36

In hope this is appropriate

I have a Bosch Tassimo TAS2002EE coffee maker that uses T-Disks. Those contain coffee/milk/something else, and a barcode that is supposed to tell the machine how to deal with the disk.

What I want to do is understand the barcode and come up with some different barcodes that would be accepted as valid and let me adjust e.g. drink volume.

At first I wasn't able to find any decent information about these barcodes, among the top Google hits were things like this rather useless rant. Surprisingly, when searching for pictures of T-Disks (in order to study more barcodes), I stumbled upon this useful post: Hacking the Tassimo - Part 2: Breaking the Code (archive), which also links to this T-Disk-related patent, in which there is a table explaining the controlling bits. While this was quite promising, it resulted in nothing, as the blog author found out himself, too. (Part 3 archive)


On top of the information from the links above, here's what I found out myself.

The barcode uses the Interleaved 2 of 5 symbology and 6 digits. The last digit is the check digit calculated according to the UPC Check Digit rules.
Actual barcodes with the checksum removed:

Barcode Product Output, ml Barcode binary
06409 coffe créma 150 00011001 00001001
06178 espresso 80 00011000 00100010
63735 milk for latte (big disk) ? 11111000 11110111
06182 milk for cappuccino (small disk) ? 00011000 00100110
06665 hot chocolate ? 00011010 00001001
07879 service disk 200 00011110 11000111

The service disk is used for cleaning, it makes hot water at 60° C flow straight through without any brewing time.

Using a barcode printer, I tried to modify the Coffe Créma barcode to give 300 ml (the max amount from the patent). I did some really extensive testing, printing out and feeding the machine a handful of barcodes, and it would seem there are six bits in the barcode, not four, that control the amount. The data is available here at Google Docs. The 6-bit range in question is in the middle: last 3 bits of the first byte and first 3 bits of the second byte (big-endian). Because Google Docs don't support in-cell colours, there is also a more nicely coloured Excel file uploaded here at Google Drive.

So I identified two 6-bit sequences that resulted in 300 ml for Crema.
For the sake of interest, I took one of the sequences and put it into the respective place of the original Espresso barcode. And there it is, I got 300 ml of Espresso.

While this was sort of a success (I'm now able to produce barcodes with correct volumes for the drinks I'm interested in), I'm still completely lost as of exactly how this works. As you can see from the experiment table, the pattern is rather fuzzy, and there are entries that give same volume from different combination of bits. I'm also not sure I'm getting the same brewing parameters with the barcodes I made.

Please share your ideas on how to understand this further.

6
  • 1
    According to the second blog post you linked to, the last digit is a UPC-style check digit, and should be dropped before converting to binary (and recalculated for any modified codes). You just happened to be lucky that you two-bit change resulted in a number that passed the check. Mar 20, 2014 at 18:35
  • 1
    Note that the UPC check digit scheme is designed such that, for an even-length code that already ends with a correct check digit, repeating the calculation always gives zero. That is, for a correctly checksummed (even-length) code, (sum of even digits) + 3 * (sum of odd digits) ≡ 0 (mod 10). Mar 20, 2014 at 18:40
  • @IlmariKaronen Yes, you are rigth, I overlooked this. When I removed the check digits all went rather well. Please see the edit.
    – GSerg
    Mar 21, 2014 at 15:37
  • Looking at your table, i see you never flip the last bit of the first byte in your crema experiments. So this may or may not change anything. Also, the patent mentions different cartridge charges - with soak, without soak - which may affect the volume of water in the cup, as well as steam/no steam, which isn't mentioned in the patent. Last, the blog author mentions that american cartriges seem to have high first digits while europeans have zero; this might mean some bits have no effect on the apparatus, but serve as licensee/vendor identification. Mar 22, 2014 at 12:11
  • Just wanted to point out that this thread is still relevant wiki.mbirth.de/know-how/hacking/tassimo-barcodes.html did a great job, but might have noticed that the barcode might be inverse, or that a bit flip makes it inverse maybe? Edit: This might be relevant: patents.google.com/patent/US7231869?oq=coffee+barcode Search for "table 3" in the above link Jan 29, 2019 at 0:09

8 Answers 8

6

Consider the code that you were able to modify. The decimal representation of your modified code is 065375.

The checksum of 064095 =  3*0 + 6 + 3*4 + 0 + 3*9 + 5 = 50 (≡ 0 mod 10).
The checksum of 065375 =  3*0 + 6 + 3*5 + 3 + 3*7 + 5 = 50 (≡ 0 mod 10).

