Leopoldo Rodríguez d70dd806be T43: documentos vivos de V5.6/V5.7/v6 en los designadores nuevos; aviso en los fechados (V5.5/V4/V3 sin cambios)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QCy5VHMVLkAmftYM6swWmx

2026-10-22 21:04:59 -06:00

38 KiB

Raw Blame History

title

EinarBoard v6 — Design Brief ("the prompt")

!!! warning "Designators from before 22-Oct (T43)" This document keeps the designators the board had on its date. Since 22-Oct (T43) the V5.6, V5.7 and v6 carry new ones, and several old names now belong to another part: on the v6, U6 is now the A7670SA modem (was U19) and the LTC4040 is U17 (was U6). To read it against today's board, use the old → new table (in Spanish); parts already gone by 22-Oct are not in it.

What this is. The instruction set for turning hbox-watchdog-v5 (EinarBoard 3.0 / v5.5, 15 pcs in fab since 22-Ago) into EinarBoard v6 — the first HBOX board with the GNSS receiver and the 4G modem soldered on, retiring the simpleRTK2B Pro shield (MOD1) and the XBee-socket 4G NTRIP Master (J7/J8).

Standing rules unchanged: file-level KiCad edits only; git checkpoint after every phase; every structural edit verified by an independent parse; bench gates before fab.

0. Decisions locked 2026-08-24 (Leo)

Topic	Decision
Scope	Full integration — GNSS + 4G both on-board; MOD1 and J7/J8 deleted
Board outline	Keep 140.000 × 100.000 mm (x ∈ [60.19, 200.19], y ∈ [40.32, 140.32]) — no enclosure rework
SIM	MFF2 soldered SIM (DFN 5×6). No tray, no spring contacts, no opening a sealed IP67 box in Veracruz
GNSS receiver	🔒 LOCKED — ZED-F9P-04B, LCSC `C5120257` (Leo, 24-Ago). Rationale §1. LG290P stays as the documented v7 cost-down
4G module	🔒 LOCKED — SIMCom A7670SA-LASC, LCSC `C18548276` (Leo, 24-Ago). LTE Cat-1 + 2G GSM fallback; 3G answered in §2.3
Inherited	The entire v5.5 EMC fix list is day-one scope, not a wish list (§7)

Still open — need Leo: antenna interface (§4.4), modem VBAT source sign-off (§3.2), homologación path (§9.4), and gate T1 (§2.4) — which does not block the schematic, only the decision to stay on the A7670SA if the cabinet runs hot.

1. GNSS receiver — "cheapest" vs "best value" are not the same part

1.1 The hard constraint that eliminates the truly cheap tier

Your base is the Ardusimple AS-PRO-CORS = ZED-F9P = L1/L2, and Mexican public CORS (INEGI RGNA) are overwhelmingly GPS L1/L2 + GLONASS. RTK requires the rover to track the same frequencies the base broadcasts.

That disqualifies the entire cheap L1/L5 tier: Quectel LC29H (all variants, $22–33), ZED-F9P-15B, NEO-F9P, LG69T. They are L1 + L5, no L2. Fed from an L1/L2 base they degrade to effectively single-frequency — you would be paying for RTK silicon and getting float. Do not let the $22 LC29H price tempt anyone: it is the right part for a product where you also own the base, and the wrong part for a fleet you diagnose remotely from Querétaro.

Also permanently out: ATGM332D / ATGM336H / AT6668 ($1.44–4.75, huge LCSC stock) — single-band L1, no carrier-phase RTK at all.

1.2 The three that survive

	ZED-F9P-04B	LG290P03AAMD	UM980
Vendor	u-blox (CH)	Quectel (CN)	Unicore (CN)
Bands	L1/L2	L1/L2/L5/E6	all incl. E6/B2b
RTK rate / convergence	7–24 Hz / <12 s	20 Hz / 5 s	50 Hz / <5 s
Package	54-LGA 22×17×2.4	12.2×16×2.6	54-LGA 22×17×2.6
Supply / current	2.7–3.6 V, 85 mA trk (130 pk)	3.15–3.45 V, 91 mA	3.0–3.6 V, 145–180 mA / 480 mW
Internal LNA	No — active antenna mandatory	ambiguous (see §1.5)	No
USB	Yes	No	No
qty 1	$84.82 LCSC (C5120257) / $131.74 Mouser	$79.89	~$94.88
qty 100	$116.56 Mouser	$59.54	~$80.65
JLCPCB	C5120257, Extended, 104–129 stk	not listed — consign	C9900015354, Extended

1.3 The money, honestly

Volume	ZED-F9P (LCSC)	LG290P	Saving by switching
30 units	$2,545	~$2,100	~$450
100 units	$8,482 (if stock holds)	$5,954	~$2,500
300 units	~$34,968 (Mouser $116.56)	$17,862	~$17,100

Against that saving, switching away from u-blox costs you, once:

The entire config toolchain. u-center, UBX-CFG-VALSET, your saved receiver configs, your RAM-vs-BBR/Flash lesson from the June RCA — all of it is u-blox-specific. LG290P configures with $PQTM… sentences.
The backend decoder. htracker already ingests $PUBX,00 (retranslator +138, delivered 10-Ago). LG290P does not emit PUBX. That's a protocol change on the server too.
A fresh RTCM-compatibility unknown, in a program whose actual June root cause (free rtk2go caster, RAM-only config, unverified UART2 path) is still not fully closed.

