# §4-D MCU pin map + §4-G Connectors and harness — v6 audit findings

!!! warning "Designators from before 22-Oct (T43)"
    This document keeps the designators the board had on its date. Since 22-Oct (T43) the V5.6, V5.7 and v6 carry new ones, and several old names now belong to another part: on the v6, U6 is now the A7670SA modem (was U19) and the LTC4040 is U17 (was U6). To read it against today's board, use the [old → new table](https://drogheda.helgen.online/hardware/designadores-t43-22oct/#8-tablas-viejo-nuevo) (in Spanish); parts already gone by 22-Oct are not in it.
Snapshot: sch ecee9fed… / pcb 6ddec80d… (evidence pack 2026-09-28)

Companion deliverable: `findings/pinmap-v6.md` (64/64 pins, conflicts, boot/debug, firmware delta, draft `board_v6.h`).

## Sources read
- Brief/rules: `findings/_COMMON_BRIEF.md`; master brief §3–§5, §4-D, §4-G; `INDEX.md`; `evidence/MANIFEST.md`.
- Evidence: `mcu_pins.csv`, `nets.json`, `ref_pins.json`, `components.csv`, `ic_pins_U6/U10/U13/U18/U23/U24/U26.csv`, `pcb_pads.csv`, `pcb_footprints.csv`, `pcb_tracks.csv`, `net_routing_summary.csv`, `clearance_24v_by_net_layer.csv`, `outline_and_holes.md`, `sch_pcb_sync.md`, `erc_summary.md`, `cpl.csv`, `firmware_pins.md/.csv`, `firmware_constants.csv`, `ref_versions/v5asfab_*`, `v56_*`.
- Source files: `src/hbox-watchdog-v6.kicad_pcb` (silk text, footprint pads, parsed with `kisexp.py`), `src/v5_current/hbox-watchdog-v5.kicad_pcb` (V5.5 as-fabbed PCB: holes, connectors, crystal distances), `src/Drogheda.pretty/JAE_SIM_Card_SF72S006.kicad_mod`, `src/fw/board_v5.h`, `board_v4.h`, `hbox_v5_bringup.ino` 0.6.0, `CHANGELOG.md`.
- Docs: Review-vs-V5.5-Lessons (§1 F8, §4), V5.6 ECO (§0, §B, §E, §F, §H), V5.6 Change Report (§6.10 junction incident), V4/V5 Pinmap Audit FW 0.5.4, Phase-1 NTRIP spec, Phase-2 Schematic Delta (§3 pin allocation, Block N/O), project doc 2026-09-25 Pre-Fab Audit.
- Memory: `drogheda-einarboard-30-mcu-integration`, `-harness`, `-j1-mirror`, `drogheda-firmware-por-tarjeta`, `drogheda-einarboard-v6-brief` (P-renumber map), `drogheda-fan-policy`, `drogheda-epct-telemetria`, `drogheda-v6-zed-f9p-integration`, `drogheda-backup-lowpower`, `preferences`.
- Datasheets: **ST DS10314 (DocID026289 Rev 7)**: Table 8 (pins, FT/TC), Table 11/12 (abs max, injection), Table 37/38 (HSE/LSE Gm_crit_max), Table 52 (injection susceptibility), Table 53 (VIL/VIH, RPU incl. PA10 7–14 kΩ). **ST STM32_open_pin_data** (CubeMX DB: `STM32F411R(C-E)Tx.xml`, `GPIO-STM32F411_gpio_v1_0_Modes.xml`) for every AF number. **LTC4040 DS (4040fb)** pin functions (CLPROG = 32 × (VIN − CLN), PFO/CHRG/FAULT open-drain 6 V). **ZED-F9P integration manual UBX-18010802**, pin table (ANT_DETECT = I, ANT_SHORT_N = I, ANT_OFF = O). JLC parts via `get_jlcpcb_part` (C14872, C32346, C48615, C2901684, C9006, C1679, C38523, C1644, C23162, C25803, C25804, C4190, C19726, C3040595, C14663, C1588, C7519, C2827694, C224019, C5160226, C144394, C424683, C12074, C2238, C125103).

## Findings

### D-01 Modem-side level shifter back-powers the unpowered ZED-F9P through RXD2
- **Severity:** Major
- **Block / refs:** §4-D, §4-C; lesson = FW 0.5.5/0.5.6 back-feed (PA2 kept the simpleRTK2B "alive and dead"); memory `drogheda-v6-zed-f9p-integration` (VCC ramp window); U24, U18, R106, Rdfu1, U16 PA10/PC7/PA2/PC12
- **Evidence:** U24 74LVC2T45: VCC(A) = /1V8_MODEM (modem VDD_EXT), **VCC(B) = /3V3 (always on)**, DIR = VCC(A), so A→B. 1B drives **/DOUT_4G = {U24.7, R106.1, R107.2 (DNP), U18.26 RXD2}**. The F9P rail is switched: /3V3_GNSS = U21 output from /SW_5V (PA1 → Q5 → Q1). When the modem is booted (VDD_EXT up) and PA1 is LOW, U24 holds /DOUT_4G at the modem UART idle level (HIGH ≈ 3.3 V, 74LVC push-pull, ±24 mA class) straight into the unpowered U18.26. The only limit is the F9P's input ESD diode to VCC. ZED-F9P abs max input = VCC + 0.5 V (UBX-21044850), so at VCC = 0 the limit is exceeded by ≈ 2.8 V. Smaller paths into the same receiver: Rdfu1 22 k → /3V3 on /USART1_RX (U18.27 TXD2) ≈ (3.3 − 0.6)/22 k = 0.12 mA; plus PA10's internal pull-up, which is **7–14 kΩ on PA10** (DS10314 Table 53, OTG_FS_ID), not 40 kΩ: 0.5 mA if USART1 RX is left pulled up; PC7 pull-up via R106 (≈ 70 µA); PA2 and PC12 if driven HIGH. Firmware can avoid the U24 path only by never having the modem on while the F9P is off. That rules out F9P-only recovery cycles with the modem registered (REC_NMEA → `PWR_CTRL` cycle) and any modem-only reporting window.
- **Consequence:** the F9P rail sits pre-biased (≈ 2–2.7 V). The receiver neither powers down nor gets a clean ramp inside the 20–8000 µs/V window, so F9P power-cycle recovery silently fails. This is the V5.5 failure mode, now in hardware, and it also stresses the RXD2 ESD structure.
- **Fix:** insert **U27 = 74LVC1G125 (C3040595, SOT-23-5, Ioff/partial-power-down) powered from /3V3_GNSS**: A = /DOUT_4G, Y = new net /DOUT_4G_F9P → U18.26, OE# = GND, 100 nF (C14663) at VCC. With the F9P off, Y is hi-Z and A tolerates 3.3 V. PC7 and R106 stay on /DOUT_4G. Minimum alternative (layout only, no new IC): split the net with **10 kΩ 0603 (C25804) in series at U18.26**. That caps injection at ≤ 0.2 mA; τ = 10 k × ≈ 5 pF = 50 ns, fine at 115 200–460 800 Bd. **Rdfu1 22 k → 100 k (C25803)**: back-feed ≤ 27 µA, and PA10 still sits at a defined idle-high for ROM-DFU noise immunity. Firmware rules in `pinmap-v6.md` §2.5.
- **Effort:** both (1 IC + 1 cap, or 1 resistor; small reroute at U18.26)
- **Confidence:** high on the path (netlist + 74LVC2T45 supply topology). Medium on the magnitude, because the F9P ESD/rail loading is not published. Scoping /3V3_GNSS with the modem on and PA1 LOW on the first article would confirm it.

