Success with Homemade Auto Dialer

[TimD]

This is really a continuation of thread viewtopic.php?f=36&t=67457. This safe is now open.

This is the second safe I have opened with my homemade auto dialer. The dialer uses a Raspberry Pi, stepper motor, optical encoder and Python computer code. The machine can dial around 480, three number combinations per hour and will try every combination in an increasing sequence - no short-cuts. So the safe has to be in a situation where time is not a critical factor! I have not tried it on a four number combination lock but I suspect the enormously large number of possible combinations would make it impractical. I'd estimate the cost of parts to be around $350CAD with the stepper motor controller board being the most expensive item at $120CAD. I have access to a 3D printer and laser cutter.

The first safe, my son's, opened in around 2.5 hours as the combination was 20,32,65 - very near the start of the dialing(1,018th number). The second safe was opened after 134,358 combinations were tried - some 280 hrs of dialing (but not continuous) - with 40,58,79. The longest continuous run was 60,981 combinations tried but this technically was not continuous as the dialer was suspended several times. The machine has the facility to suspend it on the next number dialed. This allows the machine to be checked to ensure it is hitting its dial numbers accurately and the folks around the safe to get some relief from the clickity-clack of the dialer! The dialer also sends cell phone notifications concerning progress and (possible) success. The dialer writes a log of settings, numbers dialed, etc. so that if a power failure occurs you know how far it has progressed. It can be restarted, moving sequentially forward, from any combination to any other combination.

I could not think of any dialing short-cuts that would be guaranteed to work as I had no reliable knowledge of the inside of the lock - size of the flies, pins, etc. although clearly I understand how the locks work (I think). I did not know how far I can move a wheel before it moves the adjacent one. Once open and on review, for both locks, probably S&G locks in largish old Taylor office safes, missing a dialed number by more than 0.25 of an increment would probably not allow the lock to open. They were surprisingly well made! Also incrementing the numbers in fives or threes clearly would have missed the correct combinations. The stepper motor and encoder gave a positional resolution to better than 0.1 of a dial division.

I did not run the dialer as fast as it could go as I was afraid of damaging the lock in some way, especially over a (very) large number of attempted combinations, and was also worried that the wheels, due to their single or multiple inertia(s), would not stop when the stepper motor reversed for the next number. WD40 and light machine oil was introduced behind the dial (as best as possible) to help free things up and lubricate the runs. On the initial runs the lock jammed for unknown reasons and the dialer gave false 'success' messages. These jams were eliminated by paying special attention to ensure that during set-up the axis of the stepper motor was accurately aligned with the axis of the dial and the dial was rotating within the 'middle of its float' within the dial faceplate. Not an easy thing to achieve.

For both safes, there was nothing inside - but we sort of knew that anyway.

A very interesting project.

My son's safe in his garage.







The second safe was within the main dining area of a local restaurant. The dialer got a lot of attention and my wife and I got a free dinner once opened!









A close-up of the revised auto dialer - slimmer and with two extra magnets for more secure positioning.

[Squelchtone]

Hey, you didn't mention in your first post that you made an awesome dialer! Sweet! Based on the combination you mentioned it looks like the restaurant safe is probably set to 40-60-80.

Nicely done and thank you for following up to share with us!

Squelchtone

[femurat]

That's impressive!

You say no shortcuts. I hope it does not dial the full combination every time. I mean, after turning all wheels left at the beginning, it goes on moving only the third wheel around, to check 0 0 99, 0 0 98, 0 0 97... before moving the second wheel one number, and so on.

Congratulations on the double opening

[TimD]

Thanks Squelchtone. The original thought on the restaurant safe was to try and manipulate the lock. But I could not make head to tale of what was going on in the lock and I only had access to the safe during restaurant hours. It got very noisy in there some evenings! The owners had had a quote from a 'locksmith' to manipulate the lock for them but it was very expensive and no guarantees that they would be able to open it. I felt that the auto dialer, although very time consuming, had more chance of a guaranteed success. Also it generated a lot of interest and follow-up amongst the guests. However, it was very stressful for me as I'm no lock expert and I was continually wondering had I missed something, what was I going to do if it dialled all combinations and was still not open? As we only dialed 0.5% of the combinations on the first lock and around 25% on the second then we were very lucky on both attempts!

Thanks femurat. No shortcuts - at all. Full dial for each number. But I would like to understand shortcuts more - for obvious reasons. Below is a screen shot of the last sequential numbers dialed before the opening one. You can see at the top of the screen that the number to be dialed is the 3,585th number on that run and is 40/58/76. You can then see the dialer dial each number with stepper position 340, 58, 176. Then it tests the lock to see if it is jammed, i.e. open. To do this it moves to two positions (turning right) half a turn and another half a turn from the last dialed position, 126 and 76. If the lock does not jam then it returns to zero and starts all over again. (The units of the stepper position are dial units).

You can see the opening combination, 3,588th number, 40, 58, 79, at the bottom of the screen. Here the stepper motor misstepped, i.e., jammed, on the second half turn of testing the lock. This is an encouraging place for the lock to jam!

