Drogheda/03-Architecture-Hardware/pinmap-v6.md

222 lines
33 KiB
Markdown
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

# EinarBoard v6 — MCU pin map (U16 STM32F411RET6, LQFP64) for `board_v6.h` / FW 0.7.x
Snapshot: sch ecee9fed… / pcb 6ddec80d… (evidence pack 2026-09-28) · Author: D/G auditor (read-only)
> **Editorial header (v1.0, 2026-09-28).** Source: the D/G auditor's `findings/pinmap-v6.md` (same date, same snapshot), republished as the standalone companion of `2026-09-28_Drogheda_EinarBoard-v6_Full-Audit_v1.0.md` (§4). The table describes **v6 as drawn**. Rows marked **▶ audit** carry the pin-level consequence of a finding that was independently verified (verify_1 = power/RF, verify_2 = layout/BOM/MCU) or of the spare-pin allocation both verifiers accept. Nothing below has been applied to the schematic; the "▶ audit" notes say what changes **if** the fix is adopted. Corrections applied to the auditor's text:
> 1. **PA15 / ETH_RST:** pull-down is **4.7 kΩ (C23162)**, not 100 kΩ. The W5500 RSTn has its own internal 62–112 kΩ pull-up (DS v1.0.2 §5.3) on top of the PA15 JTDI 30–50 kΩ pull-up; 4.7 k gives ≤ 0.62 V worst case. D-04's alternative "move to PD2 + 100 k" fails (1.56–2.04 V) and is withdrawn (verify_1, E-02 absorbs D-04).
> 2. **Spare-pin allocation (verify_1 conflict (h)):** PD2 = `ETH_PWR_EN` (E-01), PB10 = `PFO` (A-13, absorbs D-10), PC5 = pack-NTC tap (F-51), PA9 = spare (D-12 test pad). D-10's CLPROG → PC5 is dropped. **Open:** D-08's board-ID strap also wanted PD2; no free pin is left for it except PA9 (Leo to choose).
> 3. **D-01:** the isolating gate is the **Nexperia 74LVC1G125GV, C12518** (verified Ioff), not the TECH PUBLIC clone C3040595; Rdfu1 22 k → 100 k (C25803). The 10 k series-R alternative is withdrawn (≈ 0.28 mA, same order as the V5.5 back-feed) (verify_2).
> 4. **D-06 is merged into F-02 and rated Blocker** (Rig1 ≤ 3 mm of copper from P1.3 + SMBJ33A C224019), not ≤ 5 mm/Major (verify_2).
> 5. **HSE distances** are pad-edge **8.32 / 11.30 mm** (the 10.30 / 14.21 mm below are pad-centre) (verify_2, D-02).
> 6. **C-01 (Blocker, absorbs D-07):** with the TPS2552 antenna feed, PC2 (`/GNSS_ANT_SHORT_N`) becomes a real short-fault input (FAULT̅, 10 k to /3V3_GNSS); PC1 stays undriven.
> 7. **PB4 decode:** the power auditor, citing the LTC4040 datasheet table (p.14), decodes "pausa NTC" = CHRG low ∧ FAULT low and bad battery = CHRG high ∧ FAULT low; this governs over the wording in the PB4 row.
**Coverage: 64 / 64 pins.** Sources: `evidence/mcu_pins.csv` (netlist), `evidence/pcb_pads.csv` (distances, pad-centre to pad-centre, same net), `evidence/firmware_pins.csv` (V5 `board_v5.h` + `hbox_v5_bringup.ino` 0.6.0), ST DS10314 (DocID026289 Rev 7) Table 8 (pin definitions, I/O structure) and Table 53 (I/O static), and ST's own alternate-function database (`STM32_open_pin_data`: `mcu/STM32F411R(C-E)Tx.xml` + `mcu/IP/GPIO-STM32F411_gpio_v1_0_Modes.xml`, the CubeMX source for DS10314 Table 9). The embedded schematic symbol was checked against the ST LQFP64 pinout: **64/64 pin numbers and names match** (the ERC "symbol differs from library" warning on U16 is cosmetic).
Legend. **FT** = 5 V-tolerant in digital mode only (DS10314 Table 8 note 4: not in analog or oscillator mode; Table 53 note 5: internal pull-up/down must be off above VDD+0.3 V). **TC** = 3.3 V-only. On this LQFP64 only **PA0** and **PB5** are TC; every other GPIO is FT. PC13–PC15 are backup-domain pins (Table 8 note 2: sink ≤ 3 mA, ≤ 2 MHz, ≤ 30 pF, never a source). **No MCU pin on v6 carries a 5 V or a 1.8 V signal**: all modem 1.8 V lines go through U23/U24 (74LVC2T45) or open-drain Q20/Q21, and every pull-up is to /3V3.
"Same?" = does the V5 macro on this pin mean the same thing on v6.