Read: at 30 units the saving is $450 — less than a week of firmware and backend work. At 300 units it is $17k — real money.

1.4 🔒 DECIDED 24-Ago — ZED-F9P-04B

v6 = ZED-F9P-04B, sourced from LCSC (C5120257) at $84.82. It is $32/unit cheaper than Mouser with zero engineering change, it is the receiver your base station is paired to, and it keeps u-center as your field-diagnosis tool while you are simultaneously taking on an RF front end, a cellular radio, and an NTRIP client you've never shipped. One new unknown at a time.

Documented cost-down for the 300-unit phase = LG290P. Scope it as a bounded respin of the GNSS island only (§5 puts the receiver in its own corner precisely so this stays cheap), plus the firmware/backend work, and pull the trigger when volume pays for it.

⚠ Sourcing caveat that applies either way: LCSC shows ~104–129 pcs of ZED-F9P-04B. A 100-unit run eats the entire bin. Mouser has 573 + 834 arriving, 18-week factory line. For a 30–100 unit run, buy the receivers yourself and consign them to JLCPCB — you control the most expensive, longest-lead line item instead of being hostage to an LCSC bin.

(If you want the LG290P now anyway, say so and I'll re-baseline §5/§6 — but then Phase 1 in §10 grows a receiver-bring-up spike and the backend decoder becomes v6 scope.)

1.5 Open verification if LG290P is ever chosen

Its datasheet says "external active antenna"; Mouser's part description says "w/ LNA (KT5030)". These cannot both drive the RF section. Resolve against the LG290P Hardware Design doc before laying out one millimetre of RF.

2. 4G modem

2.1 Bands decide the variant before anything else

Telcel = B4 (bulk) + B7 + B66. AT&T MX = B2/B4/B5/B7. Altán "Red Compartida" = B28 (700 MHz — the best-propagating band in the country). Movistar rides AT&T's RAN.

→ You need B2/B4/B5/B7/B28/B66. That is exactly the -SA (SIMCom), -LA (Quectel EG915x) and -AU (Quectel EC200x) suffixes. Any -EU / -E / -CN / -C part is useless here — no B4, no B66. This is the single most common way this decision goes wrong.

2.2 🔒 DECIDED 24-Ago — SIMCom A7670SA-LASC

SIMCom A7670SA-LASC — LCSC C18548276, $7.58 @1, $7.39 @10, ~$6.3–6.9 @1k, 220 in stock, already in the JLCPCB parts library (Extended, X-ray inspection required, MSL3).

Why it wins on your criteria:

Cheapest thing that is actually assemblable at JLCPCB. The only real alternative in the JLC library is Quectel EG915U-LA (C19185632) at ~$9–13.
Correct LatAm bands: LTE-FDD B1/2/3/4/5/7/8/28/66, plus GSM 900/1800.
Single antenna. Cat-1bis-class: one RF_ANT pin, no RX-diversity port. One less 50 Ω path, one less antenna, one less thing to get wrong. (This is also why Cat-4 is the wrong choice — EC200A/SIM7600 add a second antenna port, a 29×32 mm footprint and 2–4× the price for throughput you will never use on a 50–200 MB/month NTRIP + NMEA stream.)
Public docs, no NDA, and the A76xx AT set is SIM7600-compatible → TinyGSM works, which is what makes the §2.5 firmware estimate credible.
Feature-variant upgrade path with no respin: -LASC (bare) → -LASE (+BLE) → -FASE (+GNSS +BLE) are the same 88-LGA footprint.

Not interchangeable, do not confuse: A7670 = 88-LGA · A7672 = 124 hybrid LCC+LGA · SIM7070 = 68-LCC. All 24×24 mm, all different footprints. Migration = respin.

2.3 On your 3G question — the honest answer

3G is not the lever you want, and it is on its way out. Mexico's 2G/3G shutdown is still under negotiation rather than executed (operators were still discussing it in July 2026 — millions of handsets block it), so 3G exists today. But designing a 2026 board with a 5–10 year fleet life around a network the regulator and all three carriers are actively trying to switch off is buying a fallback with an expiry date.

What actually fixes poor coverage, in order of effect:

Band coverage at low frequency. B28 (700 MHz) and B5 (850 MHz) penetrate buildings and container stacks far better than B4/B66 (1700/2100 MHz). The A7670SA has all of them.
Cat-1bis link budget. A narrower, lower-order category has a better link budget than Cat-4 at the cell edge. The cheap choice is also the more robust one here.
A proper external antenna on a bulkhead SMA, not a chip antenna inside a metal-adjacent cabinet. §4.4.
2G/GSM fallback — which the A7670SA already has (GSM 900/1800). At 20–40 kbps GPRS you will not hold RTCM at full rate, but you keep telemetry and remote command alive, which is what "never vanish" (invariant #2) actually requires.

