Drogheda/03-Architecture-Hardware/2026-09-28_v6-audit-attachments/verify_1.md

Verification 1 — Power (A-xx, F-51) + Modem / GNSS / Ethernet (B/C/E)

Snapshot: sch ecee9fed… / pcb 6ddec80d… (evidence pack 2026-09-28). Verifier scripts: /home/claude/v6audit/work/verifier1/ (geo.py pad/track polygons from the evidence CSVs, zonefill.py → zonefills.json (filled polygons parsed with kisexp), islands.py / clusters.py (F.Cu GND islands and pad/track-joined clusters with via counts), vbat_sim.py (averaged current-mode model of U20 → VBAT_MODEM burst droop)). No auditor script was reused.

Datasheets used (fetched this session): LTC4040 Rev B (4040fb, p.3–4, 10–11, 15–19); TPS54360B SNVSB93 (§6.1/6.5/6.6); AP64350 DS41976 Rev 5-2 (p.4–5, 10–11, 13, 15, 18–20); MP1584 Rev 1.0 (abs max, EN); PMEG3050EP v3 (Table 7); SIMCom A7672X/A7670X HD V1.03 (Table 1, Table 8 p.26–27, Table 30 p.50, Fig. 33 / Table 40 p.54); u-blox ZED-F9P-04B DS UBX-21044850 R05 (pin table, Table 14/15) and Integration Manual UBX-18010802 R02 §8.6; AP2112 DS39724 Rev 2-2 (p.4); TPS7A20 SBVS338H; TPS2552 SLVS841F; W5500 DS v1.0.2 (§5.3, crystal spec, pin 37); TI TIDUC41 Table 4 (ISO 7637-2 pulse levels). Part data: KiCad-MCP JLC lookups (numbers quoted inline).

Transient levels assumed for the 24 V discussion: 24 V truck bus 27–29 V while charging (up to ≈ 30 V with cold compensation); ISO 16750-2 over-voltage 36 V for 60 min (24 V systems); ISO 7637-2:2011 pulse 2a +37…+50 V, Ri 2 Ω, 50 µs (TI TIDUC41 Table 4; the auditor's +112 V is an older/OEM level); ISO 16750-2 load dump Test A 151–202 V, Ri 1–8 Ω, 100–350 ms; suppressed load dump (Test B) ≈ 58 V for 24 V systems.

Summary table

ID	Auditor severity	Verdict	Verified severity	One-line reason
A-01	Blocker	CONFIRMED-WITH-CORRECTION	Blocker	Topology and ratings reproduced. The Blocker rests on D21 (30 V Schottky, 18.5–23.5 V reverse on a charging 24 V bus, thermal-runaway range) plus the unfused branch, not on U2 (U2-on-24 V has field history). Pulse 2a is +50 V per ISO 7637-2:2011, not +112 V. D32 does clamp /24V transients through Q10–F2–Q23.
A-02	Blocker	CONFIRMED	Blocker	SW_BAT 0.5 mm × 11.9 mm with 0.25/0.30 mm necks, EP 0 vias, L6 8.65 mm, C30/C31 7.2/6.2 mm, nearest sensor 71.4 mm. This repeats lesson F5 / ECO D2 ("Obligatorio"). The H0008 OT-cycling causality is still unproven.
A-03	Blocker	CONFIRMED	Blocker	825 Ω → 2.42 A nominal (2.28–2.57 A). The top corner is above the LTC4040's 2.5 A maximum. 1.43 k is the largest E96 value with a worst-case minimum ≥ 1.3 A (1.316 A); 1.5 k gives 1.254 A.
B-01	Blocker	CONFIRMED (merge → A-01)	Blocker	Same root cause as A-01. D21 stress and leakage reproduced from the PMEG3050EP datasheet.
B-02	Blocker	SEVERITY-CHANGE	Major	C2827940 is a SamYoung MVG general-purpose e-cap (85 °C/2000 h), and the compensation is the AP64350 5 V Table 1 row. Simulated 2 A GSM droop on battery with new caps is 0.25–0.28 V (VBAT ≥ 3.52 V), so it works on day 1. It fails when cold or aged (0.44–0.52 V). This is a lifetime issue; the fix is BOM-only.
B-03	Blocker	CONFIRMED-WITH-CORRECTION	Blocker	Unidirectional ESD9L on the TX line clips at −0.6 V even at 23 dBm (4.47 V pk). The proposed PGB1010402KR is rated 12 VDC max operating, below the 14.1 V GSM peak, so use PESD0402-240 (C1975527, 24 V) or DNP.
B-04	Blocker	SEVERITY-CHANGE (merge → F-12)	Major	Measured: 1 GND via in the U19 courtyard, U20 EP 0 vias (nearest 3.45 mm), J13 20–21 mm to a via, 3611 mm² cluster with 5 vias. No R1–R5 violation, no V5.5 field failure, no damage path, so this is Major.
C-01	Blocker	CONFIRMED	Blocker	u-blox IM R02 §8.6 says a 10 Ω limiter is "required". VCC_RF is 300 mA abs max; AP2112 current limit ≈ 0.6–0.8 A. ANT_DETECT/ANT_SHORT_N are F9P inputs with nothing driving them. The TPS2552 fix checks out.
A-04	Major	CONFIRMED	Major	53.6k/10.2k → 4.871/5.004/5.140 V; 57.6k → 5.176/5.318/5.463 V (37 mV under the LTC4040 5.5 V VIN max). PFI falls at 4.27/4.40/4.54 V. The V5_PFI constant 4.60 is stale.
A-05	Major	CONFIRMED-WITH-CORRECTION	Major	Budget reproduced: 2.25–2.33 A at MAIN5V on a GSM burst. The "93–97 %" is against the datasheet's guaranteed 2.5 A. ILIM(BST) ≥ 5.5 A still leaves ≈ 30–40 % switch headroom at 3.5 V.
A-06	Major	CONFIRMED	Major	U25 input caps' GND (252 mm² cluster) and U25 EP/D34 (3611 mm² cluster) are separate. 0 EP vias on U25/U20/U2/U12. L22 is 13.75 mm edge, not 17.0.
A-07	Major	CONFIRMED	Major	VEH5V In1 0.5 × 13.6 mm, VIN_SW In2 0.8 × 23.6 mm. These are also a prerequisite for A-01's MAIN5V modem feed.
A-08	Major	CONFIRMED	Major	LDO_IN 4.27–4.67 V on battery vs ≈ 4.3 V needed. Iq 5/11 mA ≈ 27–60 mW referred to the battery, against a 20–50 mW floor target.
A-09	Major	CONFIRMED (C130/C131 merge → B-02)	Major	MVG 85 °C/2000 h → ≈ 8000 h at 65 °C. C881921 polymer verified (105 °C, 16 V, 6.3×7.7, stock 2442).
F-51	Major	CONFIRMED	Major	No TMP102 on v6; /NTC goes to U6.17 only; PC5/PB10/PA9/PD2 free; 0x48 does not clash with U10 (0x4D).
B-05	Major	CONFIRMED (merge → F-06)	Major	RF_LTE In1 22.14 mm with two vias. Crossed by VBAT_MODEM, SYS5V, SW_IN and MODEM_LED on F.Cu and DIN_4G on In2. 1 GND via within 1.5 mm.
B-06	Major	CONFIRMED (absorbs F-07, A-06/U20)	Major	C128/C127 GND → U20.7 6.86/8.48 mm, EP 0 vias. Resolved Cin: 2 × 22 µF.
B-07	Major	CONFIRMED (absorbs G-02, F-14/J9, F-17)	Major	USB_DP/DM/VBUS = J9 + U19 only. USBLC6-2SC6 C7519 (stock 1415) verified.
C-02	Major	CONFIRMED	Major (low end)	AP2112 has no soft-start (tS 20 µs, no load). With ≈ 18 µF, the ramp is ≈ 28–80 µs/V: inside 20–8000 µs/V but not guaranteed. TPS7A2033P is a drop-in: 239–367 µs/V.
C-03	Major	CONFIRMED (merge → F-12)	Major	U18 0 vias; 946 mm² cluster with 5 vias. Correction: J12.3 has a GND via 0.73 mm away.
C-04	Major	CONFIRMED	Major	Q1 9.0 mm and Q5 7.1 mm from J13. /SW_5V In1 181.3 mm.
E-01	Major	CONFIRMED (absorbs A-05 fix 1)	Major	U12.2 EN on /SYS5V. W5500 VIH max 5.5 V (5 V-tolerant I/O), so gating 3V3_ETH does not back-power it through SPI.
E-02	Major	CONFIRMED-WITH-CORRECTION (absorbs D-04)	Major (Minor once E-01 is in)	W5500 RSTn also has an internal 62–112 kΩ pull-up, so 100 k fails even without PA15. 4.7 k gives ≤ 0.62 V worst case. D-04's "PD2 + 100 k" alternative fails.
E-03	Major	SEVERITY-CHANGE (absorbs H-07, F-11/Y1)	Minor	CL mismatch confirmed (+80…+160 ppm). V5.5 as-fabbed has the identical Y1 (C14872) and C95/C96 18 pF (C1647) and works; J10 is DNP on the prototypes. Conflicting fixes resolved below.

