Update:  See Part 2 of my investigation.

Like many techno-geeks, one of my favourite kitchen appliances is the coffee machine.  Mine happens to be a Braun Tassimo T1200, which is by far and away the coolest coffee machine because it is actually a programmable beverage dispensing system.  With it I can make anything from a run-of-the-mill cup of Maxwell House to espresso, latte, cappucino, hot chocolate and everything inbetween.  And with almost zero cleanup.

What makes this possible are the pre-packaged, sealed pods (called T-DISCS) for each drink type that has a barcode printed on its lower surface.  Once placed in the machine, a scanner reads the barcode on the pod which then “programs” the Tassimo to prepare the bevvy with the precise amount of water at an exact temperature for a specific time.  The result is amazingly consistent quality from cup to cup!

Pictured above are three Tassimo coffee T-DISCs that are available here in Canada (Starbucks is coming soon!) and a plastic cleaning disc that’s used for descaling, etc.  As you can see, each features a different barcode to “program” the machine accordingly.  Of course, being a geek I just had to know how these codes worked to make my daily cup of bliss, so I set about to reverse-engineer/hack my Tassimo.

Starting the Hack – Reading the T-DISC Barcodes

I began toying with how the Tassimo brews coffee by examining the effect of swapping the barcodes – I used my color scanner/printer to make a replica of the Cafe Crema barcode and put it over top of the code for the Columbian coffee pod to see if it would give a similar frothy head.  No dice, but I was still curious how the codes configured the machine’s settings for each brew.  So, my first plan of attack was to decipher the barcodes to see if I could observe any patterns.

Step 1:  Scanning the T-DISC barcodes with a “declawed” :CueCat

In order to read the codes, I needed a barcode reader – and I had just the thing:  An old IBM :CueCat.  The :CueCat was originally intended to be used as a web-browsing aide, allowing users to “scan” barcodes that would navigate their browser to a specific site.  I know: I cannot imagine why the idea flopped.  If you want your own, I think they can still be had on eBay.

The :CueCat plugs into your USB port and pushes scanned data into your machine in much the same way as a keyboard.  I tested mine and discovered the output was encrypted – this required a hack to “declaw” the cat.

Once complete, I was quickly able to decipher codes from five pods and the cleaning disc using just the :CueCat and Notepad2.  I scanned each barcode several times to ensure that I was getting an accurate and consistent reading: (NB: I added labels to each code for clarity)

Reviewing this data, I discovered that the T-DISCs are encoded with six-digit “programs” which should correlate to programming the Tassimo’s brewing parameters of water, temperature and time.  Additionally, some interesting features of the codes were revealed:

• Both the Latte and Cappucino T-DISCS share the same first two digits: “63”;  given that they are almost identical, this provides some insight into the purpose for the first tuple;
• The cleaning disc’s code begins with a unique tuple, “07” – this could indicate a special code for its purpose.

Step 2:  Determining the T-DISC barcode symbology

Having decoded the data behind the T-DISC barcodes, I now needed to determine the symbology that was used to encode them.  Knowing this, I could then use a barcode generator to create my own codes for manipulating the machine.

After a bit of Googling, I came across a site I’d seen before for Wasp Barcode Technologies – they make all manner of readers, scanners and software related to barcoding.  They also have a web-based barcode generator:

Using trial-and-error, I applied each of the generator’s thirteen symbologies to the code for the Nabob Columbian coffee (642262) until I found one that matched the source bar code:  Interleaved 2 of 5.  This is a fairly common standard that’s literally applied to everything from soup to nuts.

I cross-checked the T-DISC codes with the symbology FAQ and determined that it did not include a checksum field which strengthened my earlier observation that the code’s three tuples were used to program the Tassimo’s brewing parameters directly.

Step 3:  Using the cleaning disc as a mock object

Before I could set to manipulating the Tassimo brewing codes, I needed to get some baseline measurements from the barcodes I knew.  In effect, I wanted to run some physical unit tests on the machine using known data so that I could record the volume and temperature of water dispensed and respective brew cycle time;  I’d then try to “map” these measurements back to the codes to determine correlations to “programming” the Tassimo.

