FAQ  •  Register  •  Login
UKLockpickers.co.uk Lockpicking supplies such as Lockpicks, tools, and more! COMMANDOLOCK.COM Military grade padlock systems lockpickshop.com A source for lockpicking supplies such as lockpicks, locksmith tools, and more!

In depth explanation on workings of safe locks

<<

LockManipulator

User avatar

Active Member

Posts: 593

Joined: Wed Jan 11, 2012 6:33 pm

Location: California, US

Post Sun Aug 18, 2013 7:04 pm

In depth explanation on workings of safe locks

I recently wrote a tutorial on safe cracking but I did not include in it how safes work. I wrote the safe manipulation tutorial based on an assumption that the reader will have a knowledge of the workings of safes already. So, I decided to write this to explain the workings of a safe. This will be pre-reading to the safe manipulation article and hopefully cover enough ground that these two articles combined can almost be a complete basic course on safe cracking. This will specifically cover group 2 safes that are key change type. No direct entry or group 1 safes will be discussed (mostly because I don't know too much about those :lol: ) but also because that would be a REALLY long page! The only safe I have at the moment is a LaGard 3330 so that is where all the photos come from but all group 2 safes are the same with very slight variations. Other types such as screw change and mesh work the same just have a different way to change the combo. Once you read through this, http://keypicking.com/viewtopic.php?f=100&t=8306 is the tutorial by me on safecracking!

I'm not going to go into the differences between group 2 and group 1 safe locks. Those terms are easily googled as well as direct entry versus spring loaded fence locks. Plus, this thing is long enough!!

The safe
DSCF4623.JPG

haha ignore the sticker. The keyhole on the front is only for locking the dial, it has nothing to do with locking whatever the safe lock is mounted on. That front key lock is a cheap wafer lock so any amateur lockpicker should be able to pick it.

Parts of a safe lock
The part of the lock you see from the front is the dial. It is what you spin to dial in the combination and has graduations marked from 0-99. Here is the back of the lock:
DSCF4661.JPG


And here is the back of the lock with the back plate removed:
DSCF4624.JPG


Ok so there's a lot of parts there and I have really bad photoshop skills so you'll have to bear with me here for a moment. I outlined some parts that are visible with the backplate removed.
safe parts1.JPG

The part outlined in blue is called the nose. It rides along the drive cam which is circled in orange. There is a metal wire that you can see pushing the nose down onto the drive cam. This means it is a spring loaded fence type of lock. The thing the spring is on is called the lever or arm. Because the nose is being pushed down onto the drive cam when the gap is under the nose that means it'll drop into the gap ever so slightly. That's where the two little red dots come into play. They are called the contact points. The nose hits those points everytime it is coming out of the contact area which is the space between the two contact points as indicated by the green line.
Are you still following along? Ok good :) Now, the brass circle behind the drive cam is one of the 3 wheels in the lock. The purple part in the wheel is called a gate. These terms are very important for later so make sure you remember all these. Oh, and the part circled in teal is called the bolt. It locks the handle of the safe the lock is on. The lock doesn't actually lock the safe, it locks the handle which is turned to retract all the bolts along the door of the safe and allow it to be opened. The part in the very middle of the drive can is called the spline key. We will be learning more about what they all do later but for now, remember these parts and what they look like!


All of it taken apart!
DSCF4630.JPG


This is a view of all the parts not together. We'll start naming them (maybe not with as much color as last time) from the order the get put back together in. Here's another wonderful example of my lack of skills with photoshop:
safe parts 2.JPG


So I numbered them. #1 is a tension washer. It's slightly wavy so it acts like a spring and keeps all the wheels (#'s 2, 5, & 9) lightly pressed against each other so nothing wobbles and it all fits snugly together. #2 is wheel number 1. You can see the gate in the wheel. The position of the gate is what determines the combination. Wheel number 1 goes on first and will the be wheel closest to the dial. This will be explained shortly. #3 is called a fly. Specifically a movable fly. It fits directly on top of the first wheel as pictured and the little stub shown has a slot on wheel 1 it fits into. #4 is a spacer. It spaces the wheels out from one another so they don't rub on each other. #5 is the second wheel. I have it laying upside down in the picture and for a purpose. #6 is pointing to a stub sticking out from the bottom of the second wheel called the drive pin. It fits into a groove on the top of wheel 1 and when spun, hit the fly that is laying on top of wheel one. This causes wheel one to turn with wheel two. Wheel 1 has no drive pin since there is no wheel under it that it needs to spin. #7 does the same thing as #3 and goes on the top of wheel 2 (the other side of wheel two than what's shown in the picture). #8 is the same thing as #4. #9 is the 3rd wheel. It is the same in appearance as wheel number 2 including a drive pin (since it has to move wheel 2) except that it has a larger fly (#10). The reason it's bigger will be explained later. #11 is another spacer but thicker than #'s 4 and 8. #12 is a retainer. After all the other parts are on the shaft, it snaps on to lock them into place. #13 is the drive cam with an upside down view. It goes on after the retainer. What holds it on is the spindle which is a protruding rod from the back of the dial. It's not shown here but will be later. #14 is the spline key and it holds the spindle to the drive cam. #15 is a metal bar above and behind the nose and is called the fence. When the nose is in the contact area on the drive cam, the fence lowers onto the wheels. And I forgot to mark it but that plastic ring between the 2nd and 3rd wheel is to keep the dial running smoothly and so there's no metal on metal interaction. It goes on the spindle.


