Leopoldo Rodríguez d70dd806be T43: documentos vivos de V5.6/V5.7/v6 en los designadores nuevos; aviso en los fechados (V5.5/V4/V3 sin cambios)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QCy5VHMVLkAmftYM6swWmx

2026-10-22 21:04:59 -06:00

209 KiB

Raw Blame History

title

EinarBoard v6 — Full pre-fab audit (v1.0)

!!! warning "Designators from before 22-Oct (T43)" This document keeps the designators the board had on its date. Since 22-Oct (T43) the V5.6, V5.7 and v6 carry new ones, and several old names now belong to another part: on the v6, U6 is now the A7670SA modem (was U19) and the LTC4040 is U17 (was U6). To read it against today's board, use the old → new table (in Spanish); parts already gone by 22-Oct are not in it.

!!! warning "EinarBoard v6 (hbox-watchdog-v6): en diseño, no se pide" Diseño nuevo con ZED-F9P y módem A7670SA soldados a bordo. No es la V5.6 que se manda a fabricar esta semana (hbox-watchdog-v5, zócalos para simpleRTK2B y 4G NTRIP Master). Los hallazgos marcados «Impacto en V5.6» ya se aplicaron a la V5.6 y están en su informe de cambios.

!!! info "Update 28-Sep-2026: schematic fixes applied and independently verified" The schematic-level fixes from this report have since been applied in hbox-watchdog-v6.* and independently verified in three passes: audit fixes (173 PASS / 0 FAIL), ports and no new version, and a final check (the one FAIL, the inductor land, was fixed). Final schematic sha256 d58a89ba…e7b (after a fourth pass that aligned the charger straps with the V5.6 LFP-HT pack), ERC 0 errors; the .kicad_pcb is untouched until Michelle runs Update PCB from Schematic. Status, final state per block and the layout delta: EinarBoard v6 — Cambios de esquemático: resumen de las 3 pasadas. Spanish translation of this report: Auditoría completa v6.

!!! info "Correction plan, decisions and status: Spanish page" This is the audit report as written on 28-Sep-2026 (read-only, before any correction). The decisions taken afterwards on Leo's delegation (D1–D18), the status of every Blocker and Major, Michelle's layout work list and the release checklist are on EinarBoard v6 — Plan de corrección y estado, and the schematic edits are summarised in the 3-pass summary. Where the decisions differ from this report: G-01 is a Blocker (the V5.5 backplate is reused), F-51 is implemented in full (sensor ≤ 10 mm of U6 is binding), PD2 = ETH_PWR_EN with the board ID detected in firmware only (D-08 not applied), E-03 keeps Y1 with C95/C96 → 33 pF, and the schematic changes were applied in place in hbox-watchdog-v6.* (not on a -audit copy; the .kicad_pcb is Michelle's). Cost figures are not published on this site.

Owner: Leo (Helgen Technologies) · Date: 2026-09-28 · Version: 1.0 · Author: Claude for Leo (four block auditors, two independent verifiers, one editor) · Scope: read-only audit of 03-Architecture-Hardware/kicad/hbox-watchdog-v6.*; no KiCad file was modified · Brief: 2026-09-28_Drogheda_EinarBoard-v6_Full-Audit_Agent-Brief_v1.0.md · Companion: pinmap-v6.md

Design snapshot (KiCad 10.0.4, board file version 20260206). Hashes identical at the start and end of evidence collection (20:22–20:58 UTC).

File	sha256	mtime (UTC)
`hbox-watchdog-v6.kicad_sch`	`ecee9fed851f02e74074340bf8361bced7c385b2502b19c368861b9851c2f04a`	2026-09-25 20:27:58
`hbox-watchdog-v6.kicad_pcb`	`6ddec80d1c15f79e69dff6c1a850b28345a5d826389f79cee8c61998240b36bf`	2026-09-28 17:36:06
`hbox-watchdog-v6.kicad_pro`	`25c57f3936b96a4e31cb5947668c172d318189258d6a5d2fa34d230df8958028`	2026-09-28 20:16:16
`hbox-watchdog-v6.kicad_dru`	`47538e6cfadc0c53421ff59dadabc0e7f0ad5f11d9e2250618728788080aca1a`	2026-09-25 18:57:05

Board: 4 layers, 140.0 × 100.0 mm, 312 footprints, 1999 track segments, 210 vias, 205/205 multi-pad nets routed. Schematic: one flat sheet, 328 netlist symbols.

Resumen ejecutivo (ES)

¿Listo para ordenar? NO. Condiciones para ordenar: (a) cerrar los 10 Blockers (valores y campos de BOM, dos piezas nuevas —TPS2552 con sus 2 resistencias y un SMBJ33A—, reglas de diseño y layout); (b) Leo confirma el patrón de agujeros de la placa base (G-01 es Blocker si se reutilizan los standoffs de la V5.5); (c) DRC limpio con las reglas corregidas de F-01 como puerta de salida; (d) los 19 Major hechos o con razón escrita (escala del brief: «deben cambiar antes de pedir salvo razón escrita»). Ningún hallazgo cambia la arquitectura de la v6.
Conteo tras fusiones (81 hallazgos activos; 36 IDs absorbidos en su hallazgo primario; mapa completo en el Apéndice D):

Severidad Número

Blocker 10 + 1 condicional (G-01)

Major 19 (incluye V1-01, nuevo del verificador 1, y H-02b, separado de H-02)

Minor 30

Note 21
Blockers, una línea cada uno (orden de riesgo):
1. A-01 — La rama /24V sin fusible alimenta U20 y U2; D21 (Schottky 30 V) ve 23.5 V inversos con el bus cargando a 28.8 V y 30.7 V a 36 V → fuga con riesgo de embalamiento térmico a 45–60 °C; un D21 en corto pone 24 V sin fusible en MAIN5V. Arreglo: U20 solo desde MAIN5V (sin D20/D21), ventilador desde VEH5V (bloque U2 DNP), F2 3 A (C206912) delante de D10.
2. F-02 — La ignición cruda /IGN_IN (9–36 V) corre 106.5 mm en In2 a 0.221 mm de /VEH5V: la geometría del corto del 23-jul otra vez, en el mismo par de redes. Arreglo: Rig1 a ≤ 3 mm de cobre de P1.3 + SMBJ33A (C224019).
3. F-01 — Netclasses rotas (solo /24V_IN resuelve a HV24) y una regla de 0.15 mm que anula todas las demás: el «DRC 0 errores» no puede ver ningún espaciado de 24 V. Arreglo: tabla de netclasses + .kicad_dru corregido por verify_2 (incluye la regla HV24↔HV24).
4. H-04 — U25 lleva LCSC Part = C2071691 (AP64350, 40 V) además de LCSC = C524806; Fabrication Toolkit lee LCSC Part primero → se ensamblaría un buck de 40 V detrás de un clamp de 53 V. Arreglo: borrar el campo en la tarjeta y en la huella de librería.
5. C-01 — El bias de la antena GNSS no tiene limitador (u-blox exige ≥ 10 Ω); un coaxial en corto supera los 300 mA abs. máx. de VCC_RF y los 400 mA de L21. Arreglo: TPS2552DBVR (C46506), 75 mA, ANT_OFF → EN̅, FAULT̅ → ANT_SHORT_N.
6. B-03 — La ESD de la antena LTE (D28 ESD9L5.0, unidireccional 5 V) conduce en cada semiciclo negativo (−0.6 V) y avalancha en GSM (14.1 V pico). Arreglo: PESD0402-240 (C1975527), bidireccional 24 V, o DNP (la PGB1010402KR propuesta solo aguanta 12 VDC).
7. A-02 — Cobre y placement del LTC4040 repiten la lección F5: /SW_BAT 0.5 mm × 11.9 mm con cuellos de 0.25/0.30 mm, EP de U6 sin vías, L6 a 8.65 mm, C30/C31 a 7.2/6.2 mm, sensor más cercano a 71.4 mm. Arreglo: layout (pour ≥ 2 mm, 9 vías en el EP, re-agrupar).
8. A-03 — R50 = 825 Ω programa 2.42 A (2.28–2.57 A; la esquina alta supera los 2.5 A máx. del LTC4040). Arreglo: 1.43 kΩ (C22840) → ≥ 1.316 A en todas las esquinas (1.5 k de la ECO da 1.254 A mínimo).
9. H-01 — U15 MAX3232ESE (SO-16 angosto) sobre huella SOIC-16W (filas a 9.3 mm): no se puede soldar. Es una regresión de la v6 (la V5.5 se fabricó con la huella angosta). Arreglo: SOIC-16_3.9x9.9mm en esquemático y PCB, mantener C15846.
10. H-02 — Sin stock para ningún pedido: U10 (15 pzas) y R53 (6 pzas, mínimo JLC 20). R53 fija el voltaje del boost de respaldo. Arreglo: U10 → C57156 (SC16IS752, idéntico en I²C), R53 → C177479.
11. (condicional) G-01 — Falta el agujero MH4 de la V5.5 en (193.2, 90.3) (L6 queda encima) y los agujeros de la abrazadera del disipador (MH11 + pareja). Blocker si la placa base de la V5.5 se reutiliza; si se re-taladra, pasa a documentación.
Majors (19): V1-01 polaridad inversa derrota a D10 (F2 primero) · A-04 R121 57.6 k (5.32 V) · F-12 vías de tierra/EP/módulos/costura (69 vías vs ≥ 400) · F-03 lazos calientes de U25/U20/U12 · B-02 bulk de VBAT_MODEM → polímero + compensación 113 k/6.8 nF/56 pF · D-01 U24 retro-alimenta al F9P apagado · E-01 3V3_ETH conmutable (PD2) · F-51 sin temperatura de cargador ni de celda en el MCU · A-05 presupuesto en batería + CSYS · A-07 cuellos del camino de 5 V en capas internas · F-06 líneas RF (LTE 22 mm en In1) · F-05 In1 no es plano (19 % vacío, 1572 mm de pistas) · C-04 Q1 del F9P a 9 mm de la antena LTE · G-02 J9 sin ESD · A-08 AMS1117 → TLV1117LV33 · A-09 C78 electrolítico 85 °C → polímero · C-02 rampa de VCC del F9P → TPS7A2033 · E-02 ETH_RST 4.7 k · H-02b stock a verificar el día del pedido.
Qué puede esperar a v6.1: los 30 Minor y los 21 Note (§5 parte 3), más lo que los hallazgos difieren explícitamente: K1 → enlace directo PC6 → DIN_4G (B-13), PoE (E-07), U12 → AP64350 (A-20a), P3 → JST-XH-5 si se rehace el arnés (G-07). Ningún Major está marcado como diferible; E-02 baja a Minor si se adopta E-01.
Firmware (FW 0.7.x, board_v6.h), lo más importante: (1) board_v6.h desde pinmap-v6.md; un binario V5.6 en v6 choca en PC3 contra RTK_STAT; (2) primeras líneas de setup(): PC10, PC8, PC11, PA1, PB5, PA15, PA6, PB0 en LOW; (3) secuencia de ventana: F9P asentado → BAT ≥ 3.4 V → W5500 apagado → MODEM_PWR_EN → PWRKEY → STATUS; nunca PC10 alto con PA1 bajo hasta tener D-01 en hardware; (4) en batería: solo LTE (AT+CNMP=38), ETH_PWR_EN = 0, K1 solo en la ventana TX; (5) V5_PFI 4.60 → 4.40 V, VDDA desde VREFINT, ignición por ADC con umbrales; (6) $PHID (UID 96 bits) por el enlace del módem al conectar y cada 5 min; (7) inhibición térmica con tcell (PC5) y tchg (TMP102 0x48), campos nuevos al final de $PHLG.
Costo: cost analysis kept in the repository copy.

Severidad	Número
Blocker	10 + 1 condicional (G-01)
Major	19 (incluye V1-01, nuevo del verificador 1, y H-02b, separado de H-02)
Minor	30
Note	21

1. Method and evidence

Evidence pack (read-only, built 2026-09-28 20:22–21:00 UTC): on the Mac at 03-Architecture-Hardware/kicad/_to_delete/v6-audit-20260928/evidence/ (KiCad exports) with the parsed tree under evidence/pack/; container copy /home/claude/v6audit/. It holds kicad-cli netlists (v6, V5.6, V5.5 as-fabbed), ERC (166 items) and DRC (283 items) outputs, BOM, CPL, IPC-D-356, per-layer PDF/SVG plots, pad/track/via/zone tables parsed from the board file, 64-pin MCU table, per-IC pin tables, 24 V clearance sweep, schematic↔PCB sync report and the firmware pin/constant tables. Self-checks: parsed pads match KiCad's IPC-356 on 1191/1191 pads (worst Δ 1.77 µm, 0 net mismatches); counts match KiCad on every table. Index in Appendix C.
Attachments kept with this report (tracked in the repo, unlike the gitignored evidence folder): 03-Architecture-Hardware/2026-09-28_v6-audit-attachments/. It holds erc_summary.md, drc_summary.md, ercdrc_classified.csv (all 166 ERC + 283 DRC items with their classification), bom_check.csv (152 BOM lines: stock, package, rating), the two verification files verify_1.md / verify_2.md, and the four block findings files these IDs come from.
Audit: four block auditors, each writing one findings file: power + temperature/fan (A-xx, F-51…F-53), modem/GNSS/Ethernet (B-, C-, E-xx), MCU pin map + connectors (D-, G-xx, plus pinmap-v6.md), layout/EMC + BOM + ERC/DRC (F-, H-, J-xx, plus bom_check.csv and ercdrc_classified.csv).
Verification: two independent verifiers re-derived every item the auditors rated Blocker or Major (plus D-02) from primary sources with their own scripts: verify_1 = power and RF (24 items), verify_2 = layout, BOM, MCU and connectors (22 items). Outcome: 0 refuted; 13 confirmed with corrections; 6 severity changes; 1 new Major (V1-01). Where auditor and verifier disagree, this report uses the verifier. Where the two verifiers merged overlapping items differently, the merge is reconciled into one item and the choice is stated (§2 per item, Appendix D). Minor and Note items outside that list are marked not independently verified.
Tools: KiCad 10.0.4 through the KiCad MCP server on Leo's Mac (kicad-cli ERC, DRC, netlist, BOM, CPL, IPC-356, courtyard check, zone query); Python sexpdata S-expression parsers (scripts/kisexp.py; no numeric regex on KiCad files); shapely for pad-edge distances, copper islands, plane voids and clearances; a 2-D finite-difference field solver and closed-form (Hammerstad–Jensen, Wadell CPWG) impedance checks; an averaged current-mode model of U20 for burst droop (verify_1 vbat_sim.py); JLC parts DB snapshot (get_jlcpcb_part, search_jlcpcb_parts) for stock, package and price; the Fabrication-Toolkit source (GitHub) for BOM field priority; manufacturer datasheets cited per finding (LTC4040 Rev B, TPS54360B, AP64350 DS41976 Rev 5-2, MP1584, AMS1117, PMEG3050EP, SIMCom A7672X/A7670X HD V1.03 and A7670 HD V1.00, u-blox ZED-F9P-04B DS UBX-21044850 R05 and IM UBX-18010802, AP2112, TPS7A20, TPS2552, W5500 v1.0.2, ST DS10314 Rev 7 / RM0383, Maxim MAX3232 19-0273 Rev 10, Sunlord MWSA, Nexperia 74LVC1G125, IPC-2221B, ISO 7637-2 / ISO 16750-2 levels via TI TIDUC41).
Conventions: "edge" = pad copper to pad copper; "ctr" = pad centre. Stackup for impedance and inner-layer current: JLC04161H-7628 (L1–L2 prepreg 0.2104 mm, εr 4.4; outer 1 oz; inner 0.5 oz by default), because the board file carries the generic 3 × 0.48 mm stack. Island and void analysis uses the zone fills stored in the file; refill before fab and re-check.
Finding format: ID · severity · block; Absorbs (merged IDs); Status (verified / verified-with-correction / not independently verified); Evidence; Consequence; Fix (value + LCSC, or layout instruction with numbers); Effort (schematic-only / layout / both / firmware-only). Original working-file IDs are kept. V1-01 is the new Major raised by verify_1; H-02b is the part of H-02 that verify_2 re-rated Major.

2. Findings and pass/fail by block (brief §4-A … §4-J)

4-A Power tree (24 V → 5 V → rails), lessons F4 / F5 / F7

(a) Findings

A-01 · Blocker · Unfused `/24V` branch feeds U20 and U2; D21 (30 V Schottky) reverse-stressed toward thermal runaway

Absorbs: B-01, H-05, F-53, F-08, A-06 (U2 row). Status: verified-with-correction (verify_1: the Blocker rests on D21 and the unfused branch, not on U2; ISO 7637-2:2011 pulse 2a is +50 V, not +112 V; D32 also clamps /24V for fast transients).

Evidence:
- Netlist: /24V_IN = {P1.1, D10, F2.1, Q10.D}. Fused branch F2 (0154002.DR 2 A, C206910) → /VIN_FUSED → Q23 → /VIN_PROT = {D32 SMCJ33A, C149–C151, U25.2, R124}. Unfused branch Q10.S → /24V = {C10, C11, C22, Ren1, U2.7, D20.A, DzG1.K}. /VIN_MODEM = {D20.K, D21.K, C127, C128, U20.2}; D21.A = /MAIN5V (LTC4040 VSYS, after RS1 and Q7).
- Clamping (verify_1): for µs–ms transients /24V is clamped by D10 and by D32 through Q10 (65 mΩ) → F2 (≈ 0.05 Ω) → Q23 (65 mΩ), ≈ 0.2 Ω. Neither TVS conducts at 36 V DC (VBR 36.7–40.6 V). "Outside the D32 clamp" holds only for DC and for fusing.
- Ratings: D21 PMEG3050EP VR 30 V, IR 2.6 mA typ / 8 mA max at 30 V, 25 °C, datasheet thermal-runaway warning, Rth(j-a) 60–200 K/W. U2 MP1584 VIN 4.5–28 V, 30 V abs max, EN abs max 6 V (EN = 24V·20k/120k = 6.0 V at 36 V). U20 AP64350 42 V DC / 45 V for 400 ms. D20/Dbk1 SS34 40 V.
- Stress: 28.8 V charging bus → D21 VR = 23.5 V (78 % VRRM), U2 0.8 V over its operating max. 36 V / 60 min (ISO 16750-2) → D21 VR 30.7 V > 30 V, U2 6 V over abs max. Pulse 2a (+50 V, 2 Ω) → D10 ∥ D32 clamp ≈ 42–45 V: U20 at its 45 V/400 ms limit, D21 ≈ 37–40 V reverse (avalanche for 50 µs). Suppressed load dump 58 V: everything on /24V over rating (A-19).
- D21 runaway (verify_1): IR ≈ 1.8 mA at 23.5 V/25 °C; stability needs PR < 0.12 W at 120 K/W (0.24 W at 60 K/W). 45 °C board → IR ≈ 7 mA, PR ≈ 0.17 W; 60 °C → ≈ 20 mA, 0.48 W. Runaway is plausible at port-box temperatures.
- Layout: the /24V 1.5 mm track runs on In1 at 0.15 mm from the In1 GND pour, and a /24V via sits 0.15 mm from the B.Cu /3V3 pour (clearance_24v.md).
- Field weighting: on V5.x P1 = 24 V fed only U2 and no U2 failure is recorded, so U2 alone would rate Major. D21, U20/D20 on the unfused branch and the D21-short mode are new on v6.
Consequence: a D21 that fails short puts /24V onto /MAIN5V with no fuse (LTC4040 VSYS 6 V abs max, U21, U17, F9P, MCU). A short of C10/C22/U2/U20/D22 draws vehicle-fuse current through 0.3–1.5 mm board copper (fire and harness risk).
Fix (single topology, verify_1 conflict (a)):
1. U20 from /MAIN5V only: delete D20 and the 48 mm /VIN_MODEM run; merge /VIN_MODEM into /MAIN5V in copper (no D21).
2. Fan from /VEH5V: DNP U2, L2, Dbk1, Cbst1, Rcomp1, Ccomp1, Rfreq1, Ren1, Ren2, R20, R21; bridge JP1 by changing its footprint to Jumper:SolderJumper-2_P1.3mm_Bridged_RoundedPad1.0x1.5mm (no BOM part; A-01's 0 Ω 0805 alternative has no LCSC in the findings). Fan stays dark on battery, as today (ECO D4).
3. /24V then has no loads: DNP Q10, DzG1, Rrp1, C10, C11, C22. Q23 remains the single reverse-polarity FET.
4. F2 → 3 A 0154003.DR, LCSC C206912 (stock 2217), placed electrically ahead of D10 (V1-01). 4 A C206914 (stock 778) only if sustained 9 V operation is required.
5. Prerequisites: A-07 (widen /VEH5V, /VIN_SW, /MAIN5V), A-04 (R121 57.6 k), A-05 (CSYS), F-03 (U20 Cin 2 × 22 µF C86817 + 1 × 220 µF C881921 at U20.2).
- Numbers with the fix (verify_1): U20 input at MAIN5V ≈ 5.25 V, η 0.9: LTE 23 dBm 0.54 A, GSM 2 A 1.61 A, 2.8 A peak 2.25 A. RS1 path while charging at 1.43 k plus LTE TX: 0.35 + 0.54 + 1.19 = 2.08 A (< 2.35–2.65 A limit); during a GSM burst the charger is throttled to 0.4–0.7 A (system load has priority, LTC4040 DS p.16). U25 ≤ 2.65 A + 0.3 A fan = 2.95 A vs 3.5 A rating; overshoot inductor peak ≈ 3.8 A < 4.5 A switch limit. D34 ≈ 0.8 W (≈ 1.0 W as-is). On battery VIN(U20) rises 4.42 → 4.72 V and MAIN5V current at 2 A GSM falls to ≈ 2.0–2.13 A. F2 current 0.74 A at 24 V, 1.48 A at 12 V, 1.97 A at 9 V. PFI margin with 57.6 k: 5.176 V − ≈ 0.2 V droop = 4.98 V vs 4.54 V PFI max (0.44 V; 0.13 V as-is).
- Rejected: D20 → /VIN_PROT with a 60 V Schottky (PMEG6045ETPX C552943) keeps U20 at 0–3 V margin to the pulse-2a clamp and costs ≈ 0.15 V of battery headroom. The JSMSEMI clone C53114006 (H-05) has unknown leakage.
- Record for Leo: U20 then sits upstream of the P5 cutoff. The ECO §A intent ("the cutoff switches everything off") still holds functionally, because cutting SYS5V unpowers the MCU and R113 holds U20 EN low (µA shutdown current).
Effort: both.

A-02 · Blocker · LTC4040 (U6) copper, EP vias and placement repeat lesson F5

Absorbs: F-13 (U6 EP part), the In1-under-U6 part of A-14. Status: verified (verify_1 re-measured edge-to-edge; caveat: the H0008 thermal-cycling causality is weak, because the ≈ 1.3 A is inferred from an OCV slope and 0.75 W at bench ambient needs θJA > 150 °C/W to reach OT. The Blocker stands on lesson F5, ECO D2 "Obligatorio" and the datasheet layout guidance).

Evidence (verify_1):

Item	v6	Target (ECO D2)
`/SW_BAT` U6.21/22 → L6.1	6 F.Cu segments, 0.5 mm × 11.89 mm + 0.25 mm and 0.30 mm necks (0.50 mm long) at the pins, 0 vias; ≈ 12.2 mΩ	≥ 2 mm polygon
`/BAT_PLUS` P3 → L6.2	1.0 mm × 21.27 mm	≥ 1.5 mm + vias
`/BAT_PLUS` L6.2 → U6.23	1.0 mm, then 0.5 mm × 10.49 mm, then 0.25 mm × 5.38 mm	Kelvin from L6.2/CBAT
U6 EP (2.65 × 3.65 mm)	0 vias; nearest GND via 3.04 mm edge at (191.6, 104.3)	≥ 9 vias
L6.1 ↔ U6.21/22	8.65 mm	≤ 5 mm
C30 / C31 → U6.6 (VIN)	7.20 / 6.18 mm	≤ 3 mm
C32 / C33 / C34 → U6.1 (VSYS)	3.90 / 3.44 / 4.74 mm, behind 0.30 mm pin necks	≤ 2 mm, pour
C35 (CBAT) → L6.2	20.2 mm edge	at L6.2 / BAT pin
GND clusters	U6 EP, C32, C30/C31, C35 on a 252 mm² F.Cu cluster with 5 vias; C33 on the 3611 mm² cluster	one solid EP island
In1 under U6	split by 7 `/VFB_BST` segments + `/IGATE` + `/CHRG_*`	solid ≥ 5 mm around U6/L6
Temperature sensor ≤ 10 mm	none; U3 SHT40 at 71.4 mm	≤ 10 mm (F-51)

IPC-2221 external rise: /SW_BAT 0.5 mm → +32 °C at 2.42 A, +80 °C at 3.6 A backup battery current; /BAT_PLUS 1.0 mm → +25 °C at 3.6 A. The same current at 2.0 mm gives +8 °C.
LTC4040 has over-temperature shutdown only, no charge-current thermal regulation (DS p.5 Note 2). IC loss ≈ 0.75 W at 2.42 A; as-built θJA ≈ 60–70 °C/W (the 43 °C/W datasheet figure assumes a via array).

Consequence: R5 (≥ 1.3 A without thermal cycling) is not met by layout; in continuous backup the boost node and the VSYS necks run hot. This repeats V5.5 lesson F5 (ECO D2 / EMC 🔴 #1, #2).
Fix (layout, Michelle; §6 L-11 … L-16): L6 pad 1 ≤ 5 mm from U6.21/22; C32/C33/C34 ≤ 2 mm from VSYS pins 1/24 with GND on the EP copper; C30/C31 ≤ 3 mm from pin 6; C35 (or an extra 22 µF 0805, C86817) at L6.2 next to BAT pin 23. /SW_BAT F.Cu polygon ≥ 2 mm wide, starting after the combined pin 21+22 fan-out (QFN 0.5 mm pitch), kept compact. /BAT_PLUS P3 → L6.2 ≥ 1.5 mm F.Cu or pour (≥ 4 vias per transition if routed inner). /MAIN5V pour from pins 1/24 over C32–C34 to the Q7 drain, ≥ 2 mm, no 0.3/0.5 mm necks. EP: ≥ 9 vias, 3 × 3 at 0.9 × 1.2 mm pitch, 0.3/0.6 mm (fit checked by verify_2; A-02 proposed 3 × 4 = 12 at 0.9 mm), pad zone_connect solid. In1/In2 GND solid for ≥ 5 mm around U6/L6 (reroute /VFB_BST, /IGATE, see A-14). Place the F-51 TMP102 between U6 and L6.
Effort: layout.

A-03 · Blocker · R50 = 825 Ω programs 2.42 A; set 1.43 kΩ to hold ≥ 1.3 A at every corner

Status: verified (verify_1). Lesson F4; ECO §C; R5.

Evidence: RPROG = 2000 V / ICHG (hPROG 2500, VPROG 0.8 V), ±5 % (950/1000/1050 mA at 2 k), maximum charge current 2.5 A (LTC4040 DS p.3, 10, 18).

R50 (1 %)	ICHG min	nom	max
825 Ω (as-is, C50214)	2.280 A	2.424 A	2.571 A (above the 2.5 A maximum)
1.43 kΩ	1.316 A	1.399 A	1.483 A
1.47 kΩ	1.280 A	1.361 A	1.443 A
1.5 kΩ (ECO C, C22843)	1.254 A	1.333 A	1.414 A

H0008 (V5.5, same R50): ≈ 1.3 A average, 8.5 h to termination, pulsed charge. At 1.4 A the IC loss drops ≈ 3× ((2.42/1.4)²). Input side at 1.4 A: 1.4·4.0/(0.9·5.3) ≈ 1.17 A + 0.35 A logic = 1.52 A < RS1 limit, so the charger stops being input-limited. The Li-ion safety timer (4.25 h) counts in CV only.

Consequence: at 825 Ω v6 repeats the H0008 behaviour, runs U25 at the RS1 limit (≈ 2.5 A) whenever charging, and exceeds the IC's 2.5 A maximum at the top corner.
Fix: R50 → 1.43 kΩ 1 % 0603, LCSC C22840 (Extended, stock 4965). 1.43 k is the largest E96 value with a worst-case minimum ≥ 1.3 A; it costs ≈ 10 % more I²R than 1.5 k. 1.5 kΩ (C22843, Basic) keeps V5.6 commonality but meets R5 only nominally.
Effort: schematic-only.

V1-01 · Major · Reverse polarity is defeated by the D10 position (new)

Status: raised by verify_1 ("Anything else" #1); not cross-checked by a second verifier.

Evidence: D10 (C224019, SMBJ33A) and D32 (C699039, SMCJ33A) are unidirectional parts drawn with a bidirectional A1/A2 symbol, pad 1 (cathode) on the + rail. D10 sits on /24V_IN, ahead of F2 and ahead of the Q10/Q23 reverse-polarity FETs.
Consequence: a reversed P1 forward-biases D10 straight across the harness with no board fuse; the SMB part carries harness-fuse current until it fails, typically short.
Fix: F2 electrically first: P1 → F2 → D10 ∥ Q23 (D10 moves from /24V_IN to the F2 output). A reversed connection then blows the socketed Nano2 fuse. ISO 7637-2 pulse 1 (24 V: −600 V, 50 Ω, 1 ms, ≈ 12 A, I²t ≈ 0.07 A²s) is ≈ 7 % of a 3 A Nano2's I²t. A-01 listed this as optional; verify_1 makes it mandatory. Same F2 part as A-01 (C206912).
Effort: both.

A-04 · Major · U25 set-point 5.00 V (4.87–5.14 V) sits below the charge governor's start line; set R121 = 57.6 k

Status: verified (verify_1). Lesson F7; ECO §A/§C.

Evidence: Vout = Vref·(1 + R121/R122), TPS54360B Vref 0.792/0.800/0.808 V (−40…150 °C), 1 % resistors, R122 = 10.2 k.

R121	min	nom	max	vs CHG_RAIL_ON 5.05 V	vs LTC4040 VIN max 5.5 V
53.6 k (as-is)	4.871	5.004	5.140	nominal below the start line	ok
56.2 k	5.069	5.208	5.350	low corner +0.02 V	ok
57.6 k	5.176	5.318	5.463	≥ 0.13 V above	37 mV margin
57.6 k, 0.1 %	5.256	5.318	5.380	ok	120 mV margin

LTC4040 PFI (R51 270 k / R52 100 k, 1.17/1.19/1.21 V, +30 mV hysteresis): falling 4.27 / 4.40 / 4.54 V, rising 4.38 / 4.51 / 4.66 V. Firmware V5_PFI 4.60 V is stale (it came from the old 287 k).
ADC reads 5V_SENSE (R7/R8 10 k/10 k) against VDDA = the 3V3 LDO (±1.5 %, lower on battery, A-08): thresholds carry ±2–3 % unless calibrated with VREFINT.

Consequence: with FW 0.6.0 thresholds most v6 units never start charging (R5 fails); margins are thin under modem bursts once the modem moves to MAIN5V (A-01).
Fix: R121 → 57.6 k 1 % 0603, LCSC C23082 (Extended, stock 3673). Top corner 5.463 V is 37 mV under the 5.5 V VIN operating maximum; load-release overshoot is brief and far below abs max (verify_1). 0.1 % parts optional (no 0.1 % LCSC found in the DB). Firmware: V5_PFI = 4.40 V, VREFINT calibration.
Effort: schematic-only (+ firmware constants).

A-05 · Major · Battery-mode budget: 2.25–2.33 A on MAIN5V during a GSM burst; CSYS ≈ 57–69 µF effective

Absorbs: nothing (its fix 1 is E-01, fix 3 is in F-03, fix 4 is A-01). Status: verified-with-correction (verify_1: the 93–97 % is against the datasheet's guaranteed 2.5 A from ≥ 3.2 V; the hard limit is ILIM(BST) ≥ 5.5 A, which leaves ≈ 30–40 % switch headroom at 3.5 V; a 2.8 A GSM peak at a 3.2 V battery reaches ≈ 5.4 A, i.e. the limit).

Evidence: what stays alive on battery: BAT → L6 → U6 boost → /MAIN5V (VSYS 0.8·(1 + 499k/100k) = 4.60 / 4.79 / 4.99 V); from MAIN5V: D21 → U20 → modem (ahead of P5; EN held low by R113 when the MCU is unpowered), and P5 → /SYS5V → D12 → U17 (3V3), U12 (3V3_ETH, EN tied to VIN = always on), F1 → Q1 → U21 → F9P, K1 coil. CSYS = C32/C33 47 µF 16 V X7R 1210 + C34 10 µF 50 V = 104 µF nominal, ≈ 57–69 µF effective at 4.8 V, below the 75 µF transient guidance (DS p.21). Worst-case budget below (assumptions: logic 90/120 mA, F9P 100/85 mA, W5500 132 mA at 3.3 V via U12 η 0.85, K1 30 mA, modem 2.0 A GSM peak / 0.7 A LTE / 20 mA idle, U20 η 0.88, boost η 0.88, battery 3.5 V).
Consequence: as-is, a cold modem registration or a GSM burst with everything else on sits at 91–97 % of the guaranteed boost rating with no allowance for > 2 A bursts or an aged pack. Hitting the limit droops VSYS: U17 drops out first (A-08), then VBAT_MODEM < 3.4 V, the V5.5 "modem dark on battery" symptom by another mechanism. R1/R3 need the fixes plus firmware sequencing.
Fix: add 2 × 47 µF 16 V X7R 1210, LCSC C5440143, at U6 VSYS pins 1/24 (≈ 113 µF effective). Plus: E-01 (gate 3V3_ETH), A-01 (no D21, +0.30 V at U20), A-07 (MAIN5V ≥ 1.5–2 mm to U20), F-03 (U20 Cin), and mandatory firmware sequencing (§8: LTE-only on battery, W5500 off, F9P settled before the modem, refuse modem cold start below VBAT ≈ 3.4 V).
Effort: both.

