A safe is a safe, is a safe, right? It’s just a big metal box? Actually. nothing could be further from the truth – the problem (with regard to perception) is that to the unskilled eye, they all look fairly similar. They might be static in appearance, but they serve a uniform purpose – to keep unwanted people out. To the left is an image of our sample safe. From the outside, it’s a very uninspiring confluence of mechanical properties. It’s a box. It looks chunky. It looks heavy. It also looks very simple, but it isn’t. It has two locks – a key lock and a combination lock. It also has a handle and two heavy duty hinges. In order to open the safe, both locks must first be unlocked and the handle then rotated in order for the door to pivot on the hinges.
Only when we open the door do we begin to have an appreciation as to the internal qualities (right).
As you can see, there is a significant amount of material and a much reduced amount of storage space, relative to the external dimensions.
For the remainder of the article, with the odd exception, we’ll dispense with the body and focus on the door only, as this is normally the best protected part of the safe, as it contains the locking mechanism.
So, let’s remove the back plate of our door (see image below) and take a look at what’s happening inside…
As this article does not cover the working of the locks themselves, they have simply been inserted into the model as two blocks of light blue material.
The basic operating principles
In order for our safe to be opened, firstly, both locks must be operated through the rotation of a key and the entering of a combination, respectively. In each case, this retracts the bolt of the respective lock, as shown below;
The lock bolts themselves do not directly lock the safe door into the body, but instead have a blocking action on what is known as the bolt work of the safe. Each section of bolt work is coupled to the central handle via a camming action wheel, as shown below;
So, if even one section of bolt work is prevented from retracting (in our case, the two horizontal sections), then none of the others are able to.
When the handle has been rotated – in our case, upwards, the bolt work is fully retracted into the door and the door can now pivot on its hinges in order to open.
Door composition
To start from the outside and working inwards, our safe has an array of different materials layered within the door. We’ll take a close look at what they are and why they are there presently, but first, it’s important to understand some basic concepts and fundamentals;
Everything is built to a cost – and that cost for a safe is equal to the associated risk that the safe is exposed to. In other words, a safe could theoretically be constructed out of materials such as Tungsten Carbide, Boron Nitride, Strontium Titanate, Cermets etc., but you would never sell one, as the cost would exceed the value of the goods that it contained.
All materials exhibit different unique properties, and in terms of safe construction, a variety of differing properties are desirable, as the intent is to present differing challenges to the safe cracker, which represent themselves in two primary ways – tools and time.
As an example, hard materials are brittle – a strong shock will make them crack. Soft materials are pliable and offer little resistance to force, owing to their low modulus of elasticity and modulus of shear. However, both of them serve their own purpose when attempting to create a composite barrier that will effectively delay attack.
Firstly, the multiplicity of materials requires that the safe cracker brings a wider variety of tools to the event. As an example, a angle grinder deals with Steel very effectively, but the disc tends to get clogged up by Aluminium.
This requirement for multiple tools not only acts favourably for the designer as a deterrent (inasmuch as it makes a break-in more time consuming to transport the equipment, and also more cumbersome and therefore more noticeable to authorities), but it also plays an important role in the overall attack time required – tool and equipment changes take time, and in the heat of the moment, people make mistakes.
Power cables are stepped on, or tripped over, leading to plugs becoming dislodged from their sockets, valves for thermal cutting gas supplies are turned the wrong way, people fumble over the key that’s required to change angle grinder discs etc.
It’s a very effective way of introducing confusion into an already extremely tense situation.
The image below shows a cross section of the door, with our different composite materials labeled, and the reason for using the door as an illustrative model is that it is almost always the best protected part of the safe.
The reason for this is simply because a small (successful) incursion through the door can result in the very large reward of defeating the locking mechanism and thus providing complete access to the safe.
Any attempt that requires the breaching of any wall of the safe would be exponentially more difficult, in order to achieve the same resultant cavity.
So, what’s actually in our safe door?
What is it, why is it there, and why is it in the order that it is?
