How to Crack a Safe's Combination with a Robotic Auto Dialer - Part 1

2023-01-09 | By Zach Hipps

License: See Original Project Adafruit Feather

This is my brother-in-law Levy, and he has a problem on his hands. A couple of years ‎ago, he bought a safe to store his valuables. He wrote the combination on a piece of ‎paper and locked it inside before going on a vacation abroad for several weeks. Upon ‎returning home, he realized he didn't remember the combination, and the only place it ‎was written down was inside the safe. He tried contacting the manufacturer but wasn't ‎able to get help recovering the combination. ‎

He sat down for hours and hours trying all the different numbers he could think of to ‎no avail. The safe has been sitting locked in his house for more than two years! That's ‎when Levy called me. There are 100 numbers on the dial, and the combination has 3 ‎numbers, so there are a total of 1,000,000 possible combinations! There is no way ‎someone could try all of those by hand; that would take several lifetimes. But if I can ‎find a way to test combinations quickly (and maybe find a way to reduce the number of ‎possible combinations) this might be doable! ‎

I'm not a locksmith, nor do I have any burglar skills, but I am good at engineering, ‎problem-solving, and building things, so I'm going to try to build a robot that can crack ‎the combination to Levy's safe. ‎

call_1

The first thing I did was research to see what is out there. I wanted to know what other ‎people have tried or if there are commercially available products that can do this sort of ‎thing. I came across a video on the Lock Picking Lawyer YouTube channel. He ‎demonstrated a safe combination auto dialer that appeared to be a commercial product, ‎but if you look closely at the chuck, you’ll see some 3D-printed parts. I did some ‎digging and found a similar device with a price tag of $6k for sale! I really liked the ‎simplicity of this design but, Levy isn’t going to fork over that kind of cash to open his ‎safe. My plan is to replicate the design and features of this commercial product. I will ‎also publish the CAD, code, and other design files as open source if others want to ‎build their own and improve on my prototype.‎

proto_2

Materials Required for this Project:‎

To start, I need a motor that can turn the dial as quickly as possible and try all the ‎combinations. I have a few options here. I could go with a servo motor, but it would ‎have to be the continuous rotation type, not the kind that only turns about 180°. I could ‎also use a regular DC or brushless DC motor, but I will need to know the precise ‎location of the motor shaft, so that would require an external encoder. ‎

Instead, I’m going to use a PD57-2-1076 stepper motor because it can be controlled ‎very precisely and has a lot of torque. The model I chose is great because it has an ‎integrated Trinamic motor driver built in, which is attached to the back of the NEMA 23 ‎stepper motor. The motor driver has a ton of useful features, like stall detection, which ‎can be configured over the UART interface. I connected a USB to TTL Serial converter ‎to the RX and TX pins of the motor driver and supplied 24V to turn it on. From there I ‎used the Trinamic software to configure the motor driver.‎

For the brains of this project, I wanted a microcontroller that features Wi-Fi just in case I ‎want to develop a mobile app to use with this device in the future. It would also be fun ‎to have the microcontroller email or send a message to your phone after it cracks the ‎combination. It could even send you the combination in the message! ‎

I chose the Adafruit Feather Huzzah ESP8266 for now. In the future, I may upgrade to ‎a more capable microcontroller with more GPIO pins. The nice thing about the Adafruit ‎Feather form factor is that I can just swap it out for an ESP32 Feather board later on, for ‎example. I also want to have an onboard display for status information and menu ‎selection so I’m going to use an OLED display. I also chose one using the feather form ‎factor so I can stack it on top, or use a doubler PCB. ‎

With these components sorted out, it was time to start assembling my prototype. The ‎motor driver has “Step” and “Direction” pins to control the motor output. There are also ‎other useful pins like “Enable”, and the UART pins “RX” and “TX”. ‎

