Helgen-Services/Drogheda
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
3c4382caa6
Drogheda/03-Architecture-Hardware/2026-09-28_v6-audit-attachments/BCE_modem_gnss_eth.md

58 KiB
Raw Blame History

B/C/E (Modem A7670SA · GNSS ZED-F9P · Ethernet W5500) — v6 audit findings

!!! warning "Designators from before 22-Oct (T43)" This document keeps the designators the board had on its date. Since 22-Oct (T43) the V5.6, V5.7 and v6 carry new ones, and several old names now belong to another part: on the v6, U6 is now the A7670SA modem (was U19) and the LTC4040 is U17 (was U6). To read it against today's board, use the old → new table (in Spanish); parts already gone by 22-Oct are not in it. Snapshot: sch ecee9fed… / pcb 6ddec80d… (evidence pack 2026-09-28)

Auditor: RF/COMMS block agent. Read-only; no design file touched. Scratch scripts and numbers: /home/claude/v6audit/work/BCE/ (dist.py pad distances, tracks.py segments, pathr.py path resistance/IR drop, rfgeo.py RF gaps/reference planes/crossings, islands.py F.Cu GND clusters and plane vias, z0.py/fdrun*.py impedance (analytic + 2-D finite-difference solver), budget.py battery budget).

Stackup assumption (stated once, used everywhere): the board file carries KiCad's generic stack (3 × 0.48 mm FR4, εr 4.5). JLC will build its standard JLC04161H-7628: L1–L2 prepreg 0.2104 mm (7628, εr ≈ 4.4), core 1.065 mm, L3–L4 prepreg 0.2104 mm, outer Cu 35 µm, inner Cu 15–17.5 µm (0.5 oz default). All impedance and inner-layer IR numbers below use that; the file's own stack is shown for comparison.

Sources read

  • Common brief findings/_COMMON_BRIEF.md; master brief §3–§5 incl. §4-B/C/E; INDEX.md; evidence/MANIFEST.md; evidence/stackup.md.
  • Prior review docs/2026-09-28_…_Review-vs-V5.5-Lessons_v1.0.md (§1 F1/F2/F3/F8/F9, §2, §3, §4 checklist); ECO docs/2026-09-27_…_V5.6_ECO_ES_v1.0.md §0 (R1–R5), §A, §B, §E, §F, §H; project docs claude__2026-09-25_HBox-v6_Pre-Fab-Audit_EN.md, claude__2026-09-27_…Modem-on-battery_Diagnosis…md, claude__2026-09-28_…Status-and-Next-Steps.md.
  • Design docs: 2026-08-24_…GNSS-4G-Integration_Design-Brief_v1.0.md (§3, §4), …Phase-2_Schematic-Delta_v1.0.md (Blocks N–T), …Phase-1_NTRIP-Firmware-Spec_v1.0.md (§1.4, §2, §4), 2026-08-27_…Antenna-Chain_Diagram.html, 2026-09-02_…Copper-Plan_Placement-EMC-Guide.html (§4, §5, §7, §8).
  • Memory (docs/memory/): drogheda-einarboard-v6-brief, drogheda-v6-zed-f9p-integration, drogheda-v6-lte-island, drogheda-mff2-footprint, drogheda-einarboard-v6-phase12, drogheda-einarboard-modem-rail, drogheda-epct-telemetria.
  • Evidence: ic_pins_U19/U18/U11/U20/U22/U23/U24.csv, mcu_pins.csv, components.csv, nets.json, ref_pins.json, pcb_footprints.csv, pcb_pads.csv, pcb_tracks.csv, vias.csv, zones.csv, net_routing_summary.csv, erc_summary.md, drc_summary.md, sch_pcb_sync.md, firmware_pins.md, firmware_constants.csv; staged src/hbox-watchdog-v6.kicad_pcb (parsed with scripts/parse_pcb.py), src/Drogheda-v6.kicad_sym, src/Drogheda-v6.pretty/*, src/fw/hbox_v5_bringup.ino, board_v5.h.
  • Datasheets / app docs (manufacturer or vendor copies):

Findings

B-01 Modem buck input hangs on the unfused, weakly clamped /24V branch; D21 (30 V Schottky) is over-stressed and leaks into MAIN5V

  • Severity: Blocker
  • Block / refs: §4-B (U20 source); lesson F1; ECO §A; memory drogheda-einarboard-v6-brief (T9 "9–36 V in"), drogheda-einarboard-v6-phase12 (Block P); INDEX gotcha #4.
  • Evidence:
    • Netlist: /VIN_MODEM = D20.1 (SS34 K) + D21.1 (PMEG3050EP K) + C127/C128 + U20.2. D20.2 = /24V = Q10.3 (IRFR5305 reverse-polarity FET from /24V_IN), not behind F2 (F2 is only on /24V_IN → F2 → Q23 → /VIN_PROT). D21.2 = /MAIN5V (LTC4040 VSYS).
    • When 24 V is absent (battery/backup) VIN_MODEM is fed only through D21 from the LTC4040 boost (4.79 V) → the modem can run on battery (numbers in B-16). When 24 V is present D21 is reverse-biased by VIN_MODEM − MAIN5V.
    • D21 reverse stress: VR = V24 − VF(D20 ≈ 0.45 V) − MAIN5V (5.0–5.3 V). At the declared 36 V input max: 30.3–30.6 V > 30 V VRRM. At 32 V (24 V-system max steady): 26.3 V (88 % of rating). PMEG3050EP IR = 2.6 mA typ / 8 mA max at 30 V, 25 °C; Schottky leakage roughly doubles per ~10 °C, so at a 60 °C board it is tens of mA × 26 V = 0.5–1 W into a 120 K/W package → thermal runaway risk, and that current is injected from the vehicle supply into MAIN5V (6 V abs max, LTC4040 DS p.2).
    • Transients: /24V is clamped only by D10 SMBJ33A (VBR 36.7–40.6 V, VC 53.3 V @ 11.3 A). AP64350 abs max = 42 V DC / 45 V for 400 ms. An ISO 7637-2 pulse 2a-class event that pushes D10 to ≈ 45–51 V exceeds U20's rating and puts ≈ 40–46 V reverse on D21 → avalanche into MAIN5V.
    • No fuse on the D20 path: a failed C127/C128/U20/D20 short draws unlimited current from the vehicle battery through Q10 and 0.8 mm × 48 mm of track (/VIN_MODEM F.Cu, D20 at (136.5,113.8) → U20 at (147.5,63.2)).
    • Positives: C127 = GRM21BR61H106 10 µF 50 V and C128 = 1 µF 50 V (voltage rating OK).
  • Consequence: On 24–28 V vehicles in a hot cabinet D21 can run away and short 24 V into the 5 V domain (LTC4040, MCU, F9P); transients can destroy U20; no overcurrent protection on that branch. The original reason for the 24 V feed (keep 1.6 A of modem off the SD-15B's 3 A) no longer exists: v6 has its own U25 TPS54360B and RS1 = 10 mΩ (2.5 A input limit < U25 capability).
  • Fix (pick one; B recommended):
    • Option B (recommended, schematic + small layout): delete D20 and the /24V→VIN_MODEM trace; feed U20 only from /MAIN5V. Either keep D21 as a plain forward diode (no reverse stress any more) or replace it by a copper link (+0.27 V battery headroom, see B-16). U20 then never sees > 5.5 V, the unfused-branch question disappears for the modem, and the modem sits behind the LTC4040 PowerPath (seamless 24 V↔battery). Budget on vehicle power: modem LTE ≈ 0.6–1.0 A, GSM burst ≈ 1.8 A from MAIN5V + ≈ 0.4 A system = 2.2 A peak; LTC4040 system load has priority over charge (DS p.13/16), U25 rated 3.5 A. Needs the power auditor to confirm U25 transient droop stays above PFI (4.44 V) with R121 = 57.6 k (5.32 V).
    • Option A (keep 24 V feed): D21 → PMEG6045ETPX, LCSC C552943 (Nexperia, 60 V/4.5 A, IR 400 µA @ 60 V, SOD-128 = same land as PMEG3050EP; 2722 in stock, Extended); move D20's anode from /24V to /VIN_PROT (behind F2 + Q23 + D32 SMCJ33A 1500 W, whose clamp at ≈ 9.5 A is ≈ 43.5 V, inside U20's 45 V/400 ms rating); F2 (currently Littelfuse 0154002.DR, 2 A, C206910) must then be re-rated for U25 + U20 at the 9 V minimum input (≈ 2.4 A at 12 V) → 4 A class (power auditor).
  • Effort: both (schematic + ~50 mm of copper removed/added)
  • Confidence: high on ratings (datasheet numbers); medium on the runaway temperature (Fig. 5 of the PMEG3050EP DS not tabulated). Raise by measuring D21 leakage at 26 V on a hot plate (60/85 °C).

