Local Grill Monitoring Setup

1.

System ExecutiveOverview: Summary & Architecture Overview

The Local Grill Monitoring Setup provides a 100% self-hosted, cloud-free telemetry and historical graphing pipeline for the FireBoard 2 (FBX2-GJ8RC3JRD) multi-6-probe grill thermometer,thermometer. feedingAn internal Seeed Studio XIAO ESP32-C3 (switched on/off automatically by an IRLB8721PBF N-Channel MOSFET driven from the FireBoard's [Pin 35: TXD0] pad) reads all probe channels over Bluetooth Low Energy GATT and posts live webupdates dashboardover hostedWi-Fi onto ul at https://grill.drheck.dev (http://10.0.0.3:8088/api/ingest).

Why

1. anBench InternalWiring BLE-to-Wi-Fi& BridgeFlashing Was Required

1.1 the stock firmware exposes zero local listening ports and initiates outbound TLS 1.2 connections exclusively to FireBoard Cloud (fireboard.io) with strict server certificate verification (CA pinning) and SNI checks.

• Flash Encryption (FLASH_CRYPT_CNT = 127)Microcontroller: All 7 bits of FLASH_CRYPT_CNT (0b1111111) are burned (Write-Protected), permanently locking flash encryption on and preventing plaintext re-flashing.

Solution Architecture

A thumb-sized Seeed Studio XIAO ESP32-C3 (with$21\text{ anmm} \times 17.5\text{ mm}$, built-in Li-Ion battery pads on underside + external U.FL flexibleantenna socket).

1.2 Step-by-Step Pin Connections

MOSFET Pin Orientation (IRLB8721PBF):: TheHold the MOSFET Gate is driven bywith the FireBoard'sblack printed label facing you and the metal heatsink tab facing away (legs pointing down). From left to right, the 3 legs are:
• Pin 1 (Left Leg): Gate (G) — Trigger input ($3.3\text{ V}$ ON / $0.0\text{ V}$ OFF)
• Pin 2 (Middle Leg): Drain (D) — Switched ground going to XIAO BAT-
• Pin 3 (Right Leg): Source (S) — True ground going to FireBoard Battery - (GND)

Required Connections (4 Wires + 1x 100kΩ Resistor)

Optional Battery % Sense Divider (2x 100kΩ when the FireBoard is ON, 0.0V when the FireBoard is OFF). Turning the FireBoard 2Resistors on or off automatically powers the internalPin XIAOA0)

1.3 Complete Wiring Schematic

  FIREBOARD 2 overMAIN BLEPCB GATT/ BATTERY                   IRLB8721PBF MOSFET              SEEED XIAO ESP32-C3
  ==============================                   (Label Facing You)              ===================

  1S Li-Ion Battery (+) [3.7V-4.2V] ---------------------------------------------> Underside [BAT+] Pad
                                                       |
                                                    [100kΩ] (Optional R1)
                                                       |
                                                       +-------------------------> Top-Left Pin [A0 / GPIO2]
                                                       |
                                                    [100kΩ] (Optional R2)
                                                       |
                                                       v
  6-Pin Header [35 TXD0] (3.3V ON) ------------> Pin 1 [Gate (G) - Left]
                                                       |
                                                    [100kΩ] (Pull-Down to GND)
                                                       |
  1S Li-Ion Battery (-) / [GND] ---------------> Pin 3 [Source (S) - Right]
                                                       
                                                 Pin 2 [Drain (D) - Middle] -----> Underside [BAT-] Pad

Why Power Connects to the Underside BAT+ / BAT- Pads (Not the Top 5V Pin): On the Seeed Studio XIAO ESP32-C3, the top 5V (2VBUS) cmpin awaypasses insidethrough thea shell),protection sendsSchottky diode ($\Delta V_{\text{diode}} \approx 0.34\text{ V}$) before feeding the 0x01XC6206P332MR start$3.3\text{ command,V}$ readsLDO ($\Delta V_{\text{drop}} \approx 0.25\text{ V}$), requiring at least $3.85\text{ V}$ on 5V before the $3.3\text{ V}$ rail sags. Soldering to the underside BAT+ pad bypasses the Schottky diode and feeds the LDO directly ($V_{\text{min}} = 3.30\text{ V} + 0.25\text{ V} = 3.55\text{ V}$), running cleanly across the entire $3.5\text{ V–}4.2\text{ V}$ discharge curve of the 1S Li-Ion batterycell.

