What is inside the Enphase Envoy-S (teardown)

If you are interested in other Enphase information the following other pages may also be of interest:
Enphase Envoy-S “Data Scraping”.
Reverse Engineering the Enphase Installer Toolkit
Enphase Envoy-S Open Ports!

Here are photos and information about the insides of an Enphase Envoy-S metered solar controller. I hope this information saves you from having to open up your own unit.

Front of the circuit board showing the connection input terminals for the mains, consumption and generation meters. Also visible are the USB connections, “bios battery”, ethernet socket and wifi aerials.

Looking at the photo of the front of the unit there is a set of 4 pins with no headers attached. Located just above the bios battery.
These could be Serial programming / access pins.
Some people I’ve been collaborating with have also mentioned that the 10 pins to the left of that connector could be the JTAG port.

Back of the circuit board

Pin header titles

The four pins are titled FT15, FT16, FT17 and FT18.

Chip: The Texas Instruments AM3352 1-GHz Sitara ARM Cortex-A8 32‑Bit RISC Processor that runs everything.

 

Unknown Chip: enphase ENERGY 80-00021-01 / MB8AC3060 E1 1531 Z23

 

Chip: Micron memory 5XA18 JWA18 aka. MT27C4G24MAAKAHANE-6 WT

 

WiFi Chip: Texas Instruments WL1837MOD \ WL1807MOD \ Z64-WL18DBMOD and also showing the 4 missing header pin locations.

It is important to note that the entire board seems to have been dipped in something to “seal” it.. if you intend to try and connect onto the serial port you will need to somehow remove the lacquer around the pins. When doing this I think I slightly damaged or eroded the pin pads! So be careful.

Following the methodology here these are my beliefs about the serial port… Please do your own verification first! Until I can test this I can’t be sure so you may cause damage to your device if you blindly follow my advice!

FT18 = Ground
FT17 = (Transmit Pin) 3.26 volts between this pin and Ground but varies wildly during the boot process possibly signifying data
FT16 = (Receive Pin) 3.17 volts between this pin and Ground and fairly stable during boot process (see above methodology “Pulled high to a voltage a few hundred millivolts lower than that of Vcc”)
FT15 = (VCC) 3.26 volts between this pin and Ground and fairly stable during boot process

(yes.. I put Earth not Ground! Sorry.. top pin is Ground!)

(yes.. I put Earth not Ground! Sorry.. top pin is Ground!)

Professional soldering job (hah)

 

Header added to the board

I did have to bend the newly installed headers so that the wifi button on the board wasn’t obscured.

I can now get some sort of messy incoherent data showing on my laptop when using a USB to serial adaptor and connecting the Earth/Ground, TX and RX. I’ve been told that this is likely due to them expecting around 5 or 12volts signal not 3.3volts.

A quick purchase of a USB Logic Analyser on eBay and I’ve identified the correct settings and protocol.

It runs on 3.3volt (TTL) UART at
-115200 baud
-8 data bits
-1 stop bit
-Standard output (not inverted)

Initial analysis showing U-Boot header upon initial power on and data layout.

And here is the full boot log read when using a 3.3volt TTL to USB card.

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2018.08.28 16:30:33 =~=~=~=~=~=~=~=~=~=~=~=

U-Boot SPL 2013.10-rc3 (Oct 28 2015 - 23:05:56)

[uboot0] = valid
[uboot1] = valid
uboot0 is newer/same build time than uboot1
selecting uboot0

U-Boot 2013.10-rc3 (Oct 28 2015 - 23:05:56)

I2C:   ready
DRAM:  512 MiB
WARNING: Caches not enabled

U-Boot Enphase Part Number: 590-00018-r01-v02.00.01
Last Reset: POWER
Envoy Compat 0

MMC:   OMAP SD/MMC: 0, OMAP SD/MMC: 1, OMAP SD/MMC: 2
SF: Detected N25Q064 with page size 64 KiB, total 8 MiB
SF: Detected N25Q064 with page size 64 KiB, total 8 MiB
Loaded environment from manufacturing data
SF: Detected N25Q064 with page size 64 KiB, total 8 MiB

[uImage0] = valid
[uImage1] = valid
uImage0 is newer/same build time than uImage1
selecting uImage0