Worst-case current budget (A-05, reproduced by verify_1). On 24 V, as-is topology, charging with R50 825 Ω / with 1.43 k:

Rail	Cold start	Steady	Modem TX burst
/3V3 (U17 out)	0.120 A	0.090 A	0.090 A
/3V3_GNSS	0.100 A	0.085 A	0.085 A
/3V3_ETH	0.132 A	0.132 A	0.132 A
/VBAT_MODEM	2.0 A pk (0.3 A avg)	0.024 A	2.0 A pk
/VIN_MODEM @ 23.5 V (from /24V)	0.37 A pk	0.005 A	0.37 A pk
/SYS5V	0.35 A	0.31 A	0.31 A
/VEH5V (U25 out; charger held off 120 s at boot)	0.36 A	2.50 A (RS1-limited) / 1.48 A	2.50 / 1.48 A
P1 total @ 24 V	0.50 A	0.65 / 0.43 A	1.02 / 0.80 A
P1 total @ 9 V	—	1.73 / 1.1 A	2.8 / 2.2 A

On battery, as-is topology (VSYS 4.79 V, VIN_MODEM ≈ 4.4 V after D21):

Rail	Cold start (all on, modem registering)	Steady (idle)	GSM TX burst	LTE TX
/VIN_MODEM	1.96 A pk	0.024 A	1.96 A pk	0.69 A
/SYS5V (logic + F9P + W5500 + K1)	0.36 A	0.32 A	0.32 A	0.32 A
/MAIN5V = boost load	2.33 A (93 % of 2.5 A)	0.34 A	2.28 A (91 %)	1.01 A (40 %)
same at VSYS low corner 4.60 V	2.43 A (97 %)	0.34 A	2.38 A (95 %)	1.04 A
Battery current (3.5 V, η 0.88)	3.62 A	0.53 A	3.55 A	1.57 A
with fixes + FW sequencing (W5500 off, K1 off, F9P deferred, D21 bridged)	1.95 A (78 %)	0.15 A	1.95 A	0.85 A
with fixes + LTE-only on battery	≈ 1.2 A (48 %)	0.15 A	—	0.85 A

verify_1 reproduction: MAIN5V 2.25 A during a 2 A GSM burst (modem 1.89 A at 4.42 V input, SYS5V ≈ 0.36 A); battery 3.42 A at 3.5 V, 3.24 A at 3.7 V. Cold-start statement for the modem: B-16 (§4-B).

A-07 · Major · 5 V power path runs the full LTC4040 input current through inner 0.5/0.8 mm tracks

Absorbs: J-02 copper on /VEH5V, /VIN_SW, /MAIN5V (J-02 residual stays Minor). Status: verified (verify_1; verify_2 adds that JLC04161H inner copper is 0.5 oz by default, which makes the inner runs worse: R ≈ 27 mΩ, 0.17 W over 13.6 mm).

Evidence (widest-path bottlenecks): /VEH5V L22.2 → RS1.1: In1 0.5 mm × 13.6 mm (+ In2 1.0 mm × 66.6 mm), 2.5 A while charging → IPC-2221 internal +168 °C (IPC-2152 ≈ half). /VIN_SW RS1.2 → Q7: In2 0.8 mm × 23.6 mm, +77 °C at 2.5 A. /MAIN5V Q7 → U6.24/C32: F.Cu 0.5 mm × 13.3/6.6 mm, +26/+32 °C; U6.1 → C32 0.30 mm neck (A-02). /MAIN5V Q7 → D21: 1.0 mm, 40 mm. RS1 Kelvin: CLN sense (U6.7) taps 1.66 mm down the 0.8 mm trace from RS1.2 (+1.0 mΩ) → effective input limit 2.14–2.41 A instead of 2.35–2.65 A (conservative, unintended). verify_2 J-02: under-capacity length /MAIN5V 111 mm, /VEH5V 102 mm, /VIN_SW 26 mm.
Consequence: hot inner copper under U6/Q7 at charge current, extra drop, heat shared with the U6 area. A-01 adds more hours at the RS1 limit, so A-07 is a prerequisite of A-01.
Fix (layout): /VEH5V L22.2 → RS1.1 on F.Cu ≥ 2 mm or a pour (move L22/C153/C154 toward RS1), or ≥ 2 mm inner with ≥ 4 vias per transition. /VIN_SW on F.Cu ≥ 2 mm, Q7 ≤ 5 mm from RS1/U6. /MAIN5V per A-02, and ≥ 1.5 mm all the way to U20. Route U6.7 (CLN) and U6.6 (VIN) sense from the inner edges of the RS1 pads (Kelvin). Either order 1 oz inner copper or widen inner runs by 1.65× (verify_2).
Effort: layout.

A-08 · Major · U17 AMS1117-3.3 drops out on battery and sets a 25–55 mW sleep floor

Status: verified (verify_1).

Evidence: LDO_IN on battery = VSYS 4.60–4.99 V − D12 (≈ 0.3 V) = 4.27–4.67 V; AMS1117 dropout ≈ 1.0 V at 0.1 A (1.1 V typ / 1.3 V max at 0.8 A) → needs ≈ 4.3 V. Ground current 5 mA typ / 11 mA max → 27–60 mW referred to the battery (boost η 0.88), against the 20–50 mW duty-cycle floor (drogheda-backup-lowpower). VDDA = 3V3 via R104 10 Ω while firmware assumes 3.30 V → BAT_SENSE/5V_SENSE read up to +4 % high; the 3.40 V low-battery cut trips at ≈ 3.27 V real. Datasheet asks for 22 µF tantalum; /3V3 is all ceramic.
Consequence: degraded 3V3 exactly on battery, wrong battery telemetry, and a sleep floor as large as the whole target.
Fix: U17 → TI TLV1117LV33DCYR, LCSC C15578 (SOT-223, same 1-GND / 2-OUT / 3-IN pinout, 1 A, 455 mV at 1 A, ≈ 100 µA Iq, ceramic-stable, VIN max 5.5 V vs LDO_IN max ≈ 5.21 V with 57.6 k; stock 26 999). Do not use C48937499 (same MPN listed, wrong die: 1.2 V dropout, 12 V). Firmware: VREFINT calibration.
Effort: schematic-only.

A-09 · Major · C78 is an 85 °C / 2000 h general-purpose electrolytic on the 5 V rail (≈ 1-year life in a port box)

C130/C131 moved to B-02. Status: verified (verify_1).

Evidence: C78 (VEH5V bulk) = C2827940 SamYoung MVG 16 V 220 µF, −40…+85 °C, 2000 h @ 85 °C, 130 mA ripple. 10 °C-rule life at 65 °C local (assumption): MVG ≈ 8 000 h (0.9 y 24/7). Others: C10 MVK 105 °C/1000 h (removed by A-01), C3/C103 Rubycon TZV 105 °C/2000 h, C151 Nichicon UUD 105 °C/5000 h ✅.
Consequence: bulk capacitance and ESR drift within the first year, affecting U25 transient response.
Fix: C78 → Lelon OVZ221M1CTR-0608 220 µF 16 V polymer, LCSC C881921 (same 6.3 × 7.7 can, 105 °C/2000 h, stock 2442). Effect on the U25 loop is benign: fc ≈ 4.4 kHz with 276 µF against the 1.8 kHz compensation zero → PM ≈ 68° (verify_1).
Effort: schematic-only.

Minor (A)

A-10 · Minor · No over-voltage protection on VEH5V (not independently verified). U6.16 OVSNS tied straight to /VEH5V (OVP unused). A TPS54360B high-side short puts /VIN_PROT (24–36 V) on VEH5V (LTC4040 VIN abs max 6 V steady / 7 V transient) and through Q7 onto MAIN5V → SYS5V. V5 used the isolated SD-15B, so v6 adds this failure mode. Fix (pick one): (a) LTC4040 OVP arrangement per the datasheet application (OVSNS via 6.2 kΩ + series N-FET ≥ 40 V; verify the topology against the datasheet figure before committing), or (b) a 1.5 kW 5 V TVS (SMCJ5.0A class) as a crowbar to open F2 (imperfect). No LCSC selected in the findings. Effort: both.
A-11 · Minor · CHGOFF (PA8) has a pull-down: charger runs at full current whenever the MCU is not driving the pin (not independently verified). R56 100 k /CHRG_EN → GND; during reset, DFU, boot loops and unflashed boards the charger is enabled with no governor (2.42 A as-is). Fix: R56 100 k (C25803) re-netted to /3V3 → default charge OFF; polarity unchanged. Effort: schematic + one track.
A-13 · Minor · PFO goes only to TP2: no hardware power-fail interrupt — absorbs D-10 (not independently verified; pin allocation per verify_1 (h)). /PFO_TP = {U6.20, TP2}; firmware detects backup by polling 5V_SENSE (V5_OFF 3.80 V) although the LTC4040 has switched at PFI 4.40 V; tens of ms late to shed loads. /CLPROG_TP = {U6.3, TP1} (V = 32·(VIN − CLN), 0.32 V/A with RS1 10 mΩ). Fix: PFO → PB10 (pad 29, EXTI10) with 100 k C25803 pull-up to /3V3. D-10's CLPROG → PC5 is dropped because PC5 goes to F-51; CLPROG stays on TP1. Effort: both (two tracks).
A-14 · Minor · BSTFB divider 21–24 mm from U6; IGATE 43 mm unguarded — absorbs F-10 (not independently verified; the In1-cut part is in A-02). R53.2 → U6.18 21.4 mm, R54.1 24.0 mm; /VFB_BST F.Cu 16.8 mm + In1 24.4 mm, 5 vias, 41.2 mm total (83 kΩ Thevenin node); /IGATE F.Cu 6.0 + In1 37.0 mm, Q7.4 ↔ U6.15 23.2 mm. Switch-node overlap (F-10): /SW_PWRIN over In1 /MAIN5V 2.41 mm², /SW_5V 2.91 mm², /VFB_BST 1.14 mm² (≈ 0.095 pF → ≈ 0.23 mA spikes at 24 V/10 ns); /SW_BAT over In1 /SW_5V 1.39 mm². Consequence: backup set-point noise (the mode R1/R3 rely on); µA-class IGATE drive exposed to humid-box leakage (Q7 body diode ≈ 1.2 W at 2.5 A if partially off). Fix: R53/R54 ≤ 3 mm from pins 18/10, top leg Kelvin-tapped at the CSYS pads, net on F.Cu; Q7 ≤ 5 mm from U6.15, IGATE ≤ 8 mm on F.Cu flanked by MAIN5V copper; In1 solid under all switch nodes (F-05). Effort: layout.
(D-09, absorbing A-12, is in §4-D; F-51/F-52 are in §4-F; F-01/F-02 (24 V clearance) are in §4-F.)

Notes (A) — not independently verified unless stated

ID	Observation	Action
A-16	U25 EN/UVLO divider R124 523 k / R125 84.5 k DNP → internal UVLO 4.1–4.3 V; between ≈ 4.3 V and 5.8 V input VEH5V is in dropout inside the PFI band (12 V vehicles under crank only).	Optional: populate R124/R125 (start ≈ 8.0 V, stop ≈ 5.5 V) if 12 V machines are in scope; LCSC to be picked in sourcing.
A-18	U25 compensation = TPS54360B datasheet example (13 k / 6.8 nF / 39 pF) for 8.2 µH + 58 µF; v6 has 10 µH + ≈ 56 µF ceramic + bulk; fco ≈ 4–6 kHz, PM > 60° (estimate); ≈ 0.16 V dip for a 1.8 A step.	None required; optional R123 → 24 k after A-01/A-09; bench 0.3 → 2.5 A step.
A-19	SMCJ33A/SMBJ33A survive 36 V/60 min and ISO 7637-2 fast pulses but not an ISO 16750-2 Test B suppressed load dump (58 V, 100–350 ms, ≈ 10 A); the TVS would fail short and F2 then opens (after A-01).	Confirm alternator load-dump suppression in the fleet (§10). Keep SMCJ33A; do not raise the TVS voltage (U25 65 V abs max).
A-20	(a) U12 MP1584EN (C15051, −20…+85 °C): gate EN (E-01); optional swap to AP64350 C2071691 (re-layout). (b) F1 3 A PPTC now protects only the F9P LDO branch: harmless, not protective; keep. (c) P2 bench jack has no reverse protection (VEH5V −0.3 V abs max): state on silkscreen. (d) JP_CUT → G-04. (e) C22 value text 22 µF vs 10 µF part → H-08. (f) K1 G5V-1 rated −40…+70 °C. (g) R112 1 k VBAT_MODEM bleeder 3.8 mA / 14 mW: fine.	As listed.

F-53 (fan block) is absorbed into A-01 and not counted as a Note: U2 5V_FAN 4.99 V (4.76–5.23 V); FB divider R20/R21 0.67/1.48 mm from U2.4 (ECO E3 fixed); PA6 → Rg1 100 Ω → Q2 with Rgs1 100 k (default OFF), D2 flyback; 2-wire fan, no tach. A-01 moves the fan to VEH5V; firmware adds the NTC to thermalCtlTemp().

(b) Pass/fail — §4-A

Check	Evidence (one line)	Result
U25 output formula / tolerance	0.8·(1 + 53.6/10.2) = 5.004 V; Vref 0.792–0.808 → 4.87–5.14 V	❌ set-point (A-04)
U25 RT / fsw / min on-time	162 k → 600 kHz; tON at 36 V = 244 ns ≥ 135 ns	✅
U25 inductor L22	10 µH ≥ Lmin 7.2 µH (36 V); SRP1265A Isat 15.5 A vs peak 3.1–3.4 A	✅
U25 current capability	≤ RS1 limit 2.14–2.41 A (+0.3 A fan with A-01) vs 3.5 A rating, 4.5 A min switch limit	✅
U25 Cout / ripple	2 × 47 µF X7R 1210 (≈ 56 µF eff) + 220 µF; ΔI 0.69 A, ΔV ≈ 3 mV	✅ value / ❌ C78 life (A-09)
U25 compensation	datasheet example; fco ≈ 4–6 kHz, PM > 60° (estimate)	✅ (A-18 Note)
U25 BOOT cap C152	100 nF, 1.49 mm edge	✅
U25 Cin value	2 × 2.2 µF/100 V X7R ≈ 3.4–3.8 µF eff ≥ TI 3 µF	✅ value / ❌ loop (F-03)
U25 soft start / inrush	1024 cycles / 600 kHz = 1.7 ms; ≈ 0.9 A into ≈ 280 µF	✅
U25 EN / UVLO	EN floats → on; internal UVLO 4.1–4.3 V	✅ (A-16 Note)
Vehicle-voltage exposure of other parts	U2 30 V abs max, D21 30 V, U20 42 V on unfused `/24V`	❌ A-01
Reverse polarity	Q23/Q10 IRFR5305 −55 V/65 mΩ, gate clamps D33/DzG1 ✅; but D10 ahead of F2 conducts on reversal	❌ V1-01
DzG1 netlisted (V5 corruption)	DzG1.1 `/Q10_GATE`, .3 `/24V`	✅
TVS standoff / polarity	SMCJ33A/SMBJ33A VRWM 33 V ≥ 32 V; pad 1 = K on + rail	✅ (A-19 Note)
F2 part / coverage	C206910 2 A assigned ✅; protects the U25 branch only	❌ A-01
24 V-to-LV inner clearance < 0.5 mm	6 inner spots, all `/IGN_IN` (worst 0.221 mm to `/VEH5V` on In2); `/24V` In1 at 0.15 mm to GND fill	❌ F-01, F-02
RS1 input limit	10 mΩ 1 W (C105362): 2.35–2.65 A (2.14–2.41 A with the CLN tap) < U25 3.5 A	✅
R50 charge current	825 Ω → 2.42 A (2.57 A max > 2.5 A IC max)	❌ A-03
LTC4040 PROG node	R50 1.26 mm from pin 2; `/PROG` 2.6 mm	✅
BSTFB (backup VSYS)	499 k/100 k → 4.60/4.79/4.99 V within 3.5–5.0 V; keep 499 k	✅ value / ⚠ placement (A-14)
PFI divider	270 k/100 k: fall 4.27/4.40/4.54, rise 4.38/4.51/4.66 V	✅ (FW `V5_PFI` stale)
RSTFB / RST	RSTFB tied to BSTFB (allowed), RST NC	✅
OVSNS	tied to VIN → OVP unused	⚠ A-10
NTC window RNTB	R55 10 k: hot pause 42.4 °C, resume 40.1 °C, cold −3.1 °C (B3380)	⚠ chemistry D1 pending
Chemistry straps	JP2 1-2 (Li-ion), JP3 F1 = 0, JP4 F0 = 1 → 4.00 V	✅
Safety timer	Li-ion 4.25 h, counts in CV only	✅
CHRG / FAULT to MCU	R57/R58 100 k to 3V3 → PB3/PB4	✅
CHGOFF default	R56 100 k pull-down → charger ON without MCU	⚠ A-11
BSTOFF	tied to GND → boost always armed	✅ / Note
Q7 ideal-diode orientation	AO4406A S = VIN_SW, D = MAIN5V	✅
L6 value / rating	2.2 µH, 8 A ≥ ILIMBST max 7.5 A	✅ value / ❌ placement (A-02)
SW_BAT / BAT_PLUS copper, U6 EP vias	0.5 mm + 0.25/0.30 mm necks; 1.0 mm; 0 EP vias	❌ A-02
CSYS	104 µF nominal, ≈ 57–69 µF effective (< 75 µF)	⚠ A-05
CBAT C35	22 µF ≥ 10 µF; 20.2 mm from L6.2	✅ value / ⚠ placement (A-02)
5 V path widths	`/VEH5V` In1 0.5 mm, `/VIN_SW` In2 0.8 mm at 2.5 A	❌ A-07
U20 FB	75 k/20 k → 3.70/3.80/3.90 V within A7670 3.4–4.2 V	✅
U20 RT / min on-time	200 k → 500 kHz; tON at 36 V = 211 ns ≥ 100 ns	✅
U20 UVLO on battery	falling ≈ 3.1–3.3 V vs VIN_MODEM ≥ 4.2 V (≈ 1 V margin; V5.5 had 0.1 V)	✅
U20 EN default	EN pull-up 1.5 µA (verify_1; not 5.5 µA) × R113 100 k = 0.15 V < 1.03 V → OFF	✅
U20 BST	C129 100 nF, 1.8 mm	✅
L20	4.7 µH (MWSA0804S-4R7), 5 A vs peak 2.2–2.7 A	✅ (land: H-03)
U2 FB / placement	4.99 V; divider at pin	✅ (rating ❌ A-01; Cin moot with A-01)
U12 FB	100 k/31.6 k → 3.18/3.33/3.48 V	✅ (EN ❌ E-01, loop ❌ F-03)
U21 AP2112K dropout	250 mV at 600 mA; F9P ≈ 0.1 A; SW_5V ≥ 4.5 V on battery	✅ (ramp ❌ C-02)
U17 AMS1117	LDO_IN ≈ 4.6 V on 24 V ✅; 4.27–4.67 V on battery	❌ A-08
Worst-case battery budget	2.25–2.33 A on MAIN5V at a GSM burst (91–97 % of guaranteed 2.5 A)	⚠ A-05
DFU-only power	DFU_VBUS → D13 → LDO_IN; D12 blocks back-feed into SYS5V	✅
K1 flyback	D6 1N4148W across the coil	✅
Fan PWM default	Rgs1 100 k → Q2 OFF at reset	✅
Q5 base (F9P rail) default	no base pull-down; floats in reset	⚠ D-09

4-B Modem A7670SA (U19), lessons F1 / F2 / F3, ECO A / B

Cross-references: U20 input topology → A-01 (absorbs B-01); U20 hot loop and Cin → F-03 (absorbs B-06); modem ground vias → F-12 (absorbs B-04); LTE feed on In1 → F-06 (absorbs B-05); J9 ESD → G-02 (absorbs B-07's ESD part); NC flags on PC6/PC7 → J-04 (absorbs B-11); stackup and netclasses → F-06 / F-01 (absorb B-12).

(a) Findings

B-03 · Blocker · LTE antenna ESD D28 is a unidirectional 5 V TVS on an RF line with no DC bias

Status: verified-with-correction (verify_1: the proposed PGB1010402KR is rated 12 VDC max operating, below the 14.1 V GSM peak; use PESD0402-240).

Evidence: D28 = C82326 onsemi ESD9L5.0ST5G, "Unidirectional, 0.9 pF, VRWM 5 V, VBR 5.4 V, VC 9.8 V", SOD-923; pin 1 (C) on /RF_ANT_LTE, pin 2 (A) on GND; in-line 1.8 mm from J13.1. A7670SA output (HD V1.03 Table 30; GSM supported per Table 1): GSM850/900 33 dBm ±2, DCS/PCS 30 dBm, LTE 23 dBm ±2.7. Peak voltage at 50 Ω, V = √(2·P·50): 23 dBm → 4.47 V, 33 dBm → 14.1 V; at VSWR 3:1 (×1.5) 6.7 / 21.2 V. SIMCom Fig. 33: "D1 is a Bidirectional ESD Protection device".
Consequence: the diode forward-conducts at ≈ −0.6 V on every negative half-cycle, even in LTE, and avalanches at 5.4 V on GSM positive peaks: hard clipping, spurious emissions (homologation), lost TX power, PA stress, D28 heating and likely failure (possibly shorting the antenna port).
Fix: D28 → Littelfuse PESD0402-240, LCSC C1975527 (bidirectional, 24 V working, 0.25 pF → −j335 Ω shunt at 1.9 GHz, |Γ| ≈ 0.07; stock 9394), or DNP D28 (SIMCom marks it optional). Either way needs an 0402 land in place of the SOD-923 (comes with the F-06 reroute). Keep D27 on the GNSS line (+3.2 V bias, no TX; a unidirectional 5 V part is correct there).
Effort: both.

B-02 · Major · VBAT_MODEM bulk is a general-purpose electrolytic; U20 compensation is the 5 V table row

Absorbs: A-09 (C130/C131), A-17. Status: verified, severity changed Blocker → Major (verify_1: works on day 1, fails cold or aged; BOM-only fix on the same land).

Evidence: C130, C131 = C2827940 SamYoung MVG 16 V 220 µF 6.3 × 7.7 (value field reads "220uF/10V"), −40…+85 °C, 2000 h @ 85 °C, 130 mA ripple: not polymer. Placement: C131 8.70 mm, C130 16.26 mm from U19.55–57; nearest cap to L20.2 is C130 at 10.1 mm. Low-ESR output capacitance is only C132 22 µF + C133 1 µF + C134 100 nF ≈ 14 µF effective (SIMCom asks ≥ 300 µF, HD V1.03 p.27). Compensation R116 14 k / C141 3.3 nF / C142 47 pF = the AP64350 Table 1 VOUT = 5.0 V row (designed for 2 × 22 µF ceramic). FB R110 75 k / R111 20 k → 3.80 V (3.67–3.94 V worst case) ✅. Life ≈ 8 000 h at 65 °C.

Condition (verify_1 averaged current-mode model)	2 A GSM burst droop	0.7 A LTE
Battery via D21 (4.42 V), MVG new (ESR 0.2 Ω pair)	0.28 V (VBAT 3.52 V)	0.08 V
Same, cold / aged (0.6 Ω pair)	0.52 V (3.29 V < 3.4 V min)	0.13 V
Battery, polymer + 113 k / 6.8 nF / 56 pF	0.06 V	0.02 V
Battery, polymer with the as-is 14 k	0.18 V (PM ≈ 27°)	0.06 V

Consequence: within SIMCom's 300 mV limit on day 1 with LTE-only on battery; with cold or aged caps GSM bursts pull VBAT below 3.4 V → "modem dark" likely within about a year. Reliability failure → Major.
Fix (change caps and compensation together): C130, C131 → C881921 (Lelon OVZ 220 µF/16 V polymer, 105 °C/2000 h, 6.3 × 7.7, stock 2442); R116 14 k → 113 k 1 % (C22862, stock 59 728); C141 3.3 nF → 6.8 nF X7R 0402 (C1542); C142 47 pF → 56 pF C0G 0402 (C1572) (C141/C142 are 0402 today); add 2 × 22 µF 0805 (C86817, stock 4144) at L20.2 ≤ 3 mm. Checks: R5 = 4.67e3·14 kHz·3.8 V·454 µF = 112.8 k; C5 = 3.8·454 µ/(2 A·113 k) = 7.6 nF; zero 207 Hz, fc 14 kHz, C6 pole 25 kHz → PM ≈ 60°. 113 k is valid only with the polymer bank (with MVG the ESR zero ≈ 1.8 kHz sits below fc). A-17's alternative (R116 = 10 k with polymer) gives PM ≈ 15° and is rejected (verify_1 conflict (c)). Move C131 ≤ 5 mm from U19.55–57 (B-08). Bench: 0.1 → 2 A step on VBAT_MODEM, droop ≤ 150 mV, no ringing.
Effort: both (BOM values + 2 caps + C131 move).

Minor (B) — not independently verified

B-08 · Minor · VBAT_MODEM feed: 0.5 mm neck into pins 55–57; 1 mm over 7 mm; no pour. F.Cu 48.9 mm (0.25/0.5/1/1.5/2 mm) + In1 6.3 mm, 2 vias; final feed 0.5 mm × 2.5 mm into U19.55 then 0.5 mm × 2.0 mm to 56/57. L20.2 → U19.55 12.5 mΩ, drop at 2 A 25–29 mV (static, fine). verify_2 J-02: 12.5 mm under capacity. Consequence: violates SIMCom's VBAT width rule (≥ 3 mm V1.03), adds loop inductance between bulk and pins. Fix: F.Cu pour ≥ 3 mm from L20.2 → C130 → C131 → C132–C136 → U19.55/56/57, fanned to all three pads; C131 ≤ 5 mm from the pads. Effort: layout.
B-09 · Minor · SIM interface: 0 Ω instead of 22 Ω; ESD 22–25 mm from J14; VDD cap 13.5 mm away. J14 (C2977286) + R131–R134 0 Ω populated, U22 + R127–R130 DNP ✅. D23/D24/D25 PESD5V0S1BA (C2827694) sit 1.3–5.7 mm from U19 but 21.7–24.8 mm from J14; C126 100 nF 13.5 mm from J14.C1; /SIM_VDD unclamped. Fix: R132/R133/R134 → 22 Ω 0603 (C23345, Basic); add 100 nF 0402 (C1525) at J14.C1; move D23–D25 next to J14 (an ESDA6V1W5-class array covering VDD is an option; no LCSC selected). Keep F.Cu clear under U22's die-pad zone if MFF2 is ever fitted. Effort: both.
B-10 · Minor · Undefined idle levels on the modem interface; RTCM-tap resistor too small — absorbs D-14. U24 (VCCA = /1V8_MODEM) is Hi-Z whenever the modem is off, so /MODEM_STATUS (PC9) and /DOUT_4G float; /DIN_4G floats during the K1 transfer and with the F9P off. R106 = 100 Ω between U24 1B and PC7: a mis-configured PC7 output would see ≈ 33 mA (> 25 mA pin limit). Fix: 100 k (C25803) /MODEM_STATUS → GND; 100 k (C25803) /DIN_4G → /3V3; R106 100 Ω → 1 kΩ (C14676) (ECO §B value; 1 k × ≈ 5 pF = 5 ns, fine to 921 600 Bd). Effort: schematic-only (+ 2 small footprints).

Notes (B) — not independently verified

ID	Observation	Action
B-16	Cold start on battery (brief §4-B explicit statement). With VSYS 4.79 V: PMEG3050EP as-is, GSM 2 A → VIN(U20) 4.44 V, MAIN5V 2.28 A (OK, 9 % margin to 2.5 A); 2.8 A peak (HD V1.00) → 3.08 A, over the backup limit; D21 replaced by a link (A-01) → 4.70 V, 2.17 A (13 % margin); LTE 1.0 A with link → 1.27 A. U20 UVLO (3.5–3.7 V rising) is never approached (VIN ≥ 4.2 V). Yes, v6 can bring the modem up from the LTC4040 boost alone, provided (1) the modem is enabled only after the F9P rail has settled, (2) the modem is LTE-only on battery, (3) the W5500 is off (E-01), and (4) the VBAT bank is fixed (B-02). Otherwise LTE-burst droop, not UVLO, is the failure mode. R2 hardware path: EN low stops U20; VBAT decays through R112 1 kΩ, τ 0.46 s → 47 mV after the 2 s HARD_CYCLE.	Firmware sequencing (§8). Bench-check VBAT at MAIN5V = 4.6 V with a 2 A load (AP64350 max duty not stated in DS41976).
B-13	K1 fail-safe premise is obsolete: the A7670SA has no NTRIP client, and an MCU reset also switches the modem off (R113) and releases K1. Coil 5 V × 30 mA = 150 mW while Mode B is held.	No hardware change for v6; firmware energises K1 only while the modem is on; consider a direct PC6 → DIN_4G link in v6.1.
B-14	Everything the modem prints (AT replies, URCs, socket headers) reaches F9P UART2 RXD. No contention (single driver U24).	Firmware: F9P UART2 in-protocol RTCM3 only at 115 200; caster socket transparent (`AT+CIPMODE=1`) or MCU re-assembly → USART2 → F9P UART1.
B-15	R107/R108 "bypass the shifter" DNP 0 Ω footprints cannot work: fitted without the shifter they put 1.8 V on F9P RXD2 (VIH 2.64 V) and 3.3 V on modem RXD (abs max 2.0 V).	Delete them or add a "never fit" note.

(b) Pass/fail — §4-B

Check	Evidence (one line)	Result
A7670SA footprint / pin numbering	LGA-124 matches HD V1.03 (VBAT 55–57, RF_ANT 60, STATUS 66, VDD_1V8 15, UART 9/10, USIM 30–34)	✅
U20 source	`/VIN_MODEM` from unfused `/24V` via D20 and from MAIN5V via D21 (30 V)	❌ A-01
U20 EN default OFF	EN pull-up 1.5 µA × R113 100 k = 0.15 V < 1.03 V	✅
U20 output set-point	75 k/20 k → 3.80 V; worst 3.67–3.94 V within 3.4–4.2 V	✅
U20 frequency / min on-time	R117 200 k → 500 kHz; tON at 40 V = 190 ns > 100 ns	✅
U20 compensation vs datasheet for 3.8 V	5 V Table 1 row applied at 3.8 V; PM ≈ 27° with polymer and 14 k	❌ B-02
U20 input caps	C127 10 µF 50 V + C128 1 µF; ≈ 65 mV p-p ripple at 2 A; GND 6.86/8.48 mm, 0.25 mm neck	❌ F-03
L20 saturation	4.7 µH MWSA0804S, ≥ 8.7 A family Isat vs 2.7 A peak	✅ (land: H-03)
L20 / C129 / COMP / RT placement	L20 2.24 mm, BST 1.8 mm, COMP 0.72 mm, RT 1.44 mm	✅
SW_MODEM copper	1.0 mm × 6.6 mm, 2.2 mΩ (was 0.25 mm × 23 mm on 25-Sep)	✅
Bulk ≥ 220 µF polymer within 10–20 mm	2 × 220 µF MVG electrolytic at 8.70 / 16.26 mm	❌ B-02 (type)
VBAT track width ≥ 0.25 mm / vendor ≥ 3 mm	0.5 mm neck into pins 55–57, 1 mm over 7 mm	⚠ B-08
VBAT HF ceramics	C133–C136 1.7–2.7 mm, C132 4.1 mm from VBAT pads	✅
D22 polarity	SMAJ5.0A pad 1 = cathode on `/VBAT_MODEM`	✅
VBAT bleed for HARD_CYCLE	τ = 0.46 s → 47 mV after 2 s EN low	✅
PWRKEY / RESET drive	2N7002 open-drain, 100 k gate pull-downs, no caps	✅
Level shifting to 1.8 V	U23 DIR = GND (3.3 → 1.8 V into modem RXD); U24 DIR = VCCA (TXD + STATUS up); unused 2B tied	✅
Back-powering of the modem	74LVC2T45 Ioff with VCCA = 0; PWRKEY/RESET open-drain; only 1.8 V on `_M` nets	✅
STATUS readback	U24 2A→2B, VOH ≈ 3.3 V vs PC9 VIH 2.31 V; floats when modem off	✅ / ⚠ B-10
UART contention	`/DOUT_4G` single driver (U24); `/DIN_4G` via break-before-make K1	✅
RTCM visibility (R106 tap)	GGA field 13 on USART2 (PA3) + raw RTCM3 on USART6 RX (PC7); R106 100 Ω too small	✅ / ⚠ B-10
USART allocation	USART6 PC6/PC7 AF8, USART2 PA2/PA3, USART1 RX PA10; PA9 free	✅
USB_BOOT	TP8 floating (not pulled low at power-up)	✅
SIM population / eSIM	J14 + R131–R134 fitted; U22 MFF2 + R127–R130 DNP; USIM1_DET NC	✅ (details B-09)
LTE π-pad	R118 0 Ω + C146/C147 DNP at J13	✅
LTE antenna ESD	unidirectional ESD9L5.0 on a 14.1 V-peak TX line	❌ B-03
LTE feed geometry	22.14 mm on In1, 2 via transitions, 32–47 Ω, 1 fence via	❌ F-06
Modem ground vias	1 GND via under U19; U20 EP 0 vias; J13 20–21 mm to a via	❌ F-12
J9 modem USB ESD	none	❌ G-02
Cold start on battery (R1)	possible with sequencing, LTE-only, W5500 off and B-02 (B-16)	⚠ needs fixes + firmware

4-C GNSS ZED-F9P (U18)

Cross-references: F9P back-power through U24 → D-01 (§4-D, absorbs C-06); F9P ground vias → F-12 (absorbs C-03); GNSS RF line and bias-line coupling → F-06 (absorbs C-05).

(a) Findings

C-01 · Blocker · GNSS antenna bias has no current limit and no supervisor; ANT_DETECT / ANT_SHORT_N are undriven

Absorbs: D-07. Status: verified (verify_1).

