If you are a regular reader, then the odds are you have taken apart an electronic gadget, either for a fix, or simply because your curiosity got the better of you. Once inside, it’s all but impossible to help yourself from doing at least a little reverse engineering. That’s what happened when [PRBS23] took a look inside a MasterBuilt Gravity 800 Grill for a simple wire fix. But one thing led to the next, and now open source firmware for the grill is freely available!
The first order of business in creating the firmware is reverse engineering the original controller. Opening it up immediately reveals an ESP-32 and a well-labeled programming port. The rest of the control board is equally simple, including connectors for four thermistor temperature sensors, lid open/close switch, fan driver, 16 segment LCD, piezo buzzer, and some physical inputs.
The thermistor along with the physical inputs are connected to a 16 pin chip, interfacing with the MCU over a 9600 baud UART connection. [PRBS23] cannot determine an ADC chip meeting these specifications, so the most likely answer is a cheap MCU programmed to act as a simple analog fronted.
The neatly labeled programming header is used to quite easily dump the firmware with the espflash utility. Analyzing this dump reveals a rather strange ADC correction function used by the original firmware. The necessity and overall utility of this function remains unclear, does corrects a maximum of around 40 degrees Fahrenheit.
Most of the other features ended up being at least somewhat easier. The CS1621 segmented display driver is reasonably well documented with datasheets making its implementation far easier. Likewise, the other odds and ends were implemented in a far more normal manner compared to the thermistors.
All this reverse engineering work got tied together into a neat little firmware package. It comes with over the air updates PID controlled temperature, and a real-time web interface. This also isn’t the first time we have seen an IoT device liberated from proprietary firmware, and this remains one of our favorite uses of reverse engineering!
“The necessity and overall utility of this function remains unclear, as it only corrects by a maximum of two or three degrees Fahrenheit.”
I think you may have misread their graph?
In the “Thermocouple correction curve” graph, the correction factor gets as high as 40F above 700F. At normal steak cooking temperatures it’s a >20F correction.
Granted, it’s a very hard graph to read due to having two Y axis scales (left and right side).
Oh, I see how I misread that. Thanks for pointing it out!
Can you do this with Reqtec? I have a work around currently after they took away turning the grill on and currently have it in my Home Assistant but it’s only a matter of time before they break that too.
In theory, it looks like it might be possible. A little bit of searching seems to show that at least some of the Reqtec controllers use an ESP8266EX, you could build firmware for. It would definitely require some reverse engineering though.
One thing that would make a Reqtec more complicated is that it has both a fan and auger motor that need to be controlled, so the control loop would have to be a bit more complex. It would need to control both airflow and fuel, where as the Masterbuilt Gravity smokers just rely on gravity feeding the fuel, so a single output PID loop is all I needed.
That is a very nicely drawn schematic. In my Quest of improving my drawing skills there is certainly stuff here i will incooperate in my drawing skill.
The only thing I’d probably do differently is that I’d move inputs to the left, probes, keypad etc and outputs to the right, buzzer, screen.
I also always struggle with the wire vs bus vs label thing. Your wires look nice. nicer then what I end up with. Because of that I draw a bus between blocks so I end up with fewer (crossings) and wires over the schematic. But it always makes me wonder, am I allowed to do this? Are there EE’s turning in their grave now? I2c is a bus, so it can be in a bus. Spi, UART too. But that single (or group of) gpio, what is that … Not to mention, when do youvuse a label. In simple diagrams like thus it’s overkill, in more complex diagrams its needed, or do hierarchial, but there’s even an anti voice on that, just use bigger scheets.
@arya what say you?
Wait, that is a BBQ contraption with a firmware? wtaf?
And why, dear author, do you ass-u-me that everyone should know that such thing exists and knows by the name?
I woldn’t be surprised if it required a subscription for anything beyond sausages and burgers…
I have one of these – basically the firmware is for a glorified fan controller. It is overcomplicated for a charcoal grill, but on the other hand it’s a charcoal grill that can get up to a predefined temperature in ten minutes, and does an excellent job of maintaining the selected temperature.
Naturally I had reservations about buying yet another product that sits on the network and has too many smarts, but I also figured that if it ever failed I do know enough these days to create a dumber version of said controller myself, so I went ahead with the purchase. The grill itself is excellent, and it’s great to cook on.
Thank you for the first hand experience.
As someone who uses PC case fans to distribute heat from a wooden stove into the house because the original placement of said stove is not optimal, I know that a little wind can make all the difference.
I’m thinking reflow oven with just a firmware upgrade?
A charcoal powered reflow oven would be awesome.
On U4, where are the I2C pull-up resistors? What are R104 and R105 doing in series?
Great job, a UART ADC caught my attention as a new part idea.
The interface to IC4 (the thermocouple ADC, I’m assuming this is what you meant by U4) is not I2C, or any kind of open collector type interface. Instead it is a bidirectional interface where both the ESP32 and the ADC drive at least the SDA (Serial DAta) signal.
I can’t speak to exactly why the designers put R104 and R105 in there, but my suspicion at least for R105 is that it limits the current in the case that both the ESP and ADC drive SDA at the same time. Since it is a bidirectional data signal. That’s not really an explanation for R104, as only the ESP32 drives SCL (Serial CLock), maybe that just put it in for symmetry.
Great story, Daaaamn! Your a c5 and a three modules away from being able to wardrive at the park cookout…..is what I got from that!!! Hahahaha
Well that and damn, y’all need all that tech to cook food!!!!! hahahahahahahaha!!! Y’all don’t know how to set a timer!!? Hahahaha!!!
Just sayin’……..