Hacking the Vuse E-Cig to Fully Use Cartridges and Allow Refills

If you've ever used a Vuse e-cigarette, you may have noticed that eventually the unit will say the cartridge is empty and no longer allow you to use it. Unfortunately, the cartridge isn't actually empty but the cartridge keeps track of how much it was used and has a cut off when it reaches a certain value. In this article I'm going to show you three ways to prevent the cartridge from reaching this cut off point. One method is very simple and can be implemented by anyone. The second is more convenient but does require a bit of work initially, and the third I haven't tested. First though, let me give some background on how the unit works. From their website, 

VUSE is the only Digital Vapor Cigarette designed with a SmartLight™ Indicator to always keep consumers informed. The SmartLight Indicator informs on both the battery and Cartridge life. The SmartLight flashes white for two seconds when the Cartridge is getting low. When the SmartLight flashes white continuously, it is time to change the Cartridge.

VUSE is an electronic cigarette designed with "Smart Technology," according to their website. The VUSE Digital Vapor Cigarette contains a VaporDelivery Processor that uses algorithms in the same way a computer does, therefore it is "digital." The VaporDelivery Processor in the PowerUnit, working with the SmartMemory™ microchip in the Cartridge, monitors and adjusts the power and heat delivered to the Cartridge up to 2,000 times a second, ensuring consistently satisfying puffs.

As you can see from the picture above, the main processor (Atmel ATtiny84A) is in the battery pack, but the cartridge also contains an 8 pin eeprom or microcontroller where, among other things, it keeps track of how much it was used. While I don't know for sure how it works since I don't know the technical specifications of the chip used, I do have a pretty good idea what it is doing.

This is a picture of the main processor on the battery pack, this is located at the tip of the unit under the LED's that light up.

And this is the circuit board from the cartridge.

There are three main operations that happen when you take a puff.

1. The Vuse battery will only work with Vuse cartridges, so the cartridge authenticates itself with the battery's processor and this communication (and possibly all communication between the processors) is encrypted. This makes it much harder to eavesdrop on this communication. 
2. Power the heating element, as mentioned above, the battery's processor monitors and adjusts the power delivered to the cartridge using data it receives from the cartridge unit. I won't go too into how this works, but from the numerous patents (excerpts quoted at the end of this article,) of theirs that I've read, it likely monitors the airflow through the battery pack, and the resistance of a fusible link and the heating element located in the container. Keep in mind that the unit is calculating and adjusting the power up to 2,000 times a second.
3. Having calculated how long or intense the puff was, a value is incremented (or possibly decremented) in the cartridge's microcontroller's eeprom. Note that some people think this is a simple puff counter, but I think it is more advanced than that. If you don't know what an eeprom is, it is just memory that can be read and written like a hard drive. An eeprom doesn't need power to retain its contents, unlike other types of memory. 

Step number 3 is the one that we care about. Because the puff value is written to the eeprom at the completion of a puff, the easiest way to keep a cartridge from expiring is to disconnect it quickly as you take your puff. Unfortunately the connector that connects the battery and the cartridge isn't very dependable and will probably end up breaking at some point. So another option is to carefully take the battery compartment apart and rig a tiny push button switch to the tip of the unit that disconnects the negative terminal of the battery. You can see this connection in the image below, the black wire is the negative terminal and it connects just below the LEDs and main processor.

One way for Vuse (R.J. Reynolds Vapor Company) to prevent this would be to increment the counter to the maximum value a puff can be before the puff starts and then once the puff is done, subtract a value if the puff didn't reach the maximum. Eeprom writes take a few processor cycles to initiate and around 5 to 10 milliseconds to complete. This along with the fact that eeproms can only be written to a limited number of time before they fail (usually 100,000+ but could be less on cheaper components,) is why you wouldn't want to constantly save the value during the puff.

There is a third method that others have reported that will allow you to reuse a cartridge and this method is easier than adding a switch and far more convenient than removing the cartridge every time. This is to sever the connection of the LED on the end of the battery pack. I believe it is this LED

I haven't verified that this will work, and you need to be careful not to damage other components, especially since the main processor is on the other side. If it does work though, it is fairly simple and the only downside is that you no longer have the white LED to indicate that the device is in use.