Evidence: /VCC_RF_GNSS = {U18.7, L21, C144, C145}; L21 = C162555 LQG18HN68NJ00D, 68 nH, 0.8 Ω, 400 mA, SRF 1 GHz (u-blox recommends 120 nH). ZED-F9P-04B DS R05: pin 4 ANT_DETECT = input (active high), pin 5 ANT_OFF = output, pin 6 ANT_SHORT_N = input (active low); VCC_RF 50 mA operating, 300 mA abs max. On v6 pins 4/6 connect only to PC1/PC2 (MCU inputs), so nothing drives them; U18.5 ANT_OFF is NC. u-blox IM UBX-18010802 R02 §8.6: "a 10 Ω current limiting resistor is required to prevent against short circuits destroying the BIAS-T inductor."
Consequence: a crushed or wet coax (the H0005/H0014 field fault class) lets U21 (AP2112, current limit ≈ 0.6–0.8 A) push more than VCC_RF's 300 mA abs max and L21's 400 mA, collapses 3V3_GNSS into an F9P brown-out loop, and the PC1/PC2 "antenna telemetry" never reports it. Hardware-damage path.
Fix: add TPS2552DBVR, LCSC C46506 (SOT-23-6, stock 3002). Pinout 1 IN / 2 GND / 3 EN̅ / 4 FAULT̅ / 5 ILIM / 6 OUT. IN = /3V3_GNSS; OUT → new net /ANT_BIAS = L21.2 + C144 + C145; ILIM tied to IN → 75 mA typ (VIN 2.5–6.5 V; constant current into a short, ≈ 0.25 W at 3.3 V; FAULT̅ deglitch 7.5 ms); EN̅ ← U18.5 ANT_OFF with 100 k (C25803) to GND (antenna ON by default; ANT_OFF high → antenna off, matching the F9P's active-high ANT_OFF); FAULT̅ → /GNSS_ANT_SHORT_N (U18.6 + PC2) with 10 k (C25804) to /3V3_GNSS; leave U18.7 VCC_RF NC. ANT_DETECT stays unimplemented (infer open antenna from C/N0). U21 load becomes 130 mA + 75 mA. The 10 Ω series fallback gives 3.2 V/10.8 Ω ≈ 0.30 A, right at VCC_RF's abs max: acceptable only as u-blox's stated minimum, and no LCSC is selected for it in the findings.
Effort: both.

C-02 · Major · U21 AP2112K has no soft-start: the ZED-F9P VCC ramp window (20–8000 µs/V) is met only by an unspecified margin

Status: verified, Major at the low end (verify_1).

Evidence: U21 = AP2112K-3.3 (C51118), EN tied to VIN (/SW_5V), starts when Q1 switches /SW_5V (no gate RC). AP2112 DS39724: tS = 20 µs at no load, 50 mA foldback short-circuit current, no soft-start. /3V3_GNSS ≈ 18 µF (2 × 10 µF X5R + 3 × 100 nF). Ramp: ≈ 400 µs/V at start → ≈ 28 µs/V near regulation, ≈ 80 µs/V average: inside 20–8000 µs/V (ZED-F9P DS Table 15), but the fast-end margin (≈ 1.4×) depends on the AP2112's unspecified current-limit maximum. The F9P is power-cycled every 10-min window (R1: ≈ 52 000 starts/year).
Consequence: occasional failed F9P start (dark receiver until the next cycle) in exactly the duty-cycled mode R1 requires.
Fix: U21 → TPS7A2033PDBVR, LCSC C2862740 (same DBV pinout 1 IN / 2 GND / 3 EN / 4 NC / 5 OUT; t_STR 750–1150 µs → 239–367 µs/V; current limit ≥ 360 mA > 20 µF·3.3 V/0.75 ms = 88 mA + load; VIN max 6.0 V vs SW_5V ≤ 5.46 V; COUT 0.47–200 µF; stock 28 370). Bench: scope /3V3_GNSS rise (target 100–1000 µs/V).
Effort: schematic-only (drop-in).

C-04 · Major · GNSS supply switch Q1 sits 9 mm from the LTE antenna feed; `/SW_5V` crosses the board on In1

Status: verified (verify_1).

Evidence: Q1 AO3401A (/SW_IN → /SW_5V) at (197.28, 59.81) = 9.0 mm from J13, Q5 7.1 mm (centres); F1 at (171.4, 44.3) in the LTE corner. /SW_5V Q1.3 → U21.1: In1 181.32 mm + F.Cu 19.7 mm, 2 vias (95 mΩ at 35 µm, 184 mΩ at 17.5 µm inner copper). The In1 section of RF_LTE passes 0.21 mm under /SW_IN and /SYS5V.
Consequence: the F9P supply starts in the LTE transmitter's near field and travels ≈ 17–20 cm as a slot in the GND plane; LDO PSRR at LTE frequencies ≈ 0 dB, so TX envelope/IMD products ride into the receiver rail (desense, the brief's #1 risk), and In1 is cut end to end (F-05).
Fix (layout): move Q1 + Q5 + R1 + R2 (F1 optional) into the GNSS island next to U21/C3/C40/C119; bring /SYS5V (or /SW_IN) to it instead; keep /PWR_CTRL as the long signal; route the remaining feed on F.Cu or In2 away from the RF lines. Target /SW_5V ≤ 15 mm and 0 mm on In1.
Effort: layout.

Minor (C) — not independently verified

C-07 · Minor · No test pad on SAFEBOOT_N. U18.50 SAFEBOOT_N NC; V_USB/USB_DM/USB_DP NC; the only access is UART1 through the MCU bridge (P17 removed). Consequence: a failed F9P firmware update over the passthrough cannot be recovered (safeboot needs SAFEBOOT_N low at power-up). Fix: 1 mm test pads on U18.50 (SAFEBOOT_N) and U18.49 (RESET_N) next to a GND pad; no resistor. Effort: both.

Notes (C) — not independently verified

ID	Observation	Action
C-08	Identity: no `$GPTXT H00xx` source on v6 (the ArduSimple NTRIP Master is gone; A7670SA and F9P emit no unit ID). FW 0.6.0-eth builds `$PHID,<96-bit UID>,<fw>,<board>,<MAC>,<up_s>` (L718–724) but sends it only on the Ethernet TCP mirror. Lesson F9.	FW 0.7.x sends `$PHID` on the modem uplink at every connect and every 5 min; backend `retranslator` maps UID → H-number before v6 ships.
C-09	V_BCKP (U18.36) on the always-on `/3V3` → hot start after each 10-min off (45 µA) ✅; its decoupler Cu4 (100 nF) is 4.06 mm from pin 36.	Optional: move Cu4 ≤ 2 mm.

(b) Pass/fail — §4-C

Check	Evidence (one line)	Result
VCC ramp window 20–8000 µs/V	AP2112 no soft-start: ≈ 28 µs/V near regulation, margin unspecified	⚠ C-02
RTK_STAT	U18.20 → PC3 (output → MCU input)	✅
TIMEPULSE	U18.53 → PA7 (TIM3_CH2 / EXTI7)	✅
RESET_N	PC12 + R105 10 k to /3V3_GNSS (open-drain drive in firmware)	✅
SAFEBOOT_N	NC, no pad	⚠ C-07
V_BCKP	on always-on /3V3, 45 µA; Cu4 at 4.06 mm	✅ (C-09 Note)
Antenna bias current limit / short detect	none; ANT_DETECT/ANT_SHORT_N undriven F9P inputs	❌ C-01
DC block / bias-T	C143 0.56 mm from J12; L21 68 nH still −j455 Ω at L1 despite 1 GHz SRF	✅
GNSS ESD D27	unidirectional 5 V, cathode on line, bias 3.2 V < VRWM	✅
50 Ω trace geometry on the real stackup	0.5 mm / 0.15 mm gap → 38–41 Ω on JLC04161H-7628; `/VCC_RF_GNSS` 0.274 mm alongside over 3.3 mm	❌ F-06
RF_GNSS over a solid plane	0 In1 slot crossings	✅
F9P decoupling	C121/C122 1.7 mm, C120/C124 2.4–2.5 mm, U21 4.4 mm from VCC pins	✅
UART / I²C / SPI to MCU	UART1 ↔ USART2 PA2/PA3; UART2 RX ← modem, TX → PA10 / K1 NC; D_SEL open = UART	✅
u-center passthrough via J11 (P17 removed)	only through the MCU USB-CDC bridge to USART2 (firmware must follow CDC line coding)	✅ (firmware item)
F9P back-powering while off	U24 drives 3.3 V into unpowered RXD2	❌ D-01
Supply switch distance from LTE feed	Q1 9.0 mm from J13; `/SW_5V` 181 mm on In1	❌ C-04
GNSS island vs switchers ≥ 25 mm	nearest SW copper `/ETH_SW` 27.5 mm, L8 35.3 mm	✅
Island separation	J13 ↔ J12 150.3 mm; U19 ↔ U18 108.9 mm	✅
F9P ground vias	0 vias under U18; 946 mm² cluster with 5 vias	❌ F-12
Identity without `$GPTXT` (lesson F9)	no H00xx source on v6; `$PHID` on Ethernet only	⚠ C-08 (firmware)
MCU UID path for identity	96-bit UID at 0x1FFF7A10 used by 0.6.0-eth	✅

4-D MCU pin map vs firmware 0.6.0 (U16 STM32F411RET6)

The full 64-pin table is in §4 of this report (condensed) and in pinmap-v6.md (complete, with AF/ADC/EXTI, V5 macro and proposed v6 macro per pin). Cross-references: ETH_RST pull-down → E-02 (absorbs D-04); raw ignition on In2 → F-02 (absorbs D-06); antenna pins PC1/PC2 → C-01 (absorbs D-07); PFO → A-13 (absorbs D-10); NC flags on connected pins → J-04 (absorbs D-11); MODEM_STATUS pull → B-10 (absorbs D-14); Y2 value text → H-08 (absorbs D-16).

(a) Findings

D-01 · Major · U24 back-powers the unpowered ZED-F9P through RXD2

Absorbs: C-06. Status: verified-with-correction (verify_2: use the Nexperia gate C12518, not the clone; the 10 k series-R alternative is not enough).

Evidence: U24 74LVC2T45: VCC(A) = /1V8_MODEM, VCC(B) = /3V3 (always on), DIR = VCC(A) (A→B). /DOUT_4G = {U24.7 (1B), R106.1, R107.2 (DNP), U18.26 RXD2}; /3V3_GNSS = U21 output + U18.33/34 only (switched by PA1 → Q5 → Q1). ZED-F9P-04B DS R05 Table 14: input −0.5 … VCC + 0.5 V for VCC ≤ 3.1 V, so at VCC = 0 a 3.3 V push-pull high exceeds it by 2.8 V. The 74LVC2T45's Ioff protects only the modem side (U23), not U24's B output into a dead load. Smaller paths into the same receiver: Rdfu1 22 k → /3V3 on /USART1_RX (U18.27) ≈ 0.12 mA; PA10 internal pull-up 7–14 kΩ (≈ 0.5 mA if left enabled); PC7 pull-up via R106 (≈ 70 µA); PA2/PC12 if driven high. Same mechanism as the FW 0.5.5/0.5.6 lesson (idle-high UART held the V5.5 rails up through ESD diodes).
Consequence: whenever the modem is up and PA1 is low, the F9P rail sits pre-biased (≈ 2–2.7 V, auditor estimate): no clean ramp, F9P power-cycle recovery silently fails, RXD2 ESD structure stressed. Firmware can avoid it only by never having the modem on with the F9P off (rules out F9P-only recovery with the modem registered). Major, not Blocker, because that sequencing avoids it (verify_2).
Fix: add U27 = Nexperia 74LVC1G125GV,125, LCSC C12518 (SOT-753: 1 OE̅, 2 A, 3 GND, 4 Y, 5 VCC; datasheet Rev 17.1 "IOFF … partial power-down", ±2 µA), VCC = /3V3_GNSS, OE̅ = GND, 100 nF C14663 at VCC; A = /DOUT_4G, Y = new net /DOUT_4G_F9P → U18.26. PC7/R106 stay on /DOUT_4G (moving U24's VCCB to /3V3_GNSS would kill MODEM_STATUS and the RTCM tap with the F9P off, R2). Do not use the TECH PUBLIC clone C3040595. Rdfu1 22 k → 100 k (C25803) (≤ 27 µA into U18.27). Rejected: 10 k in series at U18.26 (≈ 0.28 mA, the same order as the leakage that held the V5.5 modem rail at ≈ 1 V). Bench: /3V3_GNSS < 0.3 V with PA1 low and the modem on.
Effort: both (1 IC + 1 cap + short reroute at U18.26).

Minor (D)

D-02 · Minor · HSE crystal 8.3/11.3 mm from the MCU; HC-49S CL 20 pF crystal at the ST start-up gm limit — absorbs F-11 (Y3 part). Status: verified (verify_2). Y3 = C14872 (CL 20 pF, −20…+70 °C) pad edge → PH0/PH1 8.32 / 11.30 mm; C113/C114 15 pF (C1644) → CL_eff 12.5–17.5 pF; gm_crit 1.21–2.37 mA/V at ESR 40 Ω vs Gm_crit_max 1 mA/V (DS10314 Table 37): passes at typical ESR; V5.5 as-fabbed has the same parts at 11.9–13.7 mm and starts in the field. In1 /USART6_RX crosses both HSE lines under Y3; /BAT_PLUS on all four layers beside it (F-11). ROM DFU and the USB clock depend on HSE. Fix: Y3 → C2901684 (SCTF 3225-4P, 25 MHz, CL 10 pF, ESR 30 Ω, −40…+85 °C, stock 11 076; footprint Crystal:Crystal_SMD_3225-4Pin_3.2x2.5mm) + C113/C114 → 12 pF C0G (C38523) → CL_eff 9.5 pF, gm_crit 0.46 mA/V (2.2× margin); ≤ 3 mm from PH0/PH1, no inner track under the crystal or its lines. Verifier conflict: verify_2 prefers C9006 (YXC 3225, CL 12 pF, Basic, 528 k stock) with the existing 15 pF C1644 (≈ 0.77 mA/V at ESR 40 Ω) after confirming its ESR; verify_1 (f) left Y3 to the MCU auditor, who chose C2901684. This report picks C2901684 because its ESR is stated in the listing and its margin is larger; C9006 is the Basic-part alternative once its ESR is confirmed. Effort: both.
D-03 · Minor · LSE crystal load and gm do not suit the F411 low-drive LSE (not independently verified). Y4 = C32346 FC-135 (CL 12.5 pF, ESR 70 kΩ max); C115/C116 12 pF → CL_eff ≈ 9 pF (+44 ppm ≈ 3.8 s/day); gm_crit 2.16 µA/V at max ESR (≈ 1.1 typ) vs Gm_crit_max 0.56 µA/V low-drive / 1.50 high-drive (DS10314 Table 38); pads 5.54/7.91 mm centre (3.92/6.32 mm pad edge, F-11). Consequence: LSE may fail to start in the default low-drive mode; an RTC wake from STOP falls back to LSI (±5–10 %). Fix: Y4 → C48615 (FC-135, CL 7 pF, stock 101 k) + C115/C116 → 6.8 pF C0G (C1679) → CL_eff ≈ 6.9 pF, gm_crit 0.76 µA/V max ESR; ≤ 3 mm from PC14/PC15; firmware sets LSEMOD (high-drive) before LSEON, LSI fallback. Effort: both.
D-05 · Minor · IGN_SENSE read digitally cannot detect a 12 V ignition; ADC saturates at 28.6 V (not independently verified). Ratio 2.870 k/(22 k + 2.870 k) = 0.1154: 12 V → 1.385 V (1.30 V with the INPUT_PULLDOWN of board_v5.h), 24 V → 2.77 V, 28 V → 3.23 V; VIH 2.31 V → a digital HIGH is guaranteed only above 20.0 V; ADC full scale at 28.6 V. Fix: firmware reads PA5 on the ADC with thresholds (for the as-is ratio: ON > 0.60 V ≈ 5.2 V in, OFF < 0.35 V), no internal pull; hardware Rigb1 3.3 k → 2.2 k (C4190, Basic) → ratio 0.0833: 12 V → 1.00 V, 24 V → 2.00 V, 36 V → 3.00 V, linear to 39.6 V; new $PHLG field vign. Effort: firmware (+ schematic value).
D-08 · Minor · No hardware board ID: a V5.6 binary on v6 drives PC3 against the F9P's RTK_STAT output (not independently verified). V5.6 drives PC3 push-pull as MODEM_EN; v6 PC3 = U18.20 RTK_STAT (push-pull output); PC1/PC2 are F9P inputs on v6. Fix: 10 k (C25804) strap → GND on a spare pin; firmware reads it with INPUT_PULLUP at boot (v6 build requires 0, V5.6 build requires 1, else outputs off and BOARD MISMATCH). Open conflict: D-08 proposed PD2, which verify_1 (h) assigns to E-01 (ETH_PWR_EN); the only spare left is PA9, which D-12 wants as a debug TX pad. Leo to choose (§10). Effort: schematic + 1 short trace.
D-09 · Minor · PWR_CTRL has no default-off pull at Q5's base — absorbs A-12 (not independently verified). /PWR_CTRL = {U16.15, R1.1}; /BASE_LS = {R1.2, Q5.1}; PA1 floats in reset/DFU; worst-case leakage ±1 µA × hFE ≈ 100 → up to 100 µA through R2 10 k → ≈ 1 V gate drive on Q1 AO3401A (VGS(th) −0.5…−1.3 V). V5.5 identical and fielded (typical leakage nA). Fix: 100 k (C25803) /BASE_LS → GND next to Q5 (A-12's 47 k had no LCSC; 100 k C25803 is already in the BOM). Effort: both.
D-12 · Minor · No UART TX pad for a TX-only log / ROM USART bootloader; SWD pads scattered (not independently verified). PA9 (USART1_TX, pad 42) NC; ROM USART1 bootloader runs on HSI but needs PA9; SWD = TP3 (109.0, 69.7), TP4 (112.5, 76.2), TP5 (110.0, 74.7), GND TP6 17.6 mm from TP3, 3V3 TP7; no SWO (PB3 = CHRG_STAT). Fix: TP9 (TestPoint_Pad_D1.5mm, no BOM part) on PA9 next to TP3–TP5; optional DNP 1×5 2.54 mm footprint (3V3, SWDIO, SWCLK, NRST, GND) or a Tag-Connect TC2030-NL land (no BOM cost). Effort: layout (+ schematic pad).

Notes (D) — not independently verified

ID	Observation	Action
D-13	EXTI3 shared by PC3 RTK_STAT and PB3 CHRG_STAT; EXTI9 by PB9 ACC_INT1 and PC9 MODEM_STATUS; PA6 fan (TIM3_CH1) and PA7 PPS (TIM3_CH2) share TIM3.	EXTI9 → PB9 (motion wake); poll PC9 and PB3; fan stays GPIO ON/OFF so TIM3 is free for PPS capture.
D-15	Nearest 100 nF per VDD pin (centre): VDD19 3.29 mm, VDD32 3.65, VDD48 2.10, VDD64 3.90 (shared with VBAT pin 1), VDDA 3.13, VCAP1 3.19.	Tighten to ≤ 2 mm in the layout pass if convenient.

(b) Pass/fail — §4-D

Check	Evidence (one line)	Result
U16 symbol vs ST LQFP64	64/64 pin numbers and names match ST open-pin-data	✅
Pin-map coverage	64/64 rows (`pinmap-v6.md`, §4)	✅
Firmware pins unconnected on v6	`PIN_USART1_TX` PA9 NC (Mode-B TX moves to PC6 USART6_TX); TMP102 0x48 and PCF P7 modem-reset absent	⚠ firmware delta (§8)
v6 nets with no firmware counterpart	PA7, PC1–PC4, PC6–PC12, PB9	⚠ firmware delta (§8)
ADC nets on ADC pads	PA0/IN0, PA4/IN4, PA5/IN5, PB1/IN9, PC4/IN14; spare PC5/IN15	✅
AF conflicts	USART2 AF7, USART6 AF8, USART1_RX AF7, SPI2 AF5, I2C1 AF4, OTG AF10, SWD AF0: no overlap	✅
5 V on a non-FT pin	none; TC pins carry PA0 ≤ 2.10 V and PB5 (output)	✅
1.8 V modem signals reaching the MCU	none (U23/U24, Q20/Q21)	✅
PWM (fan) timer	PA6 TIM3_CH1 shares TIM3 with PPS capture on PA7; fan is ON/OFF	✅ (D-13 Note)
EXTI allocation	EXTI3 and EXTI9 each shared by two pins	⚠ D-13
Modem control defaults in reset	R113/R114/R115 100 k pull-downs on PC10/PC8/PC11	✅
F9P rail default in reset	Q5 base floats	⚠ D-09
Charger default in reset	R56 pull-down → charger ON	⚠ A-11
BOOT0 / BOOT1 DFU trap	R98 10 k PD + SW2; PB2 only R99 10 k PD; ETH_INT on PC0	✅
NRST routing (SW1, P6, C104)	C104 100 nF at 3.26 mm; SW1 pad pairs correct; P6 RESET-EXT; TP5	✅ (P6 ESD: G-08)
SWD access	TP3/TP4/TP5 pads, no header, GND TP 17.6 mm away, no SWO	⚠ D-12
DFU ESD at J11	D14/D15/D16 at 3.19/6.74/6.83 mm; CC 5.1 k × 2; VBUS diode-OR D12/D13	✅ (stubs: F-14)
VCAP1 / VDDA	C111 4.7 µF at 3.19 mm; R104 10 Ω + 1 µF + 100 nF	✅
CHRG_STAT / FAULT inputs	R57/R58 100 k → /3V3 on PB3/PB4	✅
PFO input	`/PFO_TP` goes to TP2 only	⚠ A-13
IGN_SENSE divider (Rig 22 k) and junction	Rig1.2/Rig2.1/Rigb1.1/C9/D5/U16.21 on one net, sch and PCB (6 pads, 1 group); V5.6 junction loss not present	✅
IGN clamp orientation	D5 K → /3V3, A → /IGN_SENSE	✅
IGN digital threshold for 12 V vehicles	HIGH guaranteed only above 20.0 V	⚠ D-05
I²C address map	0x18 SC7A20, 0x20 PCF8574, 0x44 SHT40, 0x4D SC16IS752: no clash (TMP102 0x48 would also fit)	✅
NC flags on connected pins hide an error?	U16.37/38, U10.13/14 nets real in netlist + IPC-356, routed	✅ (cosmetic: J-04)
HSE ≤ 5 mm	8.32 / 11.30 mm pad edge	❌ D-02 (Minor)
LSE ≤ 5 mm	3.92 / 6.32 mm pad edge (5.54 / 7.91 mm centre)	⚠ D-03
F9P back-feed from MCU-side logic	U24 → U18.26 with the F9P off	❌ D-01
ETH_RST pull-down	none; 100 k would not work	❌ E-02
Hardware board ID	none; mis-flash drives PC3 against RTK_STAT	⚠ D-08

4-E Ethernet W5500 (U11), lesson F8

Cross-references: J10/P11/P12 DNP and footprint parity → G-03 (absorbs E-05); J9 (modem USB) ESD → G-02; U12 hot loop and FB node → F-03 (absorbs F-09).

(a) Findings

E-01 · Major · 3V3_ETH is not switchable: the W5500 is powered on battery and during MCU reset (lesson F8 repeated)

Absorbs: A-05 fix 1. Status: verified (verify_1).

Evidence: U12 (MP1584EN) pin 2 EN = /SYS5V = pin 7 VIN → on whenever SYS5V exists (vehicle and battery). W5500 DS v1.0.2: 128 mA (100M link), 75 mA (10M), 13 mA power-down. J10 is DNP on the PCB but U11/U12 are populated, so the draw exists even without a jack. MP1584 EN: internal 1 µA pull-up to ≈ 3 V, rising threshold 1.5 V, abs max 6 V. W5500 VIH max 5.5 V (5 V-tolerant I/O), so MCU-driven SPI/RST lines do not back-power a gated 3V3_ETH.
Consequence: a permanent ≈ 0.05–0.6 W battery load; even the 13 mA power-down current costs ≈ 57 mW from the battery, more than the whole 20–50 mW sleep floor. Hardware gating is required for R1's energy target.
Fix: new net /ETH_PWR_EN: U12.2 (EN) → U16 pad 54 PD2, with 100 k (C25803) to GND → EN at 0.1 V (OFF) in reset/DFU/battery; PD2 at 3.3 V turns it on. PD2 allocation per verify_1 conflict (h).
Effort: both (1 resistor, 1 track).

E-02 · Major (Minor once E-01 is in) · `/ETH_RST` has no pull-down; the 100 k proposed in the lessons review could never work

Absorbs: D-04. Status: verified-with-correction (verify_1: the W5500 RSTn has its own internal pull-up, so 100 k fails even without PA15; D-04's "PD2 + 100 k" also fails).

Evidence: /ETH_RST = {U11.37, U16.50 PA15}. PA15 resets to JTDI with pull-up (RM0383: GPIOA_PUPDR reset 0x6400 0000), R_PU 30–50 kΩ (DS10314). W5500 RSTn internal pull-up 62–112 kΩ (DS v1.0.2 §5.3); VIL 0.8 V; Schmitt VT− 0.95–1.09 V. 100 k pull-down: 3.3·100/(100 + 30k∥62k = 20.2 k) = 2.75 V (reads HIGH); with PA15 floating 1.56–2.04 V (undefined or high). 4.7 k: worst case 3.3·4.7/(4.7 + 20.2) = 0.62 V (typ 0.49 V) → reliably LOW; drive current 0.70 mA when firmware holds it high.
Consequence: the W5500 leaves reset during every MCU reset/DFU/bootloader and draws up to 128 mA; on battery that is the lesson-F8 drain. A V5.6 built with R112 = 100 k keeps the same bug.
Fix: add 4.7 kΩ 0603 (C23162, Basic) from /ETH_RST to GND at U11.37. Tell V5.6: R112 100 k → 4.7 k. D-04's move to PD2 with 100 k is rejected (1.56–2.04 V, and PD2 is needed for E-01). Firmware still drives PA15 low as the first line of setup().
Effort: schematic-only (+ 1 small footprint).

Minor (E)

E-03 · Minor · W5500 crystal Y1 10.8/13.7 mm from XO/XI; CL mismatch pulls +78…+156 ppm — absorbs H-07, F-11 (Y1 part). Status: verified, severity changed Major → Minor (verify_1: V5.5 as-fabbed and V5.6 have the identical Y1 C14872 and C95/C96 18 pF C1647 and Ethernet works; J10 is DNP on the v6 prototypes). Y1 = C14872 HC-49S, CL 20 pF, ±20 ppm, −20…+70 °C; W5500 specifies CL 18 pF, ±30 ppm (100BASE-TX ±50 ppm). Pad edge → U11.31 XO 10.79 mm, → U11.30 XI 13.74 mm; /ETH_XI 22.98 mm, /ETH_XO 22.03 mm; C96 6.4 mm from Y1. CL ≈ (C1+Cp)(C2+Cp)/(C1+C2+2Cp) + Cshunt with Cp ≈ 5.5 pF → ≈ 12.8 pF → pulling ≈ +78…+156 ppm. 63 × 25 MHz = 1575.000 MHz, 420 kHz from GPS L1 (a +100 ppm pull moves it to ≈ 1575.16 MHz, closer to L1 centre; EMC note shared with Y3). Fix (verify_1 conflict (f)): preferred Y1 → C9006 (YXC 3225, 25 MHz, CL 12 pF, ±10 ppm, −40…+85 °C, Basic, stock 528 k) and keep C95/C96 = 18 pF (C1647) → CL ≈ 12 pF; place ≤ 3 mm from U11.30/31, caps adjacent, 2 GND vias, no inner track under it (F-11). Alternative keeping the HC-49 part: C95/C96 → 33 pF C0G (C1663, Basic) → CL ≈ 19.3–20.3 pF. Verify with a frequency counter (target ±10 ppm). Effort: both.
E-04 · Minor · W5500 TOCAP and 1V2O capacitor values do not follow the datasheet (not independently verified). C90 on /ETH_TOCAP (U11.20) = 10 µF (DS: 4.7 µF; schematic note "VERIFY value vs ref"); C91 on /ETH_1V2 (U11.22) = 4.7 µF (DS: 10 nF, 470× larger); C90 4.4 mm, C91 5.5 mm from their pins; AVDD pins 4/8/11/21 rely on C94 10 µF (7.1 mm) / C102 22 µF (5.8 mm). Consequence: internal 1.2 V regulator outside its specified load capacitance (start-up/stability risk). Fix: C91 → 10 nF 0603 X7R (C1589); C90 → 4.7 µF 0805 (C1779, the part now on C91); both ≤ 2 mm from their pins; add 100 nF (C14663) at the AVDD 4/8 and 11/21 pairs. Effort: both.
E-06 · Minor · Ethernet pairs not coupled and split across layers; no line-side ESD; J10 pin 8 NC (not independently verified). TXP F.Cu 3.9 + In1 11.7 mm (1 via) vs TXN F.Cu 21.5 mm → coupled 0.3 mm; RXP F 5.0 + In1 11.2 vs RXN F 5.8 + In1 14.9 → coupled 1.2 mm; skew 5.9/4.4 mm (≈ 30–40 ps, irrelevant at 100BASE-TX). Terminations, EXRES1 12.4 k 1 % (5.0 mm from pin 10), VBG open, RSVD23 → GND, PMODE high: ✅. Consequence: common-mode emission from unbalanced pairs; lower ESD robustness on cabled installs. Fix: each pair coupled on F.Cu only (100 Ω diff), ≤ 1 via pair, In1 unbroken; optional low-capacitance array between magjack and U11 (SRV05-4 class; no LCSC selected); tie J10.8 per the HR911105A drawing (function not confirmed). Effort: layout.

Notes (E) — not independently verified

ID	Observation	Action
E-07	No PoE PD/controller; J10.7/J10.8 NC; firmware prints "SIN PoE". Consistent with the recorded decision (external splitter).	None for v6; PoE is a v6.1 feature (PD controller + isolated DC-DC). Record the decision in the schematic block note.

(b) Pass/fail — §4-E

Check	Evidence (one line)	Result
SPI2 wiring	PB12 CS (GPIO), PB13 SCK, PB14 MISO, PB15 MOSI (AF5)	✅
INT	U11.36 → PC0 (EXTI0), BOOT1 trap avoided	✅
RST pull-down	none on `/ETH_RST`; 100 k would read 2.75 V	❌ E-02
3V3_ETH switchable	U12 EN tied to VIN (`/SYS5V`): always on, battery included	❌ E-01
Straps / analog	PMODE all high (R84); EXRES1 12.4 k 1 % at 5.0 mm; VBG open; RSVD23 GND; 38–42 open	✅
TOCAP / 1V2O	10 µF / 4.7 µF vs DS 4.7 µF / 10 nF	❌ E-04
Termination	TX 49.9 Ω to 3V3_ETH + TCT; RX 49.9 Ω to RCT + 6.8 nF	✅
Magnetics / HR911105A	J10 C12074 set; PCB DNP vs schematic populated; LED pins still "VERIFY"	⚠ G-03
Magjack keepout	MAGJACK_NO_POUR rule area on all layers	✅
Line-side ESD on J10	none (optional)	⚠ E-06
ESD on J9 (USBLC6-2SC6)	none	❌ G-02
No PoE (state it)	none in hardware, documented	✅ (E-07)
25 MHz crystal ≤ 5 mm	10.79 / 13.74 mm; CL 20 pF with 18 pF caps	❌ E-03 (Minor)
Pair routing	TX coupled 0.3 mm, RX 1.2 mm, split across layers	⚠ E-06
U12 buck loop / FB	Cin 6.40 mm from VIN, D11 11.92 mm, FB top 25.9 mm, FB node under SW	❌ F-03

4-F Thermal and EMC (ECO §E, Copper Plan), lessons F5 / F6, 23-Jul short incident

Cross-references: U6 copper and EP vias → A-02; BSTFB/IGATE and switch-node overlap → A-14 (absorbs F-10); crystals → E-03 (Y1) and D-02 (Y3) (absorb F-11); U2 fan buck → A-01 (absorbs F-08, F-53); J9 ESD → G-02 (absorbs F-14's J9 part).

(a) Findings

F-02 · Blocker · Raw ignition `/IGN_IN` crosses the board on In2 at 0.221 mm from `/VEH5V`: the 23-Jul inner-layer geometry repeated

Absorbs: D-06, F-16. Status: verified (verify_2: Blocker; D-06's Major under-rated a repeat of a paid-for lesson with a damage path).

Evidence: /IGN_IN = {P1.3, Rig1.1}; P1.3 at (177.5, 135.0), Rig1.1 at (123.55, 50.675), 100 mm apart. Routing: 4.08 mm F.Cu + 106.47 mm In2, 0.5 mm wide, 1 via at (127.6, 50.75). With the corrected HV24 rule it is the only inner-layer violation set:

Layer	Other net	Gap	At
In2	`/VEH5V` 1.0 mm track	0.221 mm	(147.34, 67.49)
In2	GND via	0.250 mm	(154.4, 83.15)
In2	`/FAN_PWM` track	0.291 mm	(152.63, 73.49)
In2	`/5V_FAN` via	0.300 mm	(157.5, 104.5)
In1	`/NTC2` track (IGN via)	0.305 mm	(127.32, 50.47)
In2	`/VEH5V` via	0.340 mm	(147.4, 67.4)

Plus zone fills at 0.1505 mm on all four layers (re-pour under F-01). 23-Jul incident (drogheda-einarboard-short-incident): /24V_IN on In2 at 0.202–0.25 mm from MAIN5V/VEH5V and VEH5V ↔ IGN_IN at 0.2 mm on In2; v6 is within 0.02 mm of that geometry on the same net pair. /IGN_IN has no TVS (D10 covers /24V_IN only); D5 BAT54 clamps positive only; a negative ISO 7637-2 pulse through 22 k gives ≈ −27 mA into PA5 vs −5 mA I_INJ (DS10314 Table 12). F-16 (absorbed): /24V_IN runs 27.11 mm of 1.5 mm track on In1 at exactly 0.500 mm from /SW_5V, cutting a 25 mm In1 slot.