$$V_{\text{ADC}} via= A0V_{\text{BAT}} \times \frac{R_2}{R_1 + R_2} = \frac{V_{\text{BAT}}}{2.0}, \qquad I_{\text{divider}} = \frac{4.2\text{ V}}{200\text{ k}\Omega} = 21\text{ }\mu\text{A}$$

1.4 Building, Flashing & Bench Testing (GPIO2PlatformIO),

#define WIFI_SSID "Your_2.4GHz_WiFi_SSID"
#define WIFI_PASSWORD "Your_WiFi_Password"

$ pio run -t upload -t monitor

=== FireBoard 2 BLE -> Wi-Fi Sync (XIAO ESP32-C3) ===
[WiFi] Connected, IP: 10.0.0.x
[BLE] Found FireBoard (94:54:c5:f7:1c:fa, RSSI -42 dBm)
[BLE] Connected to FireBoard 2
[BLE] Subscribed and sent 0x01 start command
[BLE] Ch 1: 72.5 F
[HTTP] POST http://10.0.0.3:8088/api/ingest -> 200

2. FireBoard 2 Hardware Forensics & PCB Pinout Reference

2.1 Internal ESP32-WROVER-E Photograph & Pin Labels

RecoveredFigure Device1: & Silicon Identity (esptool / espefuse)

2.2 is powered on

Unpopulated 6-Pin 1.27mm (0.050") Debug Header Pinout

Located immediately adjacent tobelow the ESP32-WROVER-E module on the main PCB. All pads arewere verified by continuity against the castellated ESP32-WROVER-E pins:

      TOP ROW (Closer to ESP32 bottom edge)
   +----------------+----------------+----------------+
   |  [Pin 35] *    |  [Pin 25]      |  [GND]         |
   |  UART0 TXD0    |  GPIO0 (BOOT)  |  Ground        |
   |  (Right #23)   |  (Right #14)   |  (Shield/1/15) |
   +----------------+----------------+----------------+
   |  [Pin 34]      |  [Pin 3]       |  [Pin 24]      |
   |  UART0 RXD0    |  EN / RST      |  GPIO2 (Strap) |
   |  (Right #22)   |  (Left #3)     |  (Right #13)   |
   +----------------+----------------+----------------+
      BOTTOM ROW (Closer to PCB edge)

   * [Pin 35: TXD0] (top-left pad) outputs 3.30V when FireBoard is ON
     and 0.00V when FireBoard is OFF — wire this pad to MOSFET Pin 1 (Gate).

Additional Module Reference Pad: Left #2 (Pin 2: 3V3) carries the regulated $3.3030\text{ VV}$ rail when the FireBoard is powered on and drops to $0.0000\text{ VV}$ when powered off.

Hardware2.3 Recovered Device & Silicon Identity (esptool / espefuse)

2.4 Why the Stock Firmware Could Not Be Redirected or Replaced

FLASH_CRYPT_CNT        (BLOCK0) = 127 R/- (0b1111111)  [Flash encryption permanently enabled; odd bit count = 7; Write-Protected]
FLASH_CRYPT_CONFIG     (BLOCK0) = 15  R/W (0xf)        [Full AES flash encryption tweak configuration]
ABS_DONE_0             (BLOCK0) = True R/W             [Secure Boot V1 permanently enforced on boot]
DISABLE_DL_ENCRYPT     (BLOCK0) = True R/W             [UART bootloader flash encryption disabled]
DISABLE_DL_DECRYPT     (BLOCK0) = True R/W             [UART bootloader flash decryption disabled]
DISABLE_DL_CACHE       (BLOCK0) = True R/W             [UART bootloader MMU flash cache disabled]
JTAG_DISABLE           (BLOCK0) = True R/W             [Hardware JTAG debugging permanently disabled]
CONSOLE_DEBUG_DISABLE  (BLOCK0) = True R/W             [ROM BASIC fallback console disabled]
BLOCK1 (Flash Key)              = ?? ?? ... -/-        [256-bit AES Flash Encryption Key: Read & Write Protected]
BLOCK2 (Secure Boot Key)        = ?? ?? ... -/-        [256-bit Secure Boot Key: Read & Write Protected]

3. FireBoard 2 BLE GATT Protocol Reference

Zero Cloud Dependency: The FireBoard 2 exposes an unauthenticated Bluetooth Low EnergyBLE GATT service thatserver remains active regardless of Wi-Fi state:state, including after an on-device Factory Reset that wipes Wi-Fi credentials.