### D-06 Raw ignition line crosses the board on In2; no TVS; no negative clamp
- **Severity:** Major
- **Block / refs:** §4-D, §4-A/§4-F (inner-layer clearance); lesson = 23-Jul inner-layer short (`drogheda-einarboard-short-incident`); memory `drogheda-einarboard-harness` (Rig 22 k); DS10314 Table 12, Table 52 and the note after it ("add a Schottky diode (pin to ground) to analog pins which may inject negative currents")
- **Evidence:** /IGN_IN = {P1.3, Rig1.1}. **Rig1 sits next to the MCU, 100.1 mm from P1.3** (Rig1.1 at 123.55/50.68, P1.3 at 177.5/135.0). The unlimited 9–36 V vehicle line is routed **110.6 mm: 4.1 mm F.Cu + 106.5 mm In2 at 0.5 mm**, 1 via. The pack's `clearance_24v` shows it 0.15 mm from the GND pour (F/In1/In2) and, per INDEX, 0.22 mm from /VEH5V, 0.29 mm from /FAN_PWM and 0.30 mm from /5V_FAN on In2. /IGN_IN has no TVS: D10 SMBJ33A protects only /24V_IN. D5 BAT54 clamps positive only. A negative ISO 7637-2 pulse through 22 k gives −600 V/22 k ≈ −27 mA into PA5 once C9 is discharged, against I_INJ(PIN) −5 mA (Table 12). At 58 V (suppressed load dump) Rig1 dissipates 0.135 W, more than the 0.1 W 0603 rating.
- **Consequence:** an inner-layer insulation defect or a harness transient lands 12–36 V (plus pulses) on the 5 V rail or the fan gate, the same geometry as the paid-for 23-Jul lesson. Negative injection on PA5 disturbs the ADC and adjacent pins (Table 52).
- **Fix (schematic + layout):** (1) **move Rig1 to ≤ 5 mm from P1.3**, so the long trace carries only the ≤ 3.6 V, 22 k-limited node, which removes /IGN_IN from In2 entirely. Keep Rig2/Rigb1/C9/D5 at the MCU. (2) Add **TVS SMBJ33A (C224019, already in BOM) /IGN_IN → GND at P1.3** (standoff 33 V covers 28.8 V charging on 24 V systems). (3) **D5 BAT54 → BAT54S (C19726, SOT-23)**: common = /IGN_SENSE, upper diode to /3V3, lower diode to GND. (4) Optional: Rig1 in 0805/1206 (150–200 V rating).
- **Effort:** both
- **Confidence:** high (netlist, geometry, datasheet limits). The transient environment is Leo's call (Inputs).

### G-01 Mounting-hole pattern changed vs V5.5; the V5.5 right-side hole now lands on L6
- **Severity:** Major (Blocker if the HBOX backplate keeps the V5.5 standoffs)
- **Block / refs:** §4-G; `evidence/outline_and_holes.md`; V5.5 PCB `src/v5_current/…v5.kicad_pcb`; memory `drogheda-v6-zed-f9p-integration` ("MH4/5/6 (enclosure) and MH11 (heatsink clamp) survive")
- **Evidence:** outline identical to V5.5 (140.00 × 100.00, x 60.19–200.19, y 40.32–140.32) ✅. V5.5 holes: MH5 (65.2, 45.3), MH6 (65.2, 135.3), **MH4 (193.2, 90.3)**, plus MH7/9/10/11 (shield/heatsink). v6 holes: MH5 (65.2, 45.3), MH6 (65.2, 135.3), **MH7 (195.2, 45.3), MH8 (195.2, 135.3)**, a 130.0 × 90.0 mm corner pattern. At the V5.5 MH4 point, the v6 **L6 (2.2 µH/8 A) courtyard covers it (0.0 mm)** and L6.2 /BAT_PLUS pad centre is 2.44 mm away. R133 is 1.75 mm away, R130 2.73 mm, U22 3.13 mm. The MH6 edge: /3V3 F.Cu track 3.55 mm from the hole centre (an M3 washer Ø7 mm needs ≥ 3.5 mm plus tolerance).
- **Consequence:** in an enclosure drilled for V5.5, v6 cannot be screwed down on the right side, and a metal standoff at (193.2, 90.3) would press on L6 / /BAT_PLUS. If the backplate is re-drilled per board, this is only a documentation item.
- **Fix:** Leo confirms the enclosure/backplate pattern. If V5.5 standoffs must be reused: keep MH7/MH8 and **add MH at (193.2, 90.3)** by relocating L6. Block A already needs L6 ≤ 5 mm from U6. Otherwise publish the 130 × 90 mm corner pattern for the enclosure. Keep ≥ 4.0 mm copper-free radius on F.Cu/B.Cu around MH5–MH8 (move the /3V3 track at MH6 by ≥ 0.5 mm) or specify nylon washers.
- **Effort:** layout (+ enclosure drawing)
- **Confidence:** high on geometry. The enclosure fact is not derivable.

