to make no mistakes that i figured this out myself i copied this off of another site to save ppl a little bit of time. VATS/PASSKey I/II bypass on GM cars
Well, I did not even have a clear idea of what a VATS system was and I did not care at all about it until I found myself stuck on a Wal-Mart parking on a Saturday morning. My 95 Buick LeSabre would just crank, the engine would start for 1 second and then die.
I spent 50 bucks for towing the car to a mechanic, then another 100 bucks for diagnostic and the problem came out to be a fault in the security system. At this point, the dealer is the only one that could have it fixed... For about 1000CAD!
I did not really mean to spend this money when the problem was just security. I mean, the car itself was running spectacular; never had problems and I love it.
So I went google'ing and researching for the whole day and I discovered some funny things that explain a lot, but I won't comment on the funny side, will just stick on the solution that saved me all the money.
I wrote this page for 2 reasons:
1) A nightmare weekend for me. I don't want it to be the same for someone else.
2) I hate hidden things and people that make money out of them.
This document apply to the following cars:
Pontiac
1994-1996 Grand Prix
1992-1999 Bonneville
1993-2002 Firebird/Trans Am/Firehawk
Buick
1994-1996 Regal
1992-1999 LeSabre
1991-1996 Park Avenue
1991-1996 Roadmaster
Oldsmobile
1994-1997 Cutlass Supreme
1992-1999 Eighty Eight/LSS/Ninety Eight/Regency
1991-1996 Custom Cruiser Wagon
Chevrolet
1995-1999 Monte Carlo
1995-2001 Lumina
1993-2002 Camaro
1986(?)-1996 Corvette (C4)
Cadillac
1991-1996 Fleetwood
1992-1997(?) Seville/STS/DeVille
Any other GM Vehicles with the VATS or PASSKey I/II system
If you have your car diagnosed with "security system problems" and you are suggested to go to a dealer, then do NOT.
It is most probably a "security problem" when everything runs just fine and then suddenly one of the following happens:
- Engine won't start, won't even crank
- Engine would crank, start for 1sec and then die
- "security" light will flash and one of the above happens
This is a typical problem and would cost you about 1000 bucks if you go to a dealer, but can be easily solved with 8 bucks. You just need to buy some very few basic electronic components that you can even find at Radio Shack and then make a circuit that even kids can do at home. Installation is even easier.
How the VATS/PASSkey system works:
First, I would suggest you asking the question to a dealer, so you can have a lot of fun.
There are a lot of variants in the answers they could give you. One that I heard is that there is a microchip in the key that exchange information with the "whole system" and then only after this information is validated the system will send a "class 2" signal to the PCM to enable the injectors, otherwise everything will be shut off cause the car thinks it's being stolen.
I would like to say the very same in easy English words:
- That thing in the key is just a resistor, not a microchip at all; it has no brain, just a value that you can easily measure.
- The "whole system" is just a black box 6" wide and it's called the TDM (Theft Deterrent Module).
- The "class 2 signal", like they like to call it, is nothing else than a very basic 50Hz/50% duty-cycle square wave.
- And last but not least, the car does not think at all.
This is how the key shows:
So, when you insert the key, the ignition lock cylinder will make contact with the resistor's pellet on your key and, through a couple of wires will connect your resistor to the input pins on the TDM. If the value of the resistance is the one expected by the TDM, then it will activate a relay that will enable the Blower Motor and will send that 50Hz signal to the PCM that will enable the injectors. It's as easy as this.
Now back to the problem.
If it is a security problem, then there are only 3 things involved that could go wrong:
- The key
- The ignition lock cylinder
- The TDM
Of course you don't know which one of the 3 is your trouble. There are 2 ways to go:
- Do some diagnostic and, if it is the key or the lock cylinder you won't need the circuit, but just a resistor.
- Don't do any diagnostic but spend a couple of hours to build the bypass circuit - it will solve all 3 problems forever.
Let's go to the first case before all, let's say you want to do some diagnostic.
