Here's something that was posted over on ar15.com. This was written by a gentleman named Tony. He works for AMSEC and is one of their safe designers.
The UL RSC Test is no trivial matter, it is conducted by the same guys that do the TL high security safe testing. These guys "know" everything, and even though the test is run with only one attack technician, there is a group watching and consulting at every step of the test to assure the best approach and methods are applied. The tool list basically allows anything in your toolbox, with limits on the drill bit size to 1/4" diameter and sledge hammers no more than 3lbs, and prying devices no more than 18 inches long. The only power tool allowed is a hand-held drill.
The tool complement may seem unimpressive, but that is definitely not the case. I have watched them make a 3/4" diameter hole with a 1/4" drill bit in 20 seconds. They modify tools (without any time penalty off the test clock) so that they can be more effective. They abuse tools way beyond their intended application. The drill bits are top quality, and the testing techs know how to make them work at their optimum. If they can bend, grind, cut or shape a tool for a special need, that's allowed and off the clock.
The test is limited to five (5) minutes, but that is very deceiving. The clock only runs when there is tool-on-product, and a single 5 minute test can take more than an hour to run. Also, the team can run as many different 5-minute attacks as they choose. So, if they see multiple areas they suspect are vulnerable, they can go at each attempt as they desire. A full range of testing generally takes the better part of the day, unless you know your stuff and have left very little to concern them. These guys have seen it all, from every manufacturer in the world, at every level of security. They can pretty well look at a safe, drawings and pull the door cover to decide if the safe is a good design or not.
The Lock is a key area, as you might guess. For a lock hardplate, there are many approaches to protecting that area. The simplest of which is to put a thick carburized (case hardened) plate under the entire locking area so that the lock, the relocker(s) and the point of engagement with the Locking Bar, so that entire area is protected. That plate needs to be at least 1/4" gauge steel, if not more, and have a Rockwell C of at least 56. That is roughly the hardness of a good mill-file. The most vulnerable spot in the mechanism is the point where the Locking Bar contacts the Lock Bolt. This is UL's favorite drill point.
The UL guys drill with uncanny precision. They have the drawings, and they disassemble the safe to plan their attack. The attack method used is to bore a hole right thru the center of that contact point where the Locking Bar meets the Lock Bolt, taking off a piece of the Lock Bolt and a chunk of the Locking Bar. This pierce alone allows the boltwork to move toward the unlocked position another good bit more than normal. They then cram a nice new bit in the hole and crank it up full speed and start hanging on the handle to press the locking bar into the drill bit. They wrangle the drill around as this pressure on the handle forces the locking bar to get milled off on the side of the drill flutes. All the while, they are twisting and rotating the drill making the hole larger and larger. Once they get thru the hardplate, they can get this milling operation to pull back the boltwork enough to use a pry bar to open the door in a couple minutes. This is the primary reason you see shear points and clutch devices on the Handles of better safes, so the side-force at the lock bolt is limited in this attack approach.
The best defense here is to have a hardplate in that specific area that is too difficult to penetrate with a high grade Carbide tipped drill bit and a good quality (Milwaukee) high power hand drill. A carburized plate is nowhere near good enough to hold up to this attack. A skilled operator can put a hole in a Rc 58-60 hardplate in under 2 minutes. There must be more than that in this one sweet spot. There is a company in LA that sells a disk we call the "Gunsafe Disc", and it will hold up to this drill attack. It's not cheap, but it's effective. It's a 1-1/4" diameter round disc that is a bit under 1/4" thick. One side is heat-treated tool steel, the other side is a high-temp silver-soldered matrix of Tungsten Carbide powder. The whole assembly is heat treated to a high level of hardness. We punch a hole in the Carburized Hardplate (before hardening) so this Disc sits under the lock bolt hidden under the mounting plate.
Players that have not attempted to get their RSC rating are unaware of the intensity and effectiveness of this test. The UL rating does present a much higher level of security assurance. There are other more simple techniques that UL uses to defeat Boltwork systems. They study the entire Boltwork system, and look for points where a hole under a specific point (or points) would allow a punch to collapse or buckle a key element or elements in the system. They also look for fasteners and connections that are easily removed, broken or drilled off. Remember, the whole door is easy to punch holes thru, so they can attack 5-6 points in under 5 minutes with ease. The clock only runs when tools are on the safe, so five minutes of testing can take an hour or more. I see those weaknesses in unlisted products. So, when you see a Boltwork with lots of fancy gears, clusters of big linkages, and pretty chrome plated parts, don't be so impressed. Most of those things are there to impress the uneducated eye. They offer very little in added security, and in some cases actually provide compromise opportunities. A basic 3-bolt system on the locking side is just as effective as a 30-bolt system with bolts on all four sides. It's all glitz, and no go.
Other methods include side-attack on the Boltwork, unlike the TL-15 and TL-30 testing. They can, and will attempt to punch the boltwork back by accessing one or more locking bolt thru the side and banging on it with incredible skill with a heavy punch. This is where the timid fail. Good punch resistance is not easy to come by, and requires several preventative measures to assure it survives.
Pry attack, wedge and sledge on the door gaps, hinge removal are all on the table, and they will exploit any weakness there. If deadbolts are not effective, you can fail real fast. You would be shocked at how fast these guys can knock off those pretty glossy brass-capped hinges on the safe. Last, they test the body, even if you meet or exceed the material minimum requirements that are not documented. You don't get a pass because you use heavier steel. They like to drill a circle of holes about 4 inches in diameter with the drill, then punch out the plug. This takes every bit of 5 minutes with an 10 gauge body. Dual steel layers add to the difficulty and allow slightly lighter outer steel barriers. Much of this testing is left to luck and cosmic tides. If you get a bad break, and a test that would typically be easy becomes a failure point, too bad, you lose. The opposite applies too, so if a tech has a bad day, misses a drill point, breaks a tool where it's stuck in the breech, you win a favorable outcome.
That's most of the UL RSC testing in a bucket. There is a lot more, but these are the fundamentals. I assure you, it is no trivial effort to achieve a rating. Particularly if you are not a seasoned security producer with extensive experience. Testing is expensive. I think the most recent price was around $12,000 to run this test. Most have to come back twice to get their listing. Anyone that says they passed on the first try is probably telling a lie. Most of the guys in this industry didn't have a clue until they went in for testing. Most everyone comes away shocked and disappointed.
Sent from my Torque using Tapatalk 2