Car Battery Startup and Shutdown Voltage Curves

Written 2020-09-23

Tags:Battery Voltage 

Test Setup

My car is a 2002 Toyota Highlander with either a 100 or 130 Amp alternator. The car battery was last replaced about four years ago with an auto parts store brand. I used a Mooshimeter for data logging at about roughly 1.5Hz logging rate. Of note, my car currently sometimes has a low idle, I believe due to a sticky idle air control valve.



Around 2 seconds I opened the car door and sat down. Around 7 seconds I turned the key to the on-position. Around 15 seconds I started the car, sagging the voltage significantly, then the alternator began and the voltage quickly approached 14v. I then left for the grocery store.



After unpacking the groceries, I reattached the meter, waited a few seconds, then shut off the engine completely. The voltage dropped quickly initially then recovered a little and relaxed slower. It appears that around one minute after shutdown another load was removed.

Interestingly, the voltage lowered between leaving the house and returning. This could be alternator regulation changing to float-charge, or it could be that my engine was idling lower when I returned then when I left.

Alcatel Lucent O-010S-P GPON Teardown

Written 2020-08-21

Tags:GPON Fiber 

On a recent DSL-Reports thread I noticed that Alcatel-Lucent O-010S-P was marked as untested. I ordered a used one to take apart and see what was inside. For reference, here it is next to a Nokia G-010S-A(with infamous SFP linkup issue). As we can see, the cases are quite different, in addition to the different fiber connectors/polishes (SC/APC and SC/UPC).

Alcatel-Lucent O-010S-P

First to go are these little tabs on the right(other matching tab on other side of SFP). These can be bent out with a steel probe from the end of the SFP.

Alcatel-Lucent O-010S-P

Next, the outer case/shield just sort of slides off. Note this will likely scratch your labels and jack up your thermal pad if it is old and dry.

Alcatel-Lucent O-010S-P

Removing the heatsink we can see a Broadcom chip under it. Due to stains from the heatsink insert, it's a little hard to read the number, but I believe it to be BCM685131FBG, BCM685161FBG, or BCM685181FBG.

Alcatel-Lucent O-010S-P

From the side, we can see this is indeed a lot of electronics in a small package, with two PCBs soldered together, and what I would guess is RAM in the middle. Also, you need to smoosh the laser module and PCB assembly together a bit like shown before continuing.

Alcatel-Lucent O-010S-P

Apologies for this next shot, but to remove the PCB, you need to continue smooshing the PCB assembly towards the laser until the PCB can be rotated up and off the metal notches like shown.

Alcatel-Lucent O-010S-P

Apologies again for not taking the last photo of the back - the main feature is a Spansion FL256SAIF00 3v, 256mbit/32MByte Quad-SPI Flash.

Nokia G-010S-A Pin 6 Issue

Written 2020-08-15

Tags:GPON Fiber SFP 

As part of setting up a GPON lab at home, I noticed that my Nokia G-010S-A SFP refused to connect to my HP 530SFP+ NIC. Some research showed that a NIC modification was needed.

Nokia G-010S-A PCB

I decided to dig in a little deeper to figure out what was wrong. The SFP specification states that SFP pin 6 should be grounded on the SFP module, so that the NIC can detect and respond to hotplugged modules. According to the link above, the Nokia G-010S-A doesn't do so, but that's not quite the whole story. After disassembling the SFP housing(a tricky and risky venture, bent sheet metal may cause interference on reinsertion to the NIC), I was able to trace out enough of the PCB to figure out what Nokia did. Instead of directly grounding pin 6, they placed a 1k SMT resistor between pin 6 and the SFP ground(also pins 1/9/10). This forms a voltage divider between the NIC and the G-010S-A. I suspect the issue is that different NICs may use different pull-up resistors connected to pin 6, or have different levels of VIL(Voltage Low Level, the minimum voltage required to read as a zero reliably), causing some systems to detect the G-010S-A correctly(if their pull-up is high enough), others to flutter(if their pull-up is middle-sized, or not using Schmitt triggered inputs), and mine to fail to detect entirely(pull-up too low).