## 1. Pin table (physical pins 1–64)
| Pin | Name | v6 net | Connected parts (short) | Function on v6 | Dir / mode (FW) | Peripheral + AF / ADC / EXTI | 5 V needed? / pin | V5 macro on this pin → same? | Proposed v6 macro | Notes / conflicts |
|---|---|---|---|---|---|---|---|---|---|---|
| 1 | VBAT | /3V3 | 3V3 big net | Backup-domain supply, tied to 3V3 (no coin cell) | power | — | — / S | — | — | RTC + BKP regs + LSE lost whenever /3V3 drops (P5 cut-off open, no USB) |
| 2 | PC13 | /LED_C13 | D17 blue LED (K) ← R102 1 k ← /3V3 | Board status LED, active LOW (sink) | OUT, LOW = on | GPIO, EXTI13 | No / FT backup-domain | `PIN_LED_C13` → **same** | `PIN_LED_C13` | I = (3.3 − 2.8 V Vf, C125103) / 1 k ≈ 0.5 mA ≤ 3 mA sink limit ✓ (dim) |
| 3 | PC14-OSC32_IN | /LSE_IN | Y4.1 (32.768 kHz C32346, CL 12.5 pF), C115 12 pF | LSE | oscillator | RCC_OSC32_IN | — | `BOARD_LSE_HZ` → same | `BOARD_LSE_HZ 32768UL` | Y4.1 5.54 mm, C115 2.96 mm. Crystal/caps mismatch → D-03 |
| 4 | PC15-OSC32_OUT | /LSE_OUT | Y4.2, C116 12 pF | LSE | oscillator | RCC_OSC32_OUT | — | same | — | Y4.2 7.91 mm, C116 6.49 mm (> 5 mm) |
| 5 | PH0-OSC_IN | /HSE_IN | Y3.1 (25 MHz HC-49S C14872, CL 20 pF), C113 15 pF | HSE (USB, PLL, **ROM DFU needs it**) | oscillator | RCC_OSC_IN | — | `BOARD_HSE_HZ` → same | `BOARD_HSE_HZ 25000000UL` | Y3.1 **10.30 mm** ctr (**8.32 mm pad edge**, verify_2), C113 13.72 mm, track 14.5 mm → D-02. ▶ audit: Y3 → C2901684 + C113/C114 12 pF C38523 (alt. C9006 + 15 pF C1644) |
| 6 | PH1-OSC_OUT | /HSE_OUT | Y3.2, C114 15 pF | HSE | oscillator | RCC_OSC_OUT | — | same | — | Y3.2 **14.21 mm** ctr (**11.30 mm pad edge**, verify_2), C114 17.02 mm, track 20.7 mm → D-02 |
| 7 | NRST | /NRST | C104 100 nF (3.26 mm), SW1 RESET, P6.1 RESET-EXT, TP5 | MCU reset only | RST (int. pull-up 30–50 kΩ) | — | — | — (V5: P10) | — | NRST reaches only the MCU. Route 108.6 mm (91.9 F.Cu + 16.8 In2). P6 external cable has no ESD → G-08 |
| 8 | PC0 | /ETH_INT | U11.36 ~INT (W5500) | W5500 interrupt, active LOW | IN pull-up | GPIO, ADC1_IN10, **EXTI0** | No / FT | `PIN_ETH_INT` → **same** | `PIN_ETH_INT` | BOOT1 trap avoided (V4 had it on PB2) ✓ |
| 9 | PC1 | /GNSS_ANT_DETECT | U18.4 ANT_DETECT — **F9P input** | none usable (see D-07) | **ANALOG / hi-Z**, never drive HIGH while F9P off | GPIO, ADC1_IN11, EXTI1 | No / FT | V5: NC · **V5.6: MODEM_RST_MCU** → different | `PIN_GNSS_ANT_DET` (reserved) | No antenna-current supervisor on v6: MCU cannot learn antenna state here. ▶ audit C-01: stays undriven (open-antenna detect not implemented; infer from C/N0) |
| 10 | PC2 | /GNSS_ANT_SHORT_N | U18.6 ANT_SHORT_N — **F9P input** | none usable (D-07) | ANALOG / hi-Z | GPIO, ADC1_IN12 (SPI2_MISO AF5 unused) | No / FT | V5: NC · **V5.6: MODEM_LED_MCU** → different | `PIN_GNSS_ANT_SHORT_N` (reserved) | as PC1. ▶ audit C-01: TPS2552DBVR (C46506) FAULT̅ drives this net (10 k C25804 to /3V3_GNSS) → LOW = antenna short; input, no MCU pull; valid only while the F9P rail is on |
| 11 | PC3 | /GNSS_RTK_STAT | U18.20 RTK_STAT (output) | RTK status: 0 = fixed, blinking = corrections in use, 1 = none | IN, pull-DOWN while F9P off | GPIO, ADC1_IN13, **EXTI3** (shared with PB3) | No / FT | V5: NC · **V5.6: MODEM_EN (output!)** → different | `PIN_GNSS_RTK_STAT` | A V5.6 binary would drive this against the F9P output → D-08 |
| 12 | VSSA | GND | — | analog ground | power | — | — | — | — | |
| 13 | VDDA | /VDDA | R104 10 Ω ← 3V3, C109 100 nF (3.13 mm), C112 1 µF (4.61 mm) | ADC reference (VREF+ bonded) | power | — | — | `ADC_REF 3.3f` → same | — | ✓ DS10314 recommendation |
| 14 | PA0-WKUP | /BAT_SENSE | R5 10 k ← /BAT_PLUS, R6 10 k → GND, C5 100 nF (5.6 mm) | Pack voltage / 2 | ANALOG | **ADC1_IN0** (WKUP1 spare) | No (≤ 2.10 V at 4.2 V) / **TC** | `PIN_BAT_SENSE` → **same** | `PIN_BAT_SENSE` | `DIV_RATIO 2.0` unchanged. 0.21 mA permanent pack drain |