If you still want WCDMA/3G, the cheap route is SIM7600SA-H (Cat-4 + WCDMA + GSM, LatAm bands) at ~$25–40 — but you pay ~4× the module cost, a second antenna port, a 29×32 mm footprint, and more heat, for a network that is being switched off. My recommendation is no. Take the A7670SA's 2G fallback and spend the difference on the antenna.

2.4 Temperature — the one place I'd push back on "cheapest"

Your own RCA names the 4G modem as a heat casualty in the nested cabinet under Veracruz sun.

Part	Operating range
SIMCom A7670SA	−30…+80 °C (−40…+85 degraded)
Quectel EG915U-LA	−35…+75 °C (−40…+85 extended)
Telit LE910C1-LA (~$48)	−40…+85 °C full
u-blox LARA-R6001 (~$43–55)	−40…+85 °C full

🔴 GATE T1 — cabinet temperature. YOU ALREADY HAVE THIS DATA. DO NOT INSTRUMENT ANYTHING.

Fielded V3 units already report P12 = 10 k NTC → PB1 → tntc ("Cámara" = cabinet interior) and P5 = SHT40 → tair, inside $PHLG every 30 s, and the htracker retranslator has been ingesting $PHLG in production since 10-Ago. Query the existing telemetry history for the max tntc per unit over the hottest days.

That query — free, today, no hardware, no truck roll — settles the single largest cost decision in v6: an $8 A7670SA versus a $48 Telit LE910C1-LA. Across 300 units that is a $12,000 decision sitting in a database you already own.

Decision rule: max tntc < 70 °C → A7670SA. 70–75 °C → A7670SA plus the M2.5 heatsink clamp (§5) and re-measure on the first article. > 75 °C → escalate the tier; you already know what a modem failure costs at ICAVE.

2.5 What the modem costs you in firmware

Neither the A7670SA nor any Quectel module has a built-in NTRIP client. That was the Ardusimple 4G NTRIP Master's entire value, and you are giving it up. You implement NTRIP v1 yourself: GET /MOUNTPOINT HTTP/1.0 + Authorization: Basic …, then read raw RTCM3 off a transparent TCP socket and shovel it into the receiver.

Realistic budget: 1–2 weeks, not 1 day — the AT/socket layer is a day; reconnect/backoff logic, watchdog integration, TLS-on/TLS-off caster handling, signal-quality telemetry into $PHLG, and field failure modes are the rest.

✅ This risk can be retired for free, right now. See §10 Phase 1: the XBee socket on the v5.5 boards currently in fab will host an A7670SA breakout. You can prove the entire NTRIP-in-STM32 stack on hardware you already paid for, while the boards are in transit, before a single v6 trace exists.

3. Power architecture — the biggest new electrical work

3.1 What the modem demands

Parameter	A7670SA	Consequence
VBAT	3.4–4.2 V (typ 3.8)	Not the 3V3 rail. Ever.
Peak current	2.8 A (GSM TX burst)
Droop limit	≤300 mV at the burst
Bulk	≥300 µF if the source truly delivers 2.8 A; ≥1000 µF if not
VBAT trace	≥3 mm wide or equivalent pour
VBAT pins	All three (55/56/57) must be connected	RF performance depends on it
I/O rail	1.8 V	Level shifting to the 3.3 V STM32 is mandatory
VDD_1V8	output, 50 mA max	level-shift reference only, not a system rail

3.2 🔴 The 10-Ago fleet boot-loop makes this decision for us

Read the 10/11-Ago incident before designing this rail. Root cause on record: a flat 12 Ah pack demanding 2.42 A plus the LTE attach burst exceeded the SD-15B-05's 3 A, while the LTC4040 input limit (3.12 A) is set ABOVE the supply's rating → rail sagged to the PFI 4.60 V trip → failover to a flat pack → brownout → reboot → loop. The modem stayed "invisible" because it never finished its 30–60 s LTE attach inside the loop. Standing HW errata: "input-limit resistor must come DOWN below PSU rating (or bigger PSU)."

v6 adds ~1.6 A of on-board modem to that same 5 V rail. Naively bucking 3.8 V off MAIN5V would aim the new radio straight at the failure mode that already took the fleet down.