Thanks for reading, if you like it please share. Leave a comment and let me know if this worked for you or if you have another idea. Before I end this with some more pictures (my own and some from anticommander,) check out my YouTube videos. Follow me on Twitter, @gFogerlie, Google+ https://plus.google.com/+GarrettFogerlie and Facebook https://www.facebook.com/garrett.fogerlie and you can subscribe to me on Youtube if you want to keep up to date.

Here is a link to the photos I took during the teardown.

The big pads on the image above are likely ISP pinouts for programming the ATtiny microcontroller. 

Here is the pinout of the main processor. Pin 14 connects to the white LED, and pin 15 to the red.

So here are some extra images. This is the inside of a cartridge.

This is the battery charging circuit located in the battery pack where the cartridge would connect.

 Here are some excerpts from some of R.J. Reynolds Vapor Company's patents.

The present disclosure relates to an aerosol delivery device including a variable output flow sensor. The variable output flow sensor particularly can be a flex/bend sensor wherein output from the sensor varies based upon changes in electrical current flow (e.g., resistance) along an extension of the sensor relative to flexing or bending of the extension resulting from airflow across the extension. The disclosure further provides methods for controlling operation of an aerosol delivery device through utilization of a variable output flow sensor. In particular, control of functional elements (e.g., a heating member, a fluid delivery member, and a sensory feedback member) can allow for real-time changes in the operation of the aerosol delivery device relative to airflow through the device.
Read more: http://www.patentsencyclopedia.com/app/20150282527#ixzz3ojAfcn8F


In various embodiments of the smoking article, the heating connection comprising a fusible link and a heating element is in electrical connection with the power source and the control component when the control body and the cartridge body are engaged with one another. The control component can comprise a microcontroller. Furthermore, the control component can be configured to selectively actuate a first electrical current flow of a first set of conditions from the power source to the heating connection when the control body and the cartridge body are engaged, wherein the conditions of the first electrical current flow are insufficient to initiate heating by the heating element. The first set of conditions can comprise a voltage that is substantially the same as a voltage that defines a working voltage for the heating element and a current flow duration of about 45 milliseconds or less (e.g., about 5 milliseconds to about 25 milliseconds). The working voltage can be about 2 volts to about 6 volts.
Read more: http://www.faqs.org/patents/app/20140253144#ixzz3ojDJLor0


Various embodiments of the smoking article further comprise a current sense resistor, wherein the current sense resistor is adapted to establish an indication of the fusible link status. The control component can be further configured to initiate a command function based upon a cartridge status interpreted from the fusible link status indicated by the current sense resistor. Specifically, the current sense resistor can be adapted to sense a first resistance across the fusible link and a second resistance across the heating element. Sensing of the first resistance can be indicative of an unused cartridge. Sensing of the second resistance in the absence of the first resistance can be indicative of a used cartridge.
Read more: http://www.faqs.org/patents/app/20140253144#ixzz3ojDCT8pV


The control body 80 includes a control component 20, a flow sensor 30, and a battery 40. Although these components are illustrated in a specific alignment, it is understood that various alignments of the components are encompassed by the present disclosure. The control body 80 further includes a plurality of indicators 19 at a distal end 12 of the control body shell 81. Such indicators 19 can show the number of puffs taken or remaining from the smoking article can be indicative of an active or inactive status, can light up in response to a puff, or the like. The indicators can be provided in varying numbers and can take on different shapes and can even be simply an opening in the body (such as for release of sound when such indicators are present).
Read more: http://www.faqs.org/patents/app/20140253144#ixzz3ojE3wHNB


Generally, in use, when a consumer draws on the mouthend 11 of the cartridge, the flow sensor 30 detects the change in flow and activates the control component 20 to facilitate current flow through the resistive heating element 50. Thus, it is useful for air flow to travel through the control body 80 in a manner that flow sensor 30 detects air flow almost instantaneously.
Read more: http://www.faqs.org/patents/app/20140253144#ixzz3ojEccwtz


