docs/01-requirements.md
59 KB · 301 lines · markdown · View source · Download from the repository page
PoppyUp — Requirements Specification (Phase 1 baseline)
Document: 01-requirements.md · Baseline: v0.3, 2026-09-27 (owner review decisions D1–D13 applied; see ADR §15. v0.2: built-in cellular modem removed, ADR §14) · Derives from: 00-architecture-decisions.md (ADR). Where a number here disagrees with the ADR, the ADR wins and this document must be corrected.
0. How to read this document
Every requirement carries:
- ID —
FRfunctional,NFRnon-functional/performance,IFexternal interface,SAFsafety & security,ENVenvironmental/mechanical,UXuser-facing behaviour,REGregulatory. - Priority — P0 ship-blocker (product does not exist without it), P1 must ship in v1 but a slip is survivable, P2 desirable / may move to a later SKU or firmware release.
- Verify at — earliest prototype stage at which the requirement is formally tested: PoC (dev-kit rig), EVT, DVT, PVT. See
13-roadmap.mdfor what each stage is. - Acceptance — the measurable test that closes the requirement. "Realistic" numbers are field numbers, not spec-sheet numbers; the derivations are in
03-datapath-bottlenecks.mdand05-power-budget.md.
Rates are decimal (1 MB/s = 10⁶ B/s; 1 GB = 10⁹ B), matching card and network vendor conventions.
1. Assumptions
| # | Assumption | Consequence if wrong |
|---|---|---|
| A1 | Professional media in the field is overwhelmingly exFAT (some FAT32 on SD). Camera-proprietary volumes (RED, ARRI, Sony AXS, Codex) are out of scope. | Filesystem support list in firmware phase grows; no hardware impact. |
| A2 | The user's phone is an iPhone 15 or later (USB-C). iPhone Pro models expose USB 3.2 Gen2 (10 Gbps); non-Pro models expose USB 2.0 (480 Mbps). USB4 on iPhone is not assumed. | If a future iPhone is USB4, Port C (Pro SKU) already serves it at full speed. |
| A3 | Real-world 5G NR sub-6 uplink in North America and Europe is 20–80 Mbps typical, 100–200 Mbps in good C-band cells; not the ~1 Gbps headline figure. With no built-in modem this is the uplink the user's phone (hotspot or USB tether on Port B) or a USB cellular adapter will deliver; a phone hotspot adds ~5–15 % Wi-Fi overhead and phones throttle after 20–30 min of sustained TX. | Runtime and "time to upload" claims in marketing must be built on these numbers (the phone's uplink), not on any modem or phone datasheet. |
| A4 | The venue Ethernet drop, not PoppyUp, is usually the throughput ceiling (100 Mbps – 1 Gbps typical; 2.5–10 Gbps in post houses). | 5GBASE-T is already headroom; 10GBASE-T was rejected — 5GBASE-T (RTL8126) is final (ADR §5, D6). |
| A5 | Endpoints are reachable over plain outbound TCP 443/22; no VPN client is required in v1. | VPN is a firmware-phase feature; no hardware impact. |
| A6 | The device is "portable" in FCC terms (used <20 cm from the body is plausible), therefore SAR evaluation is required. | If classified "mobile", SAR cost/time drops; design does not change. |
| A7 | CFexpress 4.0 Type B cards accept a Gen3 ×2 link (all PCIe endpoints must negotiate down). | Verified at PoC with three card vendors (Sony, ProGrade, Lexar/Angelbird). |
| A8 | The RK3588 pcie3x4 controller can be bifurcated to ×2 + ×2 with the chosen carrier (Firefly / Forlinx SoM or ODM board-down RK3588J — decided at PoC exit, ADR §3.1) exposing all four Gen3 lanes. |
If not, the ASM2812 switch takes the full ×4 and the CFe B slot moves behind it (see 02-system-architecture.md fallback). |
| A9 | The battery is non-user-removable and always in circuit. | Hold-up design (SAF-070) relies on this. |
| A10 | Volumes: 1 k units in year 1, 10 k units/yr by year 3. | SoM-vs-board-down decision at PoC exit (ADR §3.1, D12). |
| A11 | iOS Personal Hotspot over USB (ipheth) and Android USB tethering (NCM/RNDIS) remain available to a Linux USB host without vendor software, and the user's phone plan permits tethering. |
USB tether falls back to the phone's Wi-Fi hotspot (same cellular uplink, no phone charging) or to a USB cellular adapter on Port B; no hardware impact. |
| A12 | Desk operation (D2). The device operates on a desk or table (studio, venue, hotel, vehicle), in free air, lying flat or standing on its bottom edge. A bag is for transport only; the device is not expected to operate inside a closed bag. Thermal design, runtime claims and the throttle ladder (NFR-030…032) assume this. | If users routinely run uploads inside closed bags, the passive thermal ceilings do not hold; the thermal safety rule (FR-077) still protects the device and data, but jobs pause. An active-cooling design (fan) would be reconsidered (ADR §12 fan gate). The rugged targets (ENV-003/004) already cover transport. |
2. Explicitly out of scope (v1 hardware)
- Sony AXS, RED Mini-Mag, Codex Compact Drive / Capture Drive, ARRI proprietary media, Blackmagic Cloud Store integration.
- XQD — unsupported, not marketed, no Sony licensing, no USB-reader workaround (ADR §7, D10). The only XQD-related behaviour is firmware detecting a non-NVMe PCIe device in the CFexpress B slot and showing "XQD not supported" (IF-006, UX-011).
- SD Express (SD 7.x/8.x) and UHS-III host modes.
- Built-in cellular modem (any band) — cellular reach is via phone hotspot / USB tether / USB cellular adapter on Port B, see FR-020, FR-026, FR-030.
- 10GBASE-T — rejected, final; 5GBASE-T only (ADR §5, D6).
- On-device GNSS receiver (ADR §13 item 10, D13). Job geotagging is provided by the phone app sending its location over BLE / the NCM management API (FR-065).
- Any on-device transcoding, proxy generation, or media playback.
- Desktop application and iPhone application (later phases; hardware must not block them — see FR-091…FR-094).
- Hot-swappable / user-swappable reader cartridges (internal daughterboard only).
- Active cooling (fan) at EVT: cooling is passive; the sealed tunnel-fan envelope is reserved and the fan decision is taken at the EVT-exit gate on measured magnesium thermal data (ADR §12, D5).
- Operation inside a closed bag (bag = transport only, A12, D2). No in-bag operating mode, detection heuristic or test exists; if the device is packed away mid-job the thermal safety rule (FR-077) pauses and later resumes the job.
- Operation while submerged, or IP rating with the shutter open beyond IP52.
