Hello, all, I have a friend who is working on a 1997 Pontiac Sunfire with Passlock I that is causing us fits. The symptoms are that it won't start because, according to his Snap-On computer, the "Theft deterrent" aka Passlock is shutting down the brain (killing crankshaft and camshaft position sensor signals). I have bypassed Passlock I & II systems before for remote start by checking the resistance across the lock cylinder with the key inserted and in the On position and then splicing in a pack of resistors that closely approximate the ignition switch's resistance but that has failed to fix this particular vehicle. The problem has been going on for sometime and has gone on too long. What I understand is that the instrument cluster, where these wires from the ignition switch for Passlock terminate, controls whether or not the brain fires the engine. If that is the case, there should be one wire that comes from the instrument cluster that can be 1) cut, 2) tied to another wire, or 3) run to battery positive or negative, to make the brain think the system is always green-lighted by Passlock. He changed the brain with no luck, and even the instrument cluster (not understanding the relationship between the brain, cluster, and ignition switch and how it works as a system) with no luck. I've tried both the original instrument cluster and the other one but neither one works. Can anybody tell me how to do a low-level hack on this Passlock system, please? Since putting the correct resistance in the system hasn't worked I am willing to strong-arm this POS by tinkering with the wires coming from the back of the cluster. :)
Has your friend tried replacing the hall effect sensor* at the inner end of the ignition lock cylinder?
*(being a hall effect sensor explains why merely installing a fixed resistance in place in the circuit doesn't work) To enable a start, the instrument cluster has to see the signal from the hall effect sensor at the proper instant as the ignition switch is being switched on.
Most of the major manufacturers of remote starter systems sell a by-pass for the Passlock system.
Neil, thank you for your response. My friend claims that the ignition switch is designed in such a way that it cannot be re-installed (his words, not mine). The problem we've had with the ignition switch seems to be that it's intermittent in showing the resistance value across the yellow (key-side) to black (splice) wire. I manually inserted and left resistors inline between the yellow (cluster-side) and the black wire splice and it doesn't work. I have bypassed Passlock II systems in a similar fashion, but what I did was to use a relay to flip the resistance in and out depending on the start command from the remote start system (too cheap and too impatient to wait for a bypass module) and it worked. The difference then would be that the remote start only kicks that resistance in when it's trying to start and leaving it out the rest of the time? Would running these resistors via a relay make the key difference? That would mimic the "bypass" modules I've seen in the past and the installs I've done that worked successfully for remote start.
Still, since the Passlock system is, at this point, scrappable, we're tempted just to cut a wire or splice a wire, or whatever, coming from the back of the instrument cluster if it'll just make the darned thing run. :)
Odd considering that it's a known weak point and a frequent repair.
I'm familiar with building your own by-pass with resistors and a couple of relays...
It's all in the timing between the key on and when the hall switch sends its signal to the cluster.
Were it that easy, it wouldn't be much of a theft deterrent, would it? The top of he dash comes off pretty fast allowing access to the back of the cluster. Another possibility would be a re-program of the PCM to not need to recognize the anti-theft signal from the cluster.
Yeah I think something upsteam more is messed up, its not the resistor in the ignition switch, or any of the wiring, the problem probably lies with the ECU not recognizing it anymore.
Neil, thank you again for your information (and thanks to Paradox, who's post is a level below this reply). I'm going to try to go over there today and put the resistance in line using a relay as opposed to the way it's just hard-wired in place now because of what you had said about the Hall effect switch. What you say makes sense that leaving a hard-wired resistance in there would not work, so I'm going to try switching it in and out.
As for the hall-effect sensor, my friend can be very hard-headed and isn't always right; I'll contact the dealer to ask them about it and see what they say (not to question what you're saying but to find if it's available and then maybe cajole a little guidance from them in the manner of replacing the item).
Well, it still seemed like a sound idea; that you could disconnect or otherwise disable the Passlock via a single wire from the instrument cluster. I realize this would be a single point of failure for the Passlock, but I didn't consider the back of the cluster that accessible. No matter, how would a person "re-program the PCM to not need the anti-theft from the cluster"? That sounds like the most promising piece (if it's fast and easy to do).
