E67 to T87/T87A TCM interface needed

[Tre-Cool]

This might be a little bit off topic, but..
U-link NT is now able to read and write the T87a and he's about to come out with a 1 click unlock for use with hpt.
Edited to add.. the T87a unlock is live and the new version is out with the needed files.
Works great.

does it require pulling the t87 apart?

[ironduke]

This might be a little bit off topic, but..
U-link NT is now able to read and write the T87a and he's about to come out with a 1 click unlock for use with hpt.
Edited to add.. the T87a unlock is live and the new version is out with the needed files.
Works great.

does it require pulling the t87 apart?

The T87 isn't locked afaik. The T87a is locked and requires unlocking. In any case no the T87a does not have to be taken apart. 2 jumpers from pin to pin, a 5v supply on an ign feed and that's all it needs. Already tested yesterday and a simple resistor ladder can be used for the 12v to 5v supply. I measured something like .015ma on the ckt soI used a 680hom and a 520ohm resistor and it worked fine. I have a connector and I just ordered a 3PDT OFF/ON/OFF switch for a bench harness. I do have and use a computer power supply for the bench but wanted something I can plug in on vehicle and quickly unlock.

[kidturbo]

Thanks for the good info. I'd previously been told it was just a Boot Pin to stick those into a DFU mode over canbus. Which allows full chip read/write. Then modify a bit or 2 in the boot sector, and done. Can't wait to give it try it.

But when I saw that Jtag tool, I also went straight to cracking open the case?? But since I'm really good at bricking ECU's, am sure will get used many ways..

[kidturbo]

In light of new tools and interest to further explore these TCM's, does anyone have a suggestion on starting a new T87A specific thread? I'd start it under Hitachi, but didn't see a fitting board index title.

I've stumbled onto quite a few 10L hardware / software differences I was unaware of couple weeks back. Some platform specific, and matching OS versions I'm guessing. Spent a few days pounding the OEM database for answers, and soon realized there's more than one pinout option.. So would like to sort the years to gears under clean topic if possible.

For this topic, I'll share what I feel is the easiest solution to E67 T87/A. The key to getting the E67 speaking to the T87/A specifically, as with any other GM ECU, is matching up a few required CANbus messages, and their specific signals. The last Global A update, around 2017, includes a few powertrain ID's not previously present. And they extended the byte length or added signals on a few existing ID's. And the developers added some checks to the ID's and byte length, which sets an U0100 for PCM CANbus data error whenever said PCM required ID's are missing. Same goes for BCM and EBCM modules..

Today we have options to turn off those related DTC's if we don't have the correct BCM or EBCM speaking on our bus. Which leaves us with the PCM to TCM communications. Luckily this TCM doesn't require much "true" data to operate happily. I've found it will shift with few minimal input values. And while it's constantly barking Driver Pleasability Torque Limiting requests, for the most part, it operates fine in a one way communications environment. But it expects a specific set of PCM variables to shift "happily" rather than in some restricted open loop mode.

So to anyone wanting to do E67 to T87/A swap, I can share with you what the T87A expects to see on the bus to not set a U0100. If you read up on the Msg ID details in the GMW docs, you will find everything needed to supplement the missing E67 msg set, with what the T87/A requires. Using existing E67 PCM data, one can easily generate the missing packets to get the TCM into a happy mode using any simple Arduino board with CANbus transceiver. Just needs to emulate some missing data messages, which is how I demonstrated this operating on the bench over a year ago. Some off the shelf hardware with a bit of code, and you can 8l or 10L swap about any GM from 2004 and up. But depending on the OS or year, it may still require some custom bin hacking to adjust the CANbus packet lengths sent from the PCM. Or you could even shorten the ones required by the TCM if you can find em.. The earlier ECM's could care less if doesn't see the correct data from the TCM, but the TCM is quite picky on what exactly it does or doesn't receive. That's what we have to deal with.

That said, here is the T87/A required Msg ID set to get ya going. Feed it these with right timing, it will drive..

0be
0c9
18e
1a1
1a3
1aa
1ba
1df
287
3d1
3e9
4c1
589

PS: if all that sounds to complicated, hit me up for a box to do it.

[Multi_Gate]

https://youtu.be/U_oEtcQiRRA

super cool seeing there was probably an easier way to do this lol.

I joined because of this thread when I was poking for info, here we are.

I am very entry level to C and CAN bus.

I spent the past year educating myself at night and managed to get this thing running and driving without flash programming anything besides a stock OS.

[kur4o]

Anyone know the broadcast CAN msg id for turbine pressure sent from pcm to ipc.

[kidturbo]

https://youtu.be/U_oEtcQiRRA

super cool seeing there was probably an easier way to do this lol.

I joined because of this thread when I was poking for info, here we are.

I am very entry level to C and CAN bus.

I spent the past year educating myself at night and managed to get this thing running and driving without flash programming anything besides a stock OS.

Welcome to the site. An nice work on the gateway approach.

Did you find that the T87A OS you are running followed same required ID set from the list above?

I didn't include 0x191, as was not required to satisfy the 10L OS versions I have tested. But is our default torque values for all pre-2014 powertrain platforms I've logged. Just curious as to any noted OS differences relating to CANbus.

