PATS, as I See It

[imp]

2004 Explorer, 4.0 SOHC 4X4, lately a "one-key" wonder. Been studying the Ford Wiring Diagrams diligently for a few days now, trying to see deeper into their scheme of disabling the vehicle. Much of this has been hashed & rehashed nearly to death. But I think I spotted something significant. Ya gotta understand electrical schematics......but look at this and see if I'm seeing it wrong:



Above, the only page devoted to the PATS anti-theft wiring. Note the Transceiver, which surrounds the lock cylinder in the steering column, receives it's power from fuse 2.24, and communicates directly with the PCM, no connection to the Security Module, via TX and RX. The PCM in turn acts as a switch in series with the starter relay, the PCM is therefore responsible for turning ON the starter motor, if it receives the "OK" from the Transceiver.

In the next diagram, the rest of the starter relay is shown, including the connection to the PCM. The relay coil receives power from fuse 2.29, which feeds the Neutral/Park Safety Switch, incorporated in the Transmission Range Sensor, thus showing that if the PCM closes the contact shown in it to ground, the relay will pull in, and the starter motor will be energized, and crank the engine.

I can find no other means which would prevent the engine from starting, such as disable of the ignition or injectors; both are fed straightforward with no hocus pocus involved, by the ignition switch, in either START or RUN position. Thus ANY KEY capable of turning the lock cylinder to START and RUN, will enable both ignition and injectors.



I propose that a set of contacts controlled by the ignition switch in the START position which ground the connection at C1017 or C175b, will start the engine.

Whaddaya think? imp

 

[410Fortune]

From those two diagrams it does appear that way yes
The PCM controls the ground side of the starter relay through C175b based on the input from the transceiver

Easy enough to try!

This would only work on the Pats "B" system right?, the 2002-2005 setup?. The earlier PATS "A" disables the injectors.......

 

[boominXplorer]

Won't work, the PATS disables the ground outputs for injectors and coil from the PCM. What your basically describing is jumping the starter but without the proper key in the on position it won't work.

Take the exciter ring off the ignition and stick your 1 key under the dash taped to it. You can now use a $1 key to start the truck.

 

[imp]

From those two diagrams it does appear that way yes
The PCM controls the ground side of the starter relay through C175b based on the input from the transceiver

Easy enough to try!

This would only work on the Pats "B" system right?, the 2002-2005 setup?. The earlier PATS "A" disables the injectors.......

@410Fortune
Thought you might be interested in what I've found, so far. And, could use some added thoughts......Had wife feel fuel pump relay, with good chip key: she felt it click. Inserted non-chip key, she felt it click! Pulled out Starter Relay, DVM across coil terminal connections, had her turn chip key to START position: measured 12 V. Same with non-chip key, 8.6 V!! Should see 0 volts, seemingly, what do you think is going on? Almost afraid to go further.

If @boominXplorer info correct, and it may well be, though I thought only Gen IIs disabled injectors/coil, it's a losing battle, if PCM internally programmed to disable everything. If it is, none of that info exists on the wiring diagrams, which show ONLY starter relay affected by the transceiver.

Taping the good key to the transceiver looks better and better! imp

 

[imp]

@410Fortune No dice! He's right. Did not bother to check whether coil, injectors, or both are disabled; makes no difference at this point. I should have known........

Held good working key up against the "eyebrow" around the lock cylinder, turned lock with non-chip key, no dice either. Think chip key must be closer proximity to transceiver. So THAT'S why they pit that ridge around the keyhole! imp