B-02 VBAT_MODEM bulk is a general-purpose aluminium electrolytic, not polymer; U20 compensation not designed for the actual output bank

  • Severity: Blocker
  • Block / refs: §4-B (Cout, bulk ≥ 220 µF polymer); lesson F1 (modem brown-out on burst); ECO §A (C43 → 220 µF polymer C881921); memory drogheda-einarboard-v6-brief ("≥300 µF VBAT bank").
  • Evidence:
    • C130, C131 = C2827940 = SamYoung MVG 16 V 220 µF 6.3×7.7, general purpose, 85 °C / 2000 h, tanδ 0.20 → ESR(120 Hz) = 0.20/(2π·120·220 µF) = 1.2 Ω, rated ripple 40 mA (catalogue) / 130 mA (LCSC) rms. Value field says "220uF/10V".
    • Placement: C131 8.7 mm, C130 16.3 mm edge from the nearest VBAT pad (U19.55/56/57) → meets the 10–20 mm position criterion, fails the polymer/low-ESR criterion.
    • Effective low-ESR output capacitance is therefore only the ceramics: C132 22 µF/16 V X5R 0805 (≈ 60 % at 3.8 V) + C133 1 µF + C134 100 nF ≈ 14 µF, vs SIMCom ≥ 300 µF (≥ 600 µF if the source cannot deliver the peak), HD V1.03 p.27.
    • No capacitor at the L20 output: nearest is C130 12 mm away. Inductor ripple ΔIL = 3.8·(24−3.8)/(24·4.7 µH·500 kHz) = 1.36 A p-p (24 V input) or 0.39 A p-p (5 V input) flows through that e-cap's ESR. AP64350 DS: "22 µF to 68 µF ceramic" at the output.
    • Compensation (R116 14 k, C141 3.3 nF, C142 47 pF) = the AP64350 5 V Table 1 row. With DS eq. R5 = 4.67·10³·fc·VOUT·COUT: ceramics only → fc = 14k/(4.67k·3.8·14 µF) = 56 kHz (> fsw/10 = 50 kHz, low phase margin); with a real 454 µF low-ESR bank → fc = 1.7 kHz (too slow). Load-step droop estimate for a 2 A step: ceramic-loop ≈ 2/(2π·56 kHz·14 µF) = 0.41 V, plus 2 A × ESR(e-caps ≈ 0.15–0.3 Ω pair) ≈ 0.3–0.6 V → VBAT can dip to ≈ 3.2–3.4 V (A7670 min 3.4 V, max droop 300 mV).
    • Life: 2000 h × 2^((85−T)/10) → 8000 h at 65 °C, 5660 h at 70 °C (≈ 8–11 months), before any burst ripple heating.
    • FB: R110 75 k / R111 20 k → 0.8·(1+75/20) = 3.80 V; worst case (±1 % R, VFB ±2 % assumed) 3.67–3.94 V — inside 3.4–4.2 V ✅.
  • Consequence: Modem brown-out/reset during registration bursts (the exact V5.5 "modem dark" failure mechanism, now from the output side), worse on battery where the boost is near its 2.5 A limit (B-16); electrolytic wear-out within the first year in a 45 °C port cabinet.
  • Fix: C130, C131 → Lelon OVZ221M1CTR-0608 220 µF/16 V polymer, 105 °C, LCSC C881921 (same CP_Elec_6.3x7.7 land; 2442 in stock) — the part already chosen in ECO §A. Move C131 to ≤ 5 mm of U19.55–57 (see B-08). Add 2 × 22 µF 0805 (C86817, Murata GRM21BR61C226) at L20.2 within 3 mm. Re-compensate for COUT ≈ 454 µF, fc ≈ 14 kHz (≈ the Table 1 bandwidth): R116 → 113 kΩ 1 % (C22862), C141 → 6.8 nF 0402 X7R (C1542), C142 → 56 pF 0402 C0G (C1572) (R5 = 4.67k·14k·3.8·454 µ = 112.8 kΩ; C5 = 3.8·454 µ/(2 A·113 k) = 7.6 nF; C6 = ESR·Co/R5 ≈ 60 pF with ≈ 15 mΩ bank ESR). Verify on the bench: 0.1 → 2 A load step on VBAT_MODEM, droop ≤ 150 mV, no ringing.
  • Effort: both (BOM values + 2 caps + C131 move)
  • Confidence: high on part type/life/ESR class; medium on the exact compensation (polymer ESR taken from class, C881921 datasheet host is robots-blocked). Raise with the bench load step.

B-03 LTE antenna ESD D28 is a unidirectional 5 V TVS on an RF line without DC bias

  • Severity: Blocker
  • Block / refs: §4-B (antenna path: ESD); memory drogheda-v6-lte-island (Block S chose ESD9L for both antennas); SIMCom HD V1.03 Fig. 33 ("D1 is a Bidirectional ESD protection device").
  • Evidence: D28 = ESD9L5.0ST5G, C82326 (JLC: "Unidirectional", 0.9 pF, VRWM 5 V, VBR 5.4 V, VC 9.8 V); symbol pin 1 = C on /RF_ANT_LTE, pin 2 = A on GND; footprint pad 1 = cathode (silk band at x = −1.2 mm side verified). The LTE line has no DC. RF peak voltage at the connector: +23 dBm → 4.47 V pk (6.7 V at VSWR 3:1); A7670SA also transmits GSM 850/900 at +33 dBm → 14.1 V pk (21.2 V at VSWR 3:1). A unidirectional diode forward-conducts at ≈ −0.6 V on every negative half-cycle and avalanches at +5.4 V on GSM positive peaks.
  • Consequence: Hard clipping of every TX cycle: harmonics/spurious emissions (homologation IFT/CRT fail), lost TX power, PA stress, and likely destruction of D28 under GSM bursts (then possibly a short across the antenna port). Placement is fine (in-line, 1.8 mm from J13.1); the part is wrong.
  • Fix: D28 → Littelfuse PGB1010402KR, LCSC C10676 (polymer ESD, bidirectional, 0.04 pF, 0402; 59 948 in stock) with a 0402 land in the same in-line spot; or DNP D28 (SIMCom marks it optional). Keep D27 (GNSS) as is: its line carries +3.2 V bias, so a unidirectional 5 V part is correct there.
  • Effort: both (part + 0402 land)
  • Confidence: high.

B-04 Modem ground: one via under the A7670SA, none in U20's EP, none at J13; the whole LTE island reaches the inner GND planes through 5 vias

  • Severity: Blocker
  • Block / refs: §4-B (ground return/vias); lesson F5 (U6 EP without thermal vias, same class of omission); ECO §E6 (stitching); Phase-2 Block O ("full via field"); memory drogheda-v6-lte-island.
  • Evidence (islands.py, gndvias.py): board has 69 GND vias in total. U19 courtyard (162.2…186.2 × 60.0…84.0) contains 1 GND via. 34 of U19's 39 GND pads (incl. the 20 inner 2.1 × 2.1 mm LGA GND pads on a 3.8 mm grid) sit in one F.Cu GND cluster of 3611 mm² whose only connections to In1/In2 are 5 vias (at (152.6,62.5), (153.5,77.0), (198.8,78.1), (145.7,129.9), (148.1,135.3); nearest 21.3 mm from U19 centre) plus THT pads of J9, P1, P11. The other 5 U19 GND pads sit in three tiny islands with 1 via each. U20 EP (pad 9, 3.2 × 2.5 mm): 0 vias in pad, 0 within 2 mm; C127/C128/C130–C136/D22 GND pads: 0 vias within 3 mm. J13 GND pads: 0 vias within 3 mm. RF_LTE path (32 mm): 1 GND via within 1.5 mm of the centreline.
  • Consequence: The PA's 2 A return current and the RF return of the antenna feed flow through a chopped 1 oz F.Cu pour to vias ≥ 21 mm away → large current loops (radiated emission, GNSS desense = the brief's #1 risk), no RF reference continuity at the In1 transitions of RF_LTE (B-05), and the module's main heat path (GND pads → planes) is missing (A7670SA normal range −30…+80 °C in a 45 °C cabinet).
  • Fix (layout): tented 0.6/0.3 mm GND vias: (a) U19 — one in each of the 1.7 mm gaps between adjacent inner GND pads (≥ 16) plus a ring on the outer GND pads (58, 59, 61–65, 69–89 groups), target ≥ 40 vias; keep vias out of signal-pad areas; (b) U20 EP — ≥ 6 vias (2 × 3 array, 0.3 mm drill) in the EP land; (c) C127/C128 and every VBAT cap GND pad — 2 vias each ≤ 0.5 mm from the pad; (d) J13 and J12 GND pads — 2 vias per pad; (e) via fence along both RF lines (B-05/C-05). Re-run the cluster check: every GND pad of U19/U20/J13 in a cluster with ≥ 1 plane via within 2 mm.
  • Effort: layout
  • Confidence: high (geometry); impact magnitude medium (no field solver run for emissions).

