Security Issues

by | Apr 2010 | 0 comments



Houston, we have a problem: A 2003 Chevy Venture that does not always start. It doesn’t even crank. I know what you’re thinking, “In the old days . . .” In the old days you also got five to 10 mpg with any car that had brisk performance. Electronics have changed everything.

ignition-module
Very often, the first part that gets replaced is the Passkey III module, even if it is not the problem. This sends the ignition key confirmation signal through the Class 2 serial data line to the IPC and the PCM.

Most of you already know the tests you are going to perform for a no-crank situation. Some of them are obvious. Do you have proper battery voltage? Do the dash lights come on with the ignition key? Do you have juice on the large cable down at the starter? These are the basics.

From there it get’s slightly more interesting. Do you have battery voltage out of the starter contact of the ignition switch? Is it a manual or automatic transmission? Does the voltage for the S terminal of the starter pass through a clutch switch or a park/neutral switch? And our personal favorite, “Did anyone install an alarm system 10 years ago about which we can have no idea of how it was wired, or if the company is even still in business anymore?” Barring any outside influences, we’ll just say this is a straightforward nopcrank situation. Also, each of the tests just mentioned still have to be performed, but the problems will start when you look at the wiring diagram. This particular vehicle has the Passkey III immobilizer system. So, if anyone wants to start a six-year-old minivan, they’re going to have to get past Passkey III first, even if it’s the vehicle’s owner!

First Things First

Before you can start your diagnostic procedure, there is one important factor that you cannot overlook. You need to know how the system works. If you do not, you will perform certain tests and probably come up with more questions than answers. This is why training and studying are so important. New systems and new technology are coming out all the time. We need to keep up to speed with what is happening, even on six-year-old vehicles.

U1096
You need to know where the anti-theft control unit is and if it is communicating with the rest of the car. In this case, it’s in the IPC, and we have a code for lost communication with the IPC. You should start here.

So, how does the Passkey III system work? This is a true transponder type immobilizer system. In previous years, GM used several different types. Older systems have a resistor pellet in the key. This resistance is read by a Passkey/VATS module, and the engine is allowed to crank and run. The next generation uses a pair of Hall-effect sensors in the ignition switch assembly that tell the immobilizer software (within the Instrument Panel Cluster or Passlock module) that it’s okay to start and run the vehicle. This is known as the Passlock system, which was used until about the 2000 model year.

In about 2001, the Passkey III system was introduced. It’s simpler than previous systems. You would think this would make it easier to diagnose — there are only four components. There is the transponder chip in the key, the Passkey III module, the Instrument Panel Cluster (IPC), and the Powertrain Control Module (PCM). The Passkey III module is an antenna and immobilizer module mounted in one unit. It sends out a signal that excites the transponder in the key. It then interprets the transponder signal from the key to determine if it is the correct key. Finally, it sends out the confirmation signal on the Class 2 serial data bus to the IPC and the PCM. This should allow the engine to crank and run.

B1440
A second code tells us the IPC is not powered up properly and therefore will not start Class 2 serial communication with the other control units. Since the PCM does not see an ignition key confirmation signal, it will not allow the engine to crank.

This vehicle is not cranking. Looking at the wiring diagram shows that there is no Park/Neutral switch to test. The ignition switch sends a battery voltage crank signal to a PCM/Crank fuse in the instrument panel fuse box. The voltage signal passes through the fuse into the PCM. If the PCM wants the engine to crank, it will ground the starter relay. This energizes the relay and allows battery voltage to the starter “S” terminal. So, the PCM is in total control cranking the vehicle. Why is this? If the PCM does not like one of the inputs, it will not operate the starter relay. The transmission Internal Mode Switch (IMS) tells the PCM that the vehicle is in park or neutral to allow the vehicle to crank. Without the proper signal the vehicle may not crank, so check the IMS. What else can cause a no-crank situation?

The immobilizer system will not only prevent the engine from starting, it can also prevent cranking. A series of inputs to the PCM will let the module know if it is okay to crank and start the vehicle. As mentioned earlier, one of these inputs is the anti-theft signal from the Passkey III module. Without this input, the vehicle will not crank. This immobilizer authorization is also sent to the IPC. The IPC then decides what to do with the Security light. Generally, when the light is on solid there is a fault in the system and the start is being blocked.

ignition-data
If you can scan the IPC for data, you may see this PID for ignition-on voltage. Here, that IGN 1 voltage is missing with the key in the on position. You now need to look at a wiring diagram.

You should be able to retrieve a DTC to determine where the fault is. You can start your diagnosis from there. If the Security light is blinking, it means the Passkey III module cannot identify the transponder signal from the key and it feels this is an attempted theft. The two different situations may call for slightly different diagnostics. A GM Tech II gives you the best shot at properly diagnosing the vehicle. You can access the PCM and look for anti-theft system codes. These codes are usually in the P16XX range. You can also communicate with the Passkey III module and see if the key is being read. Without a Tech II, it will be difficult to properly diagnose this vehicle, but let’s see what else we can look at.

Outside The Box

Before you give up because you do not have a GM Tech II, or you do and the Passkey module says everything is okay, there are other places you can look to see if you have a problem you can solve. Since all involved control units communicate on the Class 2 serial data line, you need to make sure there is communication. Any aftermarket scan tool with GM-specific software should tell you which modules are communicating and which are not. See if you can get into the BCM and look for B or U codes. If communicating with the instrument cluster is one of your choices, select that one as well. You should be looking for communication failure codes. These may indicate the Passkey module cannot “talk” to the IPC or PCM to inform them that the proper key has been installed.