Consequence: one inner-layer defect puts 9–36 V (and load-dump pulses) onto /VEH5V (LTC4040 VIN, 6 V class, and the whole 5 V system) or the fan gate/5 V fan rail. This is the failure that scrapped the 23-Jul board; inner layers can be neither inspected nor reworked.
Fix: move Rig1 (22 k 0603, C88614) to ≤ 3 mm of copper from P1.3, with /IGN_IN ≤ 3 mm long on F.Cu. The 106 mm run becomes /IGN_SENSE, limited to (36 − 5 V)/22 k = 1.4 mA (2.5 mA at 58 V) into any bridged 5 V net; C9 at the MCU keeps τ = (22 k ∥ 2.87 k)·100 nF = 0.25 ms. Keep Rig2/Rigb1/C9/D5 at the MCU. Add SMBJ33A (C224019, Littelfuse DO-214AA, stock 9624; VR 33 V, VC 53.3 V at 11.3 A) from /IGN_IN to GND at P1.3: it also clamps negative ISO 7637 pulses at ≈ −1 V, removing the PA5 injection (D-06's BAT54S C19726 becomes optional). Rig1 at 58 V dissipates 0.13 W for 400 ms: an 0603 thick-film part (75 V working, 2.5× short-time overload) is acceptable with the TVS; 1206 optional. The In1 IGN via next to /NTC2 disappears with the reroute. F-16: move /24V_IN to F.Cu along the south edge, or keep ≥ 1.0 mm from any LV net with nothing crossing it. Conflict ≤ 3 mm (F-02) vs ≤ 5 mm (D-06) resolved to ≤ 3 mm of copper (verify_2).
Effort: both (one resistor moved, one TVS added, one net rerouted).

F-01 · Blocker · Netclasses are broken and one custom rule overrides every clearance: "DRC 0 errors" cannot see any 24 V spacing

Absorbs: J-01, F-15, B-12 (netclass part). Status: verified-with-correction (verify_2: the proposed .kicad_dru misses HV24↔HV24 pairs, which would add 4 false errors; corrected rule set below).

Evidence:
- .kicad_pro HV24 patterns = /24V_IN, 24V, IGN_IN, Q10_GATE; patterns are anchored matches against the full name, so the three un-prefixed ones match nothing. Netlist class attribute: HV24 = {/24V_IN} only; PWR_HI 6 nets; PWR_MID 6 (incl. /3V3_ETH); Default 338, including /24V, /IGN_IN, /Q10_GATE, /VIN_PROT, /VIN_FUSED, /VIN_MODEM, /Q23_GATE, /SW_PWRIN, /BOOT_PWRIN, /SW_MODEM, /BST_MODEM, /BST_FAN, /VBAT_MODEM, /RF_LTE, /RF_GNSS. Dead patterns also include the un-prefixed PWR_* duplicates, /3V3_MODEM, /SW3_NODE. RF and PWR_MODEM classes are missing (lost on GUI saves, drogheda-v6-resync-protocol §5).
- Rule "Minimum clearance 1" = 0.15 mm, condition A.NetClass != 'HV24' && B.NetClass != 'HV24', no layer or type clause. Netclass values become implicit rules and custom rules are appended after them; the last matching rule wins (KiCad developer statement). So it replaces Default/PWR 0.2 mm, the zones' 0.3 mm and any future RF class.
- Proof in the stored fills: gap to every non-HV24 net 0.1505 mm, to /24V_IN 0.5005 mm, although all 5 zones carry (connect_pads (clearance 0.3)); DRC reports 0 clearance items.
- Deleting the rule with Default at 0.2 mm would fail 471 item pairs (209 net pairs) at 0.15–0.20 mm, so the floor must stay 0.15 mm, stated explicitly.
- Spacing basis (IPC-2221B Table 6-1, 51–100 V row, since the rail peaks at the 53.3 V clamp and 58 V suppressed load dump): B1 internal 0.10 mm, B4 external coated 0.13 mm, A6 0.13 mm. The 0.5 mm inner value is a defect/CAF margin from the 23-Jul loss; 0.3 mm outer under mask (2.3× IPC) fits the SO-8 pin rows.
- F-15 (absorbed), outer layer with corrected classes: 15 spots < 0.3 mm (38 < 0.5 mm): /SW_MODEM U20.8–GND 0.150; /VIN_MODEM–GND 0.150 / U20.9 0.200 / U20.2 pad–GND track 0.195; /VIN_PROT 1.5 mm – /VEH5V 0.8 mm track 0.162 mm at (176.24, 116.28) and – untented /VEH5V via 0.193; /SW_MODEM–GND 0.170; /Q23_GATE and /VIN_PROT – /USB_VBUS 0.225; /BST_MODEM–GND 0.225 / 0.275; /VIN_MODEM – U20.3/U20.4 0.250; /SW_PWRIN–GND 0.270; /24V – /COMP_FAN 0.290. Full list work/FHJ/hv24_violations_corrected_rule.csv.
Consequence: DRC cannot flag a repeat of the 23-Jul geometry. F-02 is exactly that, and it passed DRC with 0 errors.

Fix (project settings + rules, then copper):

Netclass table (exact names, one pattern per line):

Class	Nets	Clearance	Track	Via
HV24	`/24V_IN` `/VIN_FUSED` `/VIN_PROT` `/24V` `/VIN_MODEM` `/IGN_IN` `/Q10_GATE` `/Q23_GATE` `/SW_PWRIN` `/BOOT_PWRIN` `/SW_FAN` `/BST_FAN` `/SW_MODEM` `/BST_MODEM`	0.3 (class value; layer rules below)	1.0	0.8/0.4
PWR_HI	`/BAT_PLUS` `/SW_BAT` `/MAIN5V` `/VEH5V` `/SYS5V` `/VIN_SW`	0.15	1.5	0.8/0.4
PWR_MID	`/SW_5V` `/SW_IN` `/5V_FAN` `/FAN_RET`	0.15	0.6	0.8/0.4
PWR_MODEM	`/VBAT_MODEM`	0.15	1.5	0.8/0.4
RF	`/RF_GNSS` `/RF_ANT_GNSS` `/RF_LTE` `/RF_ANT_LTE`	CPWG gap (F-06)	CPWG width (F-06)	none
Default	everything else (incl. `/3V3_ETH`, `/EN_FAN`, `/EN_PWRIN`)	0.15	0.2	0.6/0.3

If A-01 is adopted, remove /SW_FAN, /BST_FAN (U2 deleted) and /VIN_MODEM (merged into MAIN5V) from HV24 (verify_2). Delete the un-prefixed duplicates.

.kicad_dru (replaces "Minimum clearance 1", "HV24 clearance", "HV24 exception"; order matters, later rules win):

(rule "Floor 0.15 (non-HV24, non-RF)"
  (condition "A.NetClass != 'HV24' && B.NetClass != 'HV24' && A.NetClass != 'RF' && B.NetClass != 'RF'")
  (constraint clearance (min 0.15mm)))
(rule "HV24 to HV24"
  (condition "A.NetClass == 'HV24' && B.NetClass == 'HV24'")
  (constraint clearance (min 0.2mm)))
(rule "HV24 outer"
  (layer outer)
  (condition "A.NetClass == 'HV24' && B.NetClass != 'HV24'")
  (constraint clearance (min 0.3mm)))
(rule "HV24 inner"
  (layer inner)
  (condition "A.NetClass == 'HV24' && B.NetClass != 'HV24'")
  (constraint clearance (min 0.5mm)))
(rule "HV24 IC land patterns"
  (layer outer)
  (condition "A.Type == 'Pad' && B.Type == 'Pad' && ((A.memberOfFootprint('U2') && B.memberOfFootprint('U2')) || (A.memberOfFootprint('U20') && B.memberOfFootprint('U20')) || (A.memberOfFootprint('U25') && B.memberOfFootprint('U25')))")
  (constraint clearance (min 0.15mm)))

Without the "HV24 to HV24" rule, 4 false errors appear: /BST_MODEM C129.1 ↔ /SW_MODEM 0.180 mm, /BST_FAN Cbst1.1 ↔ /SW_FAN 0.285, /Q23_GATE D33.1 ↔ /VIN_PROT 0.388, /SW_FAN ↔ /VIN_MODEM 0.400.

Then: refill all zones, run DRC (gate). Expected: the 6 inner spots of F-02 and the 15 outer spots of F-15; the F.Cu pour recedes to 0.3/0.5 mm around ≈ 178 HV24 items (re-check isolated_copper and the U25/U20 GND islands). Fix the outer spots: /VIN_PROT vs /VEH5V ≥ 0.5 mm near R124/U25 (24 → 5 V); remove the U20 GND neck (F-03); /USB_VBUS away from Q23; /COMP_FAN ≥ 1 mm from /24V (moot with A-01); tent all vias except test vias. Check with Inspect → Clearance Resolution on one /24V ↔ GND-zone pair and one GND-zone ↔ Default pair; re-check that the classes survive every GUI save.

Effort: both (rules now; the copper they flag is F-02 / F-15).

F-12 · Major · Ground vias: 69 on the board (V5.5: 165); 1 under the modem, 0 under the F9P, 0 in every regulator EP; east pour stitched by 5 vias

Absorbs: F-13, F-04, B-04, C-03, A-06 (EP/via part). The U6 EP belongs to A-02. Merge note: verify_1 made F-12 the umbrella; verify_2 used F-13 as primary of the same family (M-C); both agree on content and severity. Status: verified (both verifiers; B-04 re-rated Blocker → Major; F-12's via target corrected to ≥ 400; F-13's board-wide pad setting corrected).

Evidence:
- GND vias per 20 × 20 mm cell (rows from y 40.32): [0,5,4,3,0,1,0] [2,3,4,4,4,0,2] [2,1,2,3,0,1,3] [0,2,2,2,0,2,4] [4,5,0,2,2,0,0] → 10 of 35 cells empty; 2 GND vias within 3 mm of the 480 mm edge; max distance to a GND via 27.8 mm at (197.7, 42.3) next to J13.
- East F.Cu GND (U19, U20, U25, U2, J13, D34): 3611 mm² pad/track-joined cluster (verify_1) / 3766 mm² pour piece (verify_2), reaching In1/In2 through 5 vias at (145.7, 129.9), (148.1, 135.3), (152.6, 62.5), (153.5, 77.0), (198.8, 78.1); pour-point-to-via median 10.4 mm, p90 19.8 mm, max 29.5 mm.
- U19 A7670SA: 39 GND pads (20 × 2.1 mm centre pads on a 3.8 mm grid, 1.7 mm gaps), 1 GND via under the courtyard at (184.6, 81.775), 4 in a 5 mm ring; pads on thermal spokes (18–24 % perimeter contact). U18 ZED-F9P: 56 GND pads (48 × 1.1 mm on a 2.1 mm grid + 8 ring pads), 0 vias under the body, 946 mm² cluster with 5 vias. J13 GND pads 20.3/21.3 mm from a via; D28 GND 19.1 mm; J12.3 has a GND via 0.73 mm away (verify_1 correction), J12.2 3.7 mm.
- EPs: 0 vias in U6, U25, U20, U2, U12; zones default to thermal relief (gap 0.5 / spoke 0.5 mm); solid overrides only on U6.25, U2.9, U12.9, U11.9, U11.29, JP1–JP5; contact U25 EP 18 %, U20 EP 13 %, D34 anode 18 %.
Consequence: the modem's return currents (23 dBm LTE, 2 A GSM bursts) and the whole east pour reach the planes through 5 vias 30–70 mm apart: the pour behaves as a resonant patch at 1–2.7 GHz (LTE self-desense of the F9P, the brief's #1 risk; ESD returns through the pour); U19 (≈ 1–2 W at max TX) and the regulators lose their heat path (spokes + no vias roughly double θ). Major, not Blocker (both verifiers): no R1–R5 violated outright, no V5.5 field precedent for an on-board modem, no damage path, manufacturable. Zero BOM cost: do it with the Blockers.
Fix (layout; §6 L-24 … L-29): EP arrays of 0.3/0.6 mm vias: U6 9 (A-02); U25, U20: 2 × 3 = 6 at 1.0 mm, or 2 × 4 = 8 at 0.8 mm with 0.3/0.5 mm vias (3 × 3 at 1.0 mm does not fit the 2.5 mm EP side); U12 (and U2 if kept) 2 × 3. Pad-level zone_connect solid on EPs, all U18/U19 GND pads, D34/Dbk1/D11 anodes and buck Cin/Cout GND pads — not a board-wide thru_hole_only, which would make 23 × 0402 and 142 × 0603 GND pads solid (tombstoning). U19: one tented via in each 1.7 mm gap between centre GND pads (0.55 mm clearance per side) + perimeter ring, ≥ 30, target 40, never in pads. U18: vias at the diagonal interstitial centres of the 2.1 mm grid (0.41 mm to pad corners), ≥ 24, no microvias needed. 2 vias ≤ 1 mm from each U.FL GND pad (J12, J13) and at D28. Every F.Cu GND island ≥ 20 mm² gets ≥ 2 vias; no F.Cu GND pour point > 5 mm from a GND via; edge fence ≤ 5 mm pitch within 1.5 mm of the edge clearance (≈ 96 vias); board total ≥ 400 GND vias (≈ 96 edge + ≈ 316 area at 1 per 25 mm² of the 7890 mm² F.Cu GND). Tented, or JLC "epoxy filled & capped" under U18/U19. Acceptance: 0 empty 20 mm cells; every GND pad of U19/U18/U20/U25/J12/J13 in an F.Cu cluster with ≥ 1 plane via ≤ 2 mm.
Effort: layout.

F-03 · Major · Switcher hot loops: U25 input caps on a different GND island from its EP/diode (≈ 311 mm² loop); U20 returns through a 0.25 mm neck; U12 Cin 6.4 mm, diode 11.9 mm

Absorbs: A-06 (loop part), B-06, F-07, F-09 (U2 = F-08 → A-01). Merge note: verify_2 made F-03 primary (M-D); verify_1 kept A-06 and used B-06 as primary for U20. One item here, because both merges share F-07 and A-06. Status: verified (verify_1 and verify_2; F-09 corrected: Cin is 6.40 mm from VIN pin 7, not 1.77 mm, which was measured to EN).

Evidence:
- U25 TPS54360B (non-synchronous, 24–36 V): C150.1 → U25.2 2.88 mm ✅, C149.1 6.36 mm, C151.1 6.42 mm; C149/C150/C151 GND on the ≈ 252–270 mm² U6 island (nearest via 9.4–11.4 mm); U25.7/EP and D34.2 on the east piece (nearest on-piece via 29.5–30.4 mm from the EP, 37.9 mm from D34.2); D34 → SW 4.28 mm; L22.1 → SW 13.75 mm edge; /SW_PWRIN 45.8 mm². Input loop ≈ 311 mm² (≈ 51 mm² if C150.2 joined the EP island; Copper Plan target ≤ 1 cm²). EP 0 vias, 4 × 0.5 mm spokes. D34 loss 0.78·2.5 A·0.5 V ≈ 0.98 W. Estimated 15–25 nH × 3 A/5 ns → ≈ 9–15 V ringing on VIN over the 53.3 V clamp vs 65 V abs max (not simulated).
- U20 AP64350: C128.1 → U20.2 0.72 mm, C127.1 2.38 mm ✅; GND C128.2 → U20.7 6.86 mm, C127.2 8.48 mm, via a 0.25 mm GND track squeezed between U20.1 and U20.2 (gaps 0.225/0.195 mm); EP 0 vias (nearest 3.45 mm). Cin C127 10 µF 50 V X5R + C128 1 µF ≈ 9.5 µF at 5 V → 2 A·D(1−D)/(f·C) ≈ 65 mV p-p, input RMS 0.78 A. FB: R110/R111 junction ≈ 2 mm from SW copper, /FB_MODEM 13.9 mm, VBAT tap via a 5.6 mm In1 detour.
- U12 MP1584EN (3V3_ETH): C101.1 → U12.7 6.40 mm; D11 → U12.1 11.92 mm; L8 15.10 mm; R87 (FB top) 25.9 mm → /ETH_FB 35 mm long, 1.84 mm² directly under /ETH_SW on In1; C101.2 and D11.2 on different F.Cu pieces (224 / 178 mm²). The same R5 🟠 item was 8.5 mm on V5.5.
Consequence: SW-node/VIN ringing and conducted/radiated EMI into the GNSS/LTE receivers; U25 VIN overshoot eats the margin to 65 V during a clamped transient; EP/diode thermals; FB noise on U12 (3V3_ETH jitter) and U20. ECO §E.4 (Cin loops < 3 mm) not met.
Fix (layout; §6 L-20 … L-23), common rules: Cin (VIN and GND pads) ≤ 2 mm from the IC VIN and GND/EP pins; Cin GND, catch-diode anode (D34/D11) and EP on one solid F.Cu area, no GND neck < 1 mm; ≥ 2 vias ≤ 1 mm from each Cin GND pad; catch diode ≤ 3 mm from SW; inductor ≤ 5 mm from SW; SW copper ≤ 25 mm²; FB divider ≤ 3 mm from the FB pin with nothing on In1 under the SW copper; acceptance input loop ≤ 1 cm². Per regulator: U25 C149/C150 ≤ 2 mm from pins 2/7 on the EP/D34 copper, L22 ≤ 5 mm from pin 8, /SW_PWRIN off In1 signal tracks, 4 GND vias around the Cin/D34 node. U20 delete the 0.25 mm GND neck; R110/R111 ≤ 2 mm from U20.5 on the side away from pin 8; VBAT sense by a dedicated trace from C131 (delete the In1 detour); add 2 × 22 µF 16 V 0805 (C86817) ≤ 3 mm + 1 × 220 µF 16 V polymer (C881921) at U20.2 (verify_1 conflict (d): ripple 65 → 17 mV p-p; the 220 µF because at PFI hand-over the modem load sits on CSYS ≈ 60 µF; 16 V parts are valid only with A-01's 5 V input). U12 R87/R88 ≤ 3 mm from U12.4, top resistor Kelvin-fed from C102/C94, FB ≤ 5 mm on F.Cu, nothing under /ETH_SW; D11 ≤ 2 mm from pin 1 with its anode on C101's GND copper; L8 ≤ 5 mm.
Effort: both (layout + 3 caps at U20).

F-51 · Major · No charger-die or cell temperature reaches the MCU; the firmware thermal inhibit has no source on v6 (R4)

Status: verified (verify_1).

Evidence (every temperature source on v6):

Sensor	Ref / net	MCU input	Distance to U6	Notes
Board air + RH	U3 SHT40 (0x44)	I²C1	71.4 mm	52 mm from U19
MCU die	U16 internal	ADC1_IN16	77 mm
External probe 1	P7 → `/NTC_TEMP` (R42 10 k)	PB1 / ADC1_IN9	≈ 100 mm	jack only
External probe 2	P8 → `/NTC2` (R126 10 k)	PC4 / ADC1_IN14	≈ 83.5 mm	jack only
Pack NTC	P3.3 → `/NTC` → U6.17 only (R55 10 k from VEH5V)	none	—	LTC4040 hot pause 42.4 °C (B3380)
Modem die	A7670SA internal	AT over USART6	—	firmware only (F-52)
TMP102	absent (V5.x U4 and V5.6 TMP102 deleted in v6 T10)	—	—	—

Free pins: PC5 (only free ADC, ADC1_IN15), PB10, PA9, PD2. I²C: TMP102 at 0x48 does not clash (U10 A0 = A1 = GND → 0x4D).

Consequence: CHG_CELL_HOT/COOL (45/40 °C) have no cell sensor unless an installer tapes P7 to the pack; no charger-die visibility, so A-02-type cycling is invisible in telemetry. R4 is not met in firmware (the cell is still protected in hardware by the LTC4040 NTC pause).
Fix: (1) TMP102AIDRLR, LCSC C99269 (SOT-563, stock 34 854) between U6 and L6, ≤ 5 mm from the U6 EP, I²C1 0x48 (ADD0 → GND), 100 nF C14663. (2) Pack NTC to the MCU: tap /NTC into PC5 through 100 k (C25803) top / 120 k bottom (C25808, 0603 1 %, Basic; assigned at publication) + 10 nF (C1589, the 10 nF 0603 X7R of E-04); PC5 ≤ 0.545·5.46 V = 2.98 V; the 220 k load shifts the LTC4040 hot threshold ≈ 0.7 °C (B3380, verify_1). tcell is valid only with VEH5V present (VEH5V = 0 on battery), which is when charging is possible. (3) Firmware: tchg, tcell appended to $PHLG; governor inhibits on tcell (Li-ion 45 °C / LFP 55–60 °C) and sheds on tchg > 85 °C. Rating Major: R4 is still reachable with the P7 probe on the pack plus the NTC pause; Leo can promote it to Blocker if "sensor ≤ 10 mm of U6" is binding for R4 (verify_1).
Effort: both (2 parts + 3 passives, placed in the A-02 re-cluster).

F-06 · Major · RF feeds: LTE routed 22 mm on In1 under the modem power tracks with 2 via transitions; GNSS bias line 0.27 mm beside the RF line; neither line is 50 Ω on the real stackup

Absorbs: B-05, C-05, B-12 (stackup part). Status: verified-with-correction (verify_1 and verify_2: GNSS coupling re-measured; impedances re-derived; fence pitch set to ≤ 3 mm).

Evidence:
- LTE: /RF_LTE U19.60 → 4.01 mm F.Cu → In1 22.14 mm (0.5 mm) with vias at (174.25, 58.25) and (194.27, 53.72) → R118 → /RF_ANT_LTE 5.62 mm F.Cu → D28 → J13; ≈ 31.5–31.8 mm total. Copper within ±0.25 mm of the In1 run: /VBAT_MODEM F.Cu 1.15 mm², /SYS5V 0.71, /SW_IN 0.40, /MODEM_LED_K/A 0.56/0.10, /DIN_4G In2 0.71. F.Cu GND above covers ≈ 45–55 %; 1 GND via within 3.5 mm of the whole path. In1 section ≈ 30–47 Ω (FD 32.5 / 47.1 Ω).
- GNSS: /RF_GNSS 22.7 mm F.Cu, 0.5 mm / 0.15 mm gap; /VCC_RF_GNSS alongside with minimum edge gap 0.274 mm, 3.25 mm of run at ≤ 0.3 mm, 13.4 mm at ≤ 0.5 mm, 17.9 mm within 1 mm (verify_2; FHJ's "16.7 mm at 0.27" overstated it); 2 GND vias within 3.5 mm; D27 on a 2.8 mm stub beyond C143 (≈ 1–1.2 pF, RL ≈ 11 dB, ≈ 0.4 dB).
- Impedance (JLC04161H-7628, L1–L2 0.2104 mm, εr 4.4): 0.5 mm microstrip 42.1 Ω; CPWG 0.5/0.15 as built 41.0 Ω (FD 38.4 bare / 35.2 masked); CPWG 0.30/0.20 56.6 Ω bare closed-form, FD 53.3 Ω bare / 48.4 Ω masked; 0.35/0.20 52.1 Ω bare. On the file's generic stack (0.48 mm, εr 4.5) 0.5 mm is 66.6 Ω. The board file carries the generic stackup (copper finish "None"); RF and PWR_MODEM netclasses are missing.
Consequence: LTE mismatch plus two unshielded via transitions, with the PA supply crossing the RF line (PA noise and burst ripple couple into the antenna feed) and radiated desense of the adjacent F9P; on GNSS a coupled section between the antenna input and a bias line decoupled only at L21. The G3 desense bench test is likely to fail.
Fix (layout + stackup; §6 L-1, L-30 … L-33): set the real stackup in Board Setup (JLC04161H-7628: 0.035 / 0.2104 / 0.035 / 1.065 / 0.035 / 0.2104 / 0.035 mm, εr 4.4 prepreg / 4.6 core) and order impedance control. Both RF runs on F.Cu only as CPWG over solid In1, starting at w 0.30 mm / gap 0.20 mm, finalised in JLC's calculator; RF netclass (width = CPWG width, clearance = gap, no autoroute). LTE: reroute U19.60 → R118/C146/C147 → D28 → J13 on F.Cu (rotate J13 or move it toward U19's RF pad side); nothing above or below; /VBAT_MODEM ≥ 3 mm away. Via fence both sides at ≤ 3 mm pitch (λg/20 = 3.1 mm at 2.69 GHz), ≤ 1 mm from the gap edge; 2 vias per U.FL GND pad. GNSS: bias feed (/ANT_BIAS after C-01) ≥ 1 mm from the RF line with a stitched GND strip between (or on In2 after 100 pF + 100 nF decoupling at U18 pin 7); L21 taps the line stub-free at J12; D27 on the J12 pad. Optional (C-05): C143 → 47 pF C0G 0402 (no LCSC selected). Fence-pitch conflict (FHJ ≤ 2.5 mm, BCE ≤ 3.3 mm) resolved to ≤ 3 mm (verify_2).
Effort: both (stackup setting + layout).

F-05 · Major · In1, the "solid GND reference", is 19 % void and carries 1572 mm of tracks from 49 nets

Status: verified, fix scope corrected (verify_2).

Evidence: In1 GND fill 11 370.5 mm² in 8 islands: 18.8 % void vs 14 000 mm² (17.4 % vs the 139 × 99 mm usable area); 1571.9 mm of tracks from 49 nets (largest users /SW_5V 181 mm, /DOUT_4G 95, /KCOIL 85, /MAIN5V 73, /CHRG_FAULT 72, /CHRG_STAT 69, /USART6_TX 68, /BOOT0 61, … /24V_IN 27, /RF_LTE 22). F.Cu nets over In1 voids: USB_DP/DM 10.4/9.7 mm (directly over /24V_IN and /SW_5V); I2C_SDA 25.2 mm (14.2 mm directly over /SER_TXB); ETH_XO 8.3 mm (6.95 mm over /ETH_RST); NRST 21.1 mm (7.2 mm over /USART6_RX); DFU_DM 13.2 mm; SIMB_CLK 9.1 mm (5.8 mm over /SW_5V); DOUT_4G_M 13.1 mm; RF_GNSS/RF_ANT_* 0 mm ✅. In2 GND (1 island) carries 1009 mm from 25 nets; B.Cu is the /3V3 pour.
Consequence: return currents detour around slots (emissions, susceptibility); broadside crosstalk with no plane between (I2C_SDA over SER_TXB, ETH_XO over ETH_RST); the Copper Plan's "unbroken In1" rule for the RF receiver is broken by design.
Fix (layout): a full "In1 = plane" re-layout is ideal. Minimum (verify_2): clear In1 under the USB pairs, the crystals and their lines, all switch nodes, VBAT_MODEM/the RF area, SIM, and the three broadside parallels above. Priority moves: /RF_LTE (F-06), /24V_IN (F-02), /SW_5V (C-04), /MAIN5V, /KCOIL, /USART6_TX/RX, /DOUT_4G, /CHRG_*, /SER_TXB/RXB, /ETH_*, /VFB_BST, /IGATE → In2/B.Cu (or F.Cu where short). Acceptance: ≤ 3 In1 islands and no critical net over a void longer than 1 mm.
Effort: layout (large).

Minor (F) — not independently verified

F-52 · Minor · No on-board sensor near the modem (ECO D3 dropped). Nearest board sensor to U19 is U3 at 52.1 mm; the only modem-temperature path is AT over USART6 (AT+CPMUTEMP exists on SIMCom A76xx; availability on the A7670SA firmware not verified; works only while the modem is up). Fix: firmware-only (tmodem in $PHLG), or a second TMP102 (C99269) at 0x49 (ADD0 → 3V3) between U19 and U20. Effort: firmware-only, or both.
F-14 · Minor · DFU ESD (D14/D15/D16) hangs on stubs; D15 is 10.9 mm of copper from J11 (J9 part → G-02). DFU_DP/DM have no series resistors. Pad-edge / copper path J11 → ESD / on the path?: D14 2.53 / 3.3 mm / no (T-stub); D15 6.07 / 10.9 mm / no; D16 2.62 / 3.0 mm / no; ESD GND → via 2.6 / 1.8 / 4.9 mm. Consequence: ≈ 1 nH/mm stub raises the clamp voltage on the fast IEC 61000-4-2 edge. Fix: route J11 D+/D− through the D14/D15 pads, D15 ≤ 3 mm of copper from J11, each ESD GND pad with its own via ≤ 1 mm; optional: one USBLC6-2SC6 (C7519) at J11 instead of three PESD5V0S1BA. Effort: layout.
F-17 · Minor · USB pairs split across layers and crossing slots. /USB_DP F.Cu 49.9 + In1 9.6 mm; /USB_DM F.Cu 50.0 + In1 8.0 + In2 1.7 mm; they cross In1 /24V_IN (2.5 mm gap) at (157.75, 121.75), /SW_5V 2.47 mm, /5V_FAN, /IGATE, /CHRG_FAULT/STAT; /DFU_DM runs 5.98 mm over In1 /ETH_ACTLED. Consequence: A7670SA USB is high speed; FOTA/recovery through J9 may fail at HS. Fix: both pairs on F.Cu only over solid In1, coupled (≈ 0.2/0.15 mm on JLC7628 for 90 Ω, verify in the calculator), ≤ 1 via pair, no slot crossings. Merge note: verify_1 folded F-17 into B-07; verify_2 kept it separate as the routing (not ESD) part. Kept separate here so the Minor routing item does not inherit a Major rating. Effort: layout.
F-18 · Minor · Silkscreen: 304 of 312 reference texts are 0.5 mm / 0.1 mm (JLC minimum 1.0 mm / 0.15 mm). The DRU text rule is 0.5/0.1 so DRC stays silent; 14 DRC silk items (11 silk_overlap incl. D27, U23, U24, Q10/JP5, Q23; 2 silk_over_copper Rigb1, C10; 1 silk_edge P1). Fix: refs ≥ 0.8 mm / 0.15 mm (1.0/0.15 where it fits); DRU text rule (min 0.8mm) / (min 0.15mm); clear the 14 items; check D27/D28/Q10 polarity marks in the 3D view. See G-05 for label content. Effort: layout.

Notes (F) — not independently verified

ID	Observation	Action
F-19	JLC 4-layer standard: passes (min track 0.20 mm, spacing 0.15 mm, vias 0.30/0.80 mm, copper-to-edge 0.625 mm); J9/J11 (GCT USB4085) at the limits: PTH ring 0.15 mm, hole-to-hole 0.45 mm, PTH hole → track 0.30 mm (V5.5 fabbed fine).	Order notes: ENIG (LGA U18/U19); JLC04161H-7628 with impedance control; X-ray on U18/U19; tent vias.
F-20	Courtyard overlaps: all 15 MCP hits are bounding-box artefacts (polygon intersection 0.000 mm²); KiCad `courtyards_overlap` reports 0; only MH5–MH8 lack courtyards.	None. Watch the MWSA0804S bodies (8.2 × 8.8 mm on an 8.0 × 8.0 courtyard basis, H-03).
F-21	One dangling `/SW_5V` track end at (86.35, 121.88): overlaps U21.3 by 0.085 mm², connected per KiCad.	Extend 0.3 mm to the pad centre (cosmetic).

(b) Pass/fail — §4-F

Check	Evidence (one line)	Result
Fan driver / FB divider location	R20/R21 0.67/1.48 mm from U2.4 (ECO E3 fixed); moot if A-01 removes U2	✅
Fan tach	2-wire, `ENABLE_FAN_TACH 0` (decision)	✅ (Note)
Fan default OFF	Rgs1 100 k on Q2 gate	✅
Temperature sensor near U6	none; U3 at 71.4 mm	❌ F-51
Temperature sensor near modem	none on board (U3 52.1 mm); AT path only	⚠ F-52
Board ambient sensor	U3 SHT40 at (122.4, 77.3), I²C 0x44	✅
Pack NTC reaches the MCU	`/NTC` → U6.17 only (the brief's "P12 NTC" is P3 on v6; P12 is now the RS-232 terminal)	❌ F-51
Real cell source for `CHG_CELL_HOT` 45 °C	none on board	❌ F-51
Crystals ≤ 5 mm	Y1 10.79/13.74 mm (E-03), Y3 8.32/11.30 mm (D-02), Y4 3.92/6.32 mm (D-03), Y2 5.51/4.64 mm (no finding)	❌ Minor items
Crystal ↔ inductor ≥ 10 mm	nearest Y1–L8 13.6 mm	✅
Via stitching under the modem / F9P	1 / 0 vias under the bodies	❌ F-12
Board stitching / edge fence	69 GND vias, 10 empty 20 mm cells, 2 edge vias	❌ F-12
Thermal vias in regulator EPs	0 in U6/U25/U20/U2/U12	❌ A-02, F-12
DFU ESD at J11	2.5–6.1 mm pad edge (V5.5: 41 mm)	✅ (stubs: F-14)
Return paths across splits	In1 19 % void, 1572 mm of tracks; USB, crystal, SIM, I²C lines over slots	❌ F-05
24 V on inner layers next to LV	`/IGN_IN` In2 0.221 mm from `/VEH5V`; `/24V_IN` In1 0.500 mm from `/SW_5V`	❌ F-02
Netclasses resolve / DRC can see 24 V spacing	1 of 14 HV nets in HV24; 0.15 mm override rule; RF/PWR_MODEM missing	❌ F-01
Outer-layer 24 V spacing ≥ 0.3 mm	15 spots < 0.3 mm (worst 0.150; `/VIN_PROT`–`/VEH5V` 0.162)	❌ F-01 (F-15)
`/24V_IN` clearance	≥ 0.500 mm to everything on all 4 layers	✅
Switch nodes only on outer layer	`/SW_PWRIN`, `/SW_FAN`, `/SW_MODEM`, `/SW_BAT`, `/ETH_SW` F.Cu-only	✅
Buck hot loops (ECO E.4)	U25 GND split (≈ 311 mm² loop), U20 0.25 mm neck, U12 6.40 mm / 11.92 mm	❌ F-03
U20 VIN cap, BST, L20 placement	C128 0.72 mm, C129 1.8 mm, L20 2.24 mm	✅
U25 BST cap, FB/COMP/RT	C152 1.49 mm; R122 1.0, R121 2.9 mm; FB net 4.1 mm	✅
RF lines 50 Ω, fenced, on the real stackup	LTE 22 mm on In1, 30–47 Ω, 1 fence via; GNSS 38–42 Ω, bias line 0.274 mm	❌ F-06
RF_GNSS over a solid plane	0 In1 slot crossings	✅
GNSS island ↔ switchers ≥ 25 mm	`/ETH_SW` 27.5 mm, L8 35.3 mm, `/SW_FAN` 54.1 mm	✅
Courtyard overlaps (real)	0 of 15 (polygon intersection 0.000 mm²)	✅
Dangling track ends	1, benign	✅ (F-21)
Silkscreen size vs JLC	304 refs at 0.5/0.1 mm	❌ F-18
JLC 4-layer manufacturability	passes; J9/J11 at PTH-ring and hole-spacing limits	✅ / ⚠ (F-19)
DRC clean	0 errors, but only because of F-01; 283 warnings classified in §4-J	⚠ F-01

4-G Connectors and harness (`drogheda-einarboard-harness`, `drogheda-einarboard-j1-mirror`)

(a) Findings

G-01 · Blocker (conditional) · Mounting-hole pattern changed vs V5.5: MH4 now lands on L6; heatsink-clamp holes MH11 + partner missing

Status: verified-with-correction (verify_2: Blocker unless Leo confirms a re-drilled backplate; MH11 and its partner are also missing).

