Saturday, 8 February 2025

Modular MEGAphone Requirement Specification

Okay, so in the last couple of posts, I focused on making hand-assembly friendly modules, which I'll get back to soon.  But in the meantime, I want to put some effort into pinning down all of the requirements for the modules, and for the system as a whole.

We'll take an approach inspired by the "Systems Engineering V Model", which really just means that we'll start at the top, and break it down into sub-systems, and then define their requirements. Then when we have made all the sub-systems, we work from the bottom up, testing and making sure that it all ties together as intended.

To help this all work, one of my key goals is to keep the interfaces between the different sub-modules as simple as possible, so that the integration and testing phase will be as simple as possible. This is supposed to be a simple and modular device, after all!  And that's also the whole point of this project: Security is only possible when the system is simple enough to understand and reason about. But let's dive on in...

We are making a "Phone Like Object", so let's sketch out the functionality it will need, and some of the key ingredients that will be needed for that. i.e., let's map out the high-level requirements, in a bit of a hierarchy:

1. Effective power management, so that battery life is acceptable.

1.1 Integrated high capacity battery

For safety and longevity, including in the face of repeated extreme depletion of the battery, we will use a single LiFePO4 cell. Capacity should be sufficient to run for a week or more in idle operation, without any opportunity to recharge.

Assuming about a 30Wh cell, and 168 hours in a week, this means our idle power consumption must be below 30 / 168 = ~175mW, or about 55mA.  That feels achievable.

Requirement 1.1.1: Integrated LiFePO4 or other similarly safe and robust chemistry battery cell.

Requirement 1.1.2: Battery capacity and idle power consumption combine to support a battery endurance of at least 1 week when idle.

Requirement 1.1.2.1: Integrated battery capacity of at least 30Wh.

Requirement 1.1.2.2: Idle power consumption below 175mW.

1.2 Diverse charging of integrated battery

 To provide for "energy sovereignty", we need to support a variety of energy sources.

1.2.1 USB-C charging

Nothing much needs to be said about this -- USB-C is the standard for charging, and also allows much faster charging than a microUSB connector, for example.  

One option for this would be to have the USB-C port provide 20V @ several amps, without requiring it to be a data USB port, and then use the charging system for the other power sources to be used instead.  This would require some kind of isolation on the alternate power input, so that when USB power is selected, the other is physically disconnected to prevent weirdness. Or diode isolated or something.  Or alternatively we duplicate the power system in some way.

Initially I thought that I also wanted the USB-C port to provide the UART and JTAG interfaces of the MEGA65's debug header. But then I realised that for security, it's probably actually best to make the USB-C connector be power only, totally separate from the data side of things.

I haven't yet decided how I will handle wired data transfer. I could add a 2nd USB port (probably not USB-C, so that you can't accidentally connect to that and endanger the security of your MEGAphone. This is because the MEGA65's native debug interface that is what is usually exposed to the USB JTAG adapter in a MEGA65 gives total control over the system. It can reflash the FPGA, for crying out loud!

Maybe we can have a USB port that has a simple USB UART adapter that connects to one of the buffered UART slots on the buffered UART controller. But I have a vague recollection that they are all already allocated. But I could conceivably add another.  That would allow for intentional data transfer functionality. It would still be a bit clunky, as it wouldn't connect as a mass-storage device, but rather as a serial port. Fine between MEGAphones, but more annoying for connecting to a PC. But maybe that's kind of the point -- the data on your MEGAphone shouldn't be easy to interrogate or exfiltrate.

One option for this would be to use a FT2233HP which supports UART over USB as well as various power delivery modes up to 20V @ 3A. There is also a dev board available that breaks all this out, so I can de-risk this selection by testing with that board.  There is even a dual-port version of it, but I don't need that, if I can do data over powered USB. But it does offer the intriguing option of allowing a MEGAphone to plug into a USB-C cable to charge, and then you plug whatever was plugged into it before into the MEGAphone's 2nd USB-C port, so that it can keep charging.  The value in this is if there is a shortage of chargers for some reason, you're in a better position to negotiate plugging in the MEGAphone. It would also let you use the MEGAphone to charge other devices from its internal battery.

My biggest concern is that it will take a reasonable amount of effort to design up, and I can't immediately see an off-the-shelf module that has this.  Given that I have limited time, I might start out with a simpler module that lacks the UART interface. Like this one from SparkFun, for example, although they are a bit pricey.  There are also dirt cheap ones like this, but I don't know if I can trust them.

But the great thing is, that I can just make provision for a USB-C charge and data module, and start with a cheap one first, and then make an updated version when I get time!

Requirement 1.1.2.1: The internal battery shall be chargeable via an integrated USB-C connector, ideally fast charging.

Requirement 1.1.2.2 Define module bay for USB-C charger + data module, large enough to fit the SparkFun module, as that looks to be the biggest, capable of delivering 20V @ 3A to the carrier board.

Requirement 1.1.2.3: Proof-of-concept charger module based on a given USB-C power delivery module (no need for data).

Requirement 1.1.2.4: Power isolation mechanism to allow conflict-free operation of the USB-C and alternative power inputs to the MEGAphone (back-flow and over-voltage protection, for example)

1.2.2 Automotive 12V/24V power / external low-voltage solar panel

Cars and other vehicles are effectively portable generators, and by far the most common such resource. Thus we want to accept power from them directly, in case they don't have a USB power output, its busy, or perhaps you just have a car battery laying around.

While the voltage is nominally 12V for car, and 24V for trucks, realistically you can see peak voltages close to double that, and at discharge, perhaps as low as 9V. It can also be noisy as heck.  

We can kill two birds with one stone here, by selecting a regulator that can also accept a solar panel, i.e., has a Maximum Power Point Tracker (MPPT), that will do nothing when connected to a battery or car, but will help a lot when charging from an external solar panel.

Requirement 1.2.2.1: Means of accepting (including connector) dirty DC power between ~9V and ~40V using a MPPT to maximise efficiency with a solar panel.

1.2.3 Integrated solar panel

The MEGAphone will include a little integrated solar panel that covers the entire rear of the device (or as much as we can manage to cover). We'll make this using the highest-performance cells we can easily lay our hands on.

I've done previous experiments slicing up the kinds of cells they use on solar race cars and connecting them in series to get sufficient open-circuit voltage at low wattage, and then laminate them using an ordinary paper laminator. But it looks like I didn't blog it anywhere that I can find. It's a pretty rough method, but does largely work, and would allow up to about 4W in full sun, which would allow harvesting enough charge for a week in just a day or so.

But realistically I will probably use some ~1W off-the-shelf little panels to begin with, and the solar cells will be more about stopping the thing going flat when idle, rather than rapidly recharging the battery. But the device should support either, so that we have flexibility.