So it seems that this disk was accepted because the checksum matched, while your other disks weren't taken because of the wrong checksum.

Now, if i remove the checksum digit from the decimal numbers, and convert them to binary:

06409 = 0001 1001 0000 1001
06537 = 0001 1001 1000 1001

Unfortunately, that doesn't match anything from the patent volume table, even if i compare the larger volumes (170 / 230 to account for water that stays in the disc), or smaller volumes (130 / 190). - my two numbers have only one bit that's different, and each combination from the table needs more than one different bit. But, there's no guarantee for the volume table in the machine being identical to the one in the patent.

I'd try to take the above codes, flip one bit after another in each of them, calculate the decimal number, tack on the checksum digit, and print that to barcode, then check what happens:

$ ./bitflip 0001100100001001
1001100100001001 391771
0101100100001001 227933
0011100100001001 146012
0000100100001001 023139
0001000100001001 043618
0001110100001001 074339
0001101100001001 069212
0001100000001001 061537
0001100110001001 065375
0001100101001001 064736
0001100100101001 064415
0001100100011001 064255
0001100100000001 064019
0001100100001101 064132
0001100100001011 064118
0001100100001000 064088

If all these barcodes are accepted, they should produce different results which should give a hint at which bit has which meaning.

If you want to play with some other bit combinations, here's the source to my bitflip program (it's not the cleanest code, and it will produce strange results if you throw anything but binary digits at it, but it will do the job):

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

int main(int argc, char **argv) {
    int pos, pos2, binval, checksum;
    char oldbit;
    char buf[10];

    if (argc!=2 || strlen(argv[1]) != 16) {
            fprintf(stderr, "Need a 16 bit binary value\n");
            exit(1);
    }
    for (pos=0; pos<16; pos++) {
            oldbit=argv[1][pos];
            argv[1][pos]=(oldbit == '1' ? '0' : '1');
            binval=0;
            for (pos2=0; pos2<16; pos2++) {
                    binval=(binval<<1) | (argv[1][pos2]=='1');
            }
            sprintf(buf, "%05d", binval);
            checksum=
                     3*(buf[0]-'0')
                    +  (buf[1]-'0')
                    +3*(buf[2]-'0')
                    +  (buf[3]-'0')
                    +3*(buf[4]-'0');
            checksum=10-(checksum%10);
            if (checksum==10)
                    checksum=0;
            printf("%16s %5s%d\n", argv[1], buf, checksum);
            argv[1][pos]=oldbit;
    }
}
0
6

Costa

  • Costa Americano (220ml) 297615 (single T Disc)
  • Costa Cappuccino (215ml)
    • Costa Espresso for Cappuccino & Latte 022095
    • Creamer (S) for Cappuccino 061827
  • Costa Caramel Latte (320ml)
    • Costa Espresso for Cappuccino & Latte 022095
    • Creamer (L) for Caramel Latte 637350

Cadbury

  • Cadbury Hot Chocolate (265ml)
    • Cadbury Hot Chocolate 066655
    • Creamer (S) for Cadbury 061827

Gevalia

  • Gevalia Kaffe Espresso 849838 (Professional T-Disc apparently not compatible with home brewers)
  • Gevalia Kaffe Espresso 594912
  • Gevalia Kaffe Caramel Espresso (60ml) 674270
  • Gevalia Kaffe Signature Blend 642262

Maxwell House

  • Maxwell House Morning 648035 (Large 12floz serving 355ml?)

Starbucks

  • Starbucks Espresso Roast 596831

Carte Noir

  • Carte Noire Cappuccino (190ml)
    • Carte Noire Expresso Intense 061780
    • Creamer (S) for Cappuccino 061827
  • Carte Noire Petit Dejeuner Classic (215ml) 297615 (single T Disc)
  • Carte Noire Espresso Classic (60ml) 061780 (single T Disc)

Second Cup

  • Second Cup Chocolate Syrup (195ml) 676458
  • Second Cup Espresso Forte (65ml) 594592

Nabob

  • Nabob Breakfast Du Matin 683050

Milka

  • Milka Hot Chocolate (245ml)
    • Milka Chocolate 066655
    • Creamer (S) for Milka, Marabou & Freia 061827

Tassimo Brand

  • Creamer for Cappuccino (215ml) 634793
  • Creamer for Latte (250ml) 636070
  • Creamer for Sweet Latte (200ml) 634793