Net:   cpsw
Hit any key to stop autoboot:  0 
Booting from MMC...
4858672 bytes read in 784 ms (5.9 MiB/s)
SF: Detected N25Q064 with page size 64 KiB, total 8 MiB
8192 KiB N25Q064 at 0:0 is now current device
SF: 262144 bytes @ 0x490000 Read: OK
## Booting kernel from Legacy Image at 82000000 ...
   Image Name:   Linux-3.12.6-eee4e6e9
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    4858608 Bytes = 4.6 MiB
   Load Address: 80008000
   Entry Point:  80008000
   Verifying Checksum ... OK
## Flattened Device Tree blob at 80000000
   Booting using the fdt blob at 0x80000000
   Loading Kernel Image ... OK
   Loading Device Tree to 9fe45000, end 9fe4ce83 ... OK

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Initializing cgroup subsys cpuacct
[    0.000000] Linux version 3.12.6-eee4e6e9 (go@emb-osx-1.local) (gcc version 4.8.2 (crosstool-NG hg+unknown-20140612.171239) ) #1 PREEMPT Wed Oct 28 20:49:59 PDT 2015
[    0.000000] CPU: ARMv7 Processor [413fc082] revision 2 (ARMv7), cr=10c5387d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] Machine: Generic AM33XX (Flattened Device Tree), model: Enphase Energy EnvoyH
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] On node 0 totalpages: 131072
[    0.000000] free_area_init_node: node 0, pgdat c095b66c, node_mem_map c099d000
[    0.000000]   Normal zone: 1024 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 131072 pages, LIFO batch:31
[    0.000000] CPU: All CPU(s) started in SVC mode.
[    0.000000] AM335X ES2.1 (neon )
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0 
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 130048
[    0.000000] Kernel command line: console=ttyO1,115200n8 rw debug upgrade= root=/dev/mmcblk0p7 rootfstype=ext4 ethaddr0=00:1D:C0:66:37:52
[    0.000000] PID hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
[    0.000000] Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] allocated 1048576 bytes of page_cgroup
[    0.000000] please try 'cgroup_disable=memory' option if you don't want memory cgroups
[    0.000000] Memory: 508816K/524288K available (4158K kernel code, 256K rwdata, 1544K rodata, 3588K init, 258K bss, 15472K reserved, 0K highmem)
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     vmalloc : 0xe0800000 - 0xff000000   ( 488 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xe0000000   ( 512 MB)
[    0.000000]     pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
[    0.000000]     modules : 0xbf000000 - 0xbfe00000   (  14 MB)
[    0.000000]       .text : 0xc0008000 - 0xc0599d18   (5704 kB)
[    0.000000]       .init : 0xc059a000 - 0xc091b130   (3589 kB)
[    0.000000]       .data : 0xc091c000 - 0xc095c220   ( 257 kB)
[    0.000000]        .bss : 0xc095c22c - 0xc099ccb8   ( 259 kB)
[    0.000000] Preemptible hierarchical RCU implementation.
[    0.000000] NR_IRQS:16 nr_irqs:16 16
[    0.000000] IRQ: Found an INTC at 0xfa200000 (revision 5.0) with 128 interrupts
[    0.000000] Total of 128 interrupts on 1 active controller
[    0.000000] OMAP clockevent source: timer2 at 25000000 Hz
[    0.000000] sched_clock: 32 bits at 25MHz, resolution 40ns, wraps every 171798ms
[    0.000000] OMAP clocksource: timer1 at 25000000 Hz
[    0.000000] Console: colour dummy device 80x30
[    0.000257] Calibrating delay loop... 530.94 BogoMIPS (lpj=1061888)
[    0.027764] pid_max: default: 32768 minimum: 301
[    0.027884] Security Framework initialized
[    0.027942] Mount-cache hash table entries: 512
[    0.033542] Initializing cgroup subsys memory
[    0.033627] Initializing cgroup subsys devices
[    0.033643] Initializing cgroup subsys freezer
[    0.033657] Initializing cgroup subsys blkio
[    0.033711] CPU: Testing write buffer coherency: ok
[    0.034096] Setting up static identity map for 0xc03ee120 - 0xc03ee178
[    0.035403] devtmpfs: initialized
[    0.037377] VFP support v0.3: implementor 41 architecture 3 part 30 variant c rev 3
[    0.042094] omap_hwmod: debugss: _wait_target_disable failed
[    0.095169] pinctrl core: initialized pinctrl subsystem
[    0.095555] regulator-dummy: no parameters
[    0.095952] NET: Registered protocol family 16
[    0.096494] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.096942] cpuidle: using governor ladder
[    0.096958] cpuidle: using governor menu
[    0.102882] platform 49000000.edma: alias fck already exists
[    0.102907] platform 49000000.edma: alias fck already exists
[    0.102923] platform 49000000.edma: alias fck already exists
[    0.103699] OMAP GPIO hardware version 0.1
[    0.108086] platform 44e3e000.rtc: Cannot lookup hwmod 'rtc'
[    0.109325] omap-gpmc 50000000.gpmc: GPMC revision 6.0
