How to Install Vats Bypass Module 94 Buick Park Avenue

• Forums
• Past Buick Vehicle Discussion
• Buick Roadmaster Forum

You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an alternative browser.

Understanding/Diagnosing the PASS-Key System

• Thread author Goldmaster
• Start date Oct 10, 2007

• #1

1,241

3

0

Michigan

Buick Ownership

1994 Buick Roadmaster

Here is an excellent article that I saved that was orginally online in pdf format, but it doesn't seem to be hosted anywhere anymore. But it's got some great info on PASS-Key II (or VATS as it's often called) I thought it would make a useful sticky because I'm sure as these cars get older, there will be a lot more problems with this system.

[FONT=HelveticaNeue-ThinCond, sans-serif] When the engine in a GM [/FONT]
[FONT=HelveticaNeue-ThinCond, sans-serif] vehicle won't start, better [/FONT]
[FONT=HelveticaNeue-ThinCond, sans-serif] check the vehicle's Passkey [/FONT]
[FONT=HelveticaNeue-ThinCond, sans-serif] system. Are you ready to [/FONT]
[FONT=HelveticaNeue-ThinCond, sans-serif] tackle a vehicle that's been [/FONT]
[FONT=HelveticaNeue-ThinCond, sans-serif] told not to start? [/FONT]
[FONT=HelveticaNeue-BoldCond, sans-serif] BY JACQUES GORDON [/FONT]​

[FONT=BulmerMT-Regular, serif][FONT=HelveticaNeue-Condensed, sans-serif]S[/FONT] ince the mid-'80s, General Motors (GM) has used three different theft deterrent systems, but they are all passive, meaning its activation is automatic. It's operated by communication between a control unit and the ignition key through the ignition switch. If the switch is vandalized, if it's operated with the wrong key or if the Class 2 communication link is disrupted, the engine won't start. Any time the theft-deterrent system causes an unwanted no-start, chances are it's a simple communication breakdown. To find it, you need to understand how the system detects theft and how it prevents engine starting. What you will find here is information about GM's Passkey I and [/FONT] [FONT=BulmerMT-Regular, serif]Passkey II theft deterrent systems, along with a few tips provided by our Troubleshooting Editor Roy Ripple. [/FONT] [FONT=BulmerMT-Regular, serif]We've concentrated on these systems because Roy tells us these are the systems that generate the most help requests. [/FONT] [FONT=BulmerMT-Regular, serif]He also says the problem is usually just a faulty connection, botched accessory installation or even just a worn out key [/FONT] [FONT=BulmerMT-Regular, serif]or ignition lock cylinder. These can be easy to troubleshoot, because all you need is a wiring diagram, a DVOM and knowledge of how the system is supposed to work.[/FONT]

[FONT=HelveticaNeue-BlackCond, sans-serif] OPERATING STRATEGY [/FONT]​

[FONT=BulmerMT-Regular, serif]The Vehicle Anti Theft System (VATS) was first installed on the 1985 Corvette. The Personal Anti-theft Security [/FONT] [FONT=BulmerMT-Regular, serif]System (PASS-key) replaced VATS in 1988, and while there are some differences, VATS and Pass-key I and II all work the same way. There is no radio communication involved; the system merely looks for the ignition key's unique electronic signature. The PASS-key I & II systems all have a pellet embedded in the ignition key that communicates with the Theft Deterrent Module (TDM). On VATS and PASS-key I, the TDM is hidden deep in the dashboard. On PASS-key II, the TDM is built into the Body Control Module (BCM). The key's visible pellet is a resistor, and you can read its value by touching meter probes to the contacts on either side of the pellet. With the key in the ignition, the pellet touches contacts in the lock cylinder. These contacts are wired to the TDM, which reads the value of the resistor to identify the key. If the resistance is correct, the TDM sends a pulse-width modulated signal to the PCM, which then enables the fuel injectors. The TDM also operates the Theft Deterrent Relay (TDR) that allows power to reach the starter solenoid when the key is turned to the START position. If the TDM doesn't recognize the key pellet, it decides a theft attempt is in progress and it will go into anti-theft mode. In this mode, the TDM will:[/FONT]

• Turn on the "Security" warning light on the instrument panel.

