Passlock I

Do you have the key to understanding?

The point of this article is to introduce Passlock I, examine some of the more difficult aspects
of its operation, and hopefully pique your learning interest. For those of you not familiar,
Passlock I is a GM VTD security system installed to ’95 uplevel J cars, all ‘96-99 J cars and ’96-
98 N cars except the Chevrolet Malibu. Before we get too deep, lets excuse any reader who can
pass the preliminary quiz below. The author was excused the first five times through, but not
because he passed. He was excused because the remedial automotive educational program,
Flat Rate Dealer Grunt 001, was starting up and his regular front row seat was getting cold. The
answers are multiple guess, so do your best.

Prima Donna Test Out

a.k.a – The Ego Ejection Test

1. Define Reverse Rotate Mode Acronym Decoder

(Free of charge for all iATN members)
A. Reverse Rotate mode occurs whenever the shift lever is
in reverse and the back up lamps are on. GM = General Motors
B. The mode during which the customer is backing up. iATN = International
C. Set by the status of the Crank Sense line, the point at Automotive Technicians
which the IPC begins the theft decision process. Network (Duh!)
D. The point at which a Flat Rater discovers the money he
owes outpaces the money he earns. It begins soon after
IPC = Instrument Panel Cluster
joining a GM dealership and trying to deal with the J car = Chevrolet
warranty LTG. Cavalier/Pontiac Sunfire
LTG = Labor Time Guide
2. Passlock I keys have resistive pellets in their PC = Politically Correct – Not at
shanks. all applicable to this article
PCM = Powertrain Control
A. True Module
B. False PFM = What….are you kidding
C. Not quite true and not quite false
D. Depends on which GM dealer parts department you buy
me? You don’t know?
them from. PID = Parameter ID
(Identification)
3. An R-code is a resistor code. VIN = Vehicle Identification
Number
A. An R-code is not a resistance code. VTD = Vehicle Theft Deterrent
B. An R-code is not a resistance code.
C. Despite what the book says, an R-code is not a
resistance code! (Got it yet?)
D. An R-code is the term used to describe both the
combination of voltage drop and timing window.

The answers to the test questions should become clear as you read through the information
presented. If not, well….be prepared to join the author in the remedial class.
Don’t forget to familiarize yourself with the sidebar defining the many acronyms used
throughout the article. The author used his Secret Dealer Decoder Ring he obtained from a
Crackerjack box to decipher the acronyms for you.
The Hierarchy

Lets examine now the chain of command with respect to Passlock operation. The IPC can be
referred to as the General. The leader of the Passlock forces. The IPC oversees and controls most
of the Passlock I functions. The IPC is responsible for communicating with the PCM as well as
decoding the Passlock sensor data and setting the VTD mode. The IPC supplies the Passlock
sensor with a high line (supposedly close to battery voltage, although in practice the high line
can measure anywhere from 10.2 – 12.0 volts), the 5V signal line and a reference low, or ground,
line. The most important decisions are made by the IPC and the IPC is capable of storing DTCs,
both current and history, which can be accessed via the Tech II scan tool.
We could then view the PCM as an intelligence officer. Our spy in the field. The PCM is
responsible for receiving data from, and reporting back to, the IPC. The two components
compare and exchange passwords in order to allow the engine to start. The PCM has sole control
over the continuation of engine fuel pulses based on acceptance and acknowledgement of the
IPC password when sent. Lastly, the Passlock sensor is the foot soldier. Its single responsibility
is to provide the IPC with voltage drop data. It consists of a lock cylinder with an embedded
magnet and a housing containing primarily uncharted electronics. PFM, to the unacquainted. The
primary component of the Passlock I sensor responsible for a large part of the data returned is
referred to as a Linear Hall Effect switch. Think of the Linear Hall Effect switch as a two
position on-off switch.

IPC Passlock Sensor Lock Cylinder PCM

Now that we’ve met the major players, we need to learn how to speak their language.
Blah blah baba boo boo – How to speak Passlock I

Learning to speak Passlock I requires an understanding of the various Passlock I

terminologies. What may at first seem like the new age language Esperanto will soon become as
familiar and as friendly as the 5 o-clock stop work whistle. Ok, we’ll take it slow at first. We
have to; the author still doesn’t get it.

