5 k/1 % (Basic 0603, pick LCSC in sourcing) if 12 V machines are in scope.
- **Effort:** schematic-only
- **Confidence:** medium

### A-17 U20 compensation is the AP64350 5 V table set (14 k / 3.3 nF / 47 pF, 500 kHz) applied at 3.8 V
- **Severity:** Note
- **Block / refs:** §4-A; V5.6 change report §6.1; Review §4 #14.
- **Evidence:**
  - Output network: L20 4.7 µH, C132 22 µF/16 V 0805 (≈ 10–12 µF effective at 3.8 V), C133 1 µF, plus C130/C131 2 × 220 µF aluminium at 13–21 mm (ESR ≈ 0.15 Ω pair, assumed).
  - Datasheet: fc = R5/(4.67e3·VOUT·COUT).
    - Bulk-dominated (455 µF): fc ≈ 1.7 kHz. Phase is about −90° (integrator) −84° (fp ≈ 184 Hz) +27° (zero at 3.44 kHz) +36° (electrolytic ESR zero ≈ 2.4 kHz), so **PM ≈ 69°**.
    - Ceramic-only: fc ≈ 50 kHz ≈ fSW/10 (the guideline edge).
  - With polymer bulk (A-09) the ESR zero moves above 15 kHz and PM falls to ≈ 40°.
- **Fix:** if A-09 goes ahead, set R116 = 10 k (keep C141 3.3 nF, C142 47 pF) and verify with a 0.1 → 2 A load step at VIN 4.4 V and 5.3 V. Otherwise bench-verify the current values.
- **Effort:** schematic-only
- **Confidence:** low-medium (estimate). Raise it with a Bode plot or load step.

### A-18 U25 compensation is the TPS54360B datasheet example (13 k / 6.8 nF / 39 pF), designed for 8.2 µH + 58 µF
- **Severity:** Note
- **Evidence:**
  - v6 has 10 µH, C153/C154 2 × 47 µF X7R (≈ 56 µF effective), C78 220 µF aluminium, and ≈ 70 µF effective downstream (C30/C31, C32–C34 through RS1 + Q7, ≈ 20 mΩ).
  - fco = R4·gmps·Vref·gmea/(2π·Cout·Vout) ≈ 43.7/(2π·Cout·5.3): ≈ 4–6 kHz with the bulk counted, ≈ 22 kHz ceramic-only. The compensation zero is at 1.8 kHz, and PM estimates > 60° in both cases.
  - Stable, but a slower load step: ≈ 0.16 V dip for 1.8 A, relevant if A-01 Option A moves the modem onto VEH5V.
- **Fix:** none required. Optionally raise R123 to 24 k after A-01/A-09 to restore ≈ 10 kHz. Bench-verify with a 0.3 → 2.5 A step.
- **Effort:** schematic-only (optional)
- **Confidence:** medium

### A-19 Load-dump survivability of D10 SMBJ33A / D32 SMCJ33A depends on vehicle-level suppression
- **Severity:** Note
- **Evidence:**
  - SMCJ33A: VBR 36.7 V min, VC 53.3 V @ 28.1 A. SMBJ33A: VC 53.3 V @ 11.3 A.
  - Adequate for continuous 24 V systems (≤ 32 V), for the ISO 16750-2 36 V/60 min overvoltage test (below VBR min), and for ISO 7637-2 fast pulses behind the U25 65 V rating.
  - Not adequate for an ISO 16750-2 Test B suppressed load dump (24 V: Us* ≤ 58 V, 100–350 ms, Ri 1–8 Ω, i.e. ≈ 10 A for 350 ms, hundreds of J): the TVS would fail short. After A-01, F2 then opens. The alternative is a surge stopper, which is out of scope.
- **Fix:** confirm the fleet has alternator load-dump suppression (Inputs needed). Keep SMCJ33A. Do not raise the TVS voltage, because U25 has 65 V abs max.
- **Effort:** none / decision
- **Confidence:** medium

