Passlock II SECURITY light and truck won't start!

[tlamot01]

Please, please, please share your results with the rest of us!

 

[letsbangout]

Please, please, please share your results with the rest of us!

Not sure if this was directed at me. If so:

I remember seeing in Alldata a list of all the valid resistor values that Passlock uses, but can't find it again, despite a ton of effort. And although I wanted to try duplicating what my Passlock sensor was putting out, I tried opening the circuit completely (yellow and black/orange wires cut) and measuring the resistance - my sensor is open (it registers no resistance). So I dug up a guide on the web, stating that a 2.2k resistor is valid for Passlock. I connected it up on a terminal strip to the yellow and black/orange Passlock sensor wires. I couldn't get it to register with the computer, to the extent that the Passlock relearn procedure didn't act anything like it was supposed to. After 10 minutes with the key on after a start attempt (I hit the starter momentarily, on purpose), the security light wouldn't go off. So I got brave and disconnected the battery for a good 15 minutes, thinking the PCM might forget whatever it had stored with regard to Passlock, and that I'd be able to run the relearn procedure against the 2.2k resistor. To my surprise, it cranked right up. It seems what's happening is that the PCM has stored a "null" value, in other words, that it expects no response from the TDM. This would make sense, as I'm convinced my TDM either has no power or is dead from the inside, since the TDM is now part of the Steering Control Module as of 1997, and my steering tightness comes and goes along with the security light. Indeed someone in another thread on another site indicated that the PCM can store a null response value from the TDM in case the TDM dies. Though I have no official confirmation from any kind of TSB or official literature.

So it seems that my "permanent Passlock bypass" is not a resistor trick, or even reprogramming the PCM with HPtuners, but simply making sure the TDM never communicates with the PCM. The lingering question in my mind is about whether the SCM needs serial communication for any reason. I'm guessing it receives vehicle speed from the PCM since the feature is called "speed sensitive steering", so I'm sure it would suffer. Since my last post, I also discovered a few more hacks. There is of course the "pro" module from NewRockies, which seems to be severely overpriced for what it is - a serial line-driver with a microcontroller behind it to clock out a "resistor code" for the PCM to see. I also managed to find a couple of other commercial boxes that do the same thing for much less money. The downfall with those is that they're designed in such a way that you'd have to supply ignition voltage and a solid state relay to make it work the way it's supposed to, and I'd really prefer not to do any more wire hacking on my truck. I feel dirty enough having clipped the two Passlock sensor leads.

Next on my list of things to try (before I break down and buy HPtuners) is to troubleshoot my SCM/TDM problem. Is it getting good voltage and is just broken internally (possibly bad solder joints, just like the BCMs and wiper control boards on 97-99 series trucks are known for)? Or is the circuit supplying the voltage bad? Closely related, I'd also like to break open the SCM/TDM to ascertain if I can easily "disable" only the TDM by cutting a trace to it's serial line driver (assuming it has its own - maybe that's a bad assumption since it would necessarily need to share one with the SCM in the absence of a way to intelligently share the data bus to the PCM (i.e. parallel rather than serial)). I can envision all kinds of scenarios - perhaps the input buffer routes only to the SCM (to receive speed data) and the output buffer taking directions only from the TDM. That'd be such a simple thing to fix you know... stay tuned

 

[slipping]

Well, I got mine started. My first board sodering. A lot harder than I thought it was going to be. I haven't been able to get soder training in at work yet. Anyhow....

___________________________
99 4 door Hoe lifted
04 Hoe stock
94 z28 lowered, being referbished

 

[slipping]

I also was looking at these wondering if they do what we need:
http://www.flashlogic.com/
http://www.amazon.com/s/ref=nb_sb_noss_1?url=search-alias=automotive&field-keywords=flcan
http://www.amazon.com/Autopage-ADSA...5?s=automotive&ie=UTF8&qid=1336872619&sr=1-15

 

[letsbangout]

Well, I got mine started. My first board sodering. A lot harder than I thought it was going to be. I haven't been able to get soder training in at work yet. Anyhow....