Evidence: outline identical to V5.5 (140.00 × 100.00 mm, x 60.19–200.19, y 40.32–140.32). V5.5 PCB holes: MH5 (65.2, 45.3), MH6 (65.2, 135.3), MH4 (193.2, 90.3), MH7/9/10/11 (M2.5 shield/heatsink). v6 holes: MH5 (65.2, 45.3), MH6 (65.2, 135.3), MH7 (195.2, 45.3), MH8 (195.2, 135.3): a 130 × 90 mm corner pattern. At (193.2, 90.3) on v6 the L6 courtyard contains the point (0.0 mm); L6.2 /BAT_PLUS pad centre 2.44 mm away; R133 1.75 mm. Design brief v1.0: "Keep 140.000 × 100.000 mm — no enclosure rework"; memory drogheda-v6-zed-f9p-integration: "MH4/5/6 (enclosure) and MH11 (heatsink clamp) survive"; Phase-2 delta: "KEEP MH11 and add one partner near U19". MH11 at (168.3, 84.6) is missing (the point is now 0.6 mm from the U19 courtyard), and so is its partner: these are the modem heatsink-clamp holes for thermal gate T1. MH6: /3V3 F.Cu track 3.55 mm from the hole centre (an M3 washer Ø7 mm needs ≥ 3.5 mm plus tolerance).
Consequence: in an enclosure drilled for V5.5, v6 cannot be screwed down on the right side, and a metal standoff at (193.2, 90.3) would press on L6 / /BAT_PLUS. No modem heatsink clamp is possible. If the backplate is re-drilled per board, this becomes a documentation item.
Fix: Leo confirms the backplate pattern (§10). If the V5.5 standoffs are reused: restore MH4 at (193.2, 90.3) (L6 must move anyway, A-02: ≤ 5 mm from U6); decide and place the heatsink-clamp pair near U19 (MH11 + partner). Otherwise publish the 130 × 90 mm corner pattern for the enclosure. Keep a ≥ 4.0 mm copper-free radius on F.Cu/B.Cu around every mounting hole (move the /3V3 track at MH6 by ≥ 0.5 mm) or specify nylon washers.
Effort: layout (+ enclosure drawing).

G-02 · Major · Modem USB-C J9 has no ESD protection (lesson F8, ECO §E.5)

Absorbs: B-07 (ESD part), F-14 (J9 part). Merge note: verify_1 used B-07 as primary and folded F-17 in; verify_2 used G-02 and kept F-17 (pair routing) separate as a Minor. This report follows verify_2, because the routing item carries its own lower severity. Status: verified (verify_1 and verify_2).

Evidence: /USB_DP = {J9.A6, J9.B6, U19.27}, /USB_DM = {J9.A7, J9.B7, U19.28}, /USB_VBUS = {J9.A4/A9/B4/B9, U19.24}: no protection device (unchanged since the 25-Sep review). J9 is 64.6 mm (centre) from U19. J11 has D14/D15/D16. J9 is the modem's firmware-update / USB_BOOT recovery port (TP8).
Consequence: a field-service ESD hit on J9 goes straight into the A7670SA USB PHY/VBUS; the modem is the unit's only link and J9 is its only recovery route.
Fix: add USBLC6-2SC6, LCSC C7519 (ST, SOT-23-6, 3.5 pF, stock 1415): pins 1/6 → /USB_DM, 3/4 → /USB_DP, 5 → /USB_VBUS, 2 → GND (same connection as V5.6 D19); ≤ 3 mm of copper from the J9 pads, flow-through (D± routed through the device pads), GND via ≤ 1 mm (distance conflict ≤ 3 mm vs B-07's ≤ 5 mm resolved to ≤ 3 mm by verify_2).
Effort: both.

Minor (G) — not independently verified

G-03 · Minor · J10 / P11 / P12: DNP and footprint disagree between schematic and PCB — absorbs E-05, H-06. Schematic: J10, P11, P12 populated; PCB: all three dnp. P11 (/RS485_A,B,GND) and P12 (/RS232_TX,RX,GND) schematic footprint …MC_1,5_3-G-3.5_1x03_P3.50mm_Vertical does not exist in the KiCad library (MC = right-angle; vertical is MCV); the PCB uses …_Horizontal, which matches C5160226 DEGSON 15EDGRC-3.5-03P, right-angle, 7 A (V5.5 fabbed the same Horizontal footprint). J10: schematic nickname Connector_RJ45 (not configured) vs PCB Connector_RJ; LED pins 9–12 still marked "VERIFY". U10/U14/U15 are populated on both sides. With J10 DNP, the populated W5500 block (U11, U12, Y1, C90–C103) has no connector. These are the 3 "real" ERC items (footprint_link_issues). Consequence: the schematic BOM orders three parts the CPL marks DNP; an Update-PCB with "replace footprints" would load the missing Vertical footprint and flip DNP back. Fix: schematic footprints → Connector_Phoenix_MC:PhoenixContact_MC_1,5_3-G-3.5_1x03_P3.50mm_Horizontal (P11, P12) and Connector_RJ:RJ45_Hanrun_HR911105A_Horizontal (J10); set DNP identically on both sides per Leo's intent (if hand-fitted THT: DNP in the schematic too, listed on the hand-assembly sheet); if Ethernet is not fitted on v6, DNP U11/U12/Y1 and their passives as well; verify the J10 LED pins against the HR911105A drawing. Effort: schematic-only (+ Leo's decision).
G-04 · Minor · No solder-jumper bypass across the cut-off connector P5 (ECO §F JP_CUT; Review §4 #9). P5 CUTOFF-SW = {1 /MAIN5V, 2 /SYS5V}; nothing bridges them. Without a plug in P5, /SYS5V is dead. Fix: add JP_CUT = Jumper:SolderJumper-2_P1.3mm_Open_RoundedPad1.0x1.5mm (no BOM part) across P5, open by default, silk "CUTOFF BYPASS"; /SYS5V load ≲ 0.8 A fits a 1.0 × 1.5 mm bridged pad pair. Effort: both.
G-05 · Minor · Silkscreen labels: stale modem-reset label, ECO names missing, P-renumber collisions. "4G NTRIP RESET" at (187.0, 124.1): v6 has no modem-reset button (SW4G1 deleted); the label sits between D34 and L22. SW1 "NRST", SW2 "BOOT" (ECO asks "RESET MCU"); JP2 (chemistry) carries only its refdes, and "F2" is also the fuse refdes; P1 has one label "IGN 24V" at (178.5, 129) with no per-pin legend although v6 accepts 9–36 V; all labels 0.5 mm / 0.1 mm. Renumber hazard: a V5-labelled "P6 FAN" XH-2 plug fits v6 P6 RESET-EXT (the fan motor across NRST–GND holds the MCU in reset); V5 "P8 PANEL_LED" fits v6 P8 NTC2. Fix: delete "4G NTRIP RESET"; SW1 "RESET MCU", SW2 "BOOT0 (DFU)"; JP2 "CHEM 1-2 Li-ion / 2-3 LFP"; P1 legend "VIN 9-36V · GND · IGN · GND · NC"; a function name at every connector (FAN, RESET, NTC1, NTC2, LED, BATT, CUTOFF, 5V BENCH); text ≥ 0.8 mm / 0.15 mm (F-18); harness labels by function, not P-number. Effort: layout.
G-08 · Minor · External-cable inputs P6 (NRST) and P7/P8 (NTC ADC) have no ESD protection. /NRST = {U16.7, C104, SW1, P6.1, TP5}: C104 3.26 mm from the MCU, 35.6 mm from P6, NRST routed 108.6 mm. /NTC_TEMP (PB1) and /NTC2 (PC4) go to P7.1/P8.1 with 100 nF near the MCU (C24 6.63 mm, C157 3.11 mm); P7/P8 at 20.2/21.5 mm. IEC 8 kV/150 pF dumps 1.2 µC ≈ 12 V step on 100 nF before the MCU diodes conduct. Fix: PESD5V0S1BA (C2827694, SOD-323, already in the BOM as D14–D16) at P6.1, P7.1 and P8.1, each ≤ 3 mm from its connector to GND; optional 100 Ω series (C22775) on NRST between P6 and the net. Effort: both.

Notes (G) — not independently verified

ID	Observation	Action
G-06	P2 bench input sits directly on U25's output (`/VEH5V`), no OR-ing. With P2 only: current flows L22 → SW → TPS54360B high-side body diode → `/VIN_PROT`; Q23 then conducts to `/24V_IN`, and via Q10's body diode to `/24V`: ≈ 4 V on P1.1 and `/24V` (U2 may try to run). Benign with both sources (both source-only).	Document in the bench procedure ("P1.1 reads ≈ 4 V on P2-only power"); or a series Schottky on P2 (no LCSC selected). With A-01, Q10/U2 are DNP.
G-07	P3 = JST B3B-XH-A (C144394), 3 A per contact: 2.42 A charge (81 %) with 825 Ω, 1.4 A after A-03; backup peaks 3.0–3.4 A, 0.6–1 A average; ≈ 70 mV across two contacts at 3.4 A.	Keep XH-3 for compatibility with the existing 1S4P packs; if the pack harness is remade (LFP-HT, ECO D1) move to XH-5 (2 × BAT+, 2 × GND, NTC) or JST VH (v6.1).

(b) Pass/fail — §4-G

Check	Evidence (one line)	Result
P1 / P2 power entry	P1 MKDS 5-pin (16 A) = VIN, GND, IGN, GND, NC; P2 = bench 5 V on `/VEH5V`	✅ (G-06 Note)
Ignition GND return	P1.2 and P1.4 = GND, P1.5 NC (as V5.5)	✅
Ignition wire routing / protection	raw `/IGN_IN` 106 mm on In2, no TVS	❌ F-02
JP_CUT across the P5 cutoff	none	❌ G-04
Pin-1 marking / mirrored sockets (J1 errata class)	every connector a KiCad-library footprint with a distinct pad-1 shape and silk marker; J12/J13 symmetric; J14 stock KiCad JAE; no module sockets on v6	✅
Harness pinouts vs V5.5 (by function)	P1, P2, P3=P4, P4=P6, P5=P11, P6=P10, P7=P12, P9=P8, P10=P14, P11=P15, P12=P16 identical	✅
Renumbered-plug collisions	V5 "P6 FAN" fits v6 P6 RESET-EXT; V5 "P8 PANEL_LED" fits P8 NTC2	⚠ G-05
Silkscreen names (RESET MÓDEM / RESET MCU / F2)	stale "4G NTRIP RESET"; SW1 "NRST"; JP2 no legend	❌ G-05
J9 modem USB ESD	none	❌ G-02
J11 DFU ESD	D14/D15/D16 at 3.19/6.74/6.83 mm	✅ (stubs: F-14)
P6/P7/P8 external-cable ESD	none	⚠ G-08
Sch/PCB parity J10/P11/P12	DNP and footprint mismatch	❌ G-03
Mounting holes vs V5.5 enclosure	MH4 (193.2, 90.3) missing, L6 on it; MH11 + partner missing	❌ G-01 (conditional)
Outline / case fit XY	140.00 × 100.00 at V5.5 coordinates; J10 and J11 within 0.09 mm of V5.5	✅
Connector current ratings	P1 16 A, P2 3 A at ≤ 2.5 A, P5 3 A at ≤ 0.8 A, P11/P12 7 A; P3 3 A at 81 % (as-is)	✅ (P3: G-07)

4-H BOM and JLC manufacturability

Full line-by-line check: findings/bom_check.csv (152 BOM lines; LCSC, JLC DB part, package, Basic/Extended, stock at 20/100 boards, footprint vs package, unit price). Cross-references: C130/C131/C78 electrolytics → B-02 / A-09; D21 60 V clone (H-05) → A-01; J10/P11/P12 → G-03 (absorbs H-06); Y1 load caps → E-03 (absorbs H-07).

(a) Findings

H-04 · Blocker · U25's footprint carries `LCSC Part` = C2071691 (AP64350, 40 V) and the Fabrication Toolkit reads that field first

Absorbs: A-15. Status: verified, severity raised Major → Blocker (verify_2: the key order is proven in the toolkit source; the 25-Sep pre-fab audit prescribes that toolkit).

Evidence: 14 v6 footprints carry LCSC Part, all inherited from the easyeda Drogheda-v6.pretty footprints; U25 is the only one whose value differs from LCSC (C2071691 vs C524806). Source: Drogheda-v6.pretty/SO-8_L4.9-W3.9-P1.27-LS6.0-BL-EP.kicad_mod line 12, (property "LCSC Part" "C2071691") (U20 and U25 share this footprint). Fabrication-Toolkit plugins/process.py::_get_mpn_from_footprint tries ['LCSC Part #', 'LCSC Part', …] before the fallback ['LCSC', …] and returns the first non-empty field. The 25-Sep pre-fab audit says "Generate BOM/CPL from the board … (Fabrication Toolkit)", and the V5.5 production/ folder is the toolkit's output folder. AP64350 and TPS54360B are pin-compatible (1 BST, 2 VIN, 3 EN, 4 RT/CLK, 5 FB, 6 COMP, 7 GND, 8 SW) with the same 0.8 V FB.
Consequence: U25 would be assembled as the AP64350: boards pass the bench, then fail at the first transient above 40 V behind a 53 V clamp. Damage risk → Blocker.
Fix: delete LCSC Part from U25 on the board and in the library footprint (or from all 10 Drogheda-v6.pretty footprints). Alternatively generate the BOM from the schematic with kicad-cli (evidence/bom.csv is correct), but delete the field regardless.
Effort: schematic/board property only.

H-01 · Blocker · U15 MAX3232ESE (narrow SO-16) sits on a wide SOIC-16W land: it cannot be soldered (v6 regression)

Status: verified-with-correction (verify_2: V5.5 was built on the correct narrow land; v6 regressed when its footprints were rebuilt from the schematic).

Evidence: JLC DB: C15846 = MAX3232ESE+T, "SOIC-16" (compare C7605 PCF8574T = "SOIC-16-300mil"). Maxim 19-0273 Rev 10 Ordering Information: "MAX3232ESE+ … 16 Narrow SO"; "MAX3232EWE+ … 16 Wide SO". v6 PCB U15 = SOIC-16W_7.5x10.3mm, pads 2.05 × 0.6 mm, pad-row centres x = 117.3 / 126.6 (9.3 mm apart); a narrow SO lead tip reaches ±3.0–3.1 mm while the inner pad edge is at ±3.625 mm → leads end 0.5–0.6 mm short of the pads. History: the V5.5/V5.6 schematics carry the same stale SOIC-16W field, but the V5 PCB uses Package_SO:SOIC-16_3.9x9.9mm_P1.27mm (pads 1.95 × 0.6 at ±2.475 mm); v6 regressed at the 02-Sep fresh-layout re-sync. U15 is the only carried-over LCSC part whose footprint changed.
Consequence: RS-232 (P12) dead on every v6 board; JLC either rejects the job or places a part that cannot be soldered.
Fix: set Package_SO:SOIC-16_3.9x9.9mm_P1.27mm in the v6 schematic and PCB, keep C15846 (genuine Maxim, stock 4873), re-place C84–C88 against U15. Fix the stale field in the V5.x schematics too, so a future Update-PCB cannot break the working V5.5 land. C19268179 (TECH PUBLIC MAX3232ID) only as an alternate; the wide part C118514 (30 in stock) is not recommended.
Effort: both (footprint + local re-route).

H-02 · Blocker (order gate) · U10 and R53 cannot be bought for any order quantity

Status: verified-with-correction (verify_2: Blocker only for U10 + R53; the other stock items become Major H-02b).

Evidence (JLC DB snapshot 2026-09-28): U10 C729142 (SC16IS762IPW) 15 in stock; R53 C131054 (YAGEO 499 k 1 %) 6 in stock, first price break 20+, so JLC's 20-piece minimum cannot be met at any board quantity. R53 sets the LTC4040 boost set-point: unplaced, the backup rail does not regulate.
Consequence: JLC leaves U10 (RS-485/RS-232 bridge) and R53 unplaced.
Fix: U10 → C57156 SC16IS752IPW,128 (same TSSOP-28, pinout and registers; U10 runs in I²C mode (pin 9 = 3V3), where 752 and 762 are identical; the value field already says 752; stock 2670). R53 → C177479 HKR RCT03499KFLF (499 k, 1 %, 100 ppm, 0603, 100 mW, 75 V; stock 26 862). Both are exact drop-ins. Re-check stock on order day.
Effort: schematic-only.

H-02b · Major · Stock to re-check against the order quantity (split from H-02)

Status: verified (verify_2).

Evidence: C103211 (RALEC 100 k 5 %) 702 in stock, 9 per board → 78 boards max (refs R20, R56–R58, R85, R87, Ren1, Rfreq1, Rgs1; R20/Ren1/Rfreq1 disappear if A-01 DNPs the U2 block). U19 A7670SA-LASC C18548276: 96. U18 ZED-F9P-04B C5120257: 104. J14 C2977286: 10 890 but in "Pre-ordered Products" (must be pre-ordered into the JLC account; pre-fab B4 still open). L2+L8 / L6 / U13 / P11+P12 stock is fine at 100 boards.
Consequence: a 100-board order stalls on U18/U19/C103211; J14 fails without a pre-order.
Fix: C103211 → C25803 (UNI-ROYAL 100 k 1 %, Basic, 10.8 M in stock; an upgrade: R87 sets 3V3_ETH, R20 the fan output). Pre-order/consign U18 and U19 for quantities ≳ 100; pre-order J14. Re-check all on order day.
Effort: schematic-only + purchasing.

Minor (H)

H-03 · Minor · Sunlord MWSA0804S inductors (L2, L6, L8, L20) sit on a Bourns SRU8028 land. Status: verified, severity changed Major → Minor (verify_2: the same part/land pairing ran on L2/L6/L7/L8 of 15 assembled V5.5 boards; joint strength is ample). Land: pads 2.0 × 3.2 mm at ±3.9 mm (2.9–4.9 mm from centre). MWSA0804S (Sunlord spec Table 4-1): body 8.2 ± 0.3 × 8.8 ± 0.4 × 3.8 mm, electrodes D 1.4 × E 5.0 mm, recommended land I 2.75 / J 4.0 / H 5.5 mm (typ); wetted electrode area 55–64 %; ≈ 3.8 mm² per joint, SAC ≈ 30 MPa → ≈ 100 N against ≈ 0.1 N/g. The Sunlord drawing letters could not be read in the sandbox (LCSC/Digikey PDFs blocked). The V5.5 "modem dark on battery" was root-caused to back-feed/UVLO, not inductor joints. Fix: change the footprint, not the part (SRU8028-class Bourns parts have lower Isat than MWSA0804S-2R2 for L6): build Drogheda-v6:IND-SMD_MWSA0804S from the LCSC drawing (auditor's reading: pads 2.75 × 4.0 mm, 5.5 mm inner gap → centres ±4.125 mm; courtyard 9.4 × 9.8 mm; confirm against the drawing) and assign it to L2/L6/L8/L20 (C17700171/65/67) while L6/L20 are re-placed anyway; re-check neighbours for the 0.4 mm body growth. Effort: both.
H-08 · Minor · Value-field / BOM mismatches — absorbs D-16 (not independently verified). C22 "22uF/50V" but C138687 is 10 µF 50 V X7R 1210 (moot if A-01 DNPs C22); Y2 "1.8432MHz" but C2238 is 3.6864 MHz (firmware BOARD_SER_XTAL_HZ 3686400UL already matches the fitted part); U10 "SC16IS752IPW" but C729142 is SC16IS762 (fixed by H-02); C103 "100uF/6.3V" but C88744 is 35 V (harmless); C130/C131/C78 "220uF/10V" but C2827940 is 16 V (parts replaced by B-02/A-09). Fix: correct the value fields (C22 → "10uF/50V" unless 22 µF was intended; Y2 → "3.6864MHz"). Effort: schematic-only.

Notes (H) — not independently verified

ID	Observation	Action
H-09	Every fitted BOM line has an LCSC number except TP1–TP8 (copper pads) and PF1–PF21 (virtual). Schematic DNP: C146/C147, R107/R108, R124/R125, R127–R130, U22 (+ J10/P11/P12 on the PCB only, G-03). F2 = C206910 now assigned. The 10 "not found" and 22 "differs from library" symbols were checked pin → pad → net on 25 parts: no hidden pin mismatch. RS1 62.5 mW of 1 W.	None beyond H-01…H-08.
H-10	Cost: cost analysis kept in the repository copy. Consolidations that remove 4 Extended parts: C14676 → C21190 (1 k 1 % Basic), C14675/C103211 → C25803, C304185 → C21189 (0 Ω Basic).	See the repository copy (§9 cost note, §10 #23).

(b) Pass/fail — §4-H

Check	Evidence (one line)	Result
Every fitted BOM line has an LCSC number	all except TP1–TP8 (pads)	✅
LCSC parts exist in the JLC DB	121/121 found	✅
Stock for any order quantity	U10 15, R53 6 (20-pc minimum)	❌ H-02
Stock for 100 boards	C103211 78 boards max; U19 96; U18 104; J14 pre-order	⚠ H-02b
Package ↔ footprint	U15 narrow SO on SOIC-16W land (hard mismatch)	❌ H-01
Inductor land (L7-class SRU8028 vs MWSA0804S question)	55–64 % electrode wetting; ran on 15 V5.5 boards	⚠ H-03
BOM field integrity (tool reads the intended LCSC)	U25 `LCSC Part` = AP64350 read first by Fabrication Toolkit	❌ H-04
DNP list explicit / consistent	schematic DNP list explicit; J10/P11/P12 DNP only on the PCB	⚠ G-03
No `TBD`	F2 now C206910; no TBD on fitted parts	✅
Polarity marks	polarized parts use footprints with pin-1/cathode marks; D27/D28/Q10 marks among the silk overlaps	✅ / ⚠ F-18
Voltage ratings on 24 V nets	ceramics ≥ 50 V (≥ 1.8× at 28.8 V); D21 30 V, U2 30 V abs max	✅ / ❌ A-01
Value fields match parts	C22, Y2, U10, C103, C130/C131/C78	⚠ H-08
Stale library symbols hide pin errors	25 parts checked pin → pad → net, 0 mismatches	✅
U19 / L22 fab attribute	both `smd` (pre-fab B2 closed)	✅
Unit BOM cost delta vs V5.6	cost analysis kept in the repository copy	(H-10 Note)

4-I Requirements traceability (ECO §0 R1–R5)

The full traceability table is §3. Pass/fail summary on v6 as drawn:

Requirement	As drawn	Closed by
R1 — 10-min off/on on battery with report	❌ needs changes + firmware	A-05, E-01, B-02, C-02, D-01, A-01, A-08, H-02 (R53) + FW sequencing
R2 — modem never left dark (MCU can power-cycle it)	✅ hardware; firmware only	FW ladder (B-10 makes STATUS unambiguous)
R3 (brief) — report while on battery	❌ needs changes + firmware	A-05, E-01, B-02, B-03, F-12, F-06 + FW
R3 (ECO) — charge from the 5 V source without brown-out loops	⚠ no fold-back possible; charger does not start	A-04 (+ A-03)
R4 — temperature management (sensors + fan + charger inhibit)	❌ no cell/charger temperature at the MCU	F-51 (+ F-52 option, A-01 fan) + FW
R5 (brief) — charge ≥ 1.3 A without thermal cycling	❌	A-03, A-02, A-04 (+ A-07)
R5 (ECO) — EMC list of the second batch (ECO §E)	❌ items 1, 2, 4, 5 (J9 part) and 6 open; item 3 (fan FB divider) and item 5 (DFU ESD at J11) done	A-02 (1, 2), F-03 (4), G-02 (5), D-02 / D-03 / E-06 / F-12 (6)

4-J ERC / DRC

Run with kicad-cli (KiCad 10.0.4) through the KiCad MCP on the unmodified v6 files. Summary tables in Appendix A (ERC) and Appendix B (DRC). Every item is classified in findings/ercdrc_classified.csv (449 rows: 166 ERC + 283 DRC; columns tool, type, severity, message, coordinates, refs, net, width, rule, layer, classification, justification). Classes: real (a design problem), pre-existing-benign (rule or library noise, no action beyond hygiene), needs-fix-cosmetic (fix for a clean gate, no electrical effect).

Tool	Result	real	pre-existing-benign	needs-fix-cosmetic
ERC	0 errors, 166 warnings	3 (`footprint_link_issues`: P11, P12, J10 → G-03)	126 (104 pin_to_pin, 22 lib_symbol_mismatch)	37 (23 orphan NC flags, 10 lib_symbol_issues, 2 NC-on-connected markers, 2 wire stubs)
DRC	0 errors, 283 warnings, 0 unconnected	59 per the CSV (`track_width` on 7 power nets) → verified: 63 hits on 6 nets (J-02)	206 (124 track_width on low-current nets, 82 lib_footprint_mismatch)	18 (11 silk_overlap, 4 lib_footprint_issues MountingHole, 2 silk_over_copper, 1 silk_edge)

The DRC "0 errors" is produced by the rule set, not by the copper (J-01 → F-01). With the corrected netclasses and .kicad_dru: 6 inner-layer errors (all /IGN_IN, F-02) + 15 outer-layer errors at the 0.3 mm rule (38 at 0.5 mm), plus ≈ 178 zone-fill proximities that disappear on refill. With Default = 0.2 mm and no floor rule: +471 pairs. Five DRC checks are ignored in the project (footprint_type_mismatch, missing_courtyard, track_not_centered_on_via, footprint_filters_mismatch, tuning_profile); J-05 found nothing hidden behind them.

(a) Findings

J-01 is merged into F-01 (Blocker, §4-F).

Minor (J)

J-02 · Minor (residual) · track_width warnings: 6 nets really under-sized; the rest is an over-strict T15 rule. Status: verified-with-correction (verify_2: 6 real nets carrying 63 DRC hits (/BAT_PLUS 123 mm under capacity incl. 69.9 mm of In2 1.0 mm, /MAIN5V 111 mm, /VEH5V 102 mm, /SW_BAT 12.9 mm, /VIN_SW 26 mm, /VBAT_MODEM 12.5 mm); /VIN_MODEM is only a 0.1 mm neck; JLC04161H inner copper 0.5 oz makes inner runs ≈ 40 % weaker than the file's 1 oz). The copper itself is owned by A-02 (/SW_BAT, /BAT_PLUS), A-07 (/VEH5V, /VIN_SW, /MAIN5V) and B-08 (/VBAT_MODEM). Residual fix: move /3V3_ETH to Default (54 benign hits, 0.15 A) and relax T15 for the benign fan/SW_5V/SW_IN/SYS5V/VIN_PROT/VIN_FUSED nets (keep the 0.8 mm rule on /VIN_PROT//VIN_FUSED for pulse/fuse coordination), so the warning list becomes a clean gate. Order 1 oz inner copper or widen inner runs 1.65×. Effort: layout (rules).
J-03 · Minor · 104 ERC pin-to-pin warnings are pin-type noise (not independently verified). All involve pins typed unspecified in easyeda-imported symbols (U19, U20, U23, U24, U26, D21, D22, D27, D28, J12, J13): 50 Unspecified–Passive, 46 Unspecified–Unspecified, 5 –Bidirectional, 2 –Power output, 1 –Input. Net-by-net check found no driver conflict (U23 DIR = GND, U24 DIR = VCCA, single drivers on every UART/status net, Q20/Q21 open drain). Consequence: 104 standing warnings hide the next real one. Fix: retype the pins in Drogheda-v6.kicad_sym (power_in/power_out/input/output/passive). Effort: schematic-only (library).
J-04 · Minor · ERC cosmetics: 23 orphan NC flags, NC flags on 4 connected pins, 2 wire stubs, 10 missing symbols, 22 lib-mismatched symbols — absorbs B-11, D-11 (not independently verified). Orphan NC flags at x = 453.898 mm (13) and 484.378 mm (10), left from the deleted SimpleRTK2B socket. NC flags on connected pins U16.37 (PC6 /USART6_TX → K1.10), U16.38 (PC7 /USART6_RX → R106.2), U10.13/14 (/I2C_SCL//I2C_SDA): nets are real in the netlist and IPC-356 and routed (KiCad reports 2 markers). Wire stubs at P1.4 and R52.2 (uuid 2b755f7f…, 46f71e27…, 7c1dbfc0…). Consequence: the NC flags would suppress a future "unconnected pin" ERC if a label broke (the V5.6 junction incident shows how that happens); a tool honouring NC flags could drop the modem UART. Fix: delete the 27 flags and 3 stub segments by UUID; copy the 10 missing symbols into Drogheda-sym and re-link; leave the 22 mismatches (do not bulk-update); re-run ERC (D-11: the NC-on-connected count should drop by its 2 markers). Effort: schematic-only.

Notes (J) — not independently verified

ID	Observation	Action
J-05	Ignored DRC checks hide nothing real today: `missing_courtyard` only MH5–MH8; `footprint_type_mismatch` JP1–5/TP1–8 (unspecified attribute, SMD pads); 178 track ends off-centre in vias (≤ 0.40 mm, all connected); no tuned nets; 82 lib_footprint_mismatch = KiCad 10 library revisions; 4 lib_footprint_issues = MountingHole nickname not in `fp-lib-table`.	Re-enable `footprint_type_mismatch` after setting TP1–8 to SMD + exclude-from-BOM. Do not run "Update footprints from library" (it would swap P11/P12 and reset pads).

(b) Pass/fail — §4-J

Check	Evidence (one line)	Result
ERC run	kicad-cli, 166 items, full list reconstructed (22 + 10 + 30 exact + 104 pin-to-pin modelled, totals equal KiCad)	✅
ERC errors	0	✅
ERC real items	3 footprint-link issues (P11, P12, J10)	❌ G-03
ERC pin-to-pin conflicts hide a driver clash?	net-by-net check: none	✅ (J-03 hygiene)
NC flags hide a wiring error?	4 flagged pins are connected and routed	✅ (J-04 hygiene)
DRC run	kicad-cli on stored fills, 283 items, 0 unconnected	✅
DRC errors meaningful	0 errors only because the 0.15 mm catch-all overrides all classes	❌ F-01
DRC unconnected	0; 205/205 multi-pad nets routed (pack union-find agrees)	✅
`track_width` real vs benign	63 hits on 6 real nets (A-02/A-07/B-08), 124 benign	❌ copper (A-02, A-07, B-08) / ⚠ J-02 rules
Silk DRC items	14 (11 overlap, 2 over copper, 1 edge)	⚠ F-18
Library footprint mismatch / issues	82 revisions (benign), 4 MountingHole nickname	⚠ J-05
Ignored checks	5 ignored; nothing real behind them	✅ (J-05)

3. §4-I Requirements traceability (R1–R5, ECO §0)

Wording note. The ECO §0 table and the brief §4-I phrase two requirements differently: ECO R3 = "charge the battery from the 5 V source without brown-out loops" (brief R3 = "report while on battery"); ECO R5 = "EMC list of the second batch" (brief R5 = "charge at ≥ 1.3 A without thermal cycling"). The power auditor used the brief wording for R5, the other auditors and verify_2 the ECO wording. Both readings are traced below (R3 / R3′, R5 / R5′) so neither is lost. "As drawn" = v6 snapshot ecee9fed… / 6ddec80d….

