Hello all. This is my first post so I’ll start by introducing myself. My names levi. I’m an experienced mechanic that specializes in drive by wire on mobility vehicles. hopefully I can share my knowledge and get some in return.

I have have recently acquired a 2000 2wd 3.0 flex fuel single cab ranger on trade. It won’t start. I scanned it and PATS has disabled starting.

I ran the self test for pats on the scanner. It came back with
B1681 - pats transceiver signal not received.

Went through the manual tests and the pats module is not sending power to the tx. Even though it has good fuses. Because of this I believe the PATS module itself is shorted internally and a replacement is needed. (Also want to add I replaced the tx. And I have one original coded key. Someone had cut it off trying to get it started so I installed a new one before trying anything first.)

I called ford however they do not manufacture the PATS module any longer. Out of production.

Is is there a workaround for the pats system. I have done some internet searching and come up empty besides seeing eBay flashes to eliminate it. Is there something that can mimic the can message and bypass it? Please help. I wanna drive this thing.

 

Welcome to the forum

No, no way to by-pass PATS, wouldn't be much of an anti-theft device if there was, lol

Yes, you can have the PATS check deleted from the PCM(engine computer), you would still need to Ground the Starter Relay in the engine bay fuse box, its either the Pink/orange wire or dark blue/orange wire at the PATS module, thats what disables starter motor, but what PATS main anti-theft feature is that it disables fuel system, no pump and no injectors, starter and pump can be "worked around" but no way to get injectors timed and working, lol

You can't "just" change the PATS module in any case, its "married" to the PCM at the factory
If you get another PATS module, used, a Ford Dealer can "marry" it to PCM
Have to have it towed to the dealer for that

Another option is to buy used PATS Module and PCM set from another 2000 3.0l Flex fuel Ranger(must be same transmission type, but 2WD or 4x4 doesn't matter), must come with at least 1 PATS key
Have a NON-PATS key made from one of your current keys, plain metal key, put the PATS key from the used set next to key cylinder and use metal key to start.
Drive to a Locksmith, he can add your current keys to the new module

If you can't get a module/PCM set with a key then a Mobile Locksmith can come out and add your current PATS keys to the new PATS module's memory

Have you try powering the transceiver on its own, just has 12v and ground from module, in 2001 and up there was no PATS module, PCM had PATS inside and transceiver was power by key on fuse not the PCM

2001 PCM won't work in your 2000
1998 Ranger 3.0l flex fuel PCM "might work" in your 2000, no PATS in 1998 PCM, 1998-2000 were pretty much the same as far as electrics



The "marry" part between module and PCM is called RSA encryption, a shared prime number Key, its a simple public encryption system thats very very hard to break.
Each time key is turned on the module reads the PATS key number with transceiver
If number matches one of the programmed key numbers in memory the module generates a random number with a code, it then uses RSA encryption to send that to the PCM, the PCM decrypts the message with the shared(marry) key and if it decodes correctly then PCM starts fuel system
If you were to intercept the encrypted message you could, over time, decode it, but.........................it changes EVERY TIME you turn on the key, so it wouldn't work again, only works that one time

 

Thanks for the info.
The next thing I was going to try and do was deliver 12v power to the transceiver via an ignition powered relay on the two circuits that send power. All I had with me was a power probe and it needed relay and wiring for it to power on at the right time etc. Seeing as how that’s the only function the PATS module is not performing as far as I can tell I really think this might work. Since the fuses aren’t blown and the pats module came back on the self check I would assume other functions are still working.

Im hopeful that this will let the tx. Read the key and boom I’m off to the races.

 

Is it not possible to swap in a 2001 computer without pats and rewire the Tx. To the computer instead of the separate pats module?

seems like ford really screwed the pooch on this pats system and serviceability.

 

2001-2003 PCMs have PATS built in, no separate module, Type E PATS, 1999/2000 had Type B PATS

In 2004 Rangers got Type C PATS, it is part of the HEC, digital instrument cluster

2005 Rangers didn't have PATS at all

2006-2011 Ranger had Type C

Try part number XL2T-19A475-AA
Thats was last part number for the type B PATS module that was made, and is compatible with Rangers and Explorers with type B

 

Hello all. Thanks for all the help. I’ve made some huge progress on the ranger and I think I’m getting close to getting her running.

so after getting the first code back from the self test I left off not having power to the 2nd wire in the Tx ring plug. It’s supposed to have 12v in ignition.

checked at the pats module. And had no power at the plug. Unplugged the pats module and I had 12v at the plug again. So that told me the pats module was shorted internally like I thought. I opened up the case and found a Burnt trace which was the power for the tx ring.

i soldered a wire to the board to jump the burnt trace and stuffed it back in the car. Bing bang I had power at the ring but still same code at self test and no tx signal.

Followed the rest of the Diag process and determined the module was just too shot. Resistance was high during my checks of the other wires.

found a module on eBay from a 2000 explorer. I am hopeful this will solve the issue. But from what I understand I need to “marry” the two which needs to be done at the dealer?

if someone knows what the final steps are after I replace the module,

Burnt trace pats module

Pats module 2000 ranger
assuming everything else is ok at that point, that would be the most help.

 

Yes, the PATS module and the PCM(computer) are a matched set, they are "married" at the factory

Ford dealer can/needs to "remarry" if either unit fails

It won't run of course to has to be towed to a Dealer, but call first to see if they can even do it, or will do it, the software for that is pretty old and they may not want to do it with "used" parts, could be a waste of time if they can't do it, so there may be a minimum charge regardless if it works or not

 

Does anyone know if this function can be performed by a Ford IDS programmer?