___________________________
99 4 door Hoe lifted
04 Hoe stock
94 z28 lowered, being referbished

You realize that won't work on a 99 or an 04 Tahoe right? Hopefully you had another vehicle in mind. That DIY circuit from NewRockies is only for Passkey/VATS systems - ones that have an "injector enable" line. Per what I said above, I also had to find that out the "hard way" as they didn't list which specific vehicles used which type of circuit :/

---------- Post added at 06:39 PM ---------- Previous post was at 06:37 PM ----------

I also was looking at these wondering if they do what we need:
http://www.flashlogic.com/
http://www.amazon.com/s/ref=nb_sb_noss_1?url=search-alias=automotive&field-keywords=flcan
http://www.amazon.com/Autopage-ADSA...5?s=automotive&ie=UTF8&qid=1336872619&sr=1-15

In the absence of anything in the literature (which I didn't look at in depth) that says they communicate on the serial bus with the PCM, I would assume they're the same as 99% of the "bypass modules" - they simply emulate the Passlock cylinder's resistance, which you can do with a resistor. This in no way solves for other types of systems failures, like a problem communicating with or powering up the TDM.

 

[slipping]

No I did not know (did think about it because of the non-tabbed keys) but should work on my camaro which has the light on (still runs).

___________________________
99 4 door Hoe lifted
04 Hoe stock
94 z28 lowered, being referbished

 

[letsbangout]

No I did not know (did think about it because of the non-tabbed keys) but should work on my camaro which has the light on (still runs).

Ahh yeah, my version of the guide says it works in all Camaros between 88 and 02. For the benefit of everyone else (i.e. people who may come across this thread via google), I'm going to copy/paste the complete list of compatible vehicles according to the guide I purchased from NewRockies. Note that there seem to be two frequencies used for the old style VATS/Passkey systems, version 1 uses 30 hz. square waves, version 2 uses 50 hz. square waves. The NewRockies circuit is tunable via a variable trim pot, I don't recall if the "free" DIY version I pasted previously is designed this way. Compatible VATS/Passkey vehicles are as follows:

Buick
LeSabre 1992-1999
Century 1996
Park Avenue 1991-1996
Park Avenue Ultra 1991-1996
Regal 1994-1996
Roadmaster 1994-1996
Roadmaster Estate Wagon 1994-1996
Riviera 1990-1999
Reatta 1988-1991

Cadillac
Deville 1990-1996
Deville Concours 1994-1995
Eldorado 1988-1995
Eldorado Touring 1994-1995
Seville (also SLS/STS) 1989-1995
Fleetwood 1991-1995
Fleetwood Brougham 1993-1996
Allante 1990-1993

Chevrolet
Caprice 1994-1996
Caprice Wagon 1994-1996
Impala SS 1995-1996
Corvette 1986-1991
Monte Carlo 1995-1999
Camaro 1988-2002
Lumina 1995-2001
Venture 1997-1999

Oldsmobile
Cutlass 1997-1999
Cutlass Supreme 1994-1997
Toronado 1990-1992
Delta 88 1991-1993
Eighty-Eight 1994-1999
Nighty-Eight 1991-1996
Regency 1997-1999
LSS 1997-1999
Silhouette 1997-1999

Pontiac
Montana 1999
Firebird 1988-2002
Grand Prix 1994-2003
Bonneville 1992-1999

 

[letsbangout]

A follow-up to my Passlock problems. I got brave and decided to change my battery. My 550 CCA that I had in there had worn down to about 490 and it was adversely affecting my ability to spin that big starter around (it would stop spinning momentarily when the computer would advance ignition timing during start, at least that's what I surmise). New battery doesn't do that, and has a ton of reserve capacity. But now my truck won't start. Security light is solid and won't go off. I decided to disconnect my TDM and see if I could make the computer re-learn a "null response" - I couldn't. Based on anecdotal evidence, it's apparent to me that the suppositions I've read about and have made myself regarding the storage of a "null response" were just the TDM recording an infinite resistance value on the sense lines, and transmitting that to the PCM every time it did start for all of those months, rather than the PCM itself storing a null response. It's really disheartening because I had previously disconnected my battery for 15 minutes and it continued to start when I reconnected everything.

