I have an old Herring Hall Marvin safe that has been passed down through my wife's family. We believe the safe was originally purchased by her great great grandfather somewhere around 1920-1930, but that date range is a rough guess. The last person to actually know the combination to the safe was her grandfather who passed away over 30 years ago. This safe has sat unlocked at a relatives house for decades, however, recently the safe was accidentally locked and now we don't know how to get back in. Here are some pictures:
I didn't know much about safes or safe locks prior to starting this project, but I like to tinker so I was asked by the family to try to get into the safe. It doesn't have anything too valuable in it, but it does have some genealogy records in it that we would like to get back out. Safe lock manipulation sounded very interesting so I started researching on the internet and unfortunately there is not much on this safe to specifically identify it. One of the only tags on it is a UL stamp that says it is certified to Group 1. From what I have read that means that this lock should be very difficult to manipulate and it should have a tighter tolerance on the gates that most home safes (I think UL standard said +/- 1 max for Group 1)
I don't really know what the correct dialing order is for this safe or even how many digits are in the combination or if i am pulling the handle the correct direction. Based on other posts I found on the internet I am assuming it is a 3 digit combination with a dialing order of L - R - L - R where I return to 0 on the last right turn before trying the handle in a counter-clockwise direction. I am hoping someone in this forum can help point me in the right direction here using the pictures.
With this information I decided I was probably going to have to brute force the lock with an auto-dialer. I don't really want to do anything to damage the safe (at least yet). I tore apart an old 3D printer that I had and repurposed the controller and the stepper motors to make a safe auto-dialer. Pictures are included below. I modified the Marlin firmware for the 3D printer to perform the auto-dial algorithm instead of being a printer. The nice thing about starting from a 3D printer and its firmware is that I already had controls for the stepper motors including acceleration control and an LCD with a built in menu I could fiddle with, etc. That part of this worked out pretty well.
I 3d printed a ring to hold the motors and fixed magnets all around the ring to hold the contraption onto the safe. My original version had a single NEMA17 motor connected directly to the dial, but it turns out a single direct drive motor didn't have enough torque to reliably turn the dial. I swapped that out for some 3d printed gears and 4 NEAM17 motors. My 3d printer that I cannibalized had 5 motors on it and by using 4 motors I could hold the center piece that attached to the dial just with the friction on the 4 gears on the motors. I also decided that I needed to try the handle after every dial to see if the safe opens so I stole the Y axis from the 3d printer and clamped it to the front of the safe and added a wooden block to push on the handle. I am using one of the axis limit switches to detect when the handle moves further than normal indicating a successful dial. I am doing a counter-clockwise pull of the handle. After a lot of trial and error and some tweaking the dialer seemed to be doing a good job. Here are a couple of links to videos of it in action:
Video dial mechanism - https://youtu.be/K5aG0CZDLqM
Close up of the handle pull - https://youtu.be/AjK83Yqw1J8
And here are some more pictures of the auto-dialer setup:
The bad news is so far my auto-dialer has failed me.
I decided to step in increments of 2 and to start at 0.5. I figured if I started at 0.5 (i.e. half way between 0 and 1) then I was within +/- 0.5 of both 0 and 1 and that *should* be close enough for a Group 1 lock. The next number to try is 2.5, etc.
I am trying to be efficient with my dialing algorithm to minimize the number of rotations needed to increase speed and reduce wear on the lock. I found other posts in this forum describing similar methods. My general algorithm is something like:
Initialize things with the standard:
Set target combination of 0.5, 0.5, 0.5
Spin counter-clockwise stopping on the desired number the 4th time
Spin clockwise 2 full turns
Spin counter-clockwise 1 full turn
Spin clockwise stopping on 0
Try the Handle
Now to be efficient:
Increment the combination to 0.5, 0.5, 2.5. Only the 3rd digit changes. By spinning counter-clockwise to 2.5 and then clockwise back to 0 I can move the 3rd number and not affect anything else. Repeat until I have tried all 50 possibilities for the 3rd dial.
