What's the actual roadblock with regards to reading and/or flashing the T87A (and maybe the T93)? What's actually being unlocked when HPT (or others) unlocks them? Is it secured in such a way that it can't be read like the LML ECM, or is it secured such that if the calibration that's being flashed doesn't have a valid signature, it won't accept it?
T87 Swaps
- Thread starter kidturbo
- Start date
I've inquired about that one for ya. On the T93 it's seems to be about GM going to the Global B platform. However I guess HPT has that sorted now also. The whole unlock deal is a big hush hush, with only a few people knowing how to do it. Thus making the most of it. I hear the best source of details is on the HTP forum.
To me, if it talks over a network, it's hackable. Somebody did it first. Kinda like when you type "What's best bass boat for 2023?" in the search bar, and for next two weeks all ya get on FB is ads for fishing boats... Let me ask someone to unlock a couple remotely, then I'll sell ya that info next week for half price... LOL.
Saw this ad today, and gives a bit of insight to unlocking. I'd heard this before, but looks like tuning requires a bench harness. Another think I noted about these T87 units, they actually have 4 CANbus channels in the hardware.
www.edgeproducts.com
Evolution CTS3 for L5P Duramax
All-new Evolution CTS3 for GM L5P Duramax Diesel - Includes ECM and TCM Unlock Tool
Found what looks to be our read/write bit switch location in our bin file. Could be this simple to unlock, once we figure out how to write to the MPU over CANbus or by serial.
/begin DATA_ACCESS
0x000000 /* ECU address type qualifier for Flash page */
0x000000 /* ECU address type qualifier for RAMpage */
1 /* Flag 1: Upload from ECU flash data possible */
0 /* Flag 1: Verify access on ECU flash code possible */
0 /* Flag 1: Upload from ECU flash code possible */
1 /* Flag1: Upload and download only on active.page. */
/end DATA_ACCESS
Wish I had more time to dive into the hard parts of the locking strategy, but I'm mainly focused on how these unit talk to the other CANbus nodes. So below is link to the T87A processor programing and technical documents. Worst case, we pop the case open and drop a modified bin straight onto the chip. But I hope to gain a bit more insight about CANbus unlocking from the pros next week. Just in case I get sidetracked, here is everything relating to the TCM's STM32 processor.
I did receive word over the weekend that my first attempt at getting the E38 and T87A talking happy, was a success. Just a few tricks left now to include features like manual mode, tap shift, and clearing of a single comms related trouble code that typically gets written out in ECM tune. But Plug-N-play to me means no DTC's present, everyone happy happy happy... Overall, am told car runs and drives great as is. So that provides enough motivation to keep pushing forward onto the others ECM's now.
/begin DATA_ACCESS
0x000000 /* ECU address type qualifier for Flash page */
0x000000 /* ECU address type qualifier for RAMpage */
1 /* Flag 1: Upload from ECU flash data possible */
0 /* Flag 1: Verify access on ECU flash code possible */
0 /* Flag 1: Upload from ECU flash code possible */
1 /* Flag1: Upload and download only on active.page. */
/end DATA_ACCESS
Wish I had more time to dive into the hard parts of the locking strategy, but I'm mainly focused on how these unit talk to the other CANbus nodes. So below is link to the T87A processor programing and technical documents. Worst case, we pop the case open and drop a modified bin straight onto the chip. But I hope to gain a bit more insight about CANbus unlocking from the pros next week. Just in case I get sidetracked, here is everything relating to the TCM's STM32 processor.
I did receive word over the weekend that my first attempt at getting the E38 and T87A talking happy, was a success. Just a few tricks left now to include features like manual mode, tap shift, and clearing of a single comms related trouble code that typically gets written out in ECM tune. But Plug-N-play to me means no DTC's present, everyone happy happy happy... Overall, am told car runs and drives great as is. So that provides enough motivation to keep pushing forward onto the others ECM's now.
Since the time change didn't help with my sleeping disorder, figured I would sort out the pinouts between our A50 and T87 connectors. Some are easy, with matching circuit ID's, while others require some thought and wiring diagram tracing. But have a good spreadsheet started we can build on.