Regarding the state of the TDM, I opened mine up several times and inspected all of the solder joints. They were all clean except for one in particular that bugged me, but appears to be inconsequential as the lead appears to solder into an isolated (unconnected) spot on the PCB. I went ahead and hit that one with a soldering iron just for good measure. I contemplated buying another SCM module (also referred to as an EVO module (which contains the TDM)) - Amazon has them for $100. But it'd require a trip to the stealership to re-program my truck's VIN into the box (as of 97 or so, Tahoes/Yukons communicate the VIN in every communication on the CAN bus, and if one module doesn't match, they all shut down, or something to that effect).

Bottom line: My TDM is beyond repair. Unless I find that the owners of the parking lot where I left my truck are unhappy with it being there for another day, I'm going to take my PCM out and bring it to an HPtuners distributor, who's giving me one heck of a good deal on the software and will disable Passlock in my firmware for next to nothing, in advance of the software's arrival. As much as I would've loved to hack my TDM and figure out ways to make a TDM-integrated bypass method, I have to have a working vehicle and HPtuners is the quickest way from point A to point B right now. However, I can always go back and disable the firmware changes and hack on it later, if I get the desire again.

Hopefully my experiences have helped someone. For those who don't want to spend $500 or $650 on the software, Amazon has the same Delco P/N for my TDM (called a Steering Control Module or EVO module on my truck) for $99, but you'd need to take the entire truck with the TDM to the dealer for programming of the VIN into the TDM - definitely not cost-effective in my case.

 

[letsbangout]

Let me contribute one other thing to this topic. Like others in this thread, I've postulated that alarm bypass boxes could be used to bypass Passlock. Not the ones that emulate a resistor, but the ones that wrap the TDM by sending the same serial string as a TDM would send down the CAN bus, telling the PCM it's ok to start the car. These are collectively referred to as "data bypass" boxes . The reason why this won't work is two-fold: 1) At the very least, you'd need a relay to ground the input to the bypass box when you crank up - all of them use a "ground to start" input, so you'd have to feed the ignition "crank" wire into the relay, one side to ground and the other side to the bypass box - at minimum. This emulates a real alarm system. 2) If your Passlock system doesn't work to begin with (like mine), you'll never be able to program the bypass box. The ones I've read up on, seem to work by listening to the CAN bus, and capturing the sequence sent out by the TDM toward the PCM in order to start the truck. If you can't emulate that very string on the CAN bus because your Passlock is broken, you have no hope of ever using a bypass box. Essentially, you need an existing, working Passlock system before one of those bypass boxes will work. Sad, but true.

I've contemplated what would happen if you installed it into another vehicle with a working Passlock, and programmed the box by capturing the Passlock data string on the CAN bus. Theoretically it should be stored in the box forever (at least that's what I gather from XpressKit boxes - most of them have NVRAM to store firmware, presumably the Passlock data would be stored in NVRAM). But what if that string contains the VIN number? Supposedly after about 97, all of the modules (BCM, TDM, PCM etc) started communicating the VIN number to each other, and they'll shut down if they encounter a strange VIN. If that were the case, the bypass box would never work because it would be relaying your friend's VIN who's car you used to capture his Passlock string.

My PCM is now sitting at an HPtuners affiliated shop, waiting to be reprogrammed. I'll also have the Professional version of HPtuners in a few days. If anything of significance transpires with regard to Passlock, i'll report back, though I expect to be able to hook it up, jump into my truck, and fire it right up. All he's doing is pulling my firmware, checking off the Disable Passlock button, and re-uploading it. I'm expecting no CASE relearn or anything, only a truck that'll never again be plagued by Passlock.

 

[bigcfl]

I have a 99 hoe that will only start if i use the push to start button on my alarm and the security light stays on. Please help.