Spinning the Motor and Detecting a Stall

The first order of business is to get the motor shaft spinning using some code written to ‎the microcontroller. I used the Arduino IDE to write and upload some simple code onto ‎the microcontroller. This first sketch just spins the motor back and forth. One of the big ‎problems I’m worried about with this project is being able to detect when the auto-dialer ‎has found the right code. ‎

There are several styles of safes out there, but most require the user to turn the dial or a ‎crank to open the safe. If the combination is wrong, the dial or crank won’t turn. That’s ‎fine if a human is trying to open the safe, but if a stepper motor is the one trying, it will ‎hit that hard stop and lose steps, stall out the motor, or worse, start to destroy things. So, ‎I really need to be able to detect when the motor stalls to signal when the right ‎combination has been found. This took quite a bit of work to figure out. ‎

I was hoping that the motor driver could be configured to automatically stop the motor ‎when a stall was detected, but I was wrong. It turns out that the motor driver only keeps ‎track of a load on the motor. This “load value” is large and positive when there is no ‎load on the motor. When a load is applied, the value decreases until it reaches zero. ‎The parameters in the motor driver must be set to tune the system so that the load value ‎reaches 0 right before the motor skips steps and stalls. ‎

With the parameters set, I need to write some code to spin the motor and poll the motor ‎driver constantly. This is done over a serial connection. I need to ask the motor driver to ‎send me the load value while sending the step and direction commands. The code ‎cannot be “blocking” meaning it needs to loop through without any instructions that ‎take too many clock cycles to complete. The code to spin the motor and check the load ‎value has to be lean and quick. This took me quite a while to get sorted out because I ‎kept introducing blocking code that would interrupt the step pulses and make the motor ‎really slow and jerky. ‎

I happen to have a logic analyzer tool that connects to my computer. I connected the ‎RX, TX, Step, and Direction pins to capture the timing of everything. It would have ‎been nearly impossible to solve the issues I had without this tool. It comes in super ‎handy in times like this. With this step done I was able to test my code and cause a ‎motor stall by applying a load with my hand. The microcontroller reads the load value ‎and when it gets too low it stops the motor commands and disables the output. It needs ‎some more fine-tuning, but it works well enough for now. ‎

tool_3

Building an Adjustable Chuck

At this point, I’m ready to design and build something so that I can connect the motor ‎shaft to the safe dial. I could try to design a custom coupler that fits the dial on my ‎brother-in-law’s safe, but I want to be able to use this on other safes at some point. ‎There are so many different diameter safe dials that I decided an adjustable chuck ‎would be best. ‎

The design found in the Lock Picking Lawyer video worked so well that I decided to ‎recreate it using 3D-printed parts and some easily found hardware. The trick is to use a ‎threaded rod that has both right hand and left-hand threads. If you thread a jaw on ‎each side and turn the threaded rod the jaws will either move towards each other or ‎away depending on which way you turn it. It’s effectively a screw clamp, but it needs a ‎smooth guide rod to align everything. The jaws and motor shaft coupler are basic 3D ‎printed parts. The fingers, which are what I call the parts that grab onto the dial, can be ‎‎3D-printed out of a flexible material like TPU. This gives them a little compliance ‎around the dial as opposed to a rigid material like PLA. ‎

chuck_4

Running my First Test

This is starting to look like how I imagined it in my head! I am ready to hold the motor in ‎my hand and lightly clamp the adjustable jaw around a safe dial. I went ahead and ‎bought a cheap safe for testing purposes because it would get really annoying to have ‎to drive to Levy’s house anytime I needed to test something. With my test safe on my ‎workbench and my crude prototype attached to the dial I press the button and watch ‎the dial spin around. I can even hard code the combination to my test safe and have ‎the motor enter the numbers really quickly. It seems to work pretty well, but I will have to ‎wait until I build out the rest of my prototype to see if I can figure out the combination to ‎Levy’s safe. This project will continue in part 2 so stay tuned!‎

Recommended Reading