# Design Review — mle-camera-controller
Date: 2026-09-08 | Reviewer: Claude (kicad-happy skill, full analyzer suite)

## Overview
4-layer board (F.Cu/In1.Cu/In2.Cu/B.Cu), 184.15 x 101.6mm, 428 components / 441 nets,
14-sheet hierarchical schematic (camera trigger select/mux, dimming control, e-fuse
power protection, 24V level shifting, FET switch banks, potentiometer input,
strobe power/trigger). Routing is complete (0 unrouted nets), schematic component
count matches PCB footprint count exactly (428 = 428).

Analyzers run: analyze_schematic (with --lifecycle), analyze_pcb --full (with
schematic cross-ref), cross_analysis, analyze_emc, analyze_gerbers, analyze_thermal.
645 total findings (67 high, 132 warning, 446 info) across 45 rule groups.

**Environment note:** the project lives on a Google Drive-mounted path (`G:\`),
which does not support `os.link` — the analyzer's capability_mode atomic-create
step fails there. Worked around by running all analyzers with `--analysis-dir`
pointed at local disk (`C:\kicad_review_tmp\analysis\2026-09-08_2215`); that
folder holds the full JSON outputs and is not synced to the project. Worth
reporting upstream if this project will always live on a Drive-synced path.

## Verdict: NOT ready to fab — sourcing gate failure and a few real gaps; the previously-reported critical wiring bug is a FALSE POSITIVE (retracted below)

## Blockers

| # | Severity | Finding | Refs | Status |
|---|----------|---------|------|--------|
| 1 | ~~CRITICAL~~ RETRACTED | ~~Op-amp V+ tied directly to unregulated 24V input rail~~ | U11, U12, U13, U14, U15, U17 (TLV172IDCK) | **False positive — see correction below** |
| 2 | High | MPN sourcing gate: only 19/65 unique BOM lines (29%) have MPNs on schematic symbols | project-wide | **Partially resolved 2026-09-08**: wrote back the existing DigiKey CSV (17 rows / 57 refs across PowerIO, SwitchBlock, eFuse, DimmingControl, PotentiometerConnection, CameraTriggerSelect, 24VLevelShifter, FETSwitch), raising coverage to 47/65 (72%). 18 lines still open: 8 bare connectors/jumpers (J9, J18, J19, J21-25, J27, JP8) with no CSV match, and 10 ICs (TLV172 x6, ADS1115 x2, D24V22F5/F3/F12, U24, SN74AS808 x2, W6100-EVB-Pico2) whose `Value` field already equals the real MPN but hasn't been copied into the MPN property yet — quick follow-up. |
| 3 | High | No decoupling cap found near 6 ICs | U24, U21 (+4 more) | Needs verification — U21 is a Pololu regulator module (may not need local decoupling the analyzer expects) |
| 4 | High | Placement: 20 connectors 0.0–0.14mm from board edge | J9,J12,J15,J16,J20,J26,J33,J36,J50-J61 | Likely intentional edge-mount I/O connectors — verify against fab house min. edge clearance |
| 5 | High | No fiducials on F.Cu (346 SMD parts, fine-pitch present) | board-wide | Real gap if assembly house requires them |

### #1 CORRECTED (2026-09-08, post-review): not a bug

The original finding claimed TLV172IDCK is a low-voltage part (~1.8–5.5V) and
that tying its V+ to the raw 24V rail would destroy it. **This device
characterization was wrong** and was explicitly flagged in the original
report as unverified "general knowledge" — that caveat turned out to matter.

Verified against the actual TI datasheet (ti.com/lit/ds/symlink/tlv172.pdf)
and a DigiKey forum reference confirming the abs-max rating:
- TLV172 is TI's **36-V, single-supply, low-power precision op-amp family**
  ("Low-Power Operational Amplifiers for Cost-Sensitive Systems"), not a
  low-voltage part.
- Recommended operating supply range: 4.5V to 36V (single-supply) / ±2.25V to
  ±18V (split-supply).
- Absolute maximum supply voltage (V+ to V−): **40V.**

24V on V+ is comfortably inside both the recommended operating range (36V)
and the absolute maximum (40V). Net tracing from the original pass (V+ of
U11–U15/U17 sharing the raw 24V input net with the Pololu regulators' Vin and
the TPS16632 eFuse inputs) is still accurate as a *connectivity* fact — it's
the *judgment* that this is dangerous that was wrong. Running a 36V-rated
precision op-amp directly off an unregulated 24V rail is a normal, intended
design choice, not a wiring error.

**Lesson for this review:** the PP-001 "no DC path to a power rail" automated
flag on these parts was actually a correct signal that the V+ net was worth
inspecting by hand — that part of the process worked. The failure was in the
manual device-family characterization layered on top, done from memory
instead of a verified datasheet. Treat this as a reminder that any
"general knowledge" caveat in a review is a real confidence flag, not
boilerplate — confirm it before escalating a finding to CRITICAL.

