Hey guys!
I recently picked up a '96 Cavalier for a great price. The engine runs great, but only for 5 seconds...
When I bought the car it started and ran fine, but the key was a little bit hard to turn in the ignition. The next day after the test drive the key would not turn at all. So after spending a few days trying just about everything to get it to turn, I decided to just take the ignition switch and lock out of the picture. I've always wanted to do toggle switches, so I picked up some electrical busses and a couple switches from radio shack and set it up, only to be shot down by the anti theft(Passlock I) system.
The car cranks and runs healthy for about five seconds, at which time the anti theft light starts blinking and the ECM cuts power to the fuel injectors.
I have tried the resistor method: both using a pot and using a single 2.2k resistor. Nothing. Couldn't get it to relearn the resistor value, and since the lock was busted I couldn't turn it to read the proper resistance.
I built a 50hz square wave generator(http://temp.corvetteforum.net/c3/70lt1/vats.shtml) to tried and trick the ECM through the fuel enable wire. The only information I could find was that it is usually a dark blue wire coming from the dash. My car has two dark blue wires coming from the dash. One is solid and one has a stripe. The solid one carries 12v when the ignition is on, and the striped one carries no voltage. Connecting my square wave generator to either of them did not work.
I can't find any wire diagrams online, or any diagrams for my ECM. I honestly don't even know if it has a fuel enable wire. If anyone has any helpful information I would be very thankful. There has got to be someone out there who has figured this one out before.
Rather than busting your ECM by pumping arbitrary data streams into it, why don't you just get a key cut from your VIN? Your current key is probably just too worn down to turn and too worn down to get a copy from.
The key cylinder itself failed. My goal is not to replace it with another one, but to do without it completely and use a push button starter and toggle switches.
so pick up a universal anti theft bypass module, wire it in, then add your switches.
or, do it the right way.
car audio noob since 1984.
The "right" way is relative. For my project(and budget), the "right" way is not spending a few hundred dollars getting a new ignition switch and lock set up. I have a fairly specific goal in mind, and I would be extremely thankful for some help in achieving it.
What I need is a pin out for the ECM on my car, or a wire diagram that includes the anti theft system. I can't seem to find either, or even enough info to piece it together. I must still be missing something, since the usual approaches that people on the internet have had success with have not worked for me.
My case is slightly special because I do not have the lock, or the ignition switch still intact, and therefore can not read the original resistance from the sensor in the lock.
But the fact that I can't get it to relearn with a new resistor(2.2k), and can't get it to run using the TDM bypass with the 50hz square wave generator means I am still missing something. Any insight would be greatly appreciated.
Thanks!
just because it's not still intact doesnt mean you can't read the resistance. since you feel you're capable of reading the schematic of the
PCM (you do not have an ecm.) then you should be able to read the resistance of the old cylinder. even if you don't have it, get one from a yard for $5. then,
use something like this after your switches to take place of the tumbler.
still, i'd expect someone who can properly read a schematic to be able to figure this out.
car audio noob since 1984.
Even just a pin out of the PCM(sorry) would help me greatly. I just spent good money on the parts to put together my square wave generator and if my PCM does have a fuel enable pin, I feel like that would be the faster and more effective way by far.
If there is no simple fuel enable pin on the PCM, then I am sure that if I cut my losses and toss more money at it, I could reconstruct it to a point and set it up with a remote starter bypass or something of that nature.
Also, I do not claim to have any great knowledge on the subject of reading schematics(I can usually glean what I need from them...), or on the subject of Passlock I systems. Which is the reason that I have to ask for help. :p
Tim Wagner wrote:Even just a pin out of the PCM(sorry) would help me greatly. I just spent good money on the parts to put together my square wave generator and if my PCM does have a fuel enable pin, I feel like that would be the faster and more effective way by far.
If there is no simple fuel enable pin on the PCM, then I am sure that if I cut my losses and toss more money at it, I could reconstruct it to a point and set it up with a remote starter bypass or something of that nature.
Also, I do not claim to have any great knowledge on the subject of reading schematics(I can usually glean what I need from them...), or on the subject of Passlock I systems. Which is the reason that I have to ask for help. :p
I will have access to PCM schematics next Saturday (8th) if you can wait that long.
I would certainly still be trying to come to a conclusion in the mean time, but I would be very interested in a PCM schematic for my car if you had one!
If want my email address, I will PM it to you.
Thank you very much.
Go ahead and send it to me. I'll do what I can.
