When you click on links to various merchants on this site and make a purchase, this can result in this site earning a commission. Affiliate programs and affiliations include, but are not limited to, the eBay Partner Network.
Special thanks to contributors: Tuned Performance , Tibo , scooter
The following outlines multiple methods of defeating the Vehicle Theft Deterrent System and when each method is appropriate.
Schematic of the theft deterrent system is shown below. Wire colors may vary by year. The VATS Decoder Module (also known as PASSKEY Decoder Module) is the heart of the system and is located behind the dash, mounted to the HVAC plenum just above and left of the radio, and the entire dash must be removed to gain access to it.
The VATS module interfaces with the Ignition Lock Cylinder to evaluate whether the resistor pellet in the key is correct.
The VATS module controls the start relay ON/OFF function.
And the VATS module controls the engine ECM fuel injector enablement.
The system can be defeated several ways depending whether you keep or remove the engine ECM.
I have the stock engine ECM
See Method A. In this scenario you keep the system in tact but trick the VATS module into believing that the correct key is being used. This is done by permanently installing a resistor in the resistor sensing circuit. The resistor must be a match to the resistor in the key pellet.
I am removing the stock engine ECM
In this scenario the stock engine ECM no longer controls fuel enablement (because a different fuel system exists) but the VATS module still has control of the starter motor relay. The VATS module must be defeated to allow the starter to crank the engine.
The only reason the start relay exists is so that the VATS module can prevent engine starting as part of the anti-theft feature. The start relay serves no other function and can be bypassed safely. There are several options,
Do nothing and keep the theft deterrent system in tact. VATS module will operate the starter relay as long as the resistor pellet in the key is a match.
See Method A. Install a resistor in the resistor sensing circuit. This will negate the need to have the correct key pellet, but still relies on the VATS module to operate the start relay.
See Method B. Bypass the control side of the start relay. This effectively eliminates the VATS module but keeps the start relay in tact. The start relay will be controlled directly by the ignition switch.
See Method C. Eliminate the start relay. Both the VATS module and start relay are eliminated, and the starter solenoid is hard wired to the ignition switch.
I am doing an LS swap and the new PCM has VATS
See Method D. Disable VATS in the LS engine PCM, and bypass the VATS hardware on the car.
Measure the electrical resistance of the pellet in your key. Refer to the table below to determine the corresponding Key Blank Number, and purchase a resistor that falls within the allowable tolerance (max, min) as shown in the table.
Find the wire pigtail from the Ignition Lock Cylinder under the steering column. Disconnect the pigtail and install the resistor between the colored wires on the vehicle side of the harness. The old pigtail to the Ignition Lock Cylinder will not be re-used and must remain disconnected. The new resistor will satisfy the VATS module and allow the engine to start when the key is turned to the CRANK position. Having the correct pellet in the key is no longer necessary.
Even more elegant: Cut the pigtail to Ignition Lock Cylinder and solder the resistor between the wires. Now you have a "plug and play" resistor that can be plugged back into the vehicle harness, or removed if you want to disable the vehicle.
METHOD B
Ground the field coil of the start relay. Outcome is the start relay will be ON (starter cranking) when key switch is in the CRANK position.
Option 1: Ground the field coil locally at the start relay. Cut the small (16 gauge) DARK GREEN wire on earlier cars (BLACK / YELLOW wire on later cars) and ground it to chassis. Start relay is located behind the driver side kick panel, often down near the carpet line.
Option 2: Ground the start relay at the VATS module. Jump together terminals A3 and B1 at the VATS module electrical connector. A3 is the wire from start relay, and B1 is the ground path that the VATS module would have used if still working.
METHOD C
Unplug the start relay from the electrical connector and discard. Jump the larger 12 gauge YELLOW wire to the 12 gauge DARK GREEN / WHITE wire. Start relay is now eliminated and the ignition switch is wired directly to the starter solenoid when key is in CRANK position. Note: The wire leads should be insulated to prevent accidental short to ground and possible fire. Picture below does not have adequate insulation.
A sticky that covers how to fix the VATS system would make sense. I'm not really in favor of tutorials on how to defeat an anti-theft feature. Wouldn't really want it to be a sticky for the same reason I generally don't provide step by step instructions on how to roll back an odometer.
I applaud the reasoning, and the effort, it's just information with potential for misuse.
HUH?!?! Not even remotely in the same ball park as an illegal activity of rolling back the odometer.
It is a basic, common, and necessary modification for people that upgrade or change engine management system. And it is probably in the top 3 questions asked in this particular forum.