The image to the left details what the constituents are:
When the outer steel shell of the safe has been penetrated, the first constituent that the would be safe cracker has to contend with is Concrete. This is there primarily for weight versus expense. Properly constituted Concrete can be extremely hard, particularly if it has been well mixed, vibrated to remove aeration and slump tested prior to pouring, however, our Concrete, which has of course undergone these processes, is also filled with random lumps of Aluminium Oxide. This is the same material that standard grinding wheels are made from.
Safe manufacturers usually give their own proprietary mix of Concrete and various ceramics their own trade name, such as ‘Aloxite’ or ‘Adamantium’. It’s relatively cheap and as it is only present in certain parts of the Concrete, it therefore fulfills the role of not only a deterrent, but also as a deflector. A sectioned image is shown below;
The below image shows a tungsten carbide drill bit entering the safe door – this has been preceded by a HSS drill bit making the initial hole through the steel outer skin… keep on making the burglar change tools…
Arms Vs Armour
In the age old tradition of Arms vs Armour, arms will eventually always win if the kinetic energy of the projectile is applied perpendicular to the surface of the armour. So deflection is the key – to deflect that energy, and allow it to continue on its way, whilst being mildly dissipated, as shown below;
In the image below, the intent of the drill bit hole is to attack the gudgeon pin that secures the free floating bolt to the rest of the bolt work (this will become clearer later on), but as the deflection occurs at a relatively long distance from the intended point of contact, the magnitude of error is greatly amplified.
The main point of this protection layer is that dissimilar hardnesses of materials within the same zone can make life very hard for a would-be safe cracker, and that if you intend to deflect, do so as soon as possible, in order to amplify the effect of the deflection.
Concrete, although both hard and tough, doesn’t fair well under thermal attack. Exothermic processes such as Oxy-Acytelene torches can rapidly degrade its compressive modulus, and thermal lances (even operating in an unassisted electrical mode) can easily reach 4,500°C, slicing right through it.
So, the next layer is Copper, which not only has excellent thermal conductivity (resulting in a high heat dispersion rate), but also serves to aggravate the layer behind it to the extent that when the Copper finally relents, there is now a high pressure jet of semi-vapourised Aluminium that will issue forth from the resultant hole… This isn’t pleasant for anyone in the vicinity.
However, Copper can be removed with relative ease by a HSS drill, or with the use of a standard grinding disc. The next layer – Aluminium – is prone to clogging up grinding discs, and also for melting easily and re-forming as a solid substrate on the tips of drill bit flutes. Lubrication is always preferable (Paraffin is good), but again, this is not only another element that has to be brought to the ‘job’, it also entails the continuous removal of the drill bit and re-application of the lubricant, thus slowing things down further.
The alternative is to make use of a very low cutting speed and a very high pressure. This is beyond the capabilities of a standard hand held drill and requires the use of either a electro-magnetic drill press (pictured), a vacuum based drill press or a fixed drill jig that has been drilled and tapped onto the surface of the safe , but you can see how the equipment requirement and weight is increasing per layer of material.
Following the Aluminium, we have a sizable layer of Bitumen. This, from a manufacturing standpoint, is a very useful material. It has a relatively high specific gravity that adds significantly to the weight of the safe, it’s also very cheap and offers excellent resistance against both drilling and cutting attack.
If you wanted a material that was specifically designed to clog up a grinder disc, this would be your first choice.
It also performs admirably against drill bits. The angle required for a drill bit to effectively penetrate Bitumen is very similar to that of rubber – about 135°. Again, this requires a tool change and a separate component. Not only that, enormous pressure and very low speed is also required by the use of a drilling rig. Another good feature of this material is that when thermally cut, it produces large amounts of noxious fumes. This requires some form of breathing protection for the assailant/s.
The Bitumen is located relatively deep within the door, as in the event of an unfocused delamination attack, it is relatively easily removed through the use of chisels, pry bars and even screwdrivers.
Can’t we just go to the pub?