### G-02 Modem USB-C J9 still has no ESD protection
- **Severity:** Major (R5 line item "J9 sin ESD", ECO §0 / §E.5)
- **Block / refs:** §4-G, §4-B; ECO §E.5; Review §4 #7; V5.6 D19
- **Evidence:** /USB_DP = {J9.A6, J9.B6, U19.27}, /USB_DM = {J9.A7, J9.B7, U19.28}, /USB_VBUS = {J9.A4/A9/B4/B9, U19.24}. No ESD device. J11 has D14/D15/D16 at 3.19/6.74/6.83 mm.
- **Consequence:** ESD at the service connector goes straight into the A7670SA USB PHY. That port is the only recovery route for a bricked modem (TP8 USB_BOOT).
- **Fix:** add **USBLC6-2SC6 (C7519, SOT-23-6)** ≤ 3 mm from J9: pins 1/6 → /USB_DM, 3/4 → /USB_DP, 5 → /USB_VBUS, 2 → GND (same connection as V5.6 D19). Route D± through the device pads.
- **Effort:** both
- **Confidence:** high

### D-02 HSE crystal far from the MCU; HC-49S 20 pF crystal outside ST's start-up gm criterion
- **Severity:** Minor (upgrade to Major if Leo counts ECO §E.6 as part of R5)
- **Block / refs:** §4-D, §4-F; ECO §E.6 (🟡 "cristales ≤ 5 mm"); memory `drogheda-einarboard-30-mcu-integration` (ROM DFU needs HSE, AN2606)
- **Evidence:** Y3 = C14872 YXC HC-49S 25 MHz, **CL 20 pF**. Pad distances: Y3.1 → U16.5 PH0 **10.30 mm**, Y3.2 → U16.6 PH1 **14.21 mm**, C113 13.72 mm, C114 17.02 mm (beyond the crystal). Tracks: /HSE_IN 14.5 mm, /HSE_OUT 20.7 mm (F.Cu). Load: 15 pF + 15 pF → 7.5 pF + 5…10 pF stray (DS10314 §6.3.8 "≈ 10 pF") = CL_eff 12.5–17.5 pF against the 20 pF spec, so the crystal runs +33…+130 ppm fast (harmless: USB FS allows ±2500 ppm). Start-up: gm_crit = 4·ESR·(2πf)²·(C0 + CL). With ESR 40 Ω and C0 5–7 pF (typical HC-49S values; the YXC PDF could not be fetched, LCSC blocked) this gives **1.2–2.4 mA/V, against Gm_crit_max = 1 mA/V** (DS10314 Table 37). For context, V5.5 as-fabbed has Y3 at 11.9–13.7 mm with the same parts and starts in the field, so this is margin, not a known failure.
- **Consequence:** thin oscillator margin, worst over temperature and ageing. The ROM DFU bootloader (the field flashing path) and the USB clock depend on it. The long HSE traces are an EMC radiator near the MCU.
- **Fix:** **Y3 → C2901684** (SCTF SX3B25.000F1010F30, 3225-4P, 25 MHz, **CL 10 pF, ESR 30 Ω**, 11 k stock), footprint `Crystal:Crystal_SMD_3225-4Pin_3.2x2.5mm`. **C113/C114 → 12 pF C0G (C38523, Basic)**: CL_eff = 6 + ≈ 3.5 = 9.5 pF. gm_crit = 4·30·(2π·25 MHz)²·(12.5 pF)² = **0.46 mA/V** (2.2× margin). Place the crystal ≤ 3 mm from PH0/PH1, caps between the crystal and a GND via, no signal under it on In1. Basic-part alternative: C9006 (YXC 3225, CL 12 pF) with C113/C114 kept at 15 pF (C1644); confirm its ESR ≤ 40 Ω first.
- **Effort:** both (footprint swap + layout)
- **Confidence:** high (geometry). Medium (ESR/C0 of C14872 assumed from HC-49S norms).

### D-03 LSE crystal load and gm do not suit the F411 low-drive LSE
- **Severity:** Minor
- **Block / refs:** §4-D; memory `drogheda-backup-lowpower` (STOP + LSE RTC wake is the planned low-power path for R1)
- **Evidence:** Y4 = C32346 Epson FC-135, **CL 12.5 pF, ESR 70 kΩ max** (LCSC description), C0 ≈ 1 pF. C115/C116 12 pF → CL_eff ≈ 6 + 3 = 9 pF, so it runs ≈ +44 ppm fast (≈ 3.8 s/day). gm_crit = 4·70 kΩ·(2π·32 768)²·(13.5 pF)² = **2.16 µA/V** at max ESR, ≈ 1.1 µA/V at typical ESR. DS10314 Table 38: Gm_crit_max **0.56 µA/V (low-power, default)**, **1.50 µA/V (high-drive)**. Distances: Y4.1 5.54 mm, Y4.2 7.91 mm, C116 6.49 mm.
- **Consequence:** the LSE may fail to start, or start in tens of seconds, in the default low-drive mode. The 0.6.0 self-test `LSE_Y4` would flag it. An RTC wake from STOP would fall back to LSI (±5–10 %), acceptable for 10-minute timing but not for timestamps.
- **Fix:** **Y4 → C48615** (Epson FC-135 Q13FC13500002, **CL 7 pF**, 101 k stock) with **C115/C116 → 6.8 pF C0G (C1679)**: CL_eff ≈ 3.4 + 3.5 = 6.9 pF, gm_crit = 0.76 µA/V at max ESR (OK in high-drive) and ≈ 0.38 µA/V typical (OK in low-drive). Place ≤ 3 mm from PC14/PC15. Firmware: set `LSEMOD` (high-drive) before `LSEON`; LSI fallback.
- **Effort:** both
- **Confidence:** medium (C0/typical ESR from Epson family data, not the exact PDF)