| 15 | PA1 | /PWR_CTRL | R1 1 k → Q5 MMBT3904 base (**no base pull-down**) → /GATE_LS (R2 10 k to SYS5V) → Q1 AO3401A → /SW_5V → U21 AP2112K → /3V3_GNSS | **F9P rail enable**, HIGH = on | OUT PP, LOW at boot | GPIO / TIM2_CH2 AF1 (soft-start PWM) | No / FT | `PIN_PWR_CTRL` → **CHANGED**: V5 = RTK + 4G stack; v6 = F9P only (modem has PC10) | `PIN_GNSS_PWR` (keep `PIN_PWR_CTRL` alias) | Floats in reset/DFU → D-09 (absorbs A-12). ▶ audit: 100 k C25803 `/BASE_LS` → GND next to Q5 |
| 16 | PA2 | /GNSS_TX | U18.43 RXD (F9P UART1 in) | MCU → F9P UART1 (UBX config) | AF PP only while F9P on; INPUT no-pull when off | **USART2_TX AF7** | No / FT | `PIN_GNSS_TX` → same (was simpleRTK2B UART1) | `PIN_GNSS_TX` | 0.5.5 float rule is mandatory (direct into F9P) |
| 17 | PA3 | /GNSS_RX | U18.42 TXD (F9P UART1 out) | F9P → MCU NMEA/UBX | AF; pull-up only while F9P on | **USART2_RX AF7** | No / FT | `PIN_GNSS_RX` → same | `PIN_GNSS_RX` | `GNSS = Serial2` |
| 18 | VSS | GND | — | ground | power | — | — | — | — | |
| 19 | VDD | /3V3 | nearest C106 3.29 mm | supply | power | — | — | — | — | per-pin cap target ≤ 2 mm (Note) |
| 20 | PA4 | /5V_SENSE | R7 10 k ← /VEH5V, R8 10 k, C7 100 nF (5.5 mm) | VEH5V / 2 (now U25 output or bench P2) | ANALOG | **ADC1_IN4** | No (2.50 V at 5.00 V, 2.66 V at 5.32 V) / FT | `PIN_5V_SENSE` → same net; source is now on-board U25 | `PIN_5V_SENSE` | LTC4040 PFI real threshold 1.19 V × 3.7 = 4.40 V (LTC4040 DS pin 19) |
| 21 | PA5 | /IGN_SENSE | Rig1 22 k ← /IGN_IN (P1.3); Rig2 22 k ∥ Rigb1 3.3 k → GND; C9 100 nF (3.09 mm); D5 BAT54 → /3V3 | Ignition present / vehicle-voltage estimate | **ANALOG** on v6 (V5 read it digital) | **ADC1_IN5** (EXTI5 if digital) | No at the pin (3.23 V at 28 V; clamp ≈ 3.55 V above 30.3 V) / FT (not in analog mode) | `PIN_IGN_SENSE` → same net, **digital read no longer adequate** (12 V vehicles) | `PIN_IGN_SENSE` | Divider midpoint, pin and C9 on one net (junction verified) · D-05, D-06. ▶ audit F-02 (Blocker, absorbs D-06): Rig1 moves ≤ 3 mm of copper from P1.3 + SMBJ33A C224019 at P1.3, so the long run becomes the 22 k-limited `/IGN_SENSE`; pin net unchanged. D-05: Rigb1 3.3 k → 2.2 k C4190 → ratio 0.0833 (12 V → 1.00 V, 24 V → 2.00 V, 36 V → 3.00 V) |
| 22 | PA6 | /FAN_PWM | Rg1 100 Ω → Q2 AO3400A gate, Rgs1 100 k | Fan low-side switch, HIGH = on | OUT PP (ON/OFF policy) | GPIO / **TIM3_CH1 AF2** | No / FT | `PIN_FAN_PWM` → **same** | `PIN_FAN` | TIM3 is also PA7's capture timer (§2.4) |
| 23 | PA7 | /GNSS_TIMEPULSE | U18.53 TIMEPULSE | F9P 1 PPS | IN, pull-down while F9P off | **TIM3_CH2 AF2** input capture / EXTI7 | No / FT | V5: NC → new | `PIN_GNSS_PPS` | |
| 24 | PC4 | /NTC2 | R126 10 k/1 % → 3V3, C157 100 nF (3.11 mm), P8.1 | External NTC probe 2 (10 k B3950) | ANALOG | **ADC1_IN14** | No / FT | V5: NC (V5.6: MODEM_ON_SLEEP, DNP) → new | `PIN_NTC2` | `$PHLG tntc2` (append) |
| 25 | PC5 | unconnected (NC flag) | — | **spare** | ANALOG (lowest Idd) | ADC1_IN15 | — | V5: NC (V5.6: MODEM_ASSOC, DNP) | `PIN_SPARE_PC5` → `PIN_NTC_CELL` | ▶ audit F-51 (verify_1 (h)): pack-NTC tap, `/NTC` → 100 k (C25803) / 120 k (C25808) + 10 nF → PC5; PC5 ≤ 2.98 V; valid only with VEH5V present. D-10's CLPROG use dropped |
| 26 | PB0 | /EXT_LED | Q4 AO3400A gate, Rled1 10 k → panel LED D1 at **P9** | Panel LED, HIGH = on | OUT PP | GPIO (TIM3_CH3 AF2) | No / FT | `PIN_EXT_LED` → same (connector P8 → P9) | `PIN_EXT_LED` | |
| 27 | PB1 | /NTC_TEMP | R42 10 k/1 % → 3V3, C24 100 nF (6.63 mm), P7.1 | External NTC probe 1 (hot-spot, `tntc`) | ANALOG | **ADC1_IN9** | No / FT | `PIN_NTC` → same (connector P12 → P7) | `PIN_NTC` | |
| 28 | PB2 | /BOOT1_STRAP | R99 10 k → GND (2.84 mm) | BOOT1 = 0 strap (DFU entry) | never reconfigure | BOOT1 | — | — (V4: ETH_INT!) | — | "never repurpose PB2" ✓ |
| 29 | PB10 | unconnected (NC flag) | — | **spare** | ANALOG | TIM2_CH3 AF1, I2C2_SCL AF4, SPI2_SCK AF5, EXTI10 | — | V5: NC | `PIN_SPARE_PB10` → `PIN_PFO` | ▶ audit A-13 (absorbs D-10): U6.20 PFO → PB10, 100 k C25803 pull-up to /3V3, EXTI10 falling = backup entry at VEH5V < 4.40 V |
| 30 | VCAP1 | /VCAP1 | C111 4.7 µF (3.19 mm) | core regulator cap | power | — | — | — | — | ✓ |