Req.	Requirement	Status on v6 as drawn	IDs that close it	Residual risk after the fixes
R1	10-min cycle on battery: everything off, wake, register the modem, report, off	Needs changes + firmware. Structure is right (independent `PWR_CTRL` PA1 / `MODEM_PWR_EN` PC10, STATUS PC9, U20 UVLO margin ≈ 1 V vs 0.1 V on V5.5). As drawn: boost at 91–97 % of its guaranteed 2.5 A during a GSM burst with all loads on; W5500 cannot be switched off; AMS1117 sets a 25–55 mW floor; U24 back-feeds the F9P whenever the modem is on and the F9P off; F9P ramp margin unspecified; VBAT bank ages out; R53 (boost set-point) unobtainable	A-05, E-01, E-02, A-01 (+0.30 V at U20), B-02, C-02, D-01, A-08, H-02; Minor D-03 (LSE wake), A-13 (PFO); firmware §8 (sequencing, LTE-only on battery)	GSM 2.8 A peaks exceed the backup limit → LTE-only on battery is mandatory (Leo: is 2G needed on battery?). Modem LTE average current is an assumption: run the ECO §I-1 battery cold start at VBAT 3.5 V with MAIN5V/VIN scope and a `/BAT_PLUS` current probe
R2	Modem never left dark: MCU can switch, reset and see the modem	Satisfied by hardware; firmware only. U20 EN on PC10 with R113 pull-down (full power removal, τ 0.46 s bleed), PWRKEY via Q20/PC8, RESET via Q21/PC11, STATUS via U24/PC9; the modem can be cycled alone	Firmware recovery ladder (§8); B-10 (STATUS pull-down) makes STATUS unambiguous; A-01 changes the U20 source, not the control	Every MCU reset power-cycles the modem (≈ 30 s re-registration, by design). A V5.6 binary on v6 leaves the modem uncontrolled (D-08; board-ID pin unresolved)
R3 (brief)	Report while on battery	Needs changes + firmware. Budget fits with LTE-only (≈ 1.0–1.3 A on MAIN5V); GSM bursts at 2.2–2.4 A sit at the 2.5 A limit; link robustness limited by LTE ESD, ground vias, RF feed	A-05, E-01, B-02, B-03, F-12, F-06, C-04; A-13 (faster load shedding); firmware §8	LTE-to-GNSS desense not measured: G3 bench (modem TX power vs F9P C/N0, before/after F-12/F-06)
R3′ (ECO)	Charge from the 5 V source without brown-out loops (on v6 the source is U25, not the SD-15B)	Fold-back impossible (RS1 limit 2.14–2.41 A < U25 4.5 A minimum switch limit; the governor is a safety net) ✅, but U25 at 5.00 V nominal sits below `CHG_RAIL_ON` 5.05 V, so the charger never or randomly starts ❌	A-04 (R121 57.6 k → 5.18–5.46 V), A-03 (charger no longer input-limited at 1.4 A); firmware `V5_PFI` 4.40 V + VREFINT	With A-01 the modem load moves onto MAIN5V: 0.44 V margin from U25 minimum minus a 1.6 A step droop to PFI max with 57.6 k (0.13 V as drawn)
R4	Temperature management at ~45 °C ports: sensors + fan + charger inhibit	Needs changes. No cell or charger-die temperature at the MCU (TMP102 deleted; pack NTC goes only to U6.17); fan block works (U2 out of rating, A-01); LTC4040 NTC pause at 42.4 °C unchanged (chemistry D1 pending)	F-51 (TMP102 0x48 + pack-NTC tap on PC5), F-52 (optional modem sensor), A-01 (fan from VEH5V), A-02 / F-12 (heat paths); firmware thermal inhibit	`tcell` exists only with VEH5V present; RNTB/JP2 waits for the chemistry decision; F-51 promotion to Blocker is Leo's call; no modem heatsink clamp holes (G-01)
R5 (brief)	Charge at ≥ 1.3 A without thermal cycling	Needs changes. R50 825 Ω → 2.42 A (2.57 A corner > 2.5 A IC max); `/SW_BAT` 0.5 mm with 0.25/0.30 mm necks, 0 EP vias, L6 8.65 mm; U25 set-point below the governor start	A-03 (1.43 k → 1.316–1.483 A), A-02, A-04, A-07	H0008 causality unproven (≈ 1.3 A inferred from the OCV slope); do the clamp-meter + IR checks and a thermal-camera run on U6/L6 at 1.4 A charge and 2.3 A backup
R5′ (ECO)	EMC list of the second batch (ECO §E)	Needs changes. #1 `SW_BAT` pour ❌, #2 `BAT_PLUS` ❌, #3 fan FB divider at U2.4 ✅ (0.67/1.48 mm), #4 Cin loops < 3 mm ❌, #5 DFU ESD at J11 ✅ / J9 USBLC6 ❌, #6 crystals ≤ 5 mm ❌ (Y3 8.3/11.3, Y4 3.9/6.3, Y2 5.51/4.64 mm), Ethernet RX pair coupled ❌ (1.2 mm), empty 20 mm stitching cells ❌ (10; V5.5 had 8)	A-02 (#1, #2), F-03 (#4), G-02 (#5), D-02 / D-03 / E-06 / F-12 (#6)	Grades follow Leo's ECO marks (🔴 → Blocker, 🟠 → Major, 🟡 → Minor) except stitching, kept Major because v6 adds an LTE PA and a GNSS receiver (verify_2). Y2 (5.51 mm) has no finding

4. §4-D Pin map (condensed, 64/64 pins)

Complete table (AF/ADC/EXTI, FT/TC, V5 macro vs v6, distances, draft board_v6.h): pinmap-v6.md (same folder). "Audit change" = pin-level effect of a finding if it is adopted; blank = no change.

Pin	Name	v6 net	Function on v6	Proposed v6 macro	Audit change
1	VBAT	/3V3	backup domain tied to 3V3 (no coin cell)	—
2	PC13	/LED_C13	status LED, active LOW	`PIN_LED_C13`
3	PC14	/LSE_IN	32.768 kHz LSE	`BOARD_LSE_HZ`	D-03: Y4 → C48615, C115 6.8 pF
4	PC15	/LSE_OUT	LSE	—	D-03: C116 6.8 pF
5	PH0	/HSE_IN	25 MHz HSE (ROM DFU needs it)	`BOARD_HSE_HZ`	D-02: Y3 → C2901684, C113 12 pF
6	PH1	/HSE_OUT	HSE	—	D-02: C114 12 pF
7	NRST	/NRST	MCU reset (SW1, P6, TP5, C104)	—	G-08: ESD at P6
8	PC0	/ETH_INT	W5500 INT, EXTI0	`PIN_ETH_INT`
9	PC1	/GNSS_ANT_DETECT	F9P input, undriven	`PIN_GNSS_ANT_DET` (hi-Z)	C-01: stays undriven
10	PC2	/GNSS_ANT_SHORT_N	F9P input	`PIN_GNSS_ANT_SHORT_N`	C-01: TPS2552 FAULT̅ → LOW = antenna short
11	PC3	/GNSS_RTK_STAT	F9P RTK status, EXTI3	`PIN_GNSS_RTK_STAT`	D-08: mis-flash hazard (V5.6 drives PC3)
12	VSSA	GND	analog ground	—
13	VDDA	/VDDA	ADC reference (R104 10 Ω)	—	A-08/A-04: calibrate from VREFINT
14	PA0	/BAT_SENSE	pack ÷ 2, ADC1_IN0 (TC)	`PIN_BAT_SENSE`
15	PA1	/PWR_CTRL	F9P rail enable (Q5 → Q1 → U21)	`PIN_GNSS_PWR` (+ alias `PIN_PWR_CTRL`)	D-09: 100 k base pull-down
16	PA2	/GNSS_TX	USART2_TX → F9P RXD	`PIN_GNSS_TX`	hi-Z while F9P off
17	PA3	/GNSS_RX	USART2_RX ← F9P TXD	`PIN_GNSS_RX`
18	VSS	GND	ground	—
19	VDD	/3V3	supply	—	D-15: cap ≤ 2 mm
20	PA4	/5V_SENSE	VEH5V ÷ 2, ADC1_IN4	`PIN_5V_SENSE`	A-04: 5.32 V → 2.66 V
21	PA5	/IGN_SENSE	ignition, ADC1_IN5 (read analog)	`PIN_IGN_SENSE`	F-02: Rig1 at P1.3 + SMBJ33A; D-05: Rigb1 2.2 k
22	PA6	/FAN_PWM	fan low-side ON/OFF (TIM3_CH1)	`PIN_FAN`	A-01: fan supply = VEH5V
23	PA7	/GNSS_TIMEPULSE	PPS, TIM3_CH2 / EXTI7	`PIN_GNSS_PPS`
24	PC4	/NTC2	probe 2, ADC1_IN14	`PIN_NTC2`
25	PC5	NC (spare)	ADC1_IN15	`PIN_NTC_CELL`	F-51: pack-NTC tap
26	PB0	/EXT_LED	panel LED (P9)	`PIN_EXT_LED`
27	PB1	/NTC_TEMP	probe 1, ADC1_IN9	`PIN_NTC`
28	PB2	/BOOT1_STRAP	BOOT1 = 0 (R99 10 k)	— (never reconfigure)
29	PB10	NC (spare)	EXTI10	`PIN_PFO`	A-13: PFO + 100 k pull-up
30	VCAP1	/VCAP1	core regulator cap (C111)	—
31	VSS	GND	ground	—
32	VDD	/3V3	supply	—	D-15
33	PB12	/ETH_CS	W5500 CS	`PIN_ETH_CS`
34	PB13	/ETH_SCK	SPI2 SCK (AF5)	`PIN_ETH_SCK`
35	PB14	/ETH_MISO	SPI2 MISO (AF5)	`PIN_ETH_MISO`
36	PB15	/ETH_MOSI	SPI2 MOSI (AF5)	`PIN_ETH_MOSI`
37	PC6	/USART6_TX	MCU → modem via K1 NO (Mode B), AF8	`PIN_MODEM_TX`	J-04: delete NC flag
38	PC7	/USART6_RX	modem → MCU via R106, AF8	`PIN_MODEM_RX`	D-01 gate on U18.26; B-10: R106 1 k; J-04
39	PC8	/MODEM_PWRKEY	PWRKEY via Q20 (HIGH = pressed)	`PIN_MODEM_PWRKEY`
40	PC9	/MODEM_STATUS	STATUS via U24	`PIN_MODEM_STATUS`	B-10: 100 k pull-down
41	PA8	/CHRG_EN	charger disable (HIGH = off)	`PIN_CHRG_EN`	A-11: R56 → pull-up (default off)
42	PA9	NC (spare)	USART1_TX (was RELAY TX on V5)	`PIN_DBG_TX` if a pad is added	D-12: TP9; only candidate left for D-08
43	PA10	/USART1_RX	F9P TXD2 tap, RX-only, no pull	`PIN_F9P_TX2_TAP`	D-01: Rdfu1 100 k
44	PA11	/DFU_DM	USB FS D− (J11)	—	F-14: ESD in-line
45	PA12	/DFU_DP	USB FS D+ (J11)	—	F-14
46	PA13	/SWDIO	SWD (TP3)	—	D-12
47	VSS	GND	ground	—
48	VDD	/3V3	supply	—
49	PA14	/SWCLK	SWD (TP4)	—	D-12
50	PA15	/ETH_RST	W5500 reset (JTDI pull-up at reset)	`PIN_ETH_RST`	E-02: 4.7 k (C23162) to GND
51	PC10	/MODEM_PWR_EN	U20 EN (R113 100 k PD)	`PIN_MODEM_PWR_EN`	A-01: U20 input source only
52	PC11	/MODEM_RST	modem RESET via Q21	`PIN_MODEM_RST`
53	PC12	/GNSS_RESET_N	F9P reset, open-drain only	`PIN_GNSS_RESET_N`
54	PD2	NC (spare)	EXTI2	`PIN_ETH_PWR_EN`	E-01: U12 EN + 100 k PD (D-08 conflict)
55	PB3	/CHRG_STAT	LOW = charging	`PIN_CHRG_STAT`
56	PB4	/CHRG_FAULT	LOW = fault / NTC pause	`PIN_CHRG_FAULT`
57	PB5	/BYP_CTRL	K1 Mode B (TC pin, output)	`PIN_BYP_CTRL`
58	PB6	/I2C_SCL	I2C1 SCL (AF4)	`PIN_I2C_SCL`	F-51: TMP102 at 0x48
59	PB7	/I2C_SDA	I2C1 SDA (AF4)	`PIN_I2C_SDA`
60	BOOT0	/BOOT0	R98 10 k PD + SW2	—	G-05: silk "BOOT0 (DFU)"
61	PB8	/SER_IRQ	SC16IS752 IRQ, EXTI8	`PIN_SER_IRQ`
62	PB9	/ACC_INT1	SC7A20 INT1, EXTI9	`PIN_ACC_INT1`
63	VSS	GND	ground	—
64	VDD	/3V3	supply	—	D-15

Count: 50 GPIO pads + 6 special (NRST, BOOT0, VBAT, VCAP1, VDDA, VSSA) + 4 VDD + 4 VSS = 64. Spares as drawn: PA9, PB10, PC5, PD2; after the adopted fixes only PA9 remains.

5. Ranked change list

Ranking criterion within each severity: hardware-damage path first, then repeat of a paid-for lesson, then requirement R1–R5, then reliability/EMC, then process. Owner: Sch = schematic (Claude applies on the copy hbox-watchdog-v6-audit.*, Leo reviews); Lay = layout (Michelle); FW = firmware; Leo = decision or purchasing. Effort: S = schematic-only, L = layout, B = both, F = firmware-only.

Part 1 — Blockers (must change before ordering)

#	ID	Change	Owner	LCSC / numbers	Effort	Closes
1	A-01	U20 fed from `/MAIN5V` only (delete D20 + 48 mm `/VIN_MODEM` run, D21 → copper); fan from `/VEH5V` (U2 block DNP, JP1 bridged); Q10/DzG1/Rrp1/C10/C11/C22 DNP; F2 → 3 A ahead of D10	Sch + Lay	F2 C206912 (4 A C206914 only for 9 V); JP1 bridged footprint	B	Damage path; R1/R3 (+0.30 V at U20); F1, F8
2	F-02	Rig1 ≤ 3 mm of copper from P1.3 (long run becomes `/IGN_SENSE`); SMBJ33A `/IGN_IN` → GND at P1.3; `/24V_IN` off In1 or ≥ 1.0 mm from LV	Sch + Lay	C224019; Rig1 C88614 moves	B	23-Jul short lesson; damage
3	F-01	Netclass table + corrected `.kicad_dru` (incl. HV24↔HV24); refill; DRC gate; fix the 15 outer spots (F-15)	Lay (rules drafted in §2 4-F)	floor 0.15 · HV24↔HV24 0.2 · HV24 outer 0.3 · HV24 inner 0.5 mm	L	23-Jul short lesson
4	H-04	Delete `LCSC Part` from U25 on the board and in `Drogheda-v6.pretty/SO-8_L4.9-…-EP.kicad_mod`	Sch	U25 stays C524806	S	Damage (40 V part behind 53 V clamp)
5	C-01	TPS2552 current-limited antenna feed: ANT_OFF → EN̅ (100 k PD), FAULT̅ → ANT_SHORT_N (10 k to 3V3_GNSS), U18.7 NC	Sch + Lay	C46506, C25803, C25804	B	Damage; field faults H0005/H0014
6	B-03	D28 → bidirectional 24 V ESD on an 0402 land, or DNP	Sch + Lay	C1975527	B	R3 (link); homologation
7	A-02	U6 re-cluster: L6 ≤ 5 mm, C30/C31 ≤ 3 mm, C32–C34 ≤ 2 mm; `/SW_BAT` pour ≥ 2 mm; `/BAT_PLUS` ≥ 1.5 mm; EP ≥ 9 vias; In1/In2 solid ≥ 5 mm	Lay	3 × 3 vias 0.3/0.6 mm at 0.9 × 1.2 mm	L	R5, R4, ECO §E #1 #2; F5
8	A-03	R50 825 Ω → 1.43 kΩ	Sch	C22840	S	R5, R3′; F4
9	H-01	U15 footprint → `Package_SO:SOIC-16_3.9x9.9mm_P1.27mm` (sch + PCB), re-place C84–C88; fix the stale field in V5.x too	Sch + Lay	U15 stays C15846	B	Manufacturability
10	H-02	U10 → SC16IS752; R53 → HKR 499 k	Sch	C57156, C177479	S	Order gate; R1 (R53 = boost set-point)
11	G-01 (conditional)	Restore MH4 at (193.2, 90.3); place MH11 + partner near U19; ≥ 4 mm copper-free radius	Leo (backplate) + Lay	coordinates	L	Enclosure fit; thermal gate T1

Part 2 — Majors (change before ordering unless Leo writes a reason)

#	ID	Change	Owner	LCSC / numbers	Effort	Closes
1	V1-01	F2 electrically first: P1 → F2 → D10 ∥ Q23 (D10 moves to the F2 output)	Sch + Lay	F2 C206912 (A-01)	B	Damage on reversed P1
2	D-01	U27 74LVC1G125 on `/3V3_GNSS` between `/DOUT_4G` and U18.26 (+100 nF); Rdfu1 22 k → 100 k	Sch + Lay	C12518, C14663, C25803	B	R1; 0.5.5/0.5.6 back-feed lesson
3	A-04	R121 53.6 k → 57.6 k (5.18/5.32/5.46 V)	Sch	C23082	S	R3′, R5; F7
4	B-02	C130/C131 → polymer; R116 113 k, C141 6.8 nF, C142 56 pF; + 2 × 22 µF at L20.2; C131 ≤ 5 mm from U19	Sch + Lay	C881921 ×2, C22862, C1542, C1572, C86817 ×2	B	R1, R3; F1
5	E-01	`/ETH_PWR_EN`: U12.2 EN → PD2, 100 k to GND	Sch + Lay	C25803	B	R1, R3; F8
6	A-05	CSYS + 2 × 47 µF 1210 at U6 VSYS pins 1/24	Sch + Lay	C5440143 ×2	B	R1, R3; F1, F2
7	F-51	TMP102 between U6 and L6 (0x48); pack-NTC tap `/NTC` → PC5 (100 k / 120 k + 10 nF)	Sch + Lay	C99269, C14663, C25803, C25808 (120 k), C1589	B	R4; F5, F6
8	F-12	Ground vias: EP arrays (U25/U20 6, U12 6), U19 ≥ 30–40, U18 ≥ 24, U.FL 2 per pad, islands ≥ 2, edge fence ≤ 5 mm, board ≥ 400; pad-level solid on EPs/module GND	Lay	0.3/0.6 mm vias; 0 empty 20 mm cells	L	R3, R4, ECO §E #6
9	F-03	Hot loops U25/U20/U12 (Cin ≤ 2 mm, one GND island, loop ≤ 1 cm², FB ≤ 3 mm); U20 + 2 × 22 µF + 220 µF	Lay + Sch	C86817 ×2, C881921	B	ECO §E #4
10	A-07	`/VEH5V`, `/VIN_SW`, `/MAIN5V` ≥ 2 mm F.Cu or pour; Kelvin CLN/VIN sense at RS1; 1 oz inner or 1.65× width	Lay	≥ 2 mm; ≥ 4 vias per transition	L	R5; prerequisite of A-01
11	F-06	Real stackup + impedance control; RF CPWG 0.30/0.20 on F.Cu over solid In1; LTE rerouted off In1; fence ≤ 3 mm; RF netclass; GNSS bias line ≥ 1 mm	Lay	JLC04161H-7628	L	R3 (link, desense)
12	F-05	Clear In1 under USB, crystals, switch nodes, VBAT/RF, SIM and the 3 broadside parallels; ≤ 3 In1 islands	Lay	no critical net over a void > 1 mm	L	ECO §E (return paths), Copper Plan
13	C-04	Q1/Q5/R1/R2 into the GNSS island; `/SW_5V` ≤ 15 mm, 0 mm on In1	Lay	—	L	R3 (desense)
14	G-02	USBLC6-2SC6 at J9, ≤ 3 mm, flow-through	Sch + Lay	C7519	B	ECO §E #5; F8
15	C-02	U21 AP2112K → TPS7A2033P (soft-start 239–367 µs/V)	Sch	C2862740	S	R1 (52 000 starts/year)
16	A-08	U17 AMS1117 → TLV1117LV33 (not C48937499)	Sch	C15578	S	R1 (sleep floor); F2
17	E-02	4.7 k `/ETH_RST` → GND at U11.37 (Minor once E-01 is in)	Sch	C23162	S	R1; F8
18	A-09	C78 → polymer	Sch	C881921	S	Lifetime
19	H-02b	C103211 ×9 → C25803; pre-order U18, U19 (qty ≳ 100) and J14	Sch + Leo	C25803	S	Order

Part 3 — Minors (brief; can ride along or go to v6.1)

ID	Change	Owner	LCSC / numbers	Effort
A-10	VEH5V over-voltage protection (LTC4040 OVP circuit or 5 V TVS crowbar)	Sch + Lay	no LCSC selected in the findings	B
A-11	R56 re-netted to `/3V3` (charger OFF by default)	Sch + Lay	C25803	B
A-13	PFO → PB10 + 100 k pull-up (absorbs D-10)	Sch + Lay	C25803	B
A-14	R53/R54 ≤ 3 mm from U6.18/10, Q7 ≤ 5 mm, IGATE ≤ 8 mm on F.Cu (absorbs F-10)	Lay	—	L
B-08	`/VBAT_MODEM` pour ≥ 3 mm into pins 55–57	Lay	—	L
B-09	R132–R134 → 22 Ω; 100 nF at J14.C1; SIM ESD next to J14	Sch + Lay	C23345, C1525	B
B-10	100 k `/MODEM_STATUS` → GND; 100 k `/DIN_4G` → 3V3; R106 → 1 k (absorbs D-14)	Sch	C25803 ×2, C14676	S
C-07	Test pads on U18.50 SAFEBOOT_N and U18.49 RESET_N	Sch + Lay	no part	B
D-02	Y3 → 3225 CL 10 pF + 12 pF caps, ≤ 3 mm (absorbs F-11 Y3)	Sch + Lay	C2901684, C38523 (alt. C9006 + C1644)	B
D-03	Y4 → FC-135 CL 7 pF + 6.8 pF caps, ≤ 3 mm	Sch + Lay	C48615, C1679	B
D-05	Rigb1 3.3 k → 2.2 k; firmware reads PA5 on the ADC	Sch + FW	C4190	S/F
D-08	Board-ID strap 10 k → GND (pin unresolved: PD2 taken by E-01)	Leo + Sch	C25804	B
D-09	100 k `/BASE_LS` → GND (absorbs A-12)	Sch + Lay	C25803	B
D-12	TP9 on PA9; optional SWD footprint	Lay	no part	L
E-03	Y1 → 3225 CL 12 pF, keep 18 pF, ≤ 3 mm (absorbs H-07, F-11 Y1)	Sch + Lay	C9006 (alt. C95/C96 → C1663)	B
E-04	C91 → 10 nF, C90 → 4.7 µF, + 100 nF at AVDD pairs	Sch + Lay	C1589, C1779, C14663	B
E-06	Ethernet pairs coupled on F.Cu, 100 Ω diff	Lay	optional array: no LCSC	L
F-14	J11 ESD in-line, D15 ≤ 3 mm, via ≤ 1 mm	Lay	—	L
F-17	USB pairs F.Cu only, coupled, ≤ 1 via pair	Lay	—	L
F-18	Silk refs ≥ 0.8/0.15 mm; DRU text rule; clear 14 silk items	Lay	—	L
F-52	Modem temperature: `AT+CPMUTEMP` or TMP102 at 0x49	FW or Sch + Lay	C99269	F/B
G-03	Sch footprints for P11/P12/J10 + DNP parity (absorbs E-05, H-06)	Sch + Leo	—	S
G-04	JP_CUT solder jumper across P5	Sch + Lay	no part	B
G-05	Silk labels: delete "4G NTRIP RESET", RESET MCU, BOOT0 (DFU), JP2 CHEM, P1 legend, function names	Lay	—	L
G-08	PESD5V0S1BA at P6.1, P7.1, P8.1	Sch + Lay	C2827694 ×3 (opt. C22775)	B
H-03	New `IND-SMD_MWSA0804S` footprint for L2/L6/L8/L20	Lay (+ lib)	parts unchanged	B
H-08	Value fields: C22, Y2 (3.6864 MHz), U10, C103, C130/C131/C78 (absorbs D-16)	Sch	—	S
J-02	Residual: `/3V3_ETH` → Default; relax T15 on benign nets	Lay (rules)	—	L
J-03	Retype `unspecified` pins in `Drogheda-v6.kicad_sym`	Sch (lib)	—	S
J-04	Delete 27 NC flags + 3 wire stubs; re-link 10 missing symbols (absorbs B-11, D-11)	Sch	—	S

6. Layout instruction list for Michelle

Self-contained: every instruction carries its numbers; the finding ID is only for traceability. Work on the audit copy hbox-watchdog-v6-audit.kicad_pcb after the schematic changes of §7 have been synced (Update PCB without "replace footprints", see L-45). Units mm. Vias 0.3 mm drill / 0.6 mm pad unless stated. Coordinates are v6 board coordinates. Order: set rules and stackup first (L-1 … L-4), then the Blocker copper (L-5 … L-17), then Majors, then Minors, then the acceptance checks (L-48).

A. Board setup (before touching copper)

1. Stackup (F-06): Board Setup → Physical Stackup = JLC04161H-7628: Cu 0.035 / prepreg 0.2104 (εr 4.4) / Cu 0.035 / core 1.065 (εr 4.6) / Cu 0.035 / prepreg 0.2104 (εr 4.4) / Cu 0.035; copper finish ENIG. Order note: impedance control; 1 oz inner copper (or widen every inner power run 1.65×, L-19).

2. Netclasses (F-01): create/assign by exact net name (one pattern per line, leading /). HV24 (clearance 0.3, track 1.0, via 0.8/0.4): /24V_IN /VIN_FUSED /VIN_PROT /24V /IGN_IN /Q10_GATE /Q23_GATE /SW_PWRIN /BOOT_PWRIN /SW_MODEM /BST_MODEM (plus /VIN_MODEM, /SW_FAN, /BST_FAN only if A-01 is not adopted). PWR_HI (0.15 / 1.5 / 0.8/0.4): /BAT_PLUS /SW_BAT /MAIN5V /VEH5V /SYS5V /VIN_SW. PWR_MID (0.15 / 0.6 / 0.8/0.4): /SW_5V /SW_IN /5V_FAN /FAN_RET. PWR_MODEM (0.15 / 1.5 / 0.8/0.4): /VBAT_MODEM. RF (clearance = CPWG gap 0.20, width 0.30, no vias, excluded from autoroute): /RF_GNSS /RF_ANT_GNSS /RF_LTE /RF_ANT_LTE. Default (0.15 / 0.2 / 0.6/0.3): everything else, including /3V3_ETH. Delete all un-prefixed duplicate patterns and the dead /3V3_MODEM, /SW3_NODE patterns.

3. Custom rules (F-01): replace the rules "Minimum clearance 1", "HV24 clearance", "HV24 exception" with, in this order: floor 0.15 mm for non-HV24 non-RF pairs; HV24↔HV24 0.2 mm; HV24↔other 0.3 mm on outer layers; HV24↔other 0.5 mm on inner layers; pad-to-pad 0.15 mm inside U2/U20/U25 footprints (exact text in §2 4-F, F-01). Set the text rule to min height 0.8 mm / min thickness 0.15 mm (F-18). Relax the T15 width warnings for the low-current nets (/5V_FAN, /FAN_RET, /SW_FAN, /SW_5V, /SW_IN, /SYS5V), keep ≥ 0.8 mm on /VIN_PROT//VIN_FUSED (J-02).

4. Check the rules resolve: Inspect → Clearance Resolution on one /24V–GND-zone pair (expect 0.5 mm on In1) and one GND-zone–Default pair (expect 0.15 mm). After every GUI save of the project, re-check that the netclasses survived.

B. Vehicle input and 24 V (Blockers A-01, F-02, V1-01, F-01)

5. Fuse first (V1-01, A-01): place F2 (now 3 A, C206912, same Nano2 holder) electrically first: P1.1 → F2 → then D10 (SMBJ33A) and Q23 in parallel on the F2 output. Nothing but F2 on the P1.1 copper.

6. Remove the unfused branch (A-01): Q10, DzG1, Rrp1, C10, C11, C22 and the U2 fan-buck block (U2, L2, Dbk1, Cbst1, Rcomp1, Ccomp1, Rfreq1, Ren1, Ren2, R20, R21) become DNP: delete their /24V, /SW_FAN, /BST_FAN copper. JP1 becomes a bridged solder jumper (SolderJumper-2_P1.3mm_Bridged_RoundedPad1.0x1.5mm), so /5V_FAN = /VEH5V.

7. Modem buck input (A-01): delete D20 and the 48 mm /VIN_MODEM run from D20 (136.5, 113.8) to U20; remove D21 and join its two nets in copper (/VIN_MODEM becomes part of /MAIN5V). The /MAIN5V path from Q7/U6 to U20.2 is ≥ 1.5 mm wide all the way (A-05/A-07).

8. Ignition (F-02): move Rig1 (22 k, 0603) so that the copper from P1.3 to Rig1.1 is ≤ 3 mm, on F.Cu only. Add the new SMBJ33A (DO-214AA) from /IGN_IN to GND right at P1.3. The long run from Rig1.2 to the MCU is now /IGN_SENSE (Default class); keep Rig2, Rigb1, C9, D5 at the MCU. Remove the old In2 /IGN_IN run (106.5 mm) and the In1 via at (127.3, 50.5).

9. /24V_IN off In1 (F-16): reroute the 27 mm In1 run (167.5, 128.65) → (143.25, 121.75) to F.Cu along the south edge; if In1 must be used, keep ≥ 1.0 mm from every LV net with nothing crossing it.

10. Outer-layer 24 V spots (F-15): after refill + DRC (L-48), fix: /VIN_PROT 1.5 mm track vs /VEH5V 0.8 mm track at (176.24, 116.28) → ≥ 0.5 mm, and tent the /VEH5V via there; /USB_VBUS away from Q23 (≥ 0.3 mm from /Q23_GATE and /VIN_PROT); remove the U20 GND neck (L-22); /SW_PWRIN and /BST_MODEM ≥ 0.3 mm from GND tracks. Tent every via except test vias.

C. LTC4040 charger/backup (Blocker A-02; A-07, A-14, F-51, A-05)

11. Re-cluster U6: L6 pad 1 ≤ 5 mm (edge) from U6 pins 21/22; C30/C31 ≤ 3 mm from U6 pin 6; C32/C33/C34 and the two new 47 µF 1210 CSYS caps ≤ 2 mm from VSYS pins 1/24, GND pads on the EP copper; C35 (or the new 22 µF 0805) at L6.2 next to BAT pin 23. L6 may not sit on (193.2, 90.3) if MH4 is restored (L-40).

12. /SW_BAT: F.Cu polygon ≥ 2 mm wide from the combined pin 21+22 fan-out to L6.1, compact (switch node), no 0.25/0.30 mm necks beyond the pin fan-out.

13. /BAT_PLUS: P3 → L6.2 ≥ 1.5 mm F.Cu or pour; if any part runs inner, ≥ 4 vias per layer change and ≥ 1.5 × 1.65 = 2.5 mm on 0.5 oz inner copper. Take the BAT-pin sense (U6.23) as a Kelvin tap from L6.2/C35.

14. /MAIN5V: pour from U6 pins 1/24 over C32–C34 to the Q7 drain, ≥ 2 mm, no 0.3/0.5 mm necks.

15. U6 EP: 9 vias, 3 × 3 at 0.9 × 1.2 mm pitch, 0.3/0.6 mm, plugged/capped (JLC via-in-pad) or tented; pad zone_connect solid.

16. Planes under U6: In1 and In2 GND solid for ≥ 5 mm around U6 and L6: move the 7 /VFB_BST segments, /IGATE, /CHRG_* off In1 there.

17. Temperature sensor (F-51): place the new TMP102 (SOT-563) between U6 and L6, ≤ 5 mm from the U6 EP, 100 nF at its VDD, on I²C1. Route the pack-NTC tap: /NTC → 100 k → PC5 (U16 pad 25), with 120 k (C25808) and 10 nF (C1589) from the PC5 node to GND.

18. BSTFB / IGATE (A-14): R53/R54 ≤ 3 mm from U6 pins 18/10, top leg Kelvin-tapped at the CSYS pads, /VFB_BST on F.Cu; Q7 ≤ 5 mm from U6.15; /IGATE ≤ 8 mm on F.Cu, flanked by /MAIN5V copper.

19. 5 V path (A-07): /VEH5V L22.2 → RS1.1 on F.Cu ≥ 2 mm (move L22/C153/C154 toward RS1), or ≥ 2 mm inner with ≥ 4 vias per transition; /VIN_SW RS1.2 → Q7 on F.Cu ≥ 2 mm, Q7 ≤ 5 mm from RS1/U6. Route U6.7 (CLN) and U6.6 (VIN) sense traces from the inner edges of the RS1 pads (Kelvin), not 1.66 mm down the trace as today.

D. Switchers (Major F-03)

20. Common rule for U25, U20, U12: input caps (VIN and GND pads) ≤ 2 mm from the IC VIN and GND/EP pins; Cin GND, catch-diode anode and EP on one solid F.Cu area, no GND neck narrower than 1 mm; ≥ 2 vias ≤ 1 mm from each Cin GND pad; catch diode ≤ 3 mm from SW; inductor ≤ 5 mm from SW; SW copper ≤ 25 mm²; FB divider ≤ 3 mm from the FB pin; nothing on In1 under any SW copper. Acceptance: input loop area ≤ 1 cm² (U25 today ≈ 3.1 cm²).

21. U25: C149/C150 ≤ 2 mm from pins 2/7 on the EP/D34 copper (today C149/C150/C151 GND is on the U6 island); D34 cathode ≤ 2–3 mm from pin 8, anode on the Cin GND copper; L22 ≤ 5 mm from pin 8 (today 13.75 mm) with /SW_PWRIN ≤ 25 mm² (today 45.8 mm²) and not above In1 signal tracks; 4 GND vias around the Cin/D34 node within 2 mm; D34 GND pad solid.

22. U20: delete the 0.25 mm GND track between U20.1 and U20.2; C127/C128 GND pads face the EP, bonded by solid F.Cu; add the two new 22 µF 0805 caps ≤ 3 mm from U20.2 and the new 220 µF polymer (6.3 × 7.7) at U20.2; R110/R111 ≤ 2 mm from U20.5 on the side away from pin 8; VBAT sense by a dedicated trace from C131; delete the 5.6 mm In1 FB detour; keep /VIN_MODEM (now MAIN5V) ≥ 0.3 mm from the EN/RT/EP pads.

23. U12: C101 ≤ 2 mm from U12.7 (VIN; today 6.40 mm) with GND next to pin 5; D11 ≤ 2 mm from pin 1 with its anode on C101's GND copper (today 11.92 mm, different island); L8 ≤ 5 mm (today 15.10 mm); R87/R88 ≤ 3 mm from U12.4, R87 top fed by a Kelvin trace from C102/C94; /ETH_FB ≤ 5 mm on F.Cu with nothing under /ETH_SW; replace the 0.2 mm GND ties with pour.

E. Grounding and stitching (Major F-12)

24. EP via arrays: U25 and U20 (EP 3.2 × 2.5): 2 × 3 = 6 vias at 1.0 mm pitch, or 2 × 4 = 8 at 0.8 mm with 0.3/0.5 vias (3 × 3 at 1.0 mm does not fit the 2.5 mm side); U12 (EP 2.29 × 3.0): 2 × 3; U6: see L-15.