### A-20 Other power items
- **Severity:** Note
- **Evidence / fix:**
  - (a) **U12 MP1584EN** (C15051, $2.21 @100, TA −20…+85 °C): if not replaced, gate EN (A-05). Optional swap to AP64350 C2071691 ($0.58, VIN 3.8 V min, synchronous, better battery margin; needs a re-layout for pinout).
  - (b) **F1 PPTC 3 A** (C20627123, 10–60 mΩ, trip 5 A) now protects only the F9P LDO branch (≈ 0.1 A). It is harmless (≤ 6 mV) and not protective. The V5.6 "≥ 4 A low-R" requirement was for the modem, which is no longer behind it. Keep it.
  - (c) **P2 bench jack** has no reverse protection (VEH5V −0.3 V abs max). A bench-only risk, which the silkscreen should state.
  - (d) **JP_CUT across P5 (V5.6 JP6) is absent.** Harness auditor G owns it.
  - (e) **C22 value mismatch:** the schematic says "22uF/50V" but LCSC C138687 is 10 µF/50 V (moot if U2 is removed; BOM auditor H).
  - (f) **K1 G5V-1:** operating range −40…+70 °C, which is close to the enclosure worst case.
  - (g) **R112 1 k VBAT_MODEM bleeder:** 3.8 mA / 14 mW while the modem is on. Fine.
- **Effort:** —
- **Confidence:** high

### F-53 Fan block
- **Severity:** Note
- **Evidence:**
  - Driver: U2 MP1584 from /24V, 5V_FAN = 0.8·(1 + 100/19.1) = **4.99 V** (4.76–5.23 V).
  - FB divider R20/R21 at **0.67/1.48 mm** from U2.4 and `/FB_FAN` 4.1 mm, so ECO E3 is fixed.
  - PWM: PA6 (TIM3_CH1) → Rg1 100 Ω → Q2 AO3400A low side, with Rgs1 100 k gate pull-down (**default OFF** ✅) and D2 SS34 flyback ✅.
  - 2-wire fan, no tach (`ENABLE_FAN_TACH 0`, a decision). Fan dark on battery by design (ECO D4).
  - U2 is out-of-rating on the 24 V bus (A-01) and its Cin is 17–21 mm away (A-06).
- **Fix:** take A-01 fix 1 (fan from VEH5V via a bridged JP1, U2 block DNP). Firmware policy `vehiclePower && ignitionOn` is unchanged, and the fan supply then equals `vehiclePower` exactly. Add `tNtcC` to `thermalCtlTemp()` (memory `drogheda-fan-policy`).
- **Effort:** schematic-only (with A-01)
- **Confidence:** high