[    0.117457] bio: create slab <bio-0> at 0
[    0.124071] edma-dma-engine edma-dma-engine.0: TI EDMA DMA engine driver
[    0.124599] vmmcsd_fixed: 3300 mV 
[    0.124935] wlan-en-regulator: 1800 mV 
[    0.125594] SCSI subsystem initialized
[    0.125874] usbcore: registered new interface driver usbfs
[    0.125941] usbcore: registered new interface driver hub
[    0.126157] usbcore: registered new device driver usb
[    0.127564] Switched to clocksource timer1
[    0.137869] NET: Registered protocol family 2
[    0.138563] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[    0.138664] TCP bind hash table entries: 4096 (order: 4, 81920 bytes)
[    0.138782] TCP: Hash tables configured (established 4096 bind 4096)
[    0.138865] TCP: reno registered
[    0.138883] UDP hash table entries: 256 (order: 1, 12288 bytes)
[    0.138915] UDP-Lite hash table entries: 256 (order: 1, 12288 bytes)
[    0.139204] NET: Registered protocol family 1
[    0.139691] RPC: Registered named UNIX socket transport module.
[    0.139707] RPC: Registered udp transport module.
[    0.139716] RPC: Registered tcp transport module.
[    0.139724] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    0.181102] NFS: Registering the id_resolver key type
[    0.181208] Key type id_resolver registered
[    0.181221] Key type id_legacy registered
[    0.181290] msgmni has been set to 993
[    0.183244] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.183417] io scheduler noop registered
[    0.183430] io scheduler deadline registered
[    0.183472] io scheduler cfq registered (default)
[    0.184404] pinctrl-single 44e10800.pinmux: 142 pins at pa f9e10800 size 568
[    0.247387] 48022000.serial: ttyO1 at MMIO 0x48022000 (irq = 89, base_baud = 3000000) is a OMAP UART1
[    0.833932] console [ttyO1] enabled
[    0.838387] [drm] Initialized drm 1.1.0 20060810
[    0.850551] brd: module loaded
[    0.857872] loop: module loaded
[    0.869046] edma-dma-engine edma-dma-engine.0: allocated channel for 0:17
[    0.876360] edma-dma-engine edma-dma-engine.0: allocated channel for 0:16
[    0.883998] m25p80 spi1.0: found n25q064, expected s25fl064k
[    0.890029] m25p80 spi1.0: n25q064 (8192 Kbytes)
[    0.900222] 13 ofpart partitions found on MTD device spi1.0
[    0.906211] Creating 13 MTD partitions on "spi1.0":
[    0.911532] 0x000000000000-0x000000020000 : "SPL"
[    0.917710] 0x000000020000-0x000000220000 : "U-Boot0"
[    0.924134] 0x000000220000-0x000000230000 : "U-Boot0 Meta"
[    0.930869] 0x000000230000-0x000000430000 : "U-Boot1"
[    0.937163] 0x000000430000-0x000000440000 : "U-Boot1 Meta"
[    0.943952] 0x000000440000-0x000000450000 : "Board Static"
[    0.950729] 0x000000450000-0x000000470000 : "U-Boot Env"
[    0.957332] 0x000000470000-0x000000480000 : "Linux0 Meta"
[    0.964051] 0x000000480000-0x000000490000 : "Linux1 Meta"
[    0.970667] 0x000000490000-0x0000004d0000 : "Dtb0"
[    0.976644] 0x0000004d0000-0x0000004e0000 : "Dtb0 Meta"
[    0.983069] 0x0000004e0000-0x000000520000 : "Dtb1"
[    0.989075] 0x000000520000-0x000000530000 : "Dtb1 Meta"
[    1.000931] edma-dma-engine edma-dma-engine.0: allocated channel for 0:19
[    1.008248] edma-dma-engine edma-dma-engine.0: allocated channel for 0:18
[    1.021409] edma-dma-engine edma-dma-engine.0: allocated channel for 0:43
[    1.028720] edma-dma-engine edma-dma-engine.0: allocated channel for 0:42
[    1.041479] edma-dma-engine edma-dma-engine.0: allocated channel for 0:45
[    1.048796] edma-dma-engine edma-dma-engine.0: allocated channel for 0:44
[    1.056417] tun: Universal TUN/TAP device driver, 1.6
[    1.061946] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[    1.068933] PPP generic driver version 2.4.2
[    1.073723] PPP BSD Compression module registered
[    1.078740] PPP Deflate Compression module registered
[    1.084116] PPP MPPE Compression module registered
[    1.089274] usbcore: registered new interface driver asix
[    1.095051] usbcore: registered new interface driver cdc_ether
[    1.101287] usbcore: registered new interface driver r815x
[    1.107140] usbcore: registered new interface driver dm9601
[    1.113082] usbcore: registered new interface driver rndis_host
[    1.121770] usbcore: registered new interface driver cdc_wdm
[    1.127884] usbcore: registered new interface driver usb-storage
[    1.134406] usbcore: registered new interface driver usbserial
[    1.142395] musb-hdrc musb-hdrc.0.auto: Falied to request rx1.
[    1.148630] musb-hdrc: ConfigData=0xde (UTMI-8, dyn FIFOs, bulk combine, bulk split, HB-ISO Rx, HB-ISO Tx, SoftConn)
[    1.159752] musb-hdrc: MHDRC RTL version 2.0 
[    1.164363] musb-hdrc: setup fifo_mode 4