The control algorithm may call for power to the resistive heating element 50 to cycle and thus maintain a defined temperature. The control algorithm therefore can be programmed to automatically deactivate the smoking article 10 and discontinue power flow through the smoking article after a defined time lapse without a puff by a consumer. Moreover, the smoking article can include a temperature sensor to provide feedback to the control component. Such sensor can be, for example, in direct contact with the resistive heating element 50. Alternative temperature sensing means likewise may be used, such as relying upon logic control components to evaluate resistance through the resistive heating element and correlate such resistance to the temperature of the element. In other embodiments, the flow sensor 30 may be replaced by appropriate components to provide alternative sensing means, such as capacitive sensing. Still further, one or more control buttons can be included to allow for manual actuation by a consumer to elicit a variety of functions, such as powering the article 10 on and off, turning on the heating element 50 to generate a vapor or aerosol for inhalation, or the like.
Read more: http://www.faqs.org/patents/app/20140253144#ixzz3ojETq400


In particular embodiments, the smoking article can include components that define an electrical circuit whereby a control component is configured to controllably deliver a low power pulse from the power source to the heating connection according to one or more defined algorithms. As a non-limiting example, the control algorithm can include pulse width modulation, which can be based on comparison of a battery voltage with a lookup table. As a further non-limiting example, the control algorithm can include a constant voltage feedback loop, such as through utilization of heater voltage measurements. Specifically, in various embodiments of the smoking article, appropriate wiring can be included such that a cartridge engaging a control body defines a closed electrical circuit through which the control component can controllably deliver a low power pulse (as well as a higher power pulse). The low power pulse can be defined as an electrical current that does not exceed the limits of a fusible link as described herein. By contrast, the higher power electrical current that defines a working status of the heating element (i.e., wherein the heating element heats to a temperature sufficient to vaporize the aerosol precursor material) can exceed the limits of the fusible link.
In some embodiments, a low power pulse can have a voltage, a current, or both that is substantially similar to the same property of the higher power pulse, and pulse power can be defined by current flow duration. In particular, time can be adjusted such that the average power delivered to the circuit is constrained appropriately. In certain embodiments, the fusible link can exhibit a resistance that is lower than the resistance of the heating element. In some embodiments, the fusible link and the heating element are provided in parallel, a majority of the current entering the closed circuit can preferentially flow through the fusible link. When the duration of the electrical current flow is sufficiently long, the lower resistance fusible link will fail and thus allow all of the delivered current to pass through the heating element. Depending upon the type of material from which the fusible link is formed, a sufficiently long current flow time can be about 50 milliseconds or greater or about 100 milliseconds or greater, particularly about 50 to about 500 milliseconds. In various embodiments, the heating element can require that the current be applied for a time of about 0.5 seconds or greater or about 1 second or greater, particularly about 1 second to about 4 seconds for sufficient heating to occur. Therefore, in some embodiments, conditions defining a low power pulse can comprise a voltage, a current, or both a voltage and a current that is substantially the same as the same corresponding voltage, current, or both that is utilized for normal functioning of the heating element, and can also comprise an active flow unit time of about 45 milliseconds or less or about 25 milliseconds or less, particularly about 5 milliseconds to about 25 milliseconds.
In other embodiments, the low power pulse can be defined by a current and/or voltage that can be less than the current and/or voltage that define the working status of the heating element. For example, the electrical current that defines a working status of the heating element can exceed the current delivered by the low power pulse by a factor of 2 or more, 5 or more, or 10 or more. A voltage that defines a working voltage for the heating element can be about 2 volts to about 6 volts, about 2.5 volts to about 5.5 volts, or about 3 volts to about 5 volts. The working voltage is the voltage at which the heating element sufficiently heats to form the desired amount of aerosol during a current flow time as described above.
Read more: http://www.faqs.org/patents/app/20140253144#ixzz3ojFr59Bv