Counts: CONFIRMED 17 · CONFIRMED-WITH-CORRECTION 4 · SEVERITY-CHANGE 3 · REFUTED 0 · CANNOT-VERIFY 0.

Per-item notes

A-01 (with B-01, H-05, F-53) — vehicle-voltage exposure of U2 / U20 / D21

• Topology (nets.json):
  • /24V_IN = {P1.1, D10, F2.1, Q10.D}.
  • F2 → /VIN_FUSED → Q23 → /VIN_PROT = {D32, C149–C151, U25.2, R124}.
  • Q10.S → /24V = {C10, C11, C22, Ren1, U2.7, D20.A, DzG1.K}.
  • /VIN_MODEM = {D20.K, D21.K, C127, C128, U20.2}.
  • D21.A = /MAIN5V, which is VSYS of the LTC4040, downstream of RS1 and Q7.
  • Confirmed: /24V is not behind F2.
• Correction (clamping): for µs–ms transients /24V is clamped by D10 and by D32 through Q10 (65 mΩ) → F2 (≈ 0.05 Ω) → Q23 (65 mΩ), ≈ 0.2 Ω in total. "Outside the D32 clamp" is only true for fusing and for DC. Neither TVS conducts at 36 V DC (VBR 36.7–40.6 V).
• Ratings (datasheets):
  • U2 MP1584: VIN operating 4.5–28 V, abs max 30 V, EN abs max 6 V. EN = V24·20k/120k → 4.8 V at 28.8 V and 6.0 V at 36 V.
  • U20 AP64350: abs max 42 V DC / 45 V for 400 ms.
  • D21 PMEG3050EP: VR 30 V, IR 2.6 mA typ / 8 mA max at 30 V and 25 °C, 330 µA typ at 5 V. The datasheet explicitly warns about thermal runaway. Rth(j-a) 60–200 K/W.
  • D20 / Dbk1 SS34 (C8678, MDD): 40 V.
• Stress by operating point:
  • Charging bus 28.8 V: D21 VR = 28.8 − 0.3 − 5.0 = 23.5 V (78 % of VRRM); U2 is 0.8 V over its operating maximum; U20 is fine.
  • 36 V / 60 min: D21 VR = 30.7 V > 30 V; U2 is 6 V over its abs max (it dies); U20 is fine.
  • Pulse 2a (+50 V, 2 Ω): ≈ 4–5 A into D10 ∥ D32 → clamp ≈ 42–45 V (dynamic R ≈ 1.1 Ω SMBJ / 0.45 Ω SMCJ). U20 sits at its 45 V/400 ms limit, U2 far above 30 V, and D21 reverse ≈ 37–40 V (avalanche for 50 µs).
  • Suppressed load dump 58 V: every part on /24V is over its rating, and the TVSs cannot absorb it (A-19).
• D21 thermal runaway (new quantification):
  • Typical IR at 23.5 V and 25 °C ≈ 1.8 mA, interpolated from 0.33 mA at 5 V and 2.6 mA at 30 V. Leakage roughly doubles per 10 °C.
  • Stability needs k·PR·Rth < 1, with k = ln2/10 = 0.069 K⁻¹. That means PR < 0.12 W at 120 K/W, or 0.24 W at 60 K/W.
  • At a 45 °C board: IR ≈ 7 mA → PR ≈ 0.17 W. At 60 °C: IR ≈ 20 mA → PR ≈ 0.48 W. Runaway is plausible at port-box temperatures.
  • A D21 that fails short puts /24V onto MAIN5V with no fuse: LTC4040 VSYS (6 V abs max), U21 (6 V), U17, the F9P and the MCU would all be exposed. This damage path makes it a Blocker.
• Field-history weighting: on V5.x, P1 = 24 V fed only U2 (drogheda-einarboard-harness), and there is no record of U2 failing. U2 alone therefore rates Major (outside operating range at 28–29 V, abs max only exceeded at ≥ 30 V events). D21, U20/D20 on the unfused branch, and the D21-short failure mode are new on v6.
• Proposed fix "U20 from MAIN5V only, delete D20, bridge D21" — numbers:
  • Where MAIN5V sits: downstream of the LTC4040 input sense resistor. The path is VEH5V → RS1 → /VIN_SW → Q7 → MAIN5V, so modem current counts against the RS1 limit (23.5–26.5 mV / 10 mΩ = 2.35–2.65 A). The LTC4040 "does not actually limit the external load but … reduces charge current" (DS p.16). The modem therefore takes priority and the charger backs off.
  • Added U20 input current at MAIN5V ≈ 5.25 V (η 0.9): LTE 23 dBm 0.67 A → 0.54 A; GSM 2.0 A → 1.61 A; HD V1.00 2.8 A peak → 2.25 A.
  • RS1 path, steady, charging at 1.43 k + LTE TX: 0.35 (logic) + 0.54 + 1.19 (charger input at 1.4 A) = 2.08 A (under the limit).
  • RS1 path during a GSM burst: system 1.96 A, and the charger is throttled to 0.4–0.7 A.
  • U25: ≤ RS1 limit 2.65 A + fan 0.3 A (A-01 fix 1) = ≤ 2.95 A against a 3.5 A rating and ≥ 4.5 A peak switch limit. A sub-ms overshoot before the input-limit loop settles reaches ≈ 3.45 A, which gives an inductor peak ≈ 3.8 A, still under 4.5 A.
