Lock Engineering Maths: Combinations & Tolerances

Why is mathematics important in a pin tumbler lock? A key looks like a piece of shaped metal, yet its operation depends on discrete choices, measured depths, alignment, tolerance, probability and system planning. The interesting maths is not about defeating a lock. It is about designing authorised access so that the correct key works reliably, ordinary incorrect keys do not, parts can be manufactured, and a whole key system remains manageable.

This article stays deliberately on the engineering side of that boundary. It does not provide picking, decoding, impressioning, drilling or bypass instructions, and it does not reproduce a manufacturer’s restricted bitting rules. We will use invented examples to study combinations and tolerances. Real security decisions belong with the relevant manufacturer, qualified locksmith, facility owner and security professional.

The subject is a strong lesson in mathematical honesty. The tempting calculation b^n, with b possible depths at each of n positions, gives a theoretical count. It is rarely the count of usable, distinct or secure keys. Mechanical limits, adjacent-depth rules, reserved patterns, keyway compatibility, master-keying, manufacturing variation and policy reduce the practical set. Counting is the beginning of a design, not the end.

The mechanism as a mathematical model

In a simplified pin tumbler cylinder, each position contains components that can align at a boundary often called the shear line when the authorised key lifts them to the intended height. If every relevant position aligns within the permitted range, the plug can turn. If one or more positions does not align, the mechanism should remain blocked under normal operation.

That description immediately introduces several mathematical objects. Positions form an ordered sequence. Depths come from a finite set. Each key can be represented abstractly as a vector such as (2, 4, 1, 3, 2), where the digits are invented category labels rather than a real manufacturer code. The lock checks the vector mechanically, subject to tolerance.

The UK National Protective Security Authority overview of locks lists pin tumbler locks among several lock types and stresses that a lock should be considered as part of the complete doorset. This is an important systems lesson. A mathematically large key space does not guarantee a secure entrance if the door, frame, hardware, key control or operating procedure is weak.

Discrete and continuous mathematics meet

The depth labels are discrete: a design may allow a stated set of nominal steps. The manufactured geometry is continuous: a cut has an actual measured depth, not a perfect integer label. A lock therefore joins combinatorics with measurement science.

The authorised nominal pattern might say “category 3”, but the actual key surface will fall within a permitted interval around the target. Pins and cylinder features also vary. Reliable operation requires the combined variation to stay inside a functional window. Security and usability both depend on that window being controlled.

Did you know?

A product can have excellent nominal dimensions and still fail if the variations stack in the same direction. Engineers therefore analyse tolerance chains, not just individual drawings. The same reasoning appears in engines, cameras, medical devices and sheet-metal assemblies.

Counting theoretical key combinations

If each of n independent positions has b available labels, the multiplication principle gives b^n ordered strings. With five invented positions and four labels per position, the raw count is 4^5 = 1,024. Order matters: (1, 2, 3, 4, 1) is different from (4, 3, 2, 1, 1).

The reasoning is a tree. At the first position there are four branches. From each branch, the second position has four more, giving 4 × 4 = 16 partial patterns. Repeating through five positions gives 4 × 4 × 4 × 4 × 4.

Model	Count	Assumption
b labels at each of n positions	b^n	Every choice is independent and allowed
Different label count bᵢ by position	b₁b₂…bₙ	Choices remain independent
Exactly r positions use one special label	C(n,r)(b-1)^(n-r)	Positions are chosen, then other labels assigned
Some adjacent pairs forbidden	Not usually b^n	Dependence must be modelled

Combinations in everyday speech can be confusing here. In combinatorics, a combination usually ignores order. A key pattern does not ignore order, so b^n counts sequences, words or ordered assignments. Calling them “key combinations” is conventional, but the calculation uses the multiplication principle for ordered positions.

Growth is exponential

Adding one position multiplies the raw count by b. Adding one new allowable label at every position changes b^n more dramatically. For six positions, increasing from five labels to six changes the raw count from 15,625 to 46,656. That does not mean security has tripled. It means the idealised set contains about three times as many strings.