## Pass checks
| Check | Evidence (one line) | Result |
|---|---|---|
| U25 output formula / tolerance | 0.8·(1 + 53.6/10.2) = 5.004 V; Vref 0.792–0.808 → 4.87–5.14 V | ✅ math / ❌ set-point (A-04) |
| U25 RT / fsw / min on-time | 162 k → 600 kHz (TI eq.); tON at 36 V = 0.147/600 k = 244 ns ≥ 135 ns | ✅ |
| U25 inductor | 10 µH ≥ Lmin 7.2 µH (36 V) / 7.7 µH (60 V), KIND 0.3; SRP1265A Isat 15.5 A, Irms 10 A vs peak 3.1–3.4 A | ✅ |
| U25 current capability | load ≤ RS1 limit 2.14–2.41 A (+0.3 A fan with A-01) vs 3.5 A rating, 4.5 A min switch limit | ✅ |
| U25 Cout / ripple | 2 × 47 µF X7R 1210 (≈ 56 µF eff) + 220 µF; ΔI 0.69 A @ 24 V, ΔV ≈ 3 mV | ✅ (life ❌ A-09) |
| U25 compensation | datasheet example; fco ≈ 4–6 kHz, PM > 60° (estimate) | ✅ (A-18 Note) |
| U25 BOOT cap | C152 100 nF, 1.49 mm edge to pins 1/8 | ✅ |
| U25 Cin value | 2 × 2.2 µF/100 V X7R 1210 ≈ 3.4–3.8 µF eff at 24–36 V ≥ TI 3 µF | ✅ (placement A-06) |
| U25 soft start / inrush | 1024/600 kHz = 1.7 ms; ≈ 0.9 A into ≈ 280 µF | ✅ |
| U25 EN / UVLO | EN floats → on; internal UVLO 4.1–4.3 V | ✅ (A-16 Note) |
| Reverse polarity Q23 (and Q10) | P-FET D→input, S→load, gate R119 100 k + D33 15 V clamp (Rrp1 10 k + DzG1); IRFR5305 −55 V/65 mΩ | ✅ |
| DzG1 netlisted (V5 corruption) | DzG1.1 /Q10_GATE, .3 /24V | ✅ |
| TVS standoff | D32 SMCJ33A / D10 SMBJ33A VRWM 33 V ≥ 32 V max 24 V system; polarity pad 1 = K on the + rail | ✅ (A-19) |
| F2 part assigned | C206910 0154002.DR 2 A/125 V, 50 A breaking | ✅ part / ❌ coverage (A-01) |
| RS1 input limit | 10 mΩ 1 W 1206 (C105362): 23.5–26.5 mV → 2.35–2.65 A (2.14–2.41 A with the CLN tap, A-07) < U25 3.5 A | ✅ |
| LTC4040 PROG node | R50 1.26 mm from pin 2; `/PROG` 2.6 mm (≤ 40 pF) | ✅ |
| LTC4040 BSTFB (backup VSYS) | 499 k/100 k → 4.60/4.79/4.99 V within 3.5–5.0 V; keep 499 k | ✅ (placement A-14) |
| LTC4040 PFI | 270 k/100 k, 1.19 V: fall 4.27/4.40/4.54, rise 4.38/4.51/4.66 V | ✅ (FW V5_PFI stale) |
| LTC4040 RSTFB / RST | RSTFB tied to BSTFB (datasheet allows), RST NC | ✅ |
| LTC4040 OVSNS | tied to VIN → OVP unused | ⚠ (A-10) |
| NTC window RNTB | R55 10 k: hot 42.4 °C / resume 40.1 °C / cold −3.1 °C (B3380) | ⚠ (chemistry D1 pending) |
| Chemistry straps | JP2 1-2 (F2 = MAIN5V = Li-ion), JP3 F1 = 0, JP4 F0 = 1 → 4.00 V; LFP by JP2 2-3 (+ RNTB 5.6 k → +10.0…+60.4 °C) | ✅ |
| Safety timer | Li-ion 4.25 h (3.7–5 h), counts in CV only | ✅ |
| CHRG / FAULT | R57/R58 100 k to 3V3 → PB3/PB4 | ✅ |
| CHGOFF default | R56 100 k pull-down → charger ON without MCU | ⚠ (A-11) |
| BSTOFF | tied to GND → boost always armed (no FW shutdown; BAT UVLO 2.45 V is the only floor) | ✅ / Note |
| Q7 ideal-diode orientation | AO4406A N-ch: S = VIN_SW (CLN), D = MAIN5V → body diode blocks VSYS→VIN | ✅ |
| L6 | 2.2 µH (datasheet 1–2.2 µH), rated 8 A ≥ ILIMBST max 7.5 A | ✅ (placement ❌ A-02) |
| CSYS | 104 µF nominal ≥ 100 µF; ≈ 59 µF effective | ⚠ (A-05) |
| CBAT | C35 22 µF ≥ 10 µF | ✅ value / ⚠ placement |
| U20 FB | 75 k/20 k → 3.70/3.80/3.90 V within A7670 3.4–4.2 V | ✅ |
| U20 RT / min on-time | 200 k → 500 kHz (450–550); tON at 36 V = 211 ns ≥ 100 ns | ✅ |
| U20 UVLO on battery | falling ≈ 3.1–3.3 V vs VIN_MODEM ≥ 4.2 V (≈ 1 V margin; V5.5 had 0.1 V) | ✅ |
| U20 EN default | R113 100 k vs 5.5 µA pull-up → 0.55 V < 1.03 V → OFF; PC10 3.3 V > 1.25 V | ✅ |
| U20 BST | C129 100 nF, 1.8 mm | ✅ |
| L20 | 4.7 µH (MWSA0804S-4R7), rated 5 A vs peak 2.2 A (batt) / 2.7 A (24 V) | ✅ |
| U2 FB / placement | 4.99 V; divider at pin (0.67/1.48 mm) | ✅ (rating ❌ A-01, Cin ❌ A-06) |
| U12 FB | 100 k/31.6 k → 3.18/3.33/3.48 V | ✅ (EN ❌ A-05, loop ❌ A-06) |
| U21 AP2112K | dropout 250 mV @ 600 mA; F9P ≈ 0.1 A; SW_5V ≥ 4.5 V on battery; EN = VIN follows Q1 | ✅ |
| U17 AMS1117 on 24 V | LDO_IN ≈ 4.6 V ≥ 4.4 V | ✅ (battery ❌ A-08) |
| DFU-only power | DFU_VBUS → D13 → LDO_IN; D12 blocks back-feed into SYS5V | ✅ |
| K1 flyback | D6 1N4148W across the coil | ✅ |
| Temperature sensor ≤ 10 mm of U6 | none (U3 at 71.4 mm) | ❌ (F-51) |
| Fan PWM default | Rgs1 100 k → Q2 OFF at reset | ✅ |