3. Functional requirements — core upload path
| ID | Requirement | Acceptance / target | Pri | Verify |
|---|---|---|---|---|
| FR-001 | On card insertion in standalone mode, the device shall detect the card, mount it read-only, enumerate files, and begin uploading to the assigned endpoint without user action, provided a usable link and an assigned endpoint exist. | Time from card fully seated to first byte on the wire ≤ 8 s for a 256 GB exFAT card with ≤ 5 000 files; ≤ 20 s with 50 000 files. | P0 | EVT |
| FR-002 | The primary data path shall stream directly from the card to the endpoint with no mandatory intermediate copy to internal storage. | Base SKU (no NVMe) achieves NFR-010 throughput with eMMC write activity < 1 MB/s during upload (job-DB only). | P0 | PoC |
| FR-003 | Cards shall be mounted read-only for upload. The device shall never write to, modify, delete, or "repair" source media, including not clearing exFAT dirty bits, not updating access times, and not creating index files. | Byte-for-byte image of the card (dd of the block device) before and after a full upload session is identical. Tested on exFAT, FAT32, dirty-bit-set exFAT. |
P0 | PoC |
| FR-004 | Transfers shall be resumable across link loss, power loss, reboot, card removal/re-insertion, and mode switches. | After any interruption, ≤ 1 in-flight chunk (≤ 64 MB, configurable 8–64 MB) is re-sent; no file is restarted from zero. Verified with 100 randomised interruptions on a 128 GB upload. | P0 | EVT |
| FR-005 | Every uploaded object shall be checksum-verified end-to-end. Local per-chunk hash computed while streaming; remote verification via the endpoint's native mechanism (S3 ETag/MD5 or x-amz-checksum-sha256, SFTP re-read or remote sha256sum where permitted, Drive md5Checksum, Dropbox content_hash). xxHash64 is the local manifest hash; MD5 and SHA-256 are computed on demand per endpoint. |
Deliberate single-bit corruption injected on the wire (TLS disabled test harness) is detected and the chunk retried 100 % of 1 000 trials. Hashing does not reduce throughput below NFR-010. | P0 | EVT |
| FR-006 | Supported endpoint types: SFTP (SSH2, password and key auth), Amazon S3 and S3-compatible (Backblaze B2, Wasabi, Cloudflare R2, MinIO; path- and virtual-host-style; SigV4), Google Drive (OAuth 2.0, resumable upload), Dropbox (OAuth 2.0, upload sessions). | Each endpoint type completes a 100 GB mixed-file-size upload with verification. | P0 (SFTP, S3) / P1 (Drive, Dropbox) | DVT (firmware) |
| FR-007 | Per-slot endpoint assignment: each of the five slots has a default endpoint; per-card overrides (by card serial / volume label) are supported. | Two cards in two slots upload simultaneously to two different endpoint types. | P0 | DVT |
| FR-008 | A completed job shall produce a manifest (file list, sizes, xxHash64, remote object IDs/paths, timestamps, link used, data volume per link, job location when available — FR-065) retrievable from the app and optionally uploaded alongside the media. | Manifest present for 100 % of completed jobs; survives power loss (FR-070). | P1 | DVT |
| FR-009 | The device shall support card swap during an active session: a new card in the same slot starts a new job; the previous job's state is retained for resume if the same card is re-inserted within a configurable window (default 7 days). | Card identity = controller serial + FS UUID + volume label + directory fingerprint. False-match rate 0 in 1 000 swaps across 20 cards. | P0 | EVT |
| FR-010 | Optional internal NVMe (Pro SKU) shall be used only for (a) buffering when no link is available and (b) explicit "quick copy" so the card can be returned before upload completes. Default path never touches NVMe. | With NVMe fitted and a live link, NVMe write activity during a normal upload is 0 B (measured by NVMe SMART data-units-written). | P1 | EVT |
| FR-011 | Quick copy (Pro): copy card → NVMe at ≥ 1.4 GB/s for CFe B, ≥ 800 MB/s for CFe A, card-rate-limited for others; verify by hash; then release the card and upload from NVMe. | 512 GB CFe B card quick-copied and verified in ≤ 7 min. | P1 | EVT |
4. Functional requirements — connectivity and link policy
| ID | Requirement | Acceptance / target | Pri | Verify |
|---|---|---|---|---|
| FR-020 | The device shall support three uplinks: wired Ethernet (5GBASE-T only — RTL8126 with NBASE-T fallback to 2.5G/1G/100M; final, ADR §5 D6), Wi-Fi station mode (Wi-Fi 7, 2.4/5/6 GHz; including a phone's Wi-Fi hotspot), and a USB-tethered network device on Port B (iPhone/Android USB tethering or a USB LTE/5G adapter, FR-026). There is no built-in cellular modem (ADR §2, §5). | Each link independently completes FR-006 tests. | P0 | EVT |
| FR-021 | Default link preference: Ethernet > Wi-Fi STA > USB tether. Each link is tagged metered/unmetered (hotspots, tethers and USB cellular adapters default to metered). Fully user-configurable ordering, including disabling any link. | Preference change in app takes effect on the next chunk boundary (≤ 64 MB). | P0 | DVT |
| FR-022 | Automatic failover: on loss of the active link (Ethernet link down, Wi-Fi disassociation, tethered device detached or hotspot dropped, DHCP loss, DNS/TCP failure, or > 30 s without progress), the job shall continue on the next permitted link. | Failover completes (first byte on new link) in ≤ 10 s for Ethernet→Wi-Fi and Ethernet→USB tether when the standby link is already associated / the phone is already attached with tethering enabled; ≤ 45 s cold. | P0 | DVT |
| FR-023 | Automatic fail-back: when a higher-preference link returns, the job migrates to it at the next chunk boundary. | Fail-back within 20 s of link return. | P1 | DVT |
| FR-024 | Per-link rules: "never upload over metered links" (phone hotspot, USB tether, USB cellular adapter), "metered links only below N GB per job / per billing period", per-link bandwidth caps, time-of-day windows. | Rule violation count = 0 in a 24 h soak with rules toggled hourly. | P0 | DVT |
| FR-025 | Metered-link data-usage accounting (per link: hotspot, tether, USB cellular adapter) with configurable monthly cap, warning thresholds (default 80 %, 95 %), and hard stop; counted by the device's own per-interface byte counters in the job engine (there are no modem statistics to read) and cross-checked against the bytes the endpoint reports as received. | Accounting error ≤ 2 % versus endpoint-reported bytes over 50 GB; within 5 % of the phone's own tethering-usage figure where the OS shows one. | P0 | DVT |
| FR-026 | USB tethering support on Port B (replaces the v0.1 nano-SIM/eSIM requirement): iPhone Personal Hotspot over USB (ipheth, including the on-phone "Trust This Computer" / unlock prompt flow surfaced on the OLED and app), Android USB tethering (rndis_host and cdc_ncm), and USB LTE/5G adapters (cdc_mbim / qmi_wwan, or hotspot-class adapters presenting NCM/RNDIS). The tethered device is a normal link in the policy (FR-021…FR-025). |
Tethered interface enumerates and obtains an address within 10 s of attach (after the phone prompt is accepted); upload throughput ≥ 90 % of the phone's own speed-test uplink at the same spot (NFR-013); survives 100 attach/detach cycles with no stuck state and job resume each time. Tested on iPhone 15 (USB 2.0) and 15 Pro, two Android phones, one MBIM and one QMI adapter. | P0 | PoC |
| FR-027 | Wi-Fi station shall support WPA2/WPA3-Personal and WPA2/WPA3-Enterprise (EAP-TLS, PEAP), captive-portal detection with app-assisted login, and 6 GHz operation where regulatory allows. | Association to WPA3-Enterprise network ≤ 10 s; captive portal surfaced to app ≤ 15 s after association. | P1 | DVT |