What I don't understand about shortcuts is that I believe I have to test the lock after each number dialed by rotating right around 3/4 to one full turn to see if it jams. As soon as I do this, and knowing nothing about the dimensions inside the lock, then am I disturbing the adjacent wheel(s), so all bets are off, so start again. I used an increasing sequence 20, 20, 20, then 20, 20, 21, etc. is this the right approach? I have heard other auto dialers talk of shortcuts but I always assumed that they knew the lock make, model, etc. and had purchase an identical lock to figure out any shortcuts, tolerances, etc. Clearly with a 100 year old safe I did not have that luxury.

Soon I intend to remove my son's lock and play around with it some more on the bench to understand if shortcuts are indeed possible.

Thanks for your input.

[MartinHewitt]

Lets say you have dialled L20-R40-L60 and then right to 80 to check if the lock opens. Then you want to check L20-R40-L62. So when you turn left to 60 the lock is in the same state as just after dialling L20-R40-L60. Now moving 2 numbers more left changes this to L20-R40-L62. Then turning right to 80 to check. This means the second check was only a turn left by 82 numbers and turn right by 82 numbers instead of a full sequence. Knowing something about the lock is very good for these shortcuts, but locks do like to talk about themself. The shortcut for W3 can also be done for W2 and W1 with proper dialling directions. And it can be made even more complex with further lock parameters.

[femurat]

I was referring to what Martin just explained

[TimD]

Thanks MartinHewitt and femurat for your thoughts on shortcuts. I sort of read about/considered what you are describing but I had a couple of concerns as I did not have the lock, or any lock, in front of me to play with. The following are my thoughts as an individual with no practical lock experience.

If I'm at L60 and go R80 to test the lock that is 0.8 of a turn. How do I know that is enough to engage the cam and jam the lock? For different third numbers, is the amount of turn to test the lock the same or different? Having tested the lock and failed, I can see that my next third number alone would be anything above L60. However, where/how do I start this sequence and where do I end it before I have to redial the first and second number? How can I write computer code for this (as I'm an amateur programmer) unless I fully understand the method? And more importantly, how do I test the code to ensure that it works and is not messing anything up? Testing my current full, sequential dialing code with jam detection, pausing, logs, notifications, etc. with a simple test rig took up a considerable amount of time. The code after all has to work 'first time' - it can not make an error with the correct combo.

I'm not expecting any answers to my above concerns here as I realize that a forum is not the place to learn shortcuts. If you know of any reference papers on shortcut methods, etc. then that would certainly be appreciated.

I hope to get the lock and change keys from my son's safe this week so I will be able to gain some practical experience with a lock and perhaps even develop and test some code for shortcuts.

If I get anywhere with it I'll post again. Thanks.

[TimD]

A couple of things in my very limited experience that surprised me;

1. My sons safe had a dial that was marked 20 - 100. However, when examined the 100 to 20 blank area of the dial, was in fact equal to 25 divisions. So 105 divisions in all. Confused me and the auto dialler for a bit! The second safe had a similarly marked dial but the blank space was in fact equal to 20 divisions. 105 divisions - is this common?

2. The double door safe did not have any bolts on the hinge side of the doors. And it only had two vertical bolts on each door - one top and one bottom. It had three bolts between the doors. I thought it would have had more bolts.

[MartinHewitt]

If you can feel the contact points then you know where the lever drops and there is only so much a drive cam can move from this point. From the "left" CP the cam stops on my S&G 6730 after 11 numbers, on my Kromer 3011 after 10 numbers and on my Mosler 5H after 8 numbers. So if you have this information and stop 15 to 20 numbers left of the CP then you are fine. Of course it would be helpful to know in which direction to check. If you can't feel a CP and a normal dialer is suitable, then you can after going L60 for the last wheel to R62 or so (stopping slightly before reaching W3) and then it would be still ok to go L62 to push slightly W3 as nothing was moved by the last check operation. It is good to have a lock at hand for having a look while thinking through this. This lock doesn't have to be the same. Basically all combination locks have wheels with pins and often flies and need to propagate the wheel positions through the stack by multiple turns. For best optimization you should know how a fly influences the operation. With a fly there are not only 3 movable parts in a 3-wheel stack, but 6. This influences the wheel pickup. Unfortunately testing takes time.

The blank space is where the CPs are and the lever drops. The last wheel must not be set to a number in this range. Modern locks have in their manuals the information to not use a certain number range. People do sometimes forget this. Old locks ensured this by having no numbers there making it impossible for the normal user to set a forbidden combination. This gap can be anything a lock manufacturer thought to be necessary. I have here a dial with 0 to 100 with 20 gap, with 1 to 100 with 25 gap, 1 to 100 with 35 gap, 1 to 50 with 16 gap. (gap rounded to the nearest full number) Your dialer doesn't look at the numbers on the dial. So you could ignore them and handle a dial with a 50 numbers + 16 numbers gap or a 80 numbers + 25 numbers gap just like a 100 number dial. When it is open you can check what the combination for a user is.

There is also the gate width. Some have narrow gates, some wide gates. With the narrow gates you need to check possibly every numbers. With wide gates every second number or in rare cases even every third number would be fine, saving a lot of time.

If there are no bolts on the hinge side, then there is usually a fixed bar, that moves behind the door frame when the door is closed.

[sign216]

TimD,

You get my congratulations. The homemade aspect of the autodialer is a terrific accomplishment.

Joe