SOLVED! Passlock problems continue. Going on 5 years now...

[jmonica]

Can I have the PCM programmed to disable or bypass the Passlock system? If so, can anyone point to me a reliable place to have it done? My biggest problem, besides the cost ,is going to be the down time because I only have the one vehicle and it's my only way back and forth to work so I am searching for a place with a fast turn around. In live in NJ, USa and would be happy to drive to a place and wait to have it done on the spot.

If there's an alternative way to remove the system forever, I'd REALLY be interested in that.

My Securty light is "almst" always on now. Its not related to the passlock problem I am having, as that happens / happened long beofre the steady on light, but short of removing the bulb, I think a relearn might get rid of the light?

Sorry to get a little off topic but I recall many years ago, pressing the the steering wheel buttons in a certain sequence, but I can't remember what I was doing or why. Was that related to the security system programming in any way/ What a dumb arse I sound like, I know and I'm sorry. The older I get the dumber I sound.

Thank You in advance

Have a nice weekend everyone!

2006 GMC Envoy SLT. (374,631 miles on it)

 

[TJBaker57]

Can I have the PCM programmed to disable or bypass the Passlock system? If so, can anyone point to me a reliable place to have it done? My biggest problem, besides the cost ,is going to be the down time because I only have the one vehicle and it's my only way back and forth to work so I am searching for a place with a fast turn around. In live in NJ, USa and would be happy to drive to a place and wait to have it done on the spot.

If there's an alternative way to remove the system forever, I'd REALLY be interested in that.

My Securty light is "almst" always on now. Its not related to the passlock problem I am having, as that happens / happened long beofre the steady on light, but short of removing the bulb, I think a relearn might get rid of the light?

Sorry to get a little off topic but I recall many years ago, pressing the the steering wheel buttons in a certain sequence, but I can't remember what I was doing or why. Was that related to the security system programming in any way/ What a dumb arse I sound like, I know and I'm sorry. The older I get the dumber I sound.

Thank You in advance

Have a nice weekend everyone!

2006 GMC Envoy SLT. (374,631 miles on it)

Have we investigated this specific issue here before?

My personal preference is to learn how a system works, then properly diagnose the issue, fix it and move on.

It can be bypassed by adding a resistor (or reaistors) of a very specific value that will then present the correct voltage signal back to the BCM at all times.

Another option that I have thought about over the years but never tried would be to incorporate a relay or 2 along with the aforementioned resistor(s). It may be possible to duplicate the functionality of the system in such a way that the BCM would never know there was anything different.

Lastly I believe the PCM can be tuned to disable the Passlock system? I have zero interest in modifying a PCM programming so this option is one I have only read about in passing.

 

[Mooseman]

Of course we encourage to actually fix the problem. Barring that, yes it can be disabled. @limequat at http://www.lime-swap.com/ does offer a loaner program where he would first send you a temporary PCM, you would swap it out and then send yours in to get tuned. He would then send yours back, swap and send the loaner back. There is extra costs associated to this service.

He also knows these engines/trucks well and can also tune it for better performance and to your liking.
Question about having PCM tuned

 

[Ecmbuster]

Without a proper and detailed diagnosis and no faults presented within the post, adds to the difficulty to provide clear answers.
One mention is what other keys or transponders are attached to the ignition key ring.
Added transponder keys residing in close proximity to the ignition cylinder can in many times disturb / confuse the magnetic field that reads the transponder data.
This link may be an aid instead of complex and expensive component replacement.

PERMANENTLY Disable and Remove GM Security Systems

GM Security Systems are killing cars all over the US. Only solution is to disable them permanently. This is what NEWROCKIES Inc. is all about.

newrockies.com

 

[jmonica]

Of course we encourage to actually fix the problem. Barring that, yes it can be disabled. @limequat at http://www.lime-swap.com/ does offer a loaner program where he would first send you a temporary PCM, you would swap it out and then send yours in to get tuned. He would then send yours back, swap and send the loaner back. There is extra costs associated to this service.

He also knows these engines/trucks well and can also tune it for better performance and to your liking.
Question about having PCM tuned

Thank You Moose.

Besides disabling a security feature, is there any other downside to disabling it?

This has been going on for years now. I've spent countless hours in the past researching causes and checking things and right now my free time is limited and to be honest I have more pressing things to fix on the vehicle, that are making it downright dangerous to drive, versus being an inconvenience, so I'm probably going to opt for the tune if I can come up with the money for it.

The other reason is that the last few times I've tried to fix this, I wasn't able to find a clear troubleshooting path, the information I received on how it works turned out to be false.

If I knew what I was doing, there's nothing I'd love more than to be able invest the time and to fix it correctly by myself, but because I'm an idiot, I feel like I'm better off tuning the problem away.

I don't care about security. I'm not lucky enough to have someone steal this car.

Besides the dangerous steering and suspension problems I'm facing, I'm still having emissions system problems to deal with. That's a never ending saga, but I need to fix the suspension and steering problem, then emissions, then everything else.

Thank You as always Moose!

 

[jmonica]

Without a proper and detailed diagnosis and no faults presented within the post, adds to the difficulty to provide clear answers.
One mention is what other keys or transponders are attached to the ignition key ring.
Added transponder keys residing in close proximity to the ignition cylinder can in many times disturb / confuse the magnetic field that reads the transponder data.
This link may be an aid instead of complex and expensive component replacement.

PERMANENTLY Disable and Remove GM Security Systems

GM Security Systems are killing cars all over the US. Only solution is to disable them permanently. This is what NEWROCKIES Inc. is all about.

newrockies.com

Hi. Well the only reason I didn't post any more detailed info about the problem was because I really was just wondering about the possibility of disabling passlock via a tune, despite my overly wordy post. Sorry about that.

So as it stands right now, I have the following three codes relayed to this problem. I don't know where to start to troubleshoot this one to be honest.

B2960
B2961
B3031


I also have B2960 and 2961 but do t think they are related.

This problem has been happening for about 4-5 years.