| FR-028 | Wi-Fi AP (device hotspot) shall run concurrently with Wi-Fi STA on the same channel for app management, with no hardware change. | App connected via AP while STA uploads at ≥ 60 % of STA-only rate. | P1 | EVT |
| FR-029 | The hardware shall not preclude multi-link bonding (simultaneous use of two or more links for one job) in a later firmware release. | All three links are independent network interfaces: Ethernet and Wi-Fi on their own PCIe lanes, the USB tether on the ASM3142 xHCI (ADR §3.2, §3.3). | P2 | EVT |
| FR-030 | Port B tether power and exclusivity: while a phone is tethered, Port B shall source 5 V at a user-configurable current limit of 0.5 / 1.5 / 3 A (default 1.5 A; 3 A gated by FR-031; ADR §13 item 14, D13) so the phone charges rather than drains. SSD ingest (FR-049) and tethering share the single Port B receptacle and are mutually exclusive; the OLED and app shall state which role is active and that the other is unavailable ("Port B: phone tethered — SSD not available" / "Port B: SSD — unplug to tether"). | Measured VBUS current limit within ±10 % at each setting; phone reports charging at 1.5 A and (with a PD source present, FR-031) 3 A; hub-with-SSD-and-phone case rejected with the message shown. | P1 | EVT |
| FR-031 | Port B charge-current policy (EC-enforced, D13): the Port B supply limit defaults to 1.5 A; 3 A is permitted only while PoppyUp itself has external PD power present (Port A, or Port C on the Pro SKU — FR-050); on battery the EC caps the limit at 1.5 A regardless of the user setting, so 3 A is never a battery-runtime case (NFR-021). 0.5 A remains user-selectable. The app and OLED show the effective limit. | With no PD input and the user setting at 3 A, the Port B current limit reads 1.5 A (Rp advertisement and eFuse limit, ±10 %); plugging a PD source raises it to 3 A within 2 s; unplugging drops it to 1.5 A within 500 ms with no phone re-enumeration. | P1 | EVT |
5. Functional requirements — host-connected (card-reader) mode
| ID | Requirement | Acceptance / target | Pri | Verify |
|---|---|---|---|---|
| FR-040 | The device shall provide two mutually exclusive top-level modes per card: Standalone (device uploads) and Host-connected (card presented to a USB host). While a card is host-connected, PoppyUp's uploader for that card is paused. On Port A, all uploads pause while a host is attached (default, D9); concurrent read-only sharing is the UX-031 opt-in. Media presented to a host is read-only by default on both ports (FR-045, D8). | State machine documented in 02-system-architecture.md; no observed state in which both the SoC uploader and a host have the same card mounted (unless UX-031 opt-in is active). |
P0 | EVT |
| FR-041 | Path 2 (universal, Port A, all SKUs): when a USB host is attached to Port A, the SoC shall present every inserted card as a read-only USB mass-storage LUN (UAS preferred, BOT fallback; SCSI WP bit set) plus a CDC-NCM network interface, with no driver installation on macOS 14+, Windows 11, iOS/iPadOS 17+. In-progress uploads pause (checkpointed) for the duration (D9). | Card volume appears in Finder / Explorer / iPhone Files app within ≤ 5 s of cable insertion (cards already inserted). | P0 | PoC |
| FR-042 | Path 1 (Pro SKU only, Port C; depopulated on Base — D7): when a USB host is attached to Port C, the CFexpress Type B slot shall be electrically re-routed to the USB4 bridge (ASM2464PD). USB4/Thunderbolt hosts see a native NVMe device; USB 3.2 hosts see a UAS NVMe bridge. Other slots continue uploading. The card is presented read-only by default (FR-045, FR-045-A). | Enumeration on Mac (USB4) and iPhone Pro (USB 3.2 Gen2) ≤ 5 s from cable insertion; other slots' upload throughput drops < 5 % during the switch. | P0 (Pro) | PoC |
| FR-043 | Mode switch shall be clean: before re-routing a slot, the job engine checkpoints (completes or abandons the in-flight chunk, persists offsets), unmounts, and power-gates the slot; the EC then re-routes the PCIe mux and REFCLK and sequences PERST#. | Zero filesystem errors on the card after 1 000 automated switch cycles (host attach/detach) with a live upload. Switch-out latency (cable in → host sees device) ≤ 5 s; switch-back (cable out → upload resumes) ≤ 8 s. | P0 (Pro) | EVT |
| FR-044 | On return from host mode the job engine shall re-verify the card identity (FR-009) and re-scan the directory tree; files changed by the host are re-queued; unchanged files resume from checkpoint. | Host adds/deletes/modifies 3 files during Path 1 session; after return, exactly those 3 are re-uploaded/reconciled. | P0 | DVT |
| FR-045 | Read-only by default on both host paths (D8). Path 2 LUNs carry the SCSI write-protect bit; Path 1 enforces read-only per FR-045-A. An explicit per-session app toggle enables read-write (needed for formatting cards from a Mac); the toggle reverts to read-only when the host detaches, is never persisted, and every RW session is logged. Source media is otherwise never modified by a host (macOS would silently write .Spotlight-V100, .fseventsd, .Trashes and ._* files to any writable volume). |
Write attempt from a host to a Port A LUN returns a write-protect error and macOS creates no hidden metadata files on the card; RW toggle takes effect on the next enumeration and is reset to RO after detach; RW sessions appear in the job log. | P0 | EVT |
| FR-045-A | Port C read-only enforcement order (Pro, D8): (1) NVMe Namespace Write Protection — before flipping the mux the SoC sets Feature 0x84 to state 1 (Write Protect) on cards whose controller reports NWPC support (Identify Controller byte 531); works in native USB4 and UAS modes; the SoC clears it on return before "Safe to remove". (2) ASM2464PD bridge write-protect (SCSI WP / firmware RO config) when the host is in UAS/BOT fallback, if ASMedia's tool exposes it (verify). (3) Fallback when neither applies (native USB4 host + non-NWPC card): read-only cannot be enforced, so the device shall not switch to pass-through automatically; the OLED and app ask "Mac wants write access to CFe B — allow?"; only an explicit per-session confirmation (button hold or app) proceeds; the session is logged and on return the job engine performs a full re-verification (FR-044). | (i) A macOS host with a non-NWPC card does not get a writable volume without a per-session user confirmation (no pass-through occurs; prompt shown on OLED and app). (ii) With an NWPC card the host mounts the volume read-only and writes of .Spotlight-V100 / .fseventsd fail (EROFS / "disk is locked"); dd image of the card identical before and after the session. (iii) After return, the namespace WP state reads 0 before "Safe to remove" is shown. NWPC support surveyed across the IF-001 card list at PoC. |
P0 (Pro) | PoC |
| FR-046 | Volumes shall be usable in the iPhone Files app: exFAT and FAT32 volumes as formatted by cameras (including 128 kB–1 MB clusters, no partition table / MBR / GPT variants). | 20 camera-formatted cards from 8 camera brands all browse and copy in Files on iPhone 15 Pro and iPhone 15 (non-Pro). | P0 | EVT |
| FR-047 | The device shall draw no meaningful power from an iPhone (< 10 mA on VBUS) and shall run from its own battery in host mode. It may optionally source 5 V/1.5 A to the phone (PR_Swap) when enabled in the app. | VBUS current from phone ≤ 10 mA measured; with source enabled, phone reports charging. | P0 | EVT |