| 31 | VSS | GND | — | ground | power | — | — | — | — | |
| 32 | VDD | /3V3 | nearest C105 3.65 mm | supply | power | — | — | — | — | |
| 33 | PB12 | /ETH_CS | U11.32 SCSn | W5500 chip select | OUT PP (INPUT_PULLUP while W5500 idle) | GPIO (SPI2_NSS AF5 unused) | No / FT | `PIN_ETH_CS` → **same** | `PIN_ETH_CS` | |
| 34 | PB13 | /ETH_SCK | U11.33 | SPI2 SCK | AF | **SPI2_SCK AF5** | No / FT | `PIN_ETH_SCK` → same | `PIN_ETH_SCK` | |
| 35 | PB14 | /ETH_MISO | U11.34 | SPI2 MISO (W5500 output) | AF in | **SPI2_MISO AF5** | No / FT | `PIN_ETH_MISO` → same | `PIN_ETH_MISO` | |
| 36 | PB15 | /ETH_MOSI | U11.35 | SPI2 MOSI | AF | **SPI2_MOSI AF5** | No / FT | `PIN_ETH_MOSI` → same | `PIN_ETH_MOSI` | |
| 37 | PC6 | /USART6_TX | K1.10 (NO contact) → /DIN_4G → U23 (3.3 → 1.8 V) → U19.10 RXD | MCU → modem (AT, GGA, `$PHLG`) when K1 energised (Mode B) | AF PP while modem on; INPUT otherwise | **USART6_TX AF8** | No / FT | V5: NC. **Takes over V5 PA9 `PIN_USART1_TX` (RELAY TX)** | `PIN_MODEM_TX` | NC flag on a connected pin (cosmetic) → D-11 |
| 38 | PC7 | /USART6_RX | R106 100 Ω ← /DOUT_4G ← U24 (1.8 → 3.3 V) ← U19.9 TXD; /DOUT_4G also → U18.26 F9P RXD2 | modem → MCU (AT replies + RTCM byte count) | AF, **no pull while F9P off** | **USART6_RX AF8** | No / FT | V5: NC (V5.6 RTCM_TAP, same peripheral) | `PIN_MODEM_RX` | NC flag cosmetic (D-11 → J-04). A pull-up here back-feeds the F9P (D-01). ▶ audit D-01: U27 74LVC1G125GV C12518 on /3V3_GNSS isolates U18.26 (new net `/DOUT_4G_F9P`); PC7/R106 stay on `/DOUT_4G`. B-10: R106 100 Ω → 1 kΩ C14676 |
| 39 | PC8 | /MODEM_PWRKEY | Q20 2N7002 gate, R114 100 k PD → U19.1 PWRKEY (int. pull-up to VBAT) | Modem power key; MCU HIGH = key pressed | OUT PP, LOW at boot | GPIO (TIM3_CH3) | No / FT | V5: NC → new | `PIN_MODEM_PWRKEY` | on ≥ 50 ms, off ≥ 2.5 s (Phase-1 spec / Phase-2 delta) |
| 40 | PC9 | /MODEM_STATUS | U24.6 (2B) ← U19.66 STATUS (1.8 V) | Modem powered/ready (≈ 11.2 s after power-on) | IN **pull-DOWN** (floats when modem off: U24 Ioff) | GPIO, **EXTI9** (shared with PB9) | No / FT | V5: NC → new | `PIN_MODEM_STATUS` | poll it (EXTI9 belongs to the accelerometer) → D-14 (merged into B-10). ▶ audit B-10: 100 k C25803 `/MODEM_STATUS` → GND |
| 41 | PA8 | /CHRG_EN | U6.4 CHGOFF, R56 100 k → GND | Charger disable; HIGH = charge OFF | OUT PP | GPIO (TIM1_CH1 AF1) | No / FT | `PIN_CHRG_EN` → **same** | `PIN_CHRG_EN` | In reset/DFU R56 → charger ON (as V5). ▶ audit A-11: R56 100 k re-netted to /3V3 → charger OFF by default; polarity unchanged |
| 42 | PA9 | unconnected (NC flag) | — | **spare** | ANALOG | USART1_TX AF7, OTG_FS_VBUS AF10 | — | `PIN_USART1_TX` → **REMOVED** (role now PC6) | `PIN_DBG_TX` if a pad is added | USART1 is RX-only on v6 (TX alternates PA15/PB6 are taken). Add a test pad → D-12. ▶ audit: only remaining spare after (h); also the only candidate left for D-08's board-ID strap (open) |
| 43 | PA10 | /USART1_RX | U18.27 TXD2 (F9P UART2 out), K1.1 (NC → modem DIN), Rdfu1 22 k → /3V3 (2.28 mm) | Passive tap on the F9P → modem stream (fail-safe path through K1 NC) | AF RX, **no internal pull** (PA10 pull-up is 7–14 kΩ, DS Table 53) | **USART1_RX AF7** | No / FT | `PIN_USART1_RX` → **same** (tap), now RX-only | `PIN_F9P_TX2_TAP` | `Uart RELAY(PA10, PA9)` → RX-only instance. ▶ audit D-01: Rdfu1 22 k → 100 k C25803 (back-feed ≤ 27 µA) |
| 44 | PA11 | /DFU_DM | J11 A7/B7, D15 PESD5V0S1BA (6.74 mm from J11) | USB FS D− (ROM DFU + CDC console) | AF | **OTG_FS_DM AF10** | No / FT | `CON SerialUSB` → same | — | route 55.1 mm |
| 45 | PA12 | /DFU_DP | J11 A6/B6, D14 (3.19 mm) | USB FS D+ | AF | **OTG_FS_DP AF10** | No / FT | same | — | route 50.1 mm |
| 46 | PA13 | /SWDIO | TP3 (6.04 mm) | SWD data | AF0 (pull-up at reset) | SYS_JTMS-SWDIO AF0 | — | — | — | |
| 47 | VSS | GND | — | ground | power | — | — | — | — | |
| 48 | VDD | /3V3 | C107 2.10 mm | supply | power | — | — | — | — | ✓ |
| 49 | PA14 | /SWCLK | TP4 (5.43 mm) | SWD clock | AF0 (pull-down at reset) | SYS_JTCK-SWCLK AF0 | — | — | — | |