It's not related to any sort of interference from another key fob, as it happens when I'm only using the key by itself, not on a keychain or attached to anything else a was ne no other transponders of any kind in the area.

I am going to read the information that you so kindly linked me to. I was reading some information on the system and after pages of info, it turned out the person was taking about a passKEY system, on my year and model vehicle and well he obviously didn't know what he was talking about.

Thank You again! I will post back if and when I figure out a solution, though I'm less than optimistic I'll be able to fix it myself.

It's not re-creatable. I can go for a month or two with no trouble, then it will happen for a couple of days. By "happen" I mean the sec light flashes and I have to wait 10 minutes to try again. Lately I've had to wait through up 4 ten minute cycles to eventually get it to start. So I have to leave 40 minutes early wherever I go if I'm concerned about being late.

So let's say I did fix it some how. I won't know because the problem doesn't always happen. So I feel like a fix is almost impossible whereas disabling it some how would be the way to go.

I don't care about security. Thanks again!

 

[jmonica]

Without a proper and detailed diagnosis and no faults presented within the post, adds to the difficulty to provide clear answers.
One mention is what other keys or transponders are attached to the ignition key ring.
Added transponder keys residing in close proximity to the ignition cylinder can in many times disturb / confuse the magnetic field that reads the transponder data.
This link may be an aid instead of complex and expensive component replacement.

PERMANENTLY Disable and Remove GM Security Systems

GM Security Systems are killing cars all over the US. Only solution is to disable them permanently. This is what NEWROCKIES Inc. is all about.

newrockies.com

Thanks for the link to new Rockies. This is one of the sites I was reading yesterday. I'd love to buy their product, but unfortunately it's three times the cost of having passlock disabled via a tune. $300 vs. $100. I feel like they might sell a lot more if they sold at a lower price point. I don't think there's anything that exotic in their product hardware wise. I do understand that they've done the research and the work to bring their device to market, and for that work they should be compensated. I just can't afford it right now and so I need to find a less costly way to accomplish my goal. Thank You again for the link.

 

[Ecmbuster]

Inspect for rodent infestation, defective body to engine ground straps, worn parts / oxidized connections.
A GM style scan tool is required with a multi-meter

B2960 = Security System Sensor Data Incorrect But Valid
1. Test voltage values of the Passlock sensor and compare the values to the voltages found when the vehicle is a no-start.
2. Three wires at the Passlock sensor to test.
3. Test voltage from the Red/White wire to the Black wire, backprobing with the sensor connected.
4. Should have 9.0 V or higher at: IGN 0, IGN 1 and CRANK.
5. Test voltage on the Yellow signal wire.
6. Should have 4.7-5.0 V at: IGN 0, and then a drop to a specific value should occur as the key is rotated to IGN 1 and/or CRANK.
7. Compare this voltage value to what is detected when the vehicle is a no-start.

B2961 = Key In Ignition Circuit High
1. Check for IPC (Instruments) DTC's first and clear.
2. If no DTC's are present, go to "Output Tests". Command the IPC to "Sweep Gauges".
3a. If the speedometer and tachometer do not sweep, verify the rest of the gauges sweep properly.
3b. If the fault persists, check the wiring harness and or connections to the IPC
4. If the other gauges sweep properly, replace the IPC (Instruments).
5. If the IPC proves OK - Test the ignition switch and or wiring connections.

B3031 = Security System Controller In Learn Mode
1. Check the BCM power mode. Using a scan tool check the following PIDs: The "Ignition 0" should be "On" in all positions except Lock.
2. "Ignition 1" should be "ON" only with the key in the Run or Crank position.
3. "Ignition 3" should be "ON" only with the key in the Run position.
4. "Accessory Ignition" should be "Active" only with the key in the Accessory or Run position.
5. If any are incorrect then verify the circuit at the Ignition Switch.

If testing is too complex, consider the bypass mentioned.
Once again, body grounds (B-), ignition switch connections (B+) and status must be in perfect order.

 

[TJBaker57]

B2961 = Key In Ignition Circuit High
1. Check for IPC (Instruments) DTC's first and clear.
2. If no DTC's are present, go to "Output Tests". Command the IPC to "Sweep Gauges".
3a. If the speedometer and tachometer do not sweep, verify the rest of the gauges sweep properly.
3b. If the fault persists, check the wiring harness and or connections to the IPC
4. If the other gauges sweep properly, replace the IPC (Instruments).
5. If the IPC proves OK - Test the ignition switch and or wiring connections.

At the very least this seems peculiar as the IPC plays no role whatsoever in the "key in ignition" circuitry or functionality. Indeed even the B2961 attachment never mentions the IPC.

 

[Ecmbuster]

Body Control Module DTC B2961 and related faults may be an indication of a defective IPC.
Since it can't be seen from long distace, that fault points to any needles pointed incorrectly, stuck / jammed and includes lamp functions of IPC. Testing the IPC eliminates a defect at the IPC and includes monitoring of the messages for the PassLock to the IPC.

 

[TJBaker57]

Body Control Module DTC B2961 and related faults may be an indication of a defective IPC.
Since it can't be seen from long distace, that fault points to any needles pointed incorrectly, stuck / jammed and includes lamp functions of IPC. Testing the IPC eliminates a defect at the IPC and includes monitoring of the messages for the PassLock to the IPC.

Well we will have to just disagree on this one.

I can remove my IPC and toss it in the nearest swamp and the key in ignition system and Passlock system will continue to work, albeit without a security light.

 

[Ecmbuster]

Thank you for the education. Let's call it a day. September 13, 2023

 

[jmonica]

Hey Guys. I need help please? I contacted the PCM tuning place and I don't understand part of his reply. I had mentioned I wanted to have passlock disabled via the tune and here's part of the response I got.

"Also, I would caution that I've never heard of passlock issues on the GMT360 platform. 355...just about all of them. I just wouldn't want you to be disappointed if we turned of VATS and it didn't fix the issue."

I thoughts VATS was an older system and my 2006 Envoy didn't use VATS. He also said he's never heard of passlock issues with the 360 platform. So what tiny bit of information I thought I knew about the system now seems to be wrong based on this reply.

