I’ll lock the Tier-3 production baseline to Toradex Verdin iMX95 and update the architecture/design/checklist files so the review gates reference that module specifically.
The checklist now requires Verdin-specific gates: exact Verdin iMX95 SKU, Toradex datasheet/carrier guide, Verdin connector footprint and mechanical model, Toradex power requirements, thermal guidance, and confirmation of Ethernet/PTP, TPM, Wi-Fi/BT, and NVMe implementation before schematic capture.
I’ll create a Verdin iMX95 bring-up and procurement checklist from the updated gates, covering documents to obtain, parts to order, first-power validation, secure boot, Ethernet/PTP, NVMe, thermal, and sealed-node tests.
This file translates the user-provided 4-layer i.MX 95 SBC concept into a production-safe architecture for the EcoSynQ Tier-3 Witness Node.
Production baseline: Toradex Verdin iMX95 SoM-based sealed appliance.
Rejected baseline: 4-layer chip-down i.MX 95 with external LPDDR/DDR and high-speed interfaces. That approach is not suitable for production reliability, signal integrity, memory timing, PDN impedance, or thermal validation.
Product Definition
Product: EcoSynQ Tier-3 Witness Node
Processor baseline: NXP i.MX 95 family
Module baseline: Toradex Verdin iMX95
Board style: sealed industrial Verdin carrier or Verdin-integrated SBC
Runtime: deterministic Rust Ring Zero runtime, QTopology daemon, Headscale networking
Primary functions: signed epoch generation, immutable ledger storage, TSN/PTP networking, secure attestation, approved digital ingress
No external GPIO headers in production
No SD card slot in production
Passive cooling only
Target power: 3 W idle class, 12 W sustained maximum class, 15 W USB-C PD input budget
Implementation Strategy
Preferred: Toradex Verdin iMX95 Carrier
Use Toradex Verdin iMX95 to avoid chip-down LPDDR, PMIC sequencing, BGA fanout, and first-spin boot risk. The carrier must follow the Toradex Verdin family connector, pinout, power, mechanical, thermal, and carrier-board design guidance.
Baseline module family:
Toradex Verdin iMX95
Fallback module families, only if Verdin iMX95 fails a requirement:
Toradex SMARC iMX95 or Aquila iMX95
Variscite VAR-SMARC-MX95 or DART-MX95
TRIA SM2S-iMX95
Geniatech i.MX95 OSM
Required vendor files before schematic capture:
Toradex Verdin iMX95 datasheet
Toradex Verdin carrier board design guide
Verdin connector footprint and mechanical models
Verdin reference carrier schematic/layout where available
Thermal model and heatsink guidance
Torizon/Linux BSP documentation
Secure boot and provisioning guide
Lifecycle and availability documentation
Power input, rail tolerance, and sequencing specifications
Deferred: Chip-Down i.MX 95
Chip-down i.MX 95 should only proceed if the program accepts HDI cost, SI/PI simulation, memory-routing complexity, and NXP reference-design dependency.
Minimum chip-down assumptions:
8 to 12 layers, not 4 layers
HDI microvias likely required depending on BGA pitch and memory topology
Vendor reference stackup and impedance coupons
LPDDR4X/LPDDR5 length matching and fly-by routing per NXP and memory vendor rules
PDN target impedance analysis for all core rails
Thermal simulation for sealed passive chassis
Stackup Recommendation
SoM Carrier Minimum
For a SoM carrier with PCIe, USB 3.x, Ethernet, MIPI, RF module, TPM/ATECC, NVMe, and power conversion:
Table
Layer
Purpose
L1
Components and high-speed signal escape
L2
Solid GND reference plane
L3
Signal or controlled impedance stripline
L4
Power plane islands and local pours
L5
Solid GND or quiet reference plane
L6
Components and secondary signals
Use 8 layers if the selected SoM exposes dense high-speed interfaces, dual Ethernet, M.2 NVMe, RF, and multiple power domains in a compact 85 mm x 56 mm outline.
Chip-Down Minimum
For chip-down i.MX 95 with package-down LPDDR:
8 layers is the absolute minimum only if vendor reference design proves it.
10 to 12 layers is the realistic production starting point.
Do not split ground under DDR, PCIe, USB, Ethernet, clock, or TSN/PTP traces.
Do not route high-speed nets over power-plane voids.
Impedance Targets
Final widths must be calculated by the PCB fabricator using the selected stackup. The following are targets, not final dimensions:
USB-C PD input: 5 V / 9 V / 12 V profile support recommended
Sustained board budget: 12 W maximum system load target
Input design target: 15 W minimum capability, with margin for NVMe burst and wireless transmit peaks
Optional auxiliary input may be added only if ideal-diode ORing and input supervision are implemented
SoM-Based Power Rails
For a SoM-based design, the carrier should not recreate the i.MX 95 core rails unless required by the module vendor. Typical carrier rails:
Table
Rail
Purpose
Notes
VSYS / VIN
SoM input, conversion source
Follow SoM guide exactly.
5 V
USB, M.2, external peripherals
Size for NVMe and USB peaks.
3.3 V
M.2, TPM/ATECC, Ethernet PHY side, logic
Prefer buck, not LDO, if current exceeds a few hundred mA.
1.8 V
Low-voltage I/O where needed
Usually local LDO/buck depending load.