BLE Handshake & Notification Payload Format

1. Scan & Connect: Connect to BLE MAC 94:54:c5:f7:1c:fa (or any device matching prefix 94:54:c5:f7:1c: / name FBX). No pairing PIN or bond is required.
2. Subscribe: Enable GATT notifications on c2f780ec-45e1-452b-a879-327e3140d1f1.
3. Start Stream: Write 0x01 (1 byte, with response) to c2f780ec-45e1-452b-a879-327e3140d1e8.
4. Parse JSON Notifications: The FireBoard immediately begins emitting UTF-8 JSON notifications for each connected thermistor probe (channel 1 through 6):

   {
     "channel": 1,
     "temp": 225.4,
     "degreetype": 2,
     "date": "2026-09-25T13:28T20:30:00Z"
   }
   

   • channel: Probe port number (1..6).
   • temp: Floating-point temperature (null or <= 0 when unplugged).
   • degreetype: 2 = Fahrenheit (°F), 1 = Celsius (°C).

4. Internal Hardware Mod: Seeed Studio XIAO ESP32-C3 + IRLB8721PBF Power Switch

Bill of Materials (BOM)

Why Power Goes to the Underside BAT+ / BAT- Pads (Not the 5V Pin)

Complete Wiring Schematic

  FIREBOARD 2 MAIN PCB / BATTERY                   IRLB8721PBF MOSFET              SEEED XIAO ESP32-C3
  ==============================                   ==================              ===================

  1S Li-Ion Battery (+) [3.7V-4.2V] ---------------------------------------------> Underside [BAT+] Pad
                                                       |
                                                    [100kΩ] (Optional R1)
                                                       |
                                                       +-------------------------> Pin [A0 / GPIO2]
                                                       |
                                                    [100kΩ] (Optional R2)
                                                       |
                                                       v
  6-Pin Header [35 TXD0] (3.3V ON) ---[10kΩ]---> Pin 1 [Gate (G)]
                                                       |
                                                    [100kΩ] (Pull-Down)
                                                       |
  1S Li-Ion Battery (-) / [GND] ---------------> Pin 3 [Source (S)]
                                                       
                                                 Pin 2 [Drain (D)] --------------> Underside [BAT-] Pad

5. Firmware Repository (~/git/grill-sync) & Magic Constants Reference(include/config.h)

The firmware and verification tools live in /usr/local/google/home/luket/git/grill-sync. All hardware, BLE protocol, ADC resistor, and network "magic" constants are isolated in a single, self-documenting header file: include/config.h (with Wi-Fi credentials in gitignored include/secrets.h).

Repository Layout

• platformio.ini — PlatformIO configuration targeting seeed_xiao_esp32c3 (huge_app.csv 3.1 MB partition table, NimBLE-Arduino, ArduinoJson).
• include/config.h — Central configuration file containing all network URLs, MAC addresses, BLE GATT UUIDs, start byte (0x01), resistor divider values, and voltage thresholds.
• include/secrets.example.h / include/secrets.h — Local Wi-Fi credentials (WIFI_SSID, WIFI_PASSWORD) and optional local overrides.
• src/main.cpp — Non-blocking BLE GATT client, JSON parser, battery monitor, and HTTP POST transmitter.
• tools/verify_ble.py — Standalone Python (bleak) BLE client for Linux hosts to test the FireBoard 2 BLE stream and dashboard ingestion before soldering the microcontroller.

Complete Reference of Constants in include/config.h

6.5. Dashboard Infrastructure Reference on Host ul (https://grill.drheck.dev)