### D-04 ETH_RST is on PA15 = JTDI: pulled HIGH by the MCU during reset; a 100 kΩ pull-down cannot hold the W5500
- **Severity:** Minor (corrects Review-vs-Lessons §4 #6 and V5.6 R112)
- **Block / refs:** §4-D, §4-E; ECO §F ("ETH_RST pull-down 100 k"); RM0383 debug-pin reset state (GPIOA_MODER reset 0xA800 0000, GPIOA_PUPDR reset 0x6400 0000: PA15 = JTDI AF0 **pull-up**); DS10314 Table 53 R_PU 30–50 kΩ
- **Evidence:** /ETH_RST = {U16.50 PA15, U11.37 RSTn}, no external pull. From reset until firmware reconfigures PA15, the internal 30–50 kΩ pull-up drives RSTn HIGH, so the W5500 runs through every MCU reset/boot (≈ 130 mA on /3V3_ETH, which is always on: U12 EN = VIN). The proposed 100 kΩ pull-down gives 3.3 × 100/(100 + 40) = **2.36 V** typical, 2.54 V with a 30 kΩ pull-up. That is still HIGH (W5500 VIH 2.0 V).
- **Consequence:** the V5.6/review fix does nothing on this pin, and the battery drain during resets stays.
- **Fix:** **4.7 kΩ 0603 (C23162, Basic) /ETH_RST → GND** at U11: 3.3 × 4.7/(4.7 + 30) = **0.45 V** worst case (< W5500 VIL 0.8 V). 0.70 mA while firmware drives HIGH. Or move ETH_RST to **PD2** (pad 54, spare, next to PA15 on the same LQFP edge) and use 100 k (C25803). Firmware: drive PA15 LOW as the first line of `setup()`.
- **Effort:** schematic-only (4.7 k option)
- **Confidence:** high (register reset values); medium that the pull-up is active while NRST is held low. It is certainly active from reset release until `setup()`.

### D-05 IGN_SENSE read digitally cannot detect a 12 V ignition; ADC saturates at 28.6 V
- **Severity:** Minor (firmware-only must-do + optional value change)
- **Block / refs:** §4-D; v6 brief T9 (9–36 V, 12 V and 24 V vehicles); V4/V5 audit §4.4; DS10314 Table 53
- **Evidence:** ratio 2.870 k/(22 k + 2.870 k) = 0.1154 (±1 % parts 0.1134–0.1174). PA5 voltage: 12 V → 1.385 V (1.30 V with the INPUT_PULLDOWN that `board_v5.h` uses), 14.4 V → 1.66 V, 24 V → 2.77 V, 28 V → 3.23 V. Production-tested VIL/VIH = 0.99/2.31 V, so a digital HIGH is guaranteed only above **20.0 V**. ADC full scale is at 28.6 V; the clamp starts at ≈ 30.3 V.
- **Consequence:** 12 V vehicles read ignition as undefined or OFF. The fan policy (`vehiclePower && ignitionOn`), AUTO and events misbehave. 24 V systems at 28–29 V saturate the ADC, so there is no vehicle-voltage telemetry.
- **Fix:** firmware: `analogRead(PA5)` with thresholds (ON > 0.60 V ≈ 5.2 V in, OFF < 0.35 V), no internal pull. Hardware (recommended): **Rigb1 3.3 k → 2.2 k (C4190, Basic)**: ratio 0.0833, so 12 V → 1.00 V, 24 V → 2.00 V, 36 V → 3.00 V, linear to 39.6 V, and the clamp stays idle below ≈ 42 V. New `$PHLG` field `vign`.
- **Effort:** firmware-only (+ schematic-only value)
- **Confidence:** high

### D-07 GNSS_ANT_DETECT / GNSS_ANT_SHORT_N are receiver inputs; the MCU cannot read antenna state
- **Severity:** Minor
- **Block / refs:** §4-D, §4-C; Phase-2 delta §3 ("antenna-open/short telemetry — you have already lost H0005 and H0014 to antenna faults")
- **Evidence:** U18.4 ANT_DETECT and U18.6 ANT_SHORT_N have symbol pin type *input*, and the ZED-F9P integration manual pin table lists them as "I – Active antenna detect / short detect". Their only other node is U16 PC1/PC2. /VCC_RF_GNSS = {U18.7, L21 68 nH, C144, C145} has no current-sense or supervisor circuit. ANT_OFF (U18.5) is unconnected.
- **Consequence:** the intended antenna-fault telemetry does not exist. Firmware that reads PC1/PC2 gets meaningless levels, and driving them HIGH with the F9P off back-feeds it.
- **Fix:** either add the u-blox antenna supervisor (current-limit plus open/short comparators on VCC_RF, outputs to U18.4/.6 **and** to PC1/PC2 as MCU inputs; block C to size it), or leave the pins analog/hi-Z in firmware and rename the nets (`…_TO_F9P`). Firmware can still report UBX-MON-RF `antStatus` once a supervisor exists.
- **Effort:** both (supervisor) or firmware-only (accept)
- **Confidence:** high

### D-08 No hardware board-ID: a V5.6 binary on v6 drives PC3 against the F9P's RTK_STAT output
- **Severity:** Minor
- **Block / refs:** §4-D; ECO §H `board_v56.h` (MODEM_EN PC3, MODEM_RST PC1, MODEM_LED PC2); memory `drogheda-firmware-por-tarjeta` (one binary per board, board in the file name)
- **Evidence:** V5.6 drives PC3 push-pull as MODEM_EN. v6 PC3 = U18.20 RTK_STAT, a push-pull output. PC1/PC2 (V5.6 MODEM_RST/LED) are F9P inputs on v6. There is no strap distinguishing the boards (PA9, PB10, PC5, PD2 are all unconnected on both).
- **Consequence:** a mis-flash contends two push-pull outputs (≈ 25 mA class) and leaves the modem uncontrolled. The naming rule is process-only protection.
- **Fix:** **PD2 → 10 kΩ (C25804) → GND** on v6 (pad 54). V5.x leaves PD2 floating. Firmware reads PD2 with INPUT_PULLUP at boot: v6 build requires 0, V5.6 build requires 1, else halt outputs and print `BOARD MISMATCH`.
- **Effort:** schematic + 1 short trace
- **Confidence:** high