Btw, base or Z24?
The fuel enable password is sent via the UART serial data line between the cluster and the PCM.
The GM service manual wrote:The powertrain control module (PCM) communicates with the instrument cluster using serial data over the UART serial data bus, CKT 800. When the instrument cluster determines a Pass Theft condition, the instrument cluster sends a coded password to the PCM. When the instrument cluster receives the correct password, the PCM enables the fuel injection system in order to allow the vehicle to operate normally. The PCM may allow the vehicle to start and stall quickly during a failed theft condition.
The PCM may enter tamper mode under the following 2 conditions:
• A bad timing cycle
• An incorrect password
If the instrument cluster does not send a password within a preset time window, the PCM will enter the Short Tamper Mode. During the Short Tamper Mode the PCM will not allow the car to operate for 4 seconds. If the password is incorrect, the PCM will enter the Long Tamper Mode. During the Long Tamper Mode the following actions will occur:
• The indicator will flash.
• The fuel injectors will shut off for approximately 10 minutes.
The vehicle may start, but the engine will quickly stall due to fuel cut-off.
The PCM will become fail-enabled under the following conditions:
• If there is a open in the serial data wire between the instrument cluster and the PCM
• If the vehicle is running
The following actions will then occur:
• The THEFT SYSTEM indicator will then illuminate continuously.
• The PCM will become fail-enabled for future ignition cycles.
If a failure in the serial data wire occurs under the following conditions, the engine will not start:
• The engine is not running.
• The PCM is not fail-enabled.
John Lenko wrote:The fuel enable password is sent via the UART serial data line between the cluster and the PCM.
The GM service manual wrote:The powertrain control module (PCM) communicates with the instrument cluster using serial data over the UART serial data bus, CKT 800. When the instrument cluster determines a Pass Theft condition, the instrument cluster sends a coded password to the PCM. When the instrument cluster receives the correct password, the PCM enables the fuel injection system in order to allow the vehicle to operate normally. The PCM may allow the vehicle to start and stall quickly during a failed theft condition.
The PCM may enter tamper mode under the following 2 conditions:
• A bad timing cycle
• An incorrect password
If the instrument cluster does not send a password within a preset time window, the PCM will enter the Short Tamper Mode. During the Short Tamper Mode the PCM will not allow the car to operate for 4 seconds. If the password is incorrect, the PCM will enter the Long Tamper Mode. During the Long Tamper Mode the following actions will occur:
• The indicator will flash.
• The fuel injectors will shut off for approximately 10 minutes.
The vehicle may start, but the engine will quickly stall due to fuel cut-off.
The PCM will become fail-enabled under the following conditions:
• If there is a open in the serial data wire between the instrument cluster and the PCM
• If the vehicle is running
The following actions will then occur:
• The THEFT SYSTEM indicator will then illuminate continuously.
• The PCM will become fail-enabled for future ignition cycles.
If a failure in the serial data wire occurs under the following conditions, the engine will not start:
• The engine is not running.
• The PCM is not fail-enabled.
This is really awesome, man. That explains why I have not been able to get it to relearn, and why it always flashes for 4 seconds instead of 10 minutes like most people say it should.
Is it possible that you know anything about how the time window is created? I recall reading something that said the time window starts when the engine cranks and the "bulb check wire" is grounded. But I do not know if that is accurate.
Thanks so much.
That's exactly when the time window starts.
Hey guys! Just wanted to give you all a little update.
I finally figured it out and fixed the problem. I hope that if there are other people out there struggling with the same issue, they are able to find this information and use it.
A small bit of history:
This project started when the ignition lock cylinder failed and was not able to turn using the correct key(I had two keys and tried both countless times). I decided that instead of getting the lock replaced, I would take the ignition switch and lock out of the picture entirely and wire in toggle switches and a starter button. This approach allows almost unlimited possibilities for the order and flexibility of the ignition process, and let's be honest, flipping switches is just a lot more fun(My Dad calls them "Batman style toggle switches". And what could be more awesome than Batman?).
The trouble started when the anti-theft system decided that I was trying to steal my own car, and would not let the engine run for any more than 5 seconds before cutting power to the fuel injectors. This is where the search began for information on the workings of this system. And after countless hours(spanned over days) of Google searching, from both me and my Dad, as well as many nights spent deep in thought, and probably well over 100 attempted combinations... All we found was that answers were few and far in between.
