A couple months ago Chris suggested we hack a vending machine so that you could use non-traditional input to make it serve beverages. I had some experience converting a machine to free mode during our Rainfall project so it didn’t seem too hard. Vending machines are readily available on Craiglist but I made sure to ask amongst friends to avoid the hassle. Craig offered the old vending machine that was sitting in his datacenter, “as long as it comes back eventually and more awesome”. Easy.

I borrowed Ryan’s pickup to haul the machine. Getting the soda machine into the truck (499lb. empty) was easy since the datacenter has a forklift. Getting it out of the truck was much harder since the coworking space I was working out of just has project managers.

Craig had the original manual which helped a bit and the actual machine schematic is stuck to the inside (slightly different from the manual). It has 2 control relays: the “credit” relay and the “time-delay” relay. These relays connect to a 6 pin harness that runs the entire machine. AC is split across 2 pins entering the relay box and the relays complete circuits using the other 4 pins. The relay box also features a 9 pin J-plug connector used by the coin acceptor. This J-plug design is a standard feature of many vending machines; it allows you to swap in coin and bill acceptors from different manufacturers. You set the price of the item using DIP switches on the coin acceptor and when it receives the correct amount, it pulses the #3 pin for 250ms which latches the machine’s relays closed. I still don’t fully understand the vending cycle, but I knew what control signals had to go where to trick the machine into vending. I took extra care to make sure I knew which side of each element should be routed to common and which to hot of course.

I wanted to retrofit the machine so it could be controlled both remotely and directly. Instead of replacing all of the control hardware, I used a relay board to piggy back the original wiring. 1 relay would fake the credit signal while 5 relays would fake button presses for each of the 5 possible selections. I found the opto-isolated 8 channel relay board pictured above which can handle AC for less than $20. It arrived from Hong Kong in a little over 48 hours via DHL.

For my proof of concept, I just wanted to get the machine on the network. I plugged the relay board into an Arduino with an ethernet shield. I wired the first 5 relays by splicing them to the normally open side of each of their selection switches. I found it interesting that the common line for the switches is actually daisy chained through the normally closed side of the switches. This makes sure that only one selection at a time can activate. For the sixth relay I ran a line in the original harness back to the relay box to fake the credit signal. Controlling the relays is as simple as pulling a digital pin low on the Arduino. I wrote a simple server that lived on the Arduino and vended based on buttons you pressed in your phone browser.

The final machine was going to need to talk to our NinjaTel cellphone network so I decided the best controller to use would be the IOIO. An IOIO lets you write Android apps to control the microcontroller’s pins. Pictured above is the board after I populated all of the 5V tolerant pins. I replaced the Arduino with the IOIO and wrote a test Android app that used OPEN_DRAIN mode to trigger the relays. The IOIO user group is incredibly helpful if you run into trouble.

The original florescent fixture in the machine blew the replacement bulb I installed so I did the only reasonable thing: rip it out and stuff in 5 meters of individually addressable RGB LEDs. The LEDs required me to mount a cheap computer power supply to provide enough current at 5V. This was also used to power the IOIO which charges the attached phone. The IOIO is a 3.3V device so we needed pull-up resistors on the data and clock pins to talk to the LED strip.

The final Android server and client apps were written by Chris and used AllJoyn (our phone sponsor) to communicate between the phone and the machine. Unfortunately for most of the con, the wifi was so congested that no one could talk to the machine. We had filled it with random Asian market canned beverages, but very few people got to taste the power of the lychee. Before Defcon, we pulled the coin acceptor so the vending machine could only be remotely controlled.

The final task of the machine was to act as our shuttle bus stop marker for the Ninja Party. Reports started rolling in at 2AM that it had gotten fairly jacked up, but no one apparently witnessed it. We found it the next day with the marquee stolen and a massive dent in the upper corner, but I’m almost certain it still works the same. They kindly left all of the electronics intact.

I’ve got a few more ideas I’d like to try out so I’m sure this won’t be the last vending machine I end up hacking.