Drogheda/03-Architecture-Hardware/2026-07-06_Drogheda_EinarBoard-1.0-PreFab-Audit_v1.0.md

---
title: EINARBoard HBOX 1.0 — Pre-Fabrication Design Audit
tags: [project-drogheda, hardware, watchdog, pcb, audit, einarboard]
project: Project Drogheda
author: Helgen CTO (Claude audit, reviewed by Leo)
date: 2026-07-06
status: BLOCKING — do NOT order until HIGH items are cleared
---

# EINARBoard HBOX 1.0 (`hbox-watchdog-v3-PROD`) — Pre-Fab Audit

**Scope:** read-only audit of the KiCad project as of 2026-07-06 17:14 (PCB saved 17:06, fab
package `production/` regenerated 17:14). Board = 135 × 100 mm, 4-layer (F / In1-GND / In2 / B),
132 components, 1317 tracks, 130 nets. Sources checked against: LTC4040 datasheet (ADI 4040fb),
Omron G5V-1 datasheet, ArduSimple 4G NTRIP Master pinout diagram (footprint-R00), AOS AO4406A
pinout, today's IPC-D-356 netlist, ERC/DRC runs, and the canonical repo docs.

**Verdict: the architecture is right and most of the execution is verified-correct, but there
are 4 HIGH findings — 3 of them silent board-killers — that must be fixed before ordering.
Estimated fix effort: one KiCad session (~2–4 h) + re-export.**

---

## 1. HIGH — fix before ordering

### H1. Q7 (LTC4040 input pass-FET) is installed backwards
- **Board:** Q7 AO4406A source (pads 1–3) = `MAIN5V` (VSYS), drain (pads 5–8) = `VIN_SW` (CLN).
- **Datasheet:** the mandatory input FET disconnects the system from the input during backup;
  with the OVP FET the pair is common-source at VIN (OVSNS text: the OVP FET's *drain* faces the
  input connector). Correct single-FET orientation = **source on the VIN/CLN side, drain on VSYS**
  (body diode conducts VIN→VSYS at startup, blocks VSYS→VIN in backup).
- **As built:** body diode points MAIN5V→VIN_SW, so during a power-fail event the boost output
  back-feeds the dead vehicle rail through the body diode — the input can never be disconnected;
  backup collapses / pack drains into the SD-15B-05 output. **It will look fine on the bench in
  normal mode and fail exactly at the moment the battery backup is needed.**
- **Fix:** swap S↔D on Q7 in the schematic (MAIN5V ↔ VIN_SW), resync, reroute locally.

### H2. Q5 / Q6 (MMBT3904) have collector/emitter swapped — BCE symbol on a BEC part
- Symbols are `Device:Q_NPN_BCE` (1=B, 2=C, 3=E) on generic `SOT-23` footprints, but the
  MMBT3904 SOT-23 is physically **1=B, 2=E, 3=C**.
- Result: Q5 (RTK load-switch driver, pad2=`GATE_LS`) and Q6 (K1 relay driver, pad2=`KCOIL`)
  operate in reverse-active mode (β ≈ 2–10). Q6 likely **cannot sink the 30 mA coil current →
  K1 never energizes → Modo B injection dead** (corrections survive via the NC bypass — the
  fail-safe does its job). Q5 may *appear* to work (10 k pull-up is easy to overcome) but with
  degraded VOL, unit-to-unit variation, and ~5 V reverse E-B stress (BVebo = 6 V abs max).
- **Fix:** replace both with `Q_NPN_BEC` (or re-map pins), resync, reroute. SOT-23 rework is trivial.

### H3. RIG (ignition sense) — value drift + dangling schematic pin (the 1 ERC error)
- **Schematic:** Rig = **22 k** — correct for the *current* topology (DFR1015 was removed; GX16
  pin 3 raw 12–24 V now feeds Rig 22k / Rigb 10k divider + D5 BAT54 clamp to 3V3 + C9 → PA5).
- **PCB + both fab BOMs:** Rig = **100 R** (stale, from the old DFR1015→5 V design). If assembled
  as 100 R: ≈ 200 mA through the BAT54 clamp at 24 V ignition (~0.5 W in an 0603) → **D5 and Rig
  burn, ignition sense dead**, possible PA5 damage.
- **Schematic wire bug:** Rig pin 2 (36.83, 74.93) does not terminate on the IGN_SENSE wire —
  the wire passes *through* the pin (73.66→76.2) without a junction. This is the single ERC
  error and means sch↔PCB sync is no longer provable; any future netlist push would also break.
- **Fix:** terminate the wire on the pin, set the PCB value to 22k, regenerate BOM/CPL.

