Rick's b.log - entry 2018/04/23

Tassimo T-Disc hacking

Here's one of the official publicity shots from tassimo.fr:

The chocolate was okay. I would have appreciated a larger cup because, well, I'm a gannet. I tried a coffee but it was lethal. Seriously, I made the coffee and tipped three quarters in the sink. The rest was topped up wih milk, about five sugars, and then put in the microwave. Then it was drinkable.

The Maxwell House latte (should be lattè!) was amusing. I put the white disc in and made it up. It wasn't bad, needed some sugar, but it didn't really sell it's coffeeness to me. Turns out that I was only drinking the lattè part. The coffee is a separate disc! The milky stuff was an odd but rather pleasant taste. For my final two tries, I made it correctly. A big amount of milky stuff, with an espresso dose into that. The final one was made up in a big plastic beer glass so I could marvel at the three layers of the beverage. That was actually pretty impressive. After adding sugar and mixing it all together, it was perfectly drinkable - for Maxwell House is a much milder and smoother coffee. It's the sort of coffee that you can enjoy, not the sort that punches you in the face to make sure you're fully awake.

Then I discovered English breakfast.
Let's just come right out and be honest. French black tea is shit. Some teas are drinkable, everybody's favourite Lipton Yellow Label is surely the stuff that was rejected for Happy Shopper tea bags. It is the most miserable sorry excuse for tea I've ever had the misfortune to drink. And while you can find some astonishing posh-as-hell Earl Grey blends with rose and lavender (!), there's nothing that will match the simple understated joy of a cup of Tetley. And by Tetley I mean the type you get in Britain, not the export versions sold here (which are barely better than Yellow Label). For an ardent drinker of black tea, it is painfully clear that the French really don't get black tea. The usual comment from people I've shared teabags with is "wow, what a taste" followed by "gave me heartburn for weeks". Funny, that's pretty much my opinion of most French coffee!
Enter Tassimo English breakfast. Made in Germany or somesuch, it is a proper solid pleasing large cup of tea. This is a tea for people who drink tea. Amazon is listing 80 dosettes (5×16) for about €26, which is a heck of a lot more than my Tetley but at ~32 centimes a cup it would be marginally more expensive than a lot of French tea (which tends to be in the order of 10-20 cents per bag) but cheaper than that posh-as-hell tea that was... don't ask. Really, don't.

Now the thing that bugged me about coffee machines in the affordable end of the market was that they seemed to be fairly single-purpose devices. The one we have at work (some sort of nespresso, I think) has the benefit that you can get blank cartridges online for putting in your own favourite coffee, but the disadvantage that it is a rather stupid machine - there's a half cup button and a full cup button. That's it.
The Tassimo, on the other hand, has unique cartridges that carry a barcode. And what's impressive about this isn't the implied DRM (any blanks you'll find on-line are recycled cartridges) or region coding (American and European cartridges apparently won't work in the opposite machines), but the fact that the barcode is not a drink identifier. It is a coded set of instructions telling the machine how to prepare the drink.

The code for my particular machine is the one on the side, not the one closest to the tab. It is interleaved two of five (ITF) format, with a check digit. According to US patent 7,231,869 B2, the bit assignment of the barcode is as follows:

Bit     Parameter           Description
0 & 1   Water temperature   00 = cold
                            01 = warm
                            10 = 83°C.
                            11 = 93°C.
2 & 3   Cartridge charge    00 = fast charge with soak
                            01 = fast charge without soak
                            10 = slow charge with soak
                            11 = slow charge without soak
4, 5, 6 & 7 Beverage volume 0000 = 50 ml
                            0001 = 60 ml
                            0010 = 70 ml
                            0011 = 80 ml
                            0100 = 90 ml
                            0101 = 100 ml
                            0110 = 110 ml
                            0111 = 130 ml
                            1000 = 150 ml
                            1001 = 170 ml
                            1010 = 190 ml
                            1011 = 210 ml
                            1100 = 230 ml
                            1101 = 250 ml
                            1110 = 275 ml
                            1111 = 300 ml
8, 9 & 10 Flow rate         000 = 30%
                            001 = 40%
                            010 = 50%
                            011 = 60%
                            100 = 70%
                            101 = 80%
                            110 = 90%
                            111 = 100%
11 & 12 Purge               00 = slow flow/short period
                            01 = slow flow/long period
                            10 = fast flow/short period
                            11 = fast flow/long period

The code on or in the cartridge 1 will normally comprises one or more extra data bits for error checking. In one example a 16 bit code is provided. For example, using the variables listed in Table 3, a cartridge 1 bearing the code "1000100011110" would have the following operational parameters:

10    Water temperature of 83°C.
00    Fast charge with soak
1000  Dispensed drink volume of 150 ml
111   Flow rate equals 100%
10    Fast air flow purge/short period.

