In depth explanation on workings of safe locks
I'm not going to go into the differences between group 2 and group 1 safe locks. Those terms are easily googled as well as direct entry versus spring loaded fence locks. Plus, this thing is long enough!!
The safe
haha ignore the sticker. The keyhole on the front is only for locking the dial, it has nothing to do with locking whatever the safe lock is mounted on. That front key lock is a cheap wafer lock so any amateur lockpicker should be able to pick it.
Parts of a safe lock
The part of the lock you see from the front is the dial. It is what you spin to dial in the combination and has graduations marked from 0-99. Here is the back of the lock:
And here is the back of the lock with the back plate removed:
Ok so there's a lot of parts there and I have really bad photoshop skills so you'll have to bear with me here for a moment. I outlined some parts that are visible with the backplate removed.
The part outlined in blue is called the nose. It rides along the drive cam which is circled in orange. There is a metal wire that you can see pushing the nose down onto the drive cam. This means it is a spring loaded fence type of lock. The thing the spring is on is called the lever or arm. Because the nose is being pushed down onto the drive cam when the gap is under the nose that means it'll drop into the gap ever so slightly. That's where the two little red dots come into play. They are called the contact points. The nose hits those points everytime it is coming out of the contact area which is the space between the two contact points as indicated by the green line.
Are you still following along? Ok good Now, the brass circle behind the drive cam is one of the 3 wheels in the lock. The purple part in the wheel is called a gate. These terms are very important for later so make sure you remember all these. Oh, and the part circled in teal is called the bolt. It locks the handle of the safe the lock is on. The lock doesn't actually lock the safe, it locks the handle which is turned to retract all the bolts along the door of the safe and allow it to be opened. The part in the very middle of the drive can is called the spline key. We will be learning more about what they all do later but for now, remember these parts and what they look like!
All of it taken apart!
This is a view of all the parts not together. We'll start naming them (maybe not with as much color as last time) from the order the get put back together in. Here's another wonderful example of my lack of skills with photoshop:
So I numbered them. #1 is a tension washer. It's slightly wavy so it acts like a spring and keeps all the wheels (#'s 2, 5, & 9) lightly pressed against each other so nothing wobbles and it all fits snugly together. #2 is wheel number 1. You can see the gate in the wheel. The position of the gate is what determines the combination. Wheel number 1 goes on first and will the be wheel closest to the dial. This will be explained shortly. #3 is called a fly. Specifically a movable fly. It fits directly on top of the first wheel as pictured and the little stub shown has a slot on wheel 1 it fits into. #4 is a spacer. It spaces the wheels out from one another so they don't rub on each other. #5 is the second wheel. I have it laying upside down in the picture and for a purpose. #6 is pointing to a stub sticking out from the bottom of the second wheel called the drive pin. It fits into a groove on the top of wheel 1 and when spun, hit the fly that is laying on top of wheel one. This causes wheel one to turn with wheel two. Wheel 1 has no drive pin since there is no wheel under it that it needs to spin. #7 does the same thing as #3 and goes on the top of wheel 2 (the other side of wheel two than what's shown in the picture). #8 is the same thing as #4. #9 is the 3rd wheel. It is the same in appearance as wheel number 2 including a drive pin (since it has to move wheel 2) except that it has a larger fly (#10). The reason it's bigger will be explained later. #11 is another spacer but thicker than #'s 4 and 8. #12 is a retainer. After all the other parts are on the shaft, it snaps on to lock them into place. #13 is the drive cam with an upside down view. It goes on after the retainer. What holds it on is the spindle which is a protruding rod from the back of the dial. It's not shown here but will be later. #14 is the spline key and it holds the spindle to the drive cam. #15 is a metal bar above and behind the nose and is called the fence. When the nose is in the contact area on the drive cam, the fence lowers onto the wheels. And I forgot to mark it but that plastic ring between the 2nd and 3rd wheel is to keep the dial running smoothly and so there's no metal on metal interaction. It goes on the spindle.
So in this photo I have removed the bolt and a metal wire which is called the re-locker. Underneath the bolt you see a small metal ball with a spring under it (spring not shown) that pushes into the bottom of the bolt to hold it in place better. As shown:
The blue arrow points to where the ball fits into. When the bolt moves, it pushes the ball out and down into the spring that is pushing the ball. The bottom red arrow point to the re-locker. The specific part of the re-locker it is pointing to goes into the space that the other red arrow point to. It goes up in there and keep the bolt from moving back. Unless the back cover is on and pushes that little metal piece down and then the bolt is able to slide in. The reason is because some attacks against safe punch the back of the safe lock out so if that happens, the metal piece will stop the bolt from retracting even with the right combination.
