For my sins I used to design electronic locks for the Hotel Industry.
The design limitations can be put simply as,
1, They must work with existing doors / furniture.
2, They must be estheticaly pleasing so that architects etc will design them in.
3, They must be cheap to manufacture (BOM < $30).
4, The Hotel should see a ROI within 3 years against "key loss".
5, The maintance cost must be low.
6, The locks should be "guest proof" and the front desk unit should be "blond proof" (I know it's un-pc but that's what it was called in the industry and it's still in use).
There are four main reasons why electronic locks in Hotels fail to work once installed,
A, Mistakes by front desk staff, or guests not understanding how to use the lock (or being incapable due to being "tired and emotional" ;)
B, Static from soft furnishings carpets etc.
C, Abuse / misuse by Guests.
D, Battery life.
When a guest cannot get access to their room they usually use a phone to call the front desk or visit in person (which is bad news for the hotel as it's one of the biggest gripes on CustSat forms). Due to this speed of entry is the name of the game, a member of front desk or security staff will be at the room within five minutes, and if they cannot get in maintanence is called.
If you have met the avarage hotel maintanence man you will know that the solution to a door lock not working is to "drill it" and "replace it". As the former gets an existing guest into the room quickly and the latter keeps room occupancy high, this policy is usually supported by managment.
So the lock mechanisum either must be a "throw away item" or have a way to stop either the front desk or security staff calling maintanence when a guest / staff can not get in the room.
There are two ways one is electrical the other is mechanical. Unfortunatly the high tech electrical way is often the designers choice. That is there is a small connector socket at the bottom of the lock (RJ11 etc) into which security can plug the "override device" and enter a security code.
Of the mechanical methods the most sensible is simply to have an ordinary mechanical key. Other times it is the removal of the knob a finishing plate which hides a small hole that alows access to the clutch mechanisum. In the case of some locks the hole might start life as a mark or slight depression in the hidden part of the lock casing so the maintanence man knows where to drill with his 5mil drill. In some early locks it was an odd shaped screw head that had to be turned a set number of times with a special screwdriver.
Basicaly appart from the key these are all usually "security theater". Esspecialy in the electronic case as all the "override device" usually does is supply power and reset the internal micro before actuating the electromagnetic actuator.
In some locks this works directly by powering the actuator, others by putting a logic voltage on the micro, some rare ones by sending a data comand to the micro to open. The "security" for this is usually not in the lock but the override device. Even where a data command is used it will be standard to all the locks...
Therefor If you have access to the override device the or a lock you can easily come up with an analoge to the override device.
On examining a lock circuit (diagram) it is often illuminating to see just how simple the override can be. In some locks simply connecting a battery the wrong way around energises the actuator through the snuber protection diode...
The actuator can be of a number of types but it boils down to battery life and speed of of operation (and sometimes noise). Essentialy for a number of locks the actuator acts as a clutch to link human mechanical power to the traditional lock mechanisum in the door.
Battery life is a vital consideration and in modern systems >95% is used by the actuator. Realisticaly it should last a minimum of six months on ten actuations a day (five if inside handle is directly connected to the traditional lock mechanisum).
Motors are usually seen as being slow and power hungry but importantly resistant to a magnet (they are not).
Solenoid type actuators are seen as fast and low power but suceptable to magnets (true in all respects).
So broadly the solenoid wins on power and the motor wins on low susceptability to magnets. Further the solenoid wins outright on mechanical simplicity and reliability and cost. But a lot of designers are scared off by "the problem of magnets".
This is silly as even motors are susceptable and often the mechanics following the motor have considerably more issues as well.
The clasic one being "jiggling" whereby spinning or jerking the handle might, using inertia or transmitting sufficient mechanical energy as a pulse overcome the clutch (I've actually seen this being done in a very large Hotel in China).
The real problems with motors are they are not mechanicaly simple to operate requiring cams / switches and all sorts of other gubbins depending on just how inventive or knowledgable the deigner is. They are of lower reliability and have all sorts of attendant problems over and above a solenoid design.
The simplest motor system to think of uses a gear train with a final drive wheel with teeth missing on part of it's circumfrance this pulls a toothed pin back against a spring and stops part way, after a time interval it turns the wheel around further to the part with no teeth and the pin returns under the spring. The pin is used to activate the clutch mechanisum.
Although it's easy to describe and visualise it's full of Gotchas, as are all the motor mechanical trains and some (if not nearly all) clutches.
The first problem is what sort of motor to use?
Traditionaly it would have been a simple DC "brush" motor but they have realy horible charecteristics such as the current required when they start under load or stall (this caused some early locks with lithium batteries to catch fire releasing large amounts of toxic and acrid smoke as well as burn significant amounts of the door).
Due to their reliability issues DC "brush" motors are not used much. Even in low cost PC's the fans these days are contactless and in some cases have ac inverters built in and use AC "squirl cage" motors.
Stepper motors have been used but these are quite expensive and require extra control circuitry and still have most of the problems other motors have.
If using a DC "brush" motor a first thought would be to start the motor when there are no teath engaged with the pin, thus getting over the high start on load current problem. Also you could use inertia etc to get you over the teeth engage bump.
Unfortunatly this is gotcha number two, if you do not have the teeth engaged on the pin and it is metal containing iron chromium etc then a magnet can be used to draw it back. If not made of magnetic material but of sufficient mass then it might be possible to vibrate it back (the same way an electric pick gun works on traditional barrel and pin locks).
There are a whole load of others gotchas such as what position is the toothed wheel in. As the battery wears out a simple time based system will not work. Mechanical switches require force to be operated which means more energy from the batter, they also have reliability issues. Optical switches are energy hungry and have other issues. A smart deigner might use a micro with an analoge input and monitor the motor current to determin when the teeth engage / disengage thus obviating the switches and their problems but this has other issues.
I could go on at considerable length but
A, it's duller than watching paint dry.
B, The Moderator might well block it on length / suitability.
C, It might be seen by the industry as giving away "trade secrets" (the old security via law suit game).
In reality the big issue with most of these battery operated locks is that they have design compromises or deficiencies that can be exploited by a knowledgable attacker. Usually the more low tech it is the more likley it is to succede and much worse be virtually undetectable...
Magnets, Vibrators / Shakers and jiggling attack the clutch mechanics and are therefore virtually undetectable post attack. Likewise attacks against the override port might not be detectable post attack. Even the reversed battery power trick might not damage the lock electronics so again be undetectable post attack.
My original point was that it was not realy worth discussing high tech theoretical attacks against a new lock when the older and well proven low tech attacks might well work even better and from the attackers point of view less detectably.