Can an Explorer be started WITHOUT owners key ?

brian.mcmanus · December 3, 2007

Hello all.

I was the proud owner of a Ford Explorer here in the UK up until last year. It was a lovely 2000 model.

Unfortunately, someone stole it and then set fire to it on a golf course ! The insurance company did pay me for the loss though so all is well there.

HOWEVER, I have since been able to get a look at the police report - in the report, one officer says that "the vehicle is fitted with a Ford key chip immobiliser and its IMPOSSIBLE to hotwire - the thief must have used the key" and because I still have both the key and the spare, the implication was that I "stole" the car myself and this was a fraud. No action was taken though and the case closed.

Now, my question is this - Have Ford done what no other company have ever done - create a car security device which is totally IMPOSSIBLE to defeat ? Or is is possible to steal a Ford Explorer without the owners key ?

Ideally I need some sort of proof which would stand up as evidence in a court. Or examples of where Explorers have been stolen and the circumstances. I dont like being accused of fraud and would like to prove that a Ford Explorer CAN be stolen without using the owners key.

Any help would be greatly appreciated.

brian.mcmanus@hotmail.co.uk

Donner · December 3, 2007

Start here

Nice to hear from you... Start here.

http://www.explorerforum.com/forums/showthread.php?t=199312

gijoecam · December 3, 2007

Assumning it's a stock vehicle, the '00 model year should have been equipped with the PATS system which stands for Passive Anti-Theft System. The short explanation is that the vehicle uses a chip in the key. If the chip is not programmed into the system, the ignition will not run. An unrecognized key with the correct cut can unlock the steering column, and turn the accessories on, and crank the engine, but it will not allow the vehicle to start.

Here's what the factory service manual has to say on it:

SECTION 419-01: Anti-Theft — PATS 2000 Explorer/Mountaineer Workshop Manual

DESCRIPTION AND OPERATION Procedure revision date: 06/17/1999

--------------------------------------------------------------------------------

Anti-Theft—Passive Anti-Theft System (PATS)
The passive anti-theft system (PATS) contains the following components:

theft indicator
encoded ignition key
transceiver module
PATS control module (located behind the passenger side air bag module)
powertrain control module (PCM)
standard corporate protocol (SCP) communication network

The passive anti-theft system (PATS) uses radio frequency identification technology to deter a driveaway theft. Passive means that it does not require any activity from the user. This system is known as SecuriLock® in North America, Safeguard® in the U.K., and PATS in continental Europe. This information can be found in customer literature such as the Owners Guide.

The PATS uses a specially-encoded ignition key. Each encoded ignition key contains a permanently installed electronic device called a transponder. Each transponder contains a unique electronic identification code out of over 72 million billion combinations.

Each encoded ignition key must be programmed into a vehicle's PATS module before it can be used to start the engine. There are special diagnostic repair procedures outlined in this manual that must be performed if the encoded ignition keys need to be replaced.

The encoded key is larger than a traditional ignition key. The key does not require batteries and should last the life of the vehicle.

The transceiver module communicates with the encoded ignition key. This module is located behind the steering column shroud, and contains an antenna connected to a small electronics module. During each vehicle start sequence, the transceiver module reads the encoded ignition key identification code and sends the data to the PATS module.

The control functions are contained in the PATS module. This module performs all of the PATS functions such as receiving the identification code from the encoded ignition key and controlling engine enable. The PATS module initiates the key interrogation sequence when the vehicle ignition switch is turned to RUN or START.

PATS uses the p owertrain control module (PCM) to enable or disable the engine. The PATS module communicates with the PCM over the SCP communication network in order to enable engine operation. The PATS module and the PCM use sophisticated messages in order to prevent a theft. The PATS and the PCM share security data when first installed together, making them a matched pair. After this security data sharing, these modules will not function in other vehicles. The PCM shared security ID is remembered even if the battery is disconnected. The PATS module also stores the vehicle's key identification code, even if the battery is disconnected. There are special diagnostic repair procedures outlined in this workshop manual that may be carried out if either the PATS module or the PCM needs replacement.

All the elements of PATS must be functional before the engine is allowed to start. If any of the components are not working correctly, the vehicle will not start.

PATS uses a visual theft indicator. This indicator will prove out for three seconds when the ignition switch is turned to RUN or START under normal operation. If there is a PATS problem, this indicator will either flash rapidly or glow steadily when the ignition switch is turned to RUN or START. PATS also "blips" the theft indicator every two seconds at ignition OFF to act as a visual theft deterrent.