### H4. `SW_IN` routed entirely at 0.2 mm — full RTK-stack current on an 8-mil trace
- `SW_IN` (F1 PPTC → Q1 source) is **missing from the netclass patterns**, so the USB autoroute
  pass laid it at the Default 0.2 mm — 18 segments, ~46 mm total, carrying ~1.2 A continuous
  (F9P + modem via U7) and up to ~3 A+ during PPTC fault ride-through. Expect large temperature
  rise / voltage drop right at the stack's supply.
- Also audit `VEH5V`: several long 0.2 mm runs on B.Cu (20–30 mm). The main P2→RS1→U6 path is
  1.5 mm, and the thin runs appear to be the JP1 / sense branches — verify none of them is the
  only path for load current.
- **Fix:** add `SW_IN` (pattern) to PWR_HI, reroute F1→Q1 at ≥1.0–1.5 mm, re-check VEH5V.

---

## 2. MEDIUM — decide/verify before or at ordering

- **M1. Fab BOM/CPL are not assembly-ready.** No LCSC part numbers anywhere; DNP parts (P3,
  P13, H3) carry "(DNP)" only in the Value text — no DNP attribute — and appear in BOM *and*
  CPL; CPL also lists THT sockets and the MOD1 pseudo-footprint. Fine for a **bare-board**
  order; blocks a JLCPCB **PCBA** order. (QFN-24 + DFN + SOT-563 + USB-C by hand is doable but
  unpleasant — decide which path you're buying.)
- **M2. Your own fab gate is unmet.** The declared gate was "bench-validate the LTC4040 backup +
  hot-cell charge cutoff on the proto first" — the proto validates the *concept* with TP4056,
  not the LTC4040 circuit. Bare boards are cheap, so ordering after H1 is a defensible risk —
  but make that call consciously; don't discover LTC4040 issues on 30 assembled units.
- **M3. D0/D1 (and D2/D8) direction on a physical simpleRTK2B Pro is still unverified** (your
  own open item since Jul-2). Board: MOD1 D1=`GNSS_TX` (PA2 MCU-TX), D0=`GNSS_RX` (PA3). If the
  Pro's D0/D1 are the opposite direction, the GNSS UART is dead with no socket-level rework.
  10-minute check against the Pro before ordering.
- **M4. Mechanical fit not evidenced.** Board grew 120×100 → **135×100** on Jul-3; the
  "placement review vs HBOX/cabinet mechanicals" gate has no record. Verify HBOX interior,
  standoff positions (MH1–4: 3.2 mm, 4–5 mm edge margins), connector clearances (P1 terminal
  block + USB-C + JST heights under the shield) before committing.
- **M5. USB routing is functional-grade, not compliant-grade.** DP/DM routed as independent
  0.2 mm traces on *different* layers (DP: F/In1, DM: B/In1), no diff-pair spacing, several
  segments ON the In1 GND plane (local plane cuts), no ESD array on the port. For a service
  console at Full-Speed it will almost certainly work; don't expect more. Next spin: route as a
  pair on one layer, add USBLC6-type ESD.
- **M6. Two fab packages in the tree** — `fab-jlc-usb/` (14:41) is superseded by `production/`
  (17:14, includes the title-block change). Delete or archive the stale one so nobody orders it.