### D-09 PWR_CTRL has no default-off pull at Q5's base
- **Severity:** Minor
- **Block / refs:** §4-D; `board_v5.h` "PWR_CTRL … Default OFF"
- **Evidence:** /PWR_CTRL = {U16.15, R1.1}; /BASE_LS = {R1.2, Q5.1 B}; no resistor to GND. PA1 floats in reset/DFU. Leakage: I_lkg ≤ ±1 µA (DS10314 Table 53) × h_FE ≈ 100 → up to 100 µA through R2 10 k gives ≈ 1 V of gate drive on Q1 AO3401A (V_GS(th) −0.5…−1.3 V). V5.5 is identical (fielded; typical leakage is nA).
- **Consequence:** worst-case partial turn-on of the F9P rail during reset/DFU, which fails "default off" and the clean-ramp requirement.
- **Fix:** **100 kΩ 0603 (C25803) /BASE_LS → GND** next to Q5.
- **Effort:** both (1 resistor)
- **Confidence:** medium (worst-case leakage argument)

### D-10 LTC4040 power-fail (PFO) and input-current monitor (CLPROG) are invisible to the MCU
- **Severity:** Minor
- **Block / refs:** §4-D, §4-A; H0008 log (1.3 A actual vs 2.4 A programmed, only visible with a clamp meter); LTC4040 DS pins 3, 19, 20
- **Evidence:** U6.20 PFO → /PFO_TP = {TP2} only, no pull-up. U6.3 CLPROG → /CLPROG_TP = {TP1} only; V_CLPROG = 32 × (V_IN − V_CLN) = 0.32 V/A with RS1 10 mΩ (0.80 V at the 2.5 A limit). U6.11 RST unconnected. Firmware infers power fail from a 5V_SENSE ADC sample (`V5_PFI 4.60`) and cannot measure charge/load current at all.
- **Fix:** PFO → **PB10** (spare, FT, EXTI10) with **100 kΩ (C25803) pull-up to /3V3**, for an immediate IRQ on VEH5V < 4.40 V. CLPROG → **PC5 (ADC1_IN15)** via **100 kΩ (C25803) + 1 nF (C1588) at the MCU**. This keeps CLPROG unloaded; block A must confirm the pin accepts that load. Firmware field `iin`.
- **Effort:** both
- **Confidence:** medium (CLPROG loading rule not confirmed)

### D-11 No-connect flags on four connected pins (U16.37/38, U10.13/14)
- **Severity:** Minor (cosmetic, hygiene)
- **Block / refs:** §4-D, §4-J; `erc_summary.md`
- **Evidence:** netlist: U16.37 ∈ /USART6_TX {K1.10}, U16.38 ∈ /USART6_RX {R106.2}, U10.13 ∈ /I2C_SCL, U10.14 ∈ /I2C_SDA (6 nodes each). PCB pad nets are identical (IPC-356, 0 mismatches). All four nets are routed (1 group each). The connection is real, so there is no hidden wiring error.
- **Consequence:** the flags suppress future "unconnected pin" ERC on these pins. A later label break would go unreported (the V5.6 junction incident shows how such breaks happen).
- **Fix:** delete the four NC flags (by UUID) and re-run ERC. The count should drop by 2 markers.
- **Effort:** schematic-only
- **Confidence:** high

### D-12 No UART TX pad for a TX-only log / ROM USART bootloader; SWD pads scattered
- **Severity:** Minor
- **Block / refs:** §4-D; Phase-2 delta §3 ("Leave PA9 as a test point", not done); memory 30-mcu-integration (ROM DFU requires HSE)
- **Evidence:** PA9 (USART1_TX, pad 42) carries an NC flag and no pad. USB DFU depends on HSE (D-02). The ROM USART1 bootloader runs on HSI but needs PA9 to answer. SWD = TP3 (109.0, 69.7), TP4 (112.5, 76.2), TP5 (110.0, 74.7), GND TP6 at (107.8, 52.1), 17.6 mm from TP3, 3V3 TP7 at (127.8, 42.6). No SWO (PB3 is CHRG_STAT).
- **Fix:** add **TP9 (TestPoint_Pad_D1.5mm) on PA9** next to TP3–TP5: TX-only debug log at 115 200 Bd plus the ROM-bootloader TX; PA10 RX is already the F9P TXD2 tap and the F9P is off in bootloader. Optionally add a DNP 1×5 2.54 mm footprint (3V3, SWDIO, SWCLK, NRST, GND) or a Tag-Connect TC2030-NL land (no BOM cost).
- **Effort:** layout (+ schematic pad)
- **Confidence:** high

### G-03 J10 / P11 / P12: DNP and footprint disagree between schematic and PCB
- **Severity:** Minor (must be settled before any Update-PCB or BOM/CPL export)
- **Block / refs:** §4-G, §4-H; `sch_pcb_sync.md` §2; pre-fab audit §7 (still open)
- **Evidence:** schematic: J10, P11, P12 populated. PCB: all three `dnp`. P11 (/RS485_A,B,GND) and P12 (/RS232_TX,RX,GND): schematic footprint `…MC_1,5_3-G-3.5_1x03_P3.50mm_Vertical` **does not exist in the KiCad lib** (MC = right-angle series; vertical is MCV). The PCB uses `…_Horizontal`. **C5160226 = DEGSON 15EDGRC-3.5-03P, "Right-Angle", 7 A**, so the PCB footprint matches the part. V5.5 fabbed the same Horizontal footprint. J10: schematic library nickname `Connector_RJ45` (not configured) vs PCB `Connector_RJ`, same HR911105A footprint. The transceivers feeding P11/P12 (U14 SP3485, U15 MAX3232, U10) are populated in both. **P12 is the RS-232 terminal, not the battery NTC** (v6 renumber 03-Sep): the pack is P3 (BATT-1S4P+NTC).
- **Consequence:** the schematic BOM lists three parts the CPL flags as DNP (JLC order mismatch). An Update-PCB with "replace footprints" would try to load the non-existent Vertical footprint and flip DNP back. The Ethernet and RS-485/232 ports would be delivered without connectors while their ICs are fitted.
- **Fix:** schematic footprint fields: P11/P12 → `Connector_Phoenix_MC:PhoenixContact_MC_1,5_3-G-3.5_1x03_P3.50mm_Horizontal`; J10 → `Connector_RJ:RJ45_Hanrun_HR911105A_Horizontal`. Then set DNP identically on both sides per Leo's intent (if they are hand-fitted THT, mark them DNP in the schematic too and list them on the hand-assembly sheet).
- **Effort:** schematic-only (+ Leo's decision)
- **Confidence:** high