## Review-vs-Lessons §4 checklist items re-verified
- **#1 LTC4040 copper + thermal vias + re-cluster (F5):** still ❌. `/SW_BAT` is now 0.5 mm (was 0.25 mm on 25-Sep) × 11.9 mm with 0.25/0.30 mm necks. `/BAT_PLUS` main path 1.0 mm. EP 0 vias (nearest 5.21 mm). L6 8.65–9.10 mm edge. C30/C31 6.2–7.2 mm. CSYS GND on three F.Cu islands. → A-02.
- **#2 U25 set-point (F7):** still ❌. R121 53.6 k → 5.00 V (4.87–5.14 V). Re-cluster status: C150 2.88 mm (improved), C149 6.37 mm, D34 4.28 mm, L22 17.0 mm (edge), Cin/diode GND on different islands. → A-04, A-06.
- **#3 R50 (F4):** still ❌ 825 Ω. Also, 1.5 k only meets R5 nominally; 1.43 k is recommended. → A-03.
- **#4 Modem rail integrity on battery (power parts):** U20 Cin is still C127 10 µF + C128 1 µF (no 2 × 22 µF) ⚠. `/VIN_MODEM` 0.5/0.8 mm (D21 → U20 5.8 mm at 0.5 mm) ⚠. VBAT_MODEM bulk C130/C131 at 13.2/20.9 mm from L20 on 2 mm copper (improved from 0.25/0.5 mm; modem auditor owns U19-side distances). D21 drop and boost budget → A-05. Topology → A-01.
- **#5 Temperature sensor at the charger:** still ❌. → F-51.
- **#6 W5500 in reset / U12 EN:** U12 EN still tied to VIN (always on, including on battery) ❌. → A-05 fix 1. (ETH_RST pull-down belongs to E.)
- **#8 NTC window / chemistry:** unchanged ⚠ (R55 10 k, JP2 Li-ion). Decision D1 pending; BOM-only change.
- **#10 F1 / F2:** F2 LCSC now assigned (C206910) ✅, but it protects only the U25 branch ❌ (A-01). F1 3 A PPTC is harmless (A-20b).
- **#14 AP64350 compensation vs datasheet:** evaluated. It is the 5 V table set; the estimate is stable with electrolytic bulk and marginal with polymer. → A-17.
- **"Switcher EP vias (U20, U25): 0"** (Review §2): still 0 on U20, U25, U2, U12 and U6. → A-06, A-02.
- **#15 Bench validation (power parts):** still required: U6/L6 IR at 1.4 A charge and 2.3 A backup; U20 VIN scope during a battery cold start at VBAT 3.5 V; D34/U25 IR at full load.

