Overridin/fixing the PATS in my 2004

[RonD]

@Dirtman - I have 3 Ford keys and a key fob. the key fob buttons all work and operate the locks and the panic alarm. The tilt slam method was from a post on explorerforum.com from people having the same issues. There are others too, I've tried them all.
From a lot of digging it seems that PATS interrupts the ground to both the fuel injection and the starter solenoid. To defeat the PATS I'm wondering if I should attempt to jump the relays or to go straight to the PCM connections. What do you think?

@adsm08 you don't know ... and your hostility doesn't make you seem more clever. you imagine yourself as an attack helicopter? if you knew anything resembling an answer...but no. just a troll. and just because you're a fanboy of ford pats doesn't mean that every time I replace a battery I should have to go to Ford to reset the pats.

PATS(passive anti-theft system) is software inside the computer(PCM) so no outside component(relays, ect...) can bypass it
You can get the starter motor working, and even the fuel pump, but the fuel injectors can NOT be made to work without the computer timing them, so.........can NOT be bypassed

You may be able to reset it by unhooking the battery again for 5 minutes then hooking it back up
PATS will go into Lockdown mode after 5 or 6 "failed attemps" to start the engine, assumes a Theft is being attempted
So you have to wait 30minutes or so for it to reset, not sure on the wait time

If you let the PATS light flash for 60 seconds or so it should start to flash a 2 digit code number
1:3 Key code not received. Try different key: if okay then first key is faulty.
1:4 Partial code only received. Try again. If not okay use different key.
1:5 Key not programmed into PATS. get locksmith or Ford to Program key
1:6 Faulty link between PATS module and EECV Go to dealer .

In 2004 Ford also changed Ranger instrument clusters to HEC type
You can get PATS code from that as well

have a look here: http://www.carlogic.org/bg/data/Ford HEC dealer mode.pdf



adsm08 is no troll, he has good info, sorry if you think he was in any way 'attacking you', thats not his style and it simply is not tolerated at our site
He was simply saying from your description of the problem your knowledge of this system was limited, so you would be better off having a knowledgeable tech look at it, vs spending more time(and money) on non-fixes

 

[decipha]

is it not as simple as plugging in and disabling theft in the ecu programming itself? I've never not been able to permanently disable theft at my choosing. If anyone is in a bind and wants to find out shoot me a msg.

 

[RonD]

is it not as simple as plugging in and disabling theft in the ecu programming itself? I've never not been able to permanently disable theft at my choosing. If anyone is in a bind and wants to find out shoot me a msg.

Not quite understanding
Google: PATS delete tune
Yes, if you reprogram the Engine Computer you can remove any passive anti-theft system, if you have the software to do it at that time.

But how would that help someone "by-pass" the anti-theft system that doesn't have access to the engine computer's software?

 

[Dirtman]

I'm not an expert on ecu programming but I dont even know of any high dollar scanner available to the public that could do that and I'm talking 5,000 plus dollar units.

 

[adsm08]

is it not as simple as plugging in and disabling theft in the ecu programming itself? I've never not been able to permanently disable theft at my choosing. If anyone is in a bind and wants to find out shoot me a msg.

You can have custom tunes written to disable the PATS system, and load them onto the computer, yes, but that costs money, and failures are rare enough that most people don't bother because you never make your money back on it. But you didn't ask about software changes, you asked specifically about a physical workaround, asking specifically about cutting wires to the PCM or jumpering relays.

BTW, if you cut the wires to the PCM that pertain directly to the PATS system, nothing would work, because those are the CAN bus wires, and you'd take out 90% of your vehicles module to module computer network. I just realized that nobody ever answered that question for you.

With Ford's software there is no way to just go into the parameters, uncheck a box, and suddenly have no PATS. ForScan allows some parameters to be changed manually, such as speedometer calibration or at what pressure the TPMS light comes on (although you have to be good at Hexadecimal to do that correctly) but as far as I have seen even ForScan can't just turn off the PATS software.

 

[decipha]

Apparently you all misunderstood my post.

I am not asking how to I am telling you how to.

If you want to disable theft so you can utilize a remote start as the OP asked you can do so by disabling it in the ecu. This would require you to have access to change it in the ecu which I have. As I stated, "I've never not been able to permanently disable theft at my choosing."

With Ford's software there is no way to just go into the parameters, uncheck a box, and suddenly have no PATS.

yes there is and that is exactly what I do and what I was referring to.

Again, to the OP, if you want to use a remote start on your turck you have to disable PATS. If you cannot find anyone to do it for you give me a shout.

 

[Dirtman]

Good grief.

 

[RonD]

Apparently you all misunderstood my post.

I am not asking how to I am telling you how to.

If you want to disable theft so you can utilize a remote start as the OP asked you can do so by disabling it in the ecu. This would require you to have access to change it in the ecu which I have. As I stated, "I've never not been able to permanently disable theft at my choosing."



yes there is and that is exactly what I do and what I was referring to.