As a follow up, I tried using a relay to only interject the resistance when the key was in the crank position and it at least ran for a few moments before Passlock (theft) shut it down. :) That's a step ahead of where were, but still not all the way. :( I tried a pot and ran resitances from 400 to 16,000 ohms, in roughly 100 ohm increments with no luck (passlock would shut it down each time). Supposedly, according to my friend, you have to let the system "reset" for 10 minutes after a failed attempt and I didn't do that (I hit at least 50 different stages between 400 and 16,000 ohms and that would have been almost 10 hours of waiting interspersed in there. The ability to tell the ECM to skip the Passlock "okay signal" seems to be our best hope.
This site shows how to build/wire the relays and resistors to bypass passlock 1 and 2
formatting link
Going off of memory, all of the hall effects switches I've ohmed out, all had the same value, don't recall what the ohmic value is but if you can put an ohmeter on a working one, odds are that value will work for your vehicle.
Got a friend/fellow shop owner in town here who's the same way...;-)
One of the custom chip builders my have a way to re-program the PCM, another option would be a PCM speced for an export vehicle. In the old days of replaceable PROMs, one could just swap out the PROM for one that didn't have an anti-theft feature. Option three is to buy a by-pass from one of the remote starter manufacturers, in a day or two + $30 and it's running.
Here are several sections to describe how I was able to achieve a fix for a *presumed* faulty ignition switch. Bear in mind that as time wore on my attempts got more wild and were less documented, so don't crucify me if some of this seems completely hoaky, I'm just passin' on what worked in this case.
THE SHORT VERSION I had hard wired the correct resistance between the Yellow and Black wires but this failed to bypass Passlock 1. Neil had suggested that (via/because of a Hall effect switch) that the resistance was to be put in to play at specific points during the ignition sequence: Run-Crank-Run. Accepting this I attempted a simple relay circuit as I've used in the past to bypass Passlock systems which, as you've read above, failed. That was yesterday. Today I hit it again and found that I'm an idiot, I had wired the relay so that the resistance was only in play during crank, not during run. Switching the connections on the relay so that the resistance was put into play *only* when the switch was in the run position fixed the car. It ran immediately (so, no 10 minute "reset" timer, no run-off-run-off-run BS then let it sit
15 minutes, it ran immediately when the right resistance was put in the circuit at the right time. I then broke the connection between the Yellow wire and the resistance, effectively disconnecting any connection to the Yellow wire which then illuminated the Theft light, but the car kept running. Subsequent attempts to start the vehicle without the resistance/relay circuit are *successful*, with the only holdup being that the Theft light stays on constantly. A T-15, 6 or 8 screws, and a soldering iron later...no LED for the theft on the instrument cluster PCB, voila!, no Theft light. Yes, a shade-tree hack, but I live in the sticks and I don't have to put up with city traffic, so there! No resistors, no relay, the car starts fine everytime.
THE DETAILS: I had put the damned resistors in line with the black/yellow wires, but I had powered the relay with the crank wire in such a way that the relay applied the resistance *only* in the *crank* position of the ignition switch. Stupid mistake, no excuses, just stupid. I noticed my error today, which meant that yesterday, using a Pot. to try resistances from 400 to 16,000 ohms was *completely wasted time*. I put the resistance in place today correctly (the crank wire flips a relay *removing* the resistance from the circuit, but at rest, the resistance is in place) and the car ran immediately, no reset time (none of that "leave the key on, door open, hold your breath, kiss your sister, and scratch your left earlobe BS"). While it was running my buddy asked me if the car would keep running if I removed the resistance to which I replied that it would (based on a similar test on a Passlock II system I had worked on). I *disconnected the yellow* wire from the circuit, effectively leaving it open *while the car was running*. He then claimed that I might not have fixed the problem because sometimes a successful start will be repeated several times even though the theft system is not properly cleared (BS, I thought, but I didn't challenge him). However, I then remembered a post I saw online (via Deja) about a possible bypass for Passlock I (and maybe II); the process was thus, 1) start the car normally with the key, 2) while the car was running, cut the yellow wire. That's it. Supposedly that completely disabled the Passlock system. I inadvertently affected that solution when I, to prove to my buddy that I knew the car would keep running with out the resistance, removed the connection to the brain-side of the yellow wire. I proved it then when, again to prove to my buddy that the car wouldn't start without the resistance in place, started the car (to my chagrine (sp?)) without the resitance in place and *WITH THE YELLOW WIRE CUT AND NOT CONNECTED TO ANYTHING* (which means that it could *not* have been because the ignition switch worked correctly). I had read several sites (including the site that Neil had sent me a link to
formatting link
and had seen instances of tyingthe bulb-test wire to ground during specific moments of the ignitionsequence, and I had thought that might play a critical role in theprocess, however, it did not make any difference in this applicationas I have that wire untouched now and the car runs fine. THE BACKROUND (for those who didn't read the whole post history)
1997 Pontiac Sunfire. Stars. Dies moments later. Snap-On computer indicates theft system/CMK & CRK (I think those were the codes) undetected (those are the cam shaft and crank shaft position sensors). Buddy replaces the computer, no improvement; car starts, dies. Buddy replaces the instrument cluster (which houses, at least in part, the Passlock circuitry to check the resistance of the ignition switch).