	(a) Direct from the 1S pack	(b) Buck from MAIN5V	(c) Buck from OR(24V_IN, MAIN5V) ← recommended
Load on the SD-15B 3 A budget, normal op	none	🔴 +1.6 A — the 10-Ago failure mode	none — runs off 24 V
Alive during blackout	✔	✔	✔ (falls back to MAIN5V ← pack ← LTC4040)
Bench without a pack	✘	✔	✔
Under-voltage risk	🔴 pack sags below the 3.4 V modem floor	✔	✔
Couples TX bursts onto	🔴 the LTC4040 BAT node — flagged 🔴 in the EMC audit	the 5 V rail	24 V (normal) / 5 V (blackout only)

Recommendation (c) — one buck, two inputs. A 4.5–40 V input, 3 A synchronous buck (e.g. MP4560 / AP64350 / TPS54331 class — not a fourth MP1584, which is already the source of EMC findings 3 and 4) whose input is an ideal-diode / PMOS OR of 24V_IN and MAIN5V, output 3.8 V, feeding the modem through a P-FET load switch under MCU control (MODEM_PWR_EN).

Why this is the robust and cheap answer, for roughly $1.50 more than option (b):

With the cabinet live, the modem's ~9.5 W comes off 24 V at ~0.45 A — the SD-15B never sees it, and the 10-Ago brownout path is structurally removed rather than merely re-tuned.
In blackout the same buck accepts MAIN5V and the radio keeps reporting — invariant #2 holds.
One converter, one inductor, one BOM line. D10 (SMBJ33A) already clamps the 24 V input.
MODEM_PWR_EN gives the watchdog authority to hard power-cycle a wedged radio — invariant #3.

⚠ Still fix the input-limit errata. Even with the modem off the 5 V rail, the LTC4040's input limit must come below the PSU rating (or the PSU must grow). v6 is the board where that gets corrected, not deferred again.

⚠ And this makes the v5.5 🔴 EMC findings load-bearing. In blackout MAIN5V does feed the modem, so the LTC4040 boost hits the ~4 A /SW_BAT case the EMC audit flagged. /SW_BAT ≥2 mm polygon and /BAT_PLUS ≥1.5 mm + via farm are v6 hard requirements, not second-run nice-to-haves.

3.3 GNSS rail — low-noise, non-negotiable

The F9P and UM980 have no internal SAW. This board carries three MP1584 switchers. They will happily lock onto your buck's harmonics.

→ Dedicated low-noise LDO off 3V3 for the GNSS island (not a buck, not a shared tap), placed on the GNSS island itself. Verify the ZED-F9P VCC ramp rate ≤ 20 µs/V — that is a damage limit, not a guideline; check it against the LDO's soft-start.

3.4 Budget delta (worst case, backup mode)

Load	Was (v5.5)	v6
4G	via 3V3_MODEM to XBee socket, ~1.5 A pk @3.3 V	2.0 A pk @3.8 V ≈ 7.6 W → ~1.6 A from MAIN5V
GNSS	via MOD1 shield off 5 V	85–130 mA @3.3 V (F9P)
Everything else	unchanged	unchanged

Recompute the LTC4040 backup runtime against the 1S4P ~12 Ah pack once (b) is locked.

4. RF — the part that decides the stackup before anything is placed

4.1 Stackup

Current topology is already correct and stays: F.Cu signal+GND pour · In1 solid GND · In2 3V3 plane · B.Cu signal+GND pour.

New requirement: order the board as controlled impedance (JLCPCB 4-layer, JLC04161H-7628; F.Cu→In1 prepreg ≈ 0.2104 mm). Target 50 Ω CPWG on F.Cu referenced to In1 — roughly 0.35 mm trace / 0.25 mm gap at εr ≈ 4.4, to be confirmed against JLCPCB's own impedance calculator before layout, not after.

Absolute rules for both RF traces:

Referenced to the In1 GND plane with no split, ever — no plane cut, no via field gap, no In2 3V3 island underneath.
As short and straight as possible; ground-stitched along both sides at ≤ λ/20.
No other signal crosses them on any layer.

4.2 GNSS RF chain

Active antenna (mandatory for F9P/UM980) → bias tee: ≥68 nH 0603 inductor (self-resonance above 1.6 GHz) + DC block on the RF path + 100 nF ∥ 100 pF on the bias node + **ESD diode rated

2 GHz** at the connector.

Wire ANT_DETECT and ANT_SHORT_N to the MCU (or a spare PCF8574 pin). Free antenna-fault telemetry — and you have already lost two units (H0005, H0014) to 0-sats antenna faults you could only diagnose by reading logs.

⚠ Do not use VCC_RF as the antenna bias on UM980 — Unicore explicitly says its protection is inadequate. Feed the antenna from a separate current-limited rail.

4.3 🔴 The #1 technical risk in this whole change: GNSS desense

A 23 dBm LTE transmitter drawing 2–3 A bursts, 3 cm from a GNSS front end, is a classic RTK-killer — LNA compression and broadband noise will cost you exactly the fix you are paying for. The Ardusimple shield has been hiding this problem from you. A bare module hands it to you.