[    1.168525] musb-hdrc: 28/31 max ep, 16384/16384 memory
[    1.174085] musb-hdrc musb-hdrc.0.auto: MUSB HDRC host driver
[    1.180198] musb-hdrc musb-hdrc.0.auto: new USB bus registered, assigned bus number 1
[    1.188717] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
[    1.195910] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[    1.203546] usb usb1: Product: MUSB HDRC host driver
[    1.208800] usb usb1: Manufacturer: Linux 3.12.6-eee4e6e9 musb-hcd
[    1.215336] usb usb1: SerialNumber: musb-hdrc.0.auto
[    1.221255] hub 1-0:1.0: USB hub found
[    1.225300] hub 1-0:1.0: 1 port detected
[    1.230857] musb-hdrc musb-hdrc.1.auto: Falied to request rx1.
[    1.237121] musb-hdrc: ConfigData=0xde (UTMI-8, dyn FIFOs, bulk combine, bulk split, HB-ISO Rx, HB-ISO Tx, SoftConn)
[    1.248253] musb-hdrc: MHDRC RTL version 2.0 
[    1.252865] musb-hdrc: setup fifo_mode 4
[    1.257022] musb-hdrc: 28/31 max ep, 16384/16384 memory
[    1.262582] musb-hdrc musb-hdrc.1.auto: MUSB HDRC host driver
[    1.268689] musb-hdrc musb-hdrc.1.auto: new USB bus registered, assigned bus number 2
[    1.277172] usb usb2: New USB device found, idVendor=1d6b, idProduct=0002
[    1.284373] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[    1.292015] usb usb2: Product: MUSB HDRC host driver
[    1.297266] usb usb2: Manufacturer: Linux 3.12.6-eee4e6e9 musb-hcd
[    1.303805] usb usb2: SerialNumber: musb-hdrc.1.auto
[    1.309646] hub 2-0:1.0: USB hub found
[    1.313678] hub 2-0:1.0: 1 port detected
[    1.324848] pcf2123 spi driver
[    1.328750] pcf2123 chip found
[    1.332015] pcf2123 spiclk 3000 KHz.
[    1.336360] pcf2123 spi1.1: rtc core: registered pcf2123 as rtc0
[    1.342792] i2c /dev entries driver
[    1.347493] omap_wdt: OMAP Watchdog Timer Rev 0x01: initial timeout 60 sec
[    1.355240] edma-dma-engine edma-dma-engine.0: allocated channel for 0:25
[    1.362465] edma-dma-engine edma-dma-engine.0: allocated channel for 0:24
[    1.369822] omap_hsmmc 48060000.mmc: pins are not configured from the driver
[    1.547865] edma-dma-engine edma-dma-engine.0: allocated channel for 0:13
[    1.555146] edma-dma-engine edma-dma-engine.0: allocated channel for 0:12
[    1.563514] omap_hsmmc 47810000.mmc: pins are not configured from the driver
[    1.573698] mmc0: card claims to support voltages below the defined range. These will be ignored.
[    1.593729] mmc0: queuing unknown CIS tuple 0x91 (3 bytes)
[    1.600260] mmc0: new high speed SDIO card at address 0001
[    1.607996] edma-dma-engine edma-dma-engine.0: allocated channel for 0:36
[    1.616753] omap-sham 53100000.sham: hw accel on OMAP rev 4.3
[    1.627495] omap-aes 53500000.aes: OMAP AES hw accel rev: 3.2
[    1.633748] edma-dma-engine edma-dma-engine.0: allocated channel for 0:5
[    1.640941] edma-dma-engine edma-dma-engine.0: allocated channel for 0:6
[    1.648893] usbcore: registered new interface driver usbhid
[    1.654903] usbhid: USB HID core driver
[    1.659534] nf_conntrack version 0.5.0 (7950 buckets, 31800 max)
[    1.669942] ip_tables: (C) 2000-2006 Netfilter Core Team
[    1.675692] TCP: cubic registered
[    1.679262] NET: Registered protocol family 10
[    1.685610] NET: Registered protocol family 17
[    1.690492] Key type dns_resolver registered
[    1.695201] ThumbEE CPU extension supported.
[    1.699796] Registering SWP/SWPB emulation handler
[    1.731658] mmc1: BKOPS_EN bit is not set
[    1.740265] mmc1: new high speed MMC card at address 0001
[    1.746542] mmcblk0: mmc1:0001 MMC04G 3.60 GiB 
[    1.751618] mmcblk0boot0: mmc1:0001 MMC04G partition 1 16.0 MiB
[    1.757901] davinci_mdio 4a101000.mdio: davinci mdio revision 1.6
[    1.764365] davinci_mdio 4a101000.mdio: detected phy mask fffffffd
[    1.771099] mmcblk0boot1: mmc1:0001 MMC04G partition 2 16.0 MiB
[    1.784743] libphy: 4a101000.mdio: probed
[    1.789178]  mmcblk0: p1 p2 p3 p4 < p5 p6 p7 >
[    1.794048] davinci_mdio 4a101000.mdio: phy[1]: device 4a101000.mdio:01, driver unknown
[    1.805468] MACID from cmdline = 00:1d:c0:66:37:52
[    1.810752]  mmcblk0boot1: unknown partition table
[    1.817255] pcf2123 spi1.1: setting system clock to 2018-08-28 14:05:32 UTC (1535465132)
[    1.827804]  mmcblk0boot0: unknown partition table
[    1.838282] Freeing unused kernel memory: 3588K (c059a000 - c091b000)
Mounting Flash Device
Checking File Systems
Mount Root File System
[    2.365342] EXT4-fs (mmcblk0p3): mounted filesystem with ordered data mode. Opts: (null)
Creating intermediate base dev files...
mkdir: can't create directory '/mnt/root/dev/shm': No such file or directory
Configure links for partition: part/912
Starting Envoy System

