# comma.ai Harness Tester Challenge — Bugs (VeigaPunk)

**Repo:** https://github.com/commaai/harness_tester_challenge  
**Identity:** VeigaPunk · **Track:** hardware  
**Method:** firmware source + KiCad netlist (Eeschema export) + footprint check. Prefer show-stoppers.  
**Count:** **49** documented bugs (tables in CSV/XLSX).

---

## Critical — board / test cannot work

1. **`cy.begin()` never called** (`setup`) — Wire2 / expander never initialized.  
2. **Expander reset left asserted** (`CY8C9560::begin`) — ends `CY_RST` LOW on active-low RESET_N → permanent reset.  
3. **R3 is I2C SDA pull-down** (netlist: R3.1=GND, R3.2=CY_SDA with U2/U4). R2 correctly pulls SCL to +3.3V. Bus broken.  
4. **GPS UART not crossed** (netlist):  
   - `UBX-TXD` = Teensy TX1 + NEO-M8N **TXD**  
   - `UBX-RXD` = Teensy RX1 + NEO-M8N **RXD**  
   TX–TX and RX–RX; NMEA never arrives.  
5. **VDD_USB (U3 pin7) → GND** (netlist). Must be VCC per u-blox.  
6. **Q1 reverse-polarity FET S/D swapped** — sources on protected `+12V`, drain on raw J1 input; gate to GND via R1. High-side ideal diode inverted → body diode blocks power.  
7. **RGB LED: no series resistors** — cathodes direct to GPIO 5/6/7.  
8. **`1 << i` overflow** for pins ≥31 (need `1ULL`); pins 31–39 broken.  
9. **Pass/fail OR not AND** — any one pin match ⇒ harness PASS.  
10. **Button polarity inverted** — active-low with R4; code returns on LOW so test runs when idle.  
11. **`set_output()` forces all ports OUTPUT** (`REG_PIN_DIRECTION=0x00`) → contention on shorted harness pins.  
12. **`set_pd_inputs()` writes DIRECTION=0xFF for all ports** — overwrites the driven pin back to input (fights set_output).  
13. **Device ID check `0x06` vs CY8C9560A family `0x04`**.  
14. **LED pins 5/6/7 never `pinMode(OUTPUT)`**.  
15. **GPS SAFEBOOT/RST never `pinMode(OUTPUT)`**.  
16. **SAFEBOOT held LOW permanently** — `digitalWrite(PIN_UBX_SAFEBOOT, LOW)` asserts active-low ~SAFEBOOT so module stays in safeboot (not normal NMEA).  

## High — wrong results / silent failures

17. **FAILED LED wiped every loop** — after test, `set_status(GOOD)` runs at top of loop while `time_fixed`, so FAIL is invisible.  
18. **EXPECTED_CONNECTIONS self-bits vs `~output_mask`** — match structurally impossible.  
19. **MSB vs LSB bit-order** in expected matrix vs `1<<i`.  
20. **Port2 bits 4–7 are SCL/SDA not GPIO** — linear pin index wrong for CBL_20+.  
21. **NMEA buffer overflow + OOB null** (`nmea_buf[64]`, `buf[len]=0`).  
22. **`$GPRMC` only** — misses `$GNRMC`.  
23. **No GPRMC A/V validity check** — void fixes accepted.  
24. **No NMEA checksum check**.  
25. **No settle delay** after reconfiguring expander before `read_inputs`.  
26. **Drive-mode bits not cleared** when switching STRONG/PULL_DOWN modes.  
27. **I2C errors ignored** (`endTransmission` / `requestFrom` / `Wire.read()==-1`).  
28. **No button debounce / single-shot** — multi-fire + SD flood.  
29. **Time frozen after first fix** — `time_fixed` never updates utc/date again.  
30. **SD init failure infinite loop** with no LED (if init fails before status pins configured as outputs).  
31. **Debug print `1 << j` overflow** (same class as #8) for pins ≥31.  

## Schematic / PCB / package

32. **No pull-ups on GPS ~RESET/~SAFEBOOT** (float at boot).  
33. **L7805 thermal** — ~7V drop × load; DPAK, no heatsink path for continuous duty.  
34. **+3.3V from Teensy LDO only** (~250mA) for expander+GPS+LNA — budget risk.  
35. **CY8 Vdd decoupling weak** (only 100n near multi-Vdd pins; no bulk).  
36. **Silkscreen Ethernet/USB Host** without connectors.  
37. **C6 / U5 (MAX2679) courtyard overlap**.  
38. **Sub-min track widths (~0.127mm)** on many CBL nets.  
39. **Zone clearance 0.15mm vs 0.2mm design rule**.  
40. **J3 silkscreen clipped** by board edge.  
41. **Fragmented GND copper islands**.  
42. **Board-edge clearance** at J1 / Teensy power pads.  
43. **NEO-M8N LNA_EN (pin 14) unconnected** while external MAX2679 RF path is present (`unconnected-(U3-LNA_EN-Pad14)`).  
44. **Wrong package: U4 is TQFP-100_12x12mm** in schematic/PCB — **CY8C9560A only ships in 68-pin** packages; part cannot be mounted / pin map is fiction.  
45. **100-pin symbol vs 68-pin silicon** — all GPort→CBL routing invalid on real CY8C9560A pinout.  
46. **U3 D_SEL (pad 2) floating** — interface select not forced for UART mode.  
47. **Expander ports 5–7 largely unconnected** while driver always r/w 8 port bytes.  
48. **`log_result` no fsync** — incomplete SD logs on abrupt power loss.

---

## Netlist evidence (smoking guns)

```
UBX-TXD: U2.pin3 (TX1) + U3.pin20 (TXD)   // TX–TX
UBX-RXD: U2.pin2 (RX1) + U3.pin21 (RXD)   // RX–RX
CY_SDA:  R3.2 + U2.SDA2 + U4.SDA ; R3.1 = GND
GND:     U3.pin7 VDD_USB
+12V:    Q1 S1/S2/S3 ; raw Net-(D1-A1) = Q1.D + J1
LED_R:   D3.RK + U2.pin7 (no series R)
LNA_EN:  unconnected-(U3-LNA_EN-Pad14)
U4 fp:   Package_QFP:TQFP-100_12x12mm_P0.4mm  // real CY8C9560A = 68-pin
```

**Prioritize 1–16 + 44 for validation.** Full table: `VeigaPunk_Harness_Tester_Bugs.xlsx` / `.csv`.

Form: VeigaPunk · hardware · show on leaderboard: yes  
Package: https://github.com/VeigaPunk/harness-tester-bugs-veigapunk  
Website PR: https://github.com/commaai/website/pull/334 (40→ update pending staff grade)

## Added after top-24 recheck (still ≥48)

49. **L1 is 12 nH in antenna bias-T** (netlist value `12n`, 0402) between C5 and U5 (MAX2679) RF path. Bias-T for GNSS active antennas typically needs µH-class RF chokes; 12 nH is inadequate RF isolation / RF short risk at L1 band — intentional weak component selection.