| 50 | PA15 | /ETH_RST | U11.37 RSTn | W5500 reset, LOW = held | OUT PP, drive LOW first thing | GPIO (**JTDI AF0 at reset, 30–50 kΩ pull-up**) | No / FT | `PIN_ETH_RST` → **same** | `PIN_ETH_RST` | W5500 is released during MCU reset/boot → E-02 (absorbs D-04). ▶ audit (verified): **4.7 k C23162 `/ETH_RST` → GND at U11.37** → ≤ 0.62 V worst case (W5500 internal 62–112 kΩ pull-up + PA15 30–50 kΩ); 100 k gives 2.75 V and fails |
| 51 | PC10 | /MODEM_PWR_EN | U20.3 EN (AP64350), R113 100 k PD | Modem buck enable, HIGH = on | OUT PP, LOW at boot | GPIO | No / FT | V5: NC (**V5.6 used PC3**) → new | `PIN_MODEM_PWR_EN` | any MCU reset power-cycles the modem (by design). ▶ audit A-01: U20 input moves to /MAIN5V only (D20 removed, no D21); EN control unchanged (R113 100 k PD, EN pull-up 1.5 µA → 0.15 V = OFF) |
| 52 | PC11 | /MODEM_RST | Q21 2N7002 gate, R115 100 k PD → U19.16 RESET | Modem reset; MCU HIGH = asserted | OUT PP, LOW at boot | GPIO | No / FT | V5: NC (**V5.6 used PC1**) → new | `PIN_MODEM_RST` | |
| 53 | PC12 | /GNSS_RESET_N | U18.49 RESET_N, R105 10 k → /3V3_GNSS | F9P hard reset, LOW = reset | **OUTPUT_OPEN_DRAIN** (or INPUT); never push HIGH | GPIO | No / FT | V5: NC → new | `PIN_GNSS_RESET_N` | push-HIGH with F9P off = back-feed |
| 54 | PD2 | unconnected (NC flag) | — | **spare** | ANALOG | TIM3_ETR AF2, EXTI2 | — | V5: NC | `PIN_ETH_PWR_EN` (▶ audit) | ▶ audit E-01 (verify_1 (h)): `/ETH_PWR_EN` → U12.2 EN, 100 k C25803 → GND; HIGH = 3V3_ETH on. D-08's 10 k board-ID strap on this pin **conflicts** and is unresolved |
| 55 | PB3 | /CHRG_STAT | U6.8 CHRG (open-drain), R57 100 k → /3V3 | LOW = charging | IN, no pull | GPIO, **EXTI3** (JTDO/SWO AF0 at reset; TIM2_CH2) | No (3V3 pull-up) / FT | `PIN_CHRG_STAT` → **same** | `PIN_CHRG_STAT` | SWO trace unavailable |
| 56 | PB4 | /CHRG_FAULT | U6.9 FAULT (open-drain), R58 100 k → /3V3 | LOW = fault / NTC pause | IN | GPIO, EXTI4 (NJTRST pull-up at reset) | No / FT | `PIN_CHRG_FAULT` → **same** | `PIN_CHRG_FAULT` | "pausa NTC" = EN allowed ∧ STAT idle ∧ FAULT low. ▶ audit: the power auditor decodes from the LTC4040 datasheet table (p.14) "pausa NTC" = CHRG low ∧ FAULT low, bad battery = CHRG high ∧ FAULT low; use that decode |
| 57 | PB5 | /BYP_CTRL | R40 1 k → Q6 MMBT3904 (R41 10 k B–E) → K1 coil (/SYS5V) | K1 Mode B; HIGH = energised = modem DIN ← PC6 | OUT PP, LOW at boot | GPIO (TIM3_CH2 AF2) | No / **TC** (output only ✓) | `PIN_BYP_CTRL` → same pin; NO contact now = PC6 (was PA9) | `PIN_BYP_CTRL` | K1 0.15 W while held |
| 58 | PB6 | /I2C_SCL | R30 4.7 k; U3 SHT40, U10 SC16IS752, U13 PCF8574, U26 SC7A20 | I2C1 SCL | AF OD | **I2C1_SCL AF4** | No / FT | `PIN_I2C_SCL` → same | `PIN_I2C_SCL` | Map: 0x18 SC7A20 (new), 0x20 PCF8574, 0x44 SHT40, 0x4D SC16IS752. **No TMP102** (0x48/0x49) on v6 as drawn. ▶ audit F-51: TMP102 C99269 at 0x48 (ADD0 → GND) between U6 and L6; F-52 option: second TMP102 at 0x49 |
| 59 | PB7 | /I2C_SDA | R31 4.7 k; same devices | I2C1 SDA | AF OD | **I2C1_SDA AF4** | No / FT | `PIN_I2C_SDA` → same | `PIN_I2C_SDA` | |
| 60 | BOOT0 | /BOOT0 | R98 10 k → GND (3.65 mm), SW2 → 3V3 | Boot select | I (B) | — | — | — | — | route 73.2 mm (61.4 mm on In1) |
| 61 | PB8 | /SER_IRQ | U10.15 IRQ (open-drain), R81 10 k → 3V3 | SC16IS752 IRQ | IN | GPIO, **EXTI8** | No / FT | `PIN_SER_IRQ` → **same** | `PIN_SER_IRQ` | |
| 62 | PB9 | /ACC_INT1 | U26.5 INT1 (push-pull, active HIGH default) | Motion interrupt / STOP wake | IN, EXTI rising | GPIO, **EXTI9** (TIM4_CH4, TIM11_CH1) | No / FT | V5: NC → new | `PIN_ACC_INT1` | owns EXTI9 |
| 63 | VSS | GND | — | ground | power | — | — | — | — | |
| 64 | VDD | /3V3 | C110 3.90 mm (shared with pin 1), C108 4.63 mm | supply | power | — | — | — | — | |
Count check: 50 GPIO pads (PA0–PA15 = 16, PB0–PB10 + PB12–PB15 = 15, PC0–PC15 = 16, PD2 = 1, PH0/PH1 = 2) + NRST, BOOT0, VBAT, VCAP1, VDDA, VSSA (6) + VDD ×4 + VSS ×4 = **64**. 60 pins are connected; the 4 truly unconnected spares are **PA9, PB10, PC5, PD2**.