A few facts:
Unlike the PassKey system, the PassLock system does not use a fuel enable wire to the PCM. After spending $20 on electronics and bread-boarding a 50Hz square wave generator, I learned(Thanks to a kindly member of J-body) that the security information is sent from the IPC to the PCM via serial data. Not that we are unable to wire up a UART device that speaks the same language. But that is an entirely separate can of worms.
Also unlike the PassKey system, the PassLock system requires for things to happen a certain way, but more importantly at a certain time. The solution is simple once you know what you are up against, but the process of discovery is extremely confusing. You can not just wire up your resistor and ground the bulb check wire. The providing and removing of resistance as well as the grounding of the bulb check wire both have to be done dynamically during the cranking process.
Grounding the bulb check wire starts a "time window" in which the correct password must be sent. More on this later.
There is a three wire ribbon cable running from the IPC to the ignition lock cylinder. This ribbon contains a 12v power wire, a 5v signal wire, and a ground reference wire. On mine, the wires are all black and the 12v wire has a white stripe on the side. The 12v wire is used to power the sensor that detects if the ignition lock is being turned, and we will not use this wire for anything. Use a VOM to test the voltage and figure out which wire is which. The 5v wire will test 5v and the ground reference wire will test ground. The resistor will be placed between the 5v signal wire and the ground reference wire during "RUN".
There is a small black wire running to the ignition switch(it is next to a green wire of the same size). This wire will test 12v, and is called the "bulb check wire". This is the wire that must be grounded during "CRANK".
I used a 2.2k Ohms 1/2watt resistor from radio shack and the computer relearned the resistance fine. I wasn't able to check the original resistance of my device since I could never get the lock to turn, but 2.2k worked fine for me and it should work for you too.
The solution:
You can use either 'one normally closed double pull/double throw relay' or 'two single pull/single throw relays(one normally open, one normally closed)'.
There are two parts to this simple solution:
First, only provide resistance between the 5v signal wire and the ground reference wire during "RUN". The resistance must be removed during "CRANK".
And second, only ground the bulb check wire during "CRANK".
Feel free to do this in what ever way works for you. I will be rewiring everything soon, but I am currently running power for my relay/s directly from the "closed" or "switched" side of my momentary contact "CRANK" switch.
I have a normally closed relay that is always connecting my resistor between the 5v signal wire and the ground referance wire unless the engine is cranking. In which case the wires are not connected.
I also have a normally open relay that is not connecting my bulb check wire to a chassis ground unless the engine is cranking. In which case it is connecting the bulb check wire to ground.
The conclusion:
The first time you crank the car with the relays wired in properly, the light should blink for up to 10 minutes(it only took my car 5 minutes) and then it will come on solid. The next time I cycled the ignition and cranked it, it ran fine and the theft light went off. This means that the PCM has reprogrammed itself to your 2.2K Ohms resistance and will now start only with that resistance. Some people say that you have to repeat the 10 minute process three times before it will relearn, but this wasn't the case for me.
Troubleshooting:
Not that I know everything about the way the system works, but one thing that it would have been nice to know starting out is what the blinking theft light meant.
There are two tamper modes both caused by separate occurrences:
Short Tamper Mode is caused by the "time window" being opened(by grounding the bulb check wire), but no password being sent. In Short Tamper Mode, the car will run for 5 seconds and then shut off. The theft light will then blink on and off for about 5 seconds, and then come on solid.
Long Tamper Mode is caused by the "time window" being opened and an incorrect password being sent. It means you are doing the right thing, but sending the wrong resistance. In Long Tamper Mode the car will not start and run, and the theft will blink for 5-10 minutes. Notice that when the PCM is relearning our new resistance, the car will be in Long Tamper Mode. This is a good thing.
If you are not opening the time window, or sending a password, the car will not start and the light will blink once or twice. This means your relays are not working properly or something is wired wrong.
I hope this is easy to understand, and I hope it will save at least one person from confusion. That would make it worth the hour that it took me to write this up.
My car runs great now, and I have just begun the journey of fixing it up just the way I want it. Don't give up on doing what you want with your car. It's your car! There is no problem too big to solve... The only question is whether the time investment is worth it. And in this case, I think it was.
Thanks guys!
Tim do u have any photos of where and how u wired everything ? I am currently building a dirt track j body 99 z 24 and I want to run everything off of switches. I am pretty New at all these computer operated engines and don't really have a clue as far as the wiring works I really don't want to blow my computer seems how I'm getting it flashed / re programmed for my motor I just built .