25. Pad connection: set zone_connect solid per pad on: all EPs, all U18 and U19 GND pads, D34/D11 anodes, buck Cin/Cout GND pads. Leave the zone default thermal relief (≥ 2 spokes) for small passives (do not set the zones to "thermal reliefs for PTH only": that makes 23 × 0402 and 142 × 0603 GND pads solid and risks tombstoning).

26. U19 A7670SA: one tented via in each 1.7 mm gap between adjacent 2.1 mm centre GND pads (0.55 mm clearance per side) plus a via ring on the perimeter GND pads: ≥ 30, target 40, never inside a pad.

27. U18 ZED-F9P: vias at the diagonal interstitial centres of the 2.1 mm GND pad grid (0.41 mm to pad corners): ≥ 24; no microvias needed. Under U18/U19 use tented or JLC "epoxy filled & capped" vias.

28. U.FL and ESD grounds: 2 GND vias ≤ 1 mm from each GND pad of J12 and J13, and at D28.

29. Stitching: every F.Cu GND island ≥ 20 mm² gets ≥ 2 vias; no F.Cu GND pour point > 5 mm from a GND via (today median 10.4 mm, max 29.5 mm in the east pour); edge fence at ≤ 5 mm pitch within 1.5 mm of the 0.5 mm edge clearance (≈ 96 vias); board total ≥ 400 GND vias (today 69). Acceptance: 0 empty 20 × 20 mm cells (today 10 of 35).

F. RF, GNSS supply and planes (Majors F-06, C-04, F-05; Blocker B-03)

30. RF lines (F-06): both RF runs on F.Cu only, CPWG over solid In1, start at w 0.30 / gap 0.20 mm, finalise with JLC's impedance calculator for 50 Ω on JLC04161H-7628.

31. LTE (F-06, B-03): reroute U19.60 → R118/C146/C147 → D28 → J13 entirely on F.Cu (rotate J13 or move it toward U19's RF pad side); remove the 22 mm In1 section and its two vias at (174.25, 58.25) and (194.27, 53.72). Nothing on any layer above or below the line; /VBAT_MODEM ≥ 3 mm away. Replace D28's SOD-923 land with an 0402 land in the same in-line spot (new part PESD0402-240, or leave DNP).

32. Fences (F-06): GND vias on both sides of RF_LTE/RF_ANT_LTE and RF_GNSS/RF_ANT_GNSS at ≤ 3 mm pitch, ≤ 1 mm from the gap edge.

33. GNSS bias (F-06, C-01): place the new TPS2552 (SOT-23-6) near L21/J12; its output net /ANT_BIAS (was /VCC_RF_GNSS) runs ≥ 1 mm from the RF line with a stitched GND strip between (or on In2 after 100 pF + 100 nF decoupling); L21 taps the RF line stub-free at J12; move D27 onto the J12 pad (no stub).

34. GNSS supply switch (C-04): move Q1, Q5, R1, R2 (F1 optional) into the GNSS island next to U21/C3/C40/C119; bring /SYS5V (or /SW_IN) to them; /PWR_CTRL becomes the long signal; /SW_5V ≤ 15 mm and 0 mm on In1 (today 181 mm on In1).

35. In1 plane (F-05): at minimum clear In1 under: the USB pairs (J9 and J11), every crystal and its lines, all switch nodes, /VBAT_MODEM and the RF area, the SIM lines, and the three broadside parallels (I2C_SDA over /SER_TXB 14.2 mm, ETH_XO over /ETH_RST 6.95 mm, NRST over /USART6_RX 7.2 mm). Move In1 tracks to In2/B.Cu (or F.Cu where short), priority /SW_5V, /MAIN5V, /KCOIL, /USART6_TX/RX, /DOUT_4G, /CHRG_*, /SER_TXB/RXB, /ETH_*, /VFB_BST, /IGATE. Acceptance: ≤ 3 In1 islands, no critical net over a void longer than 1 mm.

G. Modem power (Major B-02, Minor B-08)

36. VBAT_MODEM: F.Cu pour ≥ 3 mm from L20.2 → C130 → C131 → C132–C136 → U19 pins 55/56/57 (fan out to all three pads; no 0.5 mm neck); C131 (now polymer) ≤ 5 mm from the pads; the two new 22 µF 0805 caps ≤ 3 mm from L20.2.

H. New parts and footprint swaps

37. Footprint swaps: U15 → SOIC-16_3.9x9.9mm_P1.27mm (narrow; re-place C84–C88 hard against it) (H-01); D28 → 0402 (L-31); Y1 and Y3 → 3225-4P crystal footprint (E-03, D-02); L2/L6/L8/L20 → new IND-SMD_MWSA0804S land (pads 2.75 × 4.0 mm, 5.5 mm inner gap, courtyard 9.4 × 9.8 mm, confirm against the Sunlord drawing) and re-check neighbours for the 0.4 mm body growth (H-03). U17 and U21 keep their footprints (drop-ins).

38. New parts to place: U27 74LVC1G125 (SOT-753) + 100 nF at U18.26, powered from /3V3_GNSS (D-01); USBLC6-2SC6 at J9 (L-41); 4.7 k at U11.37 (E-02); 100 k at U12.2 (E-01, new net /ETH_PWR_EN to U16 pad 54); 100 k at Q5 base (D-09); 100 k pull-up on /PFO routed U6.20 → PB10 (A-13); 100 k /MODEM_STATUS → GND and 100 k /DIN_4G → 3V3 (B-10); 100 nF 0402 at J14.C1 and D23–D25 moved next to J14 (B-09); PESD5V0S1BA at P6.1, P7.1, P8.1, each ≤ 3 mm from its connector (G-08); R56 re-netted to /3V3 (A-11); JP_CUT open solder jumper across P5 /MAIN5V–/SYS5V, silk "CUTOFF BYPASS" (G-04); TP9 1.5 mm pad on PA9 next to TP3–TP5 (D-12); 1 mm test pads on U18.50 and U18.49 next to a GND pad (C-07).

39. Crystals (E-03, D-02, D-03): Y1 ≤ 3 mm from U11.30/31, Y3 ≤ 3 mm from U16 PH0/PH1, Y4 ≤ 3 mm from PC14/PC15; load caps adjacent to the crystal, 2 GND vias, no inner-layer track under any crystal or its lines (Y3 today has In1 /USART6_RX under both HSE lines and /BAT_PLUS on all 4 layers beside it).

I. Mechanics, connectors, silkscreen

40. Mounting holes (G-01, after Leo's answer): if the V5.5 backplate is reused, restore MH4 (Ø3.2 NPTH) at (193.2, 90.3) and add the modem heatsink-clamp pair near U19 (V5.5 MH11 was at (168.3, 84.6), now 0.6 mm from the U19 courtyard, so its position must be re-chosen). Keep a ≥ 4.0 mm copper-free radius on F.Cu/B.Cu around every mounting hole (move the /3V3 track at MH6 out by ≥ 0.5 mm) or specify nylon washers.

41. J9 ESD (G-02): USBLC6-2SC6 ≤ 3 mm of copper from the J9 pads, D± routed through its pads (pins 1/6 /USB_DM, 3/4 /USB_DP, 5 /USB_VBUS, 2 GND), GND via ≤ 1 mm.

42. J11 ESD (F-14): route DFU D+/D− through the D14/D15 pads (no T-stubs); D15 ≤ 3 mm of copper from J11 (today 10.9 mm); each ESD GND pad with its own via ≤ 1 mm.

43. USB pairs (F-17): J9 and J11 pairs on F.Cu only over solid In1, coupled (≈ 0.2/0.15 mm for 90 Ω on JLC7628, confirm in the calculator), ≤ 1 via pair, no slot crossings.

44. Ethernet (E-04, E-06): C90/C91 ≤ 2 mm from U11.20/22; 100 nF at the AVDD 4/8 and 11/21 pairs; each TX/RX pair coupled on F.Cu only (100 Ω diff), ≤ 1 via pair; J10.8 per the HR911105A drawing.

45. Library hygiene (J-05): do not run "Update footprints from library" (it would swap P11/P12 and reset pads); when syncing from the schematic, do not tick "replace footprints".

46. Silkscreen (F-18, G-05): all reference texts ≥ 0.8 mm height / 0.15 mm stroke (1.0/0.15 where space allows); delete "4G NTRIP RESET" at (187.0, 124.1); SW1 "RESET MCU", SW2 "BOOT0 (DFU)"; JP2 "CHEM 1-2 Li-ion / 2-3 LFP"; P1 pin legend "VIN 9-36V · GND · IGN · GND · NC"; a function name at every connector (FAN, RESET, NTC1, NTC2, LED, BATT, CUTOFF, 5V BENCH); P2 "bench only, no reverse protection" (A-20c); clear the 14 DRC silk items; check the D27/D28/Q10 polarity marks in the 3D view.

47. Small cleanups: extend the /SW_5V track end at (86.35, 121.88) 0.3 mm to the U21.3 pad centre (F-21); VDD decoupling caps ≤ 2 mm from their pins where convenient (D-15); Cu4 ≤ 2 mm from U18.36 (C-09).

J. Acceptance before generating fab files

48. Refill all zones → DRC with the new rules: 0 clearance errors (the 6 inner and 15 outer spots of F-01/F-02 must be gone), track_width warnings only on nets deliberately left at T15, 0 unconnected; then check: GND vias ≥ 400 and 0 empty 20 mm cells; every GND pad of U19/U18/U20/U25/J12/J13 in an F.Cu cluster with ≥ 1 plane via ≤ 2 mm; each buck input loop ≤ 1 cm²; ≤ 3 In1 islands; RF lines at the calculator's 50 Ω geometry with fences ≤ 3 mm; U6 EP 9 vias; /SW_BAT ≥ 2 mm; no HV24 net on an inner layer within 0.5 mm of LV copper. Generate BOM/CPL only after H-04's field deletion (or from the schematic with kicad-cli).

7. Schematic change list (for the "apply" phase, brief §7)

To be applied only if Leo says "apply", on a copy hbox-watchdog-v6-audit.* following the V5.6 method: copy → backup per step under kicad/_to_delete/v6-audit-<date>/ → KiCad MCP edits by ref/UUID (UUIDs preserved) → ERC → netlist diff = only the intended pins → PDF → change report. "From" values are the current v6 fields (evidence/components.csv). New parts have no refdes yet except U27, JP_CUT and TP9 (named in the findings).

7.1 Blockers

Finding	Ref	From	To	LCSC	Note
A-01	D20	SS34 (C8678), `/24V` → `/VIN_MODEM`	remove	—	delete the `/24V`→`/VIN_MODEM` path
A-01	D21	PMEG3050EP (C50603)	remove; merge `/VIN_MODEM` into `/MAIN5V`	—	U20.2, C127, C128 now on `/MAIN5V`
A-01	U2, L2, Dbk1, Cbst1, Rcomp1, Ccomp1, Rfreq1, Ren1, Ren2, R20, R21	fan buck (U2 MP1584EN C15051 …)	DNP	—	fan now from `/VEH5V`
A-01	JP1	`SolderJumper-2_P1.3mm_Open_RoundedPad1.0x1.5mm`	`Jumper:SolderJumper-2_P1.3mm_Bridged_RoundedPad1.0x1.5mm`	no part	`/5V_FAN` = `/VEH5V`
A-01	Q10, DzG1, Rrp1, C10, C11, C22	IRFR5305 (C2624), BZX84C15, 10 k, 47 µF/50 V, 100 nF, "22uF/50V"	DNP	—	`/24V` left without loads
A-01 + V1-01	F2	2A/125V Nano2 (C206910)	0154003.DR 3 A, same holder; topology P1.1 → F2 → {D10, Q23}	C206912	4 A C206914 only for sustained 9 V operation
V1-01	D10	SMBJ33A on `/24V_IN` (ahead of F2)	SMBJ33A on the F2 output (`/VIN_FUSED`)	C224019 (unchanged)	reversed P1 now blows F2
A-03	R50	825R/1% (C50214)	1.43 kΩ 1 % 0603	C22840	1.316–1.483 A
B-03	D28	ESD9L5.0ST5G (C82326), SOD-923	PESD0402-240, 0402 (or DNP)	C1975527	bidirectional 24 V
C-01	new U (antenna switch)	—	TPS2552DBVR: 1 IN = `/3V3_GNSS`, 2 GND, 3 EN̅ = U18.5 ANT_OFF, 4 FAULT̅ = `/GNSS_ANT_SHORT_N`, 5 ILIM = IN, 6 OUT = new `/ANT_BIAS`	C46506	75 mA limit
C-01	new R	—	100 k, EN̅ → GND	C25803	antenna ON by default
C-01	new R	—	10 k, `/GNSS_ANT_SHORT_N` → `/3V3_GNSS`	C25804	FAULT̅ pull-up
C-01	L21, C144, C145 / U18.7	on `/VCC_RF_GNSS` with U18.7	on `/ANT_BIAS`; U18.7 VCC_RF → NC	unchanged
F-02	new D (IGN TVS)	—	SMBJ33A, `/IGN_IN` → GND at P1.3	C224019	optional BAT54S C19726 at the MCU
F-02	Rig1	22 k 0603 (C88614)	unchanged value; placed at P1.3 (layout)	C88614	net split: `/IGN_IN` = {P1.3, Rig1.1, TVS}
H-01	U15	footprint `Package_SO:SOIC-16W_7.5x10.3mm_P1.27mm`	`Package_SO:SOIC-16_3.9x9.9mm_P1.27mm`	C15846 (unchanged)	also fix the stale field in the V5.x schematics
H-02	U10	SC16IS762IPW (C729142)	SC16IS752IPW,128	C57156	I²C mode, drop-in
H-02	R53	499k/1% (C131054)	499 k 1 % 0603 HKR RCT03499KFLF	C177479	drop-in
H-04	U25	fields `LCSC` = C524806 and `LCSC Part` = C2071691	delete `LCSC Part` (board, schematic and `Drogheda-v6.pretty/SO-8_L4.9-W3.9-P1.27-LS6.0-BL-EP.kicad_mod`)	C524806	or strip `LCSC Part` from all 10 library footprints
G-01	MH4 (+ heatsink pair)	absent	board-only mounting holes (layout)	—	only if the V5.5 backplate is reused
F-01	project	netclass patterns and `.kicad_dru`	per §2 4-F (F-01)	—	project settings, not schematic symbols

7.2 Majors

Finding	Ref	From	To	LCSC	Note
A-04	R121	53.6k/1% (C23074)	57.6 kΩ 1 % 0603	C23082	5.18/5.32/5.46 V
A-05	new C ×2	—	47 µF 16 V X7R 1210 on `/MAIN5V` at U6 pins 1/24	C5440143	same part as C32/C33
A-08	U17	AMS1117-3.3 (C6186)	TLV1117LV33DCYR (same SOT-223 pinout)	C15578	not C48937499
A-09	C78	220uF/10V MVG (C2827940)	220 µF 16 V polymer	C881921	same 6.3 × 7.7 land
B-02	C130, C131	220uF/10V MVG (C2827940)	220 µF 16 V polymer	C881921 ×2	change together with R116/C141/C142
B-02	R116	14k (C22803)	113 kΩ 1 % 0603	C22862
B-02	C141	3.3 nF 0402 (C1536)	6.8 nF X7R 0402	C1542
B-02	C142	47 pF 0402 (C1567)	56 pF C0G 0402	C1572
B-02	new C ×2	—	22 µF 0805 on `/VBAT_MODEM` at L20.2	C86817
F-03	new C ×2	—	22 µF 16 V 0805 at U20.2 (`/MAIN5V`)	C86817	16 V valid only with A-01
F-03	new C	—	220 µF 16 V polymer at U20.2	C881921
F-51	new U (TMP102)	—	TMP102AIDRLR, I²C1, ADD0 → GND (0x48), 100 nF at VDD	C99269, C14663	placed between U6 and L6
F-51	new R/R/C	—	`/NTC` → 100 k → new net → PC5 (U16 pad 25); 120 k and 10 nF from that net to GND	C25803; C25808 (120 k); C1589	remove PC5 NC flag
C-02	U21	AP2112K-3.3 (C51118)	TPS7A2033PDBVR (same SOT-23-5 pinout)	C2862740	soft-start 239–367 µs/V
E-01	U12.2 EN	tied to `/SYS5V`	new net `/ETH_PWR_EN` → U16 pad 54 (PD2); new 100 k to GND	C25803	remove PD2 NC flag
E-02	new R	—	4.7 kΩ 0603, `/ETH_RST` → GND at U11.37	C23162	tell V5.6: R112 100 k → 4.7 k
D-01	U27 (new)	—	74LVC1G125GV,125: 1 OE̅ = GND, 2 A = `/DOUT_4G`, 3 GND, 4 Y = new `/DOUT_4G_F9P` → U18.26, 5 VCC = `/3V3_GNSS`; 100 nF at VCC	C12518, C14663	U18.26 leaves `/DOUT_4G`
D-01	Rdfu1	22k (C88614)	100 kΩ	C25803
G-02	new U (J9 ESD)	—	USBLC6-2SC6: 1/6 `/USB_DM`, 3/4 `/USB_DP`, 5 `/USB_VBUS`, 2 GND	C7519
H-02b	R56, R57, R58, R85, R87, Rgs1 (+ R20, Ren1, Rfreq1 if U2 stays)	100k 5 % (C103211)	100 kΩ 1 %	C25803	stock 702 limits the order to 78 boards
V1-01, F-12, F-05, F-06, C-04, A-07	—	layout-only	—	—	see §6

7.3 Minors

Finding	Ref	From	To	LCSC
A-11	R56	100 k to GND	100 k to `/3V3` (default charge OFF)	C25803
A-13	new R + net	`/PFO_TP` = {U6.20, TP2}	`/PFO` → U16 pad 29 (PB10) + 100 k to `/3V3`; remove PB10 NC flag	C25803
B-09	R132, R133, R134	0R (C304185)	22 Ω 0603	C23345
B-09	new C	—	100 nF 0402 at J14.C1 (`/SIM_VDD`)	C1525
B-10	new R ×2	—	100 k `/MODEM_STATUS` → GND; 100 k `/DIN_4G` → `/3V3`	C25803 ×2
B-10	R106	100R (C22775)	1 kΩ	C14676
C-07	new TP ×2	—	test pads on U18.50 SAFEBOOT_N, U18.49 RESET_N	no part
D-02	Y3	25 MHz HC-49SD (C14872)	25 MHz 3225-4P CL 10 pF, footprint `Crystal:Crystal_SMD_3225-4Pin_3.2x2.5mm`	C2901684 (alt. C9006)
D-02	C113, C114	15 pF (C1644)	12 pF C0G (keep 15 pF C1644 if C9006)	C38523
D-03	Y4	32.768 kHz FC-135 CL 12.5 pF (C32346)	FC-135 CL 7 pF	C48615
D-03	C115, C116	12 pF (C38523)	6.8 pF C0G	C1679
D-05	Rigb1	3.3k (C22978)	2.2 kΩ	C4190
D-08	new R	—	10 k strap → GND on the board-ID pin (pin unresolved, see §10)	C25804
D-09	new R	—	100 k `/BASE_LS` → GND	C25803
D-12	TP9 (new)	PA9 NC flag	test pad on PA9 (remove NC flag)	no part
E-03	Y1	25 MHz HC-49SD (C14872)	25 MHz 3225 CL 12 pF; keep C95/C96 18 pF (C1647)	C9006 (alt.: keep Y1, C95/C96 → 33 pF C1663)
E-04	C91	4.7 µF (C1779)	10 nF 0603 X7R	C1589
E-04	C90	10 µF (C440198)	4.7 µF 0805	C1779
E-04	new C ×2	—	100 nF at W5500 AVDD 4/8 and 11/21	C14663 ×2
F-52 (option)	new U	—	TMP102 at 0x49 (ADD0 → 3V3) between U19 and U20	C99269
G-03	P11, P12	fp `…MC_1,5_3-G-3.5_1x03_P3.50mm_Vertical`	`Connector_Phoenix_MC:PhoenixContact_MC_1,5_3-G-3.5_1x03_P3.50mm_Horizontal`; DNP per Leo	C5160226
G-03	J10	fp nickname `Connector_RJ45:…`	`Connector_RJ:RJ45_Hanrun_HR911105A_Horizontal`; DNP per Leo	C12074
G-04	JP_CUT (new)	—	`Jumper:SolderJumper-2_P1.3mm_Open_RoundedPad1.0x1.5mm` across P5 (`/MAIN5V`–`/SYS5V`)	no part
G-08	new D ×3	—	PESD5V0S1BA at P6.1, P7.1, P8.1 → GND (opt. 100 Ω series on NRST, C22775)	C2827694 ×3
H-03	L2, L6, L8, L20	fp `Inductor_SMD:L_Bourns-SRU8028_8.0x8.0mm`	new `Drogheda-v6:IND-SMD_MWSA0804S`	parts unchanged
H-08	C22, Y2	value text "22uF/50V", "1.8432MHz"	"10uF/50V" (unless 22 µF was intended), "3.6864MHz"; C103/C130/C131/C78 texts are harmless or replaced by B-02/A-09	—
J-03	library	`unspecified` pin types in `Drogheda-v6.kicad_sym`	power_in / power_out / input / output / passive	—
J-04	23 orphan NC flags, NC flags on U16.37/38 and U10.13/14, wire stubs uuid 2b755f7f…, 46f71e27…, 7c1dbfc0…	present	delete; copy the 10 missing symbols into `Drogheda-sym` and re-link	—
B-15 (Note)	R107, R108	DNP 0 Ω bypass	delete or mark "never fit"	—

Expected netlist diff (acceptance for the apply phase): only the nets and pins named in §7.1–7.3 change; no UUID changes on untouched symbols; ERC shows no new errors, and the J-04 items disappear.

8. Firmware requirements (`board_v6.h`, FW 0.7.x)

Sources: firmware sections of the four findings files and pinmap-v6.md §5 (draft header). Items tagged (if fix) apply only when the named hardware change is adopted.

8.1 Build and identity

1. New board_v6.h from pinmap-v6.md §5. A binary must never cross between V5.6 and v6: a V5.6 build drives PC3 (RTK_STAT, an F9P push-pull output on v6) and PC1/PC2 (F9P inputs). File names carry the board (drogheda-firmware-por-tarjeta). (if D-08) read the board-ID strap with INPUT_PULLUP at boot; mismatch → outputs off, print BOARD MISMATCH.

2. $PHID,<96-bit UID>,<fw>,<board>,<MAC>,<up_s> on the modem uplink at every connect and every 5 min, not only on Ethernet (C-08). Backend retranslator must map UID → H-number before v6 ships.

3. $PHLG stays append-only; new fields at the end: tchg, tcell (F-51), tmodem (F-52 / AT), tntc2, rtcm_bps, modem_status, vign (D-05), iin only if CLPROG ever gets a pin.

8.2 Boot defaults

4. First lines of setup(), before any delay or USB init, drive LOW: PC10 MODEM_PWR_EN, PC8 PWRKEY, PC11 MODEM_RST, PA1 GNSS_PWR, PB5 BYP_CTRL, PA15 ETH_RST (JTDI pull-up at reset), PA6 fan, PB0 panel LED; (if E-01) PD2 ETH_PWR_EN. PA8 CHRG_EN belongs to the governor (HIGH = charge off until it decides).

5. Keep hi-Z/analog: PA9, and PB10/PC5/PD2 unless their fixes are adopted; PC1/PC2 (F9P inputs; PC2 becomes a real antenna-short input (if C-01), no MCU pull); PC12 open-drain only, never push-HIGH.

6. F9P back-feed rule (0.5.5/0.5.6 lesson): while PA1 is LOW keep PA2 INPUT no-pull, PA10 no pull (its internal pull-up is 7–14 kΩ), PC7 no pull-up, PC12 released, PA7/PC3 no pull-up. Never hold PC10 HIGH with PA1 LOW and never run F9P-only power cycles with the modem up, until the D-01 gate (U27) is fitted.

8.3 Pins and peripherals

7. Modem: USART6 PC6 TX (via K1 NO, Mode B) / PC7 RX (always connected, AT replies + RTCM3 byte counter), 115 200 Bd. PC8 PWRKEY (HIGH = pressed via Q20), PC11 RESET (HIGH = asserted via Q21), PC9 STATUS (INPUT_PULLDOWN, poll it), PC10 buck enable.

8. GNSS: USART2 PA2/PA3 = F9P UART1 (GNSS = Serial2); USART1 RX-only on PA10 (F9P TXD2 tap, no pull; remove the V5 RELAY(PA10, PA9) TX); PA7 PPS on TIM3_CH2 capture or EXTI7; PC3 RTK_STAT (poll ≥ 10 Hz, or EXTI3 if blink timing is wanted, then poll PB3); PC12 RESET_N open-drain (prefer UBX-CFG-RST).

9. EXTI9 → PB9 (SC7A20 INT1 at 0x18, LIS3DH-compatible registers, motion wake); poll PC9 and PB3 (D-13). Fan stays GPIO ON/OFF so TIM3 is free for PPS.

10. ADC: IN0 BAT_SENSE, IN4 5V_SENSE, IN5 IGN_SENSE (read analog; as-drawn ratio thresholds ON > 0.60 V ≈ 5.2 V, OFF < 0.35 V, no internal pull; ratio 0.0833 (if D-05)), IN9 NTC, IN14 NTC2, (if F-51) IN15 pack NTC on PC5 (ratio 120/220; Rntc = R55·Vntc/(VEH5V − Vntc) with VEH5V from PA4; valid only with VEH5V present).

11. Delete: TMP102 at 0x48/0x49 as the V5 cell sensor and the PCF8574 P7 modem-reset bodge (PCF_MODEM_RST_BIT, ENABLE_MODEM_RST); (if F-51) re-add a TMP102 at 0x48 as the charger sensor (tchg); (if F-52) 0x49 near the modem.

12. BOARD_SER_XTAL_HZ 3686400UL (Y2 is the 3.6864 MHz part despite the "1.8432MHz" text); U10 SC16IS762 → SC16IS752 is register-compatible (H-02). If H-01 were not fixed, report rs232=absent.

13. (if A-13) PB10 EXTI10 falling = PFO (backup entry at VEH5V < 4.40 V). (if E-01) PD2 ETH_PWR_EN.

8.4 Power constants and ADC

14. V5_PFI 4.60 → 4.40 V (falling; rising 4.51 V). With R121 = 57.6 k keep CHG_RAIL_ON 5.05 / CHG_RAIL_OFF 4.90; if R121 stayed 53.6 k the governor could not be retuned safely (ON ≤ 4.80 V is not possible with PFI rising max 4.66 V and ADC error), so the hardware change is preferred (A-04). The v6 supply cannot fold (RS1 2.14–2.41 A < U25 4.5 A minimum limit): the governor is a safety net.

15. Compute VDDA every window from VREFINT (VREFINT_CAL at 0x1FFF7A2A); never assume 3.30 V, especially on battery (A-08).

16. Charger status decode (LTC4040 DS table p.14, per the power auditor): "pausa NTC" = CHRG low ∧ FAULT low; bad battery = CHRG high ∧ FAULT low. (The pin-map note on PB4 words it differently; the datasheet-cited decode governs.)

17. BSTOFF is hard-wired to GND, so firmware cannot switch the boost off: at VBAT_BACKUP_MIN go to STOP with every load off; the hardware floor is the LTC4040 BAT UVLO (2.45 V) plus the pack PCM.

8.5 Thermal

18. CHG_CELL_HOT/COOL on tcell (Li-ion 45/40 °C; LFP 55–60 °C) (if F-51); shed charge on tchg > 85 °C; include the NTC in thermalCtlTemp() (drogheda-fan-policy). Fan policy vehiclePower && ignitionOn unchanged; with A-01 the fan supply exists exactly when vehiclePower.

19. Modem temperature via AT+CPMUTEMP (confirm on the A7670SA firmware) when no TMP102 is fitted.

8.6 Backup entry and duty window (R1/R3)

20. On backup entry (PFO EXTI or 5V_SENSE < V5_OFF): ETH_PWR_EN = 0 (or hold ETH_RST low), BYP_CTRL = 0 except inside the TX window, modem to LTE-only (AT+CNMP=38) to avoid 2 A GSM bursts (2.8 A peaks exceed the 2.5 A backup limit).

21. Window power-up: PWR_CTRL HIGH → F9P settled (≥ 1–4 s) → BAT_SENSE ≥ 3.4 V (refuse a modem cold start below ≈ 3.4 V) → W5500 off → MODEM_PWR_EN HIGH → wait ≥ 100 ms (2 ms soft-start + bank charge) → PWRKEY asserted 100–500 ms (≥ 50 ms) → wait STATUS HIGH (typ 7–11.2 s, timeout 20 s) or AT RDY → BYP_CTRL HIGH (Mode B) → AT sync at 115 200 → AT+CNMP=38 on battery → attach / NTRIP / report → ≥ 2 $PHLG with pwr=BATT → power-down.

22. Window power-down: AT+CPOF (or PWRKEY ≥ 2.5 s) → STATUS LOW (≤ ≈ 2–3 s) → MODEM_PWR_EN LOW → hold ≥ 2 s → BYP_CTRL LOW → PWR_CTRL LOW → MCU STOP with the LSE RTC (LSEMOD high-drive before LSEON, LSI fallback, D-03).

23. Any MCU reset power-cycles the modem (R113) and the F9P (PA1 floats): recovery logic must assume a cold modem after every reset and re-run the full sequence.

8.7 Modem recovery and watch (R2)

24. Ladder (vehicle or battery, modem only): AT timeout → RESET asserted ≈ 2.5 s → PWRKEY off/on → HARD_CYCLE (EN LOW ≥ 2 s; VBAT decays to 47 mV) → 3 strikes → log MODEM_DARK, retry next window. Never cycle PWR_CTRL for a link problem; no stack cycle on battery.

25. Replace the V5 sag5 heuristic with STATUS + AT responses + RTCM byte count on PC7; VBAT via AT+CBC.

26. K1 energised only while the modem is on (150 mW coil).

8.8 F9P configuration and NTRIP transport

27. BBR + flash: UART2 baud = modem baud (115 200), UART2 in-protocol RTCM3 only (UBX/NMEA/SPARTN off); UART2 out NMEA GGA only if the K1-NC path is still wanted; UART1 NMEA/UBX for the MCU; (if C-01) CFG-HW-ANT_CFG_VOLTCTRL / SHORTDET = 1. u-center passthrough follows the CDC line coding → USART2 baud.

28. Caster socket transparent (AT+CIPMODE=1); if multi-socket is needed for $PHLG, disable RTCM on UART2 and forward re-assembled RTCM from the MCU on USART2 TX → F9P UART1. RTCM age from GGA field 13 plus an RTCM3 frame walker on PC7.

8.9 Ethernet

29. ETH_PWR_EN LOW on battery and at boot until needed (if E-01); RSTn LOW ≥ 500 µs before release; SPI2 pins LOW or Hi-Z while 3V3_ETH is off.

9. Verdict

Ready to order? NO.

What blocks the order (all must be closed):

The 10 Blockers: A-01 (unfused 24 V branch, D21 30 V), F-02 (raw ignition on In2 at 0.221 mm from VEH5V), F-01 (netclasses/DRC blind to 24 V spacing), H-04 (U25 LCSC Part = AP64350), C-01 (unlimited GNSS antenna bias), B-03 (unidirectional LTE ESD), A-02 (LTC4040 copper/EP/placement), A-03 (R50 825 Ω), H-01 (U15 on the wrong land), H-02 (U10/R53 unobtainable).
G-01: Leo's backplate answer. If the V5.5 standoffs are reused, MH4 at (193.2, 90.3) and the heatsink-clamp pair must be restored (Blocker); if the backplate is re-drilled, publish the 130 × 90 mm pattern (documentation).
DRC gate: refill + DRC with the F-01 rules shows 0 clearance errors (the 6 inner /IGN_IN spots and 15 outer spots gone).
BOM/CPL generated after the H-04 field deletion (or from the schematic with kicad-cli); stock re-checked on order day (H-02, H-02b); J14 pre-ordered; U18/U19 pre-ordered for quantities ≳ 100.

Conditions for YES: items 1–4 done, plus the 19 Majors done or waived in writing (severity scale: "should change before ordering unless there's a written reason"). The Majors are BOM values, three new small ICs (TMP102, 74LVC1G125, USBLC6-2SC6), two drop-in regulator swaps (TPS7A2033, TLV1117LV) and layout work that falls in the same layout pass as the Blockers; four of them (A-04, A-05 CSYS, A-07 and the F-03 U20 input caps) are prerequisites of A-01, so A-01 cannot be taken alone. Firmware 0.7.x (§8) is required for R1/R3 but does not gate the fab order.

What can follow in v6.1: the 30 Minors (they can also ride along where they touch the same area) and the 21 Notes; items the findings defer explicitly: K1 → direct PC6 → DIN_4G link (B-13), PoE (E-07), U12 → AP64350 (A-20a), P3 → JST-XH-5/VH if the pack harness is remade (G-07), modem TMP102 (F-52 option).

Impact on V5.6 (found in passing): R112 on ETH_RST must be 4.7 k (C23162), not 100 k (E-02); the V5.x schematics still carry the stale SOIC-16W footprint field for U15, so fix it before any Update-PCB on V5.6 (H-01).

Bench validation before accepting the v6 boards (from the findings): thermal camera on U6/L6 at 1.4 A charge and 2.3 A backup, 1 h each (A-02); battery-only cold start at VBAT 3.5 V with MAIN5V/VIN(U20) scope and a /BAT_PLUS current probe (A-05, ECO §I-1); 0.1 → 2 A load step on VBAT_MODEM, droop ≤ 150 mV (B-02); /3V3_GNSS rise 100–1000 µs/V (C-02); antenna short test (C-01); /3V3_GNSS < 0.3 V with PA1 LOW and the modem on (D-01); G3 desense: modem TX power vs F9P C/N0 (F-06/F-12); D34/U25 IR at full load (A-06 → F-03); frequency counter on Y1, target ±10 ppm (E-03); H0008 follow-ups: clamp meter on the pack lead and U6/L6 IR during charge (A-02/A-03).