Logarithms can express the information content of the theoretical set. A uniformly chosen set of N possibilities has log₂N bits of choice. For 4^5 = 1,024, log₂1,024 = 10 bits. Again, this is not a security certification. Real selection may be non-uniform, physical constraints leak structure, and attacks may not be random guessing.

Why theoretical combinations are not usable changes

Lock manufacturers use the term key changes or differs for distinct keying possibilities under specified rules. An older NIST report on lock and key terminology discusses key changes and combinations in the context of lock standards. Current product decisions should use current manufacturer documentation, but the report remains useful for understanding why vocabulary must be defined.

Several filters can shrink a theoretical count:

Some nominal patterns may be mechanically invalid.
Large changes between adjacent depths may be restricted by key geometry or manufacturing rules.
Some values or patterns may be reserved.
Different keyways define which blanks can enter which cylinders.
Master-keying can make more than one key operate a cylinder, consuming or overlapping possibilities.
Duplicate physical outcomes can arise if tolerances make nominally different patterns insufficiently distinguishable.
Organisation policy may exclude easily confused or operationally risky patterns.

These restrictions create dependence. If choosing label 1 at position three changes which labels are allowed at position four, the choices no longer multiply as if independent. A valid count may require dynamic programming, a state machine, a graph or direct enumeration of permitted sequences.

A safe adjacency model

Consider an invented code alphabet {1, 2, 3, 4} with the rule that neighbouring labels may differ by at most 1. This is not a real lock specification; it is a classroom constraint. From 1, the next label can be 1 or 2. From 2, it can be 1, 2 or 3. The number of choices depends on the current state.

For length two, the valid pairs are counted by row totals 2 + 3 + 3 + 2 = 10, not 4^2 = 16. For longer strings, let a_k(j) be the number of length-k strings ending in label j. Then a_{k+1}(j) is the sum of counts from labels allowed to precede j. This recurrence demonstrates how local mechanical rules reshape global capacity.

Students can calculate the counts without ever handling a lock. The mathematics transfers to spell-checking, DNA sequence constraints, production scheduling and network protocols.

Inclusion and exclusion

Suppose a six-position classroom code uses five labels, but patterns with all six labels equal are excluded. The raw count is 5^6 = 15,625 and five constant patterns are removed, leaving 15,620. If additional rules overlap, subtracting each forbidden category separately can double-subtract patterns. Inclusion-exclusion corrects the overlap.

This is a useful warning for product claims. A large headline number may be a raw theoretical count. Ask what was excluded, what overlaps, what compatibility class applies and whether the number describes one cylinder, one keyway or a planned system.

Tolerances, clearance and reliability

Tolerance is an allowed deviation from a nominal value. If a nominal feature is 3.00 mm with tolerance ±0.05 mm, its permitted interval is 2.95 to 3.05 mm. This does not mean every value in the interval is equally likely, nor does it prove the assembled mechanism will work. It states a conformance boundary for that feature.

In a lock, several variations can affect alignment: key-cut depth, pin length, plug and shell geometry, wear, dirt, lubrication, temperature and the angle or force with which a key is used. A robust design provides functional margin while limiting unintended acceptance.

Worst-case stacking

Imagine an educational assembly in which three signed dimensional errors contribute to an alignment error e = e₁ + e₂ – e₃. If each magnitude can be at most 0.03 mm, the worst-case magnitude can reach 0.09 mm when directions align unfavourably. Simply quoting “±0.03 mm parts” hides the accumulated possibility.

Worst-case analysis guarantees coverage if all specified limits and model assumptions hold, but it can be conservative. Statistical tolerance analysis estimates likely distributions when component errors are understood and production is stable. It must not replace safety or security requirements that demand guaranteed limits.

Root-sum-square reasoning

If independent, centred errors have standard deviations σ₁, σ₂ and σ₃, the standard deviation of their signed sum is √(σ₁² + σ₂² + σ₃²). Three equal 0.01 mm standard deviations yield about 0.0173 mm, not 0.03 mm. This describes variation, not the maximum possible error.

