Technology

This is the long read. If the specs sheet is the what and the architecture is the how it flows, this page is the why it’s built this way. Every choice below was a trade we made on purpose, and we’re happy to defend each one. ¹

What’s inside: the dual-SoC architecture

The WB-1 runs on two processors that do not trust each other to do the same job. This is the single most important decision in the whole device.

A Cortex-M7 at 480 MHz owns the real-time path: it samples the inputs, normalizes them, runs the Bobulation Engine tick, and hands finished decisions to the radios. It runs bare-metal with a fixed 1 kHz scheduler and nothing else competing for its cycles. Interrupt-to-handler latency is sub-microsecond, and because there is no operating system underneath it, there is no scheduler jitter, no garbage collector, and no surprise context switch to blow a deadline.

An ESP32 owns everything that is allowed to be slow: the three radios, the web stack, the REST/WebSocket API, TLS, and cloud sync. It runs an RTOS, talks to the outside world, and is fully isolated from the deterministic path by a single hardware mailbox.

The reason for the split is brutal and simple: a slow REST request must never be able to stall a safety interlock. On a single-SoC design, a spike in TLS handshakes or a chatty dashboard client steals cycles from the control loop, and your worst-case latency becomes “whoever showed up.” We refused to ship that. The M7 cannot be preempted by the network because the network lives on a different chip. The mailbox between them is bounded, lock-free, and carries only finished decisions one way and rule updates the other.

The Bobulation Engine, technically

The engine gets its own page, but here is the part that matters to a systems engineer: it is a deterministic, pull-based pipeline, not an event loop. Every 1 kHz tick, the engine pulls the latest normalized frame from each of the twelve channels, fuses them with weighted confidence, evaluates the active rule set in priority order, and emits a set of decisions. Same inputs, same rules, same clock — same outputs, every time.

Internally the data flow is pub/sub-shaped: channels publish stamped samples, the fusion stage subscribes to the set a rule cares about, and decisions are published to output targets. But the whole graph is resolved at rule-compile time, not at runtime — when you push a new rule set, the M7 builds a static dependency graph and pre-allocates every buffer. There is no allocation, no hashing, and no dynamic dispatch on the hot path. That is how a 64 KB rule DSL still ticks in single-digit milliseconds.

Determinism is a guarantee, not a hope. When two rules contend for the same output with no defined precedence, the engine does not silently pick a winner — it logs both contending rules and the freshness scores that would have broken the tie, then holds the last safe state. You can replay any decision from the audit log and get the identical result.

Three radios, one antenna problem

Running BLE 5.3, Wi-Fi 6, and LoRa concurrently inside an 96 mm puck is mostly an antenna-engineering problem, not a software one. Three radios in two overlapping bands (BLE and Wi-Fi both live at 2.4 GHz) will desensitize each other if you let them.

The WB-1 solves this with orthogonal antenna orientation and ground-plane isolation. The 2.4/5 GHz antennas sit on opposite corners of the board, rotated 90° relative to each other so their radiation patterns barely overlap. The sub-GHz LoRa antenna is physically separated by an internal ground plane that acts as an RF fence. The result is better than 20 dB of isolation between the 2.4 GHz radios — enough that all three transmit at once without clobbering each other’s receive sensitivity.

All three radios passed pre-scan against FCC Part 15, IC RSS-Gen, CE RED, and UKCA emissions limits with margin. The compliance summary is at the bottom of this page; the full test reports are available under NDA.

Power architecture

The WB-1 takes power from two inputs at once: USB-C PD (5–20 V) and a hot-swappable 2S 18650 pack (7.4 V). A load-sharing IC arbitrates between them so you can pull either source live without a reset — pull mains and the battery picks up the load in under a millisecond; plug mains back in and it recharges the pack while running.

Brown-out behaviour is deliberate. When the rail sags below threshold, the M7 gets a hardware interrupt with enough reserve energy in the bulk capacitance to write the last known rule state and audit cursor to NVRAM before the lights go out. On the next power-up the engine resumes from that state instead of cold-booting blind.

Firmware: signed, A/B, recoverable

Firmware is signed end to end. The bootloader verifies an ECDSA signature against a key burned into the SoC’s one-time-programmable fuses before it will execute an image — there is no path to run unsigned code on a production unit. Updates land in an A/B partition scheme: the new image is written to the inactive slot, verified, and only then marked bootable. If the new image fails to check in after boot, the watchdog rolls back to the last-good slot automatically. A failed OTA cannot brick the device.

The signing chain is rooted in an offline HSM; build artifacts are signed in CI by a key that never touches a developer laptop. Secure boot, signed firmware, and the hash-chained audit log together mean a deployed fleet has a tamper-evident record from silicon to cloud.

How it’s exploded

Four layers, stacked and sealed. The aluminium does double duty as the structural shell and the thermal path for the SoCs.

Manufacturing

The WB-1 is assembled and tested in Atlanta, Georgia. Boards are populated by a regional partner, then flashed, calibrated, and functionally tested in-house on a bed-of-nails fixture that exercises every one of the twelve input channels, all three radios, and the full power path before a unit gets a serial number.

Every unit ships with its calibration constants and a test report tied to its serial number. If a board fails any station, it’s pulled and root-caused, not reworked blind.

What’s in the box

• WB-1 device — calibrated, serialized, firmware current
• USB-C cable — 1 m, USB-C PD rated
• Mounting kit — DIN-rail clip, VESA 75 plate, 2× M4 wall studs
• Getting-started card — scan-to-pair, dashboard URL, support handle

No wall-wart in the box on purpose: the WB-1 takes any USB-C PD source you already own, and shipping one more disposable brick is not the engineering brand we want.

Compliance

Pre-scan complete against the marks below; full certification tracks v1.0 production. Reports available under NDA.

Documentation

This page is the overview. Go deeper:

• Full specifications → — every measured number, the datasheet
• The Bobulation Engine → — the decisioning layer, opened up
• Architecture → — the five-layer pipeline and its failure modes
• Wireless topologies → — picking a layout for your site

Questions a datasheet can’t answer go to the team. New to the vocabulary? The glossary defines every acronym above.