Other thing I clarified is our T87 speed sensor requirements. Tested my little 5v PWM signal generator against the T87. Last time I'd used it was to replicate speed sensors on a T42, so duty cycle was still setting where it worked on that. And while I could get the T87 to register a pulse count, it wasn't happy. Wouldn't track a rate change in pulses no matter what adjustments I tried. So, not likely this TCM will work with VR style pickups.
Looking at the pinout for the T87, I noticed where these new hall effect sensors use a 9v reference on pins 7 & 8, and sensor signal is on pins 14 and 15. A little online searching shows that common hall effect sensor comes in 3 forms. 0-10v, 0-5v, and Open Drain On/Off. So I verified reference pins 7 & 8 on the TCM, and those are reading a little over 9v. Guessing we have the first option. But while probing pins, I also found that listed unused pins 5 & 6, look to be 5v references. Which might just save our bacon in this A50 swap.
So next test was to see if the sensor signals would accept a 5v square wave from the little Arduino emulator I use for ECM crank / cam emulator. And guess what, the signal pulse registers on tracking PIDs, even when I was sending it a 60-3 crank wheel pulse.. It's obviously fairly fault tolerant.. But the main take away, it's perfectly happy with a 0-5v square wave pattern. Which is all I needed to know.
Seems some others didn't do much research before going full bore pushing out a T14 solution. A little knowledge goes a long ways. And I don't see any reason why someone needs to own a wrench and creeper to change sensors, when this small issue can be easily solved with a dime size circuity. Remember those 5v references I found unused? Simple fix is likely gonna spins some heads... Some of you probably know this fix already, I posted an example link above.. LOL
For those interested, below is a good link with explanation of the differences between VR and Hall sensors. Next I'm going to break out my full E35B bench rig again, blow the dust off it, and see if I can't wrap this swap up before dinner. Tomorrow that is. Ya gotta build a little suspense at least.
Other thing I clarified is our T87 speed sensor requirements. Tested my little 5v PWM signal generator against the T87. Last time I'd used it was to replicate speed sensors on a T42, so duty cycle was still setting where it worked on that. And while I could get the T87 to register a pulse count, it wasn't happy. Wouldn't track a rate change in pulses no matter what adjustments I tried. So, not likely this TCM will work with VR style pickups.
Looking at the pinout for the T87, I noticed where these new hall effect sensors use a 9v reference on pins 7 & 8, and sensor signal is on pins 14 and 15. A little online searching shows that common hall effect sensor comes in 3 forms. 0-10v, 0-5v, and Open Drain On/Off. So I verified reference pins 7 & 8 on the TCM, and those are reading a little over 9v. Guessing we have the first option. But while probing pins, I also found that listed unused pins 5 & 6, look to be 5v references. Which might just save our bacon in this A50 swap.
So next test was to see if the sensor signals would accept a 5v square wave from the little Arduino emulator I use for ECM crank / cam emulator. And guess what, the signal pulse registers on tracking PIDs, even when I was sending it a 60-3 crank wheel pulse.. It's obviously fairly fault tolerant.. But the main take away, it's perfectly happy with a 0-5v square wave pattern. Which is all I needed to know.
Seems some others didn't do much research before going full bore pushing out a T14 solution. A little knowledge goes a long ways. And I don't see any reason why someone needs to own a wrench and creeper to change sensors, when this small issue can be easily solved with a dime size circuity. Remember those 5v references I found unused? Simple fix is likely gonna spins some heads... Some of you probably know this fix already, I posted an example link above.. LOL
For those interested, below is a good link with explanation of the differences between VR and Hall sensors. Next I'm going to break out my full E35B bench rig again, blow the dust off it, and see if I can't wrap this swap up before dinner. Tomorrow that is. Ya gotta build a little suspense at least.
Last edited:
Im confused. Are pins 5-6 meant for old-style input & output speed sensors so all you have to do is repin the harness (or make an adapter)?