The assumptions are substantial: independence, stable distributions and correct centring. Tool wear can create correlation or drift. Measurements may be biased. Statistical calculations become misleading if those conditions are not checked.

False rejection and false acceptance

An authorised key that does not operate is a false rejection in access-control language. An unauthorised key that operates is a false acceptance. Widening mechanical acceptance can reduce false rejection but may increase overlap between neighbouring nominal patterns. Narrowing acceptance can improve separation but reduce reliability under wear and contamination.

This resembles the threshold trade-offs in Why Mathematics? | Fingerprint Matching, Minutiae and False-Match Rates. A mechanical lock and a biometric matcher are not equivalent technologies, yet both show that changing an acceptance threshold shifts more than one kind of error.

Measurement capability

A measurement system needs resolution and repeatability suitable for the tolerance being checked. A tool that displays to 0.01 mm does not automatically measure accurately to 0.01 mm. Calibration, technique, contact force and environmental conditions affect the result.

Manufacturers use gauges, process control and inspection plans to manage variation. The deeper lesson is found in Why Mathematics? | Manufacturing Tolerances, Measurement and Quality Control: a tolerance is part of a measurement-and-decision system, not merely a plus-minus symbol.

Master-key systems as sets and hierarchies

A simple keyed-different arrangement aims for one authorised key pattern per cylinder, with duplicates issued as policy allows. A keyed-alike arrangement lets one key operate several cylinders. A master-key system gives selected higher-level keys authorised access to multiple cylinders while change keys operate narrower sets.

Set notation clarifies the plan. Let D be the set of doors and K the set of issued keys. Define an access relation A contained in K × D. If (k,d) is in A, key k is authorised for door d. The relation can be shown as a matrix with keys as rows and doors as columns, marking permitted pairs.

Key role	Lab	Store	Office	Plant room
Lab user	Yes	No	No	No
Store user	No	Yes	No	No
Facilities role	Yes	Yes	No	Yes
Site manager	Yes	Yes	Yes	Yes

This table is an illustrative policy matrix, not a mechanical bitting plan. It separates the question “who should enter?” from “how will the hardware implement that permission?” Good design begins with the access requirement.

Least privilege and key control

Least privilege means giving only the access needed for a role and period. Mathematics helps audit the matrix: count each role’s permissions, identify doors with unusually many authorised keys, and find orphaned permissions after staff changes.

Physical key control adds inventory questions. How many copies exist? Who holds them? When were they issued and returned? Which cylinders are affected if one key is lost? Graph theory can represent doors and key roles, while database constraints can prevent duplicate or inconsistent records.

The Allegion key systems overview presents key systems, cylinders and key control as a coordinated offering. Its detailed product rules are manufacturer-specific. The general inference is that a key system is an organised access system, not merely a large pile of possible cuts.

Expansion capacity

An organisation may reserve capacity for future doors, departments or hierarchy levels. If every available change is consumed immediately, later expansion can force costly rekeying. Planning resembles address allocation in networks: a mathematically efficient dense assignment today may be operationally inflexible tomorrow.

Master-keying also changes combinatorial relationships. A cylinder intentionally accepts multiple keys, so the naive statement “one combination equals one key” no longer describes the system. Cross-keying can further complicate the access relation. Qualified professionals use manufacturer rules and specialised records to avoid unintended interchange.

Worked examples without bypass instructions

Example 1: raw sequence count

An invented classroom token has six ordered positions and five possible symbols at each. The raw count is 5^6 = 15,625. If a seventh position is added, the count becomes 78,125. One additional position multiplies capacity by five.

This answer is valid only under the stated model. It does not estimate a real lock’s usable changes, resistance to attack or certification level.

Example 2: reserving categories

Suppose 15,625 abstract strings exist, but 625 are reserved for administration and 1,200 violate a rule. If 125 strings lie in both groups, usable strings equal 15,625 – 625 – 1,200 + 125 = 13,925. The overlap is added back because it was subtracted twice.

