PDA

View Full Version : VATS Thread



Caleditor
03-19-2014, 01:20 AM
I hope this thread ends all of the misinformation and allows tuners to properly turn off VATS.

I currently have a PCM from a guy that had attempted unsuccessfully had is VATS disabled by 2 other tuners. One of them I would consider a friend in the tuning market of mine. I have worked with this tuner and have NEVER seen an issue on one of his tunes. This tuner offers the same services that we do including the dealer program.

I hope to take this to a new level

And
YES it will be in HEX

I don't have all of the answers, but I hope that we can compile information in this thread

steveo
03-19-2014, 04:28 AM
its all pretty simple, they either give you a flag that's compared and a branch that jumps over the injector disable stuff, and if that doesn't work, you just patch the jump so it always jumps (or doesnt or whatever).. or insert a jump somewhere?

not sure how much more "properly" you can do it?

Caleditor
03-19-2014, 04:38 AM
If that was the case then VATS or PK2, PassLock and PK3 all work the same way. This is not the case.
.

Caleditor
03-19-2014, 04:43 AM
I am going to use a 1998 V6 calibration

I was away from my laptop and was unable continue earlier. I have a document I will share at some point in this that I have created about GM's VATS also. It is not completed yet

From what TT has made public we know these parameters for this VDF




intDevID



txtCalToolParameterName



txtHexAddress



txtCalParameterTitle



txtCalParameterDescription






25-2



KE_VTD_IS_DISABLED



0007C948



VTD Is Disabled



This determines if VTD is disabled on this vehicle application. The value TRUE disables VTD. The value FALSE enables VTD.






25-2



K_VTD_Auto_Learn_Timer



0007C956



VTD Auto Learn Timer



Time allowed for auto learn procedure.






25-2



K_VTD_Auto_Learn_Counter



0007C95E



VTD Auto Learn Counter



# of cycles to complete for auto learn procedure

Caleditor
03-19-2014, 04:46 AM
We know a little bit more than that.


KE_TCS_CAT_TEMP_FOR_NO_BOOST
0007C7F4
Catalyst_Protection_Boost_Shutoff
If Catalyst temperature exceeds this value, then open Boost Solenoid to prevent catalytic converter overheating situation.


KE_SF_PULSES_PER_MILE
0007C93A
Pulses_Per_Mile
The pulses per mile variable is used to calculate the MPH of the car. Adjusting this variable allows you to adjust for tire size variations.


KE_VTD_IS_DISABLED
0007C948
VTD Is Disabled
This determines if VTD is disabled on this vehicle application. The value TRUE disables VTD. The value FALSE enables VTD.


K_VTD_Auto_Learn_Timer
0007C956
VTD Auto Learn Timer
Time allowed for auto learn procedure.


K_VTD_Auto_Learn_Counter
0007C95E
VTD Auto Learn Counter
# of cycles to complete for auto learn procedure


KE_MAX_PRESSURE
0007CCEC
Max_Shift_Pressure
Max allowable force motor pressure used for limiting calculations.

Caleditor
03-19-2014, 04:56 AM
In the orange is the VSS PPM. After that is VATS and the green is a table way before the Max Shift PSI.
My point is we are lacking information

http://i1106.photobucket.com/albums/h361/PCMCalibrator/VATS/11_zps1ecd0088.jpg (http://s1106.photobucket.com/user/PCMCalibrator/media/VATS/11_zps1ecd0088.jpg.html)

Caleditor
03-19-2014, 05:05 AM
These are all 1998 V6 PK2 and not PassLock

YES I ran 0's on the first line
This is 100% OE for a 1998 Riv
http://i1106.photobucket.com/albums/h361/PCMCalibrator/VATS/riv_zps001e6ca4.jpg (http://s1106.photobucket.com/user/PCMCalibrator/media/VATS/riv_zps001e6ca4.jpg.html)