This means we need a solar regulator that can also handle these sorts of little panels. It might be that we can combine this with the charge regulator for automotive power / external solar panels -- or not.

Requirement 1.2.3.1: Means of accepting DC power from integrated solar panel at input voltages of 2V to 20V with a MPPT.

1.3 Ability to switch each sub-system on and off, even if the main processor is off.

If we want this thing to have any chance of having a low idle power consumption, we need a means of turning on and off each of the major sub-systems, so that they can stop using power when not needed.

Complicating this, we need for the main processor to turn itself off, and then be able to be turned back on... except if it's off, it can't.  The solution here is to have a low-power processor or FPGA that all it does is control power to other sub-systems, and watch potential interrupt sources that would require turning on the main processor. For extra power efficiency, it would be great for it to even buffer input from some communications devices, so that the main processor can only be woken up if something important happens, and the communications received in the meantime can be delivered to the main processor after it wakes up. 

Think, for example, of the RING message from a cellular modem: We need to turn the processor on in response to that, but there are probably plenty of other unimportant messages that the cellular modem might produce that can be safely ignored.  SMS reception is another use-case, here, where we need to make sure that we don't miss the message, but don't want the main processor on all the time just waiting for one to turn up.

Also, we need the communications lines between the various sub-systems to have current-back-flow prevention, so that if a device is powered off, it can't cause current to flow through those data lines causing partial powering of devices (and thus wasting energy), but more than that, back-power can cause all sorts of weird device behaviour.

Requirement 1.3.1: Power management processor that can control power to all other sub-systems, and itself have very low power consumption, ideally <10mW.

Requirement 1.3.2: Ability for power management processor to buffer communications when main processor is powered off.

Requirement 1.3.3: Galvanic isolation of communications lines between sub-systems that can be independently powered off, e.g., using opto-isolators.

Requirement 1.3.4: A small module for galvanic isolation, so that this can be reused. 

Requirement 1.3.5: Implement UART connection between power control processor and the main FPGA via MEGA65 buffered UART interface. 

Requirement 1.3.6: Protect writing to the power control UART so that it can be done only from the Hypervisor.

Requirement 1.3.7: Implement Hypervisor calls to provide an API for applications to request power to be switched on and off.

Requirement 1.3.8: Implement register access to check battery state and charger status (i.e., charging, discharging, which power source(s) are present).

1.4 High-efficiency high-current switchable DC-DC converters that can handle output voltages either above or below the battery voltage at 2A, with surge currents of 3A. Output voltages of 3.3V and 5V.

Let's explore this one a bit more, as it has some important implications.

"High current" here means "a few Amps", or more to the point, "enough Amps for the FPGA, cellular modem and other large power drawing modules".  

Implicit in this, is that I want to use the multiple instances of the same module to power the various sub-systems to create economies of efficiency for parts, but also for assembly steps. For example, if we use the same little module several times over, it becomes much more cost-effective to use an online PCB manufacture and assembly service, by making better use of their minimum ordering quantities (MOQs), that are typically around 5 pieces.

So let's just do a quick tyre kick to work out the maximum current draw of the various larger components:

Looking at the documentation for the EC25 Cellular Modem as an example, Chapter 6.4 of that document lists the current consumption while performing various operations, and Chapter 6.2 has overall peak power consumption listed, with a peak consumption of around 2 A. We'll dig more into this later. Interestingly, the cellular modem might be able to run directly from VBAT, except at lowest battery charge levels. It might be worth exploring that at some point.

For the FPGA, using a Trenz TE0725 as in the past iterations of the MEGAphone, there is no listed maximum power consumption for the 100T variant on Trenz website. However, I know from experience that 2A should be ample. Requires 5V.

Then we have the LCD panel as the next big power draw. More specifically, the backlight, which can consume 40mA at 20V. That voltage will probably require a separate high-voltage regulator, so we can ignore that here.

Otherwise, we may want to connect a Raspberri Pi Compute Module 4. I can't find exact consumption figures, but chatter on the forums suggests that 2A will be fine. It does also need 5V.

Finally, we have any auxiliary communications devices, which we can decide at this point shall also be limited to 2A, so that we can say that our high-current power supply needs are all limited at 2A. 

The  ISL91127IR looks promising for this.

Requirement 1.4.1: High-efficiency DC switchable DC power supplies that can support various sub-systems with >=2A @ 3.3V or 5V (externally selectable), with an efficiency of at least 90% in typical conditions when powered from a single cell LiFEPO4 battery (28.V - 3.2V).

Requirement 1.4.2: LCD Panel Backlight power supply module (20V, 50mA, powered from VBAT, switchable via a single enable input pin), unless incorporated into the solution to Requirement 3.3.1).

1.5 Low-energy module for components that don't use much power, probably 100mA or less. 

This will be required only if the high-current regulators are too inefficient at these low power levels, so that battery life can be maxmised. So we'll only worry about fleshing this out, if it becomes an issue.

2. Communications interfaces

2.1 Bluetooth communications module for hands-free etc 

Must support the connection of Bluetooth headsets and similar audio devices. Support for Bluetooth keyboards would also be desirable to allow easy use of a keyboard with the MEGAphone.

Requirement 2.1.1: Bluetooth host module that can connect to headsets and other audio devices. Must support UART or I2C control, and audio interfaces that we can easily implement from the FPGA, such as I2S audio.

Requirement 2.1.2: Bluetooth host module support for keyboards and other HID peripherals.

2.2 Cellular module for interacting with the mobile phone network.

Fairly self-explanatory. I'll be using an EC25-AU initially, as I have one on hand, and know how to interact with them fairly well. This will be removable, using an industry standard M.2-style connector.

Large surface-mount connectors for these are basically unavoidable, as the alternative would be that the base board would need to have the connectors directly on it, which would mean large surface-mount components that would need to be attached to each revision. This would be a pain, so I intend to make a carrier board for the module and SIM card, using the same style as the smaller removable modules -- just that this one will be really big! On the plus side, this approach means that the cellular modem can be recessed into the PCB, because of the vertical offset that our module format facilitates.

Requirement 2.2.1: Cellular Module Carrier board that can accept an industry standard industrial cellular modem, breaking out all pins from the connectors, and provides a SIM card slot.

Requirement 2.2.2: Create UART for cellular modem AT command interface to the MEGA65 buffered serial interface. This should keep output from cellular modem in a buffer until the application requests the next line or bunch of bytes, and require acknowledgement each time, to prevent loss of important messages.

Requirement 2.2.3: Allow Hypervisor to protect access to the cellular modem UART.

Requirement 2.2.4: Create Hypervisor API to request access to the cellular modem.