 

I don't think so because a Ford Dealer needed to hook their programmer up to Ford Security mainframe, via internet, and the Vehicle, to "marry" the units, this prevented computer hackers from doing a work around for PATS

BUT.......................you may be able to remove PATS from the computer with a Ford programmer, so it doesn't need the PATS module at all

You would need to Ground one wire, pin 1 on PATS module wire harness, pink/orange wire, ground it to firewall ground, it was/is the ground for the starter relay in engine fuse box
If Key passed the PATS test, PATS module would ground that wire

 

I have a subscription to Mitchell and it says to use an ngs dealer scan tool. The old standard before ids. That’s why I was curious. Because if that’s the case I can have my mobile programmer guy swing by the shop and perform these functions.

the only access you need to do this to my knowledge is an ids subscription. Similar to how I access new fca vehicles with gateway via my snap on scan tool.

can anyone verify this?

 

IDS should work with any 1996 Ford and up, EEC-V computers, so should be fine with your 2000
NGS would work with the older EECs(1984?) and up to 2003/4 EECs

But not sure about PATS module "pairing", it wouldn't make sense for Ford to allow that on software any thief could get/steal

Maybe someone else knows?

 

Based on what I’ve read it’s not really a “Marrying” of the two modules.

it’s more like a:
tell pats module get ready for new keys
and

let the ecu know a whole new signal/encrypted coding is coming down the pipe.

then you go through programming the new keys the first time and everything is synced up.

 

Yes, you can add or delete keys but that's not pairing/marrying

PATS and PCM used RSA encryption to "talk" to each other
RSA encryption uses Public and Private keys to encrypt "messages", its very fast and very simple to use but very hard to break in real time, its not for say emails, because any RSA message can be decoded given enough time, but its unbreakable in real time
Many satellite TV and cable companies use RSA encryption for their video streams
If you remember the days of the Pirate satellite TV cards, RSA was never broken/hacked, the cards were, once the cards were secured no more pirate TV

And Each time a message is sent from one to the other, even if its the exact same message, its different bites, so you couldn't "record" an "OK to start" message from module to PCM and use it again

Anyway, Pairing/marrying means each is programed with shared RSA keys needed to decode the others messages and generate their own messages

I didn't think IDS could do that, but maybe so

 

Ok....so at the beginning of this thread I was new and I said that I was gunna get a little info and maybe I could give some at the end.

thanks everyone for the help in explaining the differences in the pats systems. I’m gunna go ahead and clear some stuff up now that I know what’s up because since having this issue I realized that no one really understands this correctly on here and in my searches I did not find much helpful info so I’m gunna lay it out for everyone in future with this problem. So it’s easy.

as of like 2006 ford switched from ngs(Star) scan tool to the now current IDS system scanner. From what I understand all functions from before 2006 (and even some newer models )have been released for your standard scan tool.

that’s right. A normal quality (snap on) bidirectional scan tool will do all secure access functions in the pats module. The only thing it will not do is reprogram vins/mileage in a replacement ecu. You would need a j-box and some real know how to perform Those functions.

after replacing the pats module I was able to not only clear all active keys out of the used module, but I was also able to erase the key access memory and re-initiate the key learn feature.

first try using this procedure and it started right up with the two new ford keys.

that being said. Here are some solids I learned that I would pass to anyone dealing with the same issue.

-I would Definately say having two brand new dealer keys with different chips in them is a must. Depending on vehicle the minimum number of keys required varies.
-Pats modules are not married to the computer in any way. It just needs the access code erased from the main ecu so that when the new module sends the new code it can remember it. So no changing computer and ecu together. Actually it’s harder to find the ecu,pats, and keys together that way and the computer would need to be programmed for vin and mileage.
-pats modules can be accessed at normal shops equipped with a decent scan tool...no need to tow to dealer
-pats modules, clusters, column mounted units can come from any car. They just need to be erased and reset for use with the computer
-the only time dealer is needed is if the ecu is being replaced and even then a quality electronics shop or one with high end Diag equipment and a Jbox can do those functions.
-I’ve added a chart with all the procedures and key lists for anything with pats as a reference.

hope this post helps everyone out and maybe some more people searching like me.

cheers! Now it’s time to go jump this thing!

Pats key type listing and pats initiation procedures

 

Good info

Did you get it working?

Not sure how PATS is much of the theft deterrent if a thief just needs a good scanner to steal a Ford Vehicle

 

Yes it is running now.

it honestly is a pretty secure system.

There is a 10 min delay built in to the scan tool so you have to let the time elapse before you could do anything.

also you would have to have 2 ford keys with you Keyed to the ignition to actually program new ones in and drive off because you have to turn the cylinder too.

it’s safety within reason which makes sense because the way everyone has explained it up until this point it lacks one huge thing.......serviceability. The 10 minute delay to change functions give you reasonable security and adds serviceability.

 

Well you wouldn't need to turn the key just pop the cylinder or ignition switch, and put a Ford key next to the transceiver
I guess the delay is something, but I thought it was longer than 10-20min

I knew you could erase and add keys with just Forscan but thought that was a security issue as well, lol
I truly liked the "marrying/pairing" when there was a separate PATS module, 1999/2000, 2004-2011, sad to hear its not there