### G-04 No solder-jumper bypass across the cut-off connector P5
- **Severity:** Minor
- **Block / refs:** §4-G; ECO §F (JP_CUT); Review §4 #9; memory `drogheda-einarboard-harness` (old P11 → v6 P5)
- **Evidence:** P5 CUTOFF-SW = {1: /MAIN5V, 2: /SYS5V}; no other part bridges /MAIN5V ↔ /SYS5V (JP1 is the fan option, JP5 the RS-485 termination). Without a plug in P5, /SYS5V is dead, so the MCU runs only from USB. The modem buck is fed from /MAIN5V via D21, ahead of P5, but it stays off because R113 holds EN low while the MCU is unpowered.
- **Fix:** add **JP_CUT = `Jumper:SolderJumper-2_P1.3mm_Open_RoundedPad1.0x1.5mm`** across P5 (/MAIN5V–/SYS5V), open by default, silk "CUTOFF BYPASS". The /SYS5V load is ≲ 0.8 A, within a 1.0 × 1.5 mm bridged pad pair.
- **Effort:** both
- **Confidence:** high

### G-05 Silkscreen: stale modem-reset label, ECO names missing, 0.5/0.1 mm text, P-renumber collisions
- **Severity:** Minor
- **Block / refs:** §4-G; ECO §F (RESET MÓDEM / RESET MCU / JP2 = F2); pre-fab audit §7 (text size); memory `drogheda-einarboard-v6-brief` (P-renumber map)
- **Evidence (parsed silk on F.SilkS):** 9 board texts. **"4G NTRIP RESET" at (187.0, 124.1)**: v6 has no modem-reset button (SW4G1 deleted); the label sits between D34 and L22 in the power island. SW1 is labelled "NRST" and SW2 "BOOT" (refdes hidden); the ECO asks for "RESET MCU". JP2 (chemistry F2, Li-ion/LFP) carries only its refdes, and "F2" is also the 24 V fuse refdes. P1 has one label, "IGN 24V" at (178.5, 129), with no per-pin legend, although v6 accepts 9–36 V. All labels are 0.5 mm / 0.1 mm stroke (JLC minimum stroke 0.15 mm; board rule 0.8 mm). **Renumber hazard:** V5-labelled plugs by number collide with same-type v6 headers. V5 "P6 FAN" (XH-2) fits v6 **P6 RESET-EXT** (XH-2): the fan motor across NRST–GND holds the MCU in reset. V5 "P8 PANEL_LED" fits v6 **P8 NTC2**.
- **Fix:** delete "4G NTRIP RESET". SW1 "RESET MCU", SW2 "BOOT0 (DFU)". JP2 "CHEM 1-2 Li-ion / 2-3 LFP". P1 pin legend "VIN 9-36V · GND · IGN · GND · NC". A **function name at every connector** (FAN, RESET, NTC1, NTC2, LED, BATT, CUTOFF, 5V BENCH). Text ≥ 0.8 mm / 0.15 mm (1.0/0.15 where space allows). Harness labels by function, not P-number.
- **Effort:** layout
- **Confidence:** high

### G-08 External-cable inputs P6 (NRST), P7/P8 (NTC ADC) have no ESD protection
- **Severity:** Minor
- **Block / refs:** §4-G, §4-D; v6 brief "optional T12 adds offered: ESD at P7/P8" (not implemented); DS10314 Table 52
- **Evidence:** /NRST = {U16.7, C104, SW1, P6.1, TP5}: C104 100 nF sits at 3.26 mm from the MCU, 35.6 mm from P6, and NRST is routed 108.6 mm. /NTC_TEMP (PB1) and /NTC2 (PC4) go to P7.1/P8.1 with only 100 nF (C24 6.63 mm, C157 3.11 mm from the MCU; P7/P8 at 20.2/21.5 mm). All three connectors lead to cables outside the board (panel reset button, NTC probes). An IEC 8 kV/150 pF hit dumps 1.2 µC, i.e. ≈ 12 V step on 100 nF before the MCU's diodes conduct.
- **Fix:** **PESD5V0S1BA (C2827694, SOD-323, already in BOM as D14–D16)** at P6.1, P7.1 and P8.1, each ≤ 3 mm from its connector to GND. Optional 100 Ω series (C22775) on NRST between P6 and the net.
- **Effort:** both
- **Confidence:** medium (exposure depends on the harness)

### D-13 EXTI and timer allocation (firmware)
- **Severity:** Note
- **Evidence:** EXTI3 is shared by PC3 RTK_STAT and PB3 CHRG_STAT; EXTI9 by PB9 ACC_INT1 and PC9 MODEM_STATUS. EXTI0 (ETH_INT), EXTI7 (PPS) and EXTI8 (SER_IRQ) are unique. PA6 fan = TIM3_CH1 and PA7 PPS = TIM3_CH2 share TIM3.
- **Fix:** EXTI9 → PB9 (motion wake); poll PC9 and PB3; fan stays GPIO ON/OFF (fan policy) so TIM3 is free for PPS capture.
- **Effort:** firmware-only · **Confidence:** high

### D-14 MODEM_STATUS and USART6_RX float whenever the modem is off
- **Severity:** Note
- **Evidence:** U24 (74LVC2T45) outputs are hi-Z when VCC(A) (/1V8_MODEM) = 0. /MODEM_STATUS = {U24.6, U16.40} has no pull. /USART6_RX via R106 likewise.
- **Fix:** firmware PC9 INPUT_PULLDOWN (30–50 kΩ). Optional hardware 100 kΩ (C25803) /MODEM_STATUS → GND so DFU/reset states read "modem off". PC7: no pull-up while the F9P is off (D-01).
- **Effort:** firmware-only (optional resistor) · **Confidence:** high