• Prevent starter operation by not turning on the Theft Deterrent Relay.

• Send a signal to the PCM telling it to disable the fuel injectors.

• Disable the key recognition circuit for three minutes.

[FONT=BulmerMT-Regular, serif]This last point is important to people who own more than one GM vehicle. With multiple GM keys on the [/FONT] [FONT=BulmerMT-Regular, serif]same key ring, accidentally inserting the wrong key in the ignition will prevent start-up, and the TDM waits [/FONT] [FONT=BulmerMT-Regular, serif]three minutes before it will read the key circuit again. Also notice that the PCM is looking for a specific "go" [/FONT] [FONT=BulmerMT-Regular, serif]or "no-go" signal from the TDM before it will decide whether or not to operate the injectors. The absence of [/FONT] [FONT=BulmerMT-Regular, serif]a go signal is not a valid no-go signal, and vice versa. [/FONT] [FONT=BulmerMT-Regular, serif]If the TDM decides a theft attempt is in progress when the engine is already running, it will not stop the engine, but it will turn on the "Security" light and enter anti-theft mode at the next key cycle. If the starter is operated without the key in the lock cylinder, such as with a remote starter switch, the TDM will interpret that as a theft attempt. Likewise, if there is a short to power or ground in the key recognition circuit, it is interpreted as a theft attempt. This can happen [/FONT] [FONT=BulmerMT-Regular, serif]if the wiring in the steering column is damaged during theft, repair or installation of electronic accessories. Either way, if the correct key is not in the ignition switch when the key recognition circuit fails, the TDM will turn on the "Security" light and enter anti-theft mode. If the correct key [FONT=BulmerMT-Italic, serif]is [/FONT]in the cylinder and that circuit fails while the engine is running, this is considered a malfunction, not a theft attempt. The "Security" light may turn on to warn of a system malfunction, but even if it doesn't, a key recognition circuit failure with the proper key in the lock will cause the TDM to enter what GM calls a "fail-enable" mode. Essentially, the theft-deterrent system goes offline and the engine will start and run with any key that turns the lock. (continued next post...) [/FONT]

Last edited: Oct 20, 2007

• Thread author
• #2

1,241

3

0

Michigan

Buick Ownership

1994 Buick Roadmaster

[FONT=HelveticaNeue-BlackCond, sans-serif] KEYS [/FONT]

In the original VATS system, the key's resistor pellet and the TDM were programmed together at the factory. [FONT=BulmerMT-Regular, serif]In the Passkey systems, the TDM will memorize the resistance of the first key inserted into the lock. There [/FONT][FONT=BulmerMT-Regular, serif]are 15 different resistance ranges or codes, and all are available as key blanks from GM dealerships. Within [/FONT] [FONT=BulmerMT-Regular, serif]each range, the actual resistance may be more than 100ohms different from the resistor's nominal code value, [/FONT] [FONT=BulmerMT-Regular, serif]and even though a TDM will memorize the resistance of the first key inserted into the lock, it will recognize a key [/FONT] [FONT=BulmerMT-Regular, serif]pellet in the same resistance range. Whether the TDM is a separate unit or built into the BCM, that key resistance[/FONT] [FONT=BulmerMT-Regular, serif]range memory cannot be reprogrammed. The resistance range of that first key is what it will look for every time. [/FONT] [FONT=BulmerMT-Regular, serif]There are three ways to get that resistance range number. One is to look at the car's original invoice. Another [/FONT] [FONT=BulmerMT-Regular, serif]is to insert the key into GM's special Passkey troubleshooting tool, the J35628A Interrogator Tester, which will display the key's range number directly. If neither of these options are available, you can read the key pellet's resistance with a DVOM. With that reading, the dealer parts department can look up the resistance [/FONT] [FONT=BulmerMT-Regular, serif]on a chart and supply the correct blank.[/FONT]