Then we have a layer of Manganese steel (or Mangalloy). Manganese alloys are renowned for their toughness, as they retain their hardness during impact, without any appreciable increase in brittleness. They are generally made through the introduction of Manganese into a relatively high Carbon content steel.
They are extremely abrasion resistant and hold a property known as ‘work hardening’. This means that under certain load conditions they can increase their initial surface hardness by as much as a factor of 2.5
No ordinary H.S.S. drill bit can penetrate this material, and only with great difficulty can either a Tungsten Carbide or Diamond core drill do so. Again, enormous pressure and low speeds are required to do so.
As an example, I’ve personally experienced the drilling of a very high grade Mangalloy ‘hard plate’ that was 10mm thick. This was in a very high end safe.
It required the use of an electro-magnetic drill press that was further constrained to the safe through the use of a rigging strap, with three people pushing/pulling on the rack & pinion lever (which provides an approximate x3 mechanical advantage) and the use of over 400 rotary grade specialist Tungsten Carbide drill bits.
It took four hours.
To penetrate 10mm.
That can become a little disheartening… When the metal that egresses from the hole is finer than Talcum powder and floats in the air, you’re in for a hard day…
This is certainly the hardest material in our safe, so why not place it on the outside? There’s a school of thought that says this is where it should be, as it will take proportionally more time to remove a sufficient amount of it in order to obtain a hand sized hole at the inner limit of the safe, given the inevitable tapering of the initial hole size as it progresses inwards.
However, it’s not cheap, so the surface area it now covers is approximately 20% less than if it were exposed towards the front.
There is also another school of thought that takes into account that such a hard material may be easily delaminated from the door when on the surface, and that the previously mentioned penetration hole attack will taper inwards, thus resulting in a far greater difficulty for grinders (considering the diameter of the disc) etc. when attempting to access the material when it is located further inwards.
Judging by the placement of this material in our sample safe, you can see which side of the fence I come down on.
And then finally, we have a somewhat incongruous element – vulcanized rubber. This serves several purposes, one of which is related to skilled brute force attack and will be covered presently.
For an unskilled attack, it has the property of generating an enormous amount of choking and sight limiting smoke in the event of a thermal cutting attack. The operator of the cutting equipment will require assisted breathing apparatus, and there is the additional complexity of now not only having to disable the building burglar alarm, but also the building fire alarm.
I made this mistake once, with the result that about 600 employees of the affected Company were all marshalled outside when the fire alarm sounded. It was about minus 5 degrees and as the freezing rain slowly melted from their faces, they bored looks of pure concentrated hatred towards me. It’s not an experience I would like to repeat…
As we’re looking at brute force attacks in Part 1, it’s important to note that even for such a form of attack, there is a clear delineation between skilled and unskilled brute force penetration of a safe.
Hollywood, Shmollywood
Even the best locksmith/safe engineer/ burglar can’t pick or manipulate every lock, so in many cases a ‘point penetration’ is used in order to access a known vulnerable point in the lock or the safe. This usually involves drilling a hole in a spot that is either known through meticulous record keeping, or worked out from experience.
Sometimes a thermal lance is also used to overcome a particularly recalcitrant barrier material that a drill cannot penetrate, but only as a point penetration for a second or two.
For an unskilled brute force attack, this in itself can be subdivided into three distinct categories – people who have done some research, people who haven’t, and people who know less than nothing about the laws of Physics.
Let’s look at the last one first… Explosives – that’s a good idea, right?
Well, they can be, if applied properly. But when the people attempting to crack the safe don’t understand Newtons’ third law, it’s usually a very bad idea. As a perfect example of both Newton and Darwin being proved correct, view the below video clip;
If you look at the image below, which is a cross section of the door and body, showing the tapering of the door into the reciprocal taper of the body, it should occur to you that simply stacking a pile of Dynamite up against the door, lighting the fuse and then seeking cover may well end badly. I started to write a very long section on the skilled use of explosives in safe cracking, but I decided that I couldn’t in all conscience follow it through. Sorry for all you pyromaniacs out there, but for the criminals, learn how to blow your own fingers off – I’m not helping you…
Note: The body in this image is simply a grey CAD generated block – in reality, it would comprise of a steel outer and inner shell, with a concrete and Aluminium Oxide nugget infill.
