Tech Feature: Gaining Access to Perimeter Anti-Theft Systems – UnderhoodService

Tech Feature: Gaining Access to Perimeter Anti-Theft Systems

It could use the same acronym, but is perimeter anti-theft the same as PATS? No, PATS, which stands for passive anti-theft systems, is a system that is designed to identify the key, and was discussed in the July 2007 issue of Underhood Service. Perimeter anti-theft is a system designed to identify unauthorized vehicle entry. There are two main types of these systems from Ford — a dealer-installed version and a factory-installed version. We’ll just discuss the factory-installed version.

The factory perimeter anti-theft is an extension of the remote keyless entry system. Depending on the year and model of the vehicle, the remote keyless entry system may be controlled by a dedicated Remote Anti-theft Personality module (RAP), a Body Security Module (BSM)/Central Security Module (CSM) or a Vehicle Security Module (VSM).

RAP System
The RAP module is the older method of keyless entry and perimeter anti-theft, spanning a time line of the late ’90s to early 2000s. Let’s discuss the RAP module system first to gain a general system understanding to build upon for the others.

On Expeditions and F-Series, the RAP module can be seen under the driver’s side of the dash against the firewall. Usually, the part number tag of the RAP module will also contain the five-digit code for the key pad on the door.

In Photo 1, you can see the factory door pad code is 75335 for this vehicle. The wiring harness for the RAP contains an antenna to receive the RF signal from the key fobs. The codes for the fobs are stored in the RAP module.

The RAP module’s inputs are the brake light switch, key fobs, door ajar output from the GEM module, door disarm switches, hood ajar switch (model dependent), transmission range sensor (reverse input), antenna and key cylinder tamper switch (model dependent). Its outputs are the driver’s priority unlock relay, the all-unlock relay, the all-lock relay, lighted entry request to the GEM, park light relay, headlight relay (low beam), starter interrupt (model dependent) and the horn relay.

The GEM module is providing the RAP module with a door ajar signal, but the hood switch is hard wired to the RAP module only. The RAP module doesn’t “know” which door has been opened, only that one of them has been opened. It can identify the hood opening separately, though.

The exact abilities of a RAP module depend on the year and model that it is in. Not all can prevent the vehicle from starting and some do not monitor the hood or an ignition tamper switch. Using a ’97 Explorer as an example of normal operation, when all of the doors are closed the system will arm if the doors are locked in any of three methods:


  • Press the “lock” button on a key fob;



  • Pressing the power lock button on the door, then closing the door; or



  • Pressing the 7/8 button and the 9/0 button on the door key pad simultaneously.


    After about 30 seconds, the system will arm and the theft light will then start flashing in about two-second intervals. The system will arm with the hood open, but the hood switch will not trigger an alarm event until it is cycled (closed then opened again).

The system will disarm when:



  • The “unlock” button is pressed on the key fob;



  • The five-digit unlock code is punched into the door key pad;



  • A key is used to unlock a door, which throws a switch inside the lock cylinder that grounds the disarm input to the module; or



  • The key is turned to the “on” or “accessory” position.

The alarm and starter interrupt will activate if either a door or hood is opened, or the ignition cylinder is removed (like when someone slam-pulls the cylinder with a slide hammer). Of course, pressing the “panic” button on the key fob does count as an alarm event, but that doesn’t cause a starter interrupt.


The transmission range sensor’s reverse input and brake input are used by the RAP module for the auto-lock feature. For auto-lock, the module wants to see the key in the on position, the transmission shifted into then out of reverse, then the brake pedal being released after the transmission is taken out of reverse. The auto-lock feature can be turned on or off using either the door key pad or the power door lock buttons. The instructions should be in either the customer’s owner’s manual or in your service information source. The RAP module operates the lock and unlock relays by grounding them. The lock/unlock relays are sometimes located in the harness in their own connectors, and sometimes they are located in the fuse/relay panel.

The CSM and BSM are essentially the same when compared to each other. The BSM is a slightly newer version of a CSM. For an example, you’ll find the security module on an early build 2002 Explorer to be labeled as a CSM, and the security module on a late-build 2002 Explorer as a BSM. The CSM/BSM is a replacement for the RAP module system. This system is a little bit smarter than the RAP and it reverses the roles a little bit when it comes to the GEM’s involvement.

To understand how this newer system works, consider the RAP system’s operation first, take away the ignition cylinder tamper switch, and now we’ll build on that. With a CSM/BSM system, the security module is now monitoring all door-ajar switches directly with hard wiring straight to the security module. The module has separate circuits for each door-ajar switch so it does “know” which door has been opened. No, it doesn’t sound a different alarm for each door, but this added feature does benefit us techs. Since each door has its own input, it also has its own PID.