Mitigations, in order of effect:

Maximum board separation — §5 puts GNSS in the bottom-left corner and LTE at the right edge: ~149 mm apart, essentially the full board diagonal. This is the whole reason the floorplan is shaped the way it is.
Antenna separation ≥ 20 cm on the enclosure. Treat this as a design rule, not an optimization. Two separate bulkheads, as far apart as the cabinet allows.
Route the modem's return path away from the GNSS island; no shared reference between the two RF regions except the solid In1 plane.
Front-end filtering. Straightforward for an L1-only receiver; for a multi-band receiver a single 1575 SAW would kill L2/L5, so rely on an active antenna with good out-of-band rejection + separation. Specify the antenna accordingly.
Measure it. Gate G3 in §10: fix quality with the modem idle vs. transmitting at full power. This is a pass/fail bench test, not an opinion.

4.4 Antenna interface — OPEN, needs Leo

Recommendation: 2× U.FL on board → pigtails → 2× SMA bulkhead on the enclosure, placed as far apart as the cabinet allows. This is what makes mitigation #2 possible; an on-board or short-pigtail arrangement forfeits it.

Needs from you: does the current enclosure have room for a second bulkhead, and where? That answer changes where the U.FL connectors sit, which changes the floorplan.

4.5 LTE link budget — the module is not the variable

Every LTE module here transmits at the same power. 3GPP Power Class 3 is +23 dBm ±2 dB, and it is a conformance requirement, not a feature — the $8 A7670SA and the $48 Telit put out the same watt. Receive sensitivity is likewise floored by 3GPP; premium parts buy perhaps 1–3 dB of margin, not a different class of performance.

What actually sets the link budget on this product, in descending order of effect:

Factor	Typical swing	Notes
Antenna type and placement	10–20 dB	An antenna inside or flush against a metal cabinet on a metal crane is the whole ballgame
Band in use	6–10 dB	B28 (700 MHz) and B5 (850 MHz) penetrate structure far better than B4/B66 at 1700/2100 MHz. The A7670SA has all of them
Cable / pigtail loss	1–3 dB	Keep the LTE pigtail short; every extra 300 mm of thin coax at 1.9 GHz is real
Cat-1bis vs Cat-4	1–2 dB in our favour	Lower-order category = better cell-edge behaviour. The cheap choice is also the more robust one
Module vendor	1–3 dB	The only line the extra $40 buys

You already have the field measurement. The $GPTXT,NET,H00xx,TELCEL,-87,334 020 line the fleet emits carries the modem's RSSI in dBm and the operator's MCC/MNC (334/020 = Telcel MX). The example on record shows −87 dBm, which is a comfortable working level. Query the fleet for the per-unit distribution over the last month, the same way as gate T1. If the worst unit sits near −105 dBm you have an antenna/siting problem to solve — and no module in this survey would have solved it. Phase 1 also adds csq to $PHLG (field 30), which makes this permanently visible instead of a one-off query.

Conclusion: spend on the antenna and its mounting, not on the modem. A better bulkhead antenna, a shorter pigtail and a clear mount are worth 10 dB; a more expensive module is worth 2.

4.6 🔴 GNSS multipath — the environment problem, and what actually fixes it

A container terminal is close to a worst case: stacked steel boxes, RTG and STS cranes, reach stackers, all of it moving. Multipath is a receiver-and-antenna problem. No modem choice affects it, and no cabling change fixes it.

First, make sure it is actually the diagnosis. As of 10-Ago the fleet showed zero corrections applied anywhere — that produces SPS, full stop, and it looks nothing like multipath. Multipath presents as float-instead-of-fixed, or a fix that wanders, and it can only be diagnosed after RTCM is confirmed arriving. Phase 1's new telemetry separates the two for the first time:

`rtcm_msgs`	fix quality	Diagnosis
0 / not rising	1 (SPS)	link or caster — not multipath
rising	1 (SPS)	receiver config, or base/rover band mismatch
rising	5 (float), never 4	multipath / sky obstruction — this is the real thing
rising	4 but `hAcc` noisy	multipath, partially mitigated

Mitigations, cheapest and most effective first:

A ground plane under the patch antenna. A metal disc ≥ 100 mm diameter beneath a patch kills ground-bounce and is the single best return per peso in this list. Often free.
Mount height and clear sky. Highest point of the machine, away from vertical steel. On an RTG that is the top of the gantry, not the cabinet lid.
A better antenna. A multiband antenna with good axial ratio and suppressed gain at low elevation rejects reflections that arrive from below the horizon. Budget US$60–120 — still cheaper than a receiver upgrade and more effective for this failure mode.
Raise the elevation mask in the receiver (10–15°, CFG-NAVSPG-INFIL_MINELEV) to discard low-elevation reflected signals, and set the correct dynamic model for the machine.
Keep L2. Dual-frequency is materially better at ambiguity resolution under multipath — another reason the L1/L5-only cheap tier was the wrong answer (§1.1).
Log C/N₀ per satellite at a problem site. A healthy sky and a reflective sky look completely different, and it turns an argument into a measurement.