  • D34 loss: ≈ 0.8 W with A-03, versus ≈ 1.0 W as-is at the 825 Ω RS1-limited charge. No thermal regression.
  • Battery: the modem already shares the 2.5 A boost as-is, through D21. Removing D21 raises VIN(U20) from ≈ 4.42 V to ≈ 4.72 V (+0.30 V) and lowers MAIN5V current at 2 A GSM from 2.25–2.33 A to ≈ 2.0–2.13 A.
  • F2 at 24 V: 2.95·5.3/(0.88·24) = 0.74 A. At 12 V it is 1.48 A; at 9 V, 1.97 A.
  • PFI margin with 57.6 k (A-04): 5.176 V − ≈ 0.2 V droop on a 1.6 A step = 4.98 V, versus PFI falling max 4.54 V, i.e. 0.44 V margin. As-is (53.6 k) the margin is 0.13 V.
  • Hand-over: at PFI hand-over the modem load is already on MAIN5V, and effective CSYS is only ≈ 57–69 µF. Add A-05's CSYS and a 220 µF polymer at U20.2 (≈ 0.18 V hold-up for 2 A × 20 µs).
• Alternative: D20 to /VIN_PROT behind F2, D21 → 60 V Schottky.
  • U20 still sees 20–36 V DC, and in pulse 2a ≈ 42–45 V (D32 ∥ D10). That is zero margin to 45 V/400 ms and over it for a 58 V suppressed load dump.
  • PMEG6045ETPX (C552943, genuine Nexperia, 60 V/4.5 A, SOD-128 same land, IR 400 µA at 60 V, stock 2722) removes the D21 runaway. Its VF ≈ 0.45 V at 2 A costs ≈ 0.15 V more battery headroom than today.
  • F2 must also carry U20's input.
  • Rejected. The JSMSEMI clone C53114006 (H-05) has unknown leakage.
• Recommended single topology:
  • U20 from MAIN5V: delete D20 and the 48 mm /VIN_MODEM run, and merge /VIN_MODEM into /MAIN5V (copper, no D21).
  • Fan from VEH5V: JP1 bridged (bridged-jumper footprint or 0 Ω 0805), U2 block DNP.
  • Q10/DzG1/Rrp1/C10/C11/C22 DNP.
  • F2 → 3 A 0154003.DR (C206912, stock 2217), placed electrically ahead of D10. Use 4 A C206914 only if sustained 9 V operation is required.
  • Dependencies: A-07 (widen VEH5V/VIN_SW/MAIN5V paths), A-04 (57.6 k), A-05 CSYS, B-06 (2 × 22 µF at U20.2) plus 1 × 220 µF polymer C881921 at U20.2.
  • Note for Leo: U20 then sits upstream of the P5 cutoff. The ECO §A intent ("the physical cutoff switches everything off") is still met functionally, because cutting SYS5V unpowers the MCU and R113 holds U20 EN low. U20 shutdown current is µA.

A-02 — LTC4040 copper / placement

• Re-measured (edge-to-edge, true pad shapes):
  • /SW_BAT: 6 F.Cu segments: 0.5 mm × 11.89 mm, plus 0.25 mm (0.50 mm) and 0.30 mm (0.50 mm) necks at pins 21/22. 0 vias.
  • /BAT_PLUS P3 → L6.2: 1.0 mm × 21.27 mm (2.12 + 0.71 + 14.90 + 3.54).
  • /BAT_PLUS L6.2 → U6.23: 1.0 mm, then 0.5 mm × 10.49 mm, then 0.25 mm × 5.38 mm.
  • U6 EP: 0 vias. Nearest GND via: 3.04 mm edge at (191.6, 104.3); (188.6, 102.7) is 3.23 mm edge / 5.21 mm centre. The auditor's 5.21 mm is a centre distance.
  • L6.1 ↔ U6.21/22: 8.65 mm.
  • C30 / C31 → U6.6: 7.20 / 6.18 mm.
  • C32 / C33 / C34 → U6.1: 3.90 / 3.44 / 4.74 mm.
  • C35 → L6.2: 20.2 mm edge (the auditor's 21.9 mm is a centre distance).
  • Nearest temperature sensor: U3 at 71.4 mm.
  • Cluster map: U6 EP, C32, C30/C31 and C35 are in a 252 mm² F.Cu cluster with 5 vias; C33 is in the 3611 mm² cluster.
• IPC-2221 external rise re-computed: SW_BAT 0.5 mm → +32 °C at 2.42 A, +80 °C at 3.6 A. BAT_PLUS 1.0 mm → +25 °C at 3.6 A. This matches the auditor.
• Correction / caveat: at bench ambient an LTC4040 dissipating ≈ 0.75 W needs θJA > 150 °C/W to reach OT. The H0008 cycling hypothesis is therefore weak. The 1.3 A figure itself is inferred from an OCV slope, not measured. The Blocker stands on lesson F5 / ECO D2 and the datasheet layout guidance, independent of H0008.
• Fix: as proposed. It is feasible: QFN 0.5 mm pitch, so start the ≥ 2 mm pour after the combined 21+22 pin fan-out. Put the F-51 TMP102 in this cluster.