Also, the module keeps a record of the last eight alarm events. This can be very helpful in tracking an intermittent fault. For example, look at this data capture taken from an Explorer with a complaint of a false alarm activation. The problem was intermittent, and wouldn’t ya know it, it wasn’t acting up when I got the vehicle. But, a quick scan of the door-ajar PIDs and alarm-event PIDs clued me in where to look.

The driver’s door is showing ajar because I do have the driver’s door open at this moment. What gave it away was, not the door-ajar PIDs, but rather the PIDs labeled AL_EVT1 through AL_EVT8. Those PIDs show the reason for the last eight alarm events. One time out of the last eight was because someone pressed the “panic” button on a key fob, but the other seven were all because the passenger door-ajar circuit was tripped. What do you think? Bad switch in the passenger door? Looks like it on the scanner doesn’t it? Most of the time, that would probably be the case. This particular time it was because the vehicle had been in a wreck involving that door. Wiring had been damaged in the wreck, but missed in the body shop. The wire was bare and would ground out intermittently, which would trip the alarm.

Unlike the RAP, the CSM/BSM now also knows how fast the vehicle is traveling. This is used for the auto-lock feature. Rather than just locking the doors because someone released the brake pedal after coming out of reverse, like the RAP did, the CSM/BSM looks for a vehicle speed of over 3 mph. The vehicle speed may be shared to the security module over the UBP network from either the GEM module or the instrument cluster, depending on the model.

This system also adds an “inhibit switch” feature. That is, when the system arms it will ignore the power door “unlock” switch, but “lock” will still function. That prevents someone from being able to operate the switch to gain access using a coat hanger. Of course, that doesn’t prevent them from digging a deeper hole for themselves, should they not have noticed a back door was unlocked and accidentally hit the “lock” side of the switch fumbling around trying to hit the unlock. On these systems, the key-in sense switch is also monitored to provide a smart-lock feature. With smart lock, if the doors are locked with the key in the ignition, the driver’s door will automatically unlock one second after locking. Obviously, that helps prevent the driver from locking the keys in the vehicle. Also with these systems, when you lock the doors, the horn will chirp once if all of the doors are closed. However, if a door is ajar, it will chirp twice. Another notable difference between these security modules and some RAP modules is that the CSM/BSM modules do not command a starter interrupt.

The VSM is the newest version of Ford remote keyless entry and is often referred to as the body control module. Wiring diagrams often call it a BCM, whereas a shop manual will often call it a VSM. The anti-theft features of the VSM are reduced mainly to the key fob’s panic button.

Unlike the older modules, the VSM contains lock and unlock relays internally. When locking the doors with the remote key fob, if all doors are closed, the VSM will flash the parking lights once. If a second press of the lock button occurs within three seconds, it will flash the lights twice and chirp the horn once if all of the doors are closed. If a door is ajar, then the module will not flash the lights on either the first or second lock button push. If the key is on, then no parking light flashes or horn chirp will occur. So if you have a customer complain of the lights not flashing when they lock the doors, but the horn works, then it is likely they have a faulty door-ajar switch. If neither a horn chirps nor the parking lights flash, it is possible that the VSM has a phantom ignition “on” power feed to it.

A new VSM has to be programmed to the specific vehicle’s configuration with a scan tool during replacement of a failed one. The newest VSM also contains the Tire Pressure Monitor System functions.

A VSM that is new from the factory will come shipped with up to six fault codes pre-stored, depending on if it has TPMS in it or not;


  • B2477 (Module Configuration Failure)



  • B2868 (Left Front Tire Pressure Sensor Fault)



  • B2869 (Right Front Tire Pressure Sensor Fault)



  • B2870 (Right Rear Tire Pressure Sensor Fault)



  • B2871 (Left Rear Tire Pressure Sensor Fault)



  • C2780 (ECU in Manufacturer Sub-state)

These codes are cleared as a proper programming sequence is performed.


Key Fob Programming
Once upon a time, as in mid ’90s and older, the very old Remote Keyless Entry (RKE) systems required a two-pin connector be jumped (behind dash left of center on trucks and in left side of trunk on cars) to program remotes. But now, for most Ford vehicles with RAP/CSM/BSM/VSM systems, simply cycle the ignition switch on and off eight times ending in “on” last. If the module successfully enters program mode, the door locks will cycle. Once that has happened, simply press a lock or unlock button on a remote key fob. The door locks will cycle to confirm that the signal was received and now added. Press the lock or unlock button on any other key fobs that the customer has to add them. You must do all key fobs at that same programming event. If not, any key fobs that were once programmed, will now be erased from the module’s memory and will have to be added again. To exit the programming mode, just turn off the ignition key. The Focus is a bit odd, it requires only four cycles instead of eight, and a few years of Focuses also require the driver’s seat belt be latched. Otherwise, the rest is the same procedure.