Sorry for my ignorance (not an EE) -- the way you're flying thru this is amazing, but head-spinning.
Sorry for my ignorance (not an EE) -- the way you're flying thru this is amazing, but head-spinning.
DPS could be the solution to flashing the T87A. It apparently works sort of like SPS2, but more powerful. IT seems with the right things, you can use it to change VINs in modules where SPS can't/won't change them. For example, the climate control module in my wife's Malibu is out of a wrecked car, so while SPS2 programmed it with the right calibration and re-linked it's 'security key', the VIN does not match. Would be nice to fix that.
I'd have to crack one open to see where those pins actually go. But it's not uncommon to have spare supplies or Lo / Hi references for 5v sensors on most ECUs. There is also some 12v, and 2v pins in the "Unused" list in the diagram. And this is just what I discovered by some quick probing. They could also be pull up resistors on 5v "input signal" lines, so little more testing required.
Short answer to your question, this TCM requires a square wave speed pulse, accepts 5v or 10v signals, and contains reference lines for each type. Making our options to convert wave patterns or run custom pickups pretty wide. It can handle 3 speed sensors based on OS. and has multiple temp and pressure sensor lines. So developers built it for use in multiple applications. Unlike our old A40/50.
Intresting... I looked it up and it seems fairly powerful. Knowing what's out there is a hacked version, I wonder if any sellers are better than others?
I see it from $50 - $100 depending on whom is selling it. Looks like 4.53 is latest version for sell. If any one finds a reputable seller, I would be interested in purchasing it.
Couldn't hold myself back from cracking this T87 open. Beefy.. Looks to have some test ports on the board.
Sent from my SM-S901U using Tapatalk
Sent from my SM-S901U using Tapatalk
Thanks for the file @pl_silverado. I've identified the CanA and CanB canbus tranceiver chips and pins on the T87 board.
We have 8 pins for canbus on these boards, but only 2 CAN transceivers. I remain unable to rationalize why GM found it necessary to run all the ECM CANbus lines thru the TCM, and on the Duramax, the GPCM. In every case, the two CanHI and CanLO pins are just tied together on the PCB.. I mean couldn't they just put a Tee in the harness, rather than forcing the wiring thru the board?? Because nobody who build the boards planned for it.
Well anyways, the reason this might be of some use, we have 8 CANbus pins on our T87 connector. 4 are listed in the normal schematics, and the other 4 fall under "Unused" pins 40&41, 56&57. While BusA handles all of our normal communications, I didn't get any data off the BusB pins when testing last night. Figured they would at least respond to some OBD2 style commands. But I feel these might be required for our bench programing or unlocking. If you want to explore, should be enough to get ya started.
We have 8 pins for canbus on these boards, but only 2 CAN transceivers. I remain unable to rationalize why GM found it necessary to run all the ECM CANbus lines thru the TCM, and on the Duramax, the GPCM. In every case, the two CanHI and CanLO pins are just tied together on the PCB.. I mean couldn't they just put a Tee in the harness, rather than forcing the wiring thru the board?? Because nobody who build the boards planned for it.
Well anyways, the reason this might be of some use, we have 8 CANbus pins on our T87 connector. 4 are listed in the normal schematics, and the other 4 fall under "Unused" pins 40&41, 56&57. While BusA handles all of our normal communications, I didn't get any data off the BusB pins when testing last night. Figured they would at least respond to some OBD2 style commands. But I feel these might be required for our bench programing or unlocking. If you want to explore, should be enough to get ya started.
Last edited:
More tools and hardware today.. Got us a clean working copy of the 2015 Allison bin for our T87. Was able to import it into EFI and convert to ctz. Now to see how easy to brick it... LOL.
Thank goodness there are smarter people than I who've sorted much of these options already. The communications between modules is taking a bit more time to clean up. GlobalA is more like Global 2007, 12, 15, 18, 20... Every few years having some slight differences in the ID's used between hardware.
Also got this A50 in the mail today. Thanks @pl_silverado .. Now with the E35B we can verify what Gloabal_X_ version they were all speaking in that year. Should be smoother sailing here on, I hope.