C-01 GNSS antenna bias has no current limit and no supervisor; ANT_DETECT / ANT_SHORT_N are undriven

  • Severity: Blocker
  • Block / refs: §4-C (ANT supply current limit/short detection); memory drogheda-v6-zed-f9p-integration, drogheda-einarboard-v6-brief (H0005/H0014 antenna faults); u-blox ZED-F9P Integration Manual (antenna bias: "a 10 Ω current limiting resistor is required"); ZED-F9P DS Table 14/15 (VCC_RF ≤ 50 mA operating, 300 mA abs max).
  • Evidence: /VCC_RF_GNSS = U18.7 (VCC_RF) + L21 + C144/C145 only — L21 (68 nH, LQG18HN68NJ00D, C162555: 0.8 Ω DCR, 400 mA) connects VCC_RF straight to the antenna line; no series resistor, no switch. /GNSS_ANT_DETECT = U18.4 + U16.9 (PC1) and /GNSS_ANT_SHORT_N = U18.6 + U16.10 (PC2): both ends are inputs (these F9P pins are supervisor inputs), nothing drives them; with the F9P powered they sit at its internal pull-ups → MCU always reads "antenna present, no short". U18.5 ANT_OFF is NC.
  • Consequence: A crushed/wet coax (the H0005/H0014 class of fault) shorts 3V3_GNSS through L21: current limited only by U21 → exceeds VCC_RF 300 mA abs max and L21's 400 mA rating ("destroying the BIAS-T inductor"), collapses 3V3_GNSS (F9P brown-out loop), and the PC1/PC2 "antenna telemetry" never reports it.
  • Fix: add a current-limited antenna feed: TPS2552DBVR, LCSC C46506 (SOT-23-6, EN active-low): IN (1) = /3V3_GNSS; OUT (6) = net to L21.2/C144/C145 (rename /ANT_BIAS); ILIM (5) tied to IN → 75 mA typ (DS; above the 50 mA VCC_RF/antenna budget, below 300 mA); EN (3) ← U18.5 ANT_OFF with 100 kΩ to GND (C25803) so the antenna is ON by default; FAULT (4, open-drain) → /GNSS_ANT_SHORT_N (U18.6 + PC2) with 10 kΩ to /3V3_GNSS (C25804); leave U18.7 VCC_RF NC. U21 then supplies F9P 130 mA + antenna ≤ 75 mA = 205 mA (TPS7A2033 300 mA, see C-02). Minimum fallback if no new IC: 10 Ω 0805 in series between VCC_RF and L21.2 (u-blox minimum; short → 3.2 V/10.8 Ω ≈ 0.3 A, 0.95 W in the resistor → use a 1206 ≥ 0.5 W). Open-antenna detect (ANT_DETECT) can stay unimplemented; firmware infers it from C/N0.
  • Effort: both
  • Confidence: high.

B-05 RF_LTE runs 22.1 mm inside In1 (the GND reference plane) with two via transitions, 32–47 Ω, under power and LED tracks

  • Severity: Major
  • Block / refs: §4-B (50 Ω trace geometry, keepouts, LTE island rules); Phase-2 Block S ("referenced to unbroken In1… nothing crossing on any layer"); pre-fab audit §7 (flagged "v6.1"); memory drogheda-v6-lte-island.
  • Evidence (tracks.py, rfgeo.py, fdrun2.py): U19.60 (174.25,60.00) → F.Cu 1.75 mm → via (174.25,58.25) → In1 22.14 mm (w 0.50) → via (194.27,53.72) → F.Cu 2.3 mm → R118 (0 Ω) → /RF_ANT_LTE F.Cu 5.6 mm → D28 → J13.1. Total 31.8 mm. In1 section: same-layer GND fill at 0.15 mm both sides; F.Cu above is GND for only 45–55 % of the length; In2 below 65–89 %. Crossing copper: F.Cu /SYS5V, /SW_IN (Q1 = F9P rail switch), /VBAT_MODEM, /MODEM_LED_A/K; In2 /DIN_4G; B.Cu /5V_FAN. FD-solver impedance of the In1 trace: 32.5 Ω where F.Cu above is GND, 47.1 Ω where it is not → |Γ| up to 0.21 (RL 13.5 dB) with two via discontinuities and no adjacent GND vias (B-04).
  • Consequence: Uncontrolled LTE match; +23/+33 dBm TX energy coupled 0.21 mm into SYS5V/SW_IN (the F9P supply chain, see C-04) and VBAT; the In1 plane is slotted for 22 mm under F.Cu signals.
  • Fix (layout): route U19.60 → J13 entirely on F.Cu as CPWG over solid In1: w = 0.30 mm, gap = 0.20 mm (FD: 53.3 Ω bare / 48.4 Ω with 20 µm mask on JLC04161H-7628; alternative 0.35/0.25 → 51.3/47.1 Ω); confirm in JLC's impedance calculator and order impedance control. GND via fence both sides at ≤ 3.3 mm pitch (λg/20 at 2.69 GHz, εeff 2.8), vias ≤ 0.5 mm from the gap edge; two GND vias at each J13 ground pad; nothing on In1/In2/B.Cu under the line; keep the π-pad (C146/R118/C147) as is at J13. Add a KiCad netclass RF (0.30 mm track, 0.20 mm clearance, excluded from autoroute) and a custom rule for zone clearance 0.20 mm to RF nets.
  • Effort: layout
  • Confidence: high (geometry and solver agree with analytic within 2–3 Ω).

B-06 U20 AP64350 hot loop and thermal: input-cap ground returns 4.9–8.5 mm, EP without vias, FB node next to SW

  • Severity: Major
  • Block / refs: §4-B (compensation/frequency network, Cin), §4-A/F (Cin ≤ 3 mm); pre-fab B5; ECO §E3/§E4; Copper Plan §4.
  • Evidence (dist.py): VIN side is good: C128.1 → U20.2 0.72 mm, C127.1 → U20.2 2.38 mm; but GND side: C128.2 → U20.7 6.86 mm, C127.2 → U20.7 8.48 mm / → EP 4.94 mm, no vias (B-04). L20.1 → U20.8 2.24 mm ✅, C129 (BST) 1.8–1.9 mm ✅, R117 (RT) 1.44 mm ✅, R116/C142 (COMP) 0.72/2.15 mm ✅. FB: R111.1/R110.2 junction at (152.5–154.25, 61.4) is ≈ 2 mm from U20.8/SW copper; /FB_MODEM is 13.9 mm long (0.5 mm) running around U20; R110 top taps VBAT via a 5.6 mm In1 detour (vias (154.00,58.90)/(154.47,52.83)). Only C127 10 µF (≈ 4 µF at 24 V DC bias) + C128 1 µF at VIN; ECO §A asked 2 × 22 µF + 10 µF.
  • Consequence: A synchronous-buck input loop closed through several mm of pour around pin 1 (EMI at 500 kHz harmonics, SW ringing), EP θJA far above the DS 45 °C/W, FB noise pickup.
  • Fix (layout + 1 part): turn C127/C128 so their GND pads face U20's EP/pin 7 side and drop 2 vias each ≤ 0.5 mm; 6 EP vias (B-04); place R110/R111 at U20.5 (≤ 2 mm) on the side away from pin 8, take the VBAT sense from a dedicated trace at C131, delete the In1 detour; add 1 × 22 µF 0805 (C86817) at U20.2 ≤ 3 mm (with option B of B-01 the input is ≤ 5.5 V, so the 16 V part is fine; with option A use a 50 V 1206).
  • Effort: both
  • Confidence: high (geometry).

B-07 Modem USB-C J9 has no ESD protection (lesson F8), and the USB pair is split across layers

  • Severity: Major
  • Block / refs: §4-E/F (ESD at connectors); lesson F8; ECO §E5 (USBLC6 at J9); Review §4 item 7.
  • Evidence: /USB_DP = J9.A6/B6 + U19.27; /USB_DM = J9.A7/B7 + U19.28; /USB_VBUS = J9.A4/A9/B4/B9 + U19.24 → no protection device (unchanged since the 25-Sep review). J9 at (147.95,130.98) is 59 mm from U19; pair: DP F.Cu 49.9 + In1 9.6 mm, DM F.Cu 50.0 + In1 8.0 + In2 1.7 mm; coupled (≤ 0.6 mm) only 34.7 mm; J9 is the modem's firmware-update/USB_BOOT recovery port.
  • Consequence: A field-service ESD hit on J9 goes straight into the A7670SA USB PHY/VBUS (module = the only link); HS signal integrity marginal for FOTA/recovery.
  • Fix: add USBLC6-2SC6, LCSC C7519 (SOT-23-6) ≤ 5 mm from J9: I/O1 = USB_DM, I/O2 = USB_DP, VBUS pin = USB_VBUS, GND with 2 vias. Route DP/DM as a coupled pair on F.Cu only (w/gap for 90 Ω diff, e.g. 0.20/0.15 on JLC7628 — confirm in JLC calculator), one layer, ≤ 1 via pair.
  • Effort: both
  • Confidence: high.

