--- title: EINARBoard HBOX 1.0 — Pre-Fabrication Design Audit tags: [project-drogheda, hardware, watchdog, pcb, audit, einarboard] project: Project Drogheda author: Helgen CTO (Claude audit, reviewed by Leo) date: 2026-07-06 status: BLOCKING — do NOT order until HIGH items are cleared --- # EINARBoard HBOX 1.0 (`hbox-watchdog-v3-PROD`) — Pre-Fab Audit **Scope:** read-only audit of the KiCad project as of 2026-07-06 17:14 (PCB saved 17:06, fab package `production/` regenerated 17:14). Board = 135 × 100 mm, 4-layer (F / In1-GND / In2 / B), 132 components, 1317 tracks, 130 nets. Sources checked against: LTC4040 datasheet (ADI 4040fb), Omron G5V-1 datasheet, ArduSimple 4G NTRIP Master pinout diagram (footprint-R00), AOS AO4406A pinout, today's IPC-D-356 netlist, ERC/DRC runs, and the canonical repo docs. **Verdict: the architecture is right and most of the execution is verified-correct, but there are 4 HIGH findings — 3 of them silent board-killers — that must be fixed before ordering. Estimated fix effort: one KiCad session (~2–4 h) + re-export.** --- ## 1. HIGH — fix before ordering ### H1. Q7 (LTC4040 input pass-FET) is installed backwards - **Board:** Q7 AO4406A source (pads 1–3) = `MAIN5V` (VSYS), drain (pads 5–8) = `VIN_SW` (CLN). - **Datasheet:** the mandatory input FET disconnects the system from the input during backup; with the OVP FET the pair is common-source at VIN (OVSNS text: the OVP FET's *drain* faces the input connector). Correct single-FET orientation = **source on the VIN/CLN side, drain on VSYS** (body diode conducts VIN→VSYS at startup, blocks VSYS→VIN in backup). - **As built:** body diode points MAIN5V→VIN_SW, so during a power-fail event the boost output back-feeds the dead vehicle rail through the body diode — the input can never be disconnected; backup collapses / pack drains into the SD-15B-05 output. **It will look fine on the bench in normal mode and fail exactly at the moment the battery backup is needed.** - **Fix:** swap S↔D on Q7 in the schematic (MAIN5V ↔ VIN_SW), resync, reroute locally. ### H2. Q5 / Q6 (MMBT3904) have collector/emitter swapped — BCE symbol on a BEC part - Symbols are `Device:Q_NPN_BCE` (1=B, 2=C, 3=E) on generic `SOT-23` footprints, but the MMBT3904 SOT-23 is physically **1=B, 2=E, 3=C**. - Result: Q5 (RTK load-switch driver, pad2=`GATE_LS`) and Q6 (K1 relay driver, pad2=`KCOIL`) operate in reverse-active mode (β ≈ 2–10). Q6 likely **cannot sink the 30 mA coil current → K1 never energizes → Modo B injection dead** (corrections survive via the NC bypass — the fail-safe does its job). Q5 may *appear* to work (10 k pull-up is easy to overcome) but with degraded VOL, unit-to-unit variation, and ~5 V reverse E-B stress (BVebo = 6 V abs max). - **Fix:** replace both with `Q_NPN_BEC` (or re-map pins), resync, reroute. SOT-23 rework is trivial. ### H3. RIG (ignition sense) — value drift + dangling schematic pin (the 1 ERC error) - **Schematic:** Rig = **22 k** — correct for the *current* topology (DFR1015 was removed; GX16 pin 3 raw 12–24 V now feeds Rig 22k / Rigb 10k divider + D5 BAT54 clamp to 3V3 + C9 → PA5). - **PCB + both fab BOMs:** Rig = **100 R** (stale, from the old DFR1015→5 V design). If assembled as 100 R: ≈ 200 mA through the BAT54 clamp at 24 V ignition (~0.5 W in an 0603) → **D5 and Rig burn, ignition sense dead**, possible PA5 damage. - **Schematic wire bug:** Rig pin 2 (36.83, 74.93) does not terminate on the IGN_SENSE wire — the wire passes *through* the pin (73.66→76.2) without a junction. This is the single ERC error and means sch↔PCB sync is no longer provable; any future netlist push would also break. - **Fix:** terminate the wire on the pin, set the PCB value to 22k, regenerate BOM/CPL. ### H4. `SW_IN` routed entirely at 0.2 mm — full RTK-stack current on an 8-mil trace - `SW_IN` (F1 PPTC → Q1 source) is **missing from the netclass patterns**, so the USB autoroute pass laid it at the Default 0.2 mm — 18 segments, ~46 mm total, carrying ~1.2 A continuous (F9P + modem via U7) and up to ~3 A+ during PPTC fault ride-through. Expect large temperature rise / voltage drop right at the stack's supply. - Also audit `VEH5V`: several long 0.2 mm runs on B.Cu (20–30 mm). The main P2→RS1→U6 path is 1.5 mm, and the thin runs appear to be the JP1 / sense branches — verify none of them is the only path for load current. - **Fix:** add `SW_IN` (pattern) to PWR_HI, reroute F1→Q1 at ≥1.0–1.5 mm, re-check VEH5V. --- ## 2. MEDIUM — decide/verify before or at ordering - **M1. Fab BOM/CPL are not assembly-ready.** No LCSC part numbers anywhere; DNP parts (P3, P13, H3) carry "(DNP)" only in the Value text — no DNP attribute — and appear in BOM *and* CPL; CPL also lists THT sockets and the MOD1 pseudo-footprint. Fine for a **bare-board** order; blocks a JLCPCB **PCBA** order. (QFN-24 + DFN + SOT-563 + USB-C by hand is doable but unpleasant — decide which path you're buying.) - **M2. Your own fab gate is unmet.** The declared gate was "bench-validate the LTC4040 backup + hot-cell charge cutoff on the proto first" — the proto validates the *concept* with TP4056, not the LTC4040 circuit. Bare boards are cheap, so ordering after H1 is a defensible risk — but make that call consciously; don't discover LTC4040 issues on 30 assembled units. - **M3. D0/D1 (and D2/D8) direction on a physical simpleRTK2B Pro is still unverified** (your own open item since Jul-2). Board: MOD1 D1=`GNSS_TX` (PA2 MCU-TX), D0=`GNSS_RX` (PA3). If the Pro's D0/D1 are the opposite direction, the GNSS UART is dead with no socket-level rework. 10-minute check against the Pro before ordering. - **M4. Mechanical fit not evidenced.** Board grew 120×100 → **135×100** on Jul-3; the "placement review vs HBOX/cabinet mechanicals" gate has no record. Verify HBOX interior, standoff positions (MH1–4: 3.2 mm, 4–5 mm edge margins), connector clearances (P1 terminal block + USB-C + JST heights under the shield) before committing. - **M5. USB routing is functional-grade, not compliant-grade.** DP/DM routed as independent 0.2 mm traces on *different* layers (DP: F/In1, DM: B/In1), no diff-pair spacing, several segments ON the In1 GND plane (local plane cuts), no ESD array on the port. For a service console at Full-Speed it will almost certainly work; don't expect more. Next spin: route as a pair on one layer, add USBLC6-type ESD. - **M6. Two fab packages in the tree** — `fab-jlc-usb/` (14:41) is superseded by `production/` (17:14, includes the title-block change). Delete or archive the stale one so nobody orders it. --- ## 3. LOW — cosmetic / next spin - L1. ERC: 95 warnings — ~90 off-grid pin/wire (your own TODO), plus lib-cache drift (`Q_NPN_BCE` not found, `L` and `AO4406A` mismatch vs library). Fixing H2 touches these anyway. - L2. DRC: 0 errors, 9 warnings — all lib_footprint mismatches (local overrides) on JST/Phoenix/ SHT4x/MountingHole. Benign. Note `missing_courtyard` and `track_not_centered_on_via` are globally ignored (deliberate for the carrier); re-enable once per release to catch strays. - L3. Title block: rev "1.0", date **2026-06-23** — stale (board materially changed since); bump date/rev on release. - L4. MODEM LED: XBee pin 13 is a **1.8 V** output → Rmled 1 k + LED will be dim or dark. Accept, reduce R, or buffer next spin. - L5. L7 (3V3_MODEM buck) is 10 µH **2 A** vs module spec "2 A peak" — saturation margin is thin at worst case; consider a 3 A-rated part next spin. (Delta doc says "1 A/1.5 A pk" — understates the ArduSimple diagram's 2 A.) - L6. `SW3_NODE`/`SW_FAN` netclass patterns exist but `SW_IN` was the one that mattered (H4) — tidy the pattern list while in there. - L7. In2.Cu carries 336 signal segments and no pour — fine (In1 is solid GND), just wasted copper; consider a 5 V pour next spin. --- ## 4. Verified GOOD (evidence-backed, not vibes) **Fail-safe invariants (the ones that matter for ICAVE):** - Load switch defaults OFF: R2 10 k pulls Q1 gate to rail; only PA1-driven Q5 can enable → invariant #1 holds with MCU absent. *(Weakened only by H2 — fix restores full margin.)* - **K1 Modo-B bypass verified against the Omron datasheet:** coil = pins 2/9 (SYS5V/Q6), COM = 5&6 (internally doubled — the double DIN_4G net is correct, not a short), **NC = 1 = F9P TX2** → corrections flow modem-ward with the MCU dead/absent; NO = 10 = PA9. Exactly the design intent of Block H. RTCM3 downlink (modem DOUT → MOD1 D2 → F9P RX2) is hardwired and never touches the MCU — invariant #3 in copper. - Cutoff chain MAIN5V→P11→SYS5V kills MCU *and* stack *and* modem (Blackpill 5V is on SYS5V) ✓. **LTC4040 block (pin-by-pin vs datasheet):** VSYS 1/24 ✓ · PROG 825 Ω → 2.42 A ≈ C/5 ✓ · CLN/RS1 8 mΩ → 3.1 A input limit ✓ · CHGOFF w/ 100 k pull-down = charge-enabled-if-MCU-absent, NTC still guards ✓ · BSTOFF grounded (backup enabled) ✓ · shared RSTFB/BSTFB divider 499k/100k → 4.79 V backup (sharing explicitly datasheet-endorsed) ✓ · PFI 287k/100k → 4.60 V trip ✓ · **F-straps decode to F2=1, F1=0, F0=1 = Li-Ion 4.00 V exactly as designed** (JP2/3/4 verified at net level; LiFePO4 = re-strap JP2 preserved) ✓ · NTC bias R55 from VIN + pack NTC on P4.3 — charger owns the battery NTC, per doctrine ✓ · OVSNS shorted to VIN (OVP unused, per datasheet) ✓ · SW→L6 2.2 µH→BAT within spec ✓ · VSYS bulk 104 µF ≥ 100 µF ✓ · RST unused = legal ✓. **XBee socket (verified against ArduSimple footprint-R00 diagram, incl. the mirrored row):** J7: VCC=3V3_MODEM (3.3–3.6 V ✓) · TX/RX=DOUT/DIN_4G ✓ · pin4+10 GND ✓ · RESET→SW4G (open = always-on) ✓ · **pin6 V_USB / 7 USB+ / 8 USB− = USB-C VBUS/DP/DM ✓** (USB enabled only when a laptop provides 5 V — elegant). J8 (pads mirror to XBee pins 20…11): ON/OFF→GND (always on) ✓ · pin15/11 GND ✓ · **pin14 VREF→VCC ✓** · pin13 LED→Rmled/D4G ✓ (see L4) · CTS/RTS/DTR open ✓. Row spacing 22.35 mm = XBee spec ✓. **Rest