[FONT=HelveticaNeue-BlackCond, sans-serif] TESTING [/FONT]
[FONT=BulmerMT-Regular, serif]A Tech II or Mastertech scan tool can read all the circuits in the Passkey system. The most common failure is [/FONT] [FONT=BulmerMT-Regular, serif]simple wear and tear of the ignition key itself or the lock cylinder contacts. It's a good idea to have all copies of the key available for testing, because if the vehicle is driven with the same ignition key most of the time, the [/FONT] [FONT=BulmerMT-Regular, serif]repair may be a simple matter of replacing a key that has worn out resistor pellet contacts. If the system doesn't recognize any of the keys, and if your scan tool can't display Passkey codes, you'll need to "undress" the steering column and find the ignition lock cylinder connector to test the key recognition circuit. If someone has already been into the steering column before, check the lock cylinder wiring carefully for damage. Roy advises that the second most common Passkey problem is pinched wires in the key recognition circuit, almost always caused by reassembling the steering column improperly after some other repair. With the lock cylinder connector unplugged, measure [/FONT] [FONT=BulmerMT-Regular, serif]resistance in the circuit with a key inserted and in the OFF position. It should match the resistance of the key pellet itself. Try wiggling the wires and the key in the cylinder. If resistance changes, the wiring is damaged or the key or lock cylinder contacts are worn and should be replaced. A heavy load swinging on the key ring has been known to cause problems with these contacts. Be aware that the TDM sends a 5-volt reference through this circuit at all times, so it's important to unplug the connector before testing the lock cylinder circuit.[/FONT] ​

[FONT=HelveticaNeue-BlackCond, sans-serif] LOST KEYS [/FONT]
[FONT=BulmerMT-Regular, serif]If you have none of the original keys for the car, there are two options. One is to use the Interrogator Tester tool, which plugs into the key recognition circuit between the lock cylinder and the TDM and simulates the key pellet's resistance. Using any key that will turn in the ignition, set the Interrogator Tester to simulate one of the 15 resistor ranges and attempt to start the engine. Each wrong guess and unsuccessful starting attempted will cause the TDM to go into anti-theft mode. It will reset after three minutes so you can set the tester to a different range and try again. It's a tedious process, but it will get the car on the road with no new parts other than the correct key blank. Without this tool, and without knowing the original key's resistance range, the only way to start the car without any of the original [/FONT] [FONT=BulmerMT-Regular, serif]keys is to replace the TDM. On Passkey I models, the TDM is a separate control unit buried deep in the dashboard along with the Theft Deterrent Relay. On Passkey II models, it's part of the BCM and can't be replaced separately. [/FONT] [FONT=BulmerMT-Regular, serif]Remember, the first time a new TDM or BCM is powered up, it permanently memorizes the resistance of the first key in the lock. Sometimes there are good reasons for permanently disabling the Passkey system so the key pellet's resistance doesn't matter. Without replacing the TDM, this can only be done if you know the original key pellet's resistance. Soldering a jumper wire with the correct resistor into the key recognition circuit will make the TDM "think" the key is always in the ignition. If you're replacing the TDM, the system can be disabled by simply installing a jumper wire in the key recognition circuit. This bypasses the new TDM's programming function and allows any mechanically correct key to start the vehicle. The same PCM was installed in vehicles sold with or without Passkey, but the PCM won't operate the injectors without a signal from the TDM. A non-programmed TDM will provide that signal, but it also will turn on the "Security" light on the instrument panel to warn of what it considers a theft deterrent system malfunction. GM just bypassed the key recognition circuit and eliminated the "Security" light from the panel. [/FONT] [FONT=BulmerMT-Regular, serif]So if you're eliminating a Passkey system, a diagram of the TDM or BCM connector will show where to jumper [/FONT] [FONT=BulmerMT-Regular, serif]the key recognition circuit. It's safer to solder a resistor into the jumper instead of just leaving a new TDM un-programmed and leave the "Security" light connected. This way, if the engine ever fails to start and the "Security" light is on, you'll know where to look first . (continued...) [/FONT] ​