2.3 Alternative communications module interface (for "communications sovereignty"). 

Initially we'll just have a super simple interface for this, using either a LoRa radio or something like the RFD900 family.

Requirement 2.3.1: Power-switched, galvanically isolated UART interface to a module bay that can accept an alternative communications module

Requirement 2.3.2: A proof-of-concept module for the above that can accommodate some alternative communications module.

3 Human Interfaces

So now we need to think about the human interfaces for the MEGAphone.

3.1 One or more microphones

First up, for a phone, we need a way for it to hear the user. Ideally a pair or more, so that we can do some simple acoustic signal processing to subtract out distant sound sources, so that it's easier to use in noisy environments.

From a security perspective it would be good if there was an LED or something that lit when the microphone was powered. Or alternatively the microphone modules could be made easily removable (but not easy to lose?).

Requirement 3.1.1: One or more power-switchable MEMS microphones with power status indication.

3.2 One or more speakers.

We also need a way to make sound, both for a built-in speaker / ear-piece, as well as a 3.5mm headphone/headset jack.

Probably the easiest way to do this is to use a standard "CODEC" chip designed for use with cellular modems. I find their name to be highly misleading, as to me a CODEC is something that does the digital encoding and compression part, like an MP3 CODEC, for example. But I guess it's technically true to call it a CODEC if it is really just converting between analog and digital domains. 

Rant aside, these chips are fairly cheap, and are designed to handle all of this mess. I've used one before when I was designing a MEGA65-based phone for people with dementia. Now, the trade-off with those is that they do a lot of black-magic inside, and are a potential risk for exfiltrating audio via RF on speaker or headphone traces etc. I also have a spare TLV32AIC3104 based CODEC module from an EC25 module, so I may yet end up taking advantage of that.

I do like the CUI (now "Same Sky") low-profile speakers that I've used in past prototypes, as well. These tend to be about 40mm diameter, and less than 6mm thick, and are quite loud, typically 1W or more. Those are great for a loud speaker, e.g., for a ringer or speaker-phone or just listening to music or playing games.  Something like this

But those are not the best option for the ear piece, where the chance of it blaring at 1W in your ear is sub-optimal. So it would be good to have a 2nd smaller speaker for when using it as a phone. Or maybe that's overkill, on the basis that we are planning to have a 3.5mm audio jack and Bluetooth output. We can easily re-spin the carrier board to have provision for an extra module for an earpiece speaker, anyway. The modular design strikes again!

Requirement 3.2.1: Audio CODEC or equivalent that has output channels for loud speaker (mono is ok), 3.5mm audio output (stereo) ear piece, and input channel for 3.5mm microphone.

3.3 LCD Panel (including touch interface) for primary display

No big surprises here. We'll stick with the 800x400 or 800x480 ~6 inch LCD panels that I have been using with previous prototypes of the MEGAphone. Again, we can roll-forward on this front, when time allows.  These panels use the much simpler to interface with Digital VGA (DVGA), which is basically just parallel digital RGB, sync and a few other signals.

One of the challenges with these panels, is that every vendor and model seem to have the ribbon cable in a slightly different position.  So the module to host this needs not only a bunch of pins for all the required signals, with good enough signal integrity for the 27MHz pixel clock, but also that the module needs to be big enough to allow for moving the connector around.

This also feeds into the touch panel interface for these, that vary even more than the DVGA cable positions. Some have a resistive interface on the primary cable, while others have a 2nd cable for the touch panel.

We then also have the backlight power requirement for these panels. For the panels I have here, they require ~20V @ 40mA. So there are plenty of options for this, such as TPS92360. One of these with the required external components could all be loaded onto the panel interface module.

Requirement 3.3.1: Module to connect to industrial LCD panels of the type used in previous MEGAphone prototypes, large enough to allow for some variability in cable lengths and positions, for both DVGA and touch interface. Allow for either resistive or capacitive interfaces. Include appropriate LCD backlight driver and expose the PWM brightness control signal.

Requirement 3.3.2: Module bay to accept the LCD panel module.

3.4 Buttons, switches and knobs for user interaction.

Okay, so now lets look at the switches and things.  People who've been following the story of the MEGAphone know that I have a soft spot for thumb-wheels for volume control, including having separate ones for in-call volume, ringer volume and media volume, so that you can easily set those independently, and not have to have the phone yell in your ear, or navigate a menu to make it quiet in a hurry etc.  

The travel of the rotating wheel also lets you check the volume settings without having to wake the device up, etc.  So something like this. Perhaps paired with an 8-pin I2C I2C ADC like this. That ADC in particular, is interesting in that allows 9 addresses from 2 pins, by sensing high, low and floating.

Then we also need a D-pad type input, and some buttons. As with the previous prototypes, we'll stick with using 3rd-party Game Boy type carbonised rubber buttons.

We also want to be able to have a bunch of LEDs to indicate various things. This includes at least one or two LEDs on the rear side that we can blink, for example, to indicate missed calls/received messages etc. 

We also want some slide switches to allow other aspects of the device to be managed, such as hard-disabling some sub-systems, or selecting things like "silent mode".

A little e-paper panel (or two) on the rear would be really good for this, too, potentially with a couple of recessed buttons, too. The advantage of e-paper displays is that they don't consume power except when the display is being updated. That's technically out of scope for the current phase, but I'm highly inclined to add provision for such a module, even if I don't implement support for it in the software, because of just how useful this would be with the rear being a solar panel, thus allowing it to remain "sunny side up" when idle. Something like this I2C e-paper display looks good.

I'm also going to throw in I2C sensors of various other kinds in here. They are not a requirement in this phase, but it will be fairly easy to add provision for them by defining the module interface for them. Then we can easily add accelerometer, digital compass, proximity sensor, thermometer, or whatever you like. Even gas sensors, if you so desire. 

Requirement 3.4.1: Module hosting a thumb-wheel potentiometer and an I2C potentiometer, with two pins to select I2C address of the module, and pads on the module to add the selection resistors if required.

Requirement 3.4.2: Module to accept D-pad

Requirement 3.4.3: Module to accept push-button pairs

Requirement 3.4.4: I2C I/O Expander to accept inputs from buttons and control LEDs

Requirement 3.4.5: Slider switch module for input

Desirable 3.4.6: Module for hosting e-ink display and recessed buttons

Desirable 3.4.7: Module specification for hosting I2C sensors and peripherals

4. Computation

For computation, we have one main requirement: An FPGA that can run the MEGAphone's MEGA65 core. But that uses too much power for idle operation, so we also need a low-powered FPGA or microcontroller that can be used to allow that main FPGA to be turned off.