### D-15 VDD decoupling slightly beyond the ≤ 2 mm rule
- **Severity:** Note
- **Evidence (nearest 100 nF, pad centre):** VDD19 C106 3.29 mm · VDD32 C105 3.65 mm · VDD48 C107 2.10 mm · VDD64 C110 3.90 mm (shared with VBAT pin 1 at 2.32 mm) · VDDA C109 3.13 mm · VCAP1 C111 3.19 mm.
- **Fix:** tighten to ≤ 2 mm in the layout pass if convenient (cap map 14-Aug).
- **Effort:** layout · **Confidence:** high

### D-16 Y2 value text says 1.8432 MHz but the LCSC part is 3.6864 MHz
- **Severity:** Note
- **Evidence:** Y2 value "1.8432MHz", LCSC C2238 = YXC X49SM36864MSD2SC-1, **3.6864 MHz, CL 20 pF**. `board_v5.h`: `BOARD_SER_XTAL_HZ 3686400UL` "C2238". JLC assembles the 3.6864 MHz part, which matches firmware. Same in V5.5/V5.6.
- **Fix:** change the value field to "3.6864MHz" (block H/E).
- **Effort:** schematic-only · **Confidence:** high

### G-06 P2 bench input sits directly on U25's output; a P2-only bench back-feeds the 24 V domain
- **Severity:** Note (for block A)
- **Evidence:** /VEH5V = {L22.2 (U25 output), P2.1, RS1, …}; no OR-ing. The v6 brief says "P2 = bench backup, one source at a time". With SD-15B on P2 **and** 24 V on P1 the higher source wins; both are source-only, so this is benign. With **P2 only**, V_OUT > V_IN, so current flows through L22 → SW → TPS54360B high-side FET body diode → /VIN_PROT. Q23 (IRFR5305, gate R119 → GND, V_GS ≈ −4.5 V) then conducts to /24V_IN, and on through Q10 and its body diode to /24V. The result is ≈ 4 V on P1.1 and /24V; U2 (fan buck) may try to run.
- **Fix:** document it in the bench procedure ("P1.1 reads ≈ 4 V on P2-only power"), or add a Schottky in series with P2 if bench-only 5 V must not wake the 24 V side.
- **Effort:** documentation · **Confidence:** medium (body-diode path inferred from the TPS54360B topology)

### G-07 Battery connector P3 (JST-XH, 3 A per contact) at its rating
- **Severity:** Note
- **Evidence:** P3 = C144394 JST B3B-XH-A, 3 A. Charge current 2000/825 = 2.42 A (81 %) with R50 825 Ω, 1.33 A after the R50 1.5 k fix. Backup: ≈ 10 W peak at MAIN5V (modem burst 7.6 W/0.9 + F9P 0.72 W + board ≈ 0.8 W) / (0.9 × 3.3–3.7 V) = **3.0–3.4 A peaks**, 0.6–1 A average. Two contacts × ≤ 10 mΩ → ≈ 70 mV at 3.4 A.
- **Fix:** keep XH-3 for compatibility with the existing 1S4P packs. If the pack harness is remade (LFP-HT decision, ECO D1), move to XH-5 (2 × BAT+, 2 × GND, NTC) or JST VH.
- **Effort:** — · **Confidence:** medium

## Pass checks
| Check | Evidence (one line) | Result |
|---|---|---|
| U16 symbol pin numbers vs ST LQFP64 | 64/64 names match ST open-pin-data XML | ✅ |
| Pin-map coverage | 64/64 rows in `pinmap-v6.md` | ✅ |
| ADC nets on ADC pads | PA0/IN0, PA4/IN4, PA5/IN5, PB1/IN9, PC4/IN14 | ✅ |
| AF conflicts | USART2 AF7, USART6 AF8, USART1_RX AF7, SPI2 AF5, I2C1 AF4, OTG AF10, SWD AF0: no overlaps | ✅ |
| 5 V on non-FT / any pin | none; TC pins PA0 ≤ 2.10 V, PB5 output | ✅ |
| 1.8 V modem signals reaching MCU | none (U23/U24, Q20/Q21) | ✅ |
| Modem control defaults in reset | R113/R114/R115 100 k pull-downs on PC10/PC8/PC11 | ✅ |
| BOOT0 / BOOT1 trap | R98 10 k PD + SW2; PB2 only R99 10 k PD; ETH_INT on PC0 | ✅ |
| NRST circuit | C104 100 nF at 3.26 mm; SW1 pad pairs correct (NRST 6.5 mm pair); P6, TP5 | ✅ |
| DFU ESD at J11 | D14/D15/D16 at 3.19/6.74/6.83 mm; CC 5.1 k ×2; VBUS diode-OR D12/D13 | ✅ |
| VCAP1 / VDDA | C111 4.7 µF 3.19 mm; R104 10 Ω + 1 µF + 100 nF | ✅ |
| IGN divider junction | Rig1.2/Rig2.1/Rigb1.1/C9/D5/U16.21 on one net, sch and PCB (6 pads, 1 group) | ✅ |
| IGN clamp orientation | D5 K (pad 1) → /3V3, A → /IGN_SENSE | ✅ |
| CHRG_STAT/FAULT pull-ups | R57/R58 100 k → /3V3 (always-on MCU rail) | ✅ |
| I2C address map | 0x18 SC7A20 (SDO→GND), 0x20 PCF8574 (A0–A2 GND), 0x44 SHT40, 0x4D SC16IS752 (A0/A1 GND, I2C mode pin 9 = 3V3): no clash | ✅ |
| NC flags on U16.37/38, U10.13/14 hide an error? | nets real in netlist + IPC-356, routed | ✅ (cosmetic, D-11) |
| Harness pinouts vs V5.5 (by function) | P1, P2, P3=P4, P4=P6, P5=P11, P6=P10, P7=P12, P9=P8, P10=P14, P11=P15, P12=P16 all identical | ✅ |
| Pin-1 / mirror | every connector is a KiCad-library footprint with a distinct pad-1 shape and silk marker; J12/J13 U.FL symmetric; J14 = stock KiCad JAE SF72S006 (C1–C3 / C5–C7 rows); no module sockets on v6 (J1-class risk gone) | ✅ |
| P1 ignition GND return | P1.2 and P1.4 = GND, P1.5 NC (as V5.5) | ✅ |
| External 5 V input | U25 is the primary; P2 retained as bench input on /VEH5V | ✅ (G-06 note) |
| Outline / case fit XY | 140.00 × 100.00 at the V5.5 coordinates; J10 (78.0, 53.825, −90) and J11 (69.975, 70.85) same as V5.5 (Δ ≤ 0.09 mm) | ✅ |
| Connector current (P1 16 A, P2 3 A at ≤ 2.5 A, P5 3 A at ≤ 0.8 A, P11/P12 7 A) | datasheet ratings vs loads | ✅ (P3 G-07) |
| HSE ≤ 5 mm | 10.30/14.21 mm | ❌ D-02 |
| LSE ≤ 5 mm | 5.54/7.91 mm | ⚠ D-03 |
| J9 ESD | none | ❌ G-02 |
| JP_CUT across P5 | none | ❌ G-04 |
| Silk names per ECO §F | stale "4G NTRIP RESET"; no "RESET MCU"/JP2 legend | ❌ G-05 |
| Sch/PCB parity J10/P11/P12 | DNP + footprint mismatch | ❌ G-03 |