Explaining how to defeat VATS is the same as explaining how to start a later thirdgen without the proper key. While there are legit reasons a person may want to do that, the information can be abused by someone with less honorable intentions. I disagree with spoon-feeding a tutorial to anyone with the ability to search Google and read the first result. It should be difficult to defeat. To make it less difficult is to compromise an anti-theft feature on countless member's cars. It should be considered how it may negatively impact the community.
You're arguing for secrecy about an antiquated 30 year old technology. If you made this argument 25 years ago then you might get a sympathetic ear. These days defeating VATS is just part of the hot rod culture.
Must not be too obsolete if it creates problems for hotrodders. Anything that inconveniences a car thief is going to make a car a less attractive temptation. While the functional value of the system isn't valuable to you, it may be valuable to someone else, and you should take that into consideration before publicizing how to defeat the system. You're welcome to disagree, but that doesn't make my opinion any less valid.
This thread is more tailored to the engine swap crowd, hence the larger variety of circumstances and methods up to and including integration of VATS with LS1 PCM.
You know I'm not a moderator and can't make stickies anyway.
Do people ever look at the main page and how-to's anymore?
I found that being a moderator caused an awful lot of bellyaching when I was being mildly abrasive. I retired my moderator status when I was living without internet access and really couldn't keep up with the job.
But anyway, I've voiced my position on the topic, so I'll leave it at that.
I can take a picture for Method A of the connector on the column where you install the resistor. Other than that, you need an ohm meter so you can measure the resistance of your existing key pellet.
Method D, you just need to remove the VATS module and ground that wire that goes to the Starter relay. You should also point out that the wire colors may change through the years, as the wire in my 92 is not dark green.
Also, that wire is where someone would want to add a security feature, such as an aftermarket alarm. My alarm system will ground that wire when the system is disabled.
I am not sure Method E is a possibility with the LS. I think the output on the later VATS is different than our cars.
In this scenario the stock engine ECM no longer controls fuel enablement because a different fuel system exists such as carburetor or stand-alone EFI. That means the PASSKEY module cannot interfere with fuel delivery, but it still has control of the start relay. If you take time to examine the starting system wiring, then you’ll notice that the only reason the start relay exists is so that the PASSKEY module can control the starter crank event. The start relay serves no other function and can be bypassed safely.
^^^
Also can't have a good sticky without the wiring schematic
? I didn't wind up using mine as I decided to ditch TPI and the ECM, but it did seem to work. I can get a picture and write a brief description if you're interested.
I'm thinking this could be presented as a viable option to the resistor bypass.
What are your thoughts on including a section on how to install a VATS bypass module? Something similar to this? I didn't wind up using mine as I decided to ditch TPI and the ECM, but it did seem to work. I can get a picture and write a brief description if you're interested.
I'm thinking this could be presented as a viable option to the resistor bypass.
The VATS or PASSkey system for our cars doesn't need any fancy module to bypass it, you just need the appropriate 5 cent resistor from the table tuned posted and possibly a new prom burned if you have the stock ecm.
The VATS or PASSkey system for our cars doesn't need any fancy module to bypass it, you just need the appropriate 5 cent resistor from the table tuned posted and possibly a new prom burned if you have the stock ecm.
OP is looking at doing options, so why rule this one out?
I have that style bypass on my dirt car. Works great. I deleted most of the factory column and key switch so this worked perfect for me. Not the best option for everyone, but again, why rule it out?
What are your thoughts on including a section on how to install a VATS bypass module........ I can get a picture and write a brief description if you're interested.
I am not sure Method E is a possibility with the LS. I think the output on the later VATS is different than our cars.
Originally Posted by QwkTrip
I'm not sure either. I have a faint memory of Pocket explaining it but I could be wrong.
What you would have to do is... Throw away the Passkey/VATS box in the thirdgen, and then.... This is where it gets fun, you'd wire the 4th gen BCM into the Thirdgen dash to detect the key value, and generate the signal for the ECM. Didn't really look too close at the LS1 starter diagrams to see if they use the starter enable relay.
It wouldn't really be worth the trouble. Yes, the 98-02 BCM can be wired into a thirdgen, but it's not exactly easy. To make things work right, you're rewiring the fuse box, power locks, hatch release, headlight switch, blah blah blah. It'd really only be worth the trouble if you wanted the other features of the BCM in a thirdgen.
OP is looking at doing options, so why rule this one out?
I have that style bypass on my dirt car. Works great. I deleted most of the factory column and key switch so this worked perfect for me. Not the best option for everyone, but again, why rule it out?