This is a perfect example of what I was talking about. Every time I think I'm learning what needs to be done to fix this nightmare, I get conflicting information and end up knowing less than before I started doing research to figure it out.

One thing I have read are horror stories of people taking it to the dealership where they just throw parts at it and $1,000 later they still have the problem. I can't afford to do that.

This is why this has been going on for 5+ years. I just recently read a long post with an explanation of how it works and what to look for, and then the next day, the person made a retraction to say the information he posted was incorrect, nullifying the troubleshooting steps he had outlined.

The bottom line is, I'm going to have bite the bullet and learn how the system works and figure it out on my own. Just not sure when I'll have enough free time given the litany of other problems I have to sort out first.

Anyway, I really do appreciate all of your replies and attempts to help a moron like me. Thank You

 

[jmonica]

At the very least this seems peculiar as the IPC plays no role whatsoever in the "key in ignition" circuitry or functionality. Indeed even the B2961 attachment never mentions the IPC.

So I started tinkering with this whole having a smoke in the parking lot at work. Although it's a cheapo, not an official tech 2000, my scanner is bi-directional and it does have a lot more functionality than I thought. It's brand new to me, so I'm just learning what it can do.

I started drilling through menus and can see a lot of info I didn't know it would read.

I did the IPC sweep test and all of the gauges checked out (they swept). My vehicle is in programming mode apparently, so I'm going to try to figure out how to fix that. I know have a lot of learning to do. Hopefully I can share some of what I learn when do.

I'm going to research how to disable passlock using a resistor. I've seen some videos where guys do it on other vehicles. Every video though, there's a lot of, this "might" work stuff. I just don't want to get myself into a no-start condition and not know how to get myself out of it, especially if I've cut into the harness etc.

If I figure out how to do it, I'll post some pics of which wires I used etc, and hopefully it can benefit someone in the same boat as me some day.

 

[Mooseman]

Which tuner did you talk to? I doubt it's Limeswap or PCM of NC as they know their stuff. Yes, Passlock can have problems on GMT 360.

Turning off VATS, which is the part that's in the PCM, will allow you to start your vehicle. Passlock will still be active but the PCM will ignore it but the IPC will flash the security light while it's running. I know this for a fact as I had this issue with one of the keys in my Saab. It's started and ran but the security light would be continuously flashing. Truck ran normally.

 

[TJBaker57]

Hey Guys. I need help please? I contacted the PCM tuning place and I don't understand part of his reply. I had mentioned I wanted to have passlock disabled via the tune and here's part of the response I got.

"Also, I would caution that I've never heard of passlock issues on the GMT360 platform. 355...just about all of them. I just wouldn't want you to be disappointed if we turned of VATS and it didn't fix the issue."

I thoughts VATS was an older system and my 2006 Envoy didn't use VATS. He also said he's never heard of passlock issues with the 360 platform. So what tiny bit of information I thought I knew about the system now seems to be wrong based on this reply.

This is a perfect example of what I was talking about. Every time I think I'm learning what needs to be done to fix this nightmare, I get conflicting information and end up knowing less than before I started doing research to figure it out.

One thing I have read are horror stories of people taking it to the dealership where they just throw parts at it and $1,000 later they still have the problem. I can't afford to do that.

This is why this has been going on for 5+ years. I just recently read a long post with an explanation of how it works and what to look for, and then the next day, the person made a retraction to say the information he posted was incorrect, nullifying the troubleshooting steps he had outlined.

The bottom line is, I'm going to have bite the bullet and learn how the system works and figure it out on my own. Just not sure when I'll have enough free time given the litany of other problems I have to sort out first.

Anyway, I really do appreciate all of your replies and attempts to help a moron like me. Thank You

What are your resources here? I scanned through your posts here and found no mention of a multimeter. I did see a comment about acquiring a scantool? Any chance you have one of those inexpensive bluetooth or wifi OBD2 adapters that work with a phone app? Do you own an Android device (phone or tablet)??

I am a tinkerer. I am cursed with a curiosity of how things work. Couple this with a background that gave me a strong foundation in mechanical and electrical devices. I bought a TrailBlazer in late 2010 and have been studying whatever I got into since then. Eventually I became active in online sites and read various posts from owners having troubles. In an effort to help where I could I began buying parts at auto recycling yards for study. I have a couple of test bench setups with various devices like PCM, BCM, IPC, TCCM, etc.

Yesterday for example I documented the possible Passlock signal voltage ranges for each passlock code of 0 to 12. The BCM assigns a Passlock code of 0 to 12 reported at PID 221C. The Passlock signal voltage is at PID 2117. FWIW the 'key in ignition' sataus is reported at bit 0 of PID 2101. I have never come across any post or publication where this is presented. From this I worked out resistance values that would be best for a bypass if one were to go that route. I began that experiment to see if any codes get set when a Passlock system is bypassed in this way.

The Passlock signal, code, and 'key in ignition' status' can be monitored with a phone app and the proper user-entered PID setup which I can provide.

When all the hype is stripped away the Passlock circuit is a very basic thing. A sensor, a BCM and 3 wires between them.

When the BCM wakes up it provides 12 volts to power the sensor circuitry. That's 2 of the theee wires. On the 3rd wire (yellow) the BCM sends out a weak (current limited) 5 volt signal. When the ignition cylinder is rotated to the START position the sensor connects a resistor between the weak 5 volt signal (yellow wire) from the BCM to ground. Connecting a resistor to ground like this drops that 5 volt signal lower, but not too low. The BCM is reading this voltage and checking that this voltage matches the value that the BCM stores in memory. If the voltage signal matches then you are all good for startup. If it doesn't then you most likely get a security light and code.

ANY poor connection in any of the 3 wires will almost certainly cause a fault.

Less likely but possible would be a failure of the sensor to read the rotation of the ignition lock cylinder and then not connect the resistor to ground. There is a small magnet in the rotating key cylinder. This is what the sensor senses, the magnetic field of this small magnet in the rotating key cylinder. If the cylinder to lock housing has gotten very loose I can imagine it may lead to such a fault though I haven't seen it myself.