| FR-048 | Path 2 shall function as the wired management link (CDC-NCM) for the phone or a computer at the same time as the mass-storage function. | App reaches device API over USB-NCM on iPhone, macOS, Windows without drivers. | P1 | EVT |
| FR-049 | Port B (USB 3.2 Gen2 host) shall accept external USB SSDs (UAS/BOT, exFAT/APFS-readonly/NTFS-readonly) as an upload source, powered at 5 V/3 A, treated as a sixth "slot" — when no tethered device occupies the port (FR-030). | Samsung T7/T9, Blackmagic MultiDock-class, SanDisk Extreme Pro all mount and upload; measured read ≥ 850 MB/s from a T9. | P1 | EVT |
| FR-050 | Port C PD sink (Pro SKU, D7): the device shall charge and run from a USB-C host attached to Port C (a Mac typically supplies 15 W; PD 5–20 V up to the host's advertised contract, ≤ 3.25 A — verify mux rating at 65 W). Port C VBUS is OR-ed with Port A VBUS into the BQ25792 input through a priority power mux; Port A has priority, switching is break-before-make, and the NVDC charger rides the transition from the battery. Depopulated on Base with the ASM2464PD. | With a Mac on Port C and nothing on Port A during a USB4 reader session, battery net discharge ≤ 0 W (session not battery-limited); plugging or unplugging a Port A PD source while Port C is attached, and vice versa, causes no reset, no VSYS droop > 3 %, and no USB4/UAS link drop; with both present, Port C VBUS current falls to 0 within 100 ms (Port A priority). | P1 (Pro) | EVT |
| FR-051 | Base SKU shippable without Port C (D7): no Base-SKU P0 requirement shall depend on the ASM2464PD / Port C path. Firmware keeps Port C behind a feature flag; the Base FCT fixture does not exercise Port C; Base regulatory testing covers the Base population (REG-008). Port C may slip to a later Pro revision without delaying Base launch. | Base SKU passes every P0 requirement in this document with the ASM2464PD, Port C PD controller and VBUS mux unpopulated (Port C receptacle fitted and blanked); every Port C-dependent requirement is tagged "(Pro)". | P0 | EVT |
6. Functional requirements — management and provisioning
| ID | Requirement | Acceptance / target | Pri | Verify |
|---|---|---|---|---|
| FR-060 | The device shall be manageable from the iPhone app over BLE (always-on EC, works with SoC asleep), Wi-Fi (device AP or shared LAN), and wired USB-NCM (FR-048). | All three transports reach the same API; BLE provides at minimum: status, power on/off, link selection, Wi-Fi credential provisioning, endpoint assignment. | P0 | EVT |
| FR-061 | First-time pairing shall use BLE with out-of-band confirmation (6-digit code on OLED) and establish device-bound TLS credentials (device identity key in TPM). | Pairing ≤ 30 s; MITM attempt with a rogue peripheral fails. | P0 | DVT |
| FR-062 | Endpoint profiles (name, description, type, host/bucket/folder, credentials/OAuth tokens) shall be synced from the app and stored only in the TPM-sealed encrypted data partition; never in plaintext on eMMC, never in logs. | eMMC image dump off a powered-off unit reveals no credential material (LUKS2, key sealed to PCRs). | P0 | DVT |
| FR-063 | The device shall expose to the app: job status/progress/throughput per slot, active link, tethered-link type (iPhone / Android / MBIM / QMI adapter) plus phone-reported signal where the OS exposes it (usually it does not), metered-link data used vs cap, Wi-Fi RSSI/SSID, battery %/Wh/health/runtime estimate, temperatures, thermal-throttle and thermal-pause state (FR-077), history (≥ 500 jobs). | Telemetry refresh ≤ 1 s over Wi-Fi/USB, ≤ 5 s over BLE. | P0 | DVT |
| FR-064 | Signed OTA firmware updates (A/B, RAUC-class) for SoC and EC firmware only (no modem firmware in v0.2), delivered via app or direct download; automatic rollback on boot failure. | 50 update cycles incl. 10 power-cut-mid-update: 100 % boot to a valid slot. | P0 | DVT |
| FR-065 | Job location from the app (D13; no on-device GNSS): the phone app shall be able to send the phone's location — latitude, longitude, altitude, horizontal accuracy, timestamp, source — over BLE (EC GATT "Job Location" characteristic: vendor UUID, write-with-response, bonded/encrypted link; EC forwards to the SoC job DB) or over the Wi-Fi / USB-NCM management API, at job start or on request. The location is stored in job metadata and written to the upload manifest / sidecar (FR-008). A job shall proceed normally if no location is available. | Location present in the manifest of a job started from the app within 2 s of job start (BLE and NCM transports); a job started without the app, or with location denied on the phone, completes with the location field absent and no error. | P1 | DVT (firmware) |
7. Functional requirements — power and job persistence
| ID | Requirement | Acceptance / target | Pri | Verify |
|---|---|---|---|---|
| FR-070 | The job manager shall persist queue state (job list, per-file/per-chunk progress, endpoint handles such as S3 upload IDs) to power-fail-safe storage after every chunk. | Power cut (battery disconnect at pack) at random points 200×: on restore, every job resumes with ≤ 1 chunk lost; job DB never corrupt. | P0 | EVT |
| FR-071 | At 5 % SoC (or gauge-estimated < 8 min runtime at current load) the device shall enter graceful pause: finish/abandon in-flight chunks, flush job DB, unmount all media cleanly, power-gate slots, notify app, then power down the SoC. EC hard-off at 3 %. | Sequence completes ≤ 30 s; media byte-identical after (FR-003). | P0 | EVT |
| FR-072 | When external power is restored (or battery recharged above 10 %) the device shall boot and auto-resume all paused jobs without user action. | Resume within 60 s of power restore. | P0 | EVT |
| FR-073 | Battery health and runtime estimates (state of health %, cycle count, full-charge capacity, estimated runtime at current load) shall be exposed to the app and shown on the OLED. | Runtime estimate error ≤ 15 % over a full discharge in each mode of ADR §6.2. | P1 | DVT |
| FR-074 | The device shall charge and run simultaneously from USB-C PD on Port A (5–20 V, up to 65 W; 100 W sources tolerated) — and from Port C on the Pro SKU (FR-050, Port A priority) — and shall run indefinitely from a ≥ 45 W source in any mode. | With 65 W source, battery charges at ≥ 30 W while device sustains Ethernet-5GbE upload (14.9 W, ADR §6.2). | P0 | EVT |
| FR-075 | Power-button behaviours: short press = wake/OLED; long press (3 s) = graceful power off (FR-071 sequence); very long press (12 s) = EC hard reset. Card insertion, Port A/C attach or the thermal auto-resume condition (FR-077) wakes the device from standby. | All transitions verified; wake-from-standby to card mounted ≤ 25 s. | P0 | EVT |
| FR-076 | Standby power (SoC off, EC + BLE advertising, OLED off) ≤ 0.12 W. | Measured at pack terminals over 24 h. | P1 | EVT |
| FR-077 | Thermal safety rule (D2, firmware only; replaces the v0.2 in-bag heuristic): if skin ≥ 52 °C, internal air ≥ 60 °C, battery ≥ 55 °C or any component limit is crossed (e.g. the device is packed away mid-job), the EC shall request the job engine to checkpoint every job (finish the current part, persist offsets — FR-004/FR-070), the SoC shall unmount and power-gate all slots and radios, and the device shall enter standby with the OLED showing "Too hot — paused, will resume"; the app is notified over BLE. The EC keeps sampling and auto-resumes (wakes the SoC, remounts, resumes from checkpoints) when skin ≤ 42 °C and internal air ≤ 45 °C, provided the link and cards are still present. Sits above the NFR-032 throttle ladder; the independent 48 °C mechanical thermal switch remains the hardware backstop. | Shutter closed and the device wrapped in insulation mid-5GbE-upload at 25 °C ambient: the device pauses before skin reaches 52 °C or internal air 60 °C (thermocouple map); the OLED message and BLE notification appear; after unwrapping in 25 °C free air the upload resumes automatically within 5 min of the cool-down thresholds being met, with zero data loss (≤ 1 re-sent chunk per job, manifest complete, card byte-identical — FR-003). 20 trials. | P0 | DVT |