Now I have to change the 2nd dial. It is most efficient to decrement the 2nd dial instead of increment because we adjust that dial with a clockwise motion. Set desired combination to 0.5, 98.5, 98.5 and move clockwise to set the middle dial and then counter clockwise to set the 3rd dial and then clockwise back to zero to try the handle.
My first two attempts at this algorithm had some defects in it in some of the corner cases. It takes about 4 days to try all 125,000 combinations using this algorithm and I have run that full set 3 times now. I was a lazy software programmer (I am a hardware engineer by trade) and didn't originally take the time to fully simulate my code and test it out before just letting it go. Watching the dial move and building a quick model of a lock dial out of wood I found my errors and on the 3rd iteration I finally built a full simulation of the lock in software and ran my algorithm through it to verify I got all of the movements correct. In case anyone cares, I did post that lock simulation to github. It is a python model of the lock and a python version of the c code I was using in the Marlin firmware. There is a long story on me trying to get simulations to work in the Marlin firmware build system, but that was a pain and python was WAY faster for me to setup due to familiarity. The code is here: https://github.com/jerrbe/py_dial_test/tree/master The LockClass.py is the model of a combination lock and the lock_test.py is essentially a clone of the actual logic I added to the marlin firmware.
So after that long explanation, I am looking for any advice anyone might have on the best way to get into this safe. I would love to get opinions on whether or not I am dialing in the correct order, whether or not we believe this lock has 3 numbers with a 4th spin to 0, etc. Does this lock have friction disks is another one of my questions. If not I probably have too high of acceleration.
Here are a couple more observations I made tonight:
1. After running my auto-dialer for approximately 12 days the lock mechanism definitely seems to be a little beat up. It feels a lot more loose than it did before I started and it makes more noise when I turn the dial by hand than it originally did. I hope I am not doing anything too terrible to it...
2. I tried to spin the lock one direction 5 or 6 full turns and then slowly spin the opposite direction and count when I pickup the additional rings. It is usually really hard to notice the first pickup, but after trying several times I could hear/feel that I picked up that dial about 3 digits before whatever number I stopped on initially. (i.e. if i spin counter-clockwise 5 or 6 times and stop on 20 then when I spin clockwise I seem to pickup that next dial at about 23 or 23.5). As I continue around picking up the 2nd dial is a lot more noticeable and that seems to happen about 6 or 7 digits from the initial stop. The 3rd dial is really hard to tell exactly when it picks up, but within a few digits of pulling it along I can feel the extra drag on the dial. It seems to pickup around 10 or 11 digits from the first. I cannot feel anything beyond that 3rd ring so I *THINK* this is a 3 digit combo, however, the drag is much higher and the lock is a big noisy when it spins so I could easily miss it if there really were a 4th ring. The fact that I am picking up about 3 or 3.5 digits before I get back to my original number seems to indicate to me that this lock has solid pins or fly instead of floating ones and there is a chance I am messing up some of my numbers with my dialing algorithm when I get close to wrapping around. I probably should update my simulation to model this 3.5 wide fly and see how much of the combination space I messed up...
Sometimes it feels like the some of the dials are sticking and I hit a rough spot or another pickup or something in a completely different place than where I stopped my initial spinning. Like 30 or 40 digits away. This might just be a rough spot in the lock or some extra friction from a friction disk or ??? It seems unlikely to me that somehow the rings would stick together, but I mention it so someone smarter than me can comment.
3. I tipped the safe over on its back for the first time today looking to see if there were any other markings. There is a square plate in the bottom center of the safe that appears to be tack welded in a couple of corners. I have no idea what this plate is or why it is there. Attaching some pictures below. If anyone has thoughts let me know. I am sort of wondering if someone cut into this safe once before through the bottom? I don't know why else it would be there...
Thank you in advance to anyone who takes the time to read this and respond. Any feedback would be most appreciated.