Some images just for familiarity sake:

First we have the ignition lock cylinder with the small magnet circled. Above the cylinder in the picture is a passlock sensor still in the plastic housing, the area where the magnet is sensed is circled. Above that is the circuit card of the sensor after the plastic housing is stripped away. The semiconductors that do the actual sensing are circled.




Next is an image displaying the alignment of cylinder to sensor when installed in the lock housing. The sensor is stationary, the cylinder moves the magnet into this position at START.




Here we have a lock housing with Passlock sensor. One can see the three wire connector. One can also see the sensor is not meant to be removeable. It will almost certainly be ruined in any attempt to remove it. Also in this image though mostly out of view is the "key in ignition" switch. It is the off white plastic thing directly behind the 3 wires coming out of the Passlock sensor harness connector.






. Last image is another view of a stripped out passlock sensor with the actual resistor responsible for the voltage signal read by the BCM circled.

 

[TJBaker57]

My vehicle is in programming mode apparently, s

This was indicated by one of the codes you posted earlier.

I'm going to research how to disable passlock using a resistor. I've seen some videos where guys do it on other vehicles. Every video though, there's a lot of, this "might" work stuff

I would advise not to go this route, at least not before learning how the system works to begin with.

Let's see a picture like you just posted but one that shows the actual data values for those parameters shown in your last picture.

Given the Passlock code and the Passlock Data Voltage I can tell you the resistance value to use for such a bypass. Using a resistance value that matches your existing Passlock sensor resistance means no relearn is required.

Now for the "this might work" comment... If your issue is a poor connection somewhere between the Passlock sensor and the BCM,,, then installing a resistor at the steering column may leave the poor connection still in place and your efforts will be useless and you will still have the problem. This is one reason why it is better to find the actual fault.

 

[jmonica]

This was indicated by one of the codes you posted earlier.





I would advise not to go this route, at least not before learning how the system works to begin with.

Let's see a picture like you just posted but one that shows the actual data values for those parameters shown in your last picture.

Given the Passlock code and the Passlock Data Voltage I can tell you the resistance value to use for such a bypass. Using a resistance value that matches your existing Passlock sensor resistance means no relearn is required.

Now for the "this might work" comment... If your issue is a poor connection somewhere between the Passlock sensor and the BCM,,, then installing a resistor at the steering column may leave the poor connection still in place and your efforts will be useless and you will still have the problem. This is one reason why it is better to find the actual fault.

Thank You for your help. Unfortunately I'm at work and will have to wait until this weekend to work on this. I'd appreciate your help with the resistor value. I'm going to do anything until I've done the research and know what I'm doing and why before taking action.

The scanner I have is a corded Chinese made scanner called a Foxwell 500.
It doesn't use a bluetooth adapter and software on the phone.

I'm changing the upper and one lower control arm and ball joints this weekend as well as a new rack and pinion unit. Definitely going to spend some time repairing the chassis ground I spotted last weekend that a missed when I did the rest of them a few weeks ago.

Thank you again.

 

[jmonica]

What are your resources here? I scanned through your posts here and found no mention of a multimeter. I did see a comment about acquiring a scantool? Any chance you have one of those inexpensive bluetooth or wifi OBD2 adapters that work with a phone app? Do you own an Android device (phone or tablet)??

I am a tinkerer. I am cursed with a curiosity of how things work. Couple this with a background that gave me a strong foundation in mechanical and electrical devices. I bought a TrailBlazer in late 2010 and have been studying whatever I got into since then. Eventually I became active in online sites and read various posts from owners having troubles. In an effort to help where I could I began buying parts at auto recycling yards for study. I have a couple of test bench setups with various devices like PCM, BCM, IPC, TCCM, etc.

Yesterday for example I documented the possible Passlock signal voltage ranges for each passlock code of 0 to 12. The BCM assigns a Passlock code of 0 to 12 reported at PID 221C. The Passlock signal voltage is at PID 2117. FWIW the 'key in ignition' sataus is reported at bit 0 of PID 2101. I have never come across any post or publication where this is presented. From this I worked out resistance values that would be best for a bypass if one were to go that route. I began that experiment to see if any codes get set when a Passlock system is bypassed in this way.

The Passlock signal, code, and 'key in ignition' status' can be monitored with a phone app and the proper user-entered PID setup which I can provide.

When all the hype is stripped away the Passlock circuit is a very basic thing. A sensor, a BCM and 3 wires between them.

When the BCM wakes up it provides 12 volts to power the sensor circuitry. That's 2 of the theee wires. On the 3rd wire (yellow) the BCM sends out a weak (current limited) 5 volt signal. When the ignition cylinder is rotated to the START position the sensor connects a resistor between the weak 5 volt signal (yellow wire) from the BCM to ground. Connecting a resistor to ground like this drops that 5 volt signal lower, but not too low. The BCM is reading this voltage and checking that this voltage matches the value that the BCM stores in memory. If the voltage signal matches then you are all good for startup. If it doesn't then you most likely get a security light and code.

ANY poor connection in any of the 3 wires will almost certainly cause a fault.

Less likely but possible would be a failure of the sensor to read the rotation of the ignition lock cylinder and then not connect the resistor to ground. There is a small magnet in the rotating key cylinder. This is what the sensor senses, the magnetic field of this small magnet in the rotating key cylinder. If the cylinder to lock housing has gotten very loose I can imagine it may lead to such a fault though I haven't seen it myself.


Some images just for familiarity sake:

First we have the ignition lock cylinder with the small magnet circled. Above the cylinder in the picture is a passlock sensor still in the plastic housing, the area where the magnet is sensed is circled. Above that is the circuit card of the sensor after the plastic housing is stripped away. The semiconductors that do the actual sensing are circled.

View attachment 109662


Next is an image displaying the alignment of cylinder to sensor when installed in the lock housing. The sensor is stationary, the cylinder moves the magnet into this position at START.