PATS differs from the perimeter anti-theft system in that PATS enables and disables the engine from starting. If equipped, the perimeter anti-theft system protects the perimeter of the vehicle (doors, hood and trunk) and sounds an alarm.

The PATS is not compatible with aftermarket remote start systems, which allow the vehicle to be started from outside the vehicle. These systems may reduce the vehicle security level, and also may cause no-start issues. Remote start systems must be removed before investigation of PATS-related No Start issues.

The passive vehicle protection system will be activated and will disable the vehicle from starting if there is a:

damaged encoded key.
unprogrammed key.
non-encoded key (key has no electronics).
wiring concern.
transceiver concern.
PCM concern.
module communications network concern.

To get an actual printed copy, have the Ford dealership provide you with a copy of section 419-01 from the service manual. You should also check out the 'Safeguard' section of the owner's manual. (which, of course, was probably in the glove box of the stolen vehicle)

The short version is that, unless you had an aftermarket remote start system installed, or unless the thieves had a previously-programmed key, they did not start the vehicle and drive it away.

If I was a thief, I'd be using a tow truck. Simply back up to it, lift the rear wheels off the ground, and away we go!

CDW6212R · December 3, 2007

... and then they couldn't start it, so they set it on fire. Plausible yes?

Donner · December 3, 2007

Ford Remote start

So, if the vehicle has auto start or remote start, is there a key inside the vehicle?

brian.mcmanus · December 3, 2007

Thanks for the replies so far.

The vehicle was completely standard with no modification to the alarm and n auto start device etc

It was driven only about a mile before they dumped it and set fire to it.

gijoecam · December 3, 2007

Sometimes there is, and sometimes there isn't. It depends on the individual remote-start system that's been installed. Personally I'll never use a system that uses a dummy-key because it can *sometimes* defeat the OEM system. (again, it depends on the system) The high-end CodeAlarm and the OEM Ford systems use a tone generator that uses a sensor ring to emit a signal that's been learned by the system. Once programmed, the tone is only emitted by the tone ring when the remote starter is in use. So, although it does, in fact, bypass the system, it does so in such a way that someone with a dummy-cut key won't be able to use it simultaneously. Make sense?

-Joe

Donner · December 3, 2007

Perfect!

gijoecam said:
Sometimes there is, and sometimes there isn't. It depends on the individual remote-start system that's been installed. Personally I'll never use a system that uses a dummy-key because it can *sometimes* defeat the OEM system. (again, it depends on the system) The high-end CodeAlarm and the OEM Ford systems use a tone generator that uses a sensor ring to emit a signal that's been learned by the system. Once programmed, the tone is only emitted by the tone ring when the remote starter is in use. So, although it does, in fact, bypass the system, it does so in such a way that someone with a dummy-cut key won't be able to use it simultaneously. Make sense?

-Joe

Excellent explanation, thanks! From the owner's explanation, pushing the vehicle a mile is all that would remain an option... It would take a few people to push an Ex. Maybe another car was used to push it, they got fed up and just burned it? He seems to be out of reasons...

blueka · December 3, 2007

In the UK, the explorer doesn't have a key like the rest of the fords, with the chip in it, and it's quite easy to hotwire one if you know what you're doing, apparently you can run a wire from the ignition straight to the starter solenoid and it will start, bypassing the immobiliser.. so i'm told..

Si

Donner · December 3, 2007

Is it typical in the poster's area for cars to be burned like that? We had an area in the Valley where they burned cars, tough place.

sjr033 · December 3, 2007

Also, as a safe guard for remote starts. Well at least the DEI unit that I have. If you push the break after the remote start (like you were trying to put it in gear) WITHOUT the key in the igintion, the truck will turn off.

CDW6212R · December 3, 2007

All remote starters work that way. What I'm wondering is if a non programmed key can be inserted with the vehicle running, and driven.

gijoecam · December 3, 2007

blueka said:
In the UK, the explorer doesn't have a key like the rest of the fords, with the chip in it, and it's quite easy to hotwire one if you know what you're doing, apparently you can run a wire from the ignition straight to the starter solenoid and it will start, bypassing the immobiliser.. so i'm told..

Si

The UK Explorers included the PATS system starting in '98, just like the US models. (at least according to the service manuals) I would consult a Ford dealer for more details, or call corporate to confirm.