That low-power FPGA should also have the means to buffer communications from the other modules, as well as power everything on and off.  It feels like it is also the correct thing to control the e-paper display, so that things like message notification can be performed without having to power the main FPGA on at all. Although that's probably more energy optimisation than we need.

Optionally, I'd also like to have a way to host a Raspberry Pi Compute Module 4 (CM4), so that Android or Linux software can also be used if required, but normally turned off, so that both power and security are optimised.

4.1 Primary FPGA module for running the MEGAphone system

For simplicity, we are just going to mandate the same TE0725 FPGA module that we've used in previous revisions. This does constrain the number of IO pins we have. But it makes it much quicker for us to design.

Requirement 4.1.1:  A100T or larger FPGA module SWaP and pin-compatible with the Trenz TE0725.

4.2 Low-power FPGA module for monitoring communications devices while primary FPGA is off to save power.

Here the goal is the lowest idle power consumption possible, while still having enough GPIOs to control the power to everything else. Ideally, this would have enough pins so that we wouldn't need an I2C IO expander or similar running to scan buttons and other inputs. 

I'm considering a few options here, including designing my own module around the Trion T4 that 33 IO pins.  Alternatively, I might use something like a FireAnt on the basis that then I don't have to design it :) In any case, leaving enough space so that a FireAnt could be used, is probably a sensible approach. 

The only thing annoying about the FireAnt is that it requires 3.3V and 5V. But the 5V is only for the USB, which is probably good overall, as the 5V rail can be switched off during normal operation, thus making it harder to accidentally reprogram the FireAnt once it is installed.

Requirement 4.2.1: Module bay that can power and host a FireAnt or similar FPGA module to control the power to all sub-systems, and interdict the communications between the main FPGA and sub-systems that require monitoring when the main FPGA is powerd off.

4.3 Raspberry Pi Compute Module Slave processor

We have spoken about the desire for this. So let's consider what would be required for this.  We can either use HDMI from the Pi into the FPGA, or multiplex a digital VGA signal to the LCD panel.  Unfortunately, we probably don't have enough pins free on the main FPGA to ingest the digital VGA signal directly.

This is not a major problem for the initial design, but would be an issue for any future version that is oriented around the disability market, where having the MEGA65 being able to read pixels from the Pi's display to do hardware zoom etc.  

For now, we are talking just about being able to have a Pi present for running a captive Android instance, so just using some 74LVC multiplexors is probably sufficient.    

Desirable 4.3.1: Bay for Pi Compute Module 4

Desirable 4.3.2: DVGA multiplexor to allow LCD panel to display either the MEGA65 or Pi display, on a pixel by pixel basis.

Desirable 4.3.3: Isolatable USB data connection between cellular modem and Pi.

Desirable 4.3.4: UART interface between Pi Compute Module and MEGA65 core.

5. Infrastructure

5.1 Main carrier board(s) to connect the sub-systems together into a robust and easily assembled structure.  

This is going to be interesting, and enabled by the castellated module system, as it will allow us to stack 2 and 4 layer PCBs together, without needing lots of fancy 3d-printed parts. 

I'm really hoping that this board will be able to be 2-layer, as that will make it much cheaper -- especially if we have multiple of these PCBs that need to stack up to make the whole electronics package.  But that stacking does make it more likely that a 2-layer board will be possible, because we can do vias through the boards if required -- even if it will make it a bit of a pain to design.  An equivalent approach is to just use external via wires where required, and then have the corresponding holes in the adjacent PCB layer where required to allow space for them -- but even that shouldn't be necessary, since the castellated modules will be sitting between the PCBs and thus create sufficient space themselves.

Requirement 5.1.1: Main carrier board that connects all sub-systems together.

5.2 A case/housing to put it all into.

So then once we have a robust electronics package, we need a way to enclose it all in a sensible and practical case. This can't be done until we know the dimensions of the electronics, of course.

Requirement 5.1.2: Design a 3D-printable / CNC machinable case to contain the electronics package.

6. Software

So let's look at the software side of things now.

6.1 Simple power management API 

First of all, we need an API that allows the main FPGA to control which sub-systems get turned on and off. This will be the responsibility of the low-power FPGA module, and will be implemented over a UART interface between the two FPGAs.

Requirement 6.1.1: Power control API on low-power FPGA to allow control of power to all sub-systems, including the main FPGA.

Requirement 6.1.2: Logic to activate power to the main FPGA based on relevant criteria (eg incoming call, user pressing power button etc).

Requirement 6.1.3: UART interface between main and low-power FPGA module exposed via one of the MEGA65 buffered UART interfaces.

Requirement 6.1.4: MEGA65-side software that implements the power control API.

6.2 Simple telephony software

Here the goal is to simply make the system usable in a basic way. So we will just focus on the ability to make and receive calls, and manage a simple contacts list.

Requirement 6.2.1: Can initiate telephone calls via dialing or selecting a contact.

Requirement 6.2.2: Can accept incoming telephone calls, showing contact name when the caller matches an existing contact.

Requirement 6.2.3: Can list contacts.

Requirement 6.2.4: Can add a contact.

Requirement 6.2.5: Can edit a contact.

Requirement 6.2.6: Can delete a contact. 

Requirement 6.2.7: Incoming calls are indicated, even if the user is performing some other function (e.g., OSD overlay or blinking LED).

6.3 Simple text messaging software

Similarly for telephone calls, we are focusing just on the most minimal functionality that proves that we can do everything necessary, so that it can be improved upon later.

Requirement 6.3.1: Incoming SMS messages are indicated, even if the user is performing some other function (e.g., OSD overlay or blinking LED).

Requirement 6.3.2: SMS message can be composed and sent to a number or contact.

Requirement 6.3.3: SMS message can be received, and the corresponding contact indicated.

Desirable 6.3.4: SMS messages are logged, so that SMS conversation threads can be displayed.

7 Summary & Diagram

Okay, so that establishes 62 requirements (including 3 desirable properties) for the system.  Next I'll look at how these all hang together, so that we can derive any subordinate requirements, in particular, relating the the IO interfaces between the various sub-systems.  To get started on that, let's make a block diagram for all of the above.

Hmm... I've been working on it for the last hour or so, and it's not surprisingly getting quite complex.  Part of this is that there are several sub-systems that require DC:DC regulators and galvanic isolation for their data paths.  So each of those sub-systems requires 3 or more blocks, and eventually, solderable module bays, even if two are repeated for each.  

I'm sure that I will have missed some modules and bays in the process, but it will be a good starting point, and as I proceed, I can just add the missing bays and modules as I go along -- yet another advantage of the modular approach.

