• 
• 
• 
• 
• 

How to control a Schlage electronic deadbolt with an arduino.

AKA Schlage lock hacking

Recently, for a product I was working on developing, I needed to prove I could interface a microcontroller with various electronic devices. My company is developing a patented interface that would replace many different types of code entry devices, Tactcess.

I found an older tutorial that showed how to hack a Kwikset Powerbolt. I started with interfacing my product with this. I decided that since the Kwikset keypad only had 5 unique buttons that there had to be a more secure starting place.

Enter the Schlage deadbolt. I picked it up on sale at Lowe's for $99. This lock differs from the Kwikset in a few ways:

1. The deadbolt itself isn't powered.
2. The deadbolt can be used with a key without any interference from the electronic mechanism.
3. Everything is made of metal, no plastic.
4. Last but not least, the Schlage unit has 10 individual number pads making it more secure from the start.

Satisfied with my purchase, I went home and opened the box. The construction of the lock is really great. Anywhere that could even remotely see any moisture is surrounded with rubber sleeving or a rubber o-ring. The lock has 3 basic parts:

• outside portion: This portion has a regular key cylinder, a knob for the deadbolt similar to what you normally see inside of a house, and a keypad for entering the code.
• inside portion: This portion has a knob to operate the deadbolt, a housing for a 9v battery, and a switch to tell the electronics in the front of the lock when the lock is in use.
• deadbolt mechanism: This portion is similar to any other deadbolt on the market.

The outside portion of the lock has a 2-conductor wire that goes through a rubber sheath and a plastic wire holder to the inside portion where it plugs into the 9v battery. Inside the lock there's a tiny little motor with a spring attached to the shaft. There's a plastic part inside of the lock that covers the spring and has a little leg that goes in-between two coils on the spring. Pretty simple idea. Motor spins one way, plastic part goes up and vice versa. This plastic piece pushes on a mushroom shaped metal part that engages a part on the back of the knob on the outer portion.

On to the hack! I disassembled the lock and tried metering all sorts of exposed parts on the circuitboard to try to figure out how the microcontroller was working. I gave up after 2 hours. I took some wire from a CAT5 cable and soldered it directly to the motor leads. I could make it work with a 9v. Progress! I routed these two wires through the same rubber sleeve that the original wires ran through so I could access them at the inside portion.

Not being big into electronics before, I had no idea how to go from here. I ended up finding a robotics page that showed how to use 4 resistors and 4 transistors to make what is called an H bridge. I soldered it up on some perfboard and it worked the first time. Excellent! I then took the leads going to the H bridge circuit and put them into two arduino output pins. I wrote some conditional code to read characters over the serial connection and operate the lock when Tactcess told the Arduino it was okay to do so. Basically I make the pins run for a few milliseconds in the "unlock" direction, pause for the same length the Schlage guts did, then make the pins run for a few milliseconds in the "unlock" direction.

After doing all of this, all I had to do was make different interfaces pass data to the arduino via the serial port. This made it easy to interface a parallax RFID reader. I can now control the lock via Tactcess, an RFID card, a key, and the original Schlage interface.