C-02 U21 AP2112K start-up is 20 µs — the ZED-F9P VCC ramp window (20–8000 µs/V) is not guaranteed

  • Severity: Major
  • Block / refs: §4-C (VCC ramp); memory drogheda-v6-zed-f9p-integration ("20–8000 µs/V window, measure before fab"); ZED-F9P DS Table 15.
  • Evidence: U21 = AP2112K-3.3 (C51118), EN (pin 3) tied to VIN (/SW_5V), so it starts when Q1 switches /SW_5V on. Q1 gate: R2 10 k to SYS5V, pulled down directly by Q5 collector — no gate RC → /SW_5V steps in µs. AP2112 DS: t_S = 20 µs (no load) → 3.3 V/20 µs = 6 µs/V unloaded; with the actual ≈ 16–20 µF on /3V3_GNSS (C120, C124 10 µF + 3 × 100 nF) the ramp is bounded by the foldback current limit (50 mA at 0 V rising to ≈ 0.6–0.8 A) → ≈ 400 µs/V at the start falling to ≈ 20–25 µs/V near regulation, i.e. at/over the fast limit. The F9P is power-cycled on every 10-min duty window (R1: ≈ 52 000 starts/year).
  • Consequence: Out-of-spec VCC ramp → occasional failed F9P start (dark receiver until the next cycle) in exactly the duty-cycled mode R1 requires.
  • Fix: U21 → TPS7A2033PDBVR, LCSC C2862740 (TI, 300 mA, SOT-23-5 with the same pinout IN/GND/EN/NC/OUT, internal soft-start t_STR 750–1150 µs → 237–367 µs/V, inside the window with > 10× margin; inrush 20 µF·4.2 V/ms ≈ 84 mA + load < 360 mA limit; 95 dB PSRR @ 1 kHz; COUT ≤ 200 µF OK). Load: F9P 130 mA pk + antenna ≤ 75 mA (C-01) = 205 mA. Bench: scope /3V3_GNSS rise (target 100–1000 µs/V).
  • Effort: schematic-only (drop-in footprint)
  • Confidence: medium-high (AP2112 behaviour into 20 µF is derived from DS limits, not measured).

C-03 ZED-F9P: 0 vias under the module; 56 GND pads reach the planes through 5 vias

  • Severity: Major
  • Block / refs: §4-C (decoupling/GND per u-blox integration manual); Phase-2 Block N ("full pad-under-module via field").
  • Evidence: U18 courtyard (65.0…82.0 × 102.2…124.2): 0 vias. Its 56 GND pads (48-pad array of 1.1 mm pads on a 2.1 mm grid + 8 ring pads) are in one 946 mm² F.Cu cluster with 5 GND vias + 1 THT pad. J12 GND pads: 0 vias ≤ 3 mm.
  • Consequence: Poor RF/digital ground reference for the receiver and the RF input, shared return with the long digital lines leaving the island; higher susceptibility to the LTE aggressor.
  • Fix (layout): tented vias between the 1.1 mm GND array pads (gap 1.0 mm → 0.45/0.2 mm vias, or via-in-pad filled/capped if JLC option chosen): ≥ 24 vias; 2 vias at each J12 GND pad and at C121/C122/C120/C124/U21 GND pads.
  • Effort: layout
  • Confidence: high.

C-04 The GNSS supply switch Q1 sits 9 mm from the LTE antenna feed; /SW_5V crosses the whole board on In1

  • Severity: Major
  • Block / refs: §4-C (distance from LTE feed; desense); brief §4.3 ("#1 risk GNSS desense"); Copper Plan §5 ("no switcher/fast digital within 25 mm of the GNSS corner"); cross-block with power (F1/Q1 placement).
  • Evidence: Q1 (AO3401A, /SW_IN → /SW_5V) at (197.28,59.81) = 9.0 mm from J13; F1 at (171.4,44.3) in the LTE corner; Q5/R1/R2 at 192–196 mm. /SW_5V path Q1.3 → U21.1 = 167 mm (F.Cu 19.7 + In1 181.3 mm, 95 mΩ at 35 µm / 184 mΩ at 17.5 µm inner Cu). RF_LTE's In1 section passes 0.21 mm under /SW_IN and /SYS5V (B-05).
  • Consequence: The F9P's supply starts in the LTE transmitter's near field and travels 17 cm as a slot in the GND plane; LDO PSRR at LTE frequencies is ≈ 0 dB, so TX envelope/IMD products ride into the receiver rail (desense), and the In1 plane is cut end to end.
  • Fix (layout): move Q1 + Q5 + R1 + R2 (and F1 if the power auditor agrees) into the GNSS island next to U21/C3/C40/C119; bring /SYS5V (or /SW_IN) to it instead; route the remaining feed on F.Cu or In2 away from the RF lines; keep /PWR_CTRL as the long signal. Target /SW_5V ≤ 15 mm, 0 mm on In1.
  • Effort: layout
  • Confidence: medium (coupling level not simulated; geometry certain).

E-01 3V3_ETH is not switchable: the W5500 is powered on battery and during MCU reset (lesson F8 repeated)

  • Severity: Major
  • Block / refs: §4-E ("On V5 it was always-on and wasted battery"); lesson F8; R1/R3.
  • Evidence: U12 (MP1584EN) pin 2 EN = /SYS5V = pin 7 VIN → always on whenever SYS5V exists (vehicle and battery). W5500 DS: 128 mA (100M link), 75 mA (10M), 13 mA power-down; reset current not specified. J10 is DNP on the PCB, but U11/U12 are populated, so the draw exists even without a jack. Firmware 0.6.0-eth holds RST low without 5 V, but RST is floating/pulled-up during MCU reset (E-02).
  • Consequence: A permanent ≈ 0.05–0.6 W battery load (depending on link/reset state) through a light-load MP1584 and the boost — comparable to the whole 10-min duty-cycle average; exactly the V5 lesson.
  • Fix: new net /ETH_PWR_EN: U12.2 (EN) → U16 pad 54 PD2 (free) with 100 kΩ to GND (C25803) (MP1584 EN threshold ≈ 1.2–1.6 V; 3.3 V drive OK) — off in MCU reset/standby and on battery. PB10 (pad 29) is the alternative free pin. Coordinate with the MCU auditor (free pins: PC5, PB10, PA9, PD2).
  • Effort: both (1 resistor, 1 track)
  • Confidence: high.

E-02 /ETH_RST has no pull-down — and the 100 kΩ fix proposed elsewhere would not work against PA15's JTDI pull-up

  • Severity: Major
  • Block / refs: §4-E (RST with 100k pull-down); lesson F8; Review §4 item 6; ECO §F (ETH_RST 100 k); also affects V5.6 R112 100 k.
  • Evidence: /ETH_RST = U11.37 + U16.50 (PA15) only. PA15 resets to JTDI with an internal pull-up (30–50 kΩ) active during and after reset until firmware reconfigures it (RM0383 §8.3.1). A 100 kΩ pull-down gives 3.3·100/(100+30…50) = 2.2–2.5 V → W5500 RSTn reads HIGH (VIL ≤ 0.8 V) → chip out of reset during every MCU reset/DFU/bootloader. With 4.7 kΩ: 3.3·4.7/(4.7+30…50) = 0.28–0.45 V ✅; cost when driven high 0.7 mA.
  • Consequence: W5500 active (up to 128 mA) whenever the MCU is in reset/DFU/bootloader — on battery that is the lesson-F8 drain; a V5.6 built with R112 = 100 k keeps the bug.
  • Fix: add 4.7 kΩ 0603 (C23162, Basic) from /ETH_RST to GND at U11.37. Tell V5.6: R112 100 k → 4.7 k. (With E-01 in place this becomes belt-and-braces, but keep it for vehicle-power resets.)
  • Effort: schematic-only (+1 small footprint)
  • Confidence: high on the mechanism; medium on the exact pull-up value range (ST datasheet 30/40/50 kΩ).