Let’s Fix Something
OK, out of the classroom and into the shop. The problem vehicle this time is a 1997 four-door Explorer. The complaint is that the horn starts honking and lights start flashing all by themselves. It is a false alarm event. Pulling fault codes from all modules finds a B1450 (wiper/washer switch circuit) in the GEM module and a B1522 (hood switch circuit failure) in the RAP module.

The wiper/wash function works normally and is not related to the problem so it is pushed aside for now. The B1522 in the RAP is pointing straight at our problem area.

Checking the alarm event PIDs indicates that every time the alarm sounded, it was because of the hood ajar circuit.

  Going straight for the hood switch PID shows the PID indicating that the hood is closed. The only problem with that, is that the hood is actually open at this moment. The PID is showing closed at all times, whether the hood is open or closed. Will a closed hood trip the alarm? No. But the alarm event PIDs all agree that the problem is with the hood switch circuit, so we need to get to the bottom of this, even though it doesn’t seem to make sense for a false setting alarm condition. Hence, the importance in viewing the alarm event PIDs.

  A quick visual of the hood switch doesn’t reveal a problem. (See Photo 2 above.)

Looking at the wiring diagram shows that the RAP module sends 5 volts to the switch. The switch completes a patch to ground when the hood is opened. So, the thing to do next is test the circuit with a voltmeter. We find an acceptable voltage supply from the module to the switch at a reading of 4.43 volts when the switch is pressed (hood down), which breaks the ground. (See Photo 3.)

That is normal because remember, this is ground-side switching. If the circuit to ground is open, then the supply voltage will be measured on the supply side of the switch. This would be a “hood closed” reading as the module would see it.

  Now, when we release the switch (hood open), the ground path will be completed and the voltage should be pulled low. After releasing the switch, the voltage does drop. It now reads 12.7 mV. You may have to look close in the photo, I know it blurred a little, but that is a millivolt indication. (See Photo 4.) You can also see the bar graph is much lower on my meter when the switch is released, for more clarification.

So this tells us that the switch and wiring are good. This also tells us that the 5-volt reference output of the module is good. While making this measurement, the hood-ajar data PID was also being viewed off to the side. The PID never changed during this test. The PID stayed at “closed.” This proves that the module is at fault and it even goes so far as to suggest a little about what it is in the module that is at fault. We know it’s not the 5-volt reference part, so it may be a logic side problem. A logic side problem is the same as saying that the module is making a bad decision. It is making a bad decision about the hood’s position when it is up, that much is known for sure. Factoring in the alarm event PIDs says this thing is making a bad decision about the hood when it is down sometimes too. At any rate, it will require a new module. This RAP module is located behind the left cargo trim panel and is fairly easily accessed through a removable panel. (See Photo 5.)

Replacing the RAP module fixed this vehicle. The RAP module was “plug and play” in the sense that it didn’t need to be programmed to the vehicle with a scan tool. Naturally, the remote key fobs had to be programmed to it by cycling them in with the ignition switch.

I hope you’ve enjoyed the information and have the opportunity to benefit from it soon.

You May Also Like

Beyond the Warranty

What does it take to keep a car going for 120,000, 180,000 or 250,000 miles? The key is maintenance and inspection. 

Step up maintenance to go farther

What happens after the bumper-to-bumper warranty and powertrain warranty wear out? If you look at any factory-recommended service intervals, after 100,000 miles they cease to exist.

What does it take to keep a car going for 120,000, 180,000 or 250,000 miles? The key is maintenance and inspection. 

ECM Damage

Engineers have devised two strategies that can be called the “immune system” for the electrical system.

Voltage Drop Testing

The measurement of voltage is like the speed of the traffic.

Spark Plug Fouling

Understanding why spark plugs get dirty.

Understanding Stop/Start Charging and Starting Systems

The problem may not have been caused by a complicated reason, something simple may have caused the system not to work.

Other Posts
Power Window Regulator and Motor Service

Power windows are great as long as they roll up and down when commanded to do so.

Power Window Regulator Replacement

Blindly replacing a window regulator and motor assembly may not solve a customer’s problem.

Freeze Frame Diagnostics

Freeze frame data is a “snap shot” of when the code occurs of the specific sensor PIDs.

Understanding Engine Misfire Codes

When the fuel/air mixture ignites, many factors must be met to pass a misfire monitor.