8. Functional requirements — display, indication, controls
| ID | Requirement | Acceptance / target | Pri | Verify |
|---|---|---|---|---|
| FR-080 | A 2.42" 128×64 monochrome OLED driven by the EC shall show: mode line, per-slot status/progress, active link + signal, battery % and runtime estimate, and any blocking condition (no endpoint assigned, no link, data cap reached, over-temperature, thermal pause "Too hot — paused, will resume" — FR-077). Works with the SoC off (battery, "hold to power on"). | Readable at 0.5 m in 1 000 lux ambient; auto-dim after 30 s, off after 2 min, wake on button. | P0 | EVT |
| FR-081 | A 5-segment RGB LED bar on the front top edge (one segment per slot) shall encode: blue = host/reader mode, pulsing green = uploading, solid green = complete & verified, amber = paused/waiting, red = error; visible with shutter closed; brightness auto-adjusts; "stealth" mode dims to minimum. | Colour-blind-safe pattern (pulse rate differs per state) verified; visible at 3 m in daylight. | P0 | EVT |
| FR-082 | Physical controls: one sealed power/action button, one recessed reset (pin). No other buttons. | Operable with gloves; IP54 maintained. | P0 | DVT |
9. Functional requirements — modularity and future-proofing
| ID | Requirement | Acceptance / target | Pri | Verify |
|---|---|---|---|---|
| FR-090 | Deleted in v0.2. The v0.1 requirement for an M.2 Key-B 3052 cellular-modem module is withdrawn with the removal of the built-in modem (ADR §14). Number retained so that earlier cross-references resolve; pcie2x1l0 becomes a spare lane (FR-094). |
— | — | — |
| FR-091 | Wi-Fi shall be an M.2 Key-E 2230 module with PCIe ×1 and USB 2.0 wired and two MHF4 feeds; MT7925 primary, QCNCM865 alternate. | Both modules enumerate and pass FR-027. | P0 | EVT |
| FR-092 | An M.2 M-key 2280 NVMe socket (PCIe Gen3 ×2) shall be present on all main boards, unpopulated on the base SKU, with no measurable effect on base-SKU performance, power, or cost beyond the connector (≈ $1). | Base SKU with socket empty: idle power within 0.05 W of a board with the socket unfitted. | P0 | EVT |
| FR-093 | The card-reader function shall live on an internal daughterboard connected by a high-speed mezzanine (Samtec ADM6/ADF6 class) carrying CFe B Gen3 ×2 + REFCLK, CFe A Gen3 ×1, three Gen3 ×1 lanes, control, and ≥ 6 A of 3.3 V, so that slot mix changes (no-CFast, dual CFe B, future SD Express) are a daughterboard-only change. | Mezzanine passes Gen3 eye-mask with ≥ 20 % margin; a second daughterboard variant (no CFast) boots on the same main board. | P1 | EVT |
| FR-094 | Two spare PCIe Gen2 ×1 lanes (pcie2x1l0, pcie2x1l2) and one spare USB 3 (5 Gbps) port shall be brought to internal test headers (future daughterboard attach points). |
Present on schematic and populated on EVT/DVT boards. | P2 | EVT |
10. Non-functional requirements — performance
| ID | Requirement | Acceptance / target | Pri | Verify |
|---|---|---|---|---|
| NFR-010 | Ethernet upload throughput: ≥ 480 MB/s sustained to S3 (multipart, TLS 1.3, per-part SHA-256) from a CFexpress B card over a 5GBASE-T link to a LAN MinIO/S3 target. | 100 GB transfer, 5-min rolling average ≥ 480 MB/s; CPU ≤ 60 % aggregate. | P0 | EVT |
| NFR-011 | Ethernet at 2.5G / 1G links: ≥ 280 MB/s / ≥ 110 MB/s (link-limited). | Same test at each negotiated speed. | P0 | EVT |
| NFR-012 | Wi-Fi 7 upload: ≥ 200 MB/s at 3 m line-of-sight to a Wi-Fi 7 2×2 160 MHz AP on 6 GHz; ≥ 60 MB/s to a typical Wi-Fi 6 80 MHz AP at 10 m through one wall. | 20 GB transfer each. | P1 | EVT |
| NFR-013 | Tethered / hotspot upload: over a USB-tethered phone on Port B, or over Wi-Fi STA to the same phone's hotspot, the device shall achieve ≥ 90 % of the uplink throughput the phone itself measures (its own speed-test app, same spot, same moment) — i.e., the device and the USB/Wi-Fi hop are not the bottleneck; the phone's cellular uplink is. | Five locations × two phones (iPhone, Android) × USB tether and hotspot, iperf3 to a cloud host vs. the phone's speed test. | P0 | DVT |
| NFR-014 | Internal card read rates (sequential, 1 MB QD8): CFe B ≥ 1.6 GB/s; CFe A ≥ 850 MB/s; SD UHS-II ≥ 280 MB/s (V90); microSD ≥ 90 MB/s (UHS-I SDR104); CFast 2.0 ≥ 480 MB/s (SATA III, card-limited; ASM1064 on a Gen3 ×1 switch port); USB SSD ≥ 850 MB/s. | fio on the block device; three card vendors each. |
P0 | PoC |
| NFR-015 | Host reader, Path 1: CFe B ≥ 2.8 GB/s to a USB4 Mac/PC; ≥ 900 MB/s to a USB 3.2 Gen2 host (iPhone 15 Pro, older Macs). | Blackmagic Disk Speed Test / dd 10 GB. |
P0 (Pro) | PoC |
| NFR-016 | Host reader, Path 2: ≥ 380 MB/s any slot to a USB 3.x host (SoC gadget, 5 Gbps); ≥ 38 MB/s to a USB 2.0 host (iPhone non-Pro). Sufficient for app-driven cloud upload through the host, whose internet link is the bottleneck (D7, 03-datapath-bottlenecks.md §4.2). |
Same test. | P0 | PoC |
| NFR-017 | Concurrency: two slots uploading simultaneously to different endpoints over Ethernet shall together reach ≥ 480 MB/s; five slots simultaneously shall not fall below 90 % of the single-slot aggregate. | 5-slot test with rate-limited endpoints. | P1 | EVT |
| NFR-018 | Hash/crypto budget: TLS 1.3 (AES-128-GCM) plus SHA-256 plus xxHash64 at 500 MB/s shall consume ≤ 2 of 4 Cortex-A76 cores; A55 cores reserved for I/O and management. | perf during NFR-010. |
P0 | PoC |
| NFR-019 | Boot to "ready to mount" from cold ≤ 20 s; from standby ≤ 8 s (EC-triggered wake). | Stopwatch from button press to card-detect service active. | P1 | EVT |
11. Non-functional requirements — power and energy
| ID | Requirement | Acceptance / target | Pri | Verify |
|---|---|---|---|---|
| NFR-020 | Battery: 2S2P 21700 Li-ion NMC, 7.2 V nominal, 10 Ah, 72 Wh nominal, ≤ 100 Wh (airline carry-on without approval). | Pack label and UN 38.3 report. | P0 | DVT |
| NFR-021 | Runtime on a new pack at 25 °C (usable 65 Wh), continuous operation, per ADR §6.2: Ethernet 5GbE upload ≥ 4.2 h; Ethernet 1GbE ≥ 5.9 h; Wi-Fi upload (~80 MB/s) ≥ 6.2 h; Wi-Fi upload via phone hotspot ≥ 7.9 h; upload via USB-tethered phone with 1.5 A phone charging ≥ 3.9 h (≥ 6.0 h at the 0.5 A setting); Host USB4 ≥ 6.0 h (not battery-limited when a Mac powers the device on Port C — FR-050, Pro); Host gadget ≥ 7.1 h; idle awake ≥ 16 h; standby ≥ 20 days. The Port B 3 A setting is available only with external PD present (FR-031) and is therefore not a battery-runtime case. | Full-discharge test in each mode; targets are ≈ 95 % of ADR computed values to allow measurement tolerance. | P0 | DVT |
| NFR-022 | Peak system draw (all loads at ADR §6.1 peak simultaneously ≈ 28 W for ms; v0.1 was ~40 W with the modem burst) shall be within pack (≥ 2C continuous = 20 A) and rail capability without brown-out. | Rail droop ≤ 3 % during a Port B VBUS 0→3 A step (tethered phone starting to charge) superimposed on CFe B 5 W peak and ASM2464PD power-up; also during a Port A ↔ Port C input hand-over on the VBUS priority mux (Pro, FR-050). | P0 | EVT |
| NFR-023 | Charge: 0→80 % ≤ 1.7 h, 0→100 % ≤ 2.5 h from a 65 W PD source at 25 °C, device idle; JEITA-compliant derating; no charge below 0 °C or above 45 °C cell temperature. | Logged charge curve. | P0 | EVT |