If — after 1–6 — multipath is still the binding constraint, then and only then does silicon help, and the honest options are: ZED-X20P (+$31/unit, same 54-LGA 22×17 footprint, so Block N accepts it with a pin-map check, plus better interference mitigation and 55 mA instead of 85 mA) or Septentrio mosaic-X5 (genuinely best-in-class multipath rejection, but 3–5× the F9P and no LCSC/JLC presence). Do not buy either on suspicion — buy it on a C/N₀ log.

5. Floorplan on 140 × 100 — proposed

Verified from hbox-watchdog-v5.kicad_pcb (228 footprints, board x ∈ [60.19, 200.19], y ∈ [40.32, 140.32]).

Freed by deletion:

Deleted	Ref	Position	Area recovered
simpleRTK2B Pro UNO socket	MOD1 (32 pads)	(90.6, 129.9)	bottom-left, ~68 × 53 mm
XBee sockets, 2.0 mm	J7, J8 (10 pads each)	(174.2, 74.8) / (196.5, 74.8)	right edge, ~27 × 20 mm
Shield / heatsink bolts	MH7, MH9, MH10, MH11	various	reclaim as GND stitching (the EMC audit found 8 empty 20 mm stitching cells, mostly under MOD1)

Proposed placement:

  x=60 ┌────────────────────────────────────────────────────┐ x=200
  y=40 │  [J10 RJ45]  connector row: P5 P10 P2 P11 P6 P8 P12 P4  │
       │                                                    │
       │  [U11 W5500]      [U16 STM32F411]     [U2/L2 fan]  │
  y=70 │  [SW1 SW2 J11]    Y3 Y4  [U10 SC16IS]   ┌──────────┤
       │                          [U14][U15]     │ ★ LTE    │ ← freed XBee area
       │                          [U13 PCF8574]  │  U19 A7670SA
  y=100│                                         │  MFF2 SIM │
       │  ┌──────────────────┐   [U7]  [U6 LTC4040+L6]  │ 3.8V buck
       │  │ ★ GNSS ISLAND    │   [U12]              [P14]│
  y=140│  │ U18 + LDO + bias │  [P15][P16]  [J9]  [P1]   │
       └──┴──[U.FL GNSS]─────┴───────────────────[U.FL LTE]┘

GNSS island → the freed MOD1 area, bottom-left corner. It is the furthest point on this board from all four switchers (nearest: U7 at 140.0, 112.9 — ~60 mm; L6/U6 LTC4040 at ~173, 110 — ~95 mm), and it puts the U.FL at a board edge. The island holds only the receiver, its LDO, its decoupling and its bias tee — nothing else, so a future LG290P swap (§1.4) is a contained respin.
LTE island → the freed XBee area at the right edge, next to the existing power cluster where the current already lives. The 27 × 20 mm freed is too tight for a 24 × 24 module + ≥300 µF bulk + buck + MFF2 — reclaim adjacent area by relocating P14 (RGB_LED_EXT, at 195.1, 101.4) and shifting the U2/L2 fan buck north. Budget ~35 × 30 mm.
Resulting GNSS ↔ LTE separation ≈ 149 mm — the full diagonal. That is the point.
Keep 2× M2.5 holes near the modem for a heatsink clamp (§2.4).

6. Signal & connectivity delta

6.1 The good news: the MCU side barely changes

These nets already exist in hbox-watchdog-v5.kicad_sch and simply terminate on solder-down silicon instead of a socket:

GNSS_RX · GNSS_TX · DIN_4G · DOUT_4G · MODEM_RST · MODEM_LED · 3V3_MODEM

No MCU pin reallocation is required for the basic paths. USART1/2/6 are all on the F411RET6; RS-485/RS-232 stay on the SC16IS752 over SPI.

6.2 New signals needed

Signal	Where it goes	Note
`MODEM_PWRKEY`	spare PCF8574 (U13) pin	⚠ timing is vendor-specific: SIMCom = low ≥50 ms to power on, ≥2.5 s to power off. Quectel = low ≥2 s on, ≥3 s off. Never copy timing between vendors.
`MODEM_STATUS`	spare PCF8574 pin	asserts ≈11.2 s after power-on (A7670); UART ready ≈8 s
`MODEM_PWR_EN`	GPIO → P-FET load switch	the hard power-cycle path (§3.2)
`GNSS_RESET_N`	GPIO	F9P needs a 7–13 kΩ pull-up
`GNSS_ANT_DETECT`, `GNSS_ANT_SHORT_N`	PCF8574	free antenna-fault telemetry (§4.2)
`GNSS_TIMEPULSE`	GPIO / timer input	optional but nearly free
RTCM path	modem UART → GNSS UART2, direct in hardware	this is what the Ardusimple shield did internally; replicate it. MCU does the NTRIP handshake, then the RTCM3 stream flows without touching the MCU — exactly the Modo B architecture already engineered

Action: confirm free PCF8574 pins against the v5 netlist before Phase 2. F0_SEL, F1_SEL, F2_SEL, EXT_LED, MODEM_LED, CHRG_STAT, CHRG_FAULT are already on it.