A-03 — R50

• Datasheet: RPROG = 2000 V/ICHG (hPROG 2500, VPROG 0.8 V); ICHG 950/1000/1050 mA at 2 k (±5 %); maximum charge current 2.5 A (DS p.3, 10, 18).

R50 (1 %)	min	nom	max
825 Ω	2.280 A	2.424 A	2.571 A (above the 2.5 A maximum)
1.43 k	1.316 A	1.399 A	1.483 A
1.47 k	1.280 A	1.361 A	1.443 A
1.5 k (ECO)	1.254 A	1.333 A	1.414 A

• 1.43 k is the largest E96 value that holds ≥ 1.3 A at every corner. It costs about 10 % more I²R than 1.5 k.
• Fix part: C22840 checked: 1.43 kΩ 1 % 0603, Extended, stock 4965.
• Rating: keep Blocker. It is an approved ECO C change missing from v6, 825 Ω exceeds the IC's 2.5 A maximum at the top corner, and it drives R5 (≥ 1.3 A without thermal cycling). The fix is one resistor.

B-01 — see A-01

All of the auditor's numbers reproduce: VR 30.3–30.7 V at 36 V; the 30 V rating; IR from the datasheet. B-01's "Option B (recommended)" is exactly A-01's "Option A". Only the labels differ (see Fix conflicts).

B-02 (with A-09 C130/C131, A-17) — VBAT_MODEM bulk and U20 compensation

• Part: C2827940 = SamYoung "MVG 16V 220UF 6.3×7.7", aluminium electrolytic, −40…+85 °C, 2000 h at 85 °C, 130 mA at 120 Hz (JLC). General purpose, not polymer. Confirmed. The value field reads "220uF/10V" while the part is 16 V (cosmetic).
• Placement: C131 8.70 mm and C130 16.26 mm from U19.55–57. The cap nearest L20.2 is C130 at 10.1 mm.
• Compensation: R116 14 k / C141 3.3 nF / C142 47 pF = AP64350 Table 1 VOUT = 5.0 V row (R5 14.00 k, C5 3.3 nF, C6 47 pF, designed for 2 × 22 µF ceramic). Confirmed.
• Droop (my averaged current-mode model, vbat_sim.py): mid-band gain Gm = 2π·R5/(4.67e3·VOUT) from DS eq. p.19; L 4.7 µH; slew limited by (VIN·0.95 − VOUT − I·0.115 Ω)/L; ceramic 13 µF.

Condition	2 A GSM burst	0.7 A LTE
Battery, via D21 (4.42 V), MVG new (ESR 0.2 Ω pair)	0.28 V (VBAT 3.52 V)	0.08 V
Same, cold / aged (0.6 Ω pair)	0.52 V (3.29 V, under the 3.4 V minimum)	0.13 V
Battery, polymer + 113 k/6.8 nF	0.06 V	0.02 V
Battery, polymer with the as-is 14 k	0.18 V (phase margin ≈ 27°, see below)	0.06 V

• Why Major, not Blocker: it works on day 1 and inside SIMCom's 300 mV drop limit, with the planned LTE-only firmware on battery. It fails with cold or aged caps. MVG life is ≈ 8000 h at 65 °C local, so "modem dark" on GSM bursts is likely within about a year. That is a reliability failure → Major. The fix is BOM-only on the same land, so do it before fab.
• Fix check:
  • C881921 verified: Lelon OVZ 220 µF/16 V polymer, 105 °C/2000 h, 6.3×7.7, stock 2442.
  • R116 → 113 k (C22862, stock 59 728); C141 → 6.8 nF X7R 0402 (C1542, Preferred); C142 → 56 pF C0G (C1572).
  • Checks: R5 = 4.67e3·14 kHz·3.8·454 µF = 112.8 k; C5 = 3.8·454 µ/(2 A·113 k) = 7.6 nF; zero 207 Hz, fc 14 kHz, C6 pole 25 kHz → phase margin ≈ 60°.
  • Coupling rule: 113 k is valid only with the polymer bank. With MVG caps, the ESR zero at ≈ 1.8 kHz lies below fc. Change the caps and the compensation together.
  • Add 2 × 22 µF (C86817, stock 4144) at L20.2 as proposed.

B-03 — LTE antenna ESD

• D28 = C82326 onsemi ESD9L5.0ST5G: "Unidirectional, 0.9 pF, VRWM 5 V, VBR 5.4 V, VC 9.8 V". Shunt: pin 1 (C) on /RF_ANT_LTE, pin 2 (A) on GND.
• A7670SA output power (HD V1.03 Table 30; GSM supported per Table 1): GSM850/900 33 dBm ±2, DCS/PCS 30 dBm, LTE 23 dBm ±2.7.
• Peak voltage at 50 Ω: V = √(2·P·50) → 23 dBm = 4.47 V, 33 dBm = 14.1 V. At VSWR 3:1 (×1.5): 6.7 / 21.2 V.
• A unidirectional diode forward-conducts at ≈ −0.6 V on every negative half-cycle, even in LTE, and avalanches at 5.4 V on GSM positive peaks. The result is hard clipping, spurious emissions and diode heating. Blocker confirmed. SIMCom Fig. 33: "D1 is a Bidirectional ESD Protection device" (recommended PESD0402-03 / CE0201S05G01R, neither in the JLC DB).
• Fix check: C10676 = Littelfuse PGB1010402KR is the correct number (0402, bidirectional, 0.04 pF, stock 59 948). Its max operating voltage is 12 VDC (TME/Newark), below the 14.1 V GSM peak. Use Littelfuse PESD0402-240, C1975527 instead (bidirectional, 24 V working, 0.25 pF → −j335 Ω shunt at 1.9 GHz, |Γ| ≈ 0.07; stock 9394), or DNP D28. Either needs an 0402 land (the current land is SOD-923), which comes with the B-05 re-route. Keep D27: the GNSS line carries +3.2 V bias and no TX.