| NFR-024 | DC/DC conversion efficiency ≥ 88 % at typical loads (5–15 W system), ≥ 85 % at 2 W. | Bench measurement of VBAT-in vs Σ rail-out. | P1 | EVT |
| NFR-025 | Pack cycle life ≥ 500 cycles to 80 % SOH at the charge profile of NFR-023. | Accelerated cycling on 3 packs (vendor data acceptable at DVT). | P1 | PVT |
12. Non-functional requirements — thermal
| ID | Requirement | Acceptance / target | Pri | Verify |
|---|---|---|---|---|
| NFR-030 | Passive thermal design (magnesium AZ91D chassis, desk, free air — A12): at 25 °C ambient the device sustains ≥ 10.0 W (shutter closed) / ≥ 9.5 W (shutter open, slats parked over the rear face) dissipation indefinitely with no external skin above 48 °C (metal) / 55 °C (plastic). At 35 °C ambient, ≥ 5.7 W / ≥ 5.4 W. Figures per ADR §2/§6.2 (G ≈ 0.44 / 0.41 W/K) — (verify) at EVT on magnesium units; machined-AZ31B EVT data must be corrected to AZ91D (k ≈ 96 vs ≈ 72 W/m·K) before the requirement is closed. | Thermocouple map, steady state after 2 h, lying flat and standing on the bottom edge, shutter closed and open. | P0 | EVT |
| NFR-031 | A 15-minute burst at 14.9 W (Ethernet 5GbE upload, one 512 GB card, battery draw per ADR §6.2) starting from 25 °C shall not trip throttling (thermal mass ≈ 500 J/K with the Mg chassis carries the burst; model: ~17 min to 48 °C skin, burst-end skin ≈ 45 °C — verify); from 35 °C ambient the burst shall run ≥ 8 min before throttling (model ~9 min). These are gate criterion (a) of the EVT-exit fan decision (ADR §12, D5). | Skin ≤ 48 °C at 15 min from 25 °C; ≥ 8 min to first throttle from 35 °C; shutter closed and open. | P0 | EVT |
| NFR-032 | Throttle policy (EC-enforced, SoC-cooperative): skin sensor > 46 °C → cap Ethernet to 2.5G; > 48 °C → cap to 1G, pause NVMe copy; CFe card SMART temp > 70 °C → pause that slot; SoC > 85 °C → DVFS cap; any sensor > 95 °C → graceful pause (FR-071). Never a hard shutdown while media is mounted unless > 105 °C. The thermal safety rule (FR-077: skin ≥ 52 °C / air ≥ 60 °C / battery ≥ 55 °C → checkpoint, standby, auto-resume) sits above this ladder. | Each threshold exercised in a thermal chamber; hysteresis 3 °C; no oscillation; ladder and FR-077 thresholds do not interact (no pause before the ladder has acted, except when the device is insulated). | P0 | EVT |
| NFR-033 | Card-slot temperature: CFexpress B card body ≤ 70 °C during a 30-min sustained read at 25 °C ambient (thermal pad from cage to chassis). | SMART temperature log. | P0 | EVT |
| NFR-034 | Deleted in v0.2 (modem case-temperature limit; no modem). Number retained. | — | — | — |
13. Non-functional requirements — reliability, life, serviceability
| ID | Requirement | Acceptance / target | Pri | Verify |
|---|---|---|---|---|
| NFR-040 | Shutter mechanism life ≥ 10 000 open/close cycles with detents, seal, and Hall detection still within spec. | Automated cycler; seal leak test at 0 / 5 000 / 10 000 cycles. | P0 | DVT |
| NFR-041 | Card connector life: CFe B/A ≥ 10 000 insertions, SD/microSD ≥ 10 000, CFast ≥ 5 000 (connector-limited). | Vendor data + 1 000-cycle sample test. | P0 | DVT |
| NFR-042 | USB-C receptacles ≥ 10 000 insertions; RJ45 ≥ 750 (standard). | Vendor data. | P1 | DVT |
| NFR-043 | Battery pack replaceable by a service centre (not user) in ≤ 15 min with standard tools; no adhesive on cells. | Service procedure demonstrated. | P1 | DVT |
| NFR-044 | MTBF ≥ 50 000 h at 25 °C (Telcordia SR-332 parts-count). | Calculation at DVT. | P2 | DVT |
| NFR-045 | Key silicon (SoM, switch, USB4 bridge, Wi-Fi module) shall have vendor-stated availability ≥ 5 years from PVT, or a qualified second source. | Vendor letters / lifecycle statements. | P1 | EVT |
14. Interface requirements
| ID | Requirement | Acceptance / target | Pri | Verify |
|---|---|---|---|---|
| IF-001 | CFexpress Type B slot: CFexpress 2.0/4.0 cards; PCIe Gen3 ×2 to SoC (standalone) or Gen4 ×2 to USB4 bridge (Path 1, Pro); 3.3 V ≥ 2.5 A with eFuse; deep-insertion push-push, card top ≥ 1 mm below shutter plane. | Card list: Sony Tough G/M, ProGrade Cobalt/Gold, Lexar Diamond/Gold, Angelbird AV Pro SE/XT, Delkin Black/Power, SanDisk Pro-Cinema, Nikon MC-CF660G. | P0 | PoC |
| IF-002 | CFexpress Type A slot: CFexpress 2.0/4.0 Type A; PCIe Gen3 ×1; 3.3 V ≥ 1.5 A. | Sony Tough CEA-G/M, ProGrade Type A, Lexar Type A, Nextorage. | P0 | PoC |
| IF-003 | SD slot: SD/SDHC/SDXC/SDUC, UHS-I (SDR104) and UHS-II (FD156/HD312); no UHS-III/SD Express host mode (SD Express cards fall back to UHS-I); 3.3 V/1.8 V signalling; Genesys GL9755. | V90 cards (Sony Tough SF-G, ProGrade V90, Lexar 2000x, Angelbird V90) at ≥ 280 MB/s; SD Express card falls back and works. | P0 | PoC |
| IF-004 | microSD slot: microSD/SDHC/SDXC UHS-I SDR104; Genesys GL9750. | ≥ 90 MB/s on SanDisk Extreme Pro, Samsung Pro Plus. | P0 | PoC |
| IF-005 | CFast 2.0 slot: SATA III (6 Gb/s) via ASMedia ASM1064 AHCI on a Gen3 ×1 switch port (985 MB/s, not limiting); 3.3 V ≥ 1.2 A; card-limited at ≈ 480–550 MB/s. | SanDisk Extreme Pro CFast, Angelbird AV Pro CF, Lexar 3600x; ARRI-formatted (UDF/exFAT) Alexa Mini cards mount read-only. | P0 | PoC |
| IF-006 | Non-NVMe PCIe device in the CFexpress B slot (an XQD card is physically insertable; XQD is unsupported, unlicensed and unmarketed — D10): the device shall detect that the enumerated device is not an NVMe controller, power the slot down, and show "XQD not supported" (UX-011). No XQD functional support, no USB-reader workaround; XQD appears in no supported-media list or product copy. | Non-NVMe PCIe card inserted 100× — no damage to card or slot; slot powered down ≤ 2 s after enumeration; message shown on OLED and in app. | P1 | EVT |
| IF-007 | Port A USB-C: USB 3.2 Gen1 (5 Gbps) UFP presenting read-only LUNs by default (FR-045); USB PD 3.1 sink 5–20 V ≤ 5 A (100 W tolerated, 65 W used), priority input to the charger (FR-050); optional PD source 5 V/1.5 A; DisplayPort Alt Mode not supported; IP67-rated sealed receptacle. | PD compliance pre-scan; sink from 18/30/45/65/100 W chargers and a MacBook; UFP enumerates on Mac/Win/iPhone. | P0 | EVT |
| IF-008 | Port B USB-C "SSD · TETHER": USB 3.2 Gen2 (10 Gbps) DFP host via ASM3142; 5 V source with a user-set 0.5 / 1.5 / 3 A limit (Type-C current advertisement, no PD required; FR-030); accepts UAS/BOT SSDs or a USB network-class device (tethered phone / USB cellular adapter, FR-026); IP67 receptacle. | Enumerates UAS SSDs at ≥ 850 MB/s; enumerates iPhone, Android and MBIM/QMI adapters as network interfaces. | P1 | EVT |
| IF-009 | Port C USB-C (Pro SKU only; depopulated on Base with receptacle fitted and blanked — D7): USB4 Gen3 ×2 (40 Gbps) device with Thunderbolt 3 compatibility and USB 3.2 Gen2 fallback, via ASM2464PD; CFe B presented read-only by default (FR-045-A); PD sink (FR-050): Port C PD sink controller (TPS25750 class) + TPS2121-class priority power mux OR-ing Port C VBUS with Port A VBUS into the BQ25792 input, Port A priority, 5–20 V ≤ 3.25 A (verify mux rating at 65 W); IP67 receptacle. | Enumerates on Apple M-series (USB4), Intel TB4 PC, iPhone 15 Pro (USB 3.2 Gen2); device runs from the Mac's VBUS (FR-050); no USB4 logo claimed unless certified. | P0 (Pro) | PoC |
| IF-010 | Ethernet RJ45: 5GBASE-T/2.5GBASE-T/1000BASE-T/100BASE-TX auto-negotiation (RTL8126 — final, D6; no 10GBASE-T footprint option), Auto-MDIX, EEE; magnetics rated for 5GBASE-T; behind hinged silicone door; jack shell bonded to the chassis via a masked conversion-coated land (ENV-014). | Links at all four speeds on Cat 5e (1GbE/2.5GbE, 30 m), Cat 6 (5GbE, 30 m), Cat 6A (5GbE, 100 m). | P0 | EVT |