6.3 Level shifting — mandatory, do not skip

Modem UART is 1.8 V; the STM32 is 3.3 V. Use TXS0108E (what Quectel recommends) or the discrete MMBT3904 network SIMCom documents. This is not a "3.3 V is close enough" situation.

6.4 MFF2 SIM

DFN 5×6, on the LTE island, close to the modem.
ESD array at the SIM lines (ESDA6V1W5 / SMF15C class).
A7670SA has an internal 4.7 kΩ pull-up on USIM1_DATA; USIM2_DATA would need an external one — you only need SIM1.
1.8 V and 3.0 V auto-detect, no strapping needed.
⚠ Sourcing: you need an actual MFF2 SIM from Telcel/AT&T MX or an M2M MVNO with a Mexican profile. Flat-rate IoT SIMs sized for sensors (500 MB / 10 years) are an order of magnitude too small for 50–200 MB/month. Start this conversation early — it has a lead time and it is not an engineering task.

6.5 USB

J9 (USB-C) is kept and becomes the modem's USB — recovery path if a firmware update bricks it, plus PPP/RNDIS debugging. Reserve VBUS/D+/D−/GND and a USB_BOOT test point; USB_BOOT must not be pulled low at power-up. Add the ESD array that v5.5 does not have (<2 pF on the data lines). 90 Ω differential.

7. Inherited EMC fix list — v6 hard scope

Straight from 2026-08-22_…EMC-Audit_v1.0.md. None of these is optional in v6:

#	Fix	v6 status
🔴 1	`/SW_BAT` → ≥2 mm polygon (was 0.3 mm × 15 mm carrying ~4 A)	Now load-bearing — the modem adds ~1.6 A to MAIN5V in backup (§3.2)
🔴 2	`/BAT_PLUS` final approach → ≥1.5 mm + via farm	same reason
🟠 3	Fan buck FB: R20/R21 at pin 4, `/FB_FAN` short and away from `/SW_FAN`	mandatory
🟠 4	1 µF + 10 µF within 3 mm of every buck VIN-GND (was 5–8.5 mm)	mandatory — and applies to the new 3.8 V buck
🟠 5	ESD at every external connector, <10 mm (D14/D15/D16 were 41 mm from J11)	mandatory + J9 now gets ESD it never had
🟡 6	Crystals 3225 package, <5 mm from their ICs (Y1/Y3/Y4 are 12–15 mm away in HC-49)	do it
🟡 7	ETH RX pair coupled and length-matched (Δ7.5 mm today)	do it
🟡 8	Fill the 8 empty 20 mm stitching cells	free — they were mostly under MOD1, which is being deleted

8. BOM & cost delta

Removed per unit: Ardusimple 4G NTRIP Master (€112 @≥50 ≈ $121) + Ardusimple simpleRTK2B Pro shield (price to verify) + MOD1 headers + J7/J8 XBee sockets.

Added per unit (indicative):

Item	Cost
ZED-F9P-04B (LCSC C5120257)	$84.82
A7670SA-LASC (LCSC C18548276)	$7.58
MFF2 SIM	carrier-dependent
3.8 V/3 A buck + inductor + ≥300 µF bulk	~$2.50
Low-noise LDO + GNSS decoupling	~$0.80
TXS0108E level shifter	~$0.50
2× U.FL + 2 pigtails + 2 SMA bulkheads	~$6
RF passives, bias tee, ESD arrays	~$2
Controlled-impedance fab option	per-order, small
Subtotal added	~$104 + SIM

The headline: the 4G side alone saves ~$113/unit ($121 Ardusimple → $7.58 module). Add the simpleRTK2B Pro's margin over a bare F9P on top. At 30 units that is meaningful; at 300 it is the difference between a viable and a non-viable unit price.

⚠ JLCPCB notes: both modules are Extended ($3 one-time setup each), both flagged X-ray inspection required, both Standard PCBA tier only — no Economic assembly. A7670SA is MSL3 (168 h floor life ≤30 °C/60 %RH) — matters for JLC and for your own rework.

9. Risk register

#	Risk	Severity	Mitigation
R1	GNSS desense from LTE TX — you buy RTK silicon and get float	🔴	§4.3: 149 mm board separation, ≥20 cm antenna separation, measured at gate G3
R2	Modem thermal — cheap tier is −30…+80 °C, cabinet may exceed it	🔴	Gate T1 (§2.4): soak a fielded unit now. Escalate to Telit/u-blox if >75 °C
R3	NTRIP client in STM32 — new firmware on the critical path	🟠	Phase 1: prove it on v5.5's XBee socket while the boards are in fab
R4	Homologación — the host now contains a radio (§9.4)	🟠	Start the lab conversation in Phase 0; it is calendar time, not engineering time
R5	Pack sag below the 3.4 V modem floor	🟠	Resolved by §3.2 option (b); if (a) is ever chosen, add UV inhibit
R6	v5.5 EMC findings carried forward	🟠	§7 — day-one scope
R7	F9P LCSC stock (~104–129 pcs)	🟡	Consign from Mouser for anything ≥100 units
R8	First RF design in this program	🟡	Controlled impedance ordered, In1 unbroken, external review of the RF section before fab

9.4 Homologación — start this early

The regulator changed: IFT was dissolved 17 Oct 2025 and replaced by the Comisión Reguladora de Telecomunicaciones (CRT) from 21 Oct 2025. Existing IFT certificates remain valid and labels still carry the IFT number; procedures continue under the same technical norms.

