Sunday, July 14, 2013

Chevy Impala Passlock Bypass

Many people reportedly have this problem with their late 90s to early 2000s GM vehicles.

The problem in a nutshell is that the car wont start, the security telltail will flash. You have to go through the 10 minute reset process, or even the 30 minute reset sometimes. Understandably some people get pretty annoyed when their car does this randomly, or even every time in some cases. Also the security warning may have been coming on while driving.

What is Passlock?

It's a security feature on the ignition barrel where only the correct key will activate the passlock. The passlock normally provides a fixed value of resistance that the BCM (Body Control Module) reads, and if it's with-in range along with some other security checks it does, it'll allow the car to start.

If it's too far out of range it wont start and the security light or telltail will flash. On the Impala's Message Center the display will cycle between blinking “security” twice and the red battery. After waiting 10 mins with the key in the ON position it will cycle between security and battery with out blinking, turn the key to OFF, then back to ON and CRANK and it should start.

So what's the problem?

The contacts in the passlock module become worn, the connectors are not gold plated so corrosion can occur in more humid places, and if you're near the ocean the salt air wont help much either. The worn contacts and/or corrosion changes the resistance the BCM sees and the new value has to be relearned via the 10 minute reset.

I happen to have a 2002 Impala with this problem.. At the time I lived in Fairbanks Alaska where the climate is very dry, my passlock would play up maybe once every couple of months or so and with one reset the problem would be gone until next time. During a trip to Anchorage where there is a lot more humidity, the passlock required a reset every morning, and at least one 30 min reset while we were there.

Finding the solution

Upon searching for answers there are many endless forum threads about it:
  • Bypass the passlock module it self with a fixed value resister.
  • Completely replace the module at a much higher cost.
  • Car alarm systems with/or remote start systems bypass the passlock.
WARNING: Bypassing the passlock also effectively disables this security feature, so just be aware of that. Most of the cars with this system are now 10+ years old, they're probably not at a great risk of being unlawfully “borrowed” as they were when new.

The passlock is connected to the BCM via three wires, yellow, black and white. All you need to do is cut the yellow wire from the BCM to the passlock, and place a fixed value resister (say 2k2 Ω) between the end FROM the BCM and the black wire, the black wire must remain joined. The yellow going TO the passlock is left disconnected. Once the new value is learned, the passlock issue should never return. Simple as that, the hard part is accessing the wires.

If you look hard enough there are some detailed instructions around, like this article for the Pontiac Grand Am. But nothing detailed for the Impala on how to get at the passlock wires. The BCM looks the same as the one shown in on Grand Am linked above. But connectors C2 and C3 are wired quite differently with different colors, and unused pins in different places. My BCM had 4 sets of numbers on it, the one that seems to identify it as an Impala BCM is 10445875, the other numbers didn't turn up much. None of the schematics I found online matched mine.

It's debatable if doing this fix on the BCM end would be any easier since you'd be cutting, stripping, soldering wires in-between two bunches of 24 wire connectors while laying upside down in the drivers side foot well. Removing a couple of extra panels and having easier access to the wires at the ignition end will be much easier, and this way you know you're dealing with the right wires.

For what it's worth I used my multimeter find out where the yellow and black actually goto on the BCM end of the loom. The BLACK wire came out on C3 (the pink connector) pin B12, and the yellow on C2 (the middle grey connector) pin B3. If you're going to do this on the BCM end, be sure you have the right wires, otherwise the magic smoke might leak out of something.

Bypassing the Passlock

This will take a couple of hours from start to finish. You'll need some basic tools, and know how to solder. If you're not into soldering you can use a solderless method such as this.

First disconnect the battery negative terminal!

Tools I used

Remove the drivers side kick panel - this holds the floor light.

Then remove the steering column filler panel as above, remove the two screws at back above the pedals then pull the panel towards the seat, it'll just pop out of the clips that hold it. Carefully remove the plug from the boot/trunk release button - use a small flat screw driver to lift the one green clip which holds it in place and wriggle it out, not the smaller white ones.

This will reveal the aluminum panel that is screwed and bolted with 4 10mm bolts - to get these undone you'll need a socket set and will have to get right down into the foot well upside down.

With all that out of the way you can now easily access the passlock wires where they come out from the back of the ignition barrel.

These are the three yellow, white and black wires that are of a much thinner gauge. Did you disconnect the negative terminal from the battery?

The other cabling to the steering wheel makes for a handy flashlight holder..
  • The yellow wire is easy, just snip it.
  • The black wire you could also just snip and rejoin, but I chose to carefully remove a section of insulation.
  • The 2k2 Ω resister goes between the back wire and the yellow wire FROM the BCM.
  • The yellow TO the passlock module is left disconnected.
  • Now the BCM will always see the fixed value resister we installed.

Resister installation. One end connected to the yellow from the BCM, I put some heat shrink down over it once I had soldered the yellow wire end. The other end of the resister will attach to the black where the insulation is removed.

I slid the heat shrink back up, I didn't bother “shrinking it”. Used the exiting insulation tape and pulled it back down over the solder joins and cable tied it twice to keep it all in place.

Reconnect the battery.

I had to do the 30 minute reset process, the car started on the 3rd attempt.

3 months after doing this mod, I have had no passlock issues!

Note: The wiring to the drivers side ABS/wheel speed sensor is broken, so the ABS and traction control system disables it self - is why the ABS and track off lights are (always) on.. I actually prefer those two nanny features to be off, especially on Alaska's iceroads.

10 and 30 Minute Learn Procedure:
  1. Turn ON the ignition, with the engine OFF.
  2. Attempt to start the engine, then release the key to ON (vehicle will not start).
  3. Observe the SECURITY telltale, after approximately 10 minutes the telltale will turn OFF.
  4. Turn OFF the ignition, and wait 5 seconds, then try and start the car.
  5. If it does not start repeat steps 1 through 4, 2 more times for a total of 3 cycles/30 minutes.
  6. The vehicle is now ready to relearn the Passlock Sensor Data Code and/or passwords on the next ignition switch transition from OFF to CRANK.
  7. IMPORTANT: The vehicle learns the Passlock Sensor Data Code and/or password on the next ignition switch transition from OFF to CRANK. You must turn the ignition OFF before attempting to start the vehicle.
  8. Start the engine. The vehicle has now learned the Passlock Sensor Data Code and/or password.