| IF-011 | Deleted in v0.2 (nano-SIM tray and MFF2 eUICC; no modem, no SIM aperture in the enclosure — ADR §3.4). Number retained. | — | — | — |
| IF-012 | Antennas: 2× Wi-Fi 2.4/5/6 GHz flex in the front-frame upper band (2× MHF4 feeds from the M.2 Key-E module), 1× BLE 2.4 GHz chip antenna on the EC; three antennas total, no cellular antennas; see 07-rf-antenna.md. |
Passive efficiency ≥ 50 % in-enclosure at 2.4/5/6 GHz; TRP/TIS within 3 dB of module reference. | P0 | EVT |
| IF-013 | Internal M.2 sockets: Key-E 2230 (Wi-Fi, PCIe + USB 2.0) and M-key 2280 (NVMe, PCIe Gen3 ×2) only; no Key-B socket in v0.2. | Mechanical fit + enumeration. | P0 | EVT |
| IF-014 | Debug: UART console + SWD (EC) + JTAG (SoC) on internal headers, disabled by fuse/config at PVT (SAF-030). | Present through DVT; fused at PVT. | P0 | PVT |
15. Safety and security requirements
| ID | Requirement | Acceptance / target | Pri | Verify |
|---|---|---|---|---|
| SAF-010 | Secure boot on the SoC: OTP-fused root-of-trust hash → signed SPL/TF-A/OP-TEE → FIT-verified U-Boot and kernel → dm-verity root filesystem. Unsigned or modified images do not boot. | Modified kernel/rootfs blocked; anti-rollback counter enforced. | P0 | DVT |
| SAF-011 | EC secure boot (MCUboot, signed images) and encrypted BLE bonding keys in nRF5340 secure domain. | Unsigned EC image rejected. | P0 | DVT |
| SAF-012 | TPM 2.0 (Infineon SLB9672): LUKS2 data-partition key sealed to boot-state PCRs; device identity ECC P-256 key non-exportable; used for mTLS to app and OTA server. | Data partition unreadable with modified boot chain; key attestation to app succeeds. | P0 | DVT |
| SAF-013 | All user data at rest (endpoint credentials, OAuth tokens, job DB, manifests, logs) shall reside on the LUKS2 encrypted partition. Cards are never written (FR-003); NVMe buffer (Pro) is encrypted with a per-boot ephemeral key unless "quick copy retain" is enabled, in which case it is LUKS2 under the TPM-sealed key. | Forensic image of eMMC/NVMe yields no plaintext user data. | P0 | DVT |
| SAF-014 | OTA images for SoC and EC shall be signed (Ed25519 or ECDSA P-256), verified offline before installation, with anti-rollback and A/B fallback (FR-064). | Tampered bundle rejected; downgrade rejected. | P0 | DVT |
| SAF-015 | App-to-device API shall use mutually authenticated TLS 1.3 over every transport (BLE via GATT-tunnelled TLS or equivalent authenticated-encryption channel). | Passive sniff and replay tests fail. | P0 | DVT (firmware) |
| SAF-016 | Credentials shall never be exposed via the host-connected USB mass-storage path or logs. | LUN content = card blocks only. | P0 | EVT |
| SAF-030 | Debug interfaces (SoC JTAG, UART console, EC SWD) shall be permanently disabled by OTP fuse/APPROTECT on production units; test points retained for factory use pre-fusing. | Attempt to attach debugger fails on PVT units. | P0 | PVT |
| SAF-040 | Battery safety: cell-level protector (BQ40Z50-R2) + secondary protector (BQ294xx) + fuse; over-charge, over-discharge, over-current, short, over-temperature protection; charge inhibited outside 0–45 °C; pack compliant with IEC 62133-2 and UN 38.3. | Pack test reports. | P0 | DVT |
| SAF-041 | Product electrical safety to IEC/UL 62368-1 (ES1/PS2 classification; no hazardous voltages; touch temperatures per NFR-030). | Pre-compliance at DVT, full at PVT. | P0 | PVT |
| SAF-050 | The device shall not damage cards under any power sequence: slot power applied only after card detect debounce (50 ms), removed cleanly before re-routing, with eFuse current limit and reverse-current blocking. | 10 000 automated insert/remove cycles with a live card; card passes vendor diagnostic after. | P0 | EVT |
| SAF-060 | Wireless coexistence: no wireless emission shall cause data corruption on any card interface (verified as bit-error-free reads during max-power Wi-Fi + BLE TX, with a tethered phone transmitting on Port B). | 1 TB read with all radios at max TX, zero CRC/ECC errors. | P0 | EVT |
| SAF-070 | Power-loss hold-up: with battery always in circuit, unplugging USB-PD at any load shall cause no reset (NVDC path + bulk capacitance). | 1 000 hot-unplugs at 15 W load: 0 resets. | P0 | EVT |
16. Environmental and mechanical requirements
| ID | Requirement | Acceptance / target | Pri | Verify |
|---|---|---|---|---|
| ENV-001 | External dimensions 190 × 96 × 38 mm (±3 mm), including bumpers, shutter closed. | CMM on DVT units. | P0 | DVT |
| ENV-002 | Mass ≤ 850 g target, ~828 g nominal (bottom-up, AZ91D magnesium die-cast chassis with 1.6 mm walls — D4, verify); machined-AZ31B EVT/DVT units ≈ 830–840 g (verify); Base SKU with battery. An aluminum chassis (~935 g) is no longer planned. | Scale; DVT (Mg thixomold/T0 die-cast) and PVT units. | P0 | DVT |
| ENV-003 | Drop: MIL-STD-810H Method 516.8 Procedure IV (transit drop), 1.22 m onto 5 cm plywood over concrete, 26 drops (6 faces, 12 edges, 8 corners), shutter closed, cards inserted, device operating; fully functional after with no card data loss; cosmetic damage allowed. | 5 samples at DVT, 3 at PVT. | P0 | DVT |
| ENV-004 | Ingress: IP54 (IEC 60529) with shutter closed and RJ45 door closed; IP52 with shutter open. USB-C receptacles sealed to IP67 individually (no SIM tray in v0.2). | Dust chamber + spray test. | P0 | DVT |
| ENV-005 | Operating temperature −10 °C to +40 °C full performance; −20 °C to +50 °C with throttling; charging 0–45 °C (cell). Storage −20 °C to +60 °C (Li-ion limit). | Chamber test in each mode. | P0 | DVT |
| ENV-006 | Humidity: 95 % RH non-condensing at 40 °C, 48 h operating (MIL-STD-810H Method 507.6 abbreviated). | No functional degradation. | P1 | DVT |
| ENV-007 | Vibration: MIL-STD-810H Method 514.8, Category 4 (common carrier truck), 1 h/axis, operating with cards inserted; no data errors, no connector unseating. | Test lab. | P1 | DVT |
| ENV-008 | Altitude: operate to 4 500 m; transport to 12 000 m unpressurised (battery vent, sealed enclosure pressure relief via PTFE vent membrane). | Chamber. | P1 | DVT |
| ENV-009 | Sliding shutter: two-slat hard-anodized 6061 aluminum roll-top (approved unchanged, D11), front-to-rear travel ≈ 40 mm, detented at both ends, Hall-sensed closed state, silicone wiper + brush seals, drainage; one-handed operation with gloves; force 4–8 N. | Force gauge; cycle test NFR-040. | P0 | DVT |
| ENV-010 | Card slots recessed so that inserted cards sit ≥ 1 mm below the shutter plane; shutter cannot be closed onto a partially inserted card (mechanical interlock or 6 mm recess geometry). | Gauge test with all card types. | P0 | EVT |
| ENV-011 | Ports and RJ45 shall be strain-resistant: connector shells anchored to the magnesium chassis through inserts (not the PCB alone, no tapped Mg — ENV-014); withstand 40 N side-load on an inserted cable for 1 min, 10 000 mating cycles (USB-C), without loss of function. | Pull/side-load test. | P0 | DVT |
| ENV-012 | Enclosure materials (D4): magnesium chassis-heatsink — AZ91D hot-chamber die-cast at production (walls 1.6 mm, draft ≥ 1°, inserts for all threads, boss faces machined to 0.10 mm flatness), machined AZ31B or thixomolded AZ91D for EVT/DVT; coating: chromate-free conversion coat (Gardobond X 4707 / Alodine 5200 class) over the whole casting + light matte grey powder coat or e-coat 40–60 µm on all external surfaces (ε ≈ 0.9, solar load), with masked bare-conversion pads at the SoM/ASM2812/RTL8126 gap-pad bosses and EMI-gasket lands; PEO (Keronite/Tagnite class) as the alternate for a later salt-fog claim. PC+30 % GF front frame with RF windows; TPU Shore 80A overmold bumpers; hard-anodized 6061 aluminum shutter slats (ENV-009). UV-stable, no sharp edges, matte low-glare finish; withstands common set chemicals (isopropanol, sunscreen, DEET). All material data (verify against supplier datasheets). | Material data sheets + chemical wipe test; coating thickness map on DVT castings (40–60 µm outside, ≤ 2 µm on masked pads). | P1 | DVT |