IPC-wiring
This wiring diagram shows that the IPC has four power inputs. One is hot all the time, and three pass through the ignition switch. The pink wire (IGN 1) voltage goes to terminal “J” in the IPC connector. You can check the fuse (Courtesy of Alldata Information Systems).

In this case, you’re in luck. One of the codes retrieved in the instrument cluster is a B1440, and in the BCM a U1096 is set. Looking at these code definitions, you see the B1440 “Power Mode Master Input Circuits Mismatch” and U1096 “Lost Communication with Driver Information & Display Control (IPC) systems.” These two codes direct you towards the instrument cluster. The U1096 tells you the BCM could not communicate with the IPC at some point. This is important to your diagnosis. The IPC contains the Passkey III control unit. If the anti-theft control unit/IPC cannot communicate with the rest of the vehicle, the start-authorization signal will never be sent to the PCM. The PCM will then shut down cranking. If you are able to access the IPC with your scan tool, that means the Class 2 serial data line must be up and operational, so it’s probably not a broken wire unless this is an intermittent connection. You now know at some point the IPC was not talking to the BCM.

The other code is the B1440, which tells you one or more of the ignition switch power-on circuits has not made it to the cluster. Class 2 serial communication will not start if the IPC detects a problem with the ignition power-on circuits. You will need to look at the wiring to determine which wire at the IPC is not powering up. First, accessory power must show up followed by the ignition-on power supply. If the vehicle were being stolen or tampered with, the PCM would not allow the vehicle to crank without the confirmation signal from the IPC. The IPC would not send this signal if it is not powered up properly by the ignition switch.

Here’s the connector at the back of the instrument cluster. Notice the one yellow wire that supplies the accessory-on and the two pink wires that supply the ignition-on power supply to the cluster. If the IPC likes the three power inputs, it starts communication with all the other control units, including the PCM.

You can confirm this quickly with a scan tool capable of getting data from the IPC. Looking at the instrument cluster wiring, you can see that there are two pink wires that feed supply voltage from the ignition switch. These power supply inputs pass through fuses, so that would be the easiest place to access them. You can also remove the cluster and look at the back of the connector for the two pink wires that power up the cluster. In this case, you find out one fuse is blown. It’s the fuse for the ignition switch (IGN 1) power output to the IPC. The fuse blows intermittently, so you have to find out where the short is in the wiring. Once you replace the fuse, the engine should crank, but it may also start and stall. This is another symptom of the Passkey III being in theft mode. You are going to have to correct this theft mode problem before you can consider the vehicle fixed.

You now have to perform the key relearn procedure. This involves attempting to crank the vehicle and leaving the key on for 10 minutes. You will need to shut the key off and repeat the process up to three times for the key to be learned to the Passkey III module. It would be a good idea to connect either a booster pack, or battery charger at a low power setting to prevent the battery from going dead. If you have a Tech II and TIS2000 reprogramming software, you can perform a 10-minute learn procedure.

In Closing

Although it is helpful to have the factory scan tool to quickly check for codes and look at data, you can do just as well by looking at a wiring diagram and having a little knowledge on how the system works. Knowing the Passkey III module is in the IPC and the IPC was not being properly powered up lead us to the correct diagnosis. In the end, we only checked for codes, scanned data and found a blown fuse. Of course, we did have to look for a short and that can be time-consuming. You must admit you typically don’t check the IPC power supply fuses in a no-crank situation. You also might say, “I always start with checking for blown fuses!” but with power distribution boxes being under the hood, under the dash, under the rear seat, and possibly in the trunk that’s a lot of fuses that will need to be checked. With anti-theft systems being what they are, you now have to look a little deeper when it comes to “no-crank/no-start” situations.

by Kerry Jonsson

VW/Audi Immobilizer Configuration, Service and Tips

VW/Audi Immobilizer Configuration, Service and Tips

Is it a GO or a NO-GO?… You Make the Call!Diagnosing and Adapting VW/Audi’s Immobilizer can be Challenging.Get One Step Wrong, and the V-Dub is Dead… Don’t be “That Guy.” VW and Audi introduced their immobilizer system (known as IMMO) in 1995 in the ROW (Rest of...

read more
Diagnosing Nissan No Starts

Diagnosing Nissan No Starts

There needs to be a solid diagnostic plan in place and solid understanding of the systems being tested to quickly and accurately determine the cause of the no start condition. A no start condition is still a fairly common complaint on today’s vehicles. No starts can...

read more

0 Comments

Submit a Comment

Search All ATI Content:

Search by Publish Date

VW/Audi Immobilizer Configuration, Service and Tips

VW/Audi Immobilizer Configuration, Service and Tips

Is it a GO or a NO-GO?… You Make the Call!Diagnosing and Adapting VW/Audi’s Immobilizer can be Challenging.Get One Step Wrong, and the V-Dub is Dead… Don’t be “That Guy.” VW and Audi introduced their immobilizer system (known as IMMO) in 1995 in the ROW (Rest of...

read more
Diagnosing Nissan No Starts

Diagnosing Nissan No Starts

There needs to be a solid diagnostic plan in place and solid understanding of the systems being tested to quickly and accurately determine the cause of the no start condition. A no start condition is still a fairly common complaint on today’s vehicles. No starts can...

read more

0 Comments

Submit a Comment