Again, to the OP, if you want to use a remote start on your turck you have to disable PATS. If you cannot find anyone to do it for you give me a shout.

What software are you using?


But in any case for a remote start you can use Ford's "electronic PATS key" remote start kit, its only good for start up, engine will die if you try to move the truck, have to use regular PATS key in ignition to drive away.

Or you can install 3rd party remote start and put a working PATS key under the steering column cowl so PCM reads it when Remote system is activated.
Steering wheel would still be locked, and you could install brake light kill switch in case someone tried to take off in it.
You would need to get Non-PATS keys made, they are cheap, for driving since having TWO PATS keys at the key slot would cause an error in PCM.
And the working PATS key would work for startup either way

But as said, there is no "by-pass" for PATS, delete it or work with it are the two options

 

[decipha]

I write the custom tuning software support for TunerPro

Custom Code Tuning / EFIDynoTuning

 

[pjtoledo]

we had remote start installed on the 2000 last year. uses something called Blade-AL. it "bypasses the factory immobilizer" and doesn't use a key near the column. we still have tp put a security key in the ignition to drive it.

www.idatalink.com

 

[adsm08]

."



yes there is and that is exactly what I do and what I was referring to.

Ok, yes, with tuning software it can be done. I am saying that the IDS cannot do it.

 

[RonD]

we had remote start installed on the 2000 last year. uses something called Blade-AL. it "bypasses the factory immobilizer" and doesn't use a key near the column. we still have to put a security key in the ignition to drive it.

www.idatalink.com

Actually it doesn't "by-pass" it, but reads better than "clones immobilizer transponders"

You need a working PATS key to install these, there are others as well, and the Ford software loaded in the "module"
It, in essence, "clones/learns" the PATS key number when you cycle the key on and off during programming, it then stores it in memory to use for remote starts.
So when you activate remote start the computer "thinks" correct PATS key is in ignition, so not a by-pass, it uses your PATS key number to start the engine, and it will stop the engine if you try to drive the vehicle, like most remote start setups do, so to drive it you would need working key in the ignition to move
And yes no key under the cowl, lol, which is the cheap version and also not a by-pass

Ford Remote starts use the same electronic key setup but you have to program the new electronic key's number into computers memory
Which requires TWO working PATS keys

 

[Pontisteve]

Decipha is right. We do PATS delete tunes all the time. But I have to say, some Rangers have been problematic. We turn off the PATS switch, and the PATS system doesn't always get disabled. It's a known issue, and I'm not 100% sure on the cause of it but I would guess that the tuning software guys might not have found every bit that needs to be disabled in the tune.

 

[RonD]

Did some more reading on PATS, and 2004 and up Rangers have PATS in the HEC dash, not the PCM(engine computer) as before

The HEC(hybrid electronic cluster) is hooked to the transceiver(ring) and it reads the PATS key number, it compares that number to key numbers in it's memory.
If PATS key is OK it then sends encrypted message to PCM that basically says "OK to start"

If PATS key is not OK then HEC flashes THEFT light and never sends the message to PCM so No Start

 

[Pontisteve]

That's pretty much correct. In older vehicles, they had a separate PATS module. But in newer vehicles, they just build the PATS module into the instrument cluster, since the cluster is already in serial communication with the PCM, and it's within close range of the lock cylinder/transceiver module. This was probably done more as a cost savings technique than anything, although it now means that you can't just swap the instrument cluster in a vehicle for another cluster, because you'll screw up the learned PATS code.

You should think of that arrangement as the PATS module being a completely separate chip or module, that just happens to be housed inside the instrument cluster module (HEC).

In some models, the PATS system is stored inside the PCM itself, meaning that the wires from the transceiver module would go straight to the PCM, and not to the cluster/PATS module. This doesn't really change things, in my opinion.

When we shut PATS off in the tune, we are essentially telling the PCM that the truck is not equipped with PATS. Therefore, don't bother to seek permission from the PATS module to enable the fuel injectors to work. After all, it's ultimately the PCM that fires the injectors, not PATS. So the PCM doesn't truly need a cluster or a PATS module to give it permission, if it's told that PATS does not exist.

Side note: Some Rangers might also disable the starter relay if there is a PATS problem. If your PATS module or instrument cluster has a wire going to the negative side of the starter relay's control coil, then you might have to cut that wire and ground it in order for the starter relay to work, even if PATS is shut off.

When we do disable the PATS system in the PCM calibration, that changes how the computer works, but doesn't change how the PATS module works (wherever it lives). The PATS module will still try to communicate with the PCM and, once deleted, the PCM will quit talking to the PATS module. This will piss off the PATS module, and if it wasn't blinking rapidly before, it will be now... for about the first minute after you start the truck. But who cares? The PATS module only has two jobs... blink the theft light, and send permission to the PCM to start. Once we don't need it's permission, then it's only job left is to blink a light. If the light bothers you, you can always pull the bulb or unplug the PATS module (if it's not part of the cluster).