Passlock problems

[jmonica]

So Im sitting in my parking lot at work. Security light flashing. So no start. This has been happening at random times for a year or so. It’s been fine for the past three months until today. I’ve sat through three ten minute cycles and still no joy. I don’t think it’s the ignition cylinder because it happens when I try to use remote starter as well. I really don’t know what to do at this point. I’ve read a lot of the threads on it but I’m stupid. I really want to try to find a way to disable this if at all possible. Once and if I ever get it home. It’s about 20 degrees in the mornings here, I have a one hour commute and my only other transportation is a Yamaha R6, so yea that’s going to stink if getting to work comes to that. I just started this job, I’m broke and now stranded. Yep, life’s a joy!

 

[Mooseman]

Sorry for your troubles. The only way to get rid of VATS is to have it tuned out, and that, unfortunately, costs money. @limequat does it for $99. http://www.lime-swap.com/

More than likely it's the key cylinder sensor. It probably thinks it's been jacked. When it started doing this, it should have been looked at then. Replacing the sensor would require either a Tech 2 or other capable scanner to do the relearn. Can't be bypassed by other means as it disables the starter and fuel pump. Maybe you can jump the fuel pump relay and then the starter relay but I doubt that will work, especially if it also disables ignition and/or the fuel injectors.

 

[TJBaker57]

Are you any good with electrical troubleshooting? Got a multimeter? I could guide you through a few tests to see if a trouble can be found.

In a simplified description.... 3 wires come from the BCM to the Passlock sensor in the ignition switch assembly. One is 12 volts, one is ground, and one is a weak 5 volt signal wire.

When the vehicle network wakes up from a door opening or a keyfob button press or whatever the BCM activates the circuits. 12 volts is sent to the sensor to power the solid state circuit in the sensor. The BCM also puts a 5 volt signal on the signal wire.

When the key is turned past RUN to CRANK a small magnet in the lock cylinder activates the sensor and when this happens the sensor connects a resistor between ground and the 5 volt signal wire. Doing
this drops the 5 volts down some. The resistor stays connected like this until the key is turned back from RUN to ACC. EDIT: I think ACC s/b OFF instead.

The BCM is watching that 5 volt signal and measures the lower level voltage and sees if it matches the level it should be at. If it matches then the BCM allows the truck to start and run normally.

The resistor that is connected to drop the voltage down is different from one truck to another so you cannot simply add a random resistance in there and expect it to work.

So what can go wrong? Bad connections on any of the three wires at the BCM or the sensor, or ANYTHING that taps into these wires,,, like a remote start system might do.

With a multimeter the 12 volts and the 5 volts etc can be tested. For those interested I also have PIDs for Torque Pro or equivalent that read out these voltages from the BCM.

Here is a somewhat useless video showing the nominal 5 volt signal dropping when I turn the key to CRANK. A relay was removed for the test so the engine does mot crank.

And if you are really bored here is another video where I show a passlock sensor on the tabletop and show the resistance that is switched in when that particular sensor activates.

 

[Mooseman]

After watching @TJBaker57 's video, this one came up and may be your solution to bypass it.

 

[TJBaker57]

may be your solution to bypass

I have seen writeups for doing the bypass like this but I always wondered if the BCM might toss a code when it sees the dropped voltage when it should be seeing the nominal 5 volt signal. Maybe they did not write that check into the BCM firmware/calibration?

I had thought that were I to do a bypass of this sort I would at least try to use a relay that would allow me to duplicate the entire factory setup, that of 5 volt signal until turned to CRANK then drop in the resistor and hold it in until key off.

However, there is something in my DNA that compels me to fix things instead of seeking to bypass them.

Just last week I repaired my old coffee pot after buying a new one. I had already identified the failure before buying the new unit but could not bring myself to toss out the old pot when I saw I could fix it for a few dollars.

Anyhow, if anyone reading this far is thinking of doing this on our GMT360/370 the wiring is easier to get to. I'll toss up some images here and add a few of the sensor itself which you cannot see without destroying it and the housing to get it out.

First off here is our sensor and the three wires.

Here is a look at the magnet in the lock cylinder, a passlock sensor with the area that is sensing the magnet circled, and the actual circuit board from inside a sensor showing the semiconductor(s) that do the sensing circled.



A close up of the circuit board with the actual resistor that is switched in circles in blue. You can sort of see there are TWO sensing elements layered one atop the other the lower one is the tamper sensor that trips if the magnetic field strength is too high.





And lastly, I would imagine the same bypassing of the sensor could also be done back at the BCM under the rear seat?? Same wires are available there without having to tear apart the steering column. However the wires are taped up pretty good there and you would likely want to remove the connectors from the BCM and unwrap some tape to gain adequate access.

I tried to isolate the wires for the first of the next 2 pictures. The sensor signal wire is on C1, terminal B10. The low reference (ground) is on C2, terminal E8 and the 12 volt power is right next to that at C2, E9.





Here below is the yellow sensor signal wire on the bottom connector, the row closest to the front of the truck and down low towards the floor. You can just barely see it between that orange wire and the black/white wire. Not easy to access without removing the connector from the BCM.

 

[TJBaker57]

Well this took me down a rabbit hole.