Moding

Pass theft - The correct R-code is received by the IPC, the VTD mode is set, the IPC sends
the PCM a password to continue fuel pulses, and the theft lamp is extinguished after engine
start.
Short Tamper - The correct R-code has not been seen by the IPC within the timing window.
The theft lamp will flash, usually four to five times before remaining on. The IPC will not
allow a start for 4 seconds regardless of whether the correct R-code is received within that
time.
Long Tamper - Long Tamper Mode is achieved when three consecutive short tampers are
seen by the IPC. Long Tamper also occurs when the wrong, or no, R-code is seen by the IPC
during a start attempt. The theft lamp will flash for approximately ten minutes.
Fail Enable - Occurs when the IPC loses the lock cylinder circuit after the correct R-code
has been received. The theft lamp will illuminate and the engine will start on all future
attempts.
Operational Terms
R-code - The term R-code refers to the combination of voltage drop, as determined by the
resistor contained within the passlock cylinder, and the timing window. The voltage drop
must be seen by the IPC at the correct moment (the timing window) during the Reverse
Rotate phase of VTD moding.
Timing Window - The timing window refers to the point at which the Reverse Rotate mode
has been set and the Crank Sense line is being held low. During the Reverse Rotate phase of
the start cycle the IPC must not only see the learned voltage drop but a single square wave on
the Passlock signal line as well, within the period the Crank Sense line was brought low.
Reverse Rotate - The most important feature of the Passlock I system. Reverse Rotate is
initiated by the Crank Sense line at the ignition switch. The IPC then sets Reverse Rotate
mode and watches for a single square wave returning from the lock cylinder as the key is
released. It compares the single square wave to the status of the Crank Sense signal line in
order to set VTD moding.

The term “single square wave” has been underlined for a reason. The wording chosen isn’t an
exact description of what can occur on the Passlock sensor signal line based on the various
modes achievable. The term “change of state” can apply with equal accuracy depending upon
which state the Passlock system finds itself in. Don’t get hung up on semantics. They’ll be your
undoing during diagnosis.

Crank Sense – Sometimes referred to as Cranklow. A signal line sent from the PCM and
changed in state based on the ignition switch position. Crank Sense is used by the PCM to set
Reverse Rotate mode. Crank Sense does not necessarily indicate the engine is cranking. Only
that the ignition switch/lock cylinder has been rotated slightly forward of the “run” position.
Tech II PIDs
PCM to IPC Data List

VTD Acknowledge – Acknowledged/Not Acknowledged. VTD Acknowledge means the

PCM has both accepted and acknowledged the pass theft password sent from the IPC.
VTD Tamper – Active/Inactive. Indicates the current theft mode of the PCM.
Reference Sync – Sync/Not sync. The PCM generates the reference sync PID and sends it to
the IPC. Reference sync means the engine is generating CKP reference pulses. Thus,
whenever the engine is cranking or running, the Reference Sync PID will read “Sync”.

IPC to PCM Data List

VTD Moding – Set/Not set. Indicates whether or not a theft decision has been made.
Caution; “Set” does not necessarily mean that a pass theft decision has been made, only that
a theft decision has been made.
VTD Password – Received/Not Received. An indication the IPC has sent the password to
the PCM. This PID is easily confused, being read from the IPC to PCM Data List. The IPC
can in fact send the password but the PCM needs to acknowledge it in order for the engine to
remain running. Be aware, this PID can read “Received” yet the PCM may not truly have
received the password.
Reverse Rotate – Active/Inactive. Indicates whether Reverse Rotate mode is current.

IPC Data List

VTD Option – Yes/No. Indicates whether the Passlock theft option has been activated within
the IPC.
VTD Data - X counts. A number internal to the IPC indicating the status of the Passlock
theft system (on or off). The VTD Data function is an interpreted representation of the VTD
Password. The software version of PFM.
Cranklow – Active/Inactive. The Crank Sense line as read by the IPC. Indicates only that the
IPC has seen a change of state in the Crank Sense line. Does not necessarily indicate the
engine is cranking.
Understanding the Rocket Science

Life is about to get rough. The introductions are over, it’s time to play ball. Were you paying
attention to what you just read? Good. Then we can move on and examine up close the system in
operation. We’ll take on a pass theft/normal operation condition first then take a quick look at a
few failures. Before we begin, study the schematics below to familiarize yourself with the basic
system configuration.

