Moving Forward

The Keurig B40 coffee maker is a masterpiece of engineering marvel. Inside you will find 2 pumps, 3 solenoids, 4 circuit boards, and an exorbitant number of tubes, sensors, and connectors. As a weekend project I’ve taken one of these beasts apart, documented it, and subsequently modified it to solve the complete lack of physical security and auditing, which I consider a serious flaw in the original design. K-cups are a precious commodity, with costs far exceeding that of traditional bulk-purchased coffee, and their usage must be carefully monitored to control costs. Previously we had no way to attribute usage to individuals as to ensure proportional, fair contributions were made to the coffee fund that accurately reflected individual consumption. In this day and age it is frightening to imagine that such a common device lacks the proper physical security interfaces required to properly solve this problem.

To rectify this situation I added an Arduino hardware interface and RFID scanner to track usage of the machine. We had previously distributed RFID devices to all lab members as part of another project to create a keyless entry system, so using RFID was the natural choice. The original brewing interface (push button on the machine) has been secured by being disconnected, and attached to the Arduino, where input is received and processed by the netbook, which performs authentication, auditing, and authorizes brewing.

Disassembly

WARNING: Proceed at your own risk. A coffee maker, by definition, mixes water and electricity, which has generally been considered a bad thing. This coffee maker, in addition to making delicious, bold blends, could easily kill you or permanently damage whatever you might connect to it.

Taking apart the B40 is no simple task. This proved to be one of the most difficult parts of the project. My best advise is to be slow and methodical. Start from the bottom and remove screws, take apart as much of the unit as possible. Once you’ve run out of screws to remove, your goal is to remove the sheath covering the entire unit. The black matte plastic casing will slide off of the entire machine, but 3 plastic clips must be released first. Unfortunately you can not see these clips. When I took the unit apart, the only way I found to release these clips was by inserting a flat-head screwdriver along the upper lip between the matte piece and the top panel, and repeatedly prying. Eventually you’ll hear the clips give way, and the unit will pop open, although it might never be the same again.

In my situation I didn’t complete this procedure without minor cosmetic damage to the plastic edges. Once you remove the sheath you’ll be greeted with a number of wires and circuit boards.

View of the tubing side of the coffee maker.

View of the side containing the main circuit board, with covers removed, and wiring harnesses.

Surprisingly the unit has a total of 4 PCB boards in it. As best as I can identify, their functionality is partitioned nicely:

• Small board sitting above large main board on side of coffee maker – Power conditioning and fuse board, this board receives the main AC voltage and conditions it before it heads to the large transformer.
• Large main board – This board, complete with a PIC microcontroller, handles all the logic and motor / solenoid control. All motors and solenoids are controlled using simple transistor-switch drive circuits. The heater voltage is also distributed using this board in the lower right corner. It appears that the PIC microcontroller exercises some control over heater voltage also, possibly using a triac
• Small board behind main control board – Additional heater control/filtering and power distribution
• Button Interface Board – Handles all the interfacing through the 16-pin connector from the main-board. Also has an op-amp circuit connected to a FPN-07PG pressure sensor, which is used to monitor tank pressure inside the unit

I also went ahead and identified the major connectors on the main controller board for reference:

• J11- Air pump
• J7- Pressure Release Value
• J4- Descaling Value
• J8- Cold Water Level Sensor
• J3- Cold Water Pump
• J15- Boiler Water Level Probe
• J9- Boiler Temperature Probe
• J10- Brew Head Open Switch

While I didn’t directly hack these connections, they might be of interest for future work.

Hacking the Interface

While initially there’s an impulse to hack the entire device and replace the control circuitry entirely, doing so would require a very full understanding of the device’s modes of operation. The Keurig operates to minimize noise, and as such even brewing a single cup of coffee is a multistage process, consisting of pumping fresh water into the boiler, heating the water to a desired pressure, and then expelling the water out through the brewing head, using forced air pressure. Additionally there are many sensors to detect the closure of the brew head, water level, boiler temperature, tank pressure, and button statuses. I decided to take a restrained approach and hack only the upper interface board, replacing human interactions by signals read and written by an Arduino.

The Keurig microcontroller and logic runs on 5V, so an Arduino was an easy choice. Additionally I wanted to make this guide accessible so using a hardware platform familiar to many was a strong consideration. Looking at the interface board, it’s obvious that a single 16-pin connector carries all signals from it to the main controller board. I spent some time and documented this interface below:

Display / Interface Board Connector Pinout

The design decisions that drove this specific layout form an interesting case study. The LEDs are all given dedicated IO lines, due to the PIC’s ability to directly drive them, while the buttons are multiplexed over a single analog line, due to the PIC’s ability to read an analog value. These decisions were certainly motivated by the cost trade offs between running dedicated wires, adding additional ICs, and simplifying the PCB layout. Also of interest is the pressure sensor, a FPN-07PG, placed on this board. The pressure sensor has a proportional current output, and is attached to the tank output of the coffee maker. A quad package op-amp sits on the interface board, along with a reference voltage source, and provides a scaled voltage output from the pressure sensor. Additionally two glued, factory-set calibration pots can be found on the device.

To tap into this functionality I went with the direct approach and simply tapped wires onto the supply signals. LEDs are active low, while buttons pull a common signal wire high, through a resistive divider, which allows the PIC to determine which button was pressed, based on different input voltages. I added wires to the switch solder points, and pre-resistor LED signal wires. Overall I ended up with 9 wires for connection to the Arduino. For inputs to the Arduino, from the LEDs and Buttons, I have Power, Brew Ready, Add Water, and if the 8oz or 10oz button is being pressed. For outputs I have one to the power switch, and the 10oz and 8oz brew buttons. I disconnected the switches for brewing from their original functions, effectively disabling them.

The wires come out of the interface through a hole made on the bottom of the plastic enclosure and snake their way along the back of the unit. They are all connected to the Arduino, which I have placed inside a small plastic bag. While the bag certainly isn’t water tight it should prevent the board from coming in contact with any metal fittings or pump housings, and provides a little bit of splash resistance. The Arduino fits snuggly in the base of the unit, and the USB cable snakes out the hole in the back where power leaves also.

Adding RFID

With the Arduino securely installed, the final step was to add RFID to the coffee maker. I considered wiring the RFID reader directly to the Arduino, but attaching it via a separate USB port gave greater flexibility, which was valued since this is essentially the first-generation prototype of the coffee maker of the future, and the design requirements are likely to shift as exploratory work is done.

Adding RFID was fairly simple. I used Sparkfun’s ID-12 breakout board, and sensor, Luckily the sensor fits snuggly in the brew head, after removing a small bit of plastic for the USB cable. This was honestly the perfect spot for the reader, now you literally tap the top of the machine with your RFID tag, and it will spring to life to do your bidding.

Wrapping Up

This wraps up the hardware section of hacking this device. Next time I’ll be presenting the software side of things, including the Arduino sketch that powers the show, and the scripts running on a Netbook next to the device that provide authentication, logging, and even snap a photo of you as you brew.

Update: Part 2 is now available: read here.