Students should draw a Venn diagram. It makes the correction visible and discourages blind formula use.

Example 3: reliability across independent events

If an authorised access operation succeeds with probability 0.999 under a specified test condition, the probability that 100 independent operations all succeed is 0.999^100, about 0.9048. This does not mean every real sequence is independent or has constant probability. Wear and contamination can create dependence.

The example shows why a tiny per-operation failure rate can matter at scale. Engineers test cycles and investigate failure modes instead of relying on a rounded success percentage.

Example 4: expected service calls

Across 20,000 yearly authorised uses, suppose a validated model estimates a 0.02% jam probability per use. The expected count is 20,000 × 0.0002 = 4. Expected value is a long-run average, not a promise that exactly four events will occur. Clustering and changing conditions can produce very different observations.

Example 5: access-matrix audit

A matrix has 12 key roles and 30 doors, so it contains 360 possible permission cells. If 54 are authorised, density is 54/360 = 15%. Low density does not automatically mean good security, but a sudden rise after a policy change is worth reviewing.

Count doors authorised to more than half the roles and roles authorised to more than half the doors. Those are audit prompts, not automatic violations. Context may justify them.

Security claims need multiple layers of evidence

A combination count is only one property. Physical security also involves resistance to forced attack, covert manipulation, key duplication controls, installation quality, the door and frame, hinges, glazing, alarms, monitoring and operational response.

NPSA’s doorset perspective is therefore mathematically sensible: the system’s effective performance can be constrained by its weakest relevant component. Multiplying an enormous theoretical key-space number does not strengthen a loose frame.

Certification statements must be specific. A product may be tested to a defined standard, grade, configuration and installation method. Do not generalise from one model to a family, or from a component rating to the complete opening. Current official product and standards documents are the proper source.

Threat models also differ. A school storeroom, a residential entrance and a high-security facility have different assets, adversaries, consequences and operational needs. “Best lock” without context is not a useful mathematical question.

Reliability, maintenance and evidence over time

A lock system is used repeatedly, so performance over time matters as much as a new-product measurement. Wear can shift dimensions; debris can raise friction; keys can bend; doors can move relative to frames. A maintenance plan turns these observations into data rather than anecdotes.

Suppose a site records authorised uses and service events by month. Event rate can be expressed per 10,000 uses rather than as a raw count. Five events during 20,000 uses is 2.5 per 10,000. Four events during 8,000 uses is 5 per 10,000. The smaller raw count belongs to the worse normalised rate.

But a rate comparison needs uncertainty. With rare events, one or two incidents can change the estimate sharply. Plot counts and exposure over time, inspect the actual failure modes, and avoid declaring a trend from two points. A jam caused by a misaligned door should not automatically be attributed to the cylinder.

Survival thinking

If time-to-failure is recorded for many comparable units, a survival curve estimates the proportion still operating without the defined event after a number of cycles or months. Censored observations—units still working when the study ends—contain useful information and should not be treated as failures or simply discarded.

The median time-to-event is the point where the estimated survival falls to 50%, if it does. Mean life can be distorted by a long tail and may not be observable in a short test. A product claim should state the test load, environment, failure definition and sample size.

Process control rather than final inspection alone

Inspecting finished parts can catch defects, but stable manufacturing also monitors the process. A control chart plots measurements in time with a centre line and statistically derived control limits. A point inside specification is not necessarily evidence that the process is stable; a sustained drift can appear before parts cross the tolerance boundary.

Specification limits come from design requirements. Control limits describe observed process behaviour under a statistical model. Confusing them can produce dangerous decisions: widening a specification to fit a drifting process does not improve the product.

Consequence-weighted decisions

Not every failure has equal consequence. A sticky cabinet lock and a failure that blocks emergency egress are not interchangeable events. Risk is often framed as likelihood combined with consequence, but multiplying two subjective scores does not magically create precise probability.

Use a risk register to document the hazard, affected people, existing controls, evidence and responsible decision-maker. Life-safety egress hardware is governed by codes and qualified design; ordinary key-space arithmetic must never override it.

