Update on "Modding a Door Lock". Help with Electrical?

If you’re new to this project or it’s your first time hearing of it, I’d recommend checking out my previous post to catch up. What’s new you might be asking? Well…

I managed to figure out which of the two ports on that ribbon cable were responsible for making the door open. In a dramatic turn of events, it was the top two of them. When these two ports were connected to the ribbon cable, scanning my room key turned the motor and unlocked the door. So modding the door lock is back on! The next thing to figure out was some sort of hole between the back and front of the door to thread the antenna cords through. I got lucky again in that the insider electronics and outside reader are held in place with a two screws through the door. The inside electronics, though, only require one to be function, so we have our pass through area now.

My only concern is making sure I do the wiring correctly. If both wires must be powered to activate and I don’t want to break anything, what’s the best way of going about wiring using the yellow (normally open), green (normally closed), and white (common). I’ve never really done any electronic work before, so I’m a little lost. I’ve included a picture of the two wires below so you can get a sense of the setup I have. Should I strip the middle of both of my addon red+yellow wires and wrap the white and yellow wire around them so it’ll short on a read? Any help would be appreciated and a reminder that both of these ports must be connected or else nothing will happen.

First, it’s really imperative that we understand what is going on electrically here.

  1. Does it cycle if you just connect both wires together? With or without original connector attached?

  2. If not, do both wires go to a hot (+voltage) when it opens? How many volts?

  3. Does the original connector with all the wires need to stay connected? I’d say probably so, just so as not to tick off the landlord.

  4. Are these wires signal only, or are they actually providing power to the lock motor?

Also, on an unrelated note, is the door wood or steel? And can you get inside (hollow core)? I’m thinking that if hollow and wood, that you could put the antenna on the INSIDE of the door glued to the inside of the outer door skin. You might be able to read through the door making the whole rig invisible, A.K.A Magic!

Hi @ODaily! to address your questions:

  1. I tested the ports by shorting the red and yellow jumper wires with a male-to-male black wire, but there was no response from the door. I suspect the tag is scanned by the outdoor scanner, which is powered and signal transmitted through the right rainbow cable. Something happens inside that center black box (I believe verification with the dorm room key server), the the according yes/no signal is given through the left rainbow cable/the two red+yellow wires I jerry-rigged. The picture below should help clarify:

  2. I haven’t gotten the most consistent readings, but it looks like 1V at most for both wires. If the internal motor is being powered by the black box, it can’t be more than 4.5V (3 AAA batteries).

  3. If by original connector you mean the ribbon cable or its port on the black box, I’d say we gotta keep them, but since I can bypass with my own jumper wires, it shouldn’t be a huge problem.

  4. As for if they’re signal or power, I’m fairly certain the lockframe in the door doesn’t come with an internally powered motor, so it must come from the batteries. Otherwise, I imagine shorting the two ports on the ribbon cable would have triggered it.

As for hollowness, I believe its a wood door with no hollow points, so we’d have to thread the antenna wire all the way through. Worse comes to worse, I can do a tiny drill hole that can’t be seen behind the sensor plates.

We need to find some arrangement of connections that wil cause the lock to open. Basically figure out how to hotwire it, then run the hot wires through the xAC.

What has me worried is the 10 wires. It’s entirely possible that there are two motors, on for the handle and one for the deadbolt perhaps. They could be stepper motors, that would account for all the wires. 2x5 each.

Stepper motors are a simple idea, BUT, in complex motion. Basically the shaft rotates through a bunch of fixed positions, one step at a time. Tiny steps, insanely fast. The wires are in pairs and are turned on / and off in a sequence that requires a microcontroller to make happen. That might be part of what’s in the black box.

The bad news, if I’m right, then the only place you could possibly interface is inside the black box, which is gonna be impractical at best.

In order to find out, you’ll need to check the ohms (resistance) between pairs. Read THIS and scroll down to the part about coils and phases. Look at the 5 wire setup. I bet you’ll find the white wires are the fith wires (one per motor) and the rest are the other four. Part of the clue is that they are in color pairs, two red, two blue, etc. I bet the first of one color, goes to one motor, and the second to the other.

No way it’s a stepper motor. There is no reason to use the extreme accuracy that comes with a stepper. And it so far from being cost effective that’s it’s not even a possibility. Let’s not chase ghosts.

That may well be, a multimeter would be a simple way to check and eliminate.

This lock is also rebadged as a Yale Affinity lock. Some interesting tidbits in the docs.