THE (hopefully) REPRODUCIBLE PROCESS Cutting into the *thin* yellow wire on the passenger-side of the steering column, by the ignition switch (one of three; black, white, yellow (search online for "bypass passlock I" or "bypass passlock II", or visit the link that Neil has provided earlier in his post, or quoted here in mine)) and measuring the resistance between the *cut* end of the yellow wire on the switch-side to a bare, stripped spot on the black wire, with the key in the Run position, yielded a particular resistance. Mimicing that resistance with resistors and placing it between the computer/instrument cluster side of the yellow wire and that bare patch on the black wire by using a relay controlled by the
*thick* yellow crank wire (on the driver's-side of the steering column) such that the relay inacted the resistance at run, but *not* crank, caused the vehicle to start properly. While it was running, breaking the connection from the yellow (thin) wire to the resistance
*seems* to have caused (corroborating another post online) the system to permanently bypass the Passlock I system; subsequent starts neither required the resistance/relay setup, NOR the yellow wire (thin) to be hooked to *anything*, not even itself. Opening the instrument cluster and de-soldering the THEFT LED prevents the LED from staying on constantly, which it did after this permanent bypass.
THE NAGGING TRUTH This was all today. It may fail tomorrow and never start again. I hope this helps y'all. Thanks to all who replied to my question, especially Neil.
Thank God, it's runnin'. :)
--HC
X
=?x-user-defined?Q?=AB?= Paul =?x-user-defined?Q?=BB?=
Hmmm, if it isn't Captain Killjoy! That's a very very good point. I will have my buddy test it. Damned good thought. I'll let y'all know how that turns out.
I disconnected the battery today (both positive and negative terminals to be thorough) for 20 minutes. I then re-connected the battery terminals and attempted to start the vehicle. It started and ran perfectly. It would *seem* that loss of power did not affect the bypass. I suppose a more thorough test/answer would be to disconnect the battery for a day or more and then to start and kill the engine repeatedly, over days of testing. However, this prelimnary and short test indicate that the solution is a permanent fix.
HTH, and thank you for your suggestion which was very valid and which I had not even thought of until you mentioned it.
Neil, I posted back about the "disconnect battery" post trying to keep it in-line for those who will read this in Deja for years to come, and I'm posting it here, too, for your convenience; disconnecting the battery seemed to have *no* effect on the bypass/hack/plunder of the Passlock I system. While the time of only 20 minutes of the battery being disconnected may not be long enough, it *should* have been more than enough, I would think. I will be out of town and pocket for the next few days during which I will have to rely on my buddy's reports of the effectiveness of the solution. In all honesty, I think a more
*elegant* solution would have been to wire the relay and resistance into the circuit and have simply left that there, along with the functioning Theft LED, but the strain on my time prevented such elegance. BUT, for those in need of a simpler solution, the temporary attachment of the relay and resistance coupled with breaking the connection to the yellow wire while the car was running, therefore allowing the complete removal of any resistance/relay/etc. may be the perfect solution.
In the end, thank God, it runs, I gave some assistance to my buddy who is the person I always call when I need car questions answered, and I've passed it on to the Groups. I feel pretty good. :)
MotorsForum website is not affiliated with any of the manufacturers or service providers discussed here.
All logos and trade names are the property of their respective owners.