## Review-vs-Lessons §4 checklist items re-verified
| Item | Status now | Evidence |
|---|---|---|
| #6 ETH_RST pull-down 100 k | **Still absent, and 100 k would not work** (PA15 JTDI pull-up) | D-04: use 4.7 k (C23162) or move to PD2 |
| #7 J9 USB ESD | Still absent | G-02 |
| #9 JP_CUT across P5 | Still absent | G-04 |
| #12 Firmware v6 pins (PC10/PC8/PC9/PC11, USART6 PC6/PC7, PB5 K1) | Confirmed on the netlist, plus PA7/PC1–PC4/PC12/PB9 | `pinmap-v6.md` |
| F8 BOOT1 trap | Holds | PB2 = R99 only; ETH_INT PC0 |
| F8 DFU ESD at J11 | Holds | 3.19–6.83 mm |
| §5 "free pins PC5, PB10, PA9, PD2" | Still free | NC flags; proposed uses in D-08/D-10/D-12 |
| #5 charger sensor via PC5 | PC5 still free (block A/F decides; D-10 competes for PC5 — use PB10 for PFO and choose between CLPROG and NTC on PC5) | mcu_pins.csv |
| #11 identity without `$GPTXT` | Firmware: 96-bit UID at 0x1FFF7A10 is available for `$PHID` | — |

## Requirements input R1–R5
- **R1** (10-min off/on on battery with report): MCU has independent F9P (PA1) and modem (PC10) power, PWRKEY/RST/STATUS. **Satisfied as-is for control.** Needs D-01 so an F9P-off/modem-on state never back-powers the receiver. LSE wake quality: D-03 (LSI fallback exists).
- **R2** (modem never dark; MCU can power-cycle it): **satisfied as-is** (PC10 + R113, PC11/Q21, PC8/Q20, PC9 STATUS). Firmware only.
- **R3** (report while on battery): firmware only. D-10 (PFO IRQ) is an improvement.
- **R4** (temperature management): NTC inputs PB1/PC4 on ADC pads ✅. There is no cell-temperature input to the MCU (P3 NTC goes to the LTC4040 only; TMP102 gone). This is block A/F's call; PC5 is available.
- **R5** (EMC list): DFU ESD at J11 ✅; **J9 ESD ❌ (G-02)**; crystals ≤ 5 mm ❌ (D-02, ECO §E.6 🟡).

## Firmware implications (board_v6.h / FW 0.7.x)
1. New `board_v6.h` (draft in `pinmap-v6.md` §5). A binary must never cross between V5.6 and v6 (PC1/PC3). Adopt the D-08 strap check.
2. First lines of `setup()`: drive LOW PC10, PC8, PC11, PA1, PB5, **PA15**, PA6, PB0.
3. Remove the PA9 RELAY TX; Mode-B TX = USART6 PC6 via K1 NO; USART6 RX PC7 always on (AT + RTCM byte counter, `rtcm_bps`); USART1 RX-only on PA10 with **no pull** (PA10 pull-up is 7–14 kΩ).
4. F9P back-feed rules (§2.5 of the pin map): PA2/PA10/PC7/PC12/PA7/PC3/PC1/PC2 inert while PA1 is LOW. Until D-01 is fixed, never hold PC10 HIGH with PA1 LOW.
5. PC12 open-drain only; PC1/PC2 analog (F9P inputs).
6. IGN on ADC (PA5/IN5) with thresholds, and `vign` if Rigb1 becomes 2.2 k (D-05).
7. New inputs: PPS (TIM3_CH2 or EXTI7), RTK_STAT (poll ≥ 10 Hz or EXTI3), ACC_INT1 (EXTI9, SC7A20 0x18), NTC2 (IN14, `tntc2`), MODEM_STATUS (poll, pull-down).
8. Drop TMP102 (0x48/0x49) and the PCF8574 P7 modem-reset code; re-source `CHG_CELL_HOT/COOL`.
9. LSE: `LSEMOD` high-drive, LSI fallback for the RTC wake.
10. Modem sequencing: PWRKEY ≥ 50 ms on / ≥ 2.5 s off; STATUS ≈ 11.2 s; any MCU reset = cold modem and cold F9P.
11. If D-10 is adopted: PB10 EXTI on PFO (falling), PC5 ADC on CLPROG (0.32 V/A).

## Inputs needed from Leo
1. **Enclosure/backplate hole pattern** for v6: are the V5.5 standoffs (incl. (193.2, 90.3)) reused? This decides whether G-01 is a Blocker. Assumed: backplate re-drilled.
2. **J10 / P11 / P12**: JLC-assembled or hand-fitted THT? (G-03.) Assumed: populated.
3. **Ignition environment**: 12 V vehicles in scope for v6? Unsuppressed ISO 7637/16750 transients on the ignition wire (terminal tractors, RTGs)? (D-05/D-06.) Assumed: yes to both.
4. Are field harness cables labelled by P-number (V5 names)? (G-05 collision.)
5. Is the v6 low-power plan STOP + RTC (LSE), or duty cycle with the MCU running? (D-03 severity.)
6. SWD header wanted on the fab board, or DFU plus pads only? (D-12.)