| ENV-013 | Chassis EMI/ESD: ±8 kV contact / ±15 kV air (IEC 61000-4-2) on all external surfaces and ports without data loss. | EMC lab. | P0 | DVT |
| ENV-014 | Galvanic isolation and corrosion (magnesium chassis, D4): magnesium is anodic to every other metal in the assembly. Fasteners shall be zinc-nickel-plated steel or Al 5056/6061 with aluminum washers in coated pockets; thread inserts aluminum or zinc-nickel-coated (no stainless helicoils, no tapped Mg); stainless detent balls/springs only in POM housings; the anodized aluminum shutter slats shall never touch the chassis (POM tracks, silicone seals); conductive EMI gaskets and the RJ45 shell bond only on masked conversion-coated lands. | 500 h neutral salt fog (ASTM B117 / ISO 9227) on coated AZ91D/AZ31B coupons including fastener-, insert- and gasket-pair coupons at EVT (verify): no white corrosion at coated surfaces, no red rust on fasteners, EMI-land contact resistance within spec after test; DVT unit inspection after ENV-006 humidity. | P1 | EVT |
17. UX-level hardware requirements
| ID | Requirement | Acceptance / target | Pri | Verify |
|---|---|---|---|---|
| UX-010 | A user shall be able to tell, from the LED bar alone and with the shutter closed, whether each card is uploading, done, waiting, or in error, and whether the device is in reader mode. | Usability test with 10 target users, ≥ 90 % correct identification. | P0 | DVT |
| UX-011 | The OLED shall show, without app, the reason the device is not uploading ("No link", "No endpoint for Slot 2", "Metered-link cap reached", "Tethering: unlock phone / trust this device", "Port B: phone tethered — SSD not available", "Too hot — cooling" (throttle ladder), "Too hot — paused, will resume" (FR-077), "XQD not supported" (IF-006), "Mac wants write access to CFe B — allow?" (FR-045-A), "Reader mode: iPhone (RO)", "Reader mode: USB4 Mac (RO)"). | Message catalogue reviewed. | P0 | DVT |
| UX-020 | Mode switching shall require no button presses: plugging a host into Port A or Port C is sufficient; unplugging returns to standalone. | Task success ≥ 95 %. | P0 | EVT |
| UX-021 | The OLED shall confirm the mode within 1 s of cable insertion and shall show "Safe to remove" per slot once the job engine has released a card (host mode entry, job completion, graceful pause). | Timing test. | P0 | EVT |
| UX-030 | A card removed mid-upload shall not be treated as an error; the job pauses with an amber indication and resumes on re-insertion (FR-009). | Behaviour test. | P0 | EVT |
| UX-031 | Opt-in setting "Share cards while uploading" (concurrent read-only host access on Path 2; default is pause — D9) shall be off by default and clearly labelled. | Setting present; default verified. | P2 | DVT |
| UX-040 | Ports shall be labelled by function on the enclosure: "CHARGE · PHONE", "SSD · TETHER", "USB4 CFexpress FAST" (Pro only), with distinct icons; tactile difference for the CFexpress FAST port (raised ring). | Blind-identification test. | P1 | DVT |
| UX-050 | Device operable and legible one-handed while wearing thin gloves; no operation requires the app for basic upload (insert card → upload to the slot's default endpoint). | Usability test. | P0 | DVT |
18. Regulatory and compliance requirements
| ID | Requirement | Acceptance / target | Pri | Verify |
|---|---|---|---|---|
| REG-001 | FCC Part 15B (unintentional radiator), Part 15C (Wi-Fi/BLE, via module modular grants with permissive-change antenna review); SAR evaluation as a portable device (Wi-Fi bands only). No licensed-band (Parts 22/24/27/90/96) filings — there is no built-in transmitter in those bands. | Grants / DoC. | P0 | PVT |
| REG-002 | ISED Canada (RSS-Gen, RSS-247, RSS-102, ICES-003) and CE RED 2014/53/EU (EN 300 328, EN 301 893, EN 303 687, EN 301 489-x, EN 18031-1/-2, EN 62368-1, EN 62311/EN 50566), UKCA. No cellular (RSS-130/132/133/139/199, EN 301 908-x) standards apply. | Certificates. | P0 | PVT |
| REG-003 | No cellular industry or carrier certification applies (no built-in modem): PTCRB, GCF and operator approval programmes are out of scope; the tethered phone or USB cellular adapter carries its own. The device shall not claim any cellular capability of its own on labels or packaging. | Certification plan in 11-certification.md contains no cellular programme; marketing copy reviewed. |
P1 | DVT |
| REG-004 | Battery: UN 38.3 transport tests on the pack; IEC 62133-2 pack safety; ≤ 100 Wh marking for air travel; cells with existing UN 38.3 and IEC 62133-2 reports. | Test reports. | P0 | DVT |
| REG-005 | Product safety: IEC/UL 62368-1 (CB scheme), RoHS, REACH, WEEE, California Prop 65 labelling, EU battery regulation (2023/1542) marking and removability-by-professional. | Reports. | P0 | PVT |
| REG-006 | Trademark/logo compliance: CompactFlash Association membership for "CFexpress" mark; SD Association membership for SD/UHS-II logos; USB-IF membership and, if the logo is used, USB4 certification; no Thunderbolt branding unless Intel-certified. | Memberships in place before packaging design freeze. | P1 | DVT |
| REG-007 | Environmental test evidence for MIL-STD-810H Methods 516.8 (drop), 514.8 (vibration), 507.6 (humidity), 501.7/502.7 (high/low temp) from an accredited lab; IP54 per IEC 60529. | Reports. | P0 | DVT |
| REG-008 | Population variants (D7): Base regulatory testing (REG-001/002/005) covers the Base population (no ASM2464PD, no Port C PD sink). The Pro USB4 path is a later population variant with its own FCC Part 15B SDoC and CE RED addendum (radiated emissions with the USB4 link active; Wi-Fi/BLE grants unchanged), filed after Base and without gating the Base launch (FR-051). | Base DoC/grants reference Base-population samples; Pro addendum test plan in 11-certification.md; Port C absent (blanked) on Base test samples. |
P1 (Pro) | PVT |
19. Traceability notes
- Throughput numbers (NFR-010…018) are derived in
03-datapath-bottlenecks.md. - Power and runtime numbers (NFR-020…025) are derived in
05-power-budget.mdand ADR §6. - Thermal limits (NFR-030…033, magnesium figures) and the thermal safety rule FR-077 are derived in
06-thermal.md(NFR-034 deleted in v0.2; the v0.2 in-bag heuristic/test is deleted in v0.3 — D2). - Mechanical/environmental (ENV-xxx, incl. the magnesium coating/galvanic requirements ENV-012/014) are elaborated in
08-mechanical.md. - Host-mode read-only enforcement (FR-045/045-A) and the Port C PD sink (FR-050) are detailed in
02-system-architecture.md§4.10 / §6 and04-component-selection.md§(e)/(n). - Regulatory (REG-xxx) cost and schedule are in
11-certification.md. - Verification stages map to
13-roadmap.md. - Open decisions that could change requirements are ADR §13 (v0.3 remaining: SoM/board-down at PoC exit, fan at EVT exit, Port C RO mechanism at PoC, Mg coupon/thermal correction at EVT, target price) and
12-risks-open-questions.md. - v0.3 additions: A12; FR-031, FR-045-A, FR-050, FR-051, FR-065, FR-077; ENV-014; REG-008. Amended: A2, A4, A8, A10, FR-008, FR-020, FR-030, FR-040…045, FR-063, FR-074, FR-075, FR-080, NFR-016, NFR-021, NFR-022, NFR-030…032, IF-006, IF-007, IF-009, IF-010, ENV-002, ENV-009, ENV-011, ENV-012, UX-011, UX-031.