E-03 W5500 crystal Y1: 10.8/13.7 mm from XO/XI, 22 mm crystal traces, load-cap mismatch

  • Severity: Major
  • Block / refs: §4-E (25 MHz crystal ≤ 5 mm, load caps vs CL); ECO §E6 (crystals ≤ 5 mm, R5); Phase-2 §5 row 6.
  • Evidence: Y1 (C14872 = YXC X49SM25MSD2SC, HC-49S, CL 20 pF, ±20 ppm) at (91.5,65.5); pad edge → U11.31 XO 10.79 mm, → U11.30 XI 13.74 mm; /ETH_XI 22.98 mm, /ETH_XO 22.03 mm (0.25–0.5 mm, F.Cu); C95 1.0 mm from Y1, C96 6.4 mm from Y1; C95/C96 = 18 pF. Effective CL ≈ (18 + ≈ 5 pF stray)/2 ≈ 11.6 pF vs 20 pF → frequency pulled high by ≈ +70…110 ppm (C1 7–10 fF, C0 4–5 pF assumed for HC-49S), plus ±20 ppm tolerance — W5500 requires ±30 ppm (DS), 100BASE-TX ±50 ppm. Also 63 × 25 MHz = 1575.000 MHz, 0.42 MHz from GPS L1 (inside the C/A main lobe); long crystal traces radiate that harmonic family (MCU HSE Y3 is also 25 MHz — MCU/EMC auditor).
  • Consequence: Link errors/negotiation failures at temperature extremes; slow or marginal oscillator start; an avoidable radiator near L1.
  • Fix: place Y1 ≤ 5 mm from U11.30/31 with C95/C96 at the crystal pads, ground guard; set C95/C96 → 33 pF C0G 0603 (C1663, Basic) → CL ≈ (33 + 4)/2 ≈ 18.5–19 pF for the 20 pF crystal (or use a 3225 25 MHz CL 18 pF part with 27 pF caps). Verify with a frequency counter (target ±10 ppm).
  • Effort: both
  • Confidence: medium on the ppm number (crystal motional parameters assumed); high on geometry and CL mismatch.

B-08 VBAT_MODEM feed: 0.5 mm neck into pins 55–57; 1 mm over 7 mm; no pour

  • Severity: Minor
  • Block / refs: §4-B (track width/length per layer, drop at 2 A); SIMCom HD ("VBAT ≥ 3 mm" V1.03 / "≥ 2 mm" V1.00); DRC T15 rule (7 segments < 0.8 mm).
  • Evidence (tracks.py, pathr.py): F.Cu 48.9 mm (0.25/0.5/1/1.5/2 mm) + In1 6.3 mm (0.5 mm, FB tap), 2 vias. Final feed: 0.5 mm × 2.5 mm into U19.55 then 0.5 mm × 2.0 mm along the pads to 56/57; 1.0 mm for ≈ 7 mm from C132 to C136. Resistance L20.2 → U19.55 = 12.5 mΩ (→ U19.57 14.4 mΩ); C131 → U19.55 7.3 mΩ; drop at 2 A = 25–29 mV (static, fine); SW_MODEM now 1.0 mm × 6.6 mm (was 0.25 mm on 25-Sep ✅).
  • Consequence: Electrically acceptable DC drop; violates the vendor width rule and adds loop inductance between the bulk and the pins.
  • Fix (layout): F.Cu pour ≥ 3 mm wide from L20.2 → C130 → C131 → C132–C136 → U19.55/56/57 (fan out to all three pads); C131 (polymer, B-02) within 5 mm of the pads.
  • Effort: layout
  • Confidence: high.

B-09 SIM interface details (J14 primary): 0 Ω instead of 22 Ω, ESD 22–25 mm from the holder, VDD cap 13.5 mm away, no ESD on VDD

  • Severity: Minor
  • Block / refs: §4-B (SIM/eSIM); memory drogheda-mff2-footprint (Telcel will not supply MFF2 → J14 primary, U22 DNP); SIMCom A7670 HD Fig. 19.
  • Evidence: J14 (JAE SF72S006, C2977286, populated) + R131–R134 0 Ω populated; U22 + R127–R130 DNP ✅. D23/D24/D25 (PESD5V0S1BA TECH PUBLIC clone, C2827694, bidirectional, capacitance not stated; Nexperia original 35 pF) sit 1.3–5.7 mm from U19 but 21.7–24.8 mm from the J14 contacts; C126 (100 nF) 13.5 mm from J14.C1; /SIM_VDD has no clamp; total SIM trace lengths VDD 37.5 / DATA 46.9 / CLK 38.5 / RST 45.4 mm; USIM1_DET NC (intentional, hot-plug stays off) ✅; U22 die-pad zone crossed by /SIMB_CLK and /SIMA_RST on F.Cu (harmless while U22 is DNP).
  • Consequence: Less ESD protection at the card (handled at assembly/service), more EMI/ringing on CLK than the reference.
  • Fix: R132/R133/R134 (RST/CLK/DATA holder branch) → 22 Ω 0603 (C23345, Basic); add 100 nF 0402 (C1525) at J14.C1; move D23–D25 (or add an ESDA6V1W5-class array covering VDD) next to J14; keep F.Cu clear under U22's die-pad zone if MFF2 is ever fitted.
  • Effort: both
  • Confidence: high.

B-10 Undefined idle levels on the modem interface; RTCM-tap series resistor too small

  • Severity: Minor
  • Block / refs: §4-B (STATUS readback, back-powering, R106 tap).
  • Evidence: U24 (74LVC2T45, VCCA = /1V8_MODEM) is in suspend (both ports Hi-Z) whenever the modem is off → /MODEM_STATUS (PC9) and /DOUT_4G float; /DIN_4G floats during the K1 transfer and when the F9P is off. R106 = 100 Ω between /DOUT_4G (U24 1B output) and PC7: if PC7 is ever mis-configured as an output, contention current ≈ 3.3 V/100 Ω = 33 mA (> STM32 25 mA pin limit).
  • Consequence: PC9 can read "modem on" with the modem off unless firmware remembers the pull-down; possible pin stress on a firmware slip.
  • Fix: 100 kΩ (C25803) /MODEM_STATUS → GND; 100 kΩ /DIN_4G → /3V3 (UART idle high); R106 100 Ω → 1 kΩ (C14676) (ECO §B value; 1 kΩ × ≈ 5 pF = 5 ns, fine to 921 600 Bd).
  • Effort: schematic-only (+2 small footprints)
  • Confidence: high.

B-11 No-connect flags on connected MCU pins U16.37 (PC6) and U16.38 (PC7)

  • Severity: Minor
  • Block / refs: §4-B (USART6); ERC; memory drogheda-einarboard-v6-phase12 (T2 added labels, old NC flags stayed).
  • Evidence: mcu_pins.csv: PC6 /USART6_TX → K1.10, PC7 /USART6_RX → R106.2 — status CONNECTED +NC_FLAG_ON_CONNECTED_PIN; ERC marker "A pin with a no-connection flag is connected" (erc_summary line 73). Netlist and PCB are correct (both nets routed: 73.3 mm / 42.3 mm).
  • Consequence: Cosmetic today; a future script/netlist tool that honours NC flags could drop the modem UART.
  • Fix: delete the two NC flags at U16 pin coordinates (482.6, 431.8) and (482.6, 434.34); ERC should lose the marker.
  • Effort: schematic-only
  • Confidence: high.

C-05 GNSS RF line: 38 Ω, a DC trace 0.46 mm alongside for 10 mm, sparse via fence, ESD on a stub

  • Severity: Minor
  • Block / refs: §4-C (antenna chain, 50 Ω geometry, ESD, DC block).
  • Evidence: /RF_GNSS C143.2 → U18.2 = 22.7 mm F.Cu, w 0.50 mm, gap 0.15 mm, 100 % In1 GND beneath; FD solver 38.4 Ω bare / 35.2 Ω masked on JLC7628 (50.6/45.6 Ω on the file stack; Wadell CPWG 37.5–41 Ω); east side has no coplanar ground from y 113.45 to 123.25 because /VCC_RF_GNSS runs parallel at 0.46 mm edge gap for 9.8 mm; 1 GND via within 1.5 mm over 27 mm (λg/20 at L1 = 5.7 mm). J12 → C143 0.56 mm ✅ (DC block at the connector), L21 bias tap 1.9 mm ✅, but D27 sits at the end of a 2.8 mm stub beyond C143 (≈ 1–1.2 pF with the stub → RL ≈ 11 dB, ≈ 0.4 dB) . L21 68 nH has SRF 1 GHz (C162555) → still a −j455 Ω shunt at L1 and −j1042 Ω at L2 (< 0.02 dB) ✅ (u-blox recommends 120 nH).
  • Consequence: ≈ 0.1–0.4 dB loss after the antenna LNA (negligible for system NF with a ≥ 25 dB active antenna); the parallel VCC_RF trace is the more relevant coupling path.
  • Fix (layout): w 0.30 / gap 0.20 mm (as B-05); move the bias feed (now /ANT_BIAS from C-01) away from the RF line with GND pour between; put D27 on the J12 pad (stub-less); GND vias both sides ≤ 5 mm; 2 vias per J12 GND pad. Optional: C143 → 47 pF C0G 0402 (series-resonant near L1) instead of 100 nF X7R.
  • Effort: layout
  • Confidence: high.