Armed with this information, I used an online barcode generator to create a 300dpi barcode for the value %00 011 1101 01 11 (or 00983 in decimal), which means 93°C, fast charge/no presoak, 250ml, 60% flow rate, short purge.

The barcode was printed using OvationPro to get it to the correct size (24mm by 10mm), and using the laser printer so a splash or two won't wreck it.

The barcode was recognised by the coffee machine, which proceeded to spew out warm water rapidly. Well, okay, I'm halfway there, I guess...

Here are the T-Discs that I currently have, and how they break down (the dashes to expand the binary to four nibbles; the bracketed number is the check digit):

If we take a look, the espresso part of the lattè is small, while the milk part is large. The codes, split as indicated in the patent, are:

Coffee  11 000 0010 00 10
Milk    11 001 0010 01 11

Let's try it backwards:

Coffee  11 00 0001 000 10
Milk    11 00 1001 001 11

We can test this... Hot, fast charge with no soak, 50ml dose, 50% flow rate, short purge. If we run it all backwards it is %11 01 0000 010 11 which is 6664 decimal.

Oh! So near, yet so far. The water came out slower, and I guess it ended up dosing about 80ml in total. The problem? Stone cold!

I think I'm going to have to do it the happy hacker way - print up a bunch of barcodes, each toggling a single bit, to observe how the machine behaves each time... Just not today.

PS: I'm not the only one to have walked into this issue, so before you post a link below, please ensure:

• It's applicable to European models (if the page mentions Starbucks dosettes, it's American)
• It's not just copying from the patent
• It's not involving cutting out existing codes and gluing them on (that's Blue Peter, not hacking!)
• It's not talking about the other barcode (the UPC_E one, that's for a different machine).

Your comments:

Please note that while I check this page every so often, I am not able to control what users write; therefore I disclaim all liability for unpleasant and/or infringing and/or defamatory material. Undesired content will be removed as soon as it is noticed. By leaving a comment, you agree not to post material that is illegal or in bad taste, and you should be aware that the time and your IP address are both recorded, should it be necessary to find out who you are. Oh, and don't bother trying to inline HTML. I'm not that stupid! ☺ ADDING COMMENTS DOES NOT WORK IF READING TRANSLATED VERSIONS.
 
You can now follow comment additions with the comment RSS feed. This is distinct from the b.log RSS feed, so you can subscribe to one or both as you wish.

Andrew, 10th January 2021, 19:06

I'm working on figuring this out by doing exactly what you said about bit flipping. I made an Excel spreadsheet where I can toggle bits, create the check digit, and output an I25 code via a barcode font.     BTW the last check digit is calculated like the UPC check digit. This is my Excel algorithm: =MOD(-SUM(MID(TEXT(B3,"00000\0"),{1,3,5;2,4,6},1)*{3;1}),10)     Essentially what I'm doing is taking 16 (or 17 it seems) bits, converting it to decimal with leading 0 if less than 5 digits, then adding the UPC style check digit, generating a new code, printing, cutting out and laying on the machine with an old Chai Latte pod.     I'm in Canada and some of the products we have are the same as the European products, complete with same brewing instructions/barcode. In my master Excel sheet I have Canadian branded products with the same Tassimo barcode as reported by others.    Another interesting thing I found was Kraft moved T-Disc packaging to Canada when then closed a USA plant but buying T-Discs from Walmart and Sobeys I have found some are packaged in Canada ('Kraft Foods Canada' and MR as the lot code prefix) and some are not with a lot code starting with LXB prefix (and 'Imported By Kraft Foods Canada' on the package). The plastic bag the boxes come in are different thicknesses as well, the Canadian plastic is thicker and has a slightly different seal/cut than the European ones.

T-bo, 16th January 2021, 22:24

Hello Andrew,   Have you worked on the meaning and the size of each parameter? I tried several barecode following the table in the patent and the tutorial https://wiki.mbirth.de/know-how/hacking/tassimo-barcodes.html.  Th e settings changed but not the ones I wanted.

Add a comment (v0.11) [help?] . . . try the comment feed!
		Your name
		Your email	(optional)
		Validation	Are you real? Please type 00769 backwards.
		Your comment