Last edited: Oct 10, 2007

• Thread author
• #3

1,241

3

0

Michigan

Buick Ownership

1994 Buick Roadmaster

[FONT=HelveticaNeue-BlackCond, sans-serif] PROGRAMMING [/FONT]
[FONT=BulmerMT-Regular, serif]Just as a new TDM is programmed by the first key pellet it reads, a new PCM or TDM/BCM learns the fuel [/FONT] [FONT=BulmerMT-Regular, serif]system go/no-go commands at the first start-up. If a PCM is replaced, the new unit will automatically learn the correct [/FONT] [FONT=BulmerMT-Regular, serif]commands from the original BCM. If a new BCM is installed, it will learn the correct commands from the [/FONT] [FONT=BulmerMT-Regular, serif]original PCM. However if either control unit was ever used in another vehicle, they must be reprogrammed [/FONT] [FONT=BulmerMT-Regular, serif]together. There is a 30-minute programming procedure that does not require a scan tool.[/FONT] ​

[FONT=BulmerMT-Regular, serif] 1.Turn the ignition switch to START, then release it to [/FONT]
[FONT=BulmerMT-Regular, serif] the ON position (the engine will not start). [/FONT]​

[FONT=BulmerMT-Regular, serif] 2. The "Security" light should be ON. After 10 minutes, [/FONT]
[FONT=BulmerMT-Regular, serif] it should turn OFF. [/FONT]​

[FONT=BulmerMT-Regular, serif] 3.Turn the ignition switch OFF and after five seconds, [/FONT]
[FONT=BulmerMT-Regular, serif] repeat steps 1 and 2. [/FONT]​

[FONT=BulmerMT-Regular, serif]When this procedure has been done three times, turn the ignition switch OFF. The control units will exchange [/FONT] [FONT=BulmerMT-Regular, serif]the correct commands during the next start-up attempt. If programming is not completed correctly, either there will be no theft protection or the system will lock in anti-theft mode and the engine won't start. Try the programming procedure again. Note that this will not reprogram key recognition, only the information transmitted on the Class 2 data link. As you can see, the key to the Passkey system is just that: the ignition key. The control unit makes all its decisions based on the state of the key recognition circuit. While the vehicle may have additional security and alarms, only the Passkey system will prevent starting. Unless there's a communication problem between the TDM or BCM and the PCM, all you need for troubleshooting the Passkey system is a DVOM, a wiring diagram, and a[/FONT] [FONT=BulmerMT-Regular, serif]good understanding of how the system works.[/FONT] ​

[FONT=HelveticaNeue-BlackCond, sans-serif] PASS-KEY SYSTEM CODES [/FONT]
[FONT=HelveticaNeue-LightCond, sans-serif] B2957 key recognition circuit voltage invalid (may be shorted) [/FONT]
[FONT=HelveticaNeue-LightCond, sans-serif] B2958 key recognition circuit voltage invalid (may be grounded) [/FONT]
[FONT=HelveticaNeue-LightCond, sans-serif] B2960 key recognition valid but incorrect (wrong resistance range) [/FONT]
[FONT=HelveticaNeue-LightCond, sans-serif] B3031 BCM does not have a valid key pellet resistance in memory [/FONT]
[FONT=HelveticaNeue-LightCond, sans-serif] B3094 BCM did not receive a "powertrain status" message from PCM within one minute of KOEO [/FONT]
[FONT=HelveticaNeue-LightCond, sans-serif] P1626 fuel enable signal missing or incorrect (can be set with KOER) [/FONT]
[FONT=HelveticaNeue-LightCond, sans-serif] P1630 PCM ready to learn security password from TDM or BCM (new PCM) [/FONT]
[FONT=HelveticaNeue-LightCond, sans-serif] P1631 BCM indicates theft attempt, PCM has entered anti-theft mode [/FONT]
(more to come shortly...) ​

• Thread author
• #4

1,241

3

0

Michigan

Buick Ownership

1994 Buick Roadmaster

PASS-Key Resistance Values

______________________________

• Thread author
• #5

1,241

3

0

Michigan

Buick Ownership

1994 Buick Roadmaster

• #6

19

0

0

West MI.

