1. Hacking the Jubilee Line's door buttons
  2. Cracking into the button case

Opening up the door button case is initially obvious - four recessed nuts surround the black plastic case. Before you get too eager however, you'll be reminded of just how filthy the tube is and need to wipe off two decades of iron filings, and black grime.

Back to the nuts - extracting these took much more effort than expected. The surrounding casing is a hard plastic. It's too difficult to get any purchase with a small spanner, and these nuts are on tight. I dug through every sort of socket I had and found that for this size nut, they were all shaped in a sort of funnel - reaching nowhere near the nut with this depth of recess... Shopping time.

All in, I bought 3 sets of drivers and sockets before finding one that fits. The nuts are 7mm, but many 7mm sockets I tried were thicker than the gap surrounding the nut. I eventually had luck with this set of deep sockets from Screwfix, with the accompanying 1/4" ratchet handle. The 7mm socket won't exactly fit into the recess - you'll need to align it, hammer it in, and then hammer it down to the nut - the plastic is pretty hardy so don't worry about cracking it. Then you can use the ratchet (with a fair amount of downward pressure to start) to remove the nut. You won't need to return several driver sets to Amazon or ask any more DIY stores for "skinny drivers".

The guts

Thankfully, the seal has held up and the insides are much cleaner. In the photo, the black casing is in the top, while the button faceplate is the bottom half.

The smaller circuit board on the left of the faceplate seems to be the control board, while the right-hand side holds a chunky button/led apparatus. This seems glued to the plate and I haven't resolved to get destructive with this yet (removing the 8 6mm nuts doesn't actually release anything).

The two cables to the casing part seem to enter some sort of rubber sealant - I assume power/communication cables from the train originally entered this through the small hole and have been removed. However, I'm yet to access this - approaching gingerly in case there's a backup battery inside.

Next steps are to get access to this rubber sarcophagus, and to try and reverse engineer the circuit board. That's not something I've done before, but it does seem fairly simple - a few resistors and capacitors and not too many traces. I'm tempted to submit a freedom of information request for the original schematic (I think I've seen a couple of successful ones before for things like train bogies), but that feels a bit like cheating so I'll give tracing a try first (and obviously publish it if successful).