This also means that my first carrier board will probably be much bigger than I want, until I work out the division into stackable sub-boards. That's also okay, and again, something that is easy to handle as part of this modular approach, as I can just desolder and resolder the modules between revisions of the carrier board. Thus I'll be actively dog-fooding my concept as I develop it. That's a feature, I think.

But first, let's look at that diagram that I've prepared:


It's a bit small here, for the full size version, you can get it from the github repository here.

For convenience, I have also added the collacted requirements list to the github repository.

So, combined with the preliminary work defining the module interface, fabricating and testing sample modules, that finally gets us to the point of being able to sign off on some of the milestones for the NLnet grant that is supporting this work. Specifically the following milestones:

1.1 Power management effective control of all sub-systems: Requirements Specification.

1.2 Power Management interface for use by other software: Requirements Specification.

1.3 Telephony software: Basic Communications With Cellular Modem: Requirements Specification.

2.1.1 High-Efficiency DC-DC converter module to power the various sub-systems: Requirements.

2.2.1 Low-energy power-management module to minimise energy consumption of device, especially in low-power modes: Requirements.

2.3.1 Battery management and energy harvesting module to allow USB-C, integrated solar panel and external 12/24V vehicle battery power sources, and efficient management of the integrated rechargeable battery: Requirements.

2.4.1 Cellular modem communications module, including SIM card module: Requirements Specification.

2.5.1 Internal microphone and speaker module: Requirements Specification.

2.6.1 External speaker and bluethooth headset interface module: Requirements Specification.

2.7.1 Primary FPGA carrier module, leveraging off the shelf FPGA modules if at all possible: Requirement Specification.

2.8.1 LCD panel interface module: Requirement Specification.

2.9.1 Auxiliary communications module, e.g., LoRa, ultra-sonic, infra-red or mm wave: Requirement Specification.

2.10.1 Main carrier board and assembly, into which the various modules connect: Requirement Specification.

Sunday, 20 October 2024

Testing the castellated module format

In the previous post working on the modularisation of the MEGAphone with NLnet Foundation's support, I described the castellated  module format I have developed.  The sample PCBs from PCBWay have turned up now, so time to try out how well it works in practice!

Here is what the sample boards look like: 

 

For ease, I made it a single panel, and made the little test modules snap-offs.  The test modules just have simple wiring from each pad to a set of hole-throughs in the middle, for testing continuity.

There is unfortunately a fabrication error on the PCBs: The little modules have all their cut layer a bit to one side, or perhaps the other layers in there were shifted. I have checked the Gerbers, and it was all correctly aligned there. So I'm guessing PCBWay might have accidentally moved something when setting it up, perhaps with the castellation, thinking that the far end of the PCBs should be castellated, instead of just the sides.

This has a few consequences: 
 
1. Pins 5 and 10 on the little PCB at least have their trace to the hole-throughs cut, so continuity cant best tested over those.

2. The cut-outs for the DIP IC puller to allow the module to be held still while soldering don't work, because the top and bottom edge of the module is misplaced by about half a pin.  This wasn't a huge disaster, but did make soldering it on fiddlier than it should have been. 

3. Also for desoldering, this means you don't have a nice way to hold the module with the IC puller, while using either a soldering iron or hot air gun to reflow it.
 
You can see what has happened with the misplaced cuts when the module sits on the carrier board: At one end there is spare PCB, and at the other end, there is only a 1/4 of a hole, instead of a half of a hole!


 
I did try filing off the excess at the other end to make it possible to use the DIP IC puller, but it didn't really help, as the opposite end was loose, and so it could rotate a bit. But every indication is with that fixed, it should work nicely.
 
The only other error I have found so far is a problem of my creation: The wide 20-pin module is too wide for the carrier board footprint, as you can kind of see in this image:
 

 
Whereas the other two smaller modules sit nicely over their footprints, the wide one is too wide, and doesn't leave enough of the carrier board pads visible. That will be an easy fix, however.
 
Time to try soldering it on, including fitting the VCC and GND straps using bits of solder wick.  That worked really easily, as the solder wick really wants to connect to the solder, even if it only reflows a little, because of the thermal mass of the carrier board's GND and VCC planes. So that feature is a win!
 

 
I ended up with it a bit rotated first time around as you can see above, and so I got to try out the ease of desoldering straight away ;)  With the VCC and GND straps not fitted, there was no massive thermal capacity problem, and with a bit of mucking about with my hot air gun, I was able to pull it off again prying it from underneath with a pair of tweezers. I was not at all gentle, and had the hot air set to 350C, which is pretty hot, and it still worked to remove it, without ripping any pads. You can see that some of the pads the solder was only softened, not properly melted when I pried it off, but all the pads still stayed put!
 
 
In the process of doing all this, I have learnt that the hole diameter in the castellated pads should be a bit bigger, so that the soldering iron can sit in it easier, to ensure ease of forming the solder joint. Also, for ease of removal, I should reduce the size of the pad on the underside of the modules.  The big pad on the top side is good, though, as it allows for continuity testing of the joints super easily using multimeter probes, because the pads are big enough to park the probes on each.

Remounting the module wasn't too hard, although I did learn the hard way, that its much easier if you first wick off the solder lumps from the carrier board pads and the underside of the module, so that it could sit flat on the carrier board again. This is another reason to remove the excess pad size on the underside of the modules.
 
Once I did that, it was really easy to reseat the module.  Holding the soldering iron vertical in the half-hole of the castellation seemed the easiest way to get both parts of the joint hot quickly.  

Again, I purposely didn't take too much care with this process, to simulate someone doing this with limited skills, or in an austere environment.
 

Then it was time to refit the VCC and GND straps. I recycled the saturated bits of solder wick from the process of cleaning the module and carrier pads, so it looks a bit scrappy, but the key point is that all connections have continuity.
The only thing to be careful of when recycling saturated wick like this, is to make sure it sits low enough, that it can't snag on anything sitting above the module PCB level, for example, if we had the carrier board sitting directly behind the battery or screen in the MEGAphone.  But its fairly easy to poke it down using a soldering iron.
 
The final thing to try out was to apply glitter polish, and see how the QR-code style reference points work to make it easier to acquire and compare an image of the glitter over the module. Actually making the image registration software to do this is outside of my scope, but if anyone would like to give it a go, and see how well it works, here are a few images from different angles:




Anyway, the short story is that this module format seems to be workable, and I just need to do a respin at some point with the reduced pad size on the underside of the modules, and fix the width of the wide module. I'll do those two when I design up the first modules (which will probably be DC:DC regulator modules), which will also give some time for me to figure out with PCBWay how the production fault occurred, so that we can avoid it in future.