C-06 F9P back-powering through I/O when /3V3_GNSS is off

  • Severity: Minor
  • Block / refs: §4-C; ZED-F9P DS Table 14 (Vin ≤ VCC + 0.5 V when VCC ≤ 3.1 V).
  • Evidence: U18.26 RXD2 is driven directly by U24 1B (/DOUT_4G, 3.3 V, VCCB = always-on /3V3) whenever the modem is on; U18.43 RXD by PA2 (USART2 TX idles high); U18.49 RESET_N by PC12 (R105 pull-up goes to the switched rail); TIMEPULSE/RTK_STAT inputs on the MCU side could have pull-ups.
  • Consequence: Any "F9P off, modem on" state (e.g. a PWR_CTRL cycle for GNSS recovery) injects current through the F9P's input clamps.
  • Fix: firmware rule (below) + optional 1 kΩ (C14676) in series at U18.26 (split /DOUT_4G: U24.7 + R106 | 1 kΩ → U18.26) to cap injection at ≈ 2.8 mA.
  • Effort: firmware-only (+ optional schematic)
  • Confidence: high.

C-07 No test pad on SAFEBOOT_N (F9P firmware recovery)

  • Severity: Minor
  • Block / refs: §4-C (SAFEBOOT_N test pad?); memory drogheda-v6-lte-island (P17/F9P USB removed, u-center only via J11 passthrough).
  • Evidence: U18.50 SAFEBOOT_N NC (no pad); V_USB/USB_DM/USB_DP NC; the only access is UART1 through the MCU bridge.
  • Consequence: A failed F9P firmware update over the passthrough cannot be recovered (safeboot needs SAFEBOOT_N low at power-up).
  • Fix: add a 1 mm test pad on U18.50 (and one on U18.49 RESET_N) next to a GND pad; no resistor.
  • Effort: both
  • Confidence: high.

E-04 W5500 TOCAP and 1V2O capacitor values do not follow the datasheet

  • Severity: Minor
  • Block / refs: §4-E (analog/digital supply decoupling); W5500 DS pin table.
  • Evidence: C90 on /ETH_TOCAP (U11.20) = 10 µF (DS: 4.7 µF; schematic note "VERIFY value vs ref"); C91 on /ETH_1V2 (U11.22) = 4.7 µF (DS: 10 nF, 470× larger). C90 4.4 mm, C91 5.5 mm from their pins. AVDD pins 15/17/28 have 100 nF at 1.3–1.5 mm; pins 4/8/11/21 rely on C94 10 µF (7.1 mm) / C102 22 µF (5.8 mm).
  • Consequence: Internal 1.2 V regulator operated outside its specified load capacitance (start-up/stability risk); weaker HF decoupling.
  • Fix: C91 → 10 nF 0603 X7R (C1589); C90 → 4.7 µF 0805 (C1779, the part now on C91); both ≤ 2 mm from their pins; add 100 nF (C14663) at AVDD pins 4/8 and 11/21 pairs.
  • Effort: both
  • Confidence: high.

E-05 J10 is DNP on the PCB but populated in the schematic, with a different footprint library nickname

  • Severity: Minor
  • Block / refs: §4-E (magnetics/RJ45); sch_pcb_sync.md; pre-fab audit §7.
  • Evidence: schematic footprint Connector_RJ45:RJ45_Hanrun_HR911105A_Horizontal (nickname not in fp-lib-table) vs PCB Connector_RJ:…; DNP no (sch) / yes (pcb). LCSC C12074 set. MAGJACK_NO_POUR keepout present ✅. LED pin mapping (9–12) still carries "VERIFY" in the schematic.
  • Consequence: BOM from the board omits J10 (no Ethernet on the prototypes); BOM from the schematic includes it; Update-PCB either fails the footprint lookup or re-populates J10.
  • Fix: Leo decides populate/DNP for the 5 prototypes; then set schematic footprint to Connector_RJ:RJ45_Hanrun_HR911105A_Horizontal and the same DNP state in both; verify LED pins against the HR911105A drawing.
  • Effort: schematic-only
  • Confidence: high.

E-06 Ethernet pairs not coupled and split across layers; no line-side ESD; J10 pin 8 NC

  • Severity: Minor
  • Block / refs: §4-E (TX/RX diff-pair routing; ESD).
  • Evidence: TXP F.Cu 3.9 + In1 11.7 mm (1 via) vs TXN F.Cu 21.5 mm → coupled 0.3 mm; RXP F 5.0 + In1 11.2 vs RXN F 5.8 + In1 14.9 → coupled 1.2 mm; skew 5.9 mm (TX) / 4.4 mm (RX) ≈ 30–40 ps (irrelevant at 100BASE-TX); no ESD array on TX/RX; J10.8 NC (on common HR911105A drawings pin 8 is the shield/Bob-Smith node — verify). Terminations: TX 49.9 Ω to 3V3_ETH + TCT (J10.4) on 3V3_ETH; RX 49.9 Ω to RCT + 6.8 nF ✅ (W5500 reference topology). EXRES1 R83 12.4 k 1 % (C103261) 5.0 mm from pin 10 ✅; VBG open ✅; RSVD23 → GND, 38–42 open ✅; PMODE all high via R84 ✅.
  • Consequence: Common-mode emission from the unbalanced pairs; slightly lower ESD robustness on cabled installations.
  • Fix (layout): route each pair coupled on F.Cu only (100 Ω diff), ≤ 1 via pair, keep In1 unbroken; optional low-cap array (e.g. SRV05-4 class) between magjack and U11; tie J10.8 per the HR911105A drawing.
  • Effort: layout
  • Confidence: medium (J10.8 function not confirmed from the Hanrun PDF).

B-12 Stackup and netclasses: generic stack in the file; RF and PWR_MODEM netclasses missing

  • Severity: Note
  • Block / refs: evidence/stackup.md §1, §4; memory drogheda-v6-lte-island ("RF 0.35 mm netclass + PWR_MODEM 1.5 mm") — both lost; INDEX gotcha #2.
  • Evidence: file stack 3 × 0.48 mm εr 4.5; RF traces drawn 0.50 mm (≈ 50 Ω only on that fictitious stack: FD 50.6 Ω); /VBAT_MODEM, /VIN_MODEM, RF nets resolve to Default (0.15 mm rule).
  • Fix: set the board stackup to JLC04161H-7628 values; recreate netclasses RF (0.30/0.20, no autoroute) and PWR_MODEM (1.5 mm) and assign by exact net names (/RF_LTE, /RF_ANT_LTE, /RF_GNSS, /RF_ANT_GNSS; /VBAT_MODEM, /VIN_MODEM, /SW_MODEM); order impedance control.
  • Effort: layout (project settings)
  • Confidence: high.

B-13 K1 fail-safe premise is obsolete on v6

  • Severity: Note
  • Block / refs: Phase-2 Block T; Phase-1 §1.4; memory drogheda-epct-telemetria.
  • Evidence: K1 NC = F9P TXD2 → modem RXD, NO = PC6. The "MCU dead ⇒ receiver GGA reaches the caster ⇒ corrections keep flowing" logic assumed the ArduSimple NTRIP Master's own NTRIP client. The A7670SA has none (brief §2.5), and an MCU reset also switches the modem off (R113 pulls EN low) and releases K1 (R41). Coil 5 V × 30 mA = 150 mW whenever Mode B (now the normal mode) is held.
  • Fix: none for v6 (no harm); firmware energises K1 only while the modem is on; consider replacing K1 by a direct PC6 → DIN_4G link in v6.1.
  • Effort: firmware-only
  • Confidence: high.

B-14 Everything the modem prints reaches the F9P's UART2 (hard-wired RTCM path)

  • Severity: Note
  • Block / refs: §4-B (RTCM tap, contention); Phase-1 §2/§4.
  • Evidence: /DOUT_4G = U24 1B → U18.26 RXD2 and R106 → PC7. No contention (single driver U24) ✅. But AT responses/URCs and any non-transparent socket framing (+RECEIVE…/+CIPRXGET headers) are fed to the receiver; the MCU can read RTCM age from GGA field 13 (USART2) and raw RTCM3 frames on PC7 ✅.
  • Fix (firmware): F9P UART2 in-protocol = RTCM3 only, baud = modem baud (115 200) saved to BBR+flash; caster socket in transparent mode (AT+CIPMODE=1) or, if multi-socket is needed for $PHLG, disable RTCM on UART2 and forward re-assembled RTCM from the MCU on USART2 TX → F9P UART1 (RTCM input enabled by default).
  • Effort: firmware-only
  • Confidence: high.