This is 100% OE Olds 88
http://i1106.photobucket.com/albums/h361/PCMCalibrator/VATS/88_zps8d7719d2.jpg (http://s1106.photobucket.com/user/PCMCalibrator/media/VATS/88_zps8d7719d2.jpg.html)

This is 100% OE LeSabre
http://i1106.photobucket.com/albums/h361/PCMCalibrator/VATS/le_zpsf731a0ac.jpg (http://s1106.photobucket.com/user/PCMCalibrator/media/VATS/le_zpsf731a0ac.jpg.html)


This is 100% OE Camaro and the PK2 is different on the F-Body's
http://i1106.photobucket.com/albums/h361/PCMCalibrator/VATS/fb_zps66d3f0c9.jpg (http://s1106.photobucket.com/user/PCMCalibrator/media/VATS/fb_zps66d3f0c9.jpg.html)

Caleditor
03-19-2014, 05:14 AM
This is a PassLock that is also Serial Data instead of Circuit 229 or PWM

This is 100% OE Olds Intrigue with PassLock. The Fuel Enable password is sent over the Class II serial data line
http://i1106.photobucket.com/albums/h361/PCMCalibrator/VATS/PL_zps787f8263.jpg (http://s1106.photobucket.com/user/PCMCalibrator/media/VATS/PL_zps787f8263.jpg.html)

I will post up a 100% OE Grand Prix PassLock that has a 229 PWM fuel enable circuit in the morning

Caleditor
03-19-2014, 05:23 AM
We also know that the RPM enable parameter is at 0007C962. This is at line 00000030 in the other pictures. We also know that we have a timer setting some place. I need to find it in my information. We also know that the LS1/GEN3 512kb PCM's have 20 parameters. All we have between TC, TT, and DHP is 4 paremeters

Caleditor
03-19-2014, 02:33 PM
This is an example of some is the bad information that has been posted in the past.

I have turned off hundreds of PassLock systems on V6 cars. Yes Hundreds. I work at a GM dealership and have been asked to disable a lot of them that come in for repeat PassLock sensors failures. We also have a Buy Here Pay Here (BHPH) department and when they have a failure they won't then turned off and not fixed.

I had a 2003 Impala 3.4L come in (towed in). It was a BHPB vehicle. I was asked to turn off the VATS.

This is how it was from the factory
http://i1106.photobucket.com/albums/h361/PCMCalibrator/VATS/impoe2_zps72d1b07e.jpg (http://s1106.photobucket.com/user/PCMCalibrator/media/VATS/impoe2_zps72d1b07e.jpg.html)

http://i1106.photobucket.com/albums/h361/PCMCalibrator/VATS/impoe_zps4b29ec45.jpg (http://s1106.photobucket.com/user/PCMCalibrator/media/VATS/impoe_zps4b29ec45.jpg.html)


I did what I have done what works for me most of the time.
I left the type on 1 --> set the injector time to 0 --> set the DTC's to X type

The car got towed back in just over 2 months later

I then set the type to 0 and let it go.

The car got towed back in 8 months later. Come to find out the car would not CRANK when the issue was present.

Guess what GM did. Some PassLock vehicles also have PCM controlled starters. This is one of them and when the PassLock sensor fails the PCM will not allow the car to crank.

I set the Type to #2. I have tried 2 in the past, but the vehicles would start and run poorly, maybe on 3 cylinders. That was not the case on this vehicle

Well it has been about 6 months and the car has not returned yet


Just a little more to think about. The VATS Starter Enable is also in that part of the code

EagleMark
03-19-2014, 06:05 PM
We also know that the RPM enable parameter is at 0007C962. This is at line 00000030 in the other pictures. We also know that we have a timer setting some place. I need to find it in my information. We also know that the LS1/GEN3 512kb PCM's have 20 parameters. All we have between TC, TT, and DHP is 4 paremetersThere's a lot of things that have been found and documented in some of our old dissasemblies so I added them to the definition and have never used them. Sometimes it's better to not have them and confuse people or let them make adjustments not needed that cause issues.