Card Reader and Relay Box
140 mA @ 12 VDC
140 mA @ 24 VDC

An external 12V or 24V DC power supply must be connected to the relay box for proper operation. Relay box
contains a 9V backup battery for loss of main power.

This can’t be reverse engineered without a multi meter. Otherwise you’re pissing into the wind.

I don’t agree with any of that.

The wire harness indicates that it’s probably a stepper because of the number of wires (and by extension the number of coils). It’s not a three phase AC motor, that’s for sure. Lock mechanisms can use stepper motors. It’s not for the accuracy, but to set an endpoint to the travel. A DC motor would stall against the lock stop and draw excess current. They’re not as expensive or bulky as you think. A multimeter would be an easy way to test that, as ODaily said

@Appellus, it’s unlikely you’ll be able to directly work the motor(s). I think you’ve really got three options here. I’ll list them in the order I’d try them.

#1, Buddy up to the security desk. Get your chip system enrolled. If you can pull this off it’s the best option.

#2 Attack the lock’s emergency exit function. This might or might not work. Could be mechanical or electrical. To find out, I’d open it while locked from the inside, then relock and take the batteries out and do it again. If it works the second time, it’s probably mechanical, don’t waste any more time on it. BUT, if it won’t work without batteries, it’s probably electrical and I’d look real hard at the door handle to see if I could figure out how the lock knows it’s being turned. If it’s just a switch, then you’re golden to use the xAC.

#3 Skip modding the lock, and build a small motor / servo assembly that can push on the handle to unlock it or that can rotate the lock knob. This would be separate from the lock, and just manipulate the controls the lock already has.

1 Like

#4, get an xM1 and clone the factory tag.

1 Like

@ODaily:

  1. I’ve been doing some sleuthing around the software they use and it’s the Visionline from Assa Abbloy. I had them test a few nights ago to see if they could write my regular room key card (Ultalight EV1) to one with a 4 byte UID to see if the software would adapt to the card, but no dice as it said there was a MAD error. The only other way I can think to do it would to have my UID installed manually, but after talking with one of their representatives at Assa as an aspiring hotelier, I wouldn’t be able to learn more until I signed an NDA.
  2. The Emergency exit is mechanical, as the door is never locked from the inside. Basically, whenever I leave my room, turning the inside doorknob will disengage the deadbolt and any locks. I apologize for not having mentioned this explicitly earlier as I imagine it shoots down a few of the emergency exit style rewires.
  3. This actually sounds very viable, any idea for what would be needed besides the motor, servo, and xAC? I’m doing some looking around but it seems difficult to find servos that could work.

@cexshun
4. I wish I could but the factory tags are Ultralight EV1’s with a 7 byte UID, while the flexMT I have installed only has Magic technology for 1k and classic cards.

Gears, some sort of framework, lots of time. I think you’d need / want a 3D printer. Be prepared to sink a lot of time into it. There is an example you can look at to get some tips, the guy did some really clean work.

@ODaily and @Satur9

Apologies for dragging you to an old thread, but there are some updates to the project that you may find interesting/I could use your advice on. I did some more testing and found out that the door lock only requires two specific wires to be plugged in to work. As a refresher, scroll back up to the labeled image.

So, with this door rainbow cable, only the brown and red wires need to be plugged in to the top two pins:

I then connected a brown jumper cable to the top pin/top cable opening and then connected a green jumper to the second pin/second cable opening. You can see with the video below that when they are not both plugged in, the reader still functions, but the door lock will not open. However, when the two cables are plugged in with their normal configuration (top to top, 2nd to 2nd), the door unlocks when scanned with the card in my wallet.

Video of the wire setup and opening the door

Even more interestingly, if I swap the input (top pin to second cable opening and second pin to the top cable opening), when I bring my keycard to the door, the door stays locked. Then, after the usual amount of “open” time (when functioning normally), it unlocks, and stays unlocked. The best explanation is that it appears I flipped the signal, where, when the wires are switched, the default state is “open” instead of “closed”. As someone who is still a novice in electronics, any idea what’s going on here? Does this mean rewiring the lock is back on the table?

Sorry for the delay, I was really tired when I first read it, then went to bed without replying. Sleep is a kind of auto-delete sometimes.

There’s a lot going on in that lock, and I just don’t think we know near enough to be modifying it. What we really need is to find something that when connected, causes the lock to function. If I had it here in front of me it would be slim odds. Trying to do it over the net makes it that much harder. I still think your best bet is to build something else entirely that you CAN control, and use that to open the door knob.

1 Like