This repository contains my progress reverse engineering the Breville/Sage Barista Touch espresso machine.
The target of this is to either find out how to control the machine or to find out how to replace the control board with a custom one.
Because I replaced my machine by a proper dual boiler.
I bought this machine defective for as less as 50 Euro and thought I won't resell it and tinker around with it instead.
Also, this machine has a few faults which could be overcome with a different firmware or controller.
Some of those are:
- Better temperature controlling
- Better temperature options (Degrees instead of low, medium and high)
- More drink customization options
- WiFi/Bluetooth connection (to control the machine from a phone, connect with a scale etc)
- Better grind timings (Currently only seconds possible)
And most importantly: because its fun
Starting with the main control board.
This should give us a good overview of the hardware running this machine.
The control board is behind the display so you need to remove the front panel to access it.
The control PCB contains the following (major) parts on the front:
| Number | Part |
|---|---|
| 1 | STM32F429BIT6 microcontroller |
| 2 | MX29GL256FHT2I-90Q 256Mb NOR Flash |
| 3 | AS4C8M32S-7TCN 256Mb SDRAM |
| 4 | TDK piezo buzzer. Something like this |
| 5 | Standart 8.0Mhz Oscillator |
| 6 | 40 pin FPC connector for the display |
| 7 | Mysterious 4 pin pressure sensor (see below) |
| 8 | 4 pin port without markings (see below) |
| 9 | 4 pin UART port (see below) |
| 10 | 3 pin connector for the grind-setting encoder |
| 11 | 26 pin connector going to the power board |
| 12 | 20 pin debug port. Probably used by the manufacturer to flash the firmware |
| 13 | Power button PCB with two white LEDs |
| 14 | Soldered CR2450 battery. Connected to VBat of the STM32 |
And on the back:
| Number | Part |
|---|---|
| 1 | ST M93C66-W Serial access EEPROM |
| 2 | MAX4460 Amplifier |
The display is a 4.3" 480x272 TFT LCD with capacitive touch screen controlled by a Sitronix ST16331.
The display is connected to the main PCB via a 40-pin FPC connector.
It is labeled as CTM480272T16-D which can not be found on the internet.
The closest I could find is the Adafruit 4.3" 40-pin TFT Display.
I confirmed the pinout only by checking that the three ground-pins on 3, 29 and 36 are actually connected to ground. Other display have ground on different pins so I'm pretty positive the layout is correct.
On the PCB there is an UART port which is not soldered.
Attaching cables and connecting it to my logic analyzer gave me - nothing. Bummer.
The only thing visible is some random gibberish data on the RX line.
Those data are also visible while the machine is not connected to mains - possibly because of the backup battery.
The same applies to the other port number 8
This needs more investigation. we should be able to get something out of it
There is a sensor on the PCB which was connected to a hose leading to the venturi valve.
It is labeled F9520 and googling this leads me to the Amsys SM9520A a low differential pressure sensor die.
This could be wrong tho
The power PCB is located at the back of the machine behind the power-supply.
Sorry it's upside down.
It contains the following cables:
| Number | Marking | Function |
|---|---|---|
| 1 | TAB18 | Third valve (right) |
| 2 | TAB19 | Single valve (bottom) |
| 3 | TAB15 | Pump |
| 4 | TAB9 | Bean hopper switch |
| 5 | TAB7 | Neutral |
| 6 | TAB21 | Grinder motor |
| 7 | TAB22 | Grinder motor |
| 8 | TAB8 | Phase |
| 9 | TAB16 | Second valve (center) |
| 10 | TAB17 | First valve (left) |
| 11 | TAB20 | Thermojet Triac feedback? |
| 12 | TAB10 | Thermojet Triac gate |
| 13 | CON7 | Airpump |
| 14 | CON3 | Watertank reed switch (left pin GND) |
| 15 | CON6 | Flow meter (center pin GND) |
| 16 | NTC1 | Thermojet NTC (Left pin 3.3V) |
| 17 | CON2 | Control voltage from PSU (second pin 3.3V, third pin from left GND) |
| 18 | CON4 | Steamwand position switch (left pin GND) |
| 19 | CON5 | Portafilter switch (left pin GND) |
| 20 | CON9 | 26 pin connector to control PCB |
| 21 | CON8 | 6 pin pitcher switch and NTC (second pin 3.3V, right pin GND) |
| None | TAB23 | Tamping motor on Oracles? |
| None | DB2 | Second boiler BDB and Oracles? |
There are some optical isolators (marked ISOx). Those are either Everlight EL3063 or OnSemi MOC3052-A isolated Triac drivers.