Passlock I Schematic – Note errors present in current service information

Corrected Schematic - Ignition Switch

In goes the key to the lock cylinder. The ignition key serves one purpose and one purpose only.
To mechanically rotate the lock cylinder. The key does not contain a transponder nor does it
contain a resistive pellet, as do some of the other GM VTD systems. With a twist of the lock
cylinder to the run position three things happen. First, the IPC and PCM are supplied with
switched ignition battery voltage. Provided their grounds are good, they come alive. Second, the
IPC boots up the high line supply voltage and the 5V signal line to the Passlock sensor. Third,
the 1st Linear Hall switch is activated by the position of the lock cylinder magnet. A voltage drop
occurs. There are 10 valid voltage drop ranges. The IPC is capable of learning, and
acknowledging, only one as a current valid drop. Don’t get hung up on the exact voltage drop as
you can neither read nor verify that voltage is what the IPC learned. You can decipher only that a
voltage drop did occur. So long as a short or open does not exist, do not place too much
emphasis on the specific voltage drop. We’ll use the status of the engine (running/not running)
and the status of the theft lamp (on/off/flashing) to determine the current theft state a little later.
Rotating the lock cylinder just slightly forward of the run position allows the Crank Sense line to
change state low. The IPC will report Reverse Rotate mode as “Active” and begin to send a
square wave down the Passlock supply line, which is lowered in voltage by the Passlock sensor
and reflected in the signal line back to the IPC by virtue of PFM. Continued forward rotation
forces the lock cylinder magnet by the 2nd Linear switch which instantly turns off the voltage
drop. The Passlock signal line returns to a 5V state and the IPC discontinues sending the square
wave.
Lets review; Remember, we haven’t set the VTD mode yet. The #1 point to understand is
that the square wave is sent from the IPC only when the status of the Crank Sense line is
low, the voltage drop is present, and the VTD mode has not been set. If any of the
conditions mentioned are not true the IPC will not send the square wave.

Back to the operation…(turn the page!).

 At this point, the lock cylinder/ignition switch has been fully rotated to the start position. The
PCM is reporting to the IPC the status of Reference Sync as “Sync” because the engine is
cranking. The IPC has set Reverse Rotate mode and is ready to make a theft decision. The key is
let go and the lock cylinder is allowed to return to the run position unimpeded causing the 1st
Linear Hall switch to install the voltage drop and then allowing the Crank Sense line to change
state high. It’s important to understand the sequence of events. The timing of those two events
during reverse rotation of the lock cylinder is critical to making a pass theft decision. The Crank
Sense line must change state high 350 mS or less from the time the 1st Linear Switch is turned
back on (the voltage drop appears again) during Reverse Rotate mode. The principle reason
behind the 350 mS Timing Window is to deter theft. The secondary reason is to allow the Crank
Sense line time to change state before the IPC enters a tamper mode. The Crank Sense line
cannot change state at the exact moment the volt drop reappears due to the separate components
in charge of providing each signal. The Crank Sense line is ignition switch based while the
Passlock sensor volt drop is related to lock cylinder/Passlock sensor housing position. Due to
mechanical build conditions, the two signals cannot always be one hundred percent
synchronized. The system designers weren’t stupid. They allowed for a 350 mS window to occur
before the IPC would begin sending the square wave again due to those mechanical conditions
and one variable they could not control; The release rate of the key/lock cylinder by the
customer. The designers allowed for over three tenths of a second to get the lock cylinder back
into the run position from the start position. More than enough time. If at any point during the
reverse rotation of the lock cylinder the IPC sees the square wave reflected in the Passlock signal
line it will not set a pass theft condition. Remember from what you’ve already read, the square
wave is sent only when the volt drop is present, the Crank Sense line has been brought low, and
the VTD mode has not been set.
Now that the lock cylinder has returned to the run position and both the voltage drop and timing
window requirements were met, the IPC will set the VTD mode and send a password to the
PCM. The PCM will compare the password sent to a previously learned password and answer
back to the IPC by acknowledging the IPC password as valid. The IPC will then update the VTD
Acknowledge PID and extinguish the theft lamp while the PCM continues fuel injection. The
engine is now up and running. The PCM, the IPC, and the customer are all happy now, on their
way to whatever destination the customer had in mind.
Lost yet? Confused to the point of insanity? Don’t worry, the author fell asleep two paragraphs
ago. You’re doing much better by getting this far. Stay with us, there’s more fun yet to come.
The scope shots below help illustrate Passlock I operation during a pass theft event. Take time to
study them as they may come in handy if you ever decide to challenge this system during a
repair.

Normal Passlock Event 1 Normal Passlock Event 2

So what goes wrong?

We thought you’d never ask. The Passlock I system is turning out to be quite robust.
Ahh….robust….what does the word really mean? The term robust is P.C. engineer-speak for
“very good”. Definitely the antithesis to saying Flat Rate is very Robust.
Ok, ‘nuff griping about a system protected by the very people who utilize your talents to earn
their living. Back to analyzing a few failed Passlock I cases. Just in case you don’t feel as though
your gray matter has been exercised enough, lets do a few mental pushups. Time for another
quiz. How well did you absorb (adsorb for our friends in Colorado) the material?