Its a legit option.
Yeah, I agree this isn't the best option for most people - but why not be thorough? Also, the VATS bypass will work even if the original PASSKEY module is damaged or missing, which might be a big deal for someone with a hacked up harness or for someone swapping to TPI.
It's worth noting you still need to bypass the start relay. The bypass module simulates the signal from the PASSKEY module to the ECM which allows the injectors to fire - but it doesn't control the start relay. Think of it as sort of a hybrid of Method A and Method B.
I'll grab a couple pictures and do a step by step writeup tomorrow. It's not too complicated to install (one or two wires to 12V+ depending on whether you need the 50Hz or 30Hz signal, one grounded, one to a specific wire on the ECM).
Would you like to add 89-92 ecm diagnostic the pins you can read the 2.5v on or hz signal at the ecm ?
1227165 (86-89) tpi maf
Pin b6
1227730 (90-92) tpi and 3.1l
Pin f10
1227846 (89-92) tbi
Pin b6
All using a dark blue wire for passkey wire to ecm.
If you suspect the vats being a issue you can check for power at these terminals or if you have the means to read a hz signal you can measure it at the above pins.
On tbi you can remove the prom and the engine will start but run poorly in limp home mode.
Last edited by Tuned Performance; 04-11-2018 at 09:06 PM.
Updated. I put all pictures on this site's picture host so links are never lost.
Moderators... This is ready to become a sticky.
LOL Except for that time when all the locally hosted images got lost
Ya know, what a lot of other forums do is put a list of related tech threads with links, in a single sticky. That way you don't have 75 stickys at the top of the forum.
If you are keeping the pasakey module with your engine swap make sure to ground the module through the c207 connector. Pin m on my car but it will be the black/white wire. Looking on the 92 schematic above it grounds through the c100 connector.
If the module is working you will get the security light for a second or two when you first move the key to run position, then it will go off. If you have the right key or resistor in place when you move it to start the starter relay will be grounded and starter will engage. If you have the wrong key the security light will come on and disable the starter for 10-15 min or so.
Special thanks to contributors: Tuned Performance , Tibo , scooter
The following outlines multiple methods of defeating the Vehicle Theft Deterrent System and when each method is appropriate.
Schematic of the theft deterrent system is shown below. Wire colors may vary by year. The PASSKEY Decoder Module (also known as VATS Decoder Module) is the heart of the system and is located behind the dash, mounted to the HVAC plenum, just above and left of the radio. The entire dash must be removed to access the PASSKEY Decoder Module. The PASSKEY module interfaces with the Ignition Lock Cylinder to evaluate whether the resistor pellet in the key is correct. The PASSKEY module controls the start relay ON/OFF function. And the PASSKEY module controls the engine ECM fuel injector enablement. The system can be defeated several ways, depending whether you keep or remove the engine ECM.
I have the stock engine ECM
See Method A. In this scenario you keep the system in tact but trick the PASSKEY module into believing that the correct key is being used. This is done by permanently installing a resistor in the resistor sensing circuit. The resistor must match the key pellet.
I am removing the stock engine ECM
In this scenario the stock engine ECM no longer controls fuel enablement because a different fuel system exists such as carburetor or stand-alone EFI. That means the PASSKEY module cannot interfere with fuel delivery, but it still has control of the start relay. If you take time to examine the starting system wiring, then you’ll notice that the only reason the start relay exists is so that the PASSKEY module can control the starter crank event. The start relay serves no other function and can be bypassed safely. There are several options,
Do nothing and keep the theft deterrent system in tact. PASSkey module will operate the starter relay as long as the resistor in the key is a match.
See Method A. Install a resistor in the resistor sensing circuit. This will negate the need to have the correct key pellet, but still relies on the PASSKEY module to operate the start relay.
See Method B. Bypass the control side of the start relay. This effectively eliminates the PASSKEY module but keeps the start relay in tact. The start relay will be controlled directly by the ignition switch.
See Method C. Eliminate the start relay. Both the PASSKEY module and start relay are eliminated. Starter solenoid is hard wired to the ignition switch.
I am doing an LS swap and the new PCM has VATS
See Method D. Disable VATS in the LS engine PCM, and bypass the PASSKEY hardware on the car.
Schematic from 1988 Firebird service manual
Schematic from 1992 Camaro service manual
does the passkey fuse power just the passkey module ?
looking at the schematic it looks like it but I’m not sure if any accessory is involved.
04-08-2018, 10:12 PM
HUH?!?! Not even remotely in the same ball park as an illegal activity of rolling back the odometer.