So in this photo I have removed the bolt and a metal wire which is called the re-locker. Underneath the bolt you see a small metal ball with a spring under it (spring not shown) that pushes into the bottom of the bolt to hold it in place better. As shown:
safe parts 3.JPG


The blue arrow points to where the ball fits into. When the bolt moves, it pushes the ball out and down into the spring that is pushing the ball. The bottom red arrow point to the re-locker. The specific part of the re-locker it is pointing to goes into the space that the other red arrow point to. It goes up in there and keep the bolt from moving back. Unless the back cover is on and pushes that little metal piece down and then the bolt is able to slide in. The reason is because some attacks against safe punch the back of the safe lock out so if that happens, the metal piece will stop the bolt from retracting even with the right combination.
DSCF4638.JPG

This picture shows how the re-locker works, blocking the bolt from sliding inward (to the left). And the next picture shows the spindle (long metal rod) with the plastic ring on it to keep metal from rubbing on metal. The way the spindle holds the drive cam on is because the spindle is like a screw. It is screwed into the drive cam and the spline key keeps it from spinning any tighter or spinning out.
DSCF4642.JPG


If you go back to the picture showing the bottom of the drive cam, you can see a drive pin protruding from the bottom. This fits into a groove on top of wheel 3 (the closest wheel to the back of the lock). Because there is a space between the drive cam and wheel 3, the fly of wheel 3 and drive pin of the drive cam have to be slightly larger than the other drive pins and flys. Since the drive cam is connected to the spindle by the spline key (if you don't get this yet, you will later :) ) every movement by the dial is directly transferred to the drive cam. The drive pin on the drive cam, when the dial is spun, hits the fly on the 3rd wheel. and picks it up as it spins. The when wheel 3 has spun around, the drive pin on the back of it hits the fly on wheel 2. This picks up wheel two and the process is repeated when the first wheel is picked up by the drive cam on wheel 2 hitting the fly on wheel 1. All wheels are now picked up. Let's say we are dialing the combination.

Combo's are dialed Left 4 times to 1st number, right 3 times to 2nd number, and left 2 times to 3rd number, and right to open. I will explain why. So go left 4 complete rotations and pick up all the wheels and stop at the first number in the combo. To dial the second number you have to switch directions because all the drive pins and flys are touching so if you keep going left, the first wheel will be moved off of it's #. Now if you reverse direction it takes a whole rotation for the drive pin on the drive cam to come back around and hit the fly of wheel 3. Once you hit it, it takes another whole rotation for the drive pin on the 3rd wheel to spin to the other side of the fly on wheel 2 and pick it up. On the dial, this shows as passing the 2nd number in the combo twice. Now, you don't want to pick up the first wheel because that will mess up the position of the gate. When the 1st wheel is aligned correctly, the gate of that wheel will be under the fence. If you make another whole rotation, wheel 1 is messed up so you want to stop when you have reached the 2nd # in the combo for the 3rd time. That is why you spin 4 times left (to reset all wheels in case they are all spun to the right) for the 1st number and 3 times for the 2nd number. Now the 3rd number is dialed by reversing directions again. Remember, a whole rotation is done before the drive cam picks up the 3rd wheel going left rotation so we have already passed the 3rd # of the combo once. Now we stop on it the second time. All wheel should be aligned with their gates under the fence such as:
DSCF4651.JPG

Now you'll notice the fence didn't lower. It's because the nose is on the drive cam and needs to move to the contact area. The last number was put in with left rotation so you turn right to contact area.
DSCF4652.JPG

Then you keep turning and it retracts the bolt.
DSCF4653.JPG

Now if you go back to the picture of the lock with the back off and look above the nose there is a pentagonal shaped piece of metal protruding from the top of the lock housing. It is keeping the whole lever from moving left and retracting bolt when the fence is not dropped into the wheel pack. Very important. When the combo is dialed and the nose drops in the drive cam, it moves under this piece of metal to retract the bolt. This is how the locks operate, now I will talk about how the combo is changed.