### V5.6 power / charger / temperature fixes vs v6
| V5.6 fix (ECO / change report) | v6 status |
|---|---|
| A: modem buck AP64350 with MCU EN + 100 k pull-down | **equivalent** (U20, PC10, R113); fed from /24V + MAIN5V instead of SYS5V → A-01 |
| A: Cin 2 × 22 µF + 10 µF at the modem buck | **missing** (10 µF + 1 µF) → A-05 |
| A: 220 µF polymer output | **missing** (2 × 220 µF 85 °C aluminium) → A-09 |
| A: L 4.7 µH ≥ 4 A | **has** (L20 4.7 µH/5 A, C17700167) |
| A: C3 → 220 µF polymer (F9P rail) | **equivalent / not needed** (F9P behind the U21 LDO; C3 47 µF 105 °C + C40 + C119) |
| A: R53 stays 499 k | **has** |
| A (opt): U12 → AP64350 | **missing** (optional) → A-20a; U12 EN gating → A-05 |
| C: RS1 10 mΩ | **has** (C105362) |
| C: R50 1.5 k | **missing** (825 Ω) → A-03 (1.43 k) |
| D1: RNTB / JP2 per chemistry | **unchanged**, pending decision |
| D2 / E1 / E2: SW_BAT ≥ 2 mm, BAT_PLUS ≥ 1.5 mm, EP ≥ 9 vias | **missing** → A-02 |
| D3: TMP102 near the modem | **missing** → F-52 (AT alternative) |
| (V5.x U4 TMP102 "cell") | **removed in v6**, no replacement → F-51 |
| D4: fan unchanged | **has**; E3 FB divider at pin **fixed** |
| D5: NTC probe to PB1 | **has** (P7 → PB1) + second probe P8 → PC4 |
| E4: buck Cin loops < 3 mm | **missing / worse** (U2 17–21 mm; U12 6.4 mm; U25 GND islands) → A-06 |
| F: F1 ≥ 4 A low-R | **equivalent / not needed** (modem not behind F1) |
| F: JP_CUT across the cutoff | **missing** (owner G) |

## Requirements input R1–R5
- **R1 (10 min off → wake → report on battery):** **needs change A-05 (+ A-08) plus firmware.** The hardware structure is right (independent PWR_CTRL / MODEM_PWR_EN, U20 UVLO margin ≈ 1 V). As-is, the boost reaches 93–97 % at a GSM burst with all loads on, W5500 cannot be powered off, and the AMS1117 floor eats the sleep budget.
- **R2 (modem never dark; MCU can power-cycle it):** **satisfied as-is** for the power side (U20 EN on PC10 with pull-down, UVLO margin, the modem can be power-cycled alone). A-01 changes the U20 input source but not the control.
- **R3 (report while on battery):** **needs change A-05 plus firmware** (same budget as R1). Also A-13 (PFO interrupt) for fast load shedding.
- **R4 (temperature management):** **needs change F-51** (charger TMP102 plus pack NTC to PC5), plus firmware. Fan: satisfied, and simplified by A-01 fix 1 (F-53).
- **R5 (charge ≥ 1.3 A without thermal cycling):** **needs A-03 (R50 1.43 k) + A-02 (copper/vias) + A-04 (R121 57.6 k or firmware retune).** A-07 is recommended.