View attachment 109661


Here we have a lock housing with Passlock sensor. One can see the three wire connector. One can also see the sensor is not meant to be removeable. It will almost certainly be ruined in any attempt to remove it. Also in this image though mostly out of view is the "key in ignition" switch. It is the off white plastic thing directly behind the 3 wires coming out of the Passlock sensor harness connector.


View attachment 109663



. Last image is another view of a stripped out passlock sensor with the actual resistor responsible for the voltage signal read by the BCM circled.

View attachment 109664

Hi. So I think I'm going crazy. I was reading your post and looking at the BCM connectors trying to identify the wires as you said that it would make more se se to make the mods at the BCM rather than at the ignition cylinder area. In fact saved one of the photos showing the yellow wire location and now the other images seemed to have disappeared. I'm assuming that you edited your post and removed the other images? I just want to make sure I'm not missing something or having trouble viewing the forum on my phone.

I think I was able to ID the yellow wire in your extremely helpful reply.

Being able to see everything like this really helps me a lot and want to say thank you for taking the time to lay it all out and include the photos.

It's a great start to understanding what's happening.

 

[jmonica]

Which tuner did you talk to? I doubt it's Limeswap or PCM of NC as they know their stuff. Yes, Passlock can have problems on GMT 360.

Turning off VATS, which is the part that's in the PCM, will allow you to start your vehicle. Passlock will still be active but the PCM will ignore it but the IPC will flash the security light while it's running. I know this for a fact as I had this issue with one of the keys in my Saab. It's started and ran but the security light would be continuously flashing. Truck ran normally.

Hey. I spoke to Jeremy at limeswap. Apparently I'm not understanding the difference between VATS and passlock. I thought VATS was an older system which was replaced by passkey then passlock.

I can manage the flashing security light always being on while driving if I know that the car is going to start, or I should say if VATS isn't going to bug out and prevent it from starting.

I'm a little sketchy about it now because of Jeremy's reply. Any thoughts?

Thanks again Moose!

 

[TJBaker57]

I did the IPC sweep test and all of the gauges checked out (they swept)

Not at all unexpected.

FWIW here is my own TrailBlazer starting when the IPC is completely disconnected from the network. In fact at the beginning you see the data splice pack 205 comb is removed so the only messaging happening is between the PCM and BCM through a redundant factory serial data wire between PCM and BCM. No messages (Passlock or other) can go to the IPC, no messages (Passlock or other) can come from the IPC. Yet the engine starts and runs just fine.

 

[jmonica]

What are your resources here? I scanned through your posts here and found no mention of a multimeter. I did see a comment about acquiring a scantool? Any chance you have one of those inexpensive bluetooth or wifi OBD2 adapters that work with a phone app? Do you own an Android device (phone or tablet)??

I am a tinkerer. I am cursed with a curiosity of how things work. Couple this with a background that gave me a strong foundation in mechanical and electrical devices. I bought a TrailBlazer in late 2010 and have been studying whatever I got into since then. Eventually I became active in online sites and read various posts from owners having troubles. In an effort to help where I could I began buying parts at auto recycling yards for study. I have a couple of test bench setups with various devices like PCM, BCM, IPC, TCCM, etc.

Yesterday for example I documented the possible Passlock signal voltage ranges for each passlock code of 0 to 12. The BCM assigns a Passlock code of 0 to 12 reported at PID 221C. The Passlock signal voltage is at PID 2117. FWIW the 'key in ignition' sataus is reported at bit 0 of PID 2101. I have never come across any post or publication where this is presented. From this I worked out resistance values that would be best for a bypass if one were to go that route. I began that experiment to see if any codes get set when a Passlock system is bypassed in this way.

The Passlock signal, code, and 'key in ignition' status' can be monitored with a phone app and the proper user-entered PID setup which I can provide.

When all the hype is stripped away the Passlock circuit is a very basic thing. A sensor, a BCM and 3 wires between them.

When the BCM wakes up it provides 12 volts to power the sensor circuitry. That's 2 of the theee wires. On the 3rd wire (yellow) the BCM sends out a weak (current limited) 5 volt signal. When the ignition cylinder is rotated to the START position the sensor connects a resistor between the weak 5 volt signal (yellow wire) from the BCM to ground. Connecting a resistor to ground like this drops that 5 volt signal lower, but not too low. The BCM is reading this voltage and checking that this voltage matches the value that the BCM stores in memory. If the voltage signal matches then you are all good for startup. If it doesn't then you most likely get a security light and code.

ANY poor connection in any of the 3 wires will almost certainly cause a fault.

Less likely but possible would be a failure of the sensor to read the rotation of the ignition lock cylinder and then not connect the resistor to ground. There is a small magnet in the rotating key cylinder. This is what the sensor senses, the magnetic field of this small magnet in the rotating key cylinder. If the cylinder to lock housing has gotten very loose I can imagine it may lead to such a fault though I haven't seen it myself.


Some images just for familiarity sake:

First we have the ignition lock cylinder with the small magnet circled. Above the cylinder in the picture is a passlock sensor still in the plastic housing, the area where the magnet is sensed is circled. Above that is the circuit card of the sensor after the plastic housing is stripped away. The semiconductors that do the actual sensing are circled.

View attachment 109662


Next is an image displaying the alignment of cylinder to sensor when installed in the lock housing. The sensor is stationary, the cylinder moves the magnet into this position at START.

View attachment 109661


Here we have a lock housing with Passlock sensor. One can see the three wire connector. One can also see the sensor is not meant to be removeable. It will almost certainly be ruined in any attempt to remove it. Also in this image though mostly out of view is the "key in ignition" switch. It is the off white plastic thing directly behind the 3 wires coming out of the Passlock sensor harness connector.


View attachment 109663



. Last image is another view of a stripped out passlock sensor with the actual resistor responsible for the voltage signal read by the BCM circled.

View attachment 109664

I Also meant to mention that I haven't started doing any troubleshooting or testing this time around. I was just playing with the OBD2 scanner for the few minutes I had on a break.