INIT: version 2.88 booting

Starting the hotplug events dispatcher: udevd.
Synthesizing the initial hotplug events...done.
Waiting for /dev to be fully populated...[    5.916266] ade7758: module is from the staging directory, the quality is unknown, you have been warned.
[    5.926859] ade7758: module is from the staging directory, the quality is unknown, you have been warned.
[    6.009652] Loading modules backported from Linux version R8.5-1-g1329949
[    6.052259] Backport generated by backports.git R8.4-0-g0d46f43
[    8.555445] cfg80211: Calling CRDA to update world regulatory domain
[    8.777885] cfg80211: World regulatory domain updated:
[    8.791581] cfg80211:  DFS Master region: unset
[    8.799575] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[    8.823578] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm), (N/A)
[    8.839576] cfg80211:   (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm), (N/A)
[    8.855575] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm), (N/A)
[    8.875574] cfg80211:   (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm), (N/A)
[    8.891576] cfg80211:   (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm), (N/A)
done.
[    9.152599] wlcore: wl18xx HW: 183x or 180x, PG 2.2 (ROM 0x11)
[    9.178064] wlcore: loaded
[    9.191768] wlcore: driver version: ol_r8.a9.14
[    9.207212] wlcore: compilation time: Wed Oct 28 23:02:59 2015
Activating swap...failed.
[   11.110129] EXT4-fs (mmcblk0p3): re-mounted. Opts: (null)
vm.dirty_writeback_centisecs = 100
vm.dirty_expire_centisecs = 100
Mounting local filesystems...mount: none already mounted or /dev/pts busy
mount: according to mtab, devpts is already mounted on /dev/pts
[   11.709097] EXT4-fs (mmcblk0p5): mounted filesystem with ordered data mode. Opts: (null)
[   11.735800] EXT4-fs (mmcblk0p6): mounted filesystem with ordered data mode. Opts: (null)
[   11.766621] EXT4-fs (mmcblk0p7): mounted filesystem with ordered data mode. Opts: (null)
failed.
Activating swapfile swap...done.
Cleaning up temporary files... /lib/init/rw /var/run /var/lock /var/www/run.