---

## 3. LOW — cosmetic / next spin

- L1. ERC: 95 warnings — ~90 off-grid pin/wire (your own TODO), plus lib-cache drift
  (`Q_NPN_BCE` not found, `L` and `AO4406A` mismatch vs library). Fixing H2 touches these anyway.
- L2. DRC: 0 errors, 9 warnings — all lib_footprint mismatches (local overrides) on JST/Phoenix/
  SHT4x/MountingHole. Benign. Note `missing_courtyard` and `track_not_centered_on_via` are
  globally ignored (deliberate for the carrier); re-enable once per release to catch strays.
- L3. Title block: rev "1.0", date **2026-06-23** — stale (board materially changed since);
  bump date/rev on release.
- L4. MODEM LED: XBee pin 13 is a **1.8 V** output → Rmled 1 k + LED will be dim or dark.
  Accept, reduce R, or buffer next spin.
- L5. L7 (3V3_MODEM buck) is 10 µH **2 A** vs module spec "2 A peak" — saturation margin is
  thin at worst case; consider a 3 A-rated part next spin. (Delta doc says "1 A/1.5 A pk" —
  understates the ArduSimple diagram's 2 A.)
- L6. `SW3_NODE`/`SW_FAN` netclass patterns exist but `SW_IN` was the one that mattered (H4) —
  tidy the pattern list while in there.
- L7. In2.Cu carries 336 signal segments and no pour — fine (In1 is solid GND), just wasted
  copper; consider a 5 V pour next spin.

---

## 4. Verified GOOD (evidence-backed, not vibes)

**Fail-safe invariants (the ones that matter for ICAVE):**
- Load switch defaults OFF: R2 10 k pulls Q1 gate to rail; only PA1-driven Q5 can enable →
  invariant #1 holds with MCU absent. *(Weakened only by H2 — fix restores full margin.)*
- **K1 Modo-B bypass verified against the Omron datasheet:** coil = pins 2/9 (SYS5V/Q6),
  COM = 5&6 (internally doubled — the double DIN_4G net is correct, not a short), **NC = 1 =
  F9P TX2** → corrections flow modem-ward with the MCU dead/absent; NO = 10 = PA9. Exactly the
  design intent of Block H. RTCM3 downlink (modem DOUT → MOD1 D2 → F9P RX2) is hardwired and
  never touches the MCU — invariant #3 in copper.
- Cutoff chain MAIN5V→P11→SYS5V kills MCU *and* stack *and* modem (Blackpill 5V is on SYS5V) ✓.

**LTC4040 block (pin-by-pin vs datasheet):** VSYS 1/24 ✓ · PROG 825 Ω → 2.42 A ≈ C/5 ✓ ·
CLN/RS1 8 mΩ → 3.1 A input limit ✓ · CHGOFF w/ 100 k pull-down = charge-enabled-if-MCU-absent,
NTC still guards ✓ · BSTOFF grounded (backup enabled) ✓ · shared RSTFB/BSTFB divider 499k/100k →
4.79 V backup (sharing explicitly datasheet-endorsed) ✓ · PFI 287k/100k → 4.60 V trip ✓ ·
**F-straps decode to F2=1, F1=0, F0=1 = Li-Ion 4.00 V exactly as designed** (JP2/3/4 verified at
net level; LiFePO4 = re-strap JP2 preserved) ✓ · NTC bias R55 from VIN + pack NTC on P4.3 —
charger owns the battery NTC, per doctrine ✓ · OVSNS shorted to VIN (OVP unused, per datasheet) ✓ ·
SW→L6 2.2 µH→BAT within spec ✓ · VSYS bulk 104 µF ≥ 100 µF ✓ · RST unused = legal ✓.

**XBee socket (verified against ArduSimple footprint-R00 diagram, incl. the mirrored row):**
J7: VCC=3V3_MODEM (3.3–3.6 V ✓) · TX/RX=DOUT/DIN_4G ✓ · pin4+10 GND ✓ · RESET→SW4G (open =
always-on) ✓ · **pin6 V_USB / 7 USB+ / 8 USB− = USB-C VBUS/DP/DM ✓** (USB enabled only when a
laptop provides 5 V — elegant). J8 (pads mirror to XBee pins 20…11): ON/OFF→GND (always on) ✓ ·
pin15/11 GND ✓ · **pin14 VREF→VCC ✓** · pin13 LED→Rmled/D4G ✓ (see L4) · CTS/RTS/DTR open ✓.
Row spacing 22.35 mm = XBee spec ✓.