Using real pods to run these “unit tests” could get expensive – fast.  So, my approach was to use the plastic cleaning disc as a mock object in conjunction with barcodes generated from the six-digit codes I scanned in from each T-DISC in Step 1.  By doing this, I could not only observe the effects of the codes on the brew parameters, but also verify that the barcodes worked and only waste water and not precious coffee in the process.

I began by using the Wasp Barcode Generator to create barcodes for each of the five beverage discs which I pasted into a Visio diagram and sized so that when printed and cut out, they would fit on to the barcode scanner in the machine.  This worked out to the convenient dimensions of 1” x 0.5”.  NB:  You can download the PDF of my worksheet here.

Mocking up a T-DISC

Mocking up a T-DISC is quite simple.  Below is a shot of the scanner in the Tassimo brew chamber where we need to place the generated barcode:

Next, here’s a sequence showing how I use the cleaning disc as a stand-in or “mock object” that simulates a Nabob Cafe Crema T-DISC.  On the left, I’m placing a generated barcode on the scanner window which will effectively override the cleaning disc’s program;  on the right, I’ve lowered the T-DISC loading tray which has the cleaning disc placed on it.  The disc is designed to allow water to flow straight through the spigot;  a real disc would retard the flow somewhat as the brewing takes place inside it before flowing through the spigot.

To run the test, I placed a pyrex measuring cup in the machine, closed the clamshell and allowed the machine to scan the code (you can see this happen through the clear plastic window) and pressed the “start” button.  I recorded the time for the brew cycle and the temperature of the dispensed water using a meat thermometer.

T-DISC Unit Test Observations

From my “unit tests”, I recorded the following observations:

Not exactly promising – while I did have more information, a pattern still wasn’t emerging to provide a positive correlation between number “x” and the three parameters.  I needed to run further tests against the machine using barcodes for extreme edge cases to try a coerce the Tassimo to reveal its programming secrets.  To this end, I created barcodes for the series “11 11 11” to “99 99 99”, with the only noticeable effect happening when I ran “55 55 55”:

Here's how the results table breaks down:

• The "Code Numbers" column corresponds to the code digits I used to generate the barcode, indicated with the graphic in the next column for visual verification;
• The Outcomes column indicates the Tassimo's status after reading the barcode:  "Auto" for valid programs that can be run, and "Manual" for programs that failed to run - effectively making the machine a hot water dispenser;
• The three stages columns correspond to the steps in the brewing cycle, depending on the type of beverage;  coffees tend to have three stages, with the first being a short 3s burst of water to pre-saturate the coffee, followed by a pause of about 10-12s, then a flow of hot water for 45 or more seconds.  Other beverages will just run straight through in one stage, or have a pre-saturate stage followed by a flow stage;
• The Water column shows the amount of water in millilitres - I did this as the machine is European in design and may use metric over imperial measures;
• The water Temperature column shows results in degrees Faranheit; 

Conclusions and Next Steps

Over the course of this hack I managed to learn several things about how the Tassimo single-serve beverage system works by employing basic “black box” testing techniques and using the cleaning disc as a “mock object” to run simulations to record various machine behaviours.  I observed that:

1. Each beverage T-DISC (and thus the Tassimo itself) uses a barcode that employs Interleaved 2 of 5 symbology to control how it is “brewed” according to amount and temperature of water and time;
2. These codes translate into six-digit strings that do not include any checksums;
3. The six-digit strings can be used to create corresponding barcodes to simulate existing beverage products;
4. There is definitely a way to modify these codes to enhance or degrade the brewing process!

What remains is to compile more test results using additional barcodes for more edge cases to see how the machine can be manipulated.  As I gather more information, I’ll post the results – and of course, if you happen to own a Tassimo, I’d love to hear about your experiments and discoveries!

Happy hacking!