Sunday, 6 October 2024

Modular MEGAphone: Prototyping castellated modules

 In the last post, I described a concept for the modules for the MEGAphone based on the following approach:

B. Half-Round Castellated Pins

C. Key Pins & Varied Module Dimensions.

D. Carrier Board Cut-Outs for Reduced Height / Reverse Component Mounting

E. Carrier Board Cut-Outs for Ease of Removal

F. Bridges for Power and Ground Thermal Relief

I'm going to add to that:

G. Image Registration Reference Markers

The reason here, is to make it easier to check if a device has been tampered with, by making it possible for someone to make an image registration-based blink comparator, to quickly and easily check of the glitter polish has been tampered with. I'm not going to implement that right now, but I want to make it easy to do.


Let's start with making a footprint in KiCad for a simple version of the carrier board half of this interface.  This requires the surface-mount pads for the pins, and the cut-outs for the ease of removal, and the cut-out to allow for reverse-side components on the modules, as well as the image reference markers.

So let's start with measuring the size of the hooks on the end of an IC puller I have here, so that we can size the cut-outs at the ends. The hooks are only about 3mm wide and  2mm deep, so it looks like 4mm x 4mm should be big enough. These should stick out far enough, so that the hook can be got into place, but still have enough of the cutout beneath the module for the hooks to grab onto.  The edges of the module will restrain the IC puller when used, but won't restrain a screwdriver or other improvised tool, if one is used. Therefore, the cut-outs for the ends should not be contiguous with the cut-out for the module components.

Let's take a look at what this looks like for the 2x5 format:


We have the 2 rows of 5 pads in the middle, where the module will sit on top.  Then above and below that, we have the A1,A2 and B1,B2 jumper pairs: These are for putting the jumpers on that connect the module to the possible large and heat sucking GND and VCC planes of the carrier board -- and vice-versa, cutting and removing the jumpers disconnects the module from those planes, and thus making it much easier to desolder or resolder, because none of the pins are going to be massive heat-sinks.

Back to the missing pin 2: This is what allows the user to know which way around the module should go: You can't rotate it or flip it, and still have the missing pad line up with the missing pad on the module half, that looks like this:

I've included exclusion zones for everything except for tracks on the rear side, except for the area marked in the middle that corresponds to the cut-out in the carrier board. The pry zones should have exclusion zones for everything, including tracks, so that using hard tools there can't mess up the function of the module.  I've not got those quite right here, which I'll have to fix, but hopefully you get the idea.

On the front side, there is no exclusion zone, because those physical problems don't apply there.

On the rear side of the module, we can see the pry zones, where no components should be placed, because a user may be using a hard tool against that surface to try to lift the board off.


Any components on the rear side should go in that square in the middle.

Now, for a symbol for the module, I've gone with this, so that those power and ground plane isolation jumpers are explicit:

For modules, a regular 10 pin symbol can be used for now, so I haven't made an explicit symbol just yet.

As I discussed in the previous post, I'd like for different modules that are not electrically compatible with one another, that they shouldn't fit. To do that, we can most easily remove different pins, or combinations of pins.  For removing only a single pin, there are only two choices: a corner, or a pin next to a corner. Removing a middle pin won't work, as then the module could be flipped vertically. So we can have a "minus pin 1" and a "minus pin 2" version.  If we want more variants, then we need to remove two pins, with "minus pins 1,2", "minus pins 1,3", "minus pins 1,4", "minus pins 1,7", "minus pins 1,8" and "minus pins 1,9" are the only options that maintain resistance to Murphy's Law. That would give us 8 total variants. 

I'll get to those, but first, I wanted to make a 20 pin version, with narrow and wide variants, depending on the space required on the module:



At this point, I have enough done that I can design up some simple test PCBs for fabrication, so that I can see whether they really are easy to solder and desolder etc.

For that, I'll make a 100x100mm carrier board (US$5 for 5 pieces from PCBWay and friends) with places for various modules, on both sides of the board, as well as simple examples of the modules, with hole-throughs that go to each pin, so that I can easily verify that the connections have been made. I'm not going to worry about the various missing-pin combinations, as that's less relevant right now.

Here's the test carrier board, with six of these footprints, spread over both sides, with every pin broken out to some standard 0.1" headers for ease of testing:


Looking at this, I'm slightly concerned that I have the inter-pad spacing a bit tight, and that they will be prone to bridging. I know that 0.1" pin headers are super easy to solder, so I should be able to reduce the pad heights to match that ratio of pad to space. They were 2mm, so only just over 0.5mm between them. I've now reduced them to 1.75mm, so that they now have just over 0.75mm between them, which feels a lot better:

Now for the test modules. I decided to add them as snap-offs on the PCB, as this should be cheaper than submitting 4 different PCB orders. I've not done this before, nor worked with PCBWay for castellated edge connectors. So let's see if they complain about my design :)


Actually, it occurred to me that it might be cheaper to do it in two parts, since the modules are forced to be 4 layer in this arrangement, even though they are just simple adaptors right now. But maybe I'll leave them all together, as it will still confirm that PCBWay can do this with 4-layer boards. In which case I should ideally put GND and power layers in them, with thermal relief connections to the pins, so that the thermal issues from that for soldering are reproduced.  Once I get the review feedback from PCBWay (I submitted it in the middle of the night), I'll make a decision on it, as I'll be pleasantly surprised if they accept it first time around.

As expected, I got some feedback from PCBWay, who pointed me at this resource

Basically I need to make my tabs wider (2mm+), with rounded ends, as well as the gap between the boards (1.6mm+), and I can then put drill holes (diameter > 0.45mm) along the edge, to make it easier to break them off.  Here is how the connections work now:

So let's see how PCBway goes with that. It passed, but the price is pretty high for five pieces, due to the castellations, and the 6 different designs on the panel. I'll live with that for now, as my priority right now is testing the module design.

Hopefully, it will work when it arrives...



Sunday, 29 September 2024

Modular MEGAphone Kick-Off -- Designing a simple and effective module interface

Thanks to the support of the fantastic folks at the NLnet Foundation, I have support to progress the hand-held version of the MEGA65, building on the past work which NLnet supported. The brief for this stage of the work is as follows:

The previous MEGAphone project laid the groundwork for creating personal communications devices that are secure through simplicity. This project extends that work by making the hardware modular, at some cost of minimum size, so that it becomes much more feasible for small communities to produce and maintain their own units, even in the face of supply chain challenges and other contributors to the "digital winter", i.e., the situation where open innovation becomes more difficult due to number of factors. This will also make it easier to include diverse resilient communications options, whether RF, optical or acoustic, so that peer-to-peer communications networks can be sustained even in environments that are hostile to freedom of communications. For this reason energy sovereignty will also be part of the design, so that even if all civil infrastructure is denied, that basic communications and computing functions can be sustained, with a single device whose security can be much more easily reasoned about.

