Hardware
Electronic components, peripherals, power systems, and the physical architecture of the Heron device.
The board
Heron runs on a Raspberry Pi Pico 2 W - the RP2350-based board with onboard Wi-Fi. The dual-core Arm Cortex-M33 runs MicroPython. The device is powered from a standard 5V Micro-USB wall adapter.
Peripherals
| Peripheral | Interface | Pins | Purpose |
|---|---|---|---|
| OLED display | I²C | GP2 (SDA), GP3 (SCL) | Status: query count, KB transferred, Wi-Fi signal, uptime. Active only after provisioning. |
| Buzzer | PWM | GP15 | Alert tone for flagged DNS activity. Observes, does not enforce. |
| Pico UPS B (INA219) | I²C0 | GP6 (SDA), GP7 (SCL) | Battery monitor: voltage, current, power, charge percentage. Backup power. |
| Battery | - | - | 600mAh Li-po cell. Provides ride-through for short power cuts. |
Power
Primary power is a 5V Micro-USB wall adapter. The Pico UPS B with the INA219 battery monitor provides battery backup - a 600mAh Li-po cell keeps the device running through brief power interruptions without losing the in-memory DNS log.
Removed from the BOM
A MicroSD card adapter was in the original pinout on SPI0 (GP16–GP19) but was never used in firmware. It was removed from the bill of materials on 2026-06-18. Those four pins are free for future use.
GPIO summary
| Pin | Assigned to |
|---|---|
GP2 | I²C SDA - OLED |
GP3 | I²C SCL - OLED |
GP6 | I²C0 SDA - UPS B / INA219 |
GP7 | I²C0 SCL - UPS B / INA219 |
GP15 | PWM - Buzzer |
GP16–GP19 | Free (MicroSD removed) |
Enclosure
The PCB and enclosure are a future packaging goal. The current phase is a breadboard MVP - the device ships as a Pico on a breadboard with the peripherals wired in. A production enclosure is planned before the next hardware run.
Manufacturing
Each device is provisioned individually. A Python manufacturing script generates a per-device ECDSA P-256 key pair, signs the device certificate with the Northsline root key, flashes the firmware UF2, and burns the keys into the RP2350's one-time-programmable memory. The burn is atomic - data fields are written, read back and verified, then a magic byte is committed last. If any byte does not match, the magic is never set and the burn can be retried.
The script refuses to ship a device that ended up on the flash-file fallback rather than OTP, and refuses to re-burn a device that already has keys.