**Rest of the board:** USB-C UFP correct (5.1 k Rd on CC1/CC2; VBUS only to the modem — no rail
backfeed) ✓ · Blackpill J1/J2: all 18 used pins match the documented map (A0 BAT_SENSE … B12–15
gauge, A9/A10 USART1, B6/B7 I²C, NRST w/ SW1+P10) ✓ · 24 V front-end: SMBJ33A TVS, IRFR5305
reverse-polarity FET correctly oriented w/ 15 V gate zener ✓ · fan: dedicated buck, UVLO enable
divider, flyback SS34 across the fan, tach DNP provision ✓ · both MP1584 bucks correct (U7 FB
100k/31.6k → 3.33 V) ✓ · sensors: SHT40 + TMP102 (ADD0→GND = 0x48) + 4.7 k pulls + external I²C
probe port P5 ✓ · NTC-hotspot chain to PB1 ✓ · sense dividers ÷2 + filters ✓ · single GND net,
solid In1 plane, closed 135×100 outline, 4×M3.2 holes with sane margins ✓ · netclasses PWR_HI
1.5 mm / PWR_MID 1.0 mm exceed the kicad-guide minimums ✓ · DRC 0 errors / 0 unconnected;
gerber+drill 4-layer set regenerated *after* the last save (17:14 > 17:06) ✓.

---

## 5. Documentation audit ("I need this to be perfect")

The doc *system* is genuinely good — canonical state doc + delta build-spec + rationale +
ledgers is more than most teams have. But it is now **3–4 days behind the copper**:

| Doc claim | Board reality |
|---|---|
| DFR1015 on-board conditions ignition; Rig = 100 Ω series from 5 V | **DFR1015 removed**; raw 12–24 V → 22k/10k divider + clamp (and PCB value still says 100R — H3) |
| Board 120 × 100 mm | **135 × 100 mm** (since Jul-3) |
| "J8 all NC"; XBee = VCC/DOUT/DIN/GND only | J7.5–8 = RESET/V_USB/USB±; J8 = ON/OFF, VREF, LED, GNDs |
| No USB-C block in design-state/delta | USB-C J9 + CC + VBUS-to-modem is a major new block (Jul-5) |
| Delta: modem 1 A/1.5 A pk | ArduSimple diagram: **2 A peak** |
| Name `hbox-watchdog-v3-PROD` everywhere | Title block says **EINARBoard HBOX 1.0** — name exists nowhere in the repo docs |
| Title block date 2026-06-23, rev 1.0 | Board changed materially Jul 2–6 |

**Docs action list:** (1) update design-state §1/§3 (ignition topology, no DFR1015, 22k) ·
(2) delta doc: add USB block + real J7/J8 table **including the J8 pad-k = XBee pin-(21−k)
mirror** (that mapping is currently only in the copper — the single most dangerous piece of
undocumented tribal knowledge on this board) · (3) board size + name: register "EINARBoard
HBOX 1.0" in CLAUDE.md directory table + design-state header · (4) BOM: add LCSC column, DNP
attributes on P3/P13/H3 · (5) delete/archive `fab-jlc-usb/` · (6) bump title-block date/rev on
release · (7) log H1–H4 fixes in the delta doc changelog.

---

## 6. Recommended order of operations

1. Fix H3 schematic wire + value → H2 symbols → H1 Q7 swap (all schematic) → resync to PCB.
2. Add `SW_IN` to PWR_HI, reroute F1→Q1 + the three FET neighborhoods (H4/H1/H2 rework zones).
3. ERC (target: 0 errors) → DRC (0 errors) → regenerate `production/` → **order bare boards.**
4. In parallel: M3 (D0/D1 on a physical Pro) + M4 (mechanical fit) — both are no-cost checks.
5. Docs pass (§5) — 1 h, do it while the fab quote is pending.
6. PCBA later only after M1 (LCSC/DNP) and ideally proto bench results (M2).

*Audit artifacts: ERC 2026-07-06 (1 err / 95 warn) · DRC 17:09 (0 err / 9 lib warn) ·
IPC-D-356 `production/netlist.ipc` 17:14 · sources: ADI 4040fb, Omron K048-E1-07,
ArduSimple 4G-NTRIP-Master-footprint-R00.*