There is good and bad news to report on regarding auto theft. First, the good news. Auto theft is down nationwide. It has dropped from an average of one vehicle being stolen every 33 seconds in 2008 to one stolen every 43 seconds in 2010. The bad news? Automotive theft deterrent systems are more complicated and harder to work on than ever.
Like this article? Sign up for our enews blasts here.
Hey, that good news didn’t sound so good either, did it? One vehicle every 43 seconds is staggering and the rate is higher than that in states like California where eight out of the top 10 cities for auto theft nationwide are located. Ever wonder how likely it is to catch the bad guy and get your car back? The statistics say that 88 percent of the time the crime goes unsolved. It’s true that a lot has changed since the 1974 movie “Gone in 60 Seconds” was running in theaters.
Today, the Corvette is no longer the No. 1 stolen car. That honor now goes to the 1994 Honda Accord followed by the 1995 Honda Civic. For Detroit iron, the high honor for most stolen domestic vehicle falls to the 1999 Full size Chevy / GMC pick-up truck at No. 4. Why don’t new and expensive vehicles make the top 10 list? They don’t for mainly two reasons.
The No. 1 reason is popularity. Thieves today want popular vehicles that bring higher prices at the chop shop. More vehicles on the road of a particular model mean higher demand for good used body parts. The second reason you don’t see the higher priced newer vehicles stolen is difficulty in pulling off the theft. While thieves will use bold methods like carjacking, flat bedding, etc., the preferred method is beating the locks and antitheft system during the dark of night.
This fact leads to my first point for those of us out there trying to repair vehicles equipped with factory Vehicle Theft Deterrent (VTD) systems: every few years these system change to try to stay ahead of thieves. For domestic vehicles the fourth most stolen vehicle (1999 Chevy full size truck) has a standard VTD called Passlock, which is an evolution from earlier Passkey systems.
Hard to steal? Yes. Impossible to steal? No. Just as repeat car theft offenders spend their time behind bars reading up on how modern anti-theft systems work so they can figure out how to beat them, we in the repair business can do the same in order to figure out how to fix them! For brevity in this article I’ll elaborate on GM systems and add the high points for Ford systems. Once you get good at one system, the others fall into place quite easy.
GM Passkey I & II
GM started with VTD in the 1980s with its Passkey I and II systems. Using a pellet embedded in the body of the key, the Passkey module would read the voltage drop across that key. If the proper analog voltage was not read by the module, the starter relay was not commanded nor was the 50 Hz/50 percent pulse width modulated (PWM) duty cycle signal sent to the ECM giving it the OK to enable injector pulses.
Later models evolved to the Passkey module sending a Class 2 / J1850 serial bus message to the PCM to give the OK password for fuel enable. The weak link for service techs to wrestle with was mostly centered on the key itself. There were 15 different resistor pellets starting at 402 ohms going up in value to 11,800 ohms. The particular value the Passkey module would learn when the voltage drop was measured would be the value the module would look for from that point forward.
There was no provision for relearning a new key. The proper key blank (No. s 1-15) had to be cut to turn the lock cylinder. If the Passkey module read the wrong resistance (spell that voltages drop), the module went into a three-minute time out prior to allowing another attempt. This was not a problem s long as the key’s pellet was clean of corrosion, the contacts in the lock cylinder were also clean and there was nothing pulling on the key to make it lose its contact with the lock cylinder’s internal electrical contacts.
Most of us who have been around GM iron throughout the 1980s and 1990s have seen our share of dirty key pellets, missing key pellets, broken lock cylinder wires and even the occasional customer who loads their key chain with good luck charms, flashlights, pocket knives and other assorted heavy accessories that tug on the key and intermittently pull the key (and its resistor pellet) down and slightly away from making good contact with the lock cylinder contacts. In the case of the corrosion, a little steel wool and a drop of Stabilant 22 on the key pellet was often enough to repair the car.
For the heavy key chain customer, the solution has always been to suggest the customer lighten their key chain. The security light points to problems within the system and Diagnostic Trouble Code (DTCs) for “no fuel enable signal” can diagnostics with the official Kent Moore PASS / VATS Interrogator is simple. The key is inserted into the reader and the number (between one and 15) representing the pellet’s resistor value is read. If the display shows E (for error), replace the key. The tester can then be plugged into the harness from the steering wheel (and lock cylinder) to read the key while inserted into the lock cylinder. This checks the cylinder and column wiring.
Issues with one of the two white wires leading from the Passkey lock cylinder to the column harness is the second most common failure on these systems. If the display can read the key in the lock cylinder, everything wiring related including the lock cylinder are good. Next, connect the tester into the harness side of the steering column connector to see if the vehicle will start with the Passkey tester set to the vehicle’s appropriate key pellet number. This checks the module and wiring harness.
Knowing how this tester works allows the rest of us “MacGyver’s” to come up with a resistor to replace the key and then insert it into the various positions to test the system. This leads me to another point; sometimes an aftermarket remote starter has been installed and the key resistor pellet/lock cylinder bypassed with a resistor wired into the harness. Problems that can ensue in this scenario include poor connections for the bypass resistor or a resistor that might be close enough in value under most conditions but when normal voltage variations/nominal resistance increases occur within the system harness, the vehicle won’t start.