All the LT1 of 94-95 era have VATS which disables fuel. Seems most also have a Starter relay tied into VATS, VATS Fail and no crank as well. The 9C1 Police car has VATS but no starter relay!

lionelhutz
03-21-2014, 07:55 AM
You seem to be comparing a lot of different systems, which obviously won't be the same, so I'm not sure what you're tying to find by comparing them.

I'd think all the '98 MY you mentioned but the F-Body have a theft deterrent module controlling the starter interlock (when it exists) as well as the security light and also sending a PWM signal to the PCM. The Intrigue oddly enough has a starter enable output from the PCM that goes to the TDM which then controls the relay. The F-body has a BCM controlling the security light and starter interlock relay with a PWM signal to the PCM. The '98 Corvette is similar but has a serial enable signal instead of the PWM signal. Then, you get into the newer vehicles with the BCM creating a serial VATS signal to the PCM which controls the starter interlock relay. I'm not sure what controls the security light in these systems since it's often run from the serial bus so either the BCM or the PCM could signal it to turn on.

kur4o
03-28-2014, 05:16 PM
The test for properly disabled vats will be to start the engine with bcm disconnected.

From what i found out there is two different Fuel enable signal

Digital signal send over class 2 serial network from bcm to pcm.
Analog Pwm signal send over single wire from bcm or theft modul to pcm.

In the software settings there is switch to tell which system the pcm will use

set to 0 is analog pwm system
set to 1 is class2 serial network system


In class2 serial system it is not only the fuel enable password, every 2 seconds the bcm send message to pcm that is online. if that messge is not recieved the engine will not start even with disabled dtc-s

steveo
03-28-2014, 05:38 PM
The F-body has a BCM controlling the security light and starter interlock relay with a PWM signal to the PCM.

94-95 had a seperate theft deterrant module and a starter enable relay

then in 96-97 they went to a bcm, but the starter enable relay appears to be built into that box (they kept that with LS1 f-bodies afaik)

Caleditor
03-28-2014, 05:39 PM
I have seen a few time that changing the settings to something that has worked in the past --> the car will start and idle, but it runs like crap. Possibly cylinders shut off

Caleditor
03-28-2014, 05:41 PM
look at the light grey bar on the link

http://www.pdqforensics.com/learning.htm

lionelhutz
03-28-2014, 07:54 PM
Yes, Steve, the small part of my reply you quoted came from a paragraph describing the different 98 model year theft systems and the F-body was a BCM with a PWM signal and an output that controls the starter inhibit relay in '98.

Caleditor
03-28-2014, 08:08 PM
All of the RWD vehicles are straight forward. The issue is with the FWD cars.

I feel that all of the VATS should be in one thread

Caleditor
03-28-2014, 08:20 PM
VTD CONFIGURATION

Unitless Number Value

This is used to activate the different VTD functionalities within the PCM.



VTD FAIL ENABLED BYPASS

Switch On or Off

Enables or disables the theft Fail-Enabled mode. Thiscapability is required for export vehicles.



VTD DIAG ENABLED

Switch On or Off

TRUE indicates the diagnostic is enabled and VTD failure is reported via Class 2.



VTD BAD PASSWORD

SHORTCARD

Threshold to compare against the Bad Password Counter during certain decision states.



VTD LEARNED ENOUGH

SHORTCARD

Threshold to compare against the Auto Learn Counter during Auto-Learn state.



VTD LEARNED PASSWORD

SHORTCARD

Threshold to compare against the Identical Password Counter during Learn Password state.



VTD DISABLE TIME

Seconds

Expiration time for the Fuel Disable Timer duringFuel Disable Lockout state.



VTD AUTO LEARN

Seconds_L

Expiration time for the Auto Learn Timer duringAuto-Learn Pending state.



VTD Class 2 INIT

Seconds

Expiration time for the PCM Class 2 Init Timer duringIgnition 1 Off and Powerup Transitions.