Open the kick panel under the steering wheel. You will find an orange double-wire (or it could be a single wire containing 2 small white wires inside).
NOTE: You will also find bigger yellow wires, DO NOT CUT THOSE, since they are part of the Airbag system and, if you get the Airbag inflating by mistake, you could be seriously injured.
Now, simply use a voltmeter (one that measure ohms - 10 bucks at Wal-Mart) to measure the resistance in your key between the 2 terminals of the pellet. Then buy a resistor about the same value you read (+/- 10%). Cut the orange wire close to the lock cylinder, strip back the insulation on the opposite side of the cylinder and sold your resistor to them.
This way you are bypassing both the key and the lock cylinder; the TDM will always see the right value of resistance no matter what the key will be.
Now turn the key and see if the engine starts.
- If it starts ok then you can leave it like this, but be aware that now your car is no more protected and anyone can start it with just a simple key copied from yours. At least you can go home now.
- If it doesn't start, or you want more security after you get home, then just build the bypass circuit in 2 hours, install it in 1 and you're done. Forever.
First of all you need to find the TDM in your car. It's a black box about 1"x3"x6" and it's usually *not* buried deep in the dashboard like they love to say. It is usually easy to access behind the glove box or the kick panel under the steering wheel. You won't even need a picture; it can be spotted right away.
In my '95 LeSabre was well visible behind the glove box.
When you see the TDM and you know where it is, then just go buy the components and prepare yourself for a 2-3 hrs soldering work.
The components you need:
- IC1 : LM7812 Voltage Regulator
- IC2 : 555 Timer - LM555CNB or equivalent
- C1,C2 : 0.1uF ceramic capacitors
- C3: 1uF electrolytic capacitor
- R1: 3.9K 1/2 watt resistor
- R2: 10K 1/2 watt resistor
- R3: 22K multi-turn linear trimpot
- PB: Prototyping Board 3.6" x 1.8"
- ICS: 8pin IC socket
All of the above components can be easily found in any Radio Shack - and this is very important since they are open on Sunday :-)
The bypass circuit:
http://newrockies.ca/vatsbypass/
After you build the circuit on your proto board, before plugging in the 555 in its socket and before going any further with the installation, you need to regulate the trimpot R3 to the right value. To do so, point your voltmeter between pin 6 and 7 of the 555 socket and turn the trimpot till you measure a resistance of 13.5K. Then plug in the 555 in the socket. This way the circuit will be generating a 50Hz signal.
Installing the bypass circuit:
The wiring diagram of the TDM connector is the following:
--------------------------------------------------
A1 ORN constant hot
A2 PNK hot in run, bulb test, or park
A3 DK BLU fuel enable signal (to pcm)
A4 YEL/BLK starter enable relay control
A5 GRY security indicator enable control
A6
A7
A8
--------------------------------------------------
B1
B2
B3
B4
B5 BLK ground
B6
B7 PPL/WHT ignition pellet return
B8 WHT/BLK ignition pellet feed
--------------------------------------------------
Some other pins could be also connected, but you don't need to care about them.
Now, unplug the connector from the TDM and carefully cut A2, A3, A4 and B5 close to the connector; then strip back the insulation on all 4.
Connect the pink wire (that was on A2) to T1 on your circuit; then the dark blue wire (former A3) to your output T3, and finally the other 2 wires together to T2.
Done. Turn on the key and the engine will start right away and never stop anymore.
If it doesn't, that could mean that your security system is a PASSKey I and need a 30Hz signal instead of a 50Hz one. All you have to do in this case is to unplug your circuit, unplug the 555 from it, point your voltmeter again on pin 6 and 7 of the 555 socket and this time turn the trimmer till you measure 22.5K.
Plug everything back again, pray and turn the key.
NOTE: For security concerns, to connect the bypass as instructed above you can use a pair of connectors. This way you can put your circuit in a nice box inside your glove box and unplug it and bring it with you whenever you feel your car is not in a safe place.