And even without PATS, it would be a lot more involved than simply running a wire to the starter solenoid. You still need to power the PCM, injectors, fuel pump relay, fuel pump, coil pack, and a couple other things before it would fire. It's not a one-wire setup.

-Joe

Flandry · December 3, 2007

Sorry to hear your Ex got torched. Around here they dump them in lakes. Was it stripped first?

You pose an interesting question. So I did some looking around and found this thread talking about a bypass device that doesn't need keys. But I couldn't find the actual device anywhere. I also found this device that looks like it might need a key initially, but it's hard to tell. It has a learning computer in it and can be connected easily at the ignition column. So it might be possible to hack it for nefarious purposes.

sparkyXplorer · December 3, 2007

I had a 2000 limited with that chipped key, and I remember making just a standard spare copy so that if I happened to lock the chipped one inside, then atleast I could use the other one to unlock the doors ( didn't know that keyless entry combo at that time)...after the copy was made I wanted to try it out and sure enough it unlocked that doors. Then I got curious and tried it to start the car...it worked! Only did it once cause I was afraid that it might mess it up, so I assume with lockpicking tools, or a universal key you might be able to start it...

rocket 5979 · December 4, 2007

gijoecam said:
And even without PATS, it would be a lot more involved than simply running a wire to the starter solenoid. You still need to power the PCM, injectors, fuel pump relay, fuel pump, coil pack, and a couple other things before it would fire. It's not a one-wire setup.

It is a 3 wire setup actually. Twist 12v hot to your "run" wire which I will not mention what color that is in a Ford. Then just touch the starter solenoid wire (that is already in the ignition switch) to the 12V/run wire bundle till the vehicle starts and then take it back off and leave hanging... Hotwiring a non-PATS car is a piece of cake once a person knows what wires do what. Gladly most people do not.

CDW6212R · December 4, 2007

I won't say Robert, I still recall doing the wiring for my first remote starter. Most thieves skip those hard steps and just break the key cylinder, then everything works like they have a key(minus the PATS issue).

Out of US models seem to have a great many differences, I'd check into that first if it was important.

gijoecam · December 4, 2007

rocket 5979 said:
It is a 3 wire setup actually. Twist 12v hot to your "run" wire which I will not mention what color that is in a Ford. Then just touch the starter solenoid wire (that is already in the ignition switch) to the 12V/run wire bundle till the vehicle starts and then take it back off and leave hanging... Hotwiring a non-PATS car is a piece of cake once a person knows what wires do what. Gladly most people do not.

Duuh... I guess the 'run' wire in the column does switch on all the stuff I mentioned, doesn't it? LOL!! I blame the brain fart....

That's why PATS is so effective. It requires the signal from the key's RFID chip when it's cranking in order to fire. If the PATS doesn't recognize the chip, it doesn't run, and no amount of jumpering or bypassing will change that.

Now, I sppose, if a thief was real crafty and wanted to bypass the system, and knoew exactly where all the connectors were, they *might* be able to access the vehicle, gain access to the necessary connectors, then unplug and bypass the correct parts of the system so that the PCM got a dummy signal from the *fake* PATS system saying it was OK to run. However, that's a lot of IF's and 'maybes'... most thieves will move on to easier prey.

-Joe

rocket 5979 · December 4, 2007

gijoecam said:
Now, I sppose, if a thief was real crafty and wanted to bypass the system, and knoew exactly where all the connectors were, they *might* be able to access the vehicle, gain access to the necessary connectors, then unplug and bypass the correct parts of the system so that the PCM got a dummy signal from the *fake* PATS system saying it was OK to run. However, that's a lot of IF's and 'maybes'... most thieves will move on to easier prey.

-Joe

Yeah, I think they would just move onto easier prey too if all that had to take place.

techieman33 · December 5, 2007

What about something like an x-cal2 can't it disable pats, so if you knew the computer code couldn't you upload a program with pats disabled and start it then?

Can an Explorer be started WITHOUT owners key ?

New Member

Explorer Addict

Village Idiot

Hauls the mail.

Explorer Addict

New Member

Village Idiot

Explorer Addict

Elite Pickler

Explorer Addict

Well-Known Member

Hauls the mail.

Village Idiot

Well-Known Member

Well-Known Member

Resident Gearhead

Hauls the mail.

Village Idiot

Resident Gearhead

Explorer Addict

Explorer Features

Explorer Features

Similar threads