B-15 R107/R108 "bypass the shifter" footprints cannot work

  • Severity: Note
  • Evidence: DNP 0 Ω across U24 ch1 (/DOUT_4G_M↔/DOUT_4G) and U23 ch1. Fitted with the shifter removed they put 1.8 V on F9P RXD2 (VIH = 0.8·VCC = 2.64 V → no data) and 3.3 V on modem RXD (abs max 2.0 V, HD V1.03 Table 41).
  • Fix: delete them (or add a schematic note "never fit").
  • Effort: schematic-only
  • Confidence: high.

B-16 Cold start on battery — modem-side numbers (the requested explicit statement)

  • Severity: Note
  • Block / refs: §4-B cold-start test; ECO R1; …Modem-on-battery_Diagnosis; LTC4040 DS; AP64350 DS.
  • Evidence (budget.py; assumptions: VSYS 4.79 V, U6→D21 41.7 mΩ + D21→U20 5.7 mΩ measured, η(U20) 90 %, η(boost) 87 %, non-modem MAIN5V load 0.38 A incl. W5500 and K1):
D21 / option Modem load VIN(U20) I(MAIN5V) vs LTC4040 2.5 A P_batt I_batt @3.6 / 3.2 V Vout max (98 % D)
PMEG3050EP (as is) LTE 23 dBm 0.67 A 4.54 V 1.00 A OK 5.5 W 1.53 / 1.73 A 4.38 V
PMEG3050EP GSM burst 2.0 A 4.44 V 2.28 A OK (9 %) 12.6 W 3.49 / 3.93 A 4.15 V
PMEG3050EP 2.8 A (A7670 HD V1.00 peak) 4.38 V 3.08 A over 16.9 W 4.71 / 5.29 A 4.02 V
PMEG6045ETPX (B-01 A) GSM 2.0 A 4.27 V 2.36 A OK (6 %) 13.0 W 3.61 / 4.06 A 3.98 V
link, no diode (B-01 B) GSM 2.0 A 4.70 V 2.17 A OK (13 %) 12.0 W 3.33 / 3.74 A 4.41 V
link (B-01 B) LTE 1.0 A 4.75 V 1.27 A OK 7.0 W 1.94 / 2.18 A 4.55 V

AP64350 UVLO rising 3.5–3.7 V / falling ≈ 3.1–3.3 V vs VIN ≥ 4.2 V in every case (V5.5's MP1584 had ≈ 0.1 V margin). Boost ILIM(BST) 5.5–7.5 A vs ≤ 4.1 A battery current in the 2 A cases. AP64350 soft-start 2 ms → inrush 456 µF·3.8 V/2 ms = 0.87 A.

  • Statement: Yes — v6 can bring the modem up from the LTC4040 boost alone, provided (1) the modem is enabled only after the F9P rail has settled, (2) the modem is LTE-only on battery (GSM 2.8 A peaks exceed the 2.5 A backup limit), (3) the W5500 is off (E-01), and (4) the VBAT bank is fixed (B-02); otherwise LTE-burst droop, not UVLO, is the failure mode. Option B of B-01 adds ≈ 0.27 V of headroom; option A removes ≈ 0.16 V. Max duty of the AP64350 is not stated in DS41976 — bench-check VBAT at MAIN5V = 4.6 V, 2 A load.
  • Hardware path to remove modem power (R2): yes — EN low stops U20; VBAT decays through R112 1 kΩ with τ = 1 kΩ × 456 µF = 0.46 s → 47 mV after the 2 s HARD_CYCLE. PWRKEY (Q20) and RESET (Q21) are the soft steps above it.
  • Confidence: medium (efficiencies and non-modem load assumed; power auditor owns the full budget).

C-08 Identity: no $GPTXT H00xx source on v6; $PHID exists only on the Ethernet socket

  • Severity: Note
  • Block / refs: §4-C (lesson F9); Review F9; pre-fab audit (does not cover identity).
  • Evidence: H00xx came from the ArduSimple NTRIP Master firmware (retired). The A7670SA and the F9P (only $GxTXT banners) emit no unit ID. Firmware 0.6.0-eth builds $PHID,<96-bit UID>,<fw>,<board>,<MAC>,<up_s> from HAL_GetUIDw0..2 (L718–724) but sends it only in ethSendId() on the TCP mirror.
  • Fix: firmware 0.7.x sends $PHID on the modem uplink at every connect and every 5 min; backend retranslator maps UID → H-number before v6 ships.
  • Effort: firmware-only (+ backend)
  • Confidence: high.

C-09 V_BCKP on the always-on /3V3

  • Severity: Note
  • Evidence: U18.36 = /3V3 (ungated) → hot start after each 10-min off (45 µA, DS Table 15) ✅; its decoupler Cu4 (100 nF, /3V3) is 4.06 mm from pin 36 (Copper Plan asked "at the pin").
  • Fix: move Cu4 to ≤ 2 mm (optional).
  • Effort: layout
  • Confidence: high.

E-07 PoE

  • Severity: Note
  • Evidence: no PoE PD/controller; J10.7/J10.8 NC; firmware prints "SIN PoE". Consistent with the recorded decision (external splitter if ever needed; v6.1 feature).
  • Effort: —
  • Confidence: high.

Pass checks

Check Evidence (one line) Result
A7670SA footprint/pin numbering LGA-124 matches A7672X/A7670X HD V1.03 (VBAT 55–57, RF_ANT 60, STATUS 66, VDD_1V8 15, UART 9/10, USIM 30–34) ✅
U20 EN default OFF EN 1.5 µA pull-up × R113 100 k = 0.15 V < 1.03 V EN-low ✅
U20 output set-point 75 k/20 k → 3.80 V; worst 3.67–3.94 V (±1 % R, ±2 % VFB) inside 3.4–4.2 V ✅
U20 frequency R117 200 k → 500 kHz (RT = 100000/f); t_on at 40 V = 190 ns > 100 ns min ✅
L20 saturation MWSA0804S family: 8.2 µH part Isat 8.7 A → 4.7 µH ≥ 8.7 A vs peak 2.7 A and 5.75 A HS limit ✅ (medium)
L20/C129/COMP/RT placement L20 2.24 mm, BST 1.8 mm, COMP 0.72 mm, RT 1.44 mm from pins ✅
SW_MODEM copper 1.0 mm × 6.6 mm, 2.2 mΩ (was 0.25 mm × 23 mm on 25-Sep) ✅
VBAT HF ceramics C133–C136 1.7–2.7 mm, C132 4.1 mm from VBAT pads ✅
D22 polarity SMAJ5.0A pad 1 = cathode (silk band) on /VBAT_MODEM ✅
VBAT bleed for HARD_CYCLE τ = 0.46 s → 47 mV after 2 s EN-low ✅
PWRKEY / RESET drive 2N7002 open-drain, 100 k gate pull-downs, no caps (≤ 100 nF rule) ✅
Level shifting U23 DIR = GND (B→A, 3.3 → 1.8 V into modem RXD), U24 DIR = VCCA (A→B TXD + STATUS), unused 2B tied GND ✅
Back-powering of the modem 74LVC2T45 suspend/Ioff when VCCA = 0 (both ports Hi-Z); PWRKEY/RESET open-drain; only 1.8 V on _M nets (abs max 2.0 V) ✅
STATUS readback U24 2A→2B, VOH ≈ 3.3 V vs PC9 VIH 2.31 V ✅ (float when off → B-10)
UART contention /DOUT_4G single driver (U24); /DIN_4G via SPDT break-before-make K1 ✅
RTCM visibility GGA field 13 on USART2 (PA3) + raw RTCM3 on USART6 RX (PC7) ✅
USART allocation USART6 PC6/PC7 (AF8), USART2 PA2/PA3, USART1 RX PA10; PA9 free ✅
USB_BOOT TP8 floating (not pulled low at power-up) ✅
SIM population J14 + R131–R134 fitted, U22 + R127–R130 DNP; USIM1_DET NC (hot-plug off) ✅
LTE π-pad R118 0 Ω + C146/C147 DNP at J13 (SIMCom Fig. 25) ✅
Island separation J13↔J12 150.3 mm, U19↔U18 108.9 mm ✅
GNSS DC block / bias-T C143 0.56 mm from J12; L21 −j455 Ω at L1 despite 1 GHz SRF ✅
D27 on GNSS line unidirectional 5 V, cathode on line, bias 3.2 V < VRWM ✅
F9P decoupling C121/C122 1.7 mm, C120/C124 2.4–2.5 mm, U21 4.4 mm from VCC pins ✅
F9P control/status wiring RESET_N PC12 + R105 10 k; TIMEPULSE PA7 (TIM3_CH2); RTK_STAT PC3; D_SEL open = UART; UART1↔USART2; UART2 RX←modem, TX→PA10/K1 ✅
V_BCKP on always-on /3V3, 45 µA ✅
No H00xx identity source no ArduSimple module on v6 ✅ (→ C-08)
W5500 SPI/INT SPI2 PB12–15 (AF5), INT PC0 (BOOT1 trap avoided) ✅
W5500 straps/analog PMODE all high; EXRES1 12.4 k 1 %; VBG open; RSVD23 GND; 38–42 open ✅
Ethernet termination TX 49.9 Ω to 3V3_ETH + TCT; RX 49.9 Ω to RCT + 6.8 nF ✅
Magjack keepout MAGJACK_NO_POUR rule area on all layers (vias/pour not allowed) ✅
PoE none, documented ✅ (note)