## Firmware implications (things board_v6.h / FW 0.7.x must do)
1. **Pins (power-related):**
   - Unchanged: `PIN_CHRG_EN PA8` (HIGH = charge OFF; polarity unchanged by A-11, only the reset default becomes OFF), `PIN_CHRG_STAT PB3`, `PIN_CHRG_FAULT PB4`, `5V_SENSE PA4` (÷2), `BAT_SENSE PA0` (÷2), `NTC_TEMP PB1`, `NTC2 PC4`, `PWR_CTRL PA1`, `MODEM_PWR_EN PC10`, `BYP_CTRL PB5`.
   - New, if the fixes are taken: `PIN_ETH_PWR_EN PD2` (A-05), `PIN_PFO PB10` EXTI falling (A-13), `NTC_CELL PC5` ADC1_IN15, ratio 120/220 (F-51), TMP102 charger sensor at 0x48 (F-51), optional modem TMP102 at 0x49 (F-52).
2. **Constants:**
   - `V5_PFI` 4.60 → **4.40 V** (falling; rising 4.51 V).
   - With R121 57.6 k, keep `CHG_RAIL_ON 5.05` / `CHG_RAIL_OFF 4.90`. If R121 stays 53.6 k, the governor must be retuned (ON ≤ 4.80 V is not possible with PFI rising max 4.66 V and ADC error), so the hardware change is preferred.
   - The v6 supply cannot fold (RS1 2.14–2.41 A < U25 4.5 A min limit): the governor is a safety net only.
3. **ADC:** compute VDDA every window from VREFINT (`VREFINT_CAL` @ 0x1FFF7A2A). Never assume 3.30 V, especially on battery (A-08).
4. **Thermal inhibit:** CHG_CELL_HOT/COOL on `tcell` from PC5 (Li-ion 45/40 °C; LFP 55–60 °C). Shed on `tchg` > 85 °C from the new TMP102. Append `tchg`, `tcell`, `tmodem` to `$PHLG`. Include the NTC in `thermalCtlTemp()`.
5. **Backup entry (PFO EXTI or 5V_SENSE < V5_OFF):**
   - Immediately `ETH_PWR_EN` = 0 (or hold ETH_RST low if not fitted).
   - `BYP_CTRL` = 0 except inside the TX window.
   - Modem to **LTE-only on battery** (`AT+CNMP=38`) to avoid 2 A GSM bursts.
6. **Duty window (R1/R3):**
   - Never start the modem with W5500, K1 and the F9P acquiring simultaneously.
   - Order: modem EN → PWRKEY → wait STATUS (~7 s) and first RTCM on PC7, with the F9P OFF or already settled ≥ 4 s. Then the F9P for a hot fix. Then ≥ 2 `$PHLG` → modem OFF → F9P OFF → MCU STOP (LSE RTC).
   - Refuse a modem cold start below VBAT ≈ 3.4 V: the boost's 2.5 A rating holds only down to 3.2 V.
7. **Low battery:** BSTOFF is hard-wired to GND, so firmware cannot switch the boost off. At `VBAT_BACKUP_MIN` go to STOP with every load off. The hardware floor is only LTC4040 BAT UVLO 2.45 V plus the pack PCM.
8. **Fan:** if the fan moves to VEH5V (A-01), the fan exists exactly when `vehiclePower`. The policy stays as is, and the ignition proxy becomes optional.
9. **Charger status:** "pausa NTC" = CHRG low ∧ FAULT low (datasheet table p.14). Bad battery = CHRG high ∧ FAULT low.

## Inputs needed from Leo
1. Supply systems in the fleet: 24 V only, or 12 V machines too? This sets F2 at 3 A vs 4 A, the U25 UVLO (A-16), and whether 9 V operation matters. Do the machines have alternator load-dump suppression (A-19)?
2. The fan part (5 V, 2-wire) and its current. Assumed 0.2–0.3 A for the VEH5V feed (A-01).
3. **Decision on A-01 Option A** (modem buck from MAIN5V only, D20 removed, D21 bridged) versus Option B (keep the 24 V feed with a ≥ 60 V buck). Coordinate with the modem auditor.
4. Pack details: capacity (Ah), PCM cut-off voltage, NTC β (B3380 vs B3950), and the chemistry decision D1.
5. Is GSM/2G fallback required on battery, or is LTE-only acceptable? This sets the backup peak (A-05).
6. Must Ethernet work on battery? Assumed no, so U12 is gated.
7. Enclosure internal temperature at 45 °C ambient. Assumed 60–65 °C local near the regulators, for electrolytic life (A-09) and U6/D34 thermals.
8. Bench data from the H0008 "Pendientes": clamp-meter charge current and U6/L6 temperature. This confirms or refutes OT cycling (A-02/A-03).