Disable PassKey-II on Cadillac Fleetwood

I was recently introduced to a 94-96 Cadillac Fleetwood, which had a VATS fault which was aggravating the owner. The owner previously tried permanently installing resistors under the dash to allow the VATS system to read a correct resistance value, but for some reason that fix was no longer the cure.These are the steps taken the effectively neutralize the VATS/Passkey system on a 1995 Cadillac Fleetwood that was built in 08/1994 but had a 1995 VIN, and OBD-I. 1995 was the changeover year for the Fleetwood (D-body) to go from OBD-I to OBD-II, so depending on when the car was constructed, it may be of either type.

1) Use C.A.T.S. Flash to download the firmware from the car, twice to assure a proper read.
2) Disable VATS functionality from the car firmware.
3) Upload the firmware to the car.
4) Download the firmware from the car again to verify that the VATS function is disabled.

At this point in the process, the Powertrain Control Module (PCM) no longer monitors or acts on the signals from the Central Control Module (CCM) regarding fuel pump enable. Fuel Pump Enable is a "modulated signal wire", so tying the line to +5V or logic ground will not enable the pump. The service manual contains a simulated oscilloscope trace of a 50% duty cycle square wave. I did not take the time to verify the signal since it was outside of the scope of work (narrowly defined as "Bypass this b**** so I can get to work, homie!").

A core feature of the 1994/1995 LT1 corporate motor implementation present in the Chevy Camaro, Caprice, Impala SS, Buick Roadmaster, and Cadillac Fleetwood is that the fuel pump, injectors, and ignition coil are all under the control of the PCM, while the starter motor is controlled by the ignition switch alone. This means that it is possible to continue cranking the engine until the point of battery failure while the PCM has withheld spark, fuel, or both. Diagnostics of the system approaches ritualistic.

1) When the ignition switch is turned to ON, the fuel pump should run for a few seconds. Even if the fuel pump is weak, this is a good sign that fuel is present in the fuel rail and the PCM has an intent to start so far.
2) Battery voltage should remain above 8 V while cranking.
3) The PCM supplies both fuel (via injectors) and spark.
4) The spark plug gap is 0.050", and the ignition coil can deliver a healthy spark into almost anything -- including you. Use caution in verifying that sparks are being generated. A spare plug wire can connect to the top of the ignition coil and be held above ground to bypass the Optispark distributor.
5) Immediately after a cranking attempt without the engine firing, the odor of gasoline should be notable from the exhaust. Please remember not to smoke in an explosive environment such as unburned exhaust fumes.

The Cadillac Fleetwood further confounds this process because of two additional modules present in few cars. One of those modules is the Theft Deterrent Module (TDM), which receives key fob commands and responds, as well as controlling the horn and lights to create the panic alarm. This module is occasionally found in Buick Roadmasters and Chevy Impalas. Despite the name, the TDM has little to do with actually inhibiting the starting of the vehicle. The other module is the Central Control Module (CCM), which implements most of the functionality present in the Fleetwood's environmental, entertainment, and other systems present only in that car and not shared with many other cars of the model year. The CCM implements the actual checking of the PassKey-II resistor, and controls the Theft Deterrent Relay (TDR).

The Theft Deterrent Relay (TDR) is located on the cabin side of the firewall directly in front of the passenger seat under the dash. Gymnastics may be required to reach this area, so the TDR was left in factory configuration. The TDR is effectively in series with the starter solenoid, but only receives power when the ignition switch is set to START. The control wire for the TDR is Yellow/Black in the 1995 model year, and this wire color is present in the trunk at the CCM.

The Central Control Module (CCM) mounts vertically behind the middle of the backseat and has two connectors along the driver's side: C1 (upper), and C2 (lower). The wire that controls the TDR connects to position D13 of C2. D13 appears to be on the bottom of the connector, if the clamp is located on the top of the connector. The following should be observed as a guide:

D13: Yellow-Black
D14: Light Green
D16: Dark Green-White

Wire D13 can be cut and spliced to a wire connecting to a nearby bolt or self-tapping metal screw and star washer to the body of the car, which completes the ground circuit. This disables what little control the PassKey-II System has to prevent the car from cranking. It is worth noting that the PCM has most of the control of the cranking process, and if the TDR were bypassed (such as holding the starter solenoid down with a screwdriver), the car would likely start. A simple way to test if this change worked is to disconnect the CCM entirely, and attempt to start the car. If the starter solenoid or motor engages, the fix is effective. Then the CCM can be reconnected and the interior reinstalled in the trunk. 


About this Entry

This page contains a single entry by Kris Kirby published on September 12, 2016 12:29 PM.

Steel Wire Instead was the previous entry in this blog.

UPS Battery Management is the next entry in this blog.

Find recent content on the main index or look in the archives to find all content.