B-04 (→ merged into F-12) — modem ground vias

• Re-measured:
  • U19 courtyard (162.25–186.25 × 60–84) contains 1 GND via at (184.6, 81.775); 4 more in a 5 mm ring. 39 GND pads: 20 × 2.1 mm on a 3.8 mm grid (1.7 mm gaps), 14 + 5 perimeter pads.
  • U20 EP: 0 vias; nearest 3.45 mm edge; none within 2 mm.
  • J13 GND pads: nearest via 20.3 / 21.3 mm. D28 GND: 19.1 mm.
  • F.Cu cluster containing U19, U20, U25, U2, J13, D34: 3611 mm², 5 vias, at (145.7, 129.9), (148.1, 135.3), (152.6, 62.5), (153.5, 77.0), (198.8, 78.1). This exactly reproduces BCE's figure.
• Severity: Major, not Blocker. It is a substantial EMC, desense and thermal risk, but it does not violate R1–R5, does not repeat a V5.5 field failure, has no damage mechanism, and is manufacturable. It belongs among the first layout actions, but it is not a gate.
• Fix check:
  • 0.6/0.3 mm tented vias fit U19's 1.7 mm inner gaps with 0.55 mm clearance per side.
  • For U18 (1.1 mm pads on 2.1 mm pitch), use the diagonal centres between four pads: pad-corner distance 0.707 mm, so a 0.6 mm via keeps 0.41 mm clearance. 35 positions are available, and no 0.45/0.2 mm microvias are needed.

C-01 — GNSS antenna bias

• /VCC_RF_GNSS = {U18.7, L21, C144, C145}. L21 = C162555 LQG18HN68NJ00D: 68 nH, 0.8 Ω, 400 mA, SRF 1 GHz. u-blox recommends 120 nH.
• ZED-F9P-04B DS R05 pin table:
  • pin 4 ANT_DETECT = Input (active high)
  • pin 5 ANT_OFF = Output
  • pin 6 ANT_SHORT_N = Input (active low)
  • VCC_RF 50 mA operating, 300 mA abs max
• On v6 pins 4/6 connect only to PC1/PC2 (MCU inputs), so they are undriven. Confirmed. D-07 is the same finding.
• IM UBX-18010802 R02 §8.6: "a 10 Ω current limiting resistor is required to prevent against short circuits destroying the BIAS-T inductor."
• Consequence: a crushed coax lets U21 (AP2112, current limit ≈ 0.6–0.8 A) push more than VCC_RF's 300 mA abs max and L21's 400 mA. That is a hardware-damage path, and the class of fault is proven in the field (H0005/H0014). Blocker confirmed.
• Fix check: TPS2552DBVR, C46506 (SOT-23-6, stock 3002).
  • Pinout 1 IN / 2 GND / 3 EN̅ (active-low on the 2552) / 4 FAULT̅ / 5 ILIM / 6 OUT; ILIM tied to IN → 75 mA typ; VIN 2.5–6.5 V; FAULT̅ deglitch 7.5 ms; constant-current into a short, ≈ 0.25 W at 3.3 V.
  • Polarity: ANT_OFF high → EN̅ high → antenna off, matching the F9P's active-high ANT_OFF. The 100 k pull-down keeps the antenna ON by default. FAULT̅ → ANT_SHORT_N (active low) with 10 k to 3V3_GNSS matches.
  • U21 load becomes 130 mA + 75 mA.
  • The 10 Ω fallback gives 3.2 V/10.8 Ω ≈ 0.30 A, right at VCC_RF's abs max. That is only acceptable as u-blox's stated minimum.

A-04 — U25 set-point

• Datasheet: TPS54360B Vref 0.792/0.800/0.808 V over −40…150 °C.
• Computed with 1 % parts:
  • 53.6k/10.2k: 4.871 / 5.004 / 5.140 V
  • 56.2k: 5.069 / 5.208 / 5.350 V
  • 57.6k: 5.176 / 5.318 / 5.463 V
  • 57.6k with 0.1 % parts: 5.256 – 5.380 V
• PFI (R51 270 k / R52 100 k, 1.17/1.19/1.21 V, +30 mV hysteresis): falling 4.266 / 4.403 / 4.543 V, rising 4.376 / 4.514 / 4.656 V.
• Firmware constants: CHG_RAIL_ON 5.05, CHG_RAIL_OFF 4.90, V5_PFI 4.60. V5_PFI came from 287 k: 4.605 V typ. Stale confirmed.
• As-is nominal is under CHG_RAIL_ON, confirmed.
• Fix: 57.6 k = C23082, Extended, stock 3673. The top corner (5.463 V) is 37 mV under the LTC4040 VIN operating maximum of 5.5 V. Load-release overshoot (≈ +0.1–0.2 V once the modem is on MAIN5V) is brief and well under the abs max. Acceptable. 0.1 % parts are optional; I could not find 0.1 % LCSC numbers in the local DB.

A-05 — battery-mode budget

• Reproduced at VSYS 4.79 V:
  • Modem 2 A at 3.8 V → U20 input 1.89 A at 4.42 V (η 0.91).
  • SYS5V ≈ 0.36 A: 3V3 0.12 A, F9P 0.10 A, W5500 0.107 A referred to 5 V, K1 0.03 A.
  • MAIN5V total 2.25 A (auditor 2.28–2.33 A).
  • Battery current at 3.5 V = 2.25·4.79/(3.5·0.9) = 3.42 A; at 3.7 V, 3.24 A.
• Correction: 90 % of the datasheet's guaranteed "2.5 A from a battery as low as 3.2 V". The hard limit is ILIM(BST) ≥ 5.5 A. At 3.5 V the inductor peak ≈ 3.6–3.9 A, which leaves ≈ 30–40 % headroom. A 2.8 A GSM peak at a 3.2 V battery reaches ≈ 5.4 A, i.e. the limit. The conclusions hold: LTE-only on battery, E-01, and firmware sequencing.
• CSYS: effective ≈ 57–69 µF (Samwha 47 µF 16 V X7R 1210 with DC-bias loss, plus 10 µF 50 V X5R), under the 75 µF transient guidance. Confirmed. This matters more with A-01's MAIN5V feed.