VTD Class 2 AUTO LEARN

Seconds_L

Expiration time for the Class 2 Auto Learn Timer duringAuto-Learn and Auto-Learn Pending states.



VTD PWM MAX ALLOWED FREQ

Hertz

Maximum allowable frequency for new vehicle antitheft pulse.



VTD PWM MIN ALLOWED FREQ

Hertz

Minimum allowable frequency for new vehicle antitheft pulse.



VTD PWM CONSEC READS to PASS

SHORTCARD

Number of consecutive good reads of pulse frequency requiredbefore setting VTD PWM Got Correct Frequency = TRUE.



VTD PWM TIME TO FAIL ENABLE

SHORTCARD

Threshold of the number of bad reads of pulse frequency thatare allowed before setting the VTD Fail Enable flag.



VTD PWM LO VOLTS LIMIT

Volts




VTD PWM LO VOLTS ADDTNL TIME

Seconds

Time added to VTD PWM Decision Point Time under low voltage conditions when deciding the fuel disable point.



VTD TIME TO IGNITION OFF

Seconds

The amount of time the ignition is off before the VTD logic performs powerdown state transitions.



VTD FUEL OFF TIME

Seconds

Expiration time for the Fuel Disable Timer during Fuel Disable Lockout state.



VTD PWM SIGNAL SAMPLE PERIOD

SHORTCARD

Lower threshold of valid signal sample period when determining if a correct frequency has been received.



VTD PWM VALID PULSE PERCENT

Percent

Lower threshold of valid pulse percent when determining if a correct frequency has been received.



VTD TIME TO DISABLE POINT

Seconds

Initial expiration time for the VTD PWM Decision Point Timer when deciding the fuel disable point.



VTD Class 2 NOT AN EXPORT VEHICLE

Switch On or Off

Used to turn On/Off the VTD Class 2 auto learning function.





Dirt old 512kb 0411 type VTD parameters from previous thread on disassembly of the code

busta9876
03-12-2015, 08:10 PM
Here is what I have documented with vehicles locally. The first number value is the default CATS value for Vats, the second column is what I changed it to. In ALL applications, the VATS Injector Disable time is set to 0. All these were done with passlock sensors wires cut or disconnected.

I did find on a particular 1998 Chevy Malibu 3.1L, that I was able to find a configuration that would allow engine to run with BCM fuse pulled. However, once BCM was again on the data bus, vehicle would start and die once the security light came back on. I found yet another configuration that allowed the engine to run with BCM plugged in, security failed, or unplugged.




1997
Pontiac
GrandAm
Passlock
1
2


1997
Chevy
Lumina

1
2


1997
Buick
LeSabre

1
2


1997
Pontiac
Bonneville

1
2


1997
Olds88


PK I/II
1
2


1999
Pontiac
Bonneville
PK I/II
1
2


1998
Chevy
Mailbu
Passlock
0
1


1999
Olds
Alero
Passlock
0
1


2000
Pontiac
Montana
PK3
1
0


2000
Pontiac
GrandAm
Passlock
1
0


2001
Pontiac
GrandAm
Passlock
1
0


2003
Pontiac
GrandAm
Passlock
1
0


2004
Pontiac
GrandAm
Passlock
1
0


2004
Olds
Alero
Passlock
1
0










2003
Pontiac
Aztec
Passlock
1
0


2004
Buick
Buick
pk3
1
0










1999
Chevy
Lumina

0
0


2000
Pontiac
GrandPrix
PK3
0
0


2001
Pontiac
GrandPrix
PK3
0
0


2003
Pontiac
GrandPrix
pk3
0
0










2001
Chevy
Impala
Passlock
1
0


2002
Chevy
Impala 3.8
Passlock
1
0


2004
Chevy
Impala 3.8
Passlock
1
0


2005
Chevy
Impala
Passlock
1
0










2002
Chevy/Pontiac
Venture/Montana
PK3
1
0