of the board:** USB-C UFP correct (5.1 k Rd on CC1/CC2; VBUS only to the modem — no rail backfeed) ✓ · Blackpill J1/J2: all 18 used pins match the documented map (A0 BAT_SENSE … B12–15 gauge, A9/A10 USART1, B6/B7 I²C, NRST w/ SW1+P10) ✓ · 24 V front-end: SMBJ33A TVS, IRFR5305 reverse-polarity FET correctly oriented w/ 15 V gate zener ✓ · fan: dedicated buck, UVLO enable divider, flyback SS34 across the fan, tach DNP provision ✓ · both MP1584 bucks correct (U7 FB 100k/31.6k → 3.33 V) ✓ · sensors: SHT40 + TMP102 (ADD0→GND = 0x48) + 4.7 k pulls + external I²C probe port P5 ✓ · NTC-hotspot chain to PB1 ✓ · sense dividers ÷2 + filters ✓ · single GND net, solid In1 plane, closed 135×100 outline, 4×M3.2 holes with sane margins ✓ · netclasses PWR_HI 1.5 mm / PWR_MID 1.0 mm exceed the kicad-guide minimums ✓ · DRC 0 errors / 0 unconnected; gerber+drill 4-layer set regenerated *after* the last save (17:14 > 17:06) ✓. --- ## 5. Documentation audit ("I need this to be perfect") The doc *system* is genuinely good — canonical state doc + delta build-spec + rationale + ledgers is more than most teams have. But it is now **3–4 days behind the copper**: | Doc claim | Board reality | |---|---| | DFR1015 on-board conditions ignition; Rig = 100 Ω series from 5 V | **DFR1015 removed**; raw 12–24 V → 22k/10k divider + clamp (and PCB value still says 100R — H3) | | Board 120 × 100 mm | **135 × 100 mm** (since Jul-3) | | "J8 all NC"; XBee = VCC/DOUT/DIN/GND only | J7.5–8 = RESET/V_USB/USB±; J8 = ON/OFF, VREF, LED, GNDs | | No USB-C block in design-state/delta | USB-C J9 + CC + VBUS-to-modem is a major new block (Jul-5) | | Delta: modem 1 A/1.5 A pk | ArduSimple diagram: **2 A peak** | | Name `hbox-watchdog-v3-PROD` everywhere | Title block says **EINARBoard HBOX 1.0** — name exists nowhere in the repo docs | | Title block date 2026-06-23, rev 1.0 | Board changed materially Jul 2–6 | **Docs action list:** (1) update design-state §1/§3 (ignition topology, no DFR1015, 22k) · (2) delta doc: add USB block + real J7/J8 table **including the J8 pad-k = XBee pin-(21−k) mirror** (that mapping is currently only in the copper — the single most dangerous piece of undocumented tribal knowledge on this board) · (3) board size + name: register "EINARBoard HBOX 1.0" in CLAUDE.md directory table + design-state header · (4) BOM: add LCSC column, DNP attributes on P3/P13/H3 · (5) delete/archive `fab-jlc-usb/` · (6) bump title-block date/rev on release · (7) log H1–H4 fixes in the delta doc changelog. --- ## 6. Recommended order of operations 1. Fix H3 schematic wire + value → H2 symbols → H1 Q7 swap (all schematic) → resync to PCB. 2. Add `SW_IN` to PWR_HI, reroute F1→Q1 + the three FET neighborhoods (H4/H1/H2 rework zones). 3. ERC (target: 0 errors) → DRC (0 errors) → regenerate `production/` → **order bare boards.** 4. In parallel: M3 (D0/D1 on a physical Pro) + M4 (mechanical fit) — both are no-cost checks. 5. Docs pass (§5) — 1 h, do it while the fab quote is pending. 6. PCBA later only after M1 (LCSC/DNP) and ideally proto bench results (M2). *Audit artifacts: ERC 2026-07-06 (1 err / 95 warn) · DRC 17:09 (0 err / 9 lib warn) · IPC-D-356 `production/netlist.ipc` 17:14 · sources: ADI 4040fb, Omron K048-E1-07, ArduSimple 4G-NTRIP-Master-footprint-R00.*