Lost-key impact as a graph problem

In the access relation A, a lost key k affects the set N(k) of doors it can operate. The size of N(k) is an exposure count. A high-level key may have a large neighbourhood, but door criticality also matters. Weighting doors by impact gives a review score Σw_d over authorised doors.

This is not a replacement for a security response plan. It helps prioritise that plan: identify affected openings, determine whether cylinders or credentials need changing, preserve incident records and restore controlled access. A well-designed system keeps current documentation so the impact set can be found promptly.

Privacy and record security

Key-control records reveal access structure and personal assignments. Collect only necessary data, restrict access, retain it according to policy and protect backups. An accurate matrix that is carelessly exposed can create risk. Data governance is part of the system boundary.

Students can discuss this without operational detail. Ask which fields a school key register genuinely needs, who should see them, and when an old record should be archived or deleted. Mathematics organises information; ethics governs its use.

Comparing physical and electronic access models

Electronic credentials often replace a physical bitting pattern with an identifier checked by a controller. Permissions can be time-limited, logged and revoked without changing every door cylinder. That flexibility does not make the system automatically secure.

An electronic system depends on credential protection, reader installation, controller configuration, power, network design, software updates, logs and recovery procedures. A mechanical override may still exist. The access matrix remains useful, but the implementation and failure modes change.

Probability language must stay careful. A 128-bit identifier space does not mean an attacker must always try 2^128 independent guesses. Protocol weaknesses, stolen credentials, poor enrollment or misconfiguration can dominate. As with physical keys, theoretical possibility count is not whole-system security.

Hybrid systems show transfer of learning. Sets still describe authorisation, graphs still describe reach, event rates still describe reliability, and least privilege still limits unnecessary access. The mathematics survives even when the hardware changes.

Common misconceptions

More theoretical combinations guarantee more security. Usable changes, physical construction, key control and the doorset all matter.
Tolerance means error is acceptable anywhere inside a range. A specified feature can be in tolerance while the assembled system fails because of stacking or an incorrect model.
Digital-looking codes make a lock electronic. Discrete labels can describe mechanical geometry.
A master key is simply a duplicate. It belongs to a planned hierarchy and intentionally operates a broader authorised set.
A lock secures the whole door by itself. Frame, installation, hardware and procedure are part of the protective system.
This mathematics teaches bypass. Counting and tolerance analysis can be taught entirely with abstract strings, measurements and access matrices.

Safe learning activities for students

Model combinations with coloured cards

Use four colours and five positions. List or program all ordered strings, then introduce invented rules such as “no adjacent cards may share a colour” or “red may appear at most twice”. Compare raw and valid counts. Explain why the second count cannot be obtained by casually subtracting percentages.

Build a tolerance stack from paper dimensions

Give three nominal paper-strip lengths and allowed deviations. Calculate worst-case total length. Then generate simulated measurements from centred distributions and compare the sample spread with the worst-case boundary. Discuss why simulation is evidence about a model, not proof about production.

Design an access matrix

Invent a community centre with rooms and roles. Apply least privilege, temporary access and emergency needs. Count permissions, review unusually broad rows or columns, and describe the reason for every exception. No lock geometry is required.

Explore recurrences

For an abstract sequence with adjacency limits, calculate the number of strings ending in each state. Put the transition rules in a matrix and multiply state vectors. This connects secondary mathematics to graph theory and dynamic programming.

Write an evidence ladder

For a hypothetical product claim, separate:

calculation from the idealised model;
measurement from a prototype;
test result under a named standard;
interpretation for a stated threat model;
decision by the responsible owner.

This is powerful media literacy. It prevents a large number in an advertisement from becoming an unsupported safety conclusion.

Guidance for parents and educators

Frame the topic as design for reliable authorised access. Avoid demonstrations that reveal bypass techniques or invite experiments on locks that the learner does not own and have permission to handle. Use abstract codes, transparent educational models or manufacturer-approved training equipment under qualified supervision.