I went out to verify the PID for the Passlock sensor return voltage. In addition I had taken my ignition switch out in the past month or two and got it what I thought was a tooth off during reinstall. This I felt because the rotation of the key and cylinder between RUN and CRANK was far too short, just a degree or two. Turns out I was way off due to the graphic in my service manual being wrong.

While checking that PID out I didn't get the 5 volt reading from Passlock sensor when turning to CRANK, I got it before even getting to the RUN position!!

After all is said and done I also see I never added this PID to my thread for these things so I need to do that also.

Passlock Return voltage:
Mode & PID = 22211701
Equation = A/51
Header = 6C40F1

If one reads out your sensor return voltage the resistance value can be calculated. The South Main Auto video was lucky as he only had a 5000 ohm variable resistor. I have seen a couple of sensors with a resistance value near 14000 ohms.

 

[jmonica]

Sorry for your troubles. The only way to get rid of VATS is to have it tuned out, and that, unfortunately, costs money. @limequat does it for $99. http://www.lime-swap.com/

More than likely it's the key cylinder sensor. It probably thinks it's been jacked. When it started doing this, it should have been looked at then. Replacing the sensor would require either a Tech 2 or other capable scanner to do the relearn. Can't be bypassed by other means as it disables the starter and fuel pump. Maybe you can jump the fuel pump relay and then the starter relay but I doubt that will work, especially if it also disables ignition and/or the fuel injectors.

Thanks Mooseman. At this point it might be worth the =$100. If I can make it until spring, then I can ride the bike and send the ECM out to get flashed. That good information, so thank very much. I went through I think seven or eight 10 minute cycles before I finally got a steady light last night and it fired up. I really need to fix this though. I expect to sit in the parking lot for a while after work today as well.

I'm not kidding when I say this. I have gone and continue to go to other websites for things like my motorcycle repair help, firearms/gunsmithing related sites, 3D Printing, etc to get help and I am always disappointed because I'm so used to the awesome help and awesome people on here. I wish every site had people as fine as this one. I've been on the internet since the late 90's and to this day, I have never found any other site where the people (like You), are as helpful, know their stuff inside and out and are just willing to help any time someone needs a hand. So thank You and thank everyone who helps make GMTNation the best site it's kind. Period. I will continue to come here for as long as You guys will let me.

 

[jmonica]

Well this took me down a rabbit hole.

I went out to verify the PID for the Passlock sensor return voltage. In addition I had taken my ignition switch out in the past month or two and got it what I thought was a tooth off during reinstall. This I felt because the rotation of the key and cylinder between RUN and CRANK was far too short, just a degree or two. Turns out I was way off due to the graphic in my service manual being wrong.

While checking that PID out I didn't get the 5 volt reading from Passlock sensor when turning to CRANK, I got it before even getting to the RUN position!!

After all is said and done I also see I never added this PID to my thread for these things so I need to do that also.

Passlock Return voltage:
Mode & PID = 22211701
Equation = A/51
Header = 6C40F1

If one reads out your sensor return voltage the resistance value can be calculated. The South Main Auto video was lucky as he only had a 5000 ohm variable resistor. I have seen a couple of sensors with a resistance value near 14000 ohms.

TJ thank You so much. I'm going to break out the VOM this weekend and follow through what you've outlined. I am confused (not unusual) because I see these videos of guy putting a random, resistor in place of sensors to bypass the system. I guess a few just got lucky given each vehicle has a different values. I on the other hand, am not that fortunate. MY vehicle sat for about 18 months about 4 years ago and that's the worst thing I ever let happen to it. Can't describe the amount of rust repair I've done on it. I have a feeling that a lot of these problems stem from bad connections, or at least some of them. I have another problem I posted about a few months ago where the DIC screens won't cycle with the steering wheel buttons, UNLESS, I dim the dash lights completely, press the button, and turn the dash lights back up. It's not random either. I can cycle through all of the screens that way, just one at a time. Then other days, I get in and the buttons just work.

Three nights ago, I went to pull out of the gas station and my gear selector went limp. It was obvious the cable had either broken or disconnected. Using my hand dandy credit card size multi tool I was able to remove the console and work the cable to get home. The plastic bushing on the cable to shifter broke. If I ever fix the Passlock problem, I only have the service brake system message to heed, the rear hatch latch, rear defroster, blower motor, my cooling fan is ticking (once again), and maybe one day I will attempt to fix the stability control indicator thing that two steering wheel position sensors didn't fix.

Thank You again for taking the time to post instructions on troubleshooting my initial problem. I appreciate it more than you know man.

 

[Mooseman]

Well, if you ever go for the tune, the fan codes can also be turned off and you can use a thermal clutch from an 08-09 TB instead of the trouble prone EV clutch. And there are also other improvements to be had as well.

 

[TJBaker57]

I am confused (not unusual) because I see these videos of guy putting a random, resistor in place of sensors to bypass the system

Well this can work but it almost certainly will require a 30 minute relearn.

 

[Mooseman]

It actually will require a relearn using a Tech 2. I had to do that when I replaced the whole steering column and its different resistance value. The 30 minute relearn is when the PCM is replaced and needs a new "handshake" between it and the BCM.

 

[jmonica]

After watching @TJBaker57 's video, this one came up and may be your solution to bypass it.

Yes, I watched this one this morning. It definitely looks like something doable and a way around this problem! I will post results. Thank You Moose!