There have been many recorded instances of leveled buildings with intact safes being recovered over 100 meters away from their original location. Not only is the safe still intact, it’s now almost impossible to open, as the door has been explosively welded into the body, which has expanded to accommodate the compressed door.
If the safe isn’t of a good quality, then the night sky will just rain down charred banknotes, none of which will be legal tender, even if you can recover them…
There are a few very effective ways to use explosives against safes, but that isn’t the focus of this article, and nor is it the intent to provide criminals with the info. they require.
So, the next category – people who haven’t done any research.
This usually entails a thought process that goes something like this (otherwise known as a syllogism) – ‘If I take the hinges off the front door of my house, the door will fall open. A safe has hinges, therefore if I remove them, the safe door will fall open’.
Fortunately, no. Almost all safes, no matter what the quality, make use of at least ‘Dog bolts’ on the hinge side of the door – these are fixed, tapered protuberances that engage with recesses in the frame. The tapering is required for geometric reasons. Our safe, as you can see in the image below, has non-tapered bolts on the hinge side, as they move in and out with the rotation of the handle (this is called a four way boltwork mechanism). It’s a feature of better quality safes, as it ensures a tighter engagement between door and body at the hinge side, preventing the insertion of a crowbar or wedge. So this means that cutting through the hinge pins with a grinder is nothing more than the waste of a cutting disc.
The next usual step, following the same thought process, is to attempt to remove the lock/s from their fixings to the door – if there’s no lock bolt stopping things from moving, then the handle will turn, right?
Again, no… Usually, if the lock is a combination lock, then the dial will be smashed off the door with a hammer and a punch will be used to to force the spindle of the lock through the body of the door.
This triggers an internal ‘re-lock’ mechanism to activate in the lock. Part two will address this properly, but keep in mind the term Re-lock. It’s one of our safes’ best weapons…
For key locks, the same approach is used of attempting to punch the lock off the back plate of the door. In the image below, you can see that the lock is mounted on a set of rubber grommets, which isolate it from the body of the safe. Between the lock and the safe door, there is a glass plate. This is constructed from tempered glass, which has the propensity of brittleness. It is possible to drill through it, but as this usually generates a lot of BTU’s, the glass tends to shatter upon cooling. It has been done in controlled situations before, but a late night safe breaking is anything but a controlled situation…
Note: The locks in all the images in part 1 are displayed as little more than a graphic block, as the intent of this part of the article is to examine everything other than them. Detailed imagery will become available in Parts 2 & 3.
The Glass plate was actually invented by the British Government in the 1960’s, as a way of protecting their high security safes, secrets documents, for the storage of.,,
They didn’t patent it though, so within a year, every high security safe manufacturer in the world was making use of the idea.
The principle is that if any forcible attack (including drilling) is made upon it, it will shatter. In the image below, you can see that a steel cable is attached to the glass plate. This runs to a door mounted re-lock.
The above image has had the body of the re-lock made transparent – it’s actually a block of steel welded onto the safe door. This will then engage the sprung loaded bolt into a cut-out in the safe bolt work…
You can see from the above image that there are two cut-outs…
This provides the safe manufacturer with a further element of randomness against a specific point penetration attack, and although they may appear to be quite close to each other, remember the principle of deflection at an early stage – in this case they are 30mm apart, but through a door of our thickness, that’s as good as a meter, in terms of ‘hitting the nail on the head’.
The image below shows the same re-lock mechanism (in solid form), but sectioned:
You can see from this image that there is also a cross-locking element to the re-lock – to the right of the main pin, there is also a small spring loaded pin that will jump into the annular groove of the main pin, in the event that the re-lock is triggered.
This prevents a hole being drilled and the use of a screwdriver or other instrument being used to force back the main re-lock pin. This type of re-lock (for there are three), is known as a ‘dead’, or passive re-lock.