## 2. Conflicts and flags
### 2.1 Firmware pins that are gone or change meaning on v6
| V5 item | v6 status | Replacement / action |
|---|---|---|
| `PIN_USART1_TX` PA9 + `Uart RELAY(PA10, PA9)` | PA9 unconnected (NC flag) | The **console was never on PA9**: `CON = SerialUSB` (PA11/PA12, J11) is unchanged. PA9 was the Mode-B injection path into the modem through K1 NO. On v6 that path is **PC6 USART6_TX → K1.10 (NO)**, and the MCU now also hears the modem on **PC7 USART6_RX**. USART1 stays as an **RX-only** tap on PA10 (F9P TXD2). No UART TX debug pin exists on v6 (D-12). |
| `PIN_PWR_CTRL` PA1 | GNSS rail only | Modem power is `PIN_MODEM_PWR_EN` PC10. Stack cycles must never be used for modem recovery. |
| PCF8574 P7 → SW4G1 `MODEM_RST` bodge (`PCF_MODEM_RST_BIT 0x80`, `ENABLE_MODEM_RST`) | U13.12 (P7) unconnected; no SW4G1 | Delete the bodge path; use PC11 (reset) / PC8 (PWRKEY) / PC10 (power). |
| TMP102 0x48 (`I2C_ADDR_TMP102`, `CHG_CELL_HOT/COOL` source) | **no TMP102 on v6** | Cell temperature for the governor has no on-board source. ▶ audit F-51 (Major, verified): TMP102 C99269 at 0x48 next to U6 (`tchg`) + pack-NTC tap on PC5 (`tcell`, valid with VEH5V present). |
| `PIN_ETH_INT` V4 = PB2 | PC0 on v6 (as V5) | ✓ |
| V5.6 `board_v56.h` (ECO §H): MODEM_EN PC3, MODEM_RST PC1, MODEM_LED PC2, ONSLP PC4, ASSOC PC5, RTCM_TAP PC7 | v6: PC1/PC2 = F9P inputs, **PC3 = F9P RTK_STAT output**, PC4 = NTC2 | `board_v56.h` and `board_v6.h` must never share a binary: a V5.6 build drives PC3 HIGH into the F9P's push-pull RTK_STAT. Hardware board-ID strap proposed (D-08); its PD2 pin is now claimed by E-01, so the strap pin is open (PA9 is the only spare left). |
### 2.2 v6 nets with no firmware counterpart (new for 0.7.x)
PA7 GNSS_TIMEPULSE · PC1/PC2 ANT_DETECT/ANT_SHORT_N (F9P inputs, reserve) · PC3 GNSS_RTK_STAT · PC4 NTC2 · PC6/PC7 USART6 · PC8 PWRKEY · PC9 STATUS · PC10 MODEM_PWR_EN · PC11 MODEM_RST · PC12 GNSS_RESET_N · PB9 ACC_INT1 (SC7A20 at 0x18).
### 2.3 ADC and 5 V checks
- Every analog net sits on an ADC-capable pad: BAT_SENSE PA0/IN0, 5V_SENSE PA4/IN4, IGN_SENSE PA5/IN5, NTC_TEMP PB1/IN9, NTC2 PC4/IN14. Spare ADC pad: PC5/IN15. ✅
- No 5 V signal on any pin; the two TC pins carry PA0 ≤ 2.10 V and PB5 (output). ✅
- IGN_SENSE is the only pin that can exceed VDD: it reaches 3.23 V at 28 V, and the BAT54 clamp holds it at ≈ 3.55–3.65 V above ≈ 30.3 V (0.24 mA at 36 V, 1.2 mA at 58 V into /3V3). In analog mode the FT tolerance is lost, so the clamp is what protects it. There is no negative clamp (D-06).
### 2.4 Alternate-function, timer and EXTI allocation
- **No AF conflicts.** USART2 PA2/PA3 AF7 · USART6 PC6/PC7 AF8 · USART1_RX PA10 AF7 (TX-less) · SPI2 PB13/PB14/PB15 AF5 (CS PB12 as GPIO) · I2C1 PB6/PB7 AF4 · OTG_FS PA11/PA12 AF10 · SWD PA13/PA14 AF0. Every peripheral uses one consistent AF set.
- USART1 TX cannot be recovered: its alternates are PA9 (NC), PA15 (ETH_RST) and PB6 (I2C1_SCL).
- **Timers:** fan PA6 = TIM3_CH1 and PPS PA7 = TIM3_CH2 share TIM3's time base. The fan policy is ON/OFF (GPIO, `drogheda-fan-policy`), so TIM3 is free for PPS capture. If PWM on the fan is ever restored, time-stamp the PPS on EXTI7 (DWT cycle counter) instead. PA1 soft-start uses TIM2_CH2 (free).
- **EXTI collisions** (one port per line, SYSCFG_EXTICR): **EXTI3** = PC3 RTK_STAT and PB3 CHRG_STAT; **EXTI9** = PB9 ACC_INT1 and PC9 MODEM_STATUS. Assign EXTI9 to the accelerometer (motion wake) and poll STATUS. Assign EXTI3 to RTK_STAT only if blink timing is wanted, and poll CHRG_STAT. EXTI0 (ETH_INT), EXTI7 (PPS) and EXTI8 (SER_IRQ) are unique.
### 2.5 Pins that touch the ZED-F9P (back-feed rule, lesson 0.5.5/0.5.6)
While `PIN_GNSS_PWR` is LOW: PA2 INPUT no-pull; PA10 no pull (its internal pull-up is 7–14 kΩ); PC7 no pull-up; PC12 released (open-drain); PA7/PC3 no pull-up; PC1/PC2 analog. **The hardware path U24 → /DOUT_4G → U18.26 cannot be fixed in firmware** except by keeping the modem off whenever the F9P is off (D-01, Major, absorbs C-06). ▶ audit fix (verify_2): U27 = Nexperia 74LVC1G125GV **C12518** (Ioff ±2 µA) powered from /3V3_GNSS, OE̅ = GND, 100 nF C14663; Rdfu1 → 100 k C25803. Bench check: /3V3_GNSS < 0.3 V with PA1 LOW and the modem on.