You asked about a multimeter. I have at least 6 or more multimeters. I have an old one from back when I referred to them as VOM's, a couple of analog meters and several digital MM's. At least one which is auto sensing, which I don't like, but keep in the car for roadside use. I also have an oscilloscope, test lights, tach/dwell meter, etc..

I like to tinker. As a boy I took apart and usually destroyed more electric and electronic devices than I care to remember, just trying to figure out how they work.

Like you, I'd much rather fix something than replace it and I know the difference between fixing something versus changing a part to fix something.

I also like to tinker with Arduino and RPi stuff. I just finished setting up my windows blinds to open and close automatically, I created a distance sensor which counts down to the CM in my garage because space is so limited that the extra few inches is the difference between being able to pump the jack handle or have it hit my toolbox. I've already bent one garage door trying to squeeze that extra few inches of space out of it.

Also recently setup a moisture meter that detects any water leaks under the dishwasher that I just installed because we've flooded our downstairs neighbor twice before. Once when our fridge ice maker leaked behind the fridge and a bathroom incident I'll spare everyone the details of. Now if the sensor detects a single drop of water behind the washer or under the sink, it shuts everything down and rings an alarm.

My last adventure was going to be sweet. I worked on it for months. It was a voice activated NOS system for my car. I had it setup so I could use Alexa Auto to voice activate the NOS system which would turn the system on, open the bottle in the trunk (using a motor I made from an old car window motor) and it would turn on the bottle heater. I used a nitrous controller to manage actually engaging the system through the throttle position sensor when I floored it, and only above 3000 rpm's.

About a week before I was going to finally install everything, the car was totaled. I still have the parts. I walk past them every day as a cruel reminder of what could have been. I just have no vehicle to use the system on unfortunately.

Well lunch break is over. Back to work for me.

Thanks again!

 

[TJBaker57]

I think I was able to ID the yellow wire in your extremely helpful reply

New set of images here...

 

[jmonica]

New set of images here...

View attachment 109669

View attachment 109667


View attachment 109668


View attachment 109670


View attachment 109671

Awesome thanks so much!

 

[TJBaker57]

Awesome thanks so much!

The pictures of the BCM case of course does not show the pins because I have the circuit board in a benchtop test setup right now. Just used the empty case for displaying the pin locations.

If you hook up that scantool after the vehicle is running check that Passlock Security data again and get me the Passlock data Voltage and the Passlock Code. With the data voltage we can figure out the resistance required to bypass. A fairly simple voltage divider circuit. The Passlock Code is just for confirmation as far as this exercise goes.

 

[TJBaker57]

also like to tinker with Arduino and RPi stuff

I have only two Arduino projects. One decodes the message traffic on our Class II serial data bus and gives me the ability to monitor sensors I can add to the truck. The Arduino operates as another node on the trucks network and responds to custom PID(s) I set up for use in Torque Pro, Car Scanner ELM OBD or equivalent phone apps. In this way I can display my custom add-on sensors in an app right along with the trucks built-in data parameters.

My second project monitors our well pump, sounds an audible alarm if the runtime exceeds 30 minutes and creates a logfile of all the pumps start/stop times and runtimes. Next step is to add the ability for the Arduino to shut down the well pump if the run cycle time is longer than 30 minutes. Wells are going dry these days and we don't want to burn out the old pump by having it run dry while we are not there to hear the audible alarm.

You really should have little trouble with this Passlock system given accurate informations.

 

[jmonica]

Nice! You're obviously far more advanced in your knowledge of electronic circuits etc. so hopefully I can learn what I can from you. I appreciate your help immensely. I'm going to work on it this weekend and will post the passlock voltage. Thank you for your help on that as well.

Through a series of unfortunate events I had a well pump burnout on me. Long story but the hose was turned on, because everything was frozen no water came out. Well my brother in law didn't shut off the spigot and when it got warm out, the water was running for a few days while I was out of town. He said he'd pay me back for the new pump but we knii oh w that goes.

Anyway I've got to get to work. Thank Ypj again very much man!!! you're a gentleman and a scholar!

 

[jmonica]

Which tuner did you talk to? I doubt it's Limeswap or PCM of NC as they know their stuff. Yes, Passlock can have problems on GMT 360.

Turning off VATS, which is the part that's in the PCM, will allow you to start your vehicle. Passlock will still be active but the PCM will ignore it but the IPC will flash the security light while it's running. I know this for a fact as I had this issue with one of the keys in my Saab. It's started and ran but the security light would be continuously flashing. Truck ran normally.

I think I'm going to try PCM of NC if I can't get it solved myself this weekend. I feel just replacing the ignition cylinder might fix it but I'm going to try to troubleshoot it. Thanks Mooseman!

 

[jmonica]

The pictures of the BCM case of course does not show the pins because I have the circuit board in a benchtop test setup right now. Just used the empty case for displaying the pin locations.

If you hook up that scantool after the vehicle is running check that Passlock Security data again and get me the Passlock data Voltage and the Passlock Code. With the data voltage we can figure out the resistance required to bypass. A fairly simple voltage divider circuit. The Passlock Code is just for confirmation as far as this exercise goes.

Hi. So I hooked up the scantool. It just so happens that the problem happened while I was performing the scan to get the PL Data Voltage. I scanned it, then turned the car off and then decided to scan it again and upon the second time turning teh key on, the problem started meaning the Security Light started flashing and no start. So below are the voltages and codes first when the car started and the second set of numbers when the problem happened to start.

So initially, the voltage was 2.94 PL Code 7

Then the problem started again where the light would flash and no start. After three 10 minute cycles, it finally started and the light went out.

So with the vehicle running again, the Voltage is 3.08 -3.10 and the PL Code changed to 8.

I restarted it a few times and rescanned it to verify those numbers. Is it strange that the PL code changed from 7 to 8 after the problem?