Others

  • (Twinnings?) (Creamer / Milk) for Chai Latte 674478
  • Twinings English Breakfast Tea (195ml) 032872 (single T Disc)
  • Corner Coffee House Peppermint Chocolate Syrup 676458
  • Tea Bar Peach Iced Tea 349130 (Is this unheated water?)
  • Tazo Awake Black Tea 699556
  • Suchard Hot Chocolate (195ml) 047852 (single T Disc)
  • Kenco Medium Roast (195ml) 297615 (single T Disc)

Notes:

  1. Carte Noire Espresso Classic 60ml + Carte Noire Expresso Intense from Cappuccino 190ml share barcodes that may imply Creamer for Cappuccino = 130ml?
  2. Kenco Medium Roast 195ml + Carte Noire Petit Dejeuner Classic 215ml share same barcode even though 20ml difference?
  3. Creamer for Capuccino and Creamer for Cadbury has the same barcode although different foil labels.
  4. Costa Cappuccino and Costa Caramel Latte use the same Costa Espresso for Cappuccino & Latte T Discs
0
6

First a thought regarding the volumes that don't seem to line up. The first link in the Q discusses purge and charge sections - these will contribute to the volume and it's possible that the table of volumes assumes some contribution from these processes that may not be the minimum

Second - some more data for you:

We have a water dispenser disc (it replaces the output spout so it's not very useful; I use a washed-out Suchard chocolate disc for water). The water disc has 4 selectable barcodes for 4 different volumes (150, 250, 350 and 450 ml). I can't get anything online or android to actually read the stupid things though. I can post a scan if anyone's interested, and I'll keep trying, but it doesn't look like it's got the start code according to wikipedia.

Edit: scanned water dispenser disc

Hot water T-disc

Also, over summer the UK website was giving away overlays to make the normal drinks with cold water. I haven't tested them, but they also don't fit the ITF spec according to wikipedia.

╔═════════════╦════════════════════════╦════════════╦══════════════════════════╗
║ Barcode     ║ Product                ║ Output, ml ║ Binary (excl first/last) ║
╠═════════════╬════════════════════════╬════════════╬══════════════════════════╣
║   ??????    ║ Water                  ║ 150        ║                          ║
║   ??????    ║ Water                  ║ 250        ║                          ║
║ 0 690872 6  ║ Water                  ║ 350        ║ 1010 1000 1010 1011 1000 ║
║ 0 191694 6  ║ Water                  ║ 450        ║ 0010 1110 1100 1100 1110 ║
╚═════════════╩════════════════════════╩════════════╩══════════════════════════╝

The above barcodes were read with Barcode Scanner for Android.

5
  • 1
    Thank you for contributing! As the OP is almost a year old, we don't know if anyone is interested in this right now. But as the site is for collecting knowledge as well, someone in the future might be interested in the bar codes. So, please post the scans, even if there probably won't be any immediate reaction. Feb 19, 2015 at 14:59
  • @GuntramBlohm, done - the OP user has been active on SO in the last day so hopefully they'll notice.
    – Chris H
    Feb 19, 2015 at 15:35
  • Yes I did notice! Thanks for the info, although it's not refreshing to learn that barcodes are allowed to be invalid in the first place. As for the status update: I would still really like to know exactly what is going on, but after some time I grew tired of printing and feeding barcodes, so I put it aside, and have been since using a 330ml barcode I came up with during the testing (one of the two that gave this volume). I have no idea how wrong the brewing instructions ended up to be, but it does its job in principle.
    – GSerg
    Feb 19, 2015 at 16:42
  • I'm no expert but I can't figure out what these barcodes are - they're not the same code as the normal discs and seem to have 4 line weights. I can't even spot a common pattern for start/stop marks. No wonder none of the online or android readers had much luck. I was hoping these codes might help by being simpler instructions, but apparently not.
    – Chris H
    Feb 21, 2015 at 16:07
  • There are two water dispenser T-Discs, the one in the image is the non Interleaved 2 of 5 version for a different set of machines. The Interleaved 2 of 5 version of the Water Dispenser disc is Green, and it's barcodes do scan normally. I'll see if I can did out my data and add it as an answer to help gather more info.
    – Mark Booth
    Jun 23, 2015 at 11:08
4

I've got a lead!!

I've looked over a lot of the data, and I think that people are getting distracted by the decimal representations of the binaries. We need to just focus on the binaries. I first got that idea from a mysteriously precise comment on the chapman consulting post. Seems like someone with some inside knowledge, possibly.

GSerg, the OP, posted a great Google spreadsheet of experiments with the binaries.

My hypothesis is that there are bit ranges dedicated to certain functions. For instance, I've isolated the liquid volume to a particular three bits (8 settings). However, I think that the liquid volume changes based on a different bit-ranges.