Buick Ownership

1995 Buick Roadmaster

Cool beans, this about a week ago would have been super.

Looking to update and upgrade your Buick luxury automobile? Look no further than right here in our own forum store - where orders are shipped immediately!

• #7

Roadmonster

• #8

6,943

7

0

Benton Harbor, MI

Buick Ownership

95 Roadmaster Sedan (3), 94 & 96 Roadmaster Wagon

sweet deal...

Now people know how to steal my car!!!

______________________________

• #9

19

0

0

West MI.

Buick Ownership

1995 Buick Roadmaster

Actually, to bypass the VATS if you're trying to steal a car, you'd just need to rip out the part of the steering column with the vats deal and use a screw driver, or something to that extent, it was explained to me quite a while ago.

• Thread author
• #10

1,241

3

0

Michigan

Buick Ownership

1994 Buick Roadmaster

sweet deal...

Now people know how to steal my car!!!

Oh, like you would even know one was missing anyway!

• #11

4,807

12

0

MI

Buick Ownership

Roadmaster

Actually, to bypass the VATS if you're trying to steal a car, you'd just need to rip out the part of the steering column with the vats deal and use a screw driver, or something to that extent, it was explained to me quite a while ago.

nahh you actually have to have a way to bypass the vats. Ripping the column apart does you no good as long as the Vats is in good working order.

• #12

6,943

7

0

Benton Harbor, MI

Buick Ownership

95 Roadmaster Sedan (3), 94 & 96 Roadmaster Wagon

Oh, like you would even know one was missing anyway!

LOL, well the Buick is the only one that has Vats... the others should be plenty easy to steal.. and have me not notice for 2-3 weeks...

______________________________

• #13

9

0

0

Buick Ownership

Buick lesabre

Reguarding the picture diagram on how to bypass the VATS. my system looks a tiny bit different. it has the two white wires in the orange case BUT they dont go to that small black connector. they go to a large connector that has a hundred other wires going to it. can a resistor still be wired in? i tried pulling vats fuses but they all control pcm also.

Thank you

• #14

5

0

0

Buick Ownership

Buick

Thanks for this info. I have used it to start a RMW without a key and a 94 LeSabre with a short in the column. Mulvey is totally wrong. Breaking the column and using a screw-driver would only work on a Police issued car because they never program the VATS with a resistor when the car is new.

seth

• #15

6,943

7

0

Benton Harbor, MI

Buick Ownership

95 Roadmaster Sedan (3), 94 & 96 Roadmaster Wagon

I finally checked one of my keys, and came up with 3.0 (k) resistance. Now if only the retards around here knew how to cut a key right...

• #16

6,943

7

0

Benton Harbor, MI

Buick Ownership

95 Roadmaster Sedan (3), 94 & 96 Roadmaster Wagon

bump so a friend outside of the forums can see it.

Guess not. When did that change, where you have to be a member to see threads?

______________________________

Last edited: May 26, 2009

• #17

7

0

1

New York

Buick Ownership

1996 Regal

Not to happy about this system not being a car guy and comfortable ripping apart the steering column I'm going to have either a) pay for the dealer to cut me a second key, I'm probably going to raped on the price or b) buy one the override systems I've seen and pay for a mechanic to install it.

This so far is only drawback I've seen on my new (96) Regal well this and the dynaride. I just got rid of a Town car with dropped air shocks.

• #18

23

0

0

phoenix

Buick Ownership

95 roadmaster

the price to have a key made at a dealer was $50.00 back in 08

• #19

36

0

0

Niles, Mi

Buick Ownership

93 Buick Roadmaster Wagon

sweet deal...

Now people know how to steal my car!!!

I'll be there to get it tonight!

• #20

6,943

7

0

Benton Harbor, MI

Buick Ownership

95 Roadmaster Sedan (3), 94 & 96 Roadmaster Wagon

• Forums
• Past Buick Vehicle Discussion
• Buick Roadmaster Forum

How to Install Vats Bypass Module 94 Buick Park Avenue

Source: https://buickforums.com/forums/threads/understanding-diagnosing-the-pass-key-system.5804/

Share this post