Review-vs-Lessons §4 checklist items re-verified

  • #4 F1 modem rail integrity → partially improved, not closed. Now: SW_MODEM 1.0 mm ✅ (was 0.25), VIN_MODEM 0.3–0.8 mm (was 0.25/0.5), L20 2.24 mm from U20 ✅ (pre-fab: 9.5 mm); still C131 8.7 mm / C130 16.3 mm, VBAT neck 0.5 mm, no 2 × 22 µF at U20.2; new: bulk is a GP electrolytic (B-02), input on unfused /24V with a 30 V OR-diode (B-01), 1 via under U19 (B-04).
  • #6 ETH_RST pull-down → still missing; the proposed 100 k would not work (PA15 JTDI pull-up) → 4.7 k (E-02); plus 3V3_ETH gating (E-01).
  • #7 J9 ESD → still missing (B-07).
  • #11 $PHID identity → firmware sends it on Ethernet only (C-08).
  • #12 firmware v6 pins → no board_v6.h yet; pin list below.
  • #13 PoE decision → no PoE in hardware (E-07); record in the schematic block note if not done.
  • #14 AP64350 compensation → evaluated: current values are the 5 V Table 1 row and do not fit either the ceramic-only or the polymer bank → new values in B-02.
  • #15 bench validation → still pending; add: VBAT load step (B-02), /3V3_GNSS ramp (C-02), antenna short test (C-01), D21 leakage hot (B-01 A only).
  • Review §2 "Switcher EP vias (U20)" → still 0 (B-04/B-06).

Requirements input R1–R5

  • R1 (10 min off → wake → report, on battery): hardware path exists (U20 on its own EN, D21 from the boost, STATUS on PC9, UVLO margin ≥ 0.9 V). Needs change B-02 (VBAT bank + compensation) and B-01 (option B preferred: +0.27 V headroom); C-02 for reliable F9P restarts every cycle; E-01 for battery energy; firmware sequencing (LTE-only on battery).
  • R2 (modem never left dark; MCU can power-cycle it): satisfied by hardware (EN with R113 pull-down = full power removal, τ 0.46 s bleed; PWRKEY/RESET via Q20/Q21; STATUS); B-10 pull-down makes STATUS unambiguous; firmware ladder below.
  • R3 (report while on battery): budget OK with LTE-only (≈ 1.0–1.3 A on MAIN5V); GSM bursts 2.2–2.4 A sit at the 2.5 A backup limit. Link robustness needs B-02, B-03, B-04 (and B-05).
  • R4 (temperature management): modem temperature via AT+CPMUTEMP (firmware); B-04 is the modem's heat path; no board sensor near U19 (thermal auditor).
  • R5 (EMC list): item 5 J9 ESD → B-07; item 6 crystals ≤ 5 mm → E-03 (Y1); item 4 hot loops → B-06 (U20); plus RF/plane items B-05, C-04.

Firmware implications (things board_v6.h / FW 0.7.x must do)

  • Pins: PIN_MODEM_PWR_EN PC10 (high = on; R113 pulls off), PIN_MODEM_PWRKEY PC8 (high = PWRKEY asserted low via Q20), PIN_MODEM_RST PC11 (high = RESET asserted via Q21), PIN_MODEM_STATUS PC9 (input, pull-down), modem UART = USART6 PC6 TX / PC7 RX, PIN_BYP_CTRL PB5 (K1), F9P UART1 = USART2 PA2/PA3, F9P UART2 TX tap = USART1 RX PA10 (PA9 unused), PIN_GNSS_RESET_N PC12 (open-drain only), PIN_GNSS_TIMEPULSE PA7 (TIM3_CH2 capture), PIN_GNSS_RTK_STAT PC3, PIN_GNSS_ANT_DETECT PC1 / PIN_GNSS_ANT_SHORT_N PC2 (inputs, no pull-ups; meaningful only after C-01), W5500 as V5 (SPI2 PB12–15, INT PC0, RST PA15) + PIN_ETH_PWR_EN PD2 if E-01 is adopted.
  • Modem power-up (duty window): PWR_CTRL high → F9P settled (≥ 1–4 s) → check BAT_SENSE ≥ 3.4 V → W5500 off → MODEM_PWR_EN high → wait ≥ 100 ms (2 ms soft-start + bank charge) → PWRKEY asserted 100–500 ms (≥ 50 ms) → wait STATUS high (typ 7–11.2 s, timeout 20 s) → BYP_CTRL high (Mode B) → AT sync at 115 200 → AT+CNMP=38 (LTE-only) on battery → attach/NTRIP/report → ≥ 2 $PHLG with pwr=BATT → power-down.
  • Modem power-down: AT+CPOF (or PWRKEY asserted ≥ 2.5 s) → wait STATUS low (≤ ≈ 2–3 s) → MODEM_PWR_EN low → hold ≥ 2 s → BYP_CTRL low → PWR_CTRL low. Never have PWR_CTRL low while MODEM_PWR_EN is high (C-06).
  • Recovery ladder (vehicle or battery, modem only): AT timeout → RESET asserted ≈ 2.5 s (HD V1.03 Table 12) → PWRKEY off/on → HARD_CYCLE (EN low ≥ 2 s) → 3 strikes → log MODEM_DARK, retry next window; never cycle PWR_CTRL for a link problem. Every MCU reset power-cycles the modem (R113) → re-run the full sequence after reset.
  • Modem watch: replace the V5 sag5 heuristic (with the current D20 feed the modem draws from 24 V, not VEH5V) by STATUS + AT responses + RTCM byte count on PC7; VBAT via AT+CBC, temperature via AT+CPMUTEMP (no ADC on VBAT_MODEM).
  • I/O discipline: modem off → disable USART6, PC7 analog, PC9 pull-down; F9P off → PA2 Hi-Z/analog, PC12 Hi-Z, no pull-ups on PA7/PC3/PC1/PC2; USIM hot-plug stays disabled (CSW/DSW NC).
  • F9P configuration (BBR + flash): UART2 baud = modem baud (115 200), UART2 in-protocol RTCM3 only (UBX/NMEA/SPARTN off), UART2 out = NMEA GGA only if the K1-NC path is still wanted; UART1 NMEA/UBX for the MCU; after C-01: CFG-HW-ANT_CFG_VOLTCTRL/SHORTDET = 1; prefer UBX-CFG-RST over RESET_N; u-center passthrough must follow CDC line-coding → USART2 baud.
  • NTRIP transport: transparent caster socket (AT+CIPMODE=1) or MCU re-assembly → USART2 → F9P UART1 (B-14); RTCM age from GGA field 13 and the RTCM3 frame walker on PC7.
  • Identity: $PHID (96-bit UID) on the modem uplink at connect + every 5 min (C-08).
  • Ethernet: ETH_PWR_EN low on battery and at boot until needed; RSTn low ≥ 500 µs before release; keep SPI2 pins low/Hi-Z while 3V3_ETH is off.
  • K1: energise only while the modem is on (150 mW coil).

Inputs needed from Leo

  1. Vehicle classes in the fleet (12 V only, or 24 V trucks/RTGs?) and the max steady/transient voltage you want to survive → decides B-01 option A vs B (assumed: 9–36 V per T9, 24 V systems present).
  2. Is 2G fallback required on battery? (assumed no → LTE-only on battery; GSM bursts exceed the backup limit.)
  3. GNSS antenna model: bias voltage range and current (assumed 3.0–3.3 V accepted, ≤ 30 mA → 75 mA limit fits).
  4. Ethernet on the 5 prototypes: populate J10 or not (E-05)?
  5. Will technicians use J9 (modem USB) in the field? (sets how hard to push B-07; assumed yes, occasionally.)
  6. Result of gate T1 (max cabinet tntc) — v6 has no heatsink clamp hole near U19 (MH11 of the brief is gone).
  7. Fab order: JLC04161H-7628 with impedance control and ENIG (assumed; required for the RF numbers above).