Cost note: cost analysis kept in the repository copy.

10. Inputs needed from Leo

#	Question	Affects	Assumption used in this audit
1	Backplate / enclosure hole pattern: are the V5.5 standoffs (incl. (193.2, 90.3)) reused? Is the modem heatsink clamp (MH11 + partner, thermal gate T1) still planned?	G-01 (Blocker or documentation), L-40	Unknown → G-01 kept as conditional Blocker
2	Decision on the modem supply topology: U20 from MAIN5V only (D20/D21 removed), fan from VEH5V (U2 DNP), F2 3 A ahead of D10	A-01, V1-01, A-04/A-05/A-07/F-03 prerequisites	Adopted as the verified single topology
3	Fleet supply systems: 24 V only, or 12 V machines too? Alternator load-dump suppression present? Unsuppressed ISO 7637/16750 transients on the ignition wire (terminal tractors, RTGs)?	F2 3 A vs 4 A, A-16 (U25 UVLO), A-19, D-05, F-02	9–36 V (T9), 24 V systems present, transients possible
4	Is GSM/2G fallback required on battery, or is LTE-only acceptable?	A-05, B-16, firmware §8	LTE-only on battery
5	Fab stackup and copper: JLC04161H-7628 with impedance control, ENIG, and 1 oz inner copper?	F-06, A-07, J-02, L-1	JLC04161H-7628, 0.5 oz inner by default
6	Order quantity (20 vs 100)	H-02b (C103211, U18, U19 limits), setup cost per board	Both computed
7	BOM tool for the JLC order: Fabrication Toolkit (board fields) or kicad-cli (schematic fields)?	H-04 (Blocker in either case until the field is deleted)	Fabrication Toolkit (per the 25-Sep pre-fab audit)
8	J10 (Ethernet) and P11/P12 (RS-485/RS-232): JLC-assembled, hand-fitted THT, or not fitted on v6? Ethernet on the prototypes?	G-03, E-01, H-01 relevance, U11/U12/Y1 population	Populated
9	Allocation of PD2: `ETH_PWR_EN` (E-01, verify_1) or board-ID strap (D-08)? If E-01 keeps PD2, is PA9 given to the board ID (losing D-12's debug TX pad)?	E-01, D-08, D-12	PD2 = ETH_PWR_EN; board-ID pin open
10	Is "temperature sensor ≤ 10 mm of U6" binding for R4? (would promote F-51 to Blocker)	F-51	No (Major)
11	R50: 1.43 kΩ (≥ 1.3 A at every corner) or 1.5 kΩ (V5.6 commonality, 1.254 A minimum)?	A-03	1.43 kΩ
12	LTE antenna ESD: fit PESD0402-240 (C1975527) or leave D28 DNP?	B-03	Either; needs the 0402 land
13	Pack details: capacity (Ah), PCM cut-off, NTC β (B3380 vs B3950), chemistry decision D1 (LFP-HT + JP2 2-3 + RNTB 5.6 k, or Li-ion)	A-02, A-03, F-51 thresholds, G-07	≈ 11.6–12 Ah Li-ion, RNTB 10 k
14	Fan part and current	A-01 (U25 load), J-02	5 V, 2-wire, 0.2–0.3 A
15	Must Ethernet work on battery?	E-01	No (gated off on battery)
16	Enclosure internal temperature at 45 °C ambient	A-09, B-02 (electrolytic life), H-07/D-02 (−20…+70 °C crystals), U6/D34 thermals	60–65 °C local near the regulators
17	H0008 bench data: clamp-meter charge current and U6/L6 temperature	A-02/A-03 causality	Not yet measured
18	GNSS antenna model: bias voltage range and current	C-01 (75 mA limit)	3.0–3.3 V, ≤ 30 mA
19	Will technicians use J9 (modem USB) in the field?	G-02	Yes, occasionally
20	Are field harness cables labelled by P-number (V5 names)?	G-05 (P6 FAN / P6 RESET-EXT collision)	Unknown
21	Low-power plan: STOP + RTC (LSE), or duty cycle with the MCU running?	D-03 severity	STOP + LSE
22	SWD header wanted on the fab board, or DFU plus pads only?	D-12	Pads only
23	Unit prices of the ArduSimple simpleRTK2B and 4G NTRIP Master (500-unit order)	H-10 system-level cost delta	—
24	Record as a decision: U20 sits upstream of the P5 cutoff (ECO §A intent met functionally via R113)	A-01, G-04	—

11. Appendices

Appendix A — ERC summary (`evidence/erc_summary.md`)

KiCad 10.0.4 ERC via kicad-cli: 166 violations = 0 errors + 166 warnings (same total on the original file and a byte-identical copy). The MCP prints 30 items per run, so the full list was built by running one check group at a time on the copy: 22 + 10 + 30 items are KiCad's exact output; the 104 pin-to-pin markers are a model whose totals equal KiCad's (104 and 70 in two pin-map settings) and which reproduces 29 of 30 visible positions.

Category	Count	Source	Classification (`ercdrc_classified.csv`)	Owner finding
pin_to_pin	104	model (count = KiCad)	pre-existing-benign	J-03
no_connect_dangling (orphan NC flags at x = 453.898 / 484.378 mm)	23	KiCad exact	needs-fix-cosmetic	J-04
lib_symbol_mismatch	22	KiCad exact	pre-existing-benign	J-04 (leave)
lib_symbol_issues (Q_*MOS_G?S ×7, D_Zener_ANK ×2, PCF8574)	10	KiCad exact	needs-fix-cosmetic	J-04
footprint_link_issues (P11, P12 Vertical footprint not in library; J10 `Connector_RJ45` nickname)	3	KiCad exact	real	G-03
no_connect_connected (markers on R31.2 `/I2C_SDA` and K1.10 `/USART6_TX`; flags on U16.37/38, U10.13/14)	2	KiCad exact	needs-fix-cosmetic	J-04
unconnected_wire_endpoint (P1.4, R52.2)	2	KiCad exact	needs-fix-cosmetic	J-04
Total	166		real 3 · benign 126 · cosmetic 37

Pin-to-pin markers by net: GND 55, /3V3 5, /1V8_MODEM 4, /VBAT_MODEM 4, /VIN_MODEM 2, /DIN_4G_M 2, /DOUT_4G_M 2, /RF_ANT_LTE 2, /RF_ANT_GNSS 2, and 1 each on 26 modem/U20/U23/U24/U26 nets. Message mix: Unspecified–Passive 50, Unspecified–Unspecified 46, Unspecified–Bidirectional 5, Unspecified–Power output 2, Unspecified–Input 1. Root cause: easyeda-imported symbols in Drogheda-v6.kicad_sym with all pins typed unspecified.

Appendix B — DRC summary (`evidence/drc_summary.md`)

KiCad DRC (swig backend, KiCad 10, stored fills) on hbox-watchdog-v6.kicad_pcb (sha256 6ddec80d…): 283 violations — 0 errors, 283 warnings; 0 unconnected items. Ignored in the project: missing courtyard, track not centred on via, tuning profile, footprint filters mismatch, footprint type mismatch. The Sep-25 stale report had 303 warnings (199 track_width).

Type	Count	Classification	Owner finding
track_width (custom T15 warning rules)	183	59 real per CSV → verified 63 hits on 6 real nets; 124 benign	A-02, A-07, B-08 (copper); J-02 (rules)
lib_footprint_mismatch	82	pre-existing-benign (KiCad 10 library revisions)	J-05
silk_overlap	11	needs-fix-cosmetic	F-18
lib_footprint_issues (MountingHole nickname)	4	needs-fix-cosmetic	J-05
silk_over_copper (Rigb1 on C9.2, C10 on C10.2)	2	needs-fix-cosmetic	F-18
silk_edge_clearance (P1 outline)	1	needs-fix-cosmetic	F-18
Total	283	real 59 (63 verified) · benign 206 · cosmetic 18

track_width per net (count; widths; verdict per J-02 as verified): /3V3_ETH 54 (0.25–0.5 mm) benign · /MAIN5V 21 (0.3/0.5) real · /VEH5V 15 (0.25–0.8, incl. In1) real · /5V_FAN 14 (0.5) benign · /VIN_SW 10 (0.25–0.8, incl. In2) real · /SW_5V 9 benign · /VIN_MODEM 9 (0.3/0.5) neck only (0.1 mm under capacity) · /SW_FAN 8 benign · /VBAT_MODEM 7 (0.25/0.5) real · /FAN_RET 7 benign · /SW_IN 7 benign · /SYS5V 6 benign · /SW_BAT 6 (0.25/0.3/0.5) real · /VIN_PROT 5 benign (keep 0.8 mm rule) · /BAT_PLUS 4 (0.25/0.5) real · /VIN_FUSED 1 benign.

Rule-set caveat (F-01): these 0 errors come from a 0.15 mm catch-all rule that overrides every netclass. With the corrected rules: 6 inner-layer errors (/IGN_IN), 15 outer-layer errors at 0.3 mm, ≈ 178 zone proximities that re-pour on refill.

Appendix C — Evidence file index

Mac: 03-Architecture-Hardware/kicad/_to_delete/v6-audit-20260928/evidence/ (KiCad exports) and …/evidence/pack/ (tree below). Container: /home/claude/v6audit/.

Path	Content
`INDEX.md`, `evidence/MANIFEST.md`, `evidence/_verification.md`	map and gotchas; hashes and provenance; self-checks (IPC-356 vs parser, counts, 64-pin MCU)
`evidence/netlists/*.xml`	kicad-cli netlists: v6, V5.6 (ECO copy), V5.5 as-fabbed, v5 current (stale)
`evidence/components.csv`, `nets.json`, `ref_pins.json`	328 symbols with fields; net → pins; ref → pin → net
`evidence/mcu_pins.csv`, `evidence/ic_pins_<REF>.csv`	U16 64/64 pins; per-IC pin tables (U19, U18, U11, U6, U25, U20, U2, U12, U17, U21, U23, U24, U10, U13, U14, U15, U26, U3, U22)
`evidence/erc_summary.md`, `erc_full.json/.txt`, `erc/kicad_run_*.txt`	ERC (Appendix A)
`evidence/drc_summary.md`, `drc_full.rpt/.json`, `drc_items.csv`	DRC (Appendix B)
`evidence/bom.csv`, `bom_ungrouped.csv`, `cpl.csv`, `v6-pcb.ipc356`	kicad-cli BOM (correct LCSC fields), position file, IPC-D-356
`evidence/pcb_footprints.csv`, `pcb_pads.csv`, `pcb_tracks.csv`, `vias.csv`, `zones.csv`, `net_routing_summary.csv`	parsed board geometry (1999 segments, 210 vias, 5 zones), per-net routing and resolved netclass
`evidence/stackup.md`, `clearance_24v.md/.csv`, `outline_and_holes.md`, `sch_pcb_sync.md`	stackup/rules/netclass resolution; 24 V clearance sweep; outline and holes; schematic↔PCB sync
`evidence/diff_v56_v6.md`, `diff_v5_v56.md`	UUID-matched semantic diffs with focus table
`evidence/firmware_pins.md/.csv`, `firmware_constants.csv`	every `PIN_*` in V5/V4 firmware vs the v6 net on the same pin; 84 constants
`evidence/v6-sch.pdf`, `v6-pcb-layers.pdf`, `svg/.svg`, `mcp/.json`	schematic PDF; per-layer plots; verbatim MCP results (courtyards, zones, rules)
`findings/A_power.md`, `BCE_modem_gnss_eth.md`, `DG_mcu_connectors.md`, `FHJ_layout_bom_ercdrc.md`	block auditor findings
`findings/verify_1.md`, `verify_2.md`	independent verification (power/RF; layout/BOM/MCU)
`findings/pinmap-v6.md`, `bom_check.csv`, `ercdrc_classified.csv`	auditor pin map; 152-line BOM check; 449 classified ERC/DRC items
`work/<block>/`, `work/verifier1/`, `work/verifier2/`	auditor and verifier scripts, renders (`in1_full.png`, `rf_lte.png`, `rf_gnss.png`, `u20.png`, `u25.png`, `fcu_gnd_pieces.png`), `hv24_violations_corrected_rule.csv`, `critical_crossings.csv`
`scripts/`	shared parsers (`kisexp.py` sexpdata helpers, `parse_pcb.py`, `parse_netlist.py`, `clearance_24v.py`, …)

Appendix D — ID → working-file map (all 117 IDs)

"Final" = severity after verification and merges; "—" = absorbed into the primary named in "State". v1 = verify_1.md, v2 = verify_2.md.

ID	Working file	Auditor severity	Final	State	Report §	Verification
A-01	`A_power.md`	Blocker	Blocker	primary	§2 4-A	verified-with-correction (v1)
A-02	`A_power.md`	Blocker	Blocker	primary	§2 4-A	verified (v1)
A-03	`A_power.md`	Blocker	Blocker	primary	§2 4-A	verified (v1)
A-04	`A_power.md`	Major	Major	primary	§2 4-A	verified (v1)
A-05	`A_power.md`	Major	Major	primary	§2 4-A	verified-with-correction (v1)
A-06	`A_power.md`	Major	—	absorbed → F-03 (loops), F-12 (EP vias), A-01 (U2 row)	§2 4-F	verified (v1, v2)
A-07	`A_power.md`	Major	Major	primary	§2 4-A	verified (v1)
A-08	`A_power.md`	Major	Major	primary	§2 4-A	verified (v1)
A-09	`A_power.md`	Major	Major	primary (C78); C130/C131 → B-02	§2 4-A	verified (v1)
F-51	`A_power.md`	Major	Major	primary	§2 4-F	verified (v1)
A-10	`A_power.md`	Minor	Minor	primary	§2 4-A	not independently verified
A-11	`A_power.md`	Minor	Minor	primary	§2 4-A	not independently verified
A-12	`A_power.md`	Minor	—	absorbed → D-09	§2 4-D	not independently verified
A-13	`A_power.md`	Minor	Minor	primary (absorbs D-10)	§2 4-A	not independently verified; pin per v1 (h)
A-14	`A_power.md`	Minor	Minor	primary (absorbs F-10; In1 part → A-02)	§2 4-A	not independently verified
A-15	`A_power.md`	Minor	—	absorbed → H-04	§2 4-H	verified via H-04 (v2)
F-52	`A_power.md`	Minor	Minor	primary	§2 4-F	not independently verified
A-16	`A_power.md`	Note	Note	primary	§2 4-A	not independently verified
A-17	`A_power.md`	Note	—	absorbed → B-02	§2 4-B	verified via B-02, conflict (c) (v1)
A-18	`A_power.md`	Note	Note	primary	§2 4-A	not independently verified
A-19	`A_power.md`	Note	Note	primary	§2 4-A	not independently verified
A-20	`A_power.md`	Note	Note	primary	§2 4-A	not independently verified
F-53	`A_power.md`	Note	—	absorbed → A-01	§2 4-A	verified via A-01 merge (v1)
B-01	`BCE_modem_gnss_eth.md`	Blocker	—	absorbed → A-01	§2 4-A	verified (v1)
B-02	`BCE_modem_gnss_eth.md`	Blocker	Major	primary (absorbs A-09 C130/C131, A-17)	§2 4-B	verified, severity Blocker → Major (v1)
B-03	`BCE_modem_gnss_eth.md`	Blocker	Blocker	primary	§2 4-B	verified-with-correction (v1)
B-04	`BCE_modem_gnss_eth.md`	Blocker	—	absorbed → F-12	§2 4-F	verified, severity Blocker → Major (v1, v2)
C-01	`BCE_modem_gnss_eth.md`	Blocker	Blocker	primary (absorbs D-07)	§2 4-C	verified (v1)
B-05	`BCE_modem_gnss_eth.md`	Major	—	absorbed → F-06	§2 4-F	verified (v1)
B-06	`BCE_modem_gnss_eth.md`	Major	—	absorbed → F-03	§2 4-F	verified (v1)
B-07	`BCE_modem_gnss_eth.md`	Major	—	absorbed → G-02 (ESD); routing → F-17	§2 4-G	verified (v1)
C-02	`BCE_modem_gnss_eth.md`	Major	Major	primary	§2 4-C	verified (v1)
C-03	`BCE_modem_gnss_eth.md`	Major	—	absorbed → F-12	§2 4-F	verified-with-correction (v1)
C-04	`BCE_modem_gnss_eth.md`	Major	Major	primary	§2 4-C	verified (v1)
E-01	`BCE_modem_gnss_eth.md`	Major	Major	primary (absorbs A-05 fix 1)	§2 4-E	verified (v1)
E-02	`BCE_modem_gnss_eth.md`	Major	Major	primary (absorbs D-04); Minor once E-01 is in	§2 4-E	verified-with-correction (v1)
E-03	`BCE_modem_gnss_eth.md`	Major	Minor	primary (absorbs H-07, F-11 Y1)	§2 4-E	verified, severity Major → Minor (v1)
B-08	`BCE_modem_gnss_eth.md`	Minor	Minor	primary	§2 4-B	not independently verified
B-09	`BCE_modem_gnss_eth.md`	Minor	Minor	primary	§2 4-B	not independently verified
B-10	`BCE_modem_gnss_eth.md`	Minor	Minor	primary (absorbs D-14)	§2 4-B	not independently verified
B-11	`BCE_modem_gnss_eth.md`	Minor	—	absorbed → J-04	§2 4-J	not independently verified
C-05	`BCE_modem_gnss_eth.md`	Minor	—	absorbed → F-06	§2 4-F	verified via F-06 (v2)
C-06	`BCE_modem_gnss_eth.md`	Minor	—	absorbed → D-01	§2 4-D	verified via D-01 (v2)
C-07	`BCE_modem_gnss_eth.md`	Minor	Minor	primary	§2 4-C	not independently verified
E-04	`BCE_modem_gnss_eth.md`	Minor	Minor	primary	§2 4-E	not independently verified
E-05	`BCE_modem_gnss_eth.md`	Minor	—	absorbed → G-03	§2 4-G	not independently verified
E-06	`BCE_modem_gnss_eth.md`	Minor	Minor	primary	§2 4-E	not independently verified
B-12	`BCE_modem_gnss_eth.md`	Note	—	absorbed → F-01 (netclasses), F-06 (stackup)	§2 4-F	verified via merges (v1, v2)
B-13	`BCE_modem_gnss_eth.md`	Note	Note	primary	§2 4-B	not independently verified
B-14	`BCE_modem_gnss_eth.md`	Note	Note	primary	§2 4-B	not independently verified
B-15	`BCE_modem_gnss_eth.md`	Note	Note	primary	§2 4-B	not independently verified
B-16	`BCE_modem_gnss_eth.md`	Note	Note	primary	§2 4-B	not independently verified
C-08	`BCE_modem_gnss_eth.md`	Note	Note	primary	§2 4-C	not independently verified
C-09	`BCE_modem_gnss_eth.md`	Note	Note	primary	§2 4-C	not independently verified
E-07	`BCE_modem_gnss_eth.md`	Note	Note	primary	§2 4-E	not independently verified
D-01	`DG_mcu_connectors.md`	Major	Major	primary (absorbs C-06)	§2 4-D	verified-with-correction (v2)
D-06	`DG_mcu_connectors.md`	Major	—	absorbed → F-02 (Blocker)	§2 4-F	verified, severity Major → Blocker (v2)
G-01	`DG_mcu_connectors.md`	Major	Blocker (conditional)	primary	§2 4-G	verified-with-correction (v2)
G-02	`DG_mcu_connectors.md`	Major	Major	primary (absorbs B-07 ESD, F-14 J9)	§2 4-G	verified (v1, v2)
D-02	`DG_mcu_connectors.md`	Minor	Minor	primary (absorbs F-11 Y3)	§2 4-D	verified (v2)
D-03	`DG_mcu_connectors.md`	Minor	Minor	primary	§2 4-D	not independently verified
D-04	`DG_mcu_connectors.md`	Minor	—	absorbed → E-02 (alternative rejected)	§2 4-E	verified via E-02 (v1)
D-05	`DG_mcu_connectors.md`	Minor	Minor	primary	§2 4-D	not independently verified
D-07	`DG_mcu_connectors.md`	Minor	—	absorbed → C-01	§2 4-C	verified via C-01 (v1)
D-08	`DG_mcu_connectors.md`	Minor	Minor	primary (pin unresolved)	§2 4-D	not independently verified
D-09	`DG_mcu_connectors.md`	Minor	Minor	primary (absorbs A-12)	§2 4-D	not independently verified
D-10	`DG_mcu_connectors.md`	Minor	—	absorbed → A-13 (CLPROG part dropped)	§2 4-A	not independently verified; pin per v1 (h)
D-11	`DG_mcu_connectors.md`	Minor	—	absorbed → J-04	§2 4-J	not independently verified
D-12	`DG_mcu_connectors.md`	Minor	Minor	primary	§2 4-D	not independently verified
G-03	`DG_mcu_connectors.md`	Minor	Minor	primary (absorbs E-05, H-06)	§2 4-G	not independently verified
G-04	`DG_mcu_connectors.md`	Minor	Minor	primary	§2 4-G	not independently verified
G-05	`DG_mcu_connectors.md`	Minor	Minor	primary	§2 4-G	not independently verified
G-08	`DG_mcu_connectors.md`	Minor	Minor	primary	§2 4-G	not independently verified
D-13	`DG_mcu_connectors.md`	Note	Note	primary	§2 4-D	not independently verified
D-14	`DG_mcu_connectors.md`	Note	—	absorbed → B-10	§2 4-B	not independently verified
D-15	`DG_mcu_connectors.md`	Note	Note	primary	§2 4-D	not independently verified
D-16	`DG_mcu_connectors.md`	Note	—	absorbed → H-08	§2 4-H	not independently verified
G-06	`DG_mcu_connectors.md`	Note	Note	primary	§2 4-G	not independently verified
G-07	`DG_mcu_connectors.md`	Note	Note	primary	§2 4-G	not independently verified
F-01	`FHJ_layout_bom_ercdrc.md`	Blocker	Blocker	primary (absorbs J-01, F-15, B-12 netclass)	§2 4-F	verified-with-correction (v2)
F-02	`FHJ_layout_bom_ercdrc.md`	Blocker	Blocker	primary (absorbs D-06, F-16)	§2 4-F	verified (v2)
F-03	`FHJ_layout_bom_ercdrc.md`	Major	Major	primary (absorbs A-06 loops, B-06, F-07, F-09)	§2 4-F	verified (v1, v2)
F-04	`FHJ_layout_bom_ercdrc.md`	Major	—	absorbed → F-12	§2 4-F	verified (v2)
F-05	`FHJ_layout_bom_ercdrc.md`	Major	Major	primary	§2 4-F	verified, fix scope corrected (v2)
F-06	`FHJ_layout_bom_ercdrc.md`	Major	Major	primary (absorbs B-05, C-05, B-12 stackup)	§2 4-F	verified-with-correction (v1, v2)
F-07	`FHJ_layout_bom_ercdrc.md`	Major	—	absorbed → F-03	§2 4-F	verified (v2)
F-08	`FHJ_layout_bom_ercdrc.md`	Major	—	absorbed → A-01 (moot with U2 DNP)	§2 4-A	verified (v2)
F-09	`FHJ_layout_bom_ercdrc.md`	Major	—	absorbed → F-03	§2 4-F	verified-with-correction (v2)
F-10	`FHJ_layout_bom_ercdrc.md`	Minor	—	absorbed → A-14	§2 4-A	not independently verified
F-11	`FHJ_layout_bom_ercdrc.md`	Minor	—	absorbed → E-03 (Y1), D-02 (Y3)	§2 4-E / 4-D	verified via E-03 (v1) / D-02 (v2)
F-12	`FHJ_layout_bom_ercdrc.md`	Major	Major	primary (absorbs F-13, F-04, B-04, C-03, A-06 vias)	§2 4-F	verified, target corrected to ≥ 400 (v1, v2)
F-13	`FHJ_layout_bom_ercdrc.md`	Major	—	absorbed → F-12 (U6 EP → A-02)	§2 4-F	verified-with-correction (v2)
F-14	`FHJ_layout_bom_ercdrc.md`	Minor	Minor	primary (J9 part → G-02)	§2 4-F	not independently verified
F-15	`FHJ_layout_bom_ercdrc.md`	Minor	—	absorbed → F-01	§2 4-F	verified via F-01 (v2)
F-16	`FHJ_layout_bom_ercdrc.md`	Minor	—	absorbed → F-02	§2 4-F	verified via F-02 (v2)
F-17	`FHJ_layout_bom_ercdrc.md`	Minor	Minor	primary	§2 4-F	not independently verified
F-18	`FHJ_layout_bom_ercdrc.md`	Minor	Minor	primary	§2 4-F	not independently verified
F-19	`FHJ_layout_bom_ercdrc.md`	Note	Note	primary	§2 4-F	not independently verified
F-20	`FHJ_layout_bom_ercdrc.md`	Note	Note	primary	§2 4-F	not independently verified
F-21	`FHJ_layout_bom_ercdrc.md`	Note	Note	primary	§2 4-F	not independently verified
H-01	`FHJ_layout_bom_ercdrc.md`	Blocker	Blocker	primary	§2 4-H	verified-with-correction (v2)
H-02	`FHJ_layout_bom_ercdrc.md`	Blocker	Blocker	primary (U10 + R53 only)	§2 4-H	verified-with-correction (v2)
H-03	`FHJ_layout_bom_ercdrc.md`	Major	Minor	primary	§2 4-H	verified, severity Major → Minor (v2)
H-04	`FHJ_layout_bom_ercdrc.md`	Major	Blocker	primary (absorbs A-15)	§2 4-H	verified, severity Major → Blocker (v2)
H-05	`FHJ_layout_bom_ercdrc.md`	Note	—	absorbed → A-01	§2 4-A	verified via A-01 (v1)
H-06	`FHJ_layout_bom_ercdrc.md`	Minor	—	absorbed → G-03	§2 4-G	not independently verified
H-07	`FHJ_layout_bom_ercdrc.md`	Minor	—	absorbed → E-03	§2 4-E	verified via E-03 (v1)
H-08	`FHJ_layout_bom_ercdrc.md`	Minor	Minor	primary (absorbs D-16)	§2 4-H	not independently verified
H-09	`FHJ_layout_bom_ercdrc.md`	Note	Note	primary	§2 4-H	not independently verified
H-10	`FHJ_layout_bom_ercdrc.md`	Note	Note	primary	§2 4-H	not independently verified
J-01	`FHJ_layout_bom_ercdrc.md`	Major	—	absorbed → F-01	§2 4-F	verified (v2)
J-02	`FHJ_layout_bom_ercdrc.md`	Major	Minor	primary, residual (copper → A-02/A-07/B-08)	§2 4-J	verified-with-correction (v2)
J-03	`FHJ_layout_bom_ercdrc.md`	Minor	Minor	primary	§2 4-J	not independently verified
J-04	`FHJ_layout_bom_ercdrc.md`	Minor	Minor	primary (absorbs B-11, D-11)	§2 4-J	not independently verified
J-05	`FHJ_layout_bom_ercdrc.md`	Note	Note	primary	§2 4-J	not independently verified
V1-01	`verify_1.md` ("Anything else" #1)	— (new)	Major	primary	§2 4-A	raised by verify_1, not cross-checked
H-02b	`verify_2.md` (H-02 split)	(part of H-02, Blocker)	Major	primary	§2 4-H	verified (v2)

209 KiB Raw Blame History Unescape Escape

EinarBoard v6 — Full pre-fab audit (v1.0)

Resumen ejecutivo (ES)

1. Method and evidence

2. Findings and pass/fail by block (brief §4-A … §4-J)

4-A Power tree (24 V → 5 V → rails), lessons F4 / F5 / F7

(a) Findings

A-01 · Blocker · Unfused /24V branch feeds U20 and U2; D21 (30 V Schottky) reverse-stressed toward thermal runaway

A-02 · Blocker · LTC4040 (U6) copper, EP vias and placement repeat lesson F5

A-03 · Blocker · R50 = 825 Ω programs 2.42 A; set 1.43 kΩ to hold ≥ 1.3 A at every corner

V1-01 · Major · Reverse polarity is defeated by the D10 position (new)

A-04 · Major · U25 set-point 5.00 V (4.87–5.14 V) sits below the charge governor's start line; set R121 = 57.6 k

A-05 · Major · Battery-mode budget: 2.25–2.33 A on MAIN5V during a GSM burst; CSYS ≈ 57–69 µF effective

A-07 · Major · 5 V power path runs the full LTC4040 input current through inner 0.5/0.8 mm tracks

A-08 · Major · U17 AMS1117-3.3 drops out on battery and sets a 25–55 mW sleep floor

A-09 · Major · C78 is an 85 °C / 2000 h general-purpose electrolytic on the 5 V rail (≈ 1-year life in a port box)

Minor (A)

Notes (A) — not independently verified unless stated

(b) Pass/fail — §4-A

4-B Modem A7670SA (U19), lessons F1 / F2 / F3, ECO A / B

(a) Findings

B-03 · Blocker · LTE antenna ESD D28 is a unidirectional 5 V TVS on an RF line with no DC bias

B-02 · Major · VBAT_MODEM bulk is a general-purpose electrolytic; U20 compensation is the 5 V table row

Minor (B) — not independently verified

Notes (B) — not independently verified

(b) Pass/fail — §4-B

4-C GNSS ZED-F9P (U18)

(a) Findings

C-01 · Blocker · GNSS antenna bias has no current limit and no supervisor; ANT_DETECT / ANT_SHORT_N are undriven

C-02 · Major · U21 AP2112K has no soft-start: the ZED-F9P VCC ramp window (20–8000 µs/V) is met only by an unspecified margin

C-04 · Major · GNSS supply switch Q1 sits 9 mm from the LTE antenna feed; /SW_5V crosses the board on In1

Minor (C) — not independently verified

Notes (C) — not independently verified

(b) Pass/fail — §4-C

4-D MCU pin map vs firmware 0.6.0 (U16 STM32F411RET6)

(a) Findings

D-01 · Major · U24 back-powers the unpowered ZED-F9P through RXD2

Minor (D)

Notes (D) — not independently verified

(b) Pass/fail — §4-D

4-E Ethernet W5500 (U11), lesson F8

(a) Findings

E-01 · Major · 3V3_ETH is not switchable: the W5500 is powered on battery and during MCU reset (lesson F8 repeated)

E-02 · Major (Minor once E-01 is in) · /ETH_RST has no pull-down; the 100 k proposed in the lessons review could never work

Minor (E)

Notes (E) — not independently verified

(b) Pass/fail — §4-E

4-F Thermal and EMC (ECO §E, Copper Plan), lessons F5 / F6, 23-Jul short incident

(a) Findings

F-02 · Blocker · Raw ignition /IGN_IN crosses the board on In2 at 0.221 mm from /VEH5V: the 23-Jul inner-layer geometry repeated

F-01 · Blocker · Netclasses are broken and one custom rule overrides every clearance: "DRC 0 errors" cannot see any 24 V spacing

F-12 · Major · Ground vias: 69 on the board (V5.5: 165); 1 under the modem, 0 under the F9P, 0 in every regulator EP; east pour stitched by 5 vias

F-03 · Major · Switcher hot loops: U25 input caps on a different GND island from its EP/diode (≈ 311 mm² loop); U20 returns through a 0.25 mm neck; U12 Cin 6.4 mm, diode 11.9 mm

F-51 · Major · No charger-die or cell temperature reaches the MCU; the firmware thermal inhibit has no source on v6 (R4)

F-06 · Major · RF feeds: LTE routed 22 mm on In1 under the modem power tracks with 2 via transitions; GNSS bias line 0.27 mm beside the RF line; neither line is 50 Ω on the real stackup

F-05 · Major · In1, the "solid GND reference", is 19 % void and carries 1572 mm of tracks from 49 nets

Minor (F) — not independently verified

Notes (F) — not independently verified

(b) Pass/fail — §4-F

4-G Connectors and harness (drogheda-einarboard-harness, drogheda-einarboard-j1-mirror)

(a) Findings

G-01 · Blocker (conditional) · Mounting-hole pattern changed vs V5.5: MH4 now lands on L6; heatsink-clamp holes MH11 + partner missing

G-02 · Major · Modem USB-C J9 has no ESD protection (lesson F8, ECO §E.5)

Minor (G) — not independently verified

Notes (G) — not independently verified

(b) Pass/fail — §4-G

4-H BOM and JLC manufacturability

(a) Findings

H-04 · Blocker · U25's footprint carries LCSC Part = C2071691 (AP64350, 40 V) and the Fabrication Toolkit reads that field first

H-01 · Blocker · U15 MAX3232ESE (narrow SO-16) sits on a wide SOIC-16W land: it cannot be soldered (v6 regression)

H-02 · Blocker (order gate) · U10 and R53 cannot be bought for any order quantity

H-02b · Major · Stock to re-check against the order quantity (split from H-02)

Minor (H)

Notes (H) — not independently verified

(b) Pass/fail — §4-H

4-I Requirements traceability (ECO §0 R1–R5)

4-J ERC / DRC

(a) Findings

Minor (J)

Notes (J) — not independently verified

209 KiB

Raw Blame History

A-01 · Blocker · Unfused `/24V` branch feeds U20 and U2; D21 (30 V Schottky) reverse-stressed toward thermal runaway

C-04 · Major · GNSS supply switch Q1 sits 9 mm from the LTE antenna feed; `/SW_5V` crosses the board on In1

E-02 · Major (Minor once E-01 is in) · `/ETH_RST` has no pull-down; the 100 k proposed in the lessons review could never work

F-02 · Blocker · Raw ignition `/IGN_IN` crosses the board on In2 at 0.221 mm from `/VEH5V`: the 23-Jul inner-layer geometry repeated

4-G Connectors and harness (`drogheda-einarboard-harness`, `drogheda-einarboard-j1-mirror`)

H-04 · Blocker · U25's footprint carries `LCSC Part` = C2071691 (AP64350, 40 V) and the Fabrication Toolkit reads that field first

8. Firmware requirements (`board_v6.h`, FW 0.7.x)

Appendix A — ERC summary (`evidence/erc_summary.md`)

Appendix B — DRC summary (`evidence/drc_summary.md`)