I finally got around to looking at this again and doing some measurements. There is just one via that I can't tell if I found where it went or not. I had to use the 4-wire probes to figure out the current shunt circuitry as the previous iteration didn't make sense. I have a couple of observations/questions about the design.
1. The MCU reset circuitry is rather complex especially considering the data sheet just suggests connecting a cap to VDD.
2.
There is a good 0.4V sag on the 5V power rail while the heater is on. The sag is seen in the digital signals. I'm a bit surprised by this since there is the 1000 uF cap. Edit: It's only 20mV. I had a grounding issue.
3. Why have a flip flop control the PNP which controls the NPN which in turn controls the P-channel for heater power? Why not have the flip flop drive the NPN?
4. There is a NTC thermistor in the hand piece just below the bottom of the cartridge. I assume this is for cold-junction compensation. I haven't worked out the LM317 is doing with the thermistor, though.
5. I don't see where/how the current shunt is actually used to measure cartridge current. The op amp circuit doesn't permit it, and the multiplexer is usually passing the cold-junction analog signal while the heater is on, not the thermocouple/current shunt signal. I actually got the over current error message when I accidentally shorted the 5V and ground rails while probing.
6. Concerning the large temperature jumps shown in Dave's video, the only time I see the thermocouple voltage jump is when the heater is on which is expected for a series heater and thermocouple. I would not expect Pace to be making temperature measurements while the heater is on. While the heater is on for an extended period of time, e.g. turning on for the first time, the multiplexer does pass the thermocouple analog signal to the ADC so perhaps Pace does make thermocouple measurements which would cause the temperature to jump.