Power Budget Placeholder
A detailed rail budget must be completed after selecting the exact SoM and NVMe/wireless modules. Initial sizing rule:
SoM peak budget: 8 to 12 W depending workload and thermal policy
NVMe burst: reserve 3 W
Dual Ethernet: reserve 1.5 to 2.5 W combined depending PHY/magnetics
Wireless module: reserve 1.5 to 3 W during transmit bursts
TPM/ATECC/security: less than 0.2 W typical budget
This exceeds 15 W if all peaks coincide, so firmware power policy must limit simultaneous NPU, NVMe, wireless, and CPU turbo events unless the input budget is increased.
Security Architecture
Primary Attestation
Use TPM 2.0 for Linux measured boot, platform attestation, sealed secrets, and remote verification.
Auxiliary Secure Element
Use Microchip ATECC608B as an auxiliary device identity or sealed-key element where CryptoAuthentication flows are useful. It should not replace TPM 2.0 for Linux measured boot.
Secure Boot
Enable i.MX 95 secure boot and fuse policy per NXP guide.
Disable external debug in production or require authenticated debug.
Use hidden pogo-pad debug access for manufacturing only.
Log enclosure-open and tamper events into the local ledger.
Correction to Physical Moat Proposal
Do not split or moat ground planes around security regions if high-speed return paths could be disrupted. Security isolation should use controlled placement, via fencing, shielding, secure boot policy, tamper sensors, and firmware controls. Continuous ground is required for signal integrity.
Networking and TSN
Preferred Networking
Use SoM-exposed Ethernet MAC/PHY capabilities that support IEEE 1588/PTP and TSN/AVB. Avoid USB Ethernet for witness-node deterministic networking.
PHY Selection
The provided Marvell 88Q1112 proposal appears to target 1000BASE-T1 automotive single-pair Ethernet, not standard RJ45 1000BASE-T. For RJ45 dual Gigabit Ethernet, select an appropriate 1000BASE-T PHY or use the SoM vendor-recommended PHY/reference circuit.
Do not treat MDIO/MDC as differential; MDIO/MDC are single-ended management signals.
Storage
Primary ledger storage: M.2 Key M NVMe 2230 or 2242, sized for thermal and write endurance.
Production storage: no SD card.
Optional soldered eMMC/UFS may be used for boot or recovery depending on SoM.
Secure storage partitioning should be implemented by secure boot, TPM sealing, disk encryption, and append-only database policy rather than relying on a separate SPI NAND alone.
Connectivity Policy
Allowed production interfaces:
USB-C PD and optional USB data if required
Dual Ethernet
M.2 NVMe
Certified Wi-Fi 6/6E and Bluetooth module if SKU requires it
MIPI CSI/DSI only if the product requires sensor/camera/display ingress
Hidden manufacturing test pads
Not allowed on production exterior:
40-pin GPIO header
SD card slot
Exposed JTAG/SWD header
Unauthenticated UART console
Mechanical and Thermal Strategy
Target outline: 85 mm x 56 mm only if thermal simulation proves it; otherwise allow growth.
Cooling: aluminum chassis as heatsink; no fan.
Thermal path: SoM thermal pad to chassis using TIM.
Place NVMe away from SoM hot zone where possible.
Add temperature sensors near SoM, NVMe, power stage, and Ethernet PHY region.
Enforce firmware thermal throttling and workload scheduling.
DFM and Fabrication
SoM Carrier
6 layer minimum; 8 layer preferred for compact high-speed SKU.
Use controlled impedance stackup and coupons.
Use IPC Class 2 or Class 3 depending deployment requirements.
JLCPCB/OSHPark may be useful for early non-HDI carriers, but production high-speed/controlled-impedance builds should use a fabricator that provides stackup engineering and impedance reports.
Chip-Down
Do not route i.MX 95 chip-down on a 4-layer commodity stackup.
Use HDI-capable fabrication with impedance control, microvia reliability data, and x-section reports.
Corrections to Supplied Draft Spec
4-layer chip-down i.MX 95 with external memory is rejected; use SoM or 8 to 12 layer chip-down.
The listed DDR part appears DDR4-style, while i.MX 95 production should follow NXP-supported LPDDR4X/LPDDR5 topology from the hardware guide.
Do not assume PF8100 is the correct PMIC without NXP i.MX 95 reference confirmation; use the SoM vendor power solution or NXP-recommended PMIC for the exact silicon revision.
Marvell 88Q1112 is not the default choice for RJ45 1000BASE-T; verify whether the product wants 1000BASE-T1 or standard 1000BASE-T.
MDIO/MDC are not differential signals.
Do not split ground planes as a security moat under/near high-speed signals.
PCIe generally should not use arbitrary 100 ohm series termination near the SoC unless the reference design requires it.
A production sealed node should not expose a 40-pin GPIO header or external JTAG/SWD connector.
Next Actions
Pick the exact Toradex Verdin iMX95 SKU.
Confirm memory option: 16 GB preferred unless exact 12 GB is available without lifecycle risk.
Confirm whether the selected Verdin SKU includes Wi-Fi/BT and TPM options or whether these remain carrier-side components.
Confirm dual Ethernet implementation from Verdin-exposed interfaces: standard 1000BASE-T RJ45 versus 1000BASE-T1 automotive SPE.
Obtain Toradex carrier reference design files and Verdin connector footprints.
Create schematic only after Toradex integration guide, connector pinout, and power requirements are available.