August 7, 2021

Hacking the Fresh Roast SR800 home coffee roaster

This is just a quick "recon mission" to get our brain thinking about what the possibilities my be for hacking the SR800

Open 'er up

This will require a tool to remove T15 Torx security screws. I had such a bit in a set of security drivers, but had to order a special tool for the SR800. Two of the screws are deep in holes and require a dedicated Torx T15 security driver. I found one on Amazon and had it in hand the next day. After removing the 8 screws (6 readily visible and 2 in recessed holes) the bottom cover comes off easily with nothing attached. Now you get to look at the guts.

Here is a link to a nice T15 that will work:

The brain of the unit is a PIC16F690 chip. Nearby is TI chip labeled HC164. This is an 8 bit shift register (an IO expander almost certainly). The PIC can run off of from 2.0 volts to 5.5 -- but the clock rate is limited at lower voltages. At 2.0 volts, 8 Mhz is the maximum.

Two wires vanish into the air plenum (the thermocouple to sense temperature). Six wires connect the logic PCB to the power PCB. Two of these are labeled on the power PCB as ground (black) and 12V (blue). The other four are yet to be determined.

My guess is that there is local regulation of a 3.3 volt supply from the 12 volts on the logic board, but this is just a guess.

Two TO220 power devices are readily visible on the power board. One is a BTA16-600B, which is an ST part. This is a "logic level 16A triac" with a 600 volt rating. The other is a BTA08-600C, which is also an ST part, another logic level triac, this one rated for 8 amps.

So a person might guess that PWM is being used to control both the fan and the heater. The bigger 16 amp triac is probably for the heater and the 8 amp triac is for the fan. It is somewhat suprising they don't use the same 16 amp part for both, but they must save enough money on the 8A part to make using two different parts worthwhile.

There is another 8 pin surface mount part on the power board. I can't get a good angle to read the part number without removing the power board, which I'm not ready to do today. My bet is that this is the regulator for the 12 volt power supply.

So, that is all I can learn from a quick peek. Sadly there is no hidden but unpopulated USB connector. I don't even see any pads that might be a serial console or JTAG or anything of the sort. I had hoped for an STM32F103 ARM chip with an SWD connector exposed and no security fuse blown, but no such luck.

All back together and working fine. I have only two tips on that. One it to realize that the screws thread into plastic, so turn them in reverse to find the original threads, then tighten only to "snug" to avoid stripping the plastic. The second tip is that the bottom is two pieces of plastic. Get them both into position before installing any screws.

Remember, no user serviceable parts are inside. If you don't know what you are doing, don't. Finally - don't do any of this with the machine plugged in. Caveat emptor.

Have any comments? Questions? Drop me a line!

Tom's coffee pages / tom@mmto.org