The certificate is issued to your product (applicant + brand + model + year), not to the module. Modular relief exists in practice — the host is labelled "Este producto contiene el módulo aprobado modelo XXXX, IFT No. …" — but there is no blanket exemption. Applicable: IFT-008 (cellular) and NOM-208 / NOM-221. Testing in an accredited Mexican lab or a US MRA-recognized lab, ~3–5 weeks.

Two consequences that bite:

Freeze on one module before you file. Switching modules later = new or amended certificate.
Sources disagree on whether the certificate holder must be the importer. Get this pinned down by the lab, in writing, in Phase 0.

None of the cheap LatAm modules advertises an IFT/CRT certificate. Do not assume one exists because the datasheet says "Latin America." A7670SA does carry FCC + Anatel, which shortens the RF test scope without eliminating the filing.

Treat it as one fixed cost amortized over hundreds of units — which is an argument for the cheap module, not against it.

10. Phases & gates

Phase	Work	Gate
−1 — 🔴 before any of this	Fix the base / caster. 10-Ago fleet truth: zero corrections applied anywhere → check `HelgenTestStation` @ rtk2go:2101. No silicon in this brief produces RTK if the correction source is broken. v6 would ship five units of new hardware into the same SPS-not-RTK result	G0: at least one fielded unit holding GGA quality 4/5 for 1 h on the existing hardware
0 — now, parallel	Run the T1 telemetry query (§2.4) — it is free and it decides the modem tier · lock §1.4 GNSS · lock §3.2 rail · answer §4.4 antenna · call a homologación lab · order A7670SA breakout + M2M SIM (~$40 total)	Decisions in this doc, v1.1
1 — while v5.5 is in fab	NTRIP-in-STM32 spike on a v5.5 board via the XBee socket + A7670SA breakout: AT driver, TCP, NTRIP v1 GET, RTCM3 → GNSS UART2, reconnect/backoff, `$PHLG` signal telemetry	G1: 24 h continuous RTK fix through the on-board modem path, ≥1 reconnect survived
2 — schematic	New blocks (GNSS island, LTE island, 3.8 V rail, MFF2, level shift, RF chains) + all of §7	G2: ERC 0 + external review of the RF and power sections
3 — stackup & floorplan	Confirm 50 Ω geometry against JLCPCB's calculator · place per §5 · verify GNSS↔LTE separation · confirm the enclosure takes a second bulkhead	G3 (design): RF traces referenced to unbroken In1, no exceptions
4 — route	RF first, then power (wide from day one), then signal · zones · DRC	DRC 0 · independent netlist parse
5 — DFM	BOM/CPL, LCSC pass, consignment plan, controlled-impedance order option	fab release
6 — first article	Bring-up, DFU, then G3 measured: fix quality with modem idle vs. TX at full power	G3 (bench): no measurable degradation in fix quality or C/N₀ under LTE TX

Phase 1 is the whole trick. It converts the largest unknown in v6 — firmware you have never shipped talking to a radio you have never soldered — into a bench result you obtain on hardware already paid for, weeks before committing a layout.

11. What I'd argue for, in one paragraph

Take the A7670SA — it is the cheapest part that is simultaneously band-correct, JLC-assemblable, 2G-capable and well-documented, and the money you save there is real ($113/unit against the Ardusimple). But keep the ZED-F9P for v6. The $450 you would save at 30 units by switching to an LG290P does not pay for a new configuration protocol, a new backend decoder, and a fresh RTCM-compatibility unknown — in the same cycle where you are already taking on your first RF front end, your first cellular radio and your first NTRIP client. Do the receiver cost-down as a contained v7 respin of one corner of the board, once volume makes it worth $17k. One new unknown at a time is the rule that gets this board to work on the first article.

12. Cross-references

v5.5 EMC fix list: 2026-08-22_Drogheda_EinarBoard-v5_EMC-Audit_v1.0.md
Prior modem survey (bench-era): 2026-07-08_Drogheda_4G-Modem-Alternatives_v1.0.md
3.0 brief & method rules: 2026-08-12_Drogheda_EinarBoard-3.0_MCU-Integration_Design-Brief_v1.0.md
Canonical electrical state: watchdog-electrical-design-state.md
Invariants touched: #1 power-off safe · #2 never vanish (§2.3, §3.2) · #3 corrections ride the 4G, recover by power-cycling (§3.2 MODEM_PWR_EN)

38 KiB Raw Blame History Unescape Escape