This picture shows how the re-locker works, blocking the bolt from sliding inward (to the left). And the next picture shows the spindle (long metal rod) with the plastic ring on it to keep metal from rubbing on metal. The way the spindle holds the drive cam on is because the spindle is like a screw. It is screwed into the drive cam and the spline key keeps it from spinning any tighter or spinning out.
If you go back to the picture showing the bottom of the drive cam, you can see a drive pin protruding from the bottom. This fits into a groove on top of wheel 3 (the closest wheel to the back of the lock). Because there is a space between the drive cam and wheel 3, the fly of wheel 3 and drive pin of the drive cam have to be slightly larger than the other drive pins and flys. Since the drive cam is connected to the spindle by the spline key (if you don't get this yet, you will later ) every movement by the dial is directly transferred to the drive cam. The drive pin on the drive cam, when the dial is spun, hits the fly on the 3rd wheel. and picks it up as it spins. The when wheel 3 has spun around, the drive pin on the back of it hits the fly on wheel 2. This picks up wheel two and the process is repeated when the first wheel is picked up by the drive cam on wheel 2 hitting the fly on wheel 1. All wheels are now picked up. Let's say we are dialing the combination.
Combo's are dialed Left 4 times to 1st number, right 3 times to 2nd number, and left 2 times to 3rd number, and right to open. I will explain why. So go left 4 complete rotations and pick up all the wheels and stop at the first number in the combo. To dial the second number you have to switch directions because all the drive pins and flys are touching so if you keep going left, the first wheel will be moved off of it's #. Now if you reverse direction it takes a whole rotation for the drive pin on the drive cam to come back around and hit the fly of wheel 3. Once you hit it, it takes another whole rotation for the drive pin on the 3rd wheel to spin to the other side of the fly on wheel 2 and pick it up. On the dial, this shows as passing the 2nd number in the combo twice. Now, you don't want to pick up the first wheel because that will mess up the position of the gate. When the 1st wheel is aligned correctly, the gate of that wheel will be under the fence. If you make another whole rotation, wheel 1 is messed up so you want to stop when you have reached the 2nd # in the combo for the 3rd time. That is why you spin 4 times left (to reset all wheels in case they are all spun to the right) for the 1st number and 3 times for the 2nd number. Now the 3rd number is dialed by reversing directions again. Remember, a whole rotation is done before the drive cam picks up the 3rd wheel going left rotation so we have already passed the 3rd # of the combo once. Now we stop on it the second time. All wheel should be aligned with their gates under the fence such as:
Now you'll notice the fence didn't lower. It's because the nose is on the drive cam and needs to move to the contact area. The last number was put in with left rotation so you turn right to contact area.
Then you keep turning and it retracts the bolt.
Now if you go back to the picture of the lock with the back off and look above the nose there is a pentagonal shaped piece of metal protruding from the top of the lock housing. It is keeping the whole lever from moving left and retracting bolt when the fence is not dropped into the wheel pack. Very important. When the combo is dialed and the nose drops in the drive cam, it moves under this piece of metal to retract the bolt. This is how the locks operate, now I will talk about how the combo is changed.
Combo changing
In the next photo you can see there are small serrations in the wheel. The brass bit from the wheel locks into those. You can see a circularish shape hole by this. When the combo is change, all these holes line up and a special metal rod called a change key slips into there. You can see on the back of the lock casing there is a hole in the bottom left for this. The change key is turned and the brass colored bit going into the serrations is lifted off and then a new combo is dialed. The brass (which includes the gate of the wheel) is in a different relative spot to how the dial is turned and the combo is now different.
Imperfection in how safes are made
So the reason that safe cracking is possible is because the wheels in safes are not perfectly round due to machine imperfections. And the holes in the center aren't actually centered. One wheel is always bigger so when the nose is in the contact area and the fence is on the wheels, it's actually only on ONE wheel. The largest one. Usually the 3rd but I don't know exactly why. Maybe because the spring for the lever is above the nose so the force pushing down is from the back. Idk. BUT this means when the gate of the largest wheel is under the fence, the nose will drop lower in the contact area ever so slightly. The lower it goes, the less wiggle room and the closer the contact points will appear on the dial. And safe manipulation is all about the measurement of these contact points. I'm including a picture that hopefully shows the 2nd wheel being bigger. You have to look closely but the fence is only on the 2nd wheel.
And also, the fence is way smaller than the gate on the wheel so you have wiggle room there and don't have to accurately get the gate under the fence precisely. You have, depending on the lock, .5 of an increment to 1.25 of an increment above or below the actual number. So anything from 33.5 to 34.5 can open the lock if the actual # is 34. Or 32.75 to 35.25.
If I made mistakes, let me know and I will correct them! Or if I left anything out. I will be checking it over tomorrow and try to catch some.