A-06 — hot loops / EP grounding

• U25: C150.1 → U25.2 2.88 mm; C149.1 6.36 mm; C151.1 6.42 mm. C149/C150/C151 GND pads are in the 252 mm² U6 cluster; U25.7/EP and D34.2 are in the 3611 mm² cluster. D34 → SW 4.28 mm; L22.1 → SW 13.75 mm edge (not 17.0); C152 1.49 mm.
• U20: see B-06.
• U2: C22/C10/C11 → U2.7 18.3/17.0/20.7 mm.
• U12: C101 6.40 mm; D11 11.6 mm; L8 15.1 mm. D11.2 is in a different cluster (174 mm², 1 via) from C101.2/U12 GND (204 mm², 2 vias).
• EP vias: 0 on U25/U20/U2/U12. Nearest GND via 12.0 / 3.45 / 17.4 / 4.86 mm.
• D34 loss: 0.78·2.5 A·0.5 V ≈ 0.98 W. Confirmed.

A-07 — 5 V path bottlenecks

• VEH5V: In1 0.5 mm × 13.6 mm (plus In2 1.0 mm × 66.6 mm). VIN_SW: In2 0.8 mm × 23.6 mm. IPC-2221 internal (35 µm): +168 °C at 2.5 A for the 0.5 mm run, matching the auditor. With JLC's default 0.5 oz inner copper it is worse (R ≈ 27 mΩ, 0.17 W over 13.6 mm).
• These paths already carry the RS1-limited 2.35–2.65 A whenever charging. A-01's fix adds more hours at that level, so A-07 becomes a dependency of A-01.

A-08 — AMS1117

• LDO_IN on battery = 4.60–4.99 V − D12 (≈ 0.3 V) = 4.27–4.67 V. AMS1117 dropout ≈ 1.0 V at 0.1 A, so it needs ≈ 4.3 V. Marginal at the low corner. Iq 5/11 mA → 27–60 mW referred to the battery (boost η 0.88), against the 20–50 mW floor in drogheda-backup-lowpower. Confirmed.
• Fix check: C15578 TLV1117LV33DCYR: SOT-223, same 1-GND / 2-OUT / 3-IN pinout, 1 A, 455 mV at 1 A, 100 µA Iq, VIN max 5.5 V against LDO_IN max ≈ 5.21 V with 57.6 k; stock 26 999. OK.

A-09 — electrolytics

• Part data (JLC): C2827940 MVG 85 °C/2000 h, 130 mA; C165527 MVK 105 °C/1000 h (C10); C88734 50TZV 105 °C/2000 h; C116241 UUD 105 °C/5000 h. Confirmed.
• Life: MVG at 65 °C ≈ 8000 h; polymer (×10 per −20 °C) ≈ 200 000 h.
• C130/C131 merge into B-02. C78 stays here (→ C881921). Its effect on the U25 loop is benign: fc ≈ 4.4 kHz with 276 µF against the 1.8 kHz compensation zero → phase margin ≈ 68°.

F-51 — temperature sensors

• Measured: U3 SHT40 at 71.4 mm from U6; P7 / P8 at 100 / 83.5 mm; no TMP102 anywhere in components.csv; /NTC = {P3.3, R55, U6.17}. Free pins: PC5 (ADC1_IN15), PB10, PA9, PD2 (NC flags).
• I²C bus: SHT40 0x44, SC7A20, U13, U10 SC16IS752. U10 A0 = A1 = GND → 0x4D. TMP102 at 0x48 does not clash.
• Fix check:
  • C99269 TMP102AIDRLR: SOT-563, stock 34 854.
  • NTC tap: a 220 k load shifts the LTC4040 hot threshold by ≈ 0.7 °C (B3380) (auditor: < 0.6 °C; negligible difference). PC5 ≤ 5.463·120/220 = 2.98 V.
  • Caveat: VEH5V = 0 on battery, so tcell is available only on vehicle power (auditor states this).
• Rating: Major. R4 is still reachable with the P7 probe on the pack plus the LTC4040's hardware NTC pause. Leo can promote it to Blocker if the brief's "sensor ≤ 10 mm of U6" is binding for R4.

B-05 (→ merged into F-06) — RF_LTE on In1

• Reproduced: F.Cu 4.01 mm + In1 22.14 mm (0.5 mm), vias at (174.25, 58.25) and (194.27, 53.72); total 31.8 mm with /RF_ANT_LTE.
• Copper within ±0.25 mm of the In1 run: VBAT_MODEM F.Cu 1.15 mm², SYS5V 0.71, SW_IN 0.40, MODEM_LED_K 0.56 / _A 0.10, DIN_4G In2 0.71. GND vias within 1.5 mm of the whole LTE path: 1 at (175.2, 58.7).
• Fix geometry check (Wadell CPWG, JLC04161H-7628 L1–L2 0.2104 mm, εr 4.4, no mask / no copper thickness):
  • w0.30 / s0.20 → 56.6 Ω (≈ 50–52 Ω with mask and 35 µm copper, consistent with BCE's FD 53.3 / 48.4)
  • w0.35 / s0.20 → 52.1 Ω
  • existing w0.50 / s0.15 → 41 Ω (BCE 38.4)
  • Use 0.30/0.20, confirm in JLC's calculator, and order impedance control.

B-06 — U20 hot loop

• Reproduced: C128.1 → U20.2 0.72 mm; C127.1 2.38 mm; C128.2 → U20.7 6.86 mm, C127.2 8.48 mm (→ EP 3.30 / 4.94 mm); EP 0 vias, nearest 3.45 mm; L20.1 → SW 2.24 mm.
• At 5 V input, C127 (GRM21BR61H106 10 µF 50 V X5R) plus C128 ≈ 9.5 µF effective. Input ripple ΔV = 2 A·D(1−D)/(f·C) = 2·0.154/(500 k·9.5 µ) ≈ 65 mV p-p; input RMS current 0.78 A.
• Fix (resolved): add 2 × 22 µF 16 V (C86817) ≤ 3 mm → ≈ 17 mV p-p. The 16 V parts are only valid once A-01 removes the 24 V feed.