Nokia G-010S-A PCB

The fix seems to be simple enough, short out this resistor(there are three white boxes above the 5 pin chip, the middle box has two resistors, the left is a zero-ohm, and the right is our 1k culprit, it's connected to pin 6, starting with pin 1 on the far right).

And it is! After soldering all four pads together, because my iron is far too large to solder over a single SMT resistor, rebooting the machine, setting the speed to 1000mbps with

sudo ethtool -s ens4f1 1000
, configuring my IP address as, I can ping and SSH into it as ONTUSER:SUGAR2A041@, it works!

Nokia G-010S-A Solder Fix Nokia G-010S-A Solder Fix ONTUSER:SUGAR2A041@

Inside a PON Splitter

Written 2020-08-15

Tags:GPON Fiber 

As part of setting up a GPON lab at home, I needed a fiber splitter. Of course, I had to see what was inside.

PON Splitter Exterior

PON Splitter Interior

It seems the true magic is inside the thin aluminum box. I dare not open it further or risk damaging it.

Google Fiber Jack Shell and GPON Configuration

Written 2020-08-12

Tags:UART Shell GPON Google Fiber 

After looking inside a Google Fiber Jack, I found a similar 0.1 inch header strip like was present on the Google Fiber Network Box. Guessing the pinouts to be the same (Ground at one end connected to ground plane, then PCB-TX, then PCB-RX), and the baud to be the same(115200), I was presented with U-boot. After politely asking U-boot to stop the autoboot sequence, I found I was unable to enter single-user mode through the normal methods(single,1,init=/bin/sh) and attempting to do so led the unit to boot normally, without even a login prompt.

After adding debug=1, we can see more printouts during startup, and a login prompt, but now we need the password.

Back to U-boot. We can use 'sf' to read Serial Flash into RAM, and 'md.b' to print RAM over the bootloader console. Equipped with 32MB of Flash, and not wanting to risk byte-drop by increasing the baud-rate, dumping the flash takes several hours, but after converting both line-endings then hex to binary, I'm greeted with a 33554432 byte file, which is exactly correct.

After running binwalk several times recusively and a little manual extraction, I'm able to locate the shadow file and hashes within. A quick run through hashcat with a wordlist reveals the passwords. I won't post the password here, but I was disappointed I didn't guess it.

After rebooting Linux with debug=1 and logging in, we can see:

JAAG45202481# cat /sys/devices/platform/gpon/info/infoGpon 

ONT Full Information:
SN[VENDOR ID]:                 4A:41:41:47 [JAAG]
SN[Serial Number]:             45:20:24:81
ONU ID:                        255
ONU STATE:                     1 [INITIAL]
INIT STATE:                    TRUE
OMCC Valid:                    FALSE
OMCC Port:                     65535
BER Interval:                  0
SD Threshold:                  9
SF Threshold:                  5
Guard Bits:                    0
Preamble Type1 Size:           0
Preamble Type2 Size:           0
Preamble Type3 Pattern:        0xAA
Preamble Type3 Range Size:     0
Preamble Type3 Oper Size:      0
Delimiter:                     0x00AB5983 [0x00AB5983]
Internal Delay:                6532 [0x1984]
Equalization Delay:            0 [0x0] (HW:0x0)
Final Delay:                   32
Const Idle Ploam:              [0xFF040000][0x00000000][0x00000000]
Const Serial Number Ploam:     [0xFF014A41][0x41474520][0x24810505]
Serial Number Mask Enable:     FALSE
Serial Number Mask Match Mode: NO MATCH
Debug Mode:                    FALSE
Overhead Manual Mode:          FALSE
JAAG45202481# uname -a
Linux GFiberONU #3 Fri Apr 4 12:48:22 PDT 2014 armv5tel