INIT: Entering runlevel: 3

Starting enhanced syslogd: rsyslogd.
Loading ade7758...done
Creating MAL hrtimer trigger...done
Starting MAL...done
Setting hostname....
Bringing up interface eth0..
[   14.720820] net eth0: initializing cpsw version 1.12 (0)
[   14.733148] net eth0: slave-0 phy found : id is : 0x2000a211
[   14.740981] libphy: PHY 4a101000.mdio:00 not found
[   14.748408] net eth0: slave-1 phy 4a101000.mdio:00 not found
[   14.767648] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
Determining IP information for eth0....udhcpc (v1.22.1) started
Sending discover...
Sending discover...
Sending discover...
No lease, forking to background
 done....
Bringing up interface eth1..
Bringing up interface lo..
[   30.862499] wlcore: PHY firmware version: Rev 8.2.0.0.224
[   30.967735] wlcore: firmware booted (Rev 8.9.0.0.31)
[   30.992287] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
Starting Network Interface Plugging Daemon: eth0 wlan0.
Starting DNS forwarder and DHCP server: dnsmasq.
Applying all IPTables filtering rules
NTP server is disabled, Using HTTP timing instead.: ntpdStarting OpenBSD Secure Shell server: sshd.
Starting system message bus: dbusUnknown username "dnsmasq" in message bus configuration file
.
Starting Avahi mDNS/DNS-SD Daemon: avahi-daemon.
Starting periodic command scheduler: cron.
mount: special device /opt/agf/images does not exist
mount: special device /opt/agf/js does not exist
mount: special device /opt/agf/css does not exist
mount: special device /opt/agf/htdocs does not exist
Starting Mongrel2 HTTP server...done
Interface IP configurations:
    inet 169.254.120.1/16 brd 169.254.255.255 scope global eth0
Starting pmi...done
[2018/08/28 16:06:10] emumon generating dbs - beginning
[2018/08/28 16:06:10] emumon generating dbs - completed
Starting Envoy System Monitor...done
[2018/08/28 16:06:15] init.d/emu start script - beginning
[2018/08/28 16:06:15] init.d/emuapp start script - beginning
Starting ldarb...done
Starting ZigBee arbiter...done
[2018/08/28 16:06:21] emumon generating dbs - beginning
[2018/08/28 16:06:22] emumon generating dbs - completed
EMU database exists:
-rw-r--r--    1 root     root        901120 Aug 28 16:06 /var/opt/emu/emu.db
Starting uiserver...pid 1844's current scheduling policy: SCHED_OTHER
pid 1844's current scheduling priority: 0
pid 1844's new scheduling policy: SCHED_FIFO
pid 1844's new scheduling priority: 20
done
Starting emu...done
Starting EnvoyPage backend...done
Starting System Configuration REST API...done
Starting EMU Web UI/API...done
Starting ui_update.rb...
Waiting for ui_update.rb to finish...done
Starting CBUS Util...done
Starting comm check...done
Starting Bin roller rest server...ping count 2...done
Starting PFA Monitor...done
Starting EIM...done
Starting task queue ...done
[2018/08/28 16:06:38] init.d/emuapp start script - ending
[2018/08/28 16:06:39] init.d/agf start script - beginning
Starting adc process...done
[2018/08/28 16:06:41] init.d/agf start script - ending
[2018/08/28 16:06:41] init.d/emu start script - ending

INIT: no more processes left in this runlevel

[   82.955634] [sched_delayed] sched: RT throttling activated
[   84.816317] IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready
[   84.823404] wlcore: down
[   87.120164] IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready
[   87.217775] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[  105.468226] wlcore: down

Thoughts:

Will the backup / time / settings battery ever hit end of life, if so, what happens?

If you are reading this and have any questions or want photos of any other parts of the board please comment as soon as possible after 19/08/2018 as the longer you wait the more chance the Envoy-S may be re-assembled and not around for analysis.