Thank goodness there are smarter people than I who've sorted much of these options already. The communications between modules is taking a bit more time to clean up. GlobalA is more like Global 2007, 12, 15, 18, 20... Every few years having some slight differences in the ID's used between hardware.
Also got this A50 in the mail today. Thanks @pl_silverado .. Now with the E35B we can verify what Gloabal_X_ version they were all speaking in that year. Should be smoother sailing here on, I hope.
I've misplaced my keyfob, and torn the whole car apart searching for it. If you can spot it, please let me know... LOL
One thing I did misplace on purpose tonight, the U0100 DTC from this T87..
Finally stopped the little sucker from defaulting to it's brain dead tables. With a test converter box installed in a E38 vehicle, it runs and drives, but wasn't shifting correctly. Reported as to soft when not at WOT. Acting like it was in some limp mode, or running hidden tables. But cold be commanded to shift firm using a scan tool. Several tuning changes didn't resolve it. Turning off that DTC didn't fix it.. So it took some serous therapy, starting with the T87 connected to a E92 on the bench for about 6 hours straight.
Wired up on the bench to the E92 it's somewhat happy, even with no physical transmission hardware connected. So long as it can see a specific group of CANbus packets from the ECM. But remove just 1 of those packets, and this T87 basically ignores all other ECM comms, and goes off into some hidden limp shift tables. I was only able to find the specific "Required" ID set by recording it in a happy state, then playing that data back to the TCM, while monitoring the DTC's and other PID's with EFI.
Worst part is, half the ID's it requires to run happy, ain't listed in the a2l RX/TX data set I've been basing all this work on.. While I know there are multiple OS versions out there, seem I've started out with one that doesn't match any other common version I have tested with. At first I thought, it was 87 vs 87A differences. But now, I'm thinking I must have a bin file GM never used... Or this missing data is buried in some table I've yet to discover. These things even track emissions and missfire status. So it's possible I just haven't searched for the correct term.
But after another all-nighter, think I've kicked it's butt.. Finally. At least it reports it in happy comms mode to to the scan tools.. Will see soon enough.
One thing I did misplace on purpose tonight, the U0100 DTC from this T87..
Finally stopped the little sucker from defaulting to it's brain dead tables. With a test converter box installed in a E38 vehicle, it runs and drives, but wasn't shifting correctly. Reported as to soft when not at WOT. Acting like it was in some limp mode, or running hidden tables. But cold be commanded to shift firm using a scan tool. Several tuning changes didn't resolve it. Turning off that DTC didn't fix it.. So it took some serous therapy, starting with the T87 connected to a E92 on the bench for about 6 hours straight.
Wired up on the bench to the E92 it's somewhat happy, even with no physical transmission hardware connected. So long as it can see a specific group of CANbus packets from the ECM. But remove just 1 of those packets, and this T87 basically ignores all other ECM comms, and goes off into some hidden limp shift tables. I was only able to find the specific "Required" ID set by recording it in a happy state, then playing that data back to the TCM, while monitoring the DTC's and other PID's with EFI.
Worst part is, half the ID's it requires to run happy, ain't listed in the a2l RX/TX data set I've been basing all this work on.. While I know there are multiple OS versions out there, seem I've started out with one that doesn't match any other common version I have tested with. At first I thought, it was 87 vs 87A differences. But now, I'm thinking I must have a bin file GM never used... Or this missing data is buried in some table I've yet to discover. These things even track emissions and missfire status. So it's possible I just haven't searched for the correct term.
But after another all-nighter, think I've kicked it's butt.. Finally. At least it reports it in happy comms mode to to the scan tools.. Will see soon enough.
Keep in mind that the Global A architecture was pretty fractured until 2014 or so. Best I can tell, the half ton trucks started being Global A in 2014, with the rest following in 2015. If I had to guess, the 2500/3500's probably moved to Global A when they ran out of T14's and moved to the T87. I'm guessing that anything Global A specific in the T87/T87A will have to be 'adjusted' to work with the earlier LMLs and the LMMs.