B-07 — J9 ESD

• Nets confirmed: USB_DP = J9.A6/B6 + U19.27; DM = J9.A7/B7 + U19.28; VBUS = J9.A4/A9/B4/B9 + U19.24. No protection device. J9 is 64.6 mm (centre) from U19.
• Fix check: C7519 USBLC6-2SC6, SOT-23-6, 3.5 pF, stock 1415. OK.
• Severity Major (Review lists it as a 🟠 F8 robustness item, not a field failure).

C-02 — F9P VCC ramp

• AP2112 DS39724: tS = 20 µs at no load; short-circuit current 50 mA (foldback); no soft-start.
• /3V3_GNSS ≈ 18 µF (2 × 10 µF X5R + 3 × 100 nF).
• Ramp: foldback from 50 mA toward ≈ 0.7 A gives ≈ 400 µs/V at start and ≈ 28 µs/V near regulation (C/(Ilim − 0.1 A load)), ≈ 80 µs/V average. That is inside 20–8000 µs/V, but the fast-end margin (≈ 1.4×) depends on the AP2112's unspecified current-limit maximum. BCE's 20–25 µs/V is consistent.
• Fix check: TPS7A2033PDBVR C2862740.
  • Same DBV pinout (1 IN, 2 GND, 3 EN, 4 NC, 5 OUT); t_STR 750–1150 µs → 239–367 µs/V.
  • Current limit ≥ 360 mA, above 20 µF·3.3 V/0.75 ms = 88 mA plus load.
  • VIN max 6.0 V against SW_5V ≤ 5.46 V; COUT 0.47–200 µF OK; stock 28 370.
• Rating: keep Major, at the low end. There are ≈ 52 000 starts per year, and the fix is a drop-in.

C-03 (→ merged into F-12)

• U18 courtyard: 0 vias. 48 × 1.1 mm plus 8 × 0.8×1.5 mm GND pads. Cluster 946 mm², 5 vias. Reproduced.
• Correction: J12.3 has a GND via 0.73 mm away at (62.8, 124.7); J12.2's nearest is 3.7 mm. BCE's "0 vias ≤ 3 mm" and FHJ's "4.1 mm" are both off.

C-04

• Q1 (197.28, 59.81) is 9.0 mm from J13 and Q5 7.1 mm (centres). /SW_5V In1 = 181.32 mm, plus F.Cu 19.7 mm, 2 vias. Reproduced. This is part of F-05's In1 usage problem.

E-01 (absorbs A-05 fix 1)

• U12.2 EN is on /SYS5V. Confirmed. MP1584 EN: internal 1 µA pull-up to ≈ 3 V, rising threshold 1.5 V, abs max 6 V. With 100 k to GND, EN sits at 0.1 V → OFF. PD2 at 3.3 V turns it ON. Fix OK.
• W5500 VIH max 5.5 V (5 V-tolerant inputs), so MCU-driven SPI/RST lines do not back-power a gated 3V3_ETH.
• Even the W5500's 13 mA power-down current costs ≈ 57 mW from the battery, more than the whole sleep floor. Hardware gating is required for R1's energy target.

E-02 (absorbs D-04)

• MCU side: PA15 resets to JTDI with pull-up (RM0383: GPIOA_PUPDR reset 0x6400 0000); R_PU 30–50 kΩ (DS10314).
• New: W5500 RSTn has its own internal pull-up, 62–112 kΩ (DS v1.0.2 §5.3); VIL 0.8 V; Schmitt VT− 0.95–1.09 V.
• 100 k pull-down: 3.3·100/(100 + 30k∥62k = 20.2k) = 2.75 V. Even with PA15 floating: 3.3·100/(100 + 62…112) = 1.56–2.04 V (undefined or high). The Review's 100 k could never have worked.
• 4.7 k (C23162, Basic): worst case 3.3·4.7/(4.7 + 20.2) = 0.62 V (typical 0.49 V) → reliably LOW. Drive current 0.70 mA.
• D-04's "move to PD2 with 100 k" is rejected (1.56–2.04 V, and PD2 is needed for ETH_PWR_EN).
• Severity: Major standalone. It becomes Minor (vehicle-power resets only) once E-01 gates 3V3_ETH.

E-03 (absorbs H-07, F-11/Y1)

• Y1 = C14872 X49SM25MSD2SC (HC-49S, CL 20 pF, ±20 ppm, −20…+70 °C). The W5500 specifies CL 18 pF and ±30 ppm. C95/C96 = C1647 18 pF C0G. Distances 10.8 / 13.7 mm; traces 22.0 / 23.0 mm.
• CL: = (C1+Cp)(C2+Cp)/(C1+C2+2Cp) + Cshunt, with Cp ≈ 3 pF (pin) + ≈ 2.5 pF (22 mm trace over a 0.21 mm dielectric) and Cshunt ≈ 1 pF.
  • 18 pF → CL ≈ 12.8 pF.
  • Pulling (C1 10–20 fF, C0 5 pF) = (C1/2)·[1/(C0+12.8) − 1/(C0+20)] ≈ +78…+156 ppm.
• Why Minor: V5.5 as-fabbed and V5.6 have the identical Y1 and C95/C96 and Ethernet works; J10 is DNP on the v6 prototypes.
• 63 × 25 MHz = 1575.000 MHz, 420 kHz from L1, is true. The +100 ppm pull moves it to ≈ 1575.16 MHz, closer to L1 centre. That is an EMC note shared with Y3.

