McDonald’s Franchises Hack McFlurry Machines to Bypass Sanitization Process

McDonald’s ice cream machines break all the time. They are broken so often that their brokenness has become a meme, with McDonald’s tweeting last year “we have a joke about our soft serve machine but we’re worried it won’t work.” Podcasts have been made about the broken machines and a software developer has written a bot that estimates that, at any given time, roughly 10 percent of all McDonald’s soft serve machines are broken.

They also make people sick. Soft serve ice cream machines are a breeding ground for disease if they aren’t properly maintained. A 2005 NBC News investigation revealed just how dirty those machines can be. Improved machines released after the investigation made the ice cream machines safer, but only if they’re maintained, which can be expensive and time consuming. Some store managers and repair techs have learned a trick that bypasses the machine’s safety mechanisms. This has led to dirty machines that can make people sick.

McDonald's McFlurry and soft serve machines, made by the Taylor Company, are part of what Wired called a "milkshake shakedown" in an investigation published last month: "sell franchisees a complicated and fragile machine. Prevent them from figuring out why it constantly breaks." The machines break because there are a lot of moving parts, and the machines need to be able to handle cold ice cream but also have to withstand heating cycles that clean the devices. The software that powers the machines is also often faulty and, as laid out in a lawsuit filed against Taylor this month, consists of “flawed code that caused the machines to malfunction.”

There is, however, a way to get certain Taylor ice cream machines that are used at McDonald’s back online quickly using a hardware hack that Taylor has classified as a “very serious issue” in an internal service bulletin, Motherboard has learned. Maintenance employees can install a “jumper,” a small metal or plastic bracket, on some of the electric pins on the back of the machine to bypass a software system that makes the machine inoperable if it hasn’t been cleaned in a certain amount of time. Doing this could make ice cream dispensed from these machines dangerous because it bypasses critical cleaning and sanitization features; Taylor itself has told maintenance workers that doing so "can greatly increase the risk of serving unsafe product to the public." 

Although the bypass is not officially endorsed by either Taylor or McDonald's corporate, it is used by some McDonald's restaurants because cleaning ice cream machines is an arduous and expensive task. 

"You're under pressure to get it up and running," a maintenance professional who has worked in many McDonald's restaurants for the last 15 years in the midwest told Motherboard, adding that, obviously, stores can't sell ice cream while the machines are broken, and customers are often upset when they can't get McFlurrys or soft serve. The maintenance worker, whom Motherboard agreed to keep anonymous because they fear losing their job, said that a McDonald's store manager once pressured them to install a jumper. 

“I was replacing a man who had been fired. When I arrived there, I had been informed he was installing the jumper on the shake machine. I refused to do it,” they said. “To clean the machine, it’s a three hour job from start to finish—you have to drain it, clean the cylinders, check the fudge and caramel pumps and o-rings. It’s a long and detailed process. Installing the jumper is considered a trick to get it up and running—you don’t have to tear it down.”

This bypass is widely known among maintenance workers who repair the equipment and by both Taylor and McDonald’s, according to the worker, internal documentation obtained by Motherboard, and health inspection records.

Part of the issue is the Taylor machine's heat treatment process. Old Taylor machines needed to be constantly cleaned to keep running. It was a laborious and time consuming process. The new machines use a heat treatment that superheats the machine inside to clean it. When a Taylor machine is doing its nightly heat treatment, it only needs cleaning every 14 days. Using the jumper to bypass the system shuts off the heat treatment cycle and it doesn’t come back off until the jumper is removed. Installing the jumper means it no longer meets the food safety standards developed by NSF International, a group that approves restaurant food equipment.

In 2013, Taylor issued a “service bulletin” in which it identified a “very serious issue that can jeopardize the product served from heat treatment machines. Taylor technicians performing equipment updates recently reported that they found heat treatment machines with a shunt (jumper) installed on the brush clean service pins on the interface boards.” Doing this allows the machine to “circumvent freezer locks” that ensure the machine has gone through a heat treatment cycle that sterilizes the machine.

“Under no circumstances should a jumper be installed and left on the brush clean service pins!” the bulletin reads. “IMPORTANT: Altering the lock out parameters in heat treatment equipment is a violation of FDA Food Code as confirmed via testing by NSF under NSF Standard 6 … Such an action can greatly increase the risk of serving unsafe product to the public.”

The McDonald's maintenance worker said it is possibly dangerous to the public to serve ice cream from machines like that have had a jumper installed, though it's difficult to say how often—if ever—people get sick from McFlurrys.

“It’s a dairy product, so there’s a reason you clean it out and sanitize it. You’ve got stuff building up in there, stuff growing in a cold, moist environment,” they added. “So to skip that, for me it’s wrong on so many fundamental levels.”