[kidturbo]

This might be a little bit off topic, but..
U-link NT is now able to read and write the T87a and he's about to come out with a 1 click unlock for use with hpt.
Edited to add.. the T87a unlock is live and the new version is out with the needed files.
Works great.

does it require pulling the t87 apart?

The T87 isn't locked afaik. The T87a is locked and requires unlocking. In any case no the T87a does not have to be taken apart. 2 jumpers from pin to pin, a 5v supply on an ign feed and that's all it needs. Already tested yesterday and a simple resistor ladder can be used for the 12v to 5v supply. I measured something like .015ma on the ckt soI used a 680hom and a 520ohm resistor and it worked fine. I have a connector and I just ordered a 3PDT OFF/ON/OFF switch for a bench harness. I do have and use a computer power supply for the bench but wanted something I can plug in on vehicle and quickly unlock.

U-Link tool works great. Kind of using a roundabout process to achieve and simple canbus line with boot mode, but his read and write scripts work well. And the Jtag tools offer plenty of other good ECU uses, like un-bricking the stack of T87's I've accumulated. So will also recommend helping in this software development.

For mapping out these T87/A's differences while fresh on my plate, created a new T87A thread:

viewtopic.php?p=131515#p131515

[Multi_Gate]

https://youtu.be/U_oEtcQiRRA

super cool seeing there was probably an easier way to do this lol.

I joined because of this thread when I was poking for info, here we are.

I am very entry level to C and CAN bus.

I spent the past year educating myself at night and managed to get this thing running and driving without flash programming anything besides a stock OS.

Welcome to the site. An nice work on the gateway approach.

Did you find that the T87A OS you are running followed same required ID set from the list above?

I didn't include 0x191, as was not required to satisfy the 10L OS versions I have tested. But is our default torque values for all pre-2014 powertrain platforms I've logged. Just curious as to any noted OS differences relating to CANbus.

Thank you sir.
I have since been working on it. I have it fully functional without codes on ANY of the other modules. I'm using a truck/SUV OS t87a with a few different trucks currently. 2007 2008 2009 and a 2013 (We also did a Terminator X version as well that is working, although it was a significant difference for tq intervention).

They are working well without complaints of tq intervention and without trouble codes disabled. I did find that if you feed it the bare minimum and just turn all the codes off like you mentioned. It will in fact drive (not the greatest but still)

I haven't compared the messages in your list vs what I have but I believe I ended up with a few more to satisfy it 100%. Upshift tq intervention working as well. I'm still in the debugging phase and trying to add more features to it before I update the hardware on my gateway. I would really like to learn some disassembly so I can compare some of the other T87a's so I can see what hardware will work with certain units.

[kidturbo]

As I recently posted in the the other T87/A topic, the main stick jumping to the 10L from the 6 or 8, is the transmission Range Switch changes. However, the same TCM hardware can operate an 8L or the Allison, which uses the old style 6 wire range switch. But the older ECM's are not configured to read the new current driven 0-100% range switch values from a 10L. And then our ECM and TCM share this new 0-100 value over CANbus, and compare the two to determine valid shifter positions.

What I did learn from bench testing is why some early ECM OS will shift a 10L, while others won't without a gateway or emulator, is simply due to some failsafe in the TCM code. IF the ECM transmits an 0x287 msg, "Transfer Case Supplemental", it must be 6 bytes in length, and contain the Opposite Sweep 0-100% value to what our TCM reads. If they don't match up at key on, ya get a dead stick, and likely a A/B Range Correlation code. The TCM will show Range Invalid in the raw CANbus data if yours sniffing.

However, if the TCM doesn't receive a 0x287 msg, it will pop a U0100 Lost Comms PCM code, but will go into gear and shift. IE, loose CANbus connection in the chassis harness, the TCM still has power, car still moves. Receives 0x287 msg malformed, missing the range data, it knows it's being spoofed, and defaults to No Valid Gear Position at key on, and limps out much like a TPS.

Now the trick is, that 0x287 msg doesn't exist on CANbus in some of our early E38 and E67 stuff. If it came from a 4x4 truck, that ECM OS doesn't TX the 0x287 msg because it's being sent from the actual Transfer Case Module. If there wasn't a transfer case, then the ECM sends the 0x287 msg to emulate it. For only reason I can find, Tow Haul switch in in there...

I've found the bit in 0x287 to tell the TCM that Range Switch Data is Invalid. By sending the TCM that one bit, it then ignores any 0-100% values from the ECM, and shifts into gear just fine based off TCM data only. Also the raw CANbus data reflects the same coming back from TCM. Everybody now happy with that one CANbus msg, or if it receives no message at all. You'll still get a U0100 code, but write it out and roll on.

So if you start with Car or 2 wheel drive truck ECM OS, most likely not gonna move due to A/B range codes. But swap out to a 4x4 truck OS, or anything that doesn't transmit the 0x287 msg, then the TCM will default to single switch mode, and most likely shift good enough to get down the road. Then we get into Torque Management messages, and how to satisfy that via CANbus. But it looks as if one of these early 10L OS, may shift on speed / throttle rather than torque values.

If so, then match up the right 2 OS versions, write out a couple codes, and you be driving. At worst, if ya can modify the T87A code, it's possible to change the required msg structure to get around the range switch conflicts with other OS. But they still won't shift nice and healthy until everyone is line up on the torque reduction requests. Hope that helps iron out why some OS shift, while others will not.