## Verification Basis
- Net connectivity for the original finding #1 (V+ of U11–U15/U17 on the shared 24V input net) confirmed by direct pin-to-net trace in the schematic analyzer JSON (deterministic, not heuristic) — this part held up. The safety judgment built on top of it did not; see the correction above, now verified against the actual TI TLV172 datasheet (36V recommended, 40V absolute max supply).
- Component/footprint counts cross-checked 428=428, net counts match (441).
- ADS1115 "address conflict" (PR-001) checked by hand: U16.ADDR → 3.3V rail (addr 0x49), U19.ADDR → GND (addr 0x48) — **different addresses, no real conflict.**
- No datasheets were available locally except a camera user manual and RM140 datasheet in `docs/` (unrelated to the flagged ICs) — DigiKey/other distributor API keys are not set in this environment, so automated datasheet sync could not run for the rest of the BOM. All IC-pinout claims other than the TLV172 correction above and the ADS1115 check are schematic-internal consistency checks, not datasheet-verified.

## False Positives Triaged Out
- **7 of the 13 PP-001 "no power rail" findings** (U16, U19, U25, U27 ×2, U28, U9, all landing on a net labeled `OUTPUT_ENABLE`): traced this net directly to U22 pin 1 (Vout of the D24V22F3, i.e. the regulated 3.3V rail). It **does** reach a real power source — the analyzer's rail-source detector doesn't recognize the Pololu module's `Vout` pin (typed `bidirectional` in the symbol, not `power_out`) as a declared source, so it misfires down the whole fanout powered from it. Same root cause drives the paired RS-001 "Vout has no declared source" warnings for these Pololu regulator symbols. Recommend fixing the pin electrical type on the `ProjectDevices:D24V22F5` symbol (or adding a PWR_FLAG) to quiet this class of finding, but no schematic rewiring is needed here — this branch is fine as designed.
- **I2C address conflict (PR-001, "2x ads1115idgs")**: not a real conflict — see Verification Basis above.
- **Connector edge-proximity (PM-002, 20 instances)**: near-certainly intentional edge-launch connectors for cable I/O on an I/O-dense controller board, not accidental placement. Still worth a fab-clearance sanity check, not a redesign.

## Other Notable Warnings (not blockers)
- **GP-001** (EMC, 20 high + 50 warning): significant/partial reference-plane gaps for many signals — expected on a 4-layer board with mixed stackup transitions (In1/In2 both signal layers per SU-001, no dedicated ground plane layer). Worth a closer EMC pass if this board will be sold/certified; less critical for a one-off camera controller.
- **RP-001** (21): missing stitching vias at layer transitions on several enable signals (CAMERA_POWER_ENABLE, STROBE_POWER_ENABLE, etc.) — cheap to add, standard good practice.
- **PU-001** (30): missing pull-up/pull-down on various MODE/PGOOD-type pins — spot-check against each IC's datasheet once datasheets are synced.
- **VS-002 / no ground stitching vias**, **TV-001** (Q1/Q2 have 0/9 thermal vias) — Q1/Q2 identity and power level not checked in this pass; worth a follow-up if they're switching FETs carrying real current.
- **Sourcing**: a `mle-camera-controller_digikey_bom.csv` (55 line items) already exists in the project root — this looks like sourcing work already done outside the schematic. It hasn't been written back to the schematic's MPN properties yet, which is why the automated sourcing gate still reads 54%. Recommend running the `bom` skill's write-back so the gate reflects real progress.

## Not Performed / Limits
- **Datasheet sync**: no DIGIKEY_CLIENT_ID/MOUSER/ELEMENT14 credentials in this environment; no `datasheets/` directory existed. All pin-level and electrical claims other than #1 (direct net trace) are consistency-only.
- **Lifecycle audit**: attempted (`--lifecycle`), but all 22 queried MPNs returned "unknown" — network access to distributor APIs is not available in this environment.
- **Thermal hotspot estimation**: ran, but produced 0 assessed components — no datasheet power-dissipation data available (same root cause as above).
- **SPICE simulation**: not run — no simulator availability check performed in this pass (time-boxed); the project does have a `simulations/` directory that wasn't inspected.
- **Deep Review pass (per-IC datasheet comparison)**: only performed for the TLV172/24VIn chain (the critical finding) and the ADS1115 address check, given the size of this board (28 ICs) and no local datasheet cache. Recommend a follow-up pass once datasheets are synced, prioritizing: TPS16632 eFuse ICs (U1/U3/U10), PCAL6416A GPIO expander (U27), SN74AS808 (U25/U28), INA260 (U9).
- **Prior review diff**: no earlier `*review*.md` found in the project — this is the first recorded review.
- **Gerbers**: analyzer ran clean (0 findings) against the `fab/` directory — outputs look complete and match the board.

## Positive Findings
- Routing complete, 0 unrouted nets, schematic/PCB component counts match exactly.
- eFuse-protected power architecture (TPS16632 ×3) with proper Pololu buck regulation from 24V down to 3.3V/5V/12V rails — sound topology aside from bug #1.
- No open/incomplete board outline, gerber set is internally consistent (job file, all layers present, drill file present).
- Decoupling present and mostly well-placed across most ICs (only 6 flagged as missing/far, out of 28 ICs).