## 3. Boot and debug
| Item | v6 | Verdict |
|---|---|---|
| BOOT0 | R98 10 k → GND at 3.65 mm; SW2 to 3V3 (silk "BOOT") | ✅ |
| BOOT1 / PB2 DFU trap | PB2 only on R99 10 k → GND (2.84 mm); ETH_INT on PC0 | ✅ (memory `drogheda-einarboard-30-mcu-integration`) |
| ROM DFU needs HSE | Y3 25 MHz is supported, but crystal placement and gm margin are poor | ⚠ D-02 |
| NRST | C104 100 nF (3.26 mm, DS10314 value) · SW1 (6 mm tact, NRST on the 6.5 mm pad pair, GND on the other) · P6 RESET-EXT (JST-XH, was P10 on V5) · TP5. Reaches only the MCU. | ✅ circuit / ⚠ no ESD at P6 (G-08) |
| SWD | TP3 SWDIO (6.04 mm), TP4 SWCLK (5.43 mm), TP5 NRST, TP6 GND (17.6 mm away), TP7 3V3. No header. SWO impossible (PB3 = CHRG_STAT). | ⚠ usable with clips; D-12 |
| USB DFU | PA11/PA12 → J11 (USB-C, CC 5.1 k ×2), D14/D15/D16 PESD5V0S1BA at 3.19 / 6.74 / 6.83 mm from J11; VBUS → D13 → AMS1117 (diode-OR with SYS5V via D12, no back-feed into SYS5V) | ✅ ECO E.5 (DFU part) met |
| HSE | Y3 C14872 YXC HC-49S 25 MHz, **CL 20 pF**, −20…+70 °C, with C113/C114 15 pF → CL_eff = 7.5 + (5…10) pF stray = 12.5–17.5 pF. Pads 8.32/11.30 mm edge (10.30/14.21 mm centre) from PH0/PH1 (target ≤ 5). | ❌ D-02 (Minor, verified) |
| LSE | Y4 C32346 Epson FC-135, **CL 12.5 pF, ESR 70 kΩ**, with 12 pF caps → CL_eff ≈ 9 pF. Pads 5.54/7.91 mm. | ⚠ D-03 |
## 4. Specific signals
- **CHRG_STAT PB3 / CHRG_FAULT PB4:** LTC4040 open-drain (abs max 6 V), R57/R58 100 k to /3V3 (always-on MCU rail, so no back-feed). ✅ **PFO** (U6.20) goes only to TP2, with no pull-up and no MCU pin. **RST** (U6.11) is unconnected. **CLPROG** goes only to TP1 (D-10). ▶ audit: PFO → PB10 (A-13); CLPROG stays on TP1 (no ADC pin left once PC5 takes the pack NTC).
- **IGN_SENSE:** 22 k / (22 k ∥ 3.3 k = 2.870 k) → ratio 0.1154 (±1 % parts: 0.1134–0.1174). Pin voltage: **12 V → 1.385 V** (1.30 V with the internal pull-down the V5 firmware enables), **24 V → 2.769 V**, **28 V → 3.231 V**, **36 V → 4.154 V open-circuit, clamped to ≈ 3.55 V** (BAT54 0.24 mA). 58 V: 1.2 mA clamp current; Rig1 dissipates 0.135 W (> 0.1 W 0603 rating, transient only). ADC full scale is reached at 28.6 V. Digital thresholds (DS10314 Table 53, production-tested VIL 0.3 VDD = 0.99 V, VIH 0.7 VDD = 2.31 V): a HIGH is guaranteed only above **20.0 V**. **A 12–14.4 V ignition sits in the undefined band.** Junction check: /IGN_SENSE = {Rig1.2, Rig2.1, Rigb1.1, C9.1, D5.2 (A), U16.21}, one net in the netlist and on the PCB (6 pads, 1 connected group, 14.2 mm F.Cu). **The V5.6 junction loss is not present on v6.** ✅ ▶ audit F-02 (Blocker): the raw `/IGN_IN` runs 106.47 mm on In2 at 0.221 mm from `/VEH5V`; moving Rig1 to P1.3 makes that run the current-limited `/IGN_SENSE` (≤ 1.4 mA at 36 V, 2.5 mA at 58 V); C9 at the MCU keeps τ = 0.25 ms. D-05 changes the ratio to 0.0833 if Rigb1 = 2.2 k.
- **Modem control:** PC10 → U20 EN (R113 100 k PD); PC8 → Q20 → PWRKEY (R114 PD); PC11 → Q21 → RESET (R115 PD); PC9 ← U24 ← STATUS 1.8 V. All default OFF or released in reset/DFU. ✅
- **GNSS:** RESET_N PC12 with R105 10 k to /3V3_GNSS (open-drain drive) ✅; TIMEPULSE PA7 ✅; RTK_STAT PC3 ✅; ANT_DETECT/ANT_SHORT_N are receiver inputs with nothing to drive them (D-07).
- **Accelerometer INT1 (T11):** PB9 EXTI9, push-pull ✅.
- **NTC2:** PC4, R126 10 k/1 % + C157 100 nF (3.11 mm), P8 ✅.
- **USART6 PC6/PC7:** AF8 on both ✅. TX goes via K1 NO (Mode B only). RX goes via R106 100 Ω and is always connected.
- **ERC NC flags on U16.37/38 and U10.13/14:** cosmetic. All four pins are on their nets in the netlist (U16.37 ∈ /USART6_TX {K1.10}; U16.38 ∈ /USART6_RX {R106.2}; U10.13/14 ∈ /I2C_SCL/SDA), the PCB pads carry the same nets (IPC-356 verified) and all four nets are routed. The flags should still be deleted (D-11).
## 5. Firmware delta list — `board_v6.h` / FW 0.7.x
**Pins whose meaning changes vs V5:** PA1 (GNSS only), PA9 (gone), PA10 (RX-only tap, direct F9P), PB5 (K1 NO is now PC6), PA5 (read analog), PC1/PC2/PC3/PC4/PC6–PC12/PA7/PB9 (new), TMP102 and the PCF P7 reset (gone).
**New peripherals to initialise:** USART6 (PC7 RX, PC6 TX, 115200, AT + RTCM byte counter); USART1 RX-only on PA10; TIM3_CH2 capture or EXTI7 on PA7 (PPS); EXTI9 on PB9 and the SC7A20 at 0x18 (LIS3DH-compatible: CTRL_REG1/3, INT1_CFG/THS/DURATION); ADC channels IN5 (IGN) and IN14 (NTC2); LSE in high-drive mode (`LSEMOD`) with an LSI fallback for the RTC wake; W5500 as V5.
**Default LOW as the very first lines of `setup()`** (before any delay or USB init): PC10 MODEM_PWR_EN, PC8 PWRKEY, PC11 MODEM_RST, PA1 GNSS_PWR, PB5 BYP_CTRL, **PA15 ETH_RST** (it comes out of reset pulled HIGH by JTDI; the 4.7 k of E-02 holds it low until then), PA6 FAN, PB0 EXT_LED, and **PD2 ETH_PWR_EN** if E-01 is adopted. PA8 CHRG_EN is owned by the governor (HIGH until it decides).
**New inputs if the audit fixes are adopted:** PB10 PFO (EXTI10 falling, A-13); PC5 ADC1_IN15 pack NTC, ratio 120/220 (F-51); TMP102 at 0x48 (F-51) and optionally 0x49 (F-52); PC2 antenna-short fault from the TPS2552 (C-01).