It’s also common practice for the uninformed to give the safe handle a good blow with a sledgehammer. As you can see in the below cross sectioned image, our safe has a couple of features in the handle to prevent this from being successful.
And we also have a turned down section (an annular groove), designed to shear before the lock bolts do, owing to the nature and cross section of the material, and also a ‘anti drive’ thickened feature, to prevent the handle from being punched through the door.
Also, as seen in the above image, our safe has a handle that rests in the 9 o’clock position when locked, but requires rotating to 11 o’clock when unlocked – in this simple way, it’s very easy to alleviate the potential of a forcible sledge hammer blow delivering sufficient force to shear through vital locking elements of the mechanism. It’s much harder to swing the hammer upwards.
Of course, if we were solely reliant on this, then we wouldn’t be doing our job properly, but if it’s a security feature that can be included at no additional cost, then why not?
This alignment of our handle also serves to quite effectively prevent another method of explosive attack, which comprises of attaching a powerful spring and tensioning winch to the handle, and then filling the key lock cavity with explosives. When the explosives are detonated, they propel the lock away from the door and prevent the dead re-lock from actuating in time to lock the bolt work, as the bolt work itself is under such tremendous force from the spring that it has already reached its opening point before the plunger of the dead re-lock has engaged with it.
This gave rise to the ‘live’ or active re-lock. This usually comprises of a loosely attached bolt that is coupled to the lock bolt itself – if the lock is forcibly removed from the door, the coupling between lock bolt and re-lock is detached, resulting in the re-lock remaining in the locked position, engaging with the safe bolt work.
Our safe has one of these, but in a quite devious manner, and one that aims to deter different forms of attack, as will become apparent soon.
The last category of re-lock is the thermal re-lock. Although not shown in our model, this is usually in the form of a Tin/Lead soldered coupling attached between two strands of re-lock cable, similar to a thermal link in boilers, that melts at a certain temperature. Preferably before the door materials succumb to a thermal attack. Other manufacturers (notably Chubb) have also made use of an Acetate sheet and Terylene plastic cables to thwart such attempts – the acetate ignites, and the Terylene melts…
For the last unskilled category,
People who have done some research.
This can take several forms;
Given that the risk/reward ratio is very high and that for a few hours work, the prospect of hundreds of thousands of Dollars is within reach, some criminals do some research. This can include on-line research, detailing the qualities of a specific safe (one of the reasons that the safe which this article centers around is a generic CAD model…). The more intelligent ones even purchase an identical model and perform an examination and conduct physical testing on their safe prior to performing the real thing.
This can prove problematic for the safe manufacturer, as with all assembly processes the most efficient way is to standardize all components. However, the element of randomness is hugely favourable for the safe, both in terms of point penetration attack and an unfocused penetrative attack.
The reality is, that for any attempt to make a hand sized hole through a composite high security safe door, the starting periphery of the hole must be approximately double the depth of the thickness of the door. This assumes an ingress angle of 30°, which is approximately true for an attack that relies on multiple methods of material removal, including grinding, chiseling, punching etc.
Such an attack usually starts with the delamination of the front shell of the safe with an angle grinder, shown below;
See the images below for a (very smooth CAD generated) example of how such an attack progresses through our composite safe door.
The real life reality is slightly different, in that, as all these tools impact areas in different materials that are harder than their surrounds, the inclination of the tool is to deflect inwards, but in a very uncontrolled manner.
You can see therefore, that if a certain spot is being aimed for within the safe mechanism, any deviation from the expected position in either the Z or Y axis will result in an error of at least double the magnitude at the point of incursion.
Skilled brute force penetration attacks
These are usually conducted by a locksmith/safe engineer and are performed when a key has been lost, a combination forgotten, or a fault has occurred in the mechanism. Or, when a locksmith/safe engineer has gone bad and thinks they can make some serious money in short order…
The safe doesn’t distinguish between the two above categories. It has only one job – to keep anyone who doesn’t possess the key or combination at bay for as long as possible.