A video viewed by Motherboard of an ice cream machine with no jumper installed shows a machine that’s beeping and shuts itself down. A second video on a machine that has a jumper installed shows a machine that is not beeping that flashes the words “UNIT CLEANED.”

A spokesperson for McDonald's confirmed to Motherboard that the company is aware of this bypass but believes it is not used often and has impacted a limited number of restaurants, and said that if maintenance employees find a jumper installed on a Taylor ice cream machine, they are supposed to immediately remove it. The company said it has also created training programs to ensure the machines (and all restaurant equipment) are cleaned regularly. The vast majority of McDonald's restaurants are independently owned franchises, and so it can be difficult for McDonald's corporate to know or understand the full scope of issues like this.

“Adhering to the highest standards of safety and cleanliness is always our top priority, and this includes having thorough cleaning processes in place for our soft serve machines to help keep our customers and crew safe. Any systems that bypass the regular cleaning cycle are not authorized or condoned by McDonald’s," McDonald's said in a statement.

A spokesperson for the Taylor Company said in an email that “the ‘jumper’ you refer to is a shunt that bypasses certain critical steps that should never be bypassed because they are necessary to ensure proper sanitation and safety. When we first learned about this unauthorized procedure in 2013, we quickly issued a safety bulletin outlining our concerns. We have provided direction to our authorized factory trained technicians to remove the ‘jumper’ should they encounter this condition in the field. We reiterate these concerns and recommendations today. Our number one concern is the safe operation and servicing of our equipment.”

They added that “these shunts pose serious potential health and safety risks, it also violates FDA Food Code, National Sanitation Foundation (NSF) and our own published safety standards.”

Health inspection records from the state of Ohio show that this problem has occurred in the recent past, though it's very difficult to have any idea the scale of the problem. The maintenance worker Motherboard spoke to said that most of the machines he comes in contact with can be bypassed by the jumper (meaning that many McDonald's restaurants are still using this specific model of machine). A July 10 inspection of a McDonald's in Ohio found a "critical violation" in which the inspector was unable to access 90-day records of heat treatment cycles, which is a byproduct of having the jumper installed. An August 8 inspection found the same thing, and called it a "critical repeat."

McDonald's ice cream machines have a much more complicated saga than you'd expect for a piece of fast food equipment, which is explored at length in the excellent Wired article. That article focuses on entrepreneurs Jeremy O’Sullivan and Melissa Nelson, who designed a device that would help franchise owners diagnose their own systems, make simple repairs, and avoid costly repair bills from Taylor. They called their gadget the Kytch and it worked like an on-board diagnostic reader for cars. Among other things, the Kytch device gives store owners access to a secret diagnostic menu they can't usually see.

The Kytch devices became popular at McDonald's, but McDonald's eventually warned stores that installing a Kytch would void restaurant owners' warranties and told them not to use it. McDonald's and Taylor soon announced new machines that would have many of the features Kytch has. Last week, Kytch filed a lawsuit against Taylor and a McDonald's franchisee sold a Kytch to that it alleges helped Taylor reverse engineer the Kytch. It also alleged that Taylor’s repair monopoly has made the ice cream machines dangerous. McDonald's corporate is not named in the suit.

“This is a case about corporate espionage and the extreme steps one manufacturer has taken to conceal and protect a multimillion-dollar repair racket,” the lawsuit said. “The problem is that Taylor designed its software so that only Taylor-certified technicians can service and repair the machines. 

“Taylor’s own documents confirm that in 2017 alone, 6,500 Taylor-certified technicians brought in almost $80 million in revenue for parts and service support.”

The lawsuit also specifically mentions the jumper issue, noting “many Taylor machines have a jumper placed on the W2 pins on the rear of the machine that disables necessary safety mechanisms ... Taylor has been aware of this hazard for years but has taken no action to correct this defect. This violates NSF International’s food safety requirements and may endanger consumers.”

McDonald's, for its parts, says that there is no conspiracy between Taylor and McDonald's and that it has been encouraged by its new connectivity solutions, software, and machines that it has rolled out since October. 

"Our fans deserve to enjoy McDonald’s cool, creamy soft serve whenever the craving strikes, and we have a dedicated team working to improve the reliability of our soft serve machines," McDonald's said. "Some of their solutions have already begun to roll out in restaurants—like new training resources for crew and maintenance ‘check-ups’ for the machines to keep them running smoothly. We’re even testing a smart technology that sends real-time texts when the machines aren’t working properly so they can be fixed ASAP. We're committed to getting this right for our customers.”