Duplicates / merges proposed

Primary	Absorbs	Agreed fix	Severity
A-01	B-01, H-05, F-53, A-06 (U2 row), F-08	U20 from MAIN5V (delete D20, merge /VIN_MODEM into /MAIN5V, no D21); fan from VEH5V (JP1 bridged, U2 block DNP); Q10 branch DNP; F2 → 3 A C206912 ahead of D10; with A-07, A-04, A-05 CSYS, B-06 Cin + 220 µF polymer at U20.2	Blocker
A-02	F-13 (U6 EP part), A-14 (In1 cuts under U6)	as A-02	Blocker
B-02	A-09 (C130/C131), A-17	C130/C131 → C881921; R116 113 k C22862, C141 6.8 nF C1542, C142 56 pF C1572; + 2 × 22 µF at L20.2	Major
F-12 (umbrella)	B-04, C-03, F-04, F-13 (EP arrays + solid SMD connection; U6 stays in A-02), EP-via clauses of A-06/B-06/F-07	Zones connect_pads thru_hole_only; EP arrays (U25 3×3, U20 2×3, U12 2×3); U19 ≥ 30–40 tented gap vias + ring; U18 ≥ 24 at the diagonal centres; 2 vias ≤ 1 mm per U.FL GND pad; RF fences ≤ 3 mm; 5 mm board grid + edge fence ≤ 5 mm. Acceptance: every GND pad of U19/U18/U20/U25/J12/J13 in an F.Cu cluster with ≥ 1 plane via ≤ 2 mm	Major
F-06	B-05, C-05, B-12 (stackup/netclass)	Both RF lines F.Cu CPWG 0.30/0.20 over solid In1, JLC04161H-7628 set in the board file, impedance control, RF netclass	Major
B-06	F-07, A-06 (U20 row), A-05 fix 3	Cin GND to EP ≤ 2 mm, delete the 0.25 mm GND neck, EP 2×3 vias, 2 × 22 µF C86817 + 220 µF C881921 at U20.2	Major
B-07	G-02, F-14 (J9), F-17	USBLC6-2SC6 C7519 ≤ 5 mm from J9; pair coupled on F.Cu	Major
C-01	D-07	TPS2552DBVR current-limited feed; ANT_OFF → EN̅; FAULT̅ → ANT_SHORT_N	Blocker
E-01	A-05 fix 1	/ETH_PWR_EN PD2 → U12 EN, 100 k to GND	Major
E-02	D-04	4.7 k C23162 /ETH_RST → GND at U11	Major (Minor with E-01)
E-03	H-07, F-11 (Y1)	see conflict (f) below	Minor
A-07	J-02 ("59 real" width warnings on these nets)	as A-07	Major

Fix conflicts resolved

• (a) U20 feed. A-01's "Option A" and B-01's "Option B" are the same fix. Adopt MAIN5V-only with no D21. The other option (D20 → /VIN_PROT, 60 V Schottky) keeps a 42 V part at 0–3 V margin to the pulse-2a clamp and costs ≈ 0.15 V more battery headroom. If D21 must remain for any reason, use the genuine Nexperia C552943, not the C53114006 clone.
• (b) F2 rating. "3 A" (A-01) vs "4 A class" (B-01 Option A). With MAIN5V-only, F2 carries ≤ 0.74 A at 24 V and ≤ 1.5 A at 12 V → 3 A C206912. 4 A (C206914, stock 778) only for sustained 9 V operation.
• (c) U20 compensation. A-17 proposes R116 = 10 k with polymer; B-02 proposes 113 k / 6.8 nF / 56 pF. With 454 µF polymer: 10 k → fc 1.24 kHz, zero 4.8 kHz → phase margin ≈ 15° (near-unstable, wrong direction). 113 k → fc 14 kHz, zero 207 Hz, pole 25 kHz → phase margin ≈ 60°. Adopt B-02.
• (d) U20 input caps. 1 × 22 µF (B-06), 2 × 22 µF + 220 µF (A-05), or a second 10 µF 50 V 1206 (F-07). 2 × 22 µF 16 V C86817 (ripple 65 → 17 mV p-p) plus 1 × 220 µF C881921, because at PFI hand-over the modem load sits on a CSYS of only ≈ 60 µF.
• (e) LTE ESD part. PGB1010402KR (12 VDC max) → PESD0402-240 C1975527 (24 V), or DNP.
• (f) Y1 load caps, 18 pF vs 33 pF. Both are right, for different crystals.
  • Keeping the HC-49 C14872 (CL 20 pF): C95/C96 → 33 pF C1663 (Basic) → CL ≈ (33+5.5)/2 + 1 ≈ 20.3 pF, or ≈ 19.3 pF once relocated.
  • Preferred, since Y1 moves ≤ 5 mm anyway: Y1 → C9006 (YXC 3225, 25 MHz, CL 12 pF, ±10 ppm, −40…+85 °C, Basic, stock 528 k) and keep 18 pF: CL = 9 + ≈ 3 = 12 pF.
  • The same crystal and caps suit Y3 (gm_crit ≈ 0.77 mA/V at ESR 40 Ω, C0 2 pF, under the F411's 1 mA/V). D-02's C2901684 gives more margin, so the MCU auditor decides Y3.
• (g) ETH_RST. 4.7 k on PA15 (E-02), not PD2 + 100 k (D-04).
• (h) Spare-pin allocation. PD2 = ETH_PWR_EN (E-01), PB10 = PFO (A-13), PC5 = NTC cell tap (F-51), PA9 spare.
• (i) R50. 1.43 k (A-03) over 1.5 k (ECO C).
• (j) CPWG geometry. 0.30/0.20 (B-05) vs 0.30–0.35/0.20–0.25 (F-06). Adopt 0.30/0.20; the calculator decides the final value.

Anything else you noticed

1. New, Major: reverse polarity defeated by D10 placement. D10 (C224019) and D32 (C699039) are unidirectional parts drawn with a bidirectional A1/A2 symbol, with pad 1 (cathode) on the + rail. D10 sits on /24V_IN ahead of F2 and ahead of the Q10/Q23 reverse-polarity FETs. A reversed P1 therefore forward-biases D10 straight across the harness with no board fuse. The SMB part carries harness-fuse current until it fails, typically short. Fix: F2 electrically first (P1 → F2 → D10 ∥ Q23). A reversed connection then blows the socketed Nano2 fuse. A-01 lists this only as "optional"; make it mandatory. ISO 7637-2 pulse 1 (24 V: −600 V, 50 Ω, 1 ms ≈ 12 A, I²t ≈ 0.07 A²s) is ≈ 7 % of a 3 A Nano2's I²t, so it is fine.
2. Cutoff intent (ECO §A). With U20 on MAIN5V (as-is through D21, or with the fix), P5 no longer cuts modem power directly. R113 disables U20 whenever the MCU is unpowered, so the functional intent holds. Record it as a decision.
3. H0008 evidence is weaker than A-02/A-03 imply. The ≈ 1.3 A figure is inferred from the OCV slope, and an LTC4040 dissipating ≈ 0.75 W is unlikely to reach OT at bench ambient. The ratings stand on ECO D2/C and the datasheet, not on H0008. The clamp-meter test is still worth doing.
4. AP64350 EN pull-up is 1.5 µA (+4 µA hysteresis source), not 5.5 µA (A-power pass table). R113 100 k → 0.15 V, still OFF.