In the service bay, Powertrain Control Module (PCM) and Body Control Module (BCM) replacements did not affect the VTD operation on Passkey systems. When the earlier Passkey module went bad, no programming was required. The very first resistor / proper voltage drop that a new Passkey module sees on its initial power up cycle is the resistor it looks for every time the ignition is turned on from that point forward.
Passlock
GM traded in its troublesome special keys with the resistor pellets starting on select models in the mid 1990s for a resistor built into the lock cylinder. There was nothing special about the key – it was the lock cylinder that was special, hence the name Passlock.
A Hall Effect wafer would be turned into the path of a magnet (just think GM 3-wire CKP sensor) as the correct key was inserted into the lock cylinder and was rotated. Because a favorite practice of car thieves had long been to simply knock out or bypass the lock cylinder forcibly to obtain access to the ignition switch and not to actually pick the lock, this new system seemed to make sense both from a reliability stand point (a dirty key didn’t matter) and a changing technology standpoint.
A tamper switch would trigger if a would-be thief had any bright ideas about turning on the Hall Effect switch internal to the Passlock cylinder with a large magnet. There were about a dozen different resistor sizes in the lock cylinders and when that number was combined with the thousands of key cut combinations that would require the correct one to turn on the Hall Effect sensor in the Passlock cylinder the numbers seemed to be in favor of the consumer until the thieves reversed engineered that system as well.
Thinking back to the CKP 3-wire Hall Effect sensor analogy, the same type of sensor in the lock cylinder could also fail rendering a no start but more likely than not you’ll find one of the 3 wires broken where they exit the Passlock cylinder. Earlier versions ran a fuel injection cut scenario that allowed the engine to crank and maybe run a second or two before stalling. Later versions added a starter solenoid inhibit circuit to the fuel enable message between the Passlock module and the PCM.
The Passlock Module could be incorporated into the BCM (most common place) or the instrument cluster on mid-90s J & N cars (Cavalier, Sunfire, GrandAm, etc) while the trucks placed the Passlock module function into a variable effort steering module called Electronic Variable Orifice (EVO). There was no interaction between the two systems in the latter mentioned applications, just a common black box to house both modules.
On the subject of modules, there often seemed to be issues there. If you replaced the BCM, for example. On some of the Passlock applications you would also have to perform a relearn of the system in order to get the vehicle back into service. A 30-minute procedure where techs turn on the key for 10 minutes, wait for the security light to change states, turn off the key a repeat three times didn’t always work for reasons that were beyond me.
In those cases, I’ve had to do the alternate procedure using a 10-minute method utilizing either the Tech 2 scan tool and GM’s TIS 2 Web to download a security calibration for VTD relearn or do the same with a J2534 universal reflash tool. Occasionally on some vehicles, the system would act up mysteriously (often after a battery rundown) without an actual hardware failure and a VTD relearn would need to be performed if a battery reset didn’t do the trick to unscramble “F.R.E.D.’s head” so to speak. When doing this battery cable removal computer reboot procedure, be sure to leave the cable off for several minutes and touch that loose negative battery cable over to the positive to further your efforts.
Engineers I spoke with about this technique often snicker but the many techs who practice it swear by it. Hey, if it works, it works.
GM PK3
General Motors still uses the Passkey III systems on its cars and trucks today. A late-90s launch saw this system mimic many of the European systems that are coined immobilizers, which is exactly what happens if the module on these vehicles (usually the BCM) doesn’t see the correct key transponder.
A special key is used once again as was done with Passkey I and II systems but instead of a resistor pellet, there is a transponder pellet. This little radio transmitter requires no batteries. Simply get it within a couple of inches of the lock cylinder and a coil in a module near or as a part of the lock cylinder begins to send oscillations out that excite the transponder pellet enough to do its job of sending out the radio message identifying itself as friend or foe. This message I’m told is 10 to the 17th power.
That’s a big number, which means it’s hard to guess which electronic handshake the module is looking for from the key compared to earlier systems that had a handful of resistance values to guess from. If the wrong radio signal is sent by the exited key, the exciter/reader coils in the Passkey III module are not satisfied and the message to the PCM results in a no crank/no fuel injector enable scenario. Replacing a key requires the other keys to be present for the relearn procedure and in most cases a factory scan tool is not required. Problems with the exciter/reader coil being powered up too long, (battery rundown) not long enough, and causing/being bothered by radio interference did occur.
Gas station passes, other immobilizer type keys, certain alarm transmitters all are possible suspects of interference. The most common problem in my experience has been the customer/locksmith being ignorant to the fact that the Passkey III equipped vehicle has a special key. With Cadillac applications this was less likely to happen with its larger and fancier key but then the average Joe’s Chevrolet took on Passkey III system with a slim and average looking key only having the letters “PK3” or simply the “+” symbol stamped on it to clue you in that a transponder equipped key has to be purchased and a relearn procedure including all keys has to be performed.