Failure Mode Exercise 1

What would happen if the Crank Sense line were to open?

A. The IPC would set a tamper mode and not allow engine start.
B. The IPC would set the VTD mode to pass theft.
C. The vehicle would be farmed off on another technician as soon as
possible to avoid a downside of Flat Rate, very little diagnostic pay.
D. The IPC would not be capable of making a theft decision.

Can you guess which answer the author chose? Answer C, and yes….he was immediately sent
to Grunt 001 detention and forced to write an essay on the benefits of Flat Rate. At completion of
the paper he was awarded the Guiness World Record for shortest compilation of advantages. The
correct answer is D. Do you know why? Without a change in state of the Crank Sense line the
IPC is unable to set Reverse Rotate mode. Without Reverse Rotate mode the IPC is incapable of
making a theft decision. The volt drop/rise/drop would still occur but since Reverse Rotate mode
was not achieved, no theft decision would be made. Get it? Got it? Good!

Theft Lamp On VTD Mode Not Set/No Reverse Rotate

The shots you see above were taken as the lock cylinder was in the start position and the engine
was cranking. The engine would attempt to start then stall soon after. The theft lamp remained on
at all times and never flashed. Removing the column shrouds to gain access to the Passlock
sensor quickly revealed the Wire Fairy had paid a visit. Apparently, she didn’t like the fact the
Crank Sense line was in one piece. She must’ve waved her magic wand or sprinkled some pixie
dust about because the Crank Sense wire was no longer one with the ignition switch. Mental
note; remember to appease the Wire Fairy by leaving a quarter under the pillow at night.
 Failure Mode Exercise 2
The Passlock sensor supply voltage is missing.

A. Technician A says the Passlock sensor will still drop the 5V signal line
when the lock cylinder is rotated to the run position.
B. Technician B says the signal line will remain at 5V since the Passlock
sensor isn’t powered up by the supply line.
C. The Flat Rate GM dealer technician says he’s glad the other guy has to
deal with it.
D. Technician C is smart and punches the straight time clock first. He then
learns out the Passlock I system and ships it.

Without a valid power source, the Passlock sensors’ PFM electronics can’t drop the 5 volts
supplied from the IPC. So…the correct answer would be D…’er C…no…B. Yea, that’s
right…B! Please excuse the author, he’s still thinking like a GM Dealership Flat Rater.
If you should happen to run into a missing, or incorrect, Passlock sensor supply voltage, be sure
to disconnect the Passlock sensor first and measure the supply voltage again. It is possible,
although very unlikely, for the Passlock sensor to short the supply line. The more likely situation
would be the IPC isn’t capable of supplying the required voltage while under the demands of the
Passlock sensor. Be careful here, you can easily be fooled into thinking the Passlock sensor is
pulling down the supply line when in fact the IPC has lost its nerve and cannot continue the
supply voltage under pressure.
 Failure Mode Exercise 3
The VTD mode is set, the theft lamp is on and
not flashing, and the engine won’t start

A. Technician A says the IPC is at fault.

B. Technician B says the IPC is not at fault.
C. The Flat Rate GM dealer technician checks with the LTG to see which component
will pay more for replacement.
D. Technician C says the VTD system needs to be learned.

VTD Mode Set Missing MIL Open IGN 1 Circuit

The pictures above illustrate the conditions present for the no start in question. The theft lamp
was indeed illuminated, the VTD mode was set, and the MIL was missing. The last picture
illustrates why. Although the Tech II would communicate with both the IPC and the PCM, the
PCM wasn’t being supplied with all necessary ignition inputs. Our ever-present Wire Fairy had
visited the ignition 1 circuit. With a liberal application of green pixie dust she was able to open
the circuit between the fuse and the PCM. The PCM was still capable of communication, but it
was incapable of acknowledging VTD password receipt. The point here is to understand the IPC
is capable of setting the VTD mode independent of the PCM. The PCM in required only for
continued fuel injection.
 Failure Mode Exercise 4
The theft lamp is on yet the 2.4 liter engine starts and runs

A. Technician A says the system is in Fail Enable Mode.

B. Technician B says his ASE certification expired and he’s not qualified to repair a
GM VTD system.
C. The Flat Rate GM dealer technician is being starved to death and pulls the theft bulb
out, figuring that since the engine ran anyway it didn’t need a theft lamp.
D. The Tech II owning Independent uses the scan data to quiz the IPC, quickly finding
the PCM to IPC data is asterisked. He concludes the PCM calibration isn’t correct.