Combo changing

In the next photo you can see there are small serrations in the wheel. The brass bit from the wheel locks into those. You can see a circularish shape hole by this. When the combo is change, all these holes line up and a special metal rod called a change key slips into there. You can see on the back of the lock casing there is a hole in the bottom left for this. The change key is turned and the brass colored bit going into the serrations is lifted off and then a new combo is dialed. The brass (which includes the gate of the wheel) is in a different relative spot to how the dial is turned and the combo is now different.
DSCF4641.JPG


Imperfection in how safes are made

So the reason that safe cracking is possible is because the wheels in safes are not perfectly round due to machine imperfections. And the holes in the center aren't actually centered. One wheel is always bigger so when the nose is in the contact area and the fence is on the wheels, it's actually only on ONE wheel. The largest one. Usually the 3rd but I don't know exactly why. Maybe because the spring for the lever is above the nose so the force pushing down is from the back. Idk. BUT this means when the gate of the largest wheel is under the fence, the nose will drop lower in the contact area ever so slightly. The lower it goes, the less wiggle room and the closer the contact points will appear on the dial. And safe manipulation is all about the measurement of these contact points. I'm including a picture that hopefully shows the 2nd wheel being bigger. You have to look closely but the fence is only on the 2nd wheel.
DSCF4657.JPG


And also, the fence is way smaller than the gate on the wheel so you have wiggle room there and don't have to accurately get the gate under the fence precisely. You have, depending on the lock, .5 of an increment to 1.25 of an increment above or below the actual number. So anything from 33.5 to 34.5 can open the lock if the actual # is 34. Or 32.75 to 35.25.

If I made mistakes, let me know and I will correct them! Or if I left anything out. I will be checking it over tomorrow and try to catch some.
You do not have the required permissions to view the files attached to this post.
Last edited by LockManipulator on Mon Aug 19, 2013 3:16 am, edited 3 times in total.
<<

Squelchtone

Active Member

Posts: 361

Joined: Fri Jun 03, 2011 1:16 pm

Location: Massachusetts USA

Post Sun Aug 18, 2013 10:53 pm

Re: In depth explanation on workings of safes

It seems to me you are blurring the lines between safes and safe LOCKS. you said the only safe you have is a Lagard 3330.. you mean safe LOCK. a safe is a container and can be made by anyone, such as AMSEC who would potentially use a Lagard 3330 or S&G 6730 Safe lock.

If you were to explain the in depth workings of safes, by reading the title, I was hoping to see pictures of bolt work and how it interacts with the safe lock's bolt, spring loaded relocking mechanisms, glass relockers, hinges, handles, and hard plate.

Good write up on the Lagard safe lock though, thanks for numbering and explaining all the parts!
Squelchtone
<<

MBI

User avatar

Site Owner

Posts: 1545

Joined: Thu Apr 03, 2008 9:25 pm

Location: Utah, USA

Post Sun Aug 18, 2013 11:36 pm

Re: In depth explanation on workings of safes

Squelchtone wrote:It seems to me you are blurring the lines between safes and safe LOCKS. you said the only safe you have is a Lagard 3330.. you mean safe LOCK. a safe is a container and can be made by anyone, such as AMSEC who would potentially use a Lagard 3330 or S&G 6730 Safe lock.

Fixed it in the title. I hope thats ok with you Daggers.
<<

LockManipulator

User avatar

Active Member

Posts: 593

Joined: Wed Jan 11, 2012 6:33 pm

Location: California, US

Post Mon Aug 19, 2013 3:11 am

Re: In depth explanation on workings of safes

MBI wrote:
Squelchtone wrote:It seems to me you are blurring the lines between safes and safe LOCKS. you said the only safe you have is a Lagard 3330.. you mean safe LOCK. a safe is a container and can be made by anyone, such as AMSEC who would potentially use a Lagard 3330 or S&G 6730 Safe lock.

Fixed it in the title. I hope thats ok with you Daggers.

It's fine with me :) Thanks! I didn't catch that when I read over it :oops: I went back over and changed some other times I accidentally put safe instead of lock.

Return to Safes, Strongboxes & Combination Locks

Who is online

Users browsing this forum: No registered users

Don't forget to visit our sponsors for all of your lockpicking needs!
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Grop
"CA Black" theme designed by stsoftware