Ford PATS
Ford’s Passive Anti-Theft System (PATS) is similar to GM Passkey III in that it is also another transponder-based system using a pellet in the key that communicates with a module via radio signals that can produce up to 72 billion different combinations of digital code. The transponder pellet in the key does not require batteries. An exciter/reader coil built into the transceiver module emits a magnetic field that causes the transponder to come alive via an inductive power circuit.
Also like GM, the integrated circuitry inside the transponder broadcasts the password on its outgoing radio signal that the column mounted transceiver receives. Ford must like variety because their PATS systems come in five different flavors using the letters A, B, C, D, E, and F to designate where the brains to the immobilizer is housed to receive the bussed message from the exciter/reader coil module, (cluster, column or PCM) how many keys must be present to begin your programming procedure, how many keys can be programmed (most systems up to eight) and whether or not the system inhibits starter enable as well as fuel.
Another important difference between Ford systems affects you more directly; what do you need to do when you replace something. For example the initialization after a PCM replacement varies like this; Type B, C and E systems require a Ford factory scanner. Type A and D have no special PATS procedure. When the PATS module is replaced type A systems require that you just pop the module in and take a previously programmed key and cycle from off to on. Type B and C systems require the Ford factory scanner. Key transponder/immobilizer systems such as the Ford PATS often fall victim to the aftermarket remote starter or other bypass system.
A new innovative rental car company called Zipcar uses a credit card unlock system for its book by internet only customers enabling them to hold their Zipcar card up to the transponder attached to the inside of the windshield in order to unlock (and lock) the vehicle and keep it immobilized when not being rented. That means, just as in the case of the remote starter, the factory immobilizer has to be bypassed. The most common method is to take a transponder key or pellet and mount it somewhere near the system’s exciter / reader coil module. Sometimes that same module is moved to accommodate the hidden key / transponder. Connections made by the aftermarket accessory installer aren’t always the best so be sure to ask / check for their presence.
Diagnostics — All Systems
First off don’t confuse Content Theft Deterrent with Vehicle Theft Deterrent. Doorjamb switches, shock sensors, blinking LED’s, etc are part of a completely different system that may or may not share the same cluster warning indicator with the VTD system. Next, make sure you know how the security light is supposed to work. In most systems, the light comes on with the key in run and crank and goes out within a couple of seconds if the correct key is detected.
Always keep in mind that if the engine starts and then the security light comes on the engine will keep running. It may or may not restart after the ignition is switched off and back on. Next check battery State Of Charge (SOC) as you would with any other electronic problem.
Look for non-factory keys and watch what’s on your customer’s key ring PRIOR to the removal of the key left with your shop. If keys need to be made, make sure all the keys available are present when the vehicle is dropped off if the system requires this.
If there is a large key ring, multiple keys, or a key case being used; remove the vehicle key from it, and troubleshoot the immobilizer system with a single key only. Look for anything that could create aftermarket accessory interference. Next check the ECM/PCM for DTCs then the BCM for DTCs. Most scan tools will display some kind of VTD Parameter Identifiers (PIDs) – do make the most of them and don’t forget to determine via the service manual’s wiring diagram and theory of operation what modules communicate on which serial busses in order for the VTD to do its thing.
I once had a case of a shorted factory radio on a Chevy Malibu causing the single wire LS CAN (GMLAN) bus to go down. That in turn caused the BCM to not be able to talk to the VTD on that same bus. The BCM could talk to the PCM as a Gateway module on the HS CAN bus (GMLAN) but because the LS CAN bus was down, no VTD fuel enable message was able to get through. Finally, you may want to make sure the customer’s complaint is actually related to VTD.
Foil the Thief? No – Foil the Key
It’s so easy to assume that a cranks, runs, then dies is a VTD shutdown or that a no crank condition with a good starter, battery and battery cables must be VTD related. Add the intermittent factor to the problem in your bay and things are usually less obvious. Is it a VTD problem or something more conventional such as a bad ignition switch, starter relay, fuel pump, etc.?
A very easy test to help you make that fork in your diagnostic path on vehicles with VTD keys/key fobs can lead you to determine exactly how the vehicle you are working on will behave if the VTD system is the problem. It doesn’t require that you look for hours in the service manual or own any factory scan tools. On all of the vehicles out there using radio style key transponder/immobilizer systems, simply take a small sheet of aluminum foil and poke the key through the center of it.
Now wrap the rest of the key or fob up with the aluminum foil nice and tight like you were going to cook it like a baked potato. The key’s transponder is now blocked from the exciter/reader coil on the vehicle. Place the key into the lock cylinder and twist. If the security light comes on and stays on and the engine won’t crank or it does crank but won’t stay running, you experienced exactly how your customer’s car acts when the immobilizer doesn’t work. That simple test only takes 60 seconds if the aluminum foil is handy. In the time a seasoned car thief needs to steal a car, a good tech can sometimes diagnose one.
Have articles like this sent to you weekly by signing up for our enews blasts here.