**Leave hi-Z / analog:** PA9, PB10, PC5, PD2 (unless E-01 / A-13 / F-51 are adopted, which take PD2 / PB10 / PC5), PC1, PC2; all F9P-facing pins while the F9P is off (§2.5); PC7/PC9 while the modem is off (PC9 with pull-down).
**Open-drain:** PC12. The PC8/PC11 drivers are external FETs, so the MCU pins are push-pull.
**Sequencing:** PA1 HIGH → ≥ 4 s → PC10 HIGH → 100 ms → PC8 pulse HIGH ≥ 50 ms → wait PC9 HIGH (≈ 11.2 s) or AT `RDY` → work → AT power-off or PC8 HIGH ≥ 2.5 s → PC10 LOW → PA1 LOW. **Never** leave PC10 HIGH with PA1 LOW (D-01) unless the D-01 hardware fix is fitted. Any MCU reset power-cycles the modem (R113) and the F9P (PA1 floats), so recovery logic must assume a cold modem after every reset.
**Draft header:**
```c
// board_v6.h — EinarBoard v6 (hbox-watchdog-v6), STM32F411RET6 LQFP64
#define HBOX_BOARD_NAME "EinarBoard v6 (HBOX v6)"
#define HBOX_BOARD_MCU "STM32F411RET6 LQFP64"
#define BOARD_HSE_HZ 25000000UL
#define BOARD_LSE_HZ 32768UL
#define BOARD_SER_XTAL_HZ 3686400UL // Y2 = C2238 (3.6864 MHz; schematic value text says 1.8432 MHz)
// power / analog
#define PIN_BAT_SENSE PA0 // ADC1_IN0, /2
#define PIN_GNSS_PWR PA1 // HIGH = F9P rail on (Q5->Q1->SW_5V->U21). Was PIN_PWR_CTRL (stack)
#define PIN_PWR_CTRL PIN_GNSS_PWR
#define PIN_5V_SENSE PA4 // ADC1_IN4, /2 (VEH5V = U25 or P2)
#define PIN_IGN_SENSE PA5 // ADC1_IN5 — READ ANALOG (12 V: 1.39 V, 24 V: 2.77 V)
#define PIN_NTC PB1 // ADC1_IN9, P7 probe 1
#define PIN_NTC2 PC4 // ADC1_IN14, P8 probe 2
#define PIN_CHRG_EN PA8 // HIGH = charger OFF (R56 PD -> ON in reset)
#define PIN_CHRG_STAT PB3 // LOW = charging (OD, R57 100k)
#define PIN_CHRG_FAULT PB4 // LOW = fault / NTC pause (OD, R58 100k)
#define PIN_FAN PA6 // HIGH = fan on (TIM3_CH1 if PWM)
#define PIN_LED_C13 PC13 // active LOW
#define PIN_EXT_LED PB0 // HIGH = panel LED (P9)
// GNSS (ZED-F9P U18)
#define PIN_GNSS_TX PA2 // USART2_TX AF7 -> F9P RXD (hi-Z when F9P off!)
#define PIN_GNSS_RX PA3 // USART2_RX AF7 <- F9P TXD
#define PIN_F9P_TX2_TAP PA10 // USART1_RX AF7 <- F9P TXD2 (RX-only, no pull)
#define PIN_GNSS_PPS PA7 // TIM3_CH2 AF2 / EXTI7
#define PIN_GNSS_RTK_STAT PC3 // 0 fixed / blink corrections / 1 none
#define PIN_GNSS_RESET_N PC12 // OPEN-DRAIN only
#define PIN_GNSS_ANT_DET PC1 // F9P INPUT — keep analog/hi-Z
#define PIN_GNSS_ANT_SHORT_N PC2 // F9P INPUT — keep analog/hi-Z
// modem (A7670SA U19)
#define PIN_MODEM_TX PC6 // USART6_TX AF8 -> K1 NO -> U23 -> RXD (Mode B)
#define PIN_MODEM_RX PC7 // USART6_RX AF8 <- R106 <- U24 <- TXD
#define PIN_MODEM_PWRKEY PC8 // HIGH = key pressed (Q20)
#define PIN_MODEM_STATUS PC9 // INPUT_PULLDOWN, HIGH = modem on
#define PIN_MODEM_PWR_EN PC10 // HIGH = U20 on (R113 PD)
#define PIN_MODEM_RST PC11 // HIGH = reset asserted (Q21)
#define PIN_BYP_CTRL PB5 // HIGH = K1 energised (modem DIN <- PC6)
// I2C1 / expanders / sensors
#define PIN_I2C_SCL PB6
#define PIN_I2C_SDA PB7
#define PIN_SER_IRQ PB8 // SC16IS752 IRQ, EXTI8
#define PIN_ACC_INT1 PB9 // SC7A20 INT1, EXTI9
#define I2C_ADDR_SC7A20 0x18
#define I2C_ADDR_PCF8574 0x20
#define I2C_ADDR_SHT40 0x44
#define I2C_ADDR_SC16IS 0x4D
// Ethernet (W5500 U11, SPI2)
#define PIN_ETH_CS PB12
#define PIN_ETH_SCK PB13
#define PIN_ETH_MISO PB14
#define PIN_ETH_MOSI PB15
#define PIN_ETH_INT PC0
#define PIN_ETH_RST PA15 // JTDI pull-up at reset: drive LOW first (E-02: 4.7k PD C23162)
// spare as drawn: PA9 (USART1_TX), PB10, PC5 (ADC1_IN15), PD2
// --- only if the audit fixes are adopted (verify_1 conflict (h)) ---
// #define PIN_ETH_PWR_EN PD2 // E-01: HIGH = 3V3_ETH on (100k PD)
// #define PIN_PFO PB10 // A-13: LTC4040 PFO, LOW = backup, EXTI10 falling
// #define PIN_NTC_CELL PC5 // F-51: ADC1_IN15, /NTC * 120/220, valid with VEH5V
// #define I2C_ADDR_TMP102_CHG 0x48 // F-51: charger die area (U6/L6)
// #define I2C_ADDR_TMP102_MODEM 0x49 // F-52 option
// PA9 stays spare (D-12 test pad); board-ID strap (D-08) pin unresolved
```