Then there is IC1, IC2 and IC6. Those are Everlight EL817 opto couplers.
Here is what each part is responsible for:
| Triac | Isolator | Function | Control pin |
|---|---|---|---|
| TA1 | ISO1 | First valve (left) | 11 |
| TA2 | ISO3 | Pump | 6 |
| TA3 | ISO5 | Second valve (center) | 12 |
| TA4 | ISO6 | Third valve (right) | 10 |
| TA5 | ISO7 | Single valve (bottom) | 9 |
| TA6 | ISO8 | Grinder | 5 |
| Under heatsink | ISO4 | Thermojet | 8 |
On the left side there is a heatsink with 3 cables going in (red, purple and yellow).
Under the heatsink there is a simple LittelFuse Q6015L6 15 Amp Triac.
This controls the thermojet. Applying power to the yellow cable fires the heater.
The 26 pin connector is the main interface between the control PCB and the power PCB.
At this point I figured the following pinout:
| Pin | Function |
|---|---|
| 1 | Connected to NTC3 which is not populated |
| 2 | Fifth pin in pitcher seitch/NTC |
| 3 | Fourth pin on pitcher switch/NTC |
| 4 | Third pin on pitcher switch/NTC |
| 5 | ISO8 (Grinder) |
| 6 | ISO3 (Pump) |
| 7 | Airpump PWM input? |
| 8 | ISO4 (Thermojet) |
| 9 | ISO7 (Single valve bottom) |
| 10 | ISO6 (Third valve right) |
| 11 | ISO1 (First valve left) |
| 12 | ISO5 (Second valve center) |
| 13 | IC1 (Output) Grinder feedback |
| 14 | IC2 (Output) Bean hopper feedback |
| 15 | Flow meter green cable |
| 16 | Portafilter switch |
| 17 | Watertank reed switch |
| 18 | Steamwand position switch |
| 19 | First pin on pitcher switch/NTC |
| 20 | NTC thermojet |
| 21 | First pin of PSU plug |
| 22 | IC6 (output) Power feedback? |
| 23 | Probably flow meter |
| 24 | VDD 3.3V |
| 25 | GND |
| 26 | VDD Unknown (Optocouplers anode) |
Finding out more pins should be pretty easy once I removed the power PCB.
The 20 pin header is accessible by removing the top panel and opening the rubber lid.
This port is very interesting and should allow us to dump and reflash the firmware.
At this point I figured the following pinout:
| Pin | Function |
|---|---|
| 1 | ??? |
| 2 | VDD 3.3V |
| 3 | ??? |
| 4 | GND |
| 5 | ??? |
| 6 | GND |
| 7 | ??? |
| 8 | GND |
| 9 | ??? |
| 10 | GND |
| 11 | ??? |
| 12 | GND |
| 13 | ??? |
| 14 | GND |
| 15 | ??? |
| 16 | GND |
| 17 | ??? |
| 18 | GND |
| 19 | ??? |
| 20 | GND |
But the MCU needs 3.3V and the airpump 12V.
We do have two options now:
- Reverse engineer the firmware and flash a custom one
- Remove the PCB and add a different.
The hardware we have is pretty powerful.
We have a 32bit ARM Cortex M4 with up to 180Mhz, 256Mb RAM and 256Mb flash.
You ever thought you could say that about your coffee machine?
This requires all pins connected to the STM32 to be traced down and documented to be able to write a whole new firmware for the STM32.
This might take some time as the PCB is a multi layer PCB.
Anyway, I'm not that skilled with STM chips and its cube IDE.
I think this is the way to go.
Unfortunately the display is not compatible with Raspberry Pis or other SBCs.
Adafruit does have a board which should be compatible but it costs 40$ and I'm not sure if it is worth it.
I decided to go with a 4.3 inch QLED DSI display from Waveshare because its costs pretty much the same as the adapter and you can just plug a raspberry to the back of it.
Also it will be pretty awesome.