Such an attack on the safe occurs when the Hollywood safe cracker can’t click his fingers and open the safe with a subtle tap here or there.
Welcome to the real world…
Reality bites…
It is of course possible to pick key locks and manipulate combination locks (parts two and three coming soon…) but sometimes, it simply isn’t going to happen, usually owing to time constraints. Five hours to attempt to manipulate a Comb. Lock (yes – it can take that long in the real world), or one hour to punch a hole through the safe…
And then you get what we covered earlier…
Really, are you sure we can’t just go to the pub…
Broken glass and a triggered re-lock… so then it’s time to go hunting, usually with a borescope. To do it properly, you would first locate the re-lock/s and peg it/them back, prior to breaking the glass. A hole is drilled through the door and the fibrescope/borescope is inserted for a good look around. When the re-lock is (approximately) located, and a hole is drilled through the safe in a (hopefully) accurate position, the hammer and punch get to work in order to obviate this issue.
But it frequently requires more than one inspection hole, and this is where the vulcanised rubber plays a role in protection from skilled attack – when you remove the drill bit and insert the borescope, it will slide in with some difficulty, but good luck when attempting to remove it, as the rubber continues to contract… That’s why it was also used for sealing aircraft fuel tanks in WW2, in case a bullet passed through it.
So this means you need to drill a larger diameter hole (more time consuming) and then have to knock a sacrificial piece of tubing through the hole with an internal diameter sufficient to allow the borescope to pass through.
Sneaky, and proud of it…
We touched on live re-locks previously, but now it’s time to explore the one that our safe contains. Hubris is always a dangerous emotion, but we’re all guilty of it to some extent, and this is my design to mess with people like me…
In the above image, you can see the bottom section of the bolt work – the focus is upon the right hand bottom bolt that is connected to the sprung loaded cantilever plate, and also the right angled plate that is attached to the bolt of the key lock.
The Silver coloured pin is connected to the vertical bolt work and moves with it.
Although the intent of this article is not to cover the working of safe locks, it is essential, at this point, to take note of the fact that a skilled lock picker can immediately determine if a safe lock is locked or unlocked. That may sound strange to the uninitiated, but remember that a safe lock can lock upwards, downwards, or left, or right.
In any event, our key lock is designed to be used as a subterfuge. It is actually designed to be left unlocked in order to keep the safe, err.. safe.
The bolt of the key lock doesn’t actually engage with the bolt work of the safe, as the combination lock does, in the first images. It makes use of the lock bolt as a bit of trickery – locked = unlocked. Unlocked = locked
In the above image, the key lock is actually unlocked, but this means that when the bolt work of the safe is turned, the right hand bottom bolt will remain locked, as it is detached from the main bolt work and is acted upon by spring pressure. See the image below for clarity:
If the key lock is left in the locked state, therefore maintaining the presence of the plate, the following will happen:
As the bolt work is retracted, the cantilever action of our ‘floating’ bolt withdrawal mechanism comes into play.
As I designed this, I’m obviously partisan, but I can only imagine how much this would mess with my head if I was to attempt to open it – you’ve done everything correctly, you’ve either picked the locks, or penetrated the safe to effect an opening, and everything is just as it should be.
But the safe won’t open….
It’s only one bolt of the mechanism keeping it closed, but how do you, as the attacker, know that, or more importantly, which one…?
If I was a criminal, I’d be out of there, quick sharp….
Coming soon…
If you enjoyed this, parts 2 and 3 will be available soon, and you may also contact the author at [email protected]
In part two, we’ll take a look at the mystical world of safe combination lock manipulation (yes, it is entirely possible, but Hollywood has a lot to answer for – the locks don’t go ‘click’, ‘click’, ‘CLUNK’ when you’ve found the right combination…),
And then in part three we’ll look at the wide and ingenious range of covert attacks that safe key locks have to withstand. Generally, this is far more rigorous than for door locks, as the reward can be far greater.
Disclaimer: It is the understanding of the author that all information contained herein is already within the public domain .
Text and illustrations © K.I.S.S. [email protected] 2017