I think there are modes, and each one has it's own temperature range.

Here is a copy of the OP's spreadsheet, with spacing on the binaries to isolate where the important volume bits are.

https://docs.google.com/spreadsheets/d/1Qpj4KC9xK5Dr7VY5HoNWr9azHKRl94jKABDwTKTbUfg/edit?usp=sharing

I think this is the first direct correlation of barcode to function that we have.

We are closer than ever to cracking this! With a bit more data, especially temperature data, I think I could figure it out.

1
  • 1
    I've bought a temperature probe, I just need to hook it up to a data logger and I should be able to use it to get some metrics of not only temperature, but also pump and purge rates. All I need now is the time to do it.
    – Mark Booth
    Jun 23, 2015 at 11:14
2

First of all, I only wanted to post a comment, but the reputation system wouldn't let me, because I'm new here.
My research showed the following: For this project we have do distinguish between two types of coffee machines. The first one reads the barcode on the side of the T-Discs. This code is formatted using Interleaved 2 of 5.
The other type of machine (I think it's only the T43xx, and the T55xx) reads the barcode from the front of the T-Disc, as shown in the picture from User perror. We already discovered, that this code is kind of invalid, all scanner apps and online decoder I found couldn't convert it into readable text.
During my research I discovered a german forum post, telling that's an invalid UPC-E. However I wasn't able to photoshop the missing parts on it, namely the start and end sequenz.
In the same forum, one comment below my link there is a guy guessing that these codes refer to an internal memory with hardcoded brewing instructions. In my opinion that's wrong, because in this case tassimo couldn't update their disc lineup after the launch of the machines, and in my region they did this with the milk-discs.

1

I check this link http://blog.chapmanconsulting.ca/post/2007/12/02/Hacking-the-Tassimo-Part-2-Breaking-the-Code.aspx I think it a error for Beverage volume. I check this two parameter:

3.Beverage volume (Bits 4,5,6,7)

4.Flow rate (Bits 8,9,10).

You need to combine this two parameter to have the volume of the brevage. The bits 4-7 it like time the water pumpe work and 8-10 the flow rate. So I think you have max 15 sec for water pump Bits 4-7 1111 = 15 and flow rate is increment by 12.5% 111 = 7 7(111)=100% 6(110)=87.5% 5(101)=75% 4(100)=62.5% 3(011)=50% 2(010)=37.5% 1(001)=25% 0(000)=12.5% It only a theory it need to be confirm.

0

This seems like a complete mapping of the bits:

http://wiki.mbirth.de/know-how/hacking/tassimo-barcodes.html

2
  • The notice before the table says that the mapping was taken from the patent description, and it is not entirely clear how it used in the actual barcodes. We have already considered the patent description (see the question text).
    – GSerg
    Dec 13, 2015 at 9:51
  • Someone sent me this image a few days ago. I'll add this information to my wiki page soon. However, just from looking at the ICE DISC's codes, I doubt this is the correct encoding as the bits for temperature (according to that image) are 10 and 11 for those instead of 00.
    – mbirth
    Apr 14, 2016 at 13:07
0

The original referenced blog has gone, however there is a lot of useful information available at HeyRick's blog and later again on HeyRick's Blog a lot of this appears to be the patent repeated but there is some further testing included:

Bit     Parameter           Description
0 & 1   Water temperature   00 = cold
                            01 = warm
                            10 = 83°C.
                            11 = 93°C.
2 & 3   Cartridge charge    00 = fast charge with soak
                            01 = fast charge without soak
                            10 = slow charge with soak
                            11 = slow charge without soak
4, 5, 6 & 7 Beverage volume 0000 = 50 ml
                            0001 = 60 ml
                            0010 = 70 ml
                            0011 = 80 ml
                            0100 = 90 ml
                            0101 = 100 ml
                            0110 = 110 ml
                            0111 = 130 ml
                            1000 = 150 ml
                            1001 = 170 ml
                            1010 = 190 ml
                            1011 = 210 ml
                            1100 = 230 ml
                            1101 = 250 ml
                            1110 = 275 ml
                            1111 = 300 ml
8, 9 & 10 Flow rate         000 = 30%
                            001 = 40%
                            010 = 50%
                            011 = 60%
                            100 = 70%
                            101 = 80%
                            110 = 90%
                            111 = 100%
11 & 12 Purge               00 = slow flow/short period
                            01 = slow flow/long period
                            10 = fast flow/short period
                            11 = fast flow/long period

Apparently there is a difference between EU and non-EU models too.

Not the answer you're looking for? Browse other questions tagged or ask your own question.