So if I am reading things correctly, I am going to place a resistor (Hopefully the value will generously be provided by you!) between E8 (Black wire at BCM, Orange/Blk at Ign.) and B11 (Yellow) at the BCM (Cutting both wires leaving the wires coming from the sensor in the ignition open or disconnected.)?

Can't thank You enough for all of your help!

Thank You!

 

[TJBaker57]

Hi. So I hooked up the scantool. It just so happens that the problem happened while I was performing the scan to get the PL Data Voltage. I scanned it, then turned the car off and then decided to scan it again and upon the second time turning teh key on, the problem started meaning the Security Light started flashing and no start. So below are the voltages and codes first when the car started and the second set of numbers when the problem happened to start.

I honestly don't know what to make of it. The PL code changed and so did the voltage. After three ten minute cycles, the light stopped flashing and the car started, but the voltage and code remained the same as when the car wouldn't start meaning, it never reverted back to the initial values. I assumed it would, but I don't know what the heck is going on.

Initial Scan (Car started, no flashing sec light) PL Data Voltage = 2.94 PL Code = 7

Second Scan (Car won't start, Sec light flashing) PL Data Voltage= 3.14 PL Code = 8

After three ten minute cycles (Car started, no Sec light) PL Data Voltage = 3.14 PL Code = 8

The final values are where the car sits no and it starts.

One thing to note, for about the past month, the security light stays on while I am driving or, after a cycle of no starts due to this problem, the sec light will go out, but after driving for 5-10 minutes will come back and stay on (Not flashing) while the car is running.

I was wondering if you had any thoughts on what might be going on? whether ot not the security light is on means nothing to me. I can deal with that whether I leave it as is or eventually eliminate it. Being able to reliably start the car without the passlock interfering is my one and only focus for now.
My concern is if the voltage changes the way it did (from 2.94 > 3.14) during these scans, how can I hope to bypass it using a resistor given the resistor value is based on the voltage? Does that make sense?

I know I have alluded to this before, but each time I try to understand what's happening and how to address the issue, I just fall deeper into the passlock vortex and end up not knowing what to do. I really want passlock gone forever. It seems like most GM models with the PL system have problems with it at some point. I read more stories of dealerships not fixing the problem after selling people new BCM's new ignition cylinders etc. People recommend pushing the key in and holding it as far in as possible when starting the car, I guess to give the sensor the best chance of reading the transponder. Some posts stated disabling the system by using the key in drivers door lock three times. None of this crap works. When it's activated, nothing works except waiting 10 minutes and retrying.

What's to prevent me from taking one of my keys apart, removing the transponder and attaching it to the sensor on the ign cylinder somehow?

Thank You!

Good work!

This tells me a great deal and I will do what I can to explain what's been going on here. It will likely take more than one post.

First off, forget about transponders as you DO NOT have any transponders in your keys. None. These keys are just simple metal blanks with nothing in them. All the Passlock stuff is built into the lock cylinder (with the little magnet) and ignition lock housing with the Passlock sensor in it.

Now a question for you. Did you happen to see what the Passlock data voltage was when the key is turned to RUN but... NOT to CRANK/START? It should be right around 5 volts give or take a little.

 

[jmonica]

Good work!

This tells me a great deal and I will do what I can to explain what's been going on here. It will likely take more than one post.

First off, forget about transponders as you DO NOT have any transponders in your keys. None. These keys are just simple metal blanks with nothing in them. All the Passlock stuff is built into the lock cylinder (with the little magnet) and ignition lock housing with the Passlock sensor in it.

Now a question for you. Did you happen to see what the Passlock data voltage was when the key is turned to RUN but... NOT to CRANK/START? It should be right around 5 volts give or take a little.

No but I can go check that right now! BRB... Thank you!

 

[jmonica]

So I just scanned it again. There's no change in Voltage at all when I plug in the scanner, turn to RUN (Not starting it). I then did start it jiust to see if there was any change and there wasn't any fluctuation even when I started the vehicle. It just stays at 3.08- 3.10 regardless of key position.

I cannot get the PL Data Voltage to move beyond that range much less to 5 volts.

Do I need to get a meter on the wires instead? Or does this indicate a different problem or identify one maybe? Nothing ever works right for me.

Thank you!!!

 

[TJBaker57]

I don't know what the heck is going on.

Initial Scan (Car started, no flashing sec light) PL Data Voltage = 2.94 PL Code = 7

Second Scan (Car won't start, Sec light flashing) PL Data Voltage= 3.14 PL Code = 8

After three ten minute cycles (Car started, no Sec light) PL Data Voltage = 3.14 PL Code = 8

What you are seeing here is most likely the result of a poor connection causing a fluctuation in the Passlock Data signal.

The Passlock Code is a result of the Passlock Data voltage. Here is what I have for the voltage vs code data. You can see your voltage is real close to a threshold here...




The BCM supplies a 5 volt signal output on the yellow wire.

When the key is turned to the start position the little magnet in the lock cylinder moves over the Passlock sensor. This magnetic field causes the sensor to activate and connect a fixed value resistor between the yellow wire from the BCM to the low reference (ground) wire at the passlock sensor.

This resistor drops the 5 volts down and that yields the Passlock Data sensor voltage and thus the code.

The Passlock sensor will keep this fixed value resistor connected like this until after the key is turned to off AND the BCM switches to the OFF state and drops the 12 volt power that goes to the Passlock Sensor on the red/white wire. (This is why they want that 10 second wait time with key off during the relearn).

So why would a steady 5 volt line from the BCM, with a FIXED VALUE resistor to ground fluctuate giving you 2.94 volts one minute and them 3.14 later?

A poor connection on either the 5 volt yellow wire or the black (or orange/black) low reference ground wire will do this. Less likely is a fluctuation on the regulated 5 volt supply from the BCM itself. My money is on a wiring fault.

As far as I know there are only a couple of connections in this circuit. Either at the BCM or the Passlock Sensor. There "might" be a connector in the steering column but I would need to look at that.

So what has likely been happening to you is the voltage has been fluctuating due to a bad connection making the code change. When the code changes during driving this makes the security light turn on. If it happens when you are trying to start then you don't start. You run the relearn and it then learns the 'current' code. Then later the voltage crosses back over to the previous code and you have to go through the whole relearn again!

