Unlocking a Gary TL-15 Round-door Safe

Taking a dialectic approach to safe opening

By Jeremy Reeder, Certified Journeyman Safecracker. (C) 2007 The Safe House. Originally published in Safe & Vault Technology, Volume 22, Issue 5, September 2007.

A man once closed and locked a safe, knowing that the combination was written down . . . somewhere. Ten years later, the safe remained locked and the combination had not been found. Since the owner of this safe wanted to start using it for his business, the company requested my services as a safecracker.

When I arrived at that business, I was led to the safe shown in figure 1. It was a red Gary safe with a jeweled steel face and a chrome-plated, spy-proof Sargent & Greenleaf dial. The serial number on the door was 46792. I knew very little about this model of safe. In fact, everything I knew is what I just told you. I simply had not yet had the priviledge of working on any hinged round doors made by Gary. It is wonderful, when approaching a job like this, to have good documentation of all relevant details about the safe. This article, however, is intended to demonstrate that a good plan of attack can often be devised even without such information.

Figure 1

Having taken note of all the visible characteristics of the safe’s exterior, I started manipulating the lock. The first steps of this are to identify internal lock characteristics and to confirm functionality of various lock components. By the lack of gear noise, I can suppose that this is a direct-drive lock. By feeling contact points, I can tell that it has either a spring-loaded or perhaps gravity-driven fence that seems to be operational. By feeling wheel pick-up, I can identify this as a three-wheel lock with moveable flys. These characteristics are rather typical, but let’s not make unconfirmed assumptions. These things are usually easy to check.

I did not get this safe unlocked by manipulation alone. I won’t make excuses for that, but I moved on with the information I had gained. Since the lock is direct-drive, its wheels are on the same axis as the dial. (If it were indirect-drive, however, the wheelpack location would be difficult to predict. I would search for more information before attempting an opening by frontal penetration.) The wheels of most safe locks have about a 7/8” radius, and none that I’m aware of are over 1+1/4”. It seems common for small round-door safes to be rather burglar-resistant, based on which I estimated that the lock was mounted 2” to 2+1/2” behind the face of the door. This measurement might be considered to have been pulled from my wazoo. The radius of the dial is 1+1/2”.

I planned to use the aforementioned measurements to get a view of the wheelpack, somewhere near its circumference. I needed no access to the fence, because the lock seemed to be perfectly functional. I needed no view of the fence, because transferring is easy. To avoid depositing debris in the wheelpack, I generally avoid drilling within or above its top half. The lock I was dealing with seemed much like a Sargent & Greenleaf 6730 but could have a very different lock case. Some round doors have an integrated wheel post and plenty of space around the wheelpack, since the door itself is the lock case. If the lock case were like that of the 6730, the most space would be found toward the lock bolt (most likely to the left, I supposed), while sufficient space would likely be found in the corners farthest from the bolt. Based on all this, I chose a target that seemed to have the most potential - one that I believed would work for various possible configurations. Eight ball, lower left corner pocket!

Preferring to avoid damage to the chrome dial and to the visible portion of the jeweled door face, I chose to drill through the dial ring at about 65. To get close to the circumference of the wheelpack, I would have to drill at somewhat of an angle, as shown in figure 2. I drilled with StrongArm and Joran Uni-Plus tungsten-carbide-tipped bits in a hand-held drill, alternating between 1/8” and 3/16” sizes and pausing from time to time to beat on the hardplate with a punch. When the drilling became easier, I carefully finished my hole, anchoring an elbow against the safe and bracing the drill motor’s side handle for a controlled entry into the lock. My bit emerged inside the safe’s door, which I felt as a slight forward surge.

Figure 2

Removing the drill, I inserted a 2.7mm borescope with a 30-degree direction of view and a 70-degree field of view. I saw no lock case around the wheelpack, but a curved obstruction kept me from viewing the wheelpack as closely as I wanted. Although I was tempted to drill through the obstruction, I chose to live with the view I had for now and see if it was good enough. I like to avoid unnecessary damage to the lock, and I couldn’t be certain that the part restricting my view did not have an important function.

Next, I would determine a combination. I got out a black marker. Watching through my borescope, I turned the dial left until I was looking at the gate of wheel 1. With a black marker, I made a mark on the dial, pointing toward my borescope hole. (All marks made can be seen in figure 2.) A front-reading dial wouldn’t need these marks, but a spy-proof dial ring conceals the dial graduations at my drill point. I continued the dialing procedure, making a mark on the dial when wheel 2’s gate was aligned at the hole, and again when wheel 3’s gate was aligned. I couldn’t see wheel 3 very clearly, but the difference between seeing a wheel and seeing the gaping hole known as a gate was not impossible to discern. Having obtained a combination that would align the gates of all three wheels, the safe was nearly open. This combination, however, involved the use of my own markings instead of the original dial graduations, and it aligned the gates directly behind the markings rather than at the fence.

All that was left was to transfer this combination to a different index - one directly in front of the fence. But where is this fence? It is common for spring-assisted fences to be located near the top of the wheelpack, with a slight bias in the direction of the lock bolt, just as it is with a purely gravity-driven fence. Based on this commonality, I made a mark on the dial ring at 97 - three graduations left of the opening index. This, I believed, was a likely location for the fence. (If it did not work, I would try others. I didn’t really know where the fence was, but it’s not a big deal.) I dialed my combination to my proposed fence index, jiggled the dial slightly at the contact area, then turned the dial to the right. This retracted what turned out to be three lock bolts, and I could then pull the door open.

The safe’s interior - shown in figure 3 - is rather small in relation to the exterior. The walls are lined with green felt, but the felt has been covered with wood panels. The back cover of the lock is labeled with information about the safe: that it is a TL-15 burglar-resistant safe, and that it has a Group 2 lock, a U.L. listed relock device, and “copper and hardened alloy steel plates.”

Figure 3

With the door’s back cover removed in figure 4, the entire lock can be seen. It has solid mesh-change wheels, 7/8” in radius as usual. The drive cam has the same radius. The fence and lever are combined in one solid piece. The lock part that limited my view of the wheelpack is a large circular cam, to which the fence lever and the door’s three locking bolts are attached. While the function of that cam is vital to this safe, I could have drilled through it for a better view without hindering that function. (The cam and drill bit are shown in figure 5, with the wheelpack removed.)

Figures 4 & 5

After disassembling the lock, I was ready to repair the hole I had made in the safe. Breaking off the business end of a few used carbide-tipped drill bits, I mixed them with JB-Weld and stuffed the mixture in the hole. Next, I cleaned all of the lock parts, lightly lubricated the lock’s bearing surfaces, cleaned my marks off the dial and ring, and reassembled the lock.

I then determined the safe’s numerical combination, which is only distantly related to the index numbers marked on the wheels. I tested the lock’s combination and varied it until I was satisfied that it accurately aligned the wheel gates with the fence. Finally, I replaced the door’s back cover, which contains a pin that holds the relock device in check. I instructed my customer on the operation of the lock and went on my way.

Every bit of available information is an asset, and it’s always nice to have more. Many characteristics of a safe and of its lock, however, can be determined by the safecracker and do not necessarily have to be read from published or personal records. In many cases, a logical approach is enough to open the safe, as I hope to have demonstrated.