Ask students to state assumptions every time they count. “Five positions, four independent labels, all strings allowed” is a complete model sentence. “There are 1,024 keys” is not, because it silently turns an invented count into a physical claim.

Useful prompts include:

Which choices are genuinely independent?
What rule makes the next choice depend on the previous one?
Is this number theoretical, usable, issued or authorised?
Which tolerance is individual and which is assembled?
What evidence supports the security conclusion?
How would loss of one high-level key change the affected set?

Connect the lesson to ethical technology. Access knowledge carries responsibility. Students can study systems deeply while respecting ownership, consent and lawful use. The same principle applies to cybersecurity; this eduKateSG article on cybersecurity and digital resilience provides a broader context.

Mathematics pathways and careers

The skills appear in mechanical engineering, manufacturing, metrology, quality assurance, facilities management, security engineering, operations research and access-control software. Combinatorics supports capacity planning; statistics supports reliability and process control; graph theory supports permission structures; geometry and measurement support manufacture.

A qualified locksmith also combines product-specific training, skilled practice, ethics and legal responsibility. Mathematics alone does not confer professional competence. Likewise, studying this article does not authorise work on someone else’s property.

Students can strengthen the foundation through algebra, probability, statistics, graphs, matrices and computing. For a wider learning map, see the eduKateSG Mathematics Learning Hub.

Frequently asked questions

Is b^n the real number of keys a lock can have?

Usually it is only a raw theoretical count for b labels across n independent positions. Real usable changes depend on product rules, geometry, keyways, master-keying, reserved patterns, tolerances and policy.

Why does order matter?

The first physical position is not interchangeable with the second. Changing the same set of labels into a different order creates a different sequence. The calculation therefore counts ordered strings.

What is a tolerance?

It is a specified permitted deviation from a nominal value. It does not describe the exact distribution of production, and one part being in tolerance does not guarantee the assembly works.

Why not make the acceptance window extremely narrow?

Real keys and cylinders vary and wear. An excessively narrow window can reject authorised keys. The design must balance reliable operation and separation, supported by testing and security requirements.

Does master-keying increase the number of locks?

No. It changes which keys are authorised for which cylinders. It can create hierarchy and convenience, but it also consumes planning capacity and changes consequences if a key is lost.

Can two different nominal keys become mechanically similar?

If nominal steps, tolerances, wear and measurement are poorly controlled, acceptance ranges could approach or overlap. Proper product design and manufacturing rules are intended to maintain functional separation.

Is a larger key space always more useful?

Not if it is achieved through unusable patterns, weak components or unmanageable administration. Capacity, reliability, physical resistance and key control must fit the actual system.

Why avoid real bitting examples?

The mathematical principles do not require operational details that could facilitate misuse. Invented labels teach counting, constraints and tolerance while respecting safety and ownership.

Final perspective

A strong classroom summary distinguishes four counts. The theoretical count comes from an abstract alphabet and positions. The valid count follows the stated design constraints. The issued count records patterns actually placed in service. The authorised count describes the access relation for a particular door. Mixing these categories produces impressive but misleading statements. Keeping them separate makes audits, expansion plans and incident response much clearer.

The same discipline applies to tolerance values. Nominal is the intended target, specification is the permitted boundary, measurement is an observation with uncertainty, and performance is the assembled result under defined conditions. None of those words is a synonym for the others. Students who learn that distinction are already thinking like quality engineers.

Pin tumbler locks show why mathematics matters because a familiar object joins several kinds of reasoning. Combinatorics counts ordered possibilities. Constraints turn simple powers into recurrences and filtered sets. Tolerance analysis connects nominal categories to real dimensions. Probability describes reliability without promising certainty. Matrices represent who should enter where.

The most important conclusion is modest: no single number proves security. A responsible answer states the model, the exclusions, the measurement limits, the system boundary and the evidence. That habit is useful far beyond locks. It is the habit of making quantitative claims that deserve to be trusted.

Why Mathematics? | Pin Tumbler Locks, Key Combinations and Tolerances