Did I lose you anywhere?

 

[TJBaker57]

So I just scanned it again. There's no change in Voltage at all when I plug in the scanner, turn to RUN (Not starting it). I then did start it jiust to see if there was any change and there wasn't any fluctuation even when I started the vehicle. It just stays at 3.08- 3.10 regardless of key position.

I cannot get the PL Data Voltage to move beyond that range much less to 5 volts.

Do I need to get a meter on the wires instead? Or does this indicate a different problem or identify one maybe? Nothing ever works right for me.

Thank you!!!

Are we CERTAIN, that nobody before you has put a resistor in there somewhere?

When the key is first turned on, even to accesory and not even as far as RUN there should be about 5 volts at the Passlock Data signal. The code should read 12.

The voltage should only drop when the key is turned to START.

NOTE: in the video ther is 4.9x volts right away even before I put the key in because I had the door open. This wakes up the BCM and the BCM turns on then power even without the key.

My video here shows me testing it with a meter but there should be no difference between this and a scantool....

 

[TJBaker57]

Are we CERTAIN, that nobody before you has put a resistor in there somewhere?

IF,,,,, someone put a resistor in that brought the voltage real close to a crossover threshold then there is a risk of the code changing back and forth like your is doing. I have calculated resistances that should yield a voltage in the center range of a given code and avoid this sort of thing.

 

[jmonica]

HI. Yes everything you said makes perfect sense. And I don't like to speak in absolutes because anything is possible, but I'm as close to 100% as possible on there not being a resistor already installed. I bought the vehicle when it was a year old and I have had it ever since.

The only thing I have ever had done is I had someone install a remote starter. He did an awful job. Didn't even have the courtesy to run the wires going to the drivers door, through the jam. Instead just went from under the steering column to the door and tucked it behind the door panel.

I cleaned up all of the body grounds i could find a few weeks ago. One of them fixed a brake problem I was having. I saw one that I had missed when I was replacing some front end parts last weekend. I intend of fixing that one too. I just hope I can find it again. Not to say that's the culprit, but do you think a bad ground could be causing this problem?

I'm going with you and thinking I have bad wiring some place. I don't know if the guy had to splice into the PL wires at some point for the remote starter, but I am going to remove the dash plastics and see how he has it connected. If I see anything spliced into the PL wires.

At least now, thanks to you, I know I should have 5 volts at the PL with the key in the ACC or run position. I am assuming i should see it drop to 3.08 or close when i crank it.

I have to go pickup my son right now but I will get cracking on it first thing in the AM. I will post results. I can't thank You enough for all of your help. Thanks for sticking with me on this!!!

 

[TJBaker57]

The only thing I have ever had done is I had someone install a remote starter.

This I think is a highly likely source of the trouble. I have not done a remote starter myself, but would not a remote start require overriding the vehicle security Passlock system? The system that depends on the ignition cylinder to be turned to the START position before the engine can run??

Rather than looking specifically for a loose connection I would do a very thorough inspection of the passlock wires. We really need to see a nominal 5 volt Passlock Data signal when the key is at ACC or RUN and BEFORE the key is turned to start.

If we don't see that nominal 5 volt signal then there is an added resistor in there somewhere.

Now if we find the resistor, and the remote start requires it, then we can change or otherwise adjust the resistance to get the voltage away from a code change threshold between codes.

 

[Mooseman]

Yes, remote starters have been known to be the source of problems such as this. The resistor hack is one way, the other is a security bypass module which doesn't totally disable Passlock, only when the remote is activated. There is also another one that is hooked up to the CANBUS and fakes the go-ahead signal to the PCM. IIRC it's made by Fortin. I think you have the resistor hack since the voltage doesn't change, as @TJBaker57 said.

 

[jmonica]

This I think is a highly likely source of the trouble. I have not done a remote starter myself, but would not a remote start require overriding the vehicle security Passlock system? The system that depends on the ignition cylinder to be turned to the START position before the engine can run??

Rather than looking specifically for a loose connection I would do a very thorough inspection of the passlock wires. We really need to see a nominal 5 volt Passlock Data signal when the key is at ACC or RUN and BEFORE the key is turned to start.

If we don't see that nominal 5 volt signal then there is an added resistor in there somewhere.

Now if we find the resistor, and the remote start requires it, then we can change or otherwise adjust the resistance to get the voltage away from a code change threshold between codes.

OK, I think I know where he might have installed some sort of of a bypass module. I believe he tapped it into the harness under the steering column. I remember reading the installation instructions for the RS and although it's been about 7 years ago, I believe the instructions said to splice into one of the wires in the harness under the column where there's a lot of wires. I'm tempted to remove the RS and reconnect everything the way it was, if I am able to see what was done.

Just to get it right in my small brain, I should see 5 volts at that light yellow wire at the BCM with the key in the ACC or Run position is that correct?

My hope is to find the RS module and be able to bypass it, at least temporarily, then hope to see 5 volts at the PL wire. If that happens, I will probably just consider removing the RS system. It's convenient in the winter when it's snowing, but I no longer have a wife who uses the car, so no biggie.

Not to sound like a broken record, but thank You again. If I don't say it in some of my replies, it's only because I don't want you to get tired of hearing it. Just know that I really appreciate your help on this. I think I've found a new job and might be starting in a few weeks, so I do not want to risk being late to work because the car won't start. At least not when I'm just starting the new job. It's a job I've been trying to get for a few years now.

 

[jmonica]

Yes, remote starters have been known to be the source of problems such as this. The resistor hack is one way, the other is a security bypass module which doesn't totally disable Passlock, only when the remote is activated. There is also another one that is hooked up to the CANBUS and fakes the go-ahead signal to the PCM. IIRC it's made by Fortin. I think you have the resistor hack since the voltage doesn't change, as @TJBaker57 said.

OK Thank You. I will confirm that hopefully once I find the RS module. I greatly appreciate your help!!!