VTD Mode Set Asterisked Tech II Data VIN - Tech II

The author has a supply of theft bulbs for those who need them. Answer D is correct, although
answer A might also be correct based on what you read earlier. Sorry, not in this case. Answer A
would be too easy for an iATN reader. What we do wouldn’t be any fun if it were easy, now
would it?
Armed with the most powerful scan tool known to GM repairmen, the Tech II, the Independent
was able to determine the PCM calibration wasn’t what it should be. A quick peek under the
hood confirmed what the Independent already knew.

2.4 Liter Engine Actual VIN

Note the VTD mode was set by the IPC and the password was sent by the IPC to the PCM.
How could the PCM acknowledge receipt of the password if no PCM to IPC communication was
present? It couldn’t. Mixing calibrations will cause all sorts of unintended results. Be aware that
parts swappin’-oak tree using-boneyard praisin’-card carrying backyard Bubbas still exist. Until
the supply is exhausted, they’ll continue to throw parts until they think they’ve resolved the
concern. Never assume anything when dealing with Bubba. He’s the master of deception. He can
fool himself quicker than you can say slam-dunk diagnosis. The vehicle in this case had passed
through three such Bubba shops as a no start before landing on the authors’ doorstep.
Somewhere along the line one of the Bubbas loaded up his 10-gauge boneyard inventory shotgun
and fired a PCM slug at the car. Too bad he missed. We suspect Bubba remains unaware of the
need to correct the calibration once the boneyard unit was installed.
The original concern was rooted in Wire Fairy damage to the harness below the radiator.
Apparently green is her favorite color. Once the Wire Fairy damage had been addressed, the
miscommunication between the IPC and the PCM was uncovered. Most of you probably don’t
know this, but Bubba is an excellent builder. Yes, he builds in problems through lack of
education and a brazen attitude that he can fix anything with four full rubber wrap around tires
and see through windshields. Who needs a Tech II? Certainly not Bubba.
Teaching Passlock I to behave

Replacement of any Passlock I component requires the system be taught. Re-learned, if you
will. Replacing the IPC or the Passlock sensor will cause the system to immediately enter long
tamper mode provided the new Passlock sensors’ voltage drop is not identical to the unit just
removed. Be aware, identical sensor replacement does happen. Long tamper mode is conducive
to completing the learn process. Once long tamper mode expires, the IPC is ready to learn the
volt drop value and send a new password to the PCM. The lock cylinder need only be cycled to
the off/lock position, the IPC and PCM must power down, and a start sequence attempted. Once
the IPC recognizes a valid voltage drop within the timing window, it will record that drop within
memory and attempt to sync up the password between itself and the PCM. Be patient, the theft
lamp may remain illuminated for a period of time with the engine running while the IPC and
PCM complete their secret dealings.
One last point worthy of mention before we solicit comments; You’ll note that your service
information may not jibe with what’s written here. The service information is both wrong and
incomplete.

DTC B1026

The picture above illustrates a DTC not recorded in current service information…yet as you can
see, it does exist. Again, don’t get hung up on semantics or the authority of the available service
information. Use the service information only as a first step to understanding the Passlock I system.
Your next steps will hopefully begin a wonderful journey of discovery. What you uncover throughout
that journey will depend on you.

Never let the learning end.

 JB Chowders Feedback Questionnaire
1. The post I’ve just read proved useful
0 Useless is more like it
0 Very helpful, thank you JB Chowders for letting me fill out this form
0 I’m a GM deelar teknition. I kant reed.
0 I used the paper I printed it out on to clean up after my dog….so I guess it was useful

2. JB Chowders is absolutely the best polling company ever!

0 I broke my pencil and can’t fill in the circle
0 Yes, I smooch backsides for a living!
0 Are you serious?
0 Bwwaaaahaahaahaaaa!!!!!

3. The Tech II is the best GM investment I’ve ever made.

0 Yes sir!
0 Absolutely!
0 The Red Brick is bitter (sic)
0 My name is Bubba and I don’t need no stinkin’ scan tool.

4. I’m ready to attempt a Passlock I repair.

0 Sure, piece-o-cake!
0 No friggin’ way! I’m employed at the GM dealer!
0 Only if my boss says so
0 These surveys are a waste of my time

5. What do you think of Flat Rate?

0 It sucks!!
0 I’m a salaried/hourly manager and I think it’s great
0 It’ll be the death of our trade
0 I work for the LTG group and I think it’s great for technicians even though I’m not
paid Flat Rate.