 If you want a bit more background on the motivations for this, I'd recommend watching this presentation and this presentation I gave just before the COVID19 pandemic, which rather uncomfortably rapidly confirmed my hypothesis that a Digital Winter could occur.

I'll dig into the work more deeply as it progresses, but the first part we will focus on, is the ability to develop a mobile-phone like device, that can be build by hand, without requiring advanced skills, and that is nimble to supply chain shocks of various forms, that characterise a Digital Winter.

Let's first agree what we mean by can be built by hand, without requiring advanced skills. Some skills will be unavoidably necessary, but we can minimise these. and perhaps more importantly, we can reduce the scale at which those skills are able to be mustered -- this is one of the key motivations for the modularisation of the MEGAphone. Put another way, we can minimise the impact of an error when building a MEGAphone. This has the significant benefit of allowing someone whose skills allow them a low but non-zero probability of achieving some particular task to increase their probability of eventual success.

Why Modularisation Makes So Much Sense

In the first instance, modularisation contributes significantly to this goal, by allowing an assembly error in a specific module to not impact on the rest of the unit. Consider the key example of surface-mount soldering of small and fiddly components.  I know first-hand, how much of a pain it can be to solder these things by hand, and how easy it is for someone who has some rudimentary hand-soldering skills to nonetheless be thwarted by the narrow pitch of pins on surface-mount components, or even more difficultly, to correctly mount surface-mount components that have ball grids, concealed thermal pads or other particularly diabolical characteristics for the hand-solderer.

By isolating such components to be on their own little PCBs, these components can be the focus of attention, and if their attachment goes wrong, only that little PCB will be wasted: The rest of the complex board on which it needs to be mounted will be preserved, and all that's needed is to have another go at making the little PCB.  

Also, it becomes much easier to track down problems with the attachment of the surface-mount components through their isolation. Short-circuits and open-circuits are some of the most common things that can go wrong, and are much easier to track down if there is only one component that needs to be investigated.

A further benefit, is that for components that truly need surface-mount techniques, it is much more likely that in austere environments that a very small SMD reflow oven could be rigged up and operated correctly, than if a whole board needed to be reflowed.  For boards that are perhaps just a few centimeters long and wide, getting an even temperature will be much easier.  

This isolation of the need for SMD processing skills onto small modules, also allows for a community where those skills (or the equipment necessary) are available, but scarce, that they can be focused on exactly those parts of the design where they are unavoidable, while the rest of the assembly process is performed using much simpler hand-soldering skills.

Finally, the modularisation allows for ordering these little modules in bulk, if such services were still available, which one assumes that except in a deep Digital Winter, that they may well be. And certainly, prior to that, it would be a very convenient option.  The attraction of this is increased if we reuse some modules in the design. For example, the MEMS microphone module will likely be replicated at least 2x and possibly 4x, to allow for a nice way to suppress background noise in the hardware domain (we'll talk about this more in a future post, but the short version is that you can use the difference between pairs of microphones to subtract out common mode background noise). The voltage regulators are also likely to be used more than once, as well.  This would allow individuals or small communities to order modest size batches at affordable cost from online PCB providers, and either used by themselves, or further distributed.

This approach also helps us to mitigate a bunch of the common problems with PCB design, too, and generally allows us to apply the strengths of a Systems Engineering approach, by breaking down a complex system into several smaller ones, that we can then integrate in a methodical and reliable manner.

Module Interface Requirements

So given that we are going to use a modular approach, let's now think about how we can design a nice module interface.  We'll start by looking at a number of the requirements for such an interface to be effective in our use-case, in no particular order.

1. Large Pad Size

First up, the solder pads need to be big enough, that someone who has only spent an hour or two learning to solder can work with them, without significant risk of creating short-circuits or other problems.

2. Effective Thermal Relief for Hand Soldering

Soldering power rails and ground pins by hand can be a royal pain, when those pins are connected to ground or power planes in the PCB, because the heat gets sucked out of the spot you are trying to solder. Without a solution to this, a reflow oven or similar approach would then be required, that can heat the entire ground or power plane to be heated, so that it can't cause this problem.

3. Unambiguous Orientation and Placement

The original formulation of Murphy's Law is all that we need as justification:

If there are two or more ways to do something and one of those results in a catastrophe, then someone will do it that way.[1]

Therefore it should not be possible to place a module with incorrect orientation, nor in the incorrect place on the PCB. This indicates that means that each module should have only one, correct, orientation, where they fit into the PCB receptacle, and that the PCB receptacles and modules should only mate in places where the modules are electronically compatible. 

4. No Sharp Protrusions on Rear

The MEGAphone is not going to be a particularly small device, because miniaturisation and modularisation aren't usually the best of friends, and even more so hand assembability and miniaturisation are more or less sworn enemies.  Nonetheless, we don't want it to be any bigger than necessary. 

To assist with this goal, we don't want to have to have any clearance between the PCB assembly and other components, like the rechargeable battery, which its probably a good idea to avoid sharp metal pins and solder lumps poking holes into [2]. We could avoid this by putting a spacer or bracket in place, but that takes space -- it would be much better to just make the rear of the PCB -- including attached modules -- be smooth and flat, so that the problem is simply avoided.  Apart from being be best option from the Heirarchy of Control perspective [3], i.e., we have removed rather than managed the battery piercing hazard, it also follows the principle of "the best part is no part", made famous by Elon Musk [4].  

(We'll also be using LiFePO4 cells, rather than Lithium Ion, to also reduce the risk, as they behave much more sedately when damaged, as can be seen in this video).

5. Ease of Desoldering for Diagnosis, Repair, Replacement, Substitution or Scavenging

It's not just important that a module can be easily added to the system, but also that they can be easily and reversably removed. Maybe you want to be check a suspect faulty module by swapping it out with another one, or maybe you are in an extremely austere environment, and need to make one working MEGAphone out of two or more damaged units, or swap out a module with a newer (or older) one that avoids a security vulnerability of some sort.  This should be possible using only simple hand soldering tools, if possible.

6. Small Size

We have already mentioned size, but this is really critical: We want these modules to be as small as possible in surface area, and also in height, as possible, so that the MEGAphone doesn't become the GIGAphone, or require a backpack to carry around.

7. Ease of Testability / Verification

We have also touched on this one, in terms of being able to remove or replace a module easily, but we'd also like to be able to easily test a module before it is first installed. This includes during development, but also for post-assembly of modules to test that they have been built correctly, especially when hand assembling modules with tricky surface-mount parts.  

