BeatIt

Getting started: git clone --recursive https://github.com/7FM/BEAT_IT

RP2040 Firmware

cd rp2040_beatit
./build.sh
# Note that the BeatIt PCB also supports the normal rp2040 programming by connecting via USB-C and dragging the `beatit.uf2` file to the mounted fake drive
# Alternatively, flash the firmware via SWD using another rp2040:
./flash.sh

PCBs

All PCBs were designed for jlcpcb and the assembly service. Though the part selection is probably not ideal, regarding costs.

• BeatIt main PCB to control the heat it: ./KiCAD/RP2040_minimal_r2/jlcpcb/production_files
• PCB to power the BeatIt via a coin cell or NiMH battery: ./KiCAD/CoinCellBooster/jlcpcb/production_files

Rust Application

A linux CLI application has been implemented to interact with the beat it from a computer.

cd rust
cargo build
./target/debug/beatit

USB protocol reversing:

Details

BULK OUT REQUESTS:

NOTE: After each bulk out, a bulk in is initiated to receive the heat it status / response ?!?

Starting the heat it:

First bulk out request to heat it: FF 0A FF FF FF 01 08 (this might be optional?)

The second bulk out request depends on the settings:

Setting	Duration	Sensitive	Bulk out request data
Adult	Long	n	FF 08 03 02 0D
Adult	Medium	n	FF 08 03 01 0C
Adult	Short	n	FF 08 03 00 0B
Adult	Long	y	FF 08 02 02 0C
Adult	Medium	y	FF 08 02 01 0B
Adult	Short	y	FF 08 02 00 0A
Child	Long	n	FF 08 01 02 0B
Child	Medium	n	FF 08 01 01 0A
Child	Short	n	FF 08 01 00 09
Child	Long	y	FF 08 00 02 0A
Child	Medium	y	FF 08 00 01 09
Child	Short	y	FF 08 00 00 08

Unknown Bulk requests

• FF B0: ??? no clue
• FF 02 02 followed by FF 32 32 probably status related, response (BULK IN) is always 12 bytes

Possible Temperature Sensor

command: FF 02 02
reply  : ff, 00, 01, 3b, 00, 00, 00, 00, 3c, XX, XX, XX
                 aaaaaa      bb      cccccc  dddddddddd
                                     ee

a: temperature?
b: heating state
- 01 heating phase
- 02 keep temperature?
- 00 done
c: temperature?
d: device id?
e: error code?