It also makes it easier to check modules that have been assembled by 3rd parties for correctness. While a sufficiently determined adversary can almost always hide malicious functionality in a device, by breaking it down into smaller simpler modules, we at least make it as easy as possible for us to detect the cheaper and easier approaches, thus increasing the cost of such attacks, and/or increasing our chance of detecting them.

This can be further enhanced by applying some tricks to make it harder for components to contain side-channels for communications, such as using low-pass filters on signals, but that's probably well outside of our current scope, for now at least.

8. Tamper Evidence

But one thing that we can design for, is to make it easier to detect when a device has been tampered with, in particular, by swapping out a module, or by reflowing it to swap out a component in the field without the owners knowledge, e.g., via an Evil Maid/Manservant attack [5]

While nothing is perfect, not even glitter polish seals [6], they are still a pretty good approach in that they are quick and easy to apply [7], but take considerable time and effort to replicate -- the time factor being critical here: It is pretty implausible that someone could replicate a glitter seal in just a few moments -- especially if the seal is not flat, but has to conform around some slightly odd shape, a point that we'll come back to later.

In short, if we can meet these design criteria, we will be well on our way to a good solution.

Considering Some Module Design Characteristics

A. Hole-through vs Surface-Mount

Let's start with the key dichotomy we have to deal with: Should we make our modules use a hole-through or a surface-mount attachment mechanism? Let's compare how these interact with our 8 design criteria:

Approach 1 2 3 4 5 6 7 8
Hole-Through 😐
😐 😐 💩 😍 💩 😍 😐
Surface Mount 😐 😐 💩 😍
💩 😍 💩 😐

As we can see, neither has the upper hand: Both have characteristics that are great, really unhelpful, or are rather neutral.  Surface mount has the slight edge here. But what if we break it down, and instead say that the PCB should be surface mount, and the module have hole-through characteristics, and see how many of those poops we can get rid off:


Approach 1 2 3 4 5 6 7 8
Hole-Through Module
😐
😐 😐 😍 😍 😐 😍 😐
Surface Mount Carrier
😐 😐 😐 😍
😍 😍 😍 😐

Look at that: we have flushed all of the poop away, in many cases turning them into strengths.  Not surprisingly, such hybrid approaches already exist, in particular in the form of crenelated/castellated modules, e.g., this module.

B. Half-Round Castellated Pins

If the castellations are made as half-rounds with spacing that matches standard hole-through spacing of breadboards etc, then they can also be just easy to test in that context. This also makes it easier to hand-solder, without causing bridges between adjacent pads, because the shape helps surface tension to keep the blob of solder away from the neighbouring pads.

We are probably stuck with 2.54mm spacing, as the smallest pitch that is easily hand-soldered, and would offer good compatibility with existing prototyping aids, such as breadboards and DIP IC sockets.

Another benefit of this approach is cost: There are no sockets or connectors involved, delivering another benefit of "the best part is no part" philosophy.

C. Key Pins & Varied Module Dimensions.

By using judiciously placed key pins, we can make it impossible to insert the module around the wrong way, including up-side down -- which is important if we want to be able to minimise the assembled height (see below).

Also, by varying the module dimensions, primarily through changing the number of pads, and the width of the module, we can effectively key each type of electrically compatible module, so that they can't be put in an electrically incompatible place on the board. The module widths could match existing DIP spacing options to make prototyping and testing as simple as possible.

Together, these measures would effectively deal with Murphy's Law.

D. Carrier Board Cut-Outs for Reduced Height / Reverse Component Mounting

In some cases, it might be desirable to mount the components on the under-side of the module. This makes it possible to reduce the overall PCB stack-height, by reusing the thickness of the carrier PCB to offset the height of the components. If modules are assembled on both sides of the carrier, then components can be the height of the carrier board and one module PCB thickness -- which is probably sufficient for most components -- without further increasing the height of the assembly, and ensuring that there are no non-smooth protrusions on either side of the PCB assembly, thus helping to avoid the need for spacers or brackets on either side.

Mounting components on the under-side of the modules also makes it easier to use simple surface-mount techniques, such as a hot air gun, to reflow the modules into place, or to remove them later. This is because the attached surface mount components on the module will not be exposed to direct heat, and thus are unlikely to move or fall off.

E. Carrier Board Cut-Outs for Ease of Removal

Another use that can be made of cut-outs in the carrier board, is to make it easier to remove modules using either a hot-air gun or hand desoldering techniques, as the module can then be gently pried using a small screw-driver, tweezers or and old-fashion DIP chip puller, like this one:

While it's not the best way to remove a castellated module, as it would require you to reflow the pads repeatedly, until you could get enough movement to get it free, it would work, and doesn't require a great deal of skill or precision.  And of course, with a hot air-gun, this becomes almost trivial. So all in all, it makes sense to allow.

F. Bridges for Power and Ground Thermal Relief

Another design element we can consider is to completely avoid the thermal relief problem, as well as helping with making testing and "bring-up" of the system, by having the power and GND of the module route to jumpers or pads, that then have to be bridged to the power and ground planes of the carrier.

Once the module was soldered in place, those pads would be bridged with a short piece of desoldering braid, to ensure that the link could carry high current loads.  As only localised melting of solder onto those pads would be required, the thermal aspects would be greatly simplified.  To desolder and remove the module, the bridge could be first cut,  and then the two ends separately removed, so that it wouldn't be necessary to heat both ends at the same time.  Using desoldering braid as the link is convenient, because its widely available, has good surface area for carrying current, and of course takes solder very easily.

Summary and Requirements Cross-Check

In short, this combination of design elements should yield a solution that satisfies our design requirements from above. Let's go over them again, just to be sure:

  1. Large Pad Size -- Addressed by A & B
  2. Effective Thermal Relief for Hand Soldering -- Addressed by F
  3. Unambiguous Orientation and Placement -- Addressed by C
  4. No Sharp Protrusions on Rear -- Addressed by A, B & D
  5. Ease of Desoldering for Diagnosis, Repair, Replacement, Substitution or Scavenging - Addressed by E & F
  6. Small Size - Addressed by A, B & D
  7. Ease of Testability / Verification -- Addressed by B & E
  8. Tamper Evidence  -- Addressed by A & B: Glitter polish can be applied over the castellated solder joints, creating an uneven surface for the polish, that would be hard to rework without being detectable.

So this design approach has the potential to meet our needs. Now, I don't claim that it is the only possible approach, nor necessarily the best possible approach. Rather, only that it is an approach that we can use in this project, to make rapid progress.  If you have better ideas, or suggested improvements to this approach, please let me know in the comments or via email!

In the meantime, I'll probably try to design up a module or two and a simple carrier board to test this concept, before I move onto the rest of the hardware design, in particular, gathering the requirements for the device as a whole.