TA-1042A/U interface with Raspberry Pi Pico

Working on a project to interface the TA-1042A/U in some fashion. Currently some notes, I’ll update as it progresses.

Connecting to SMB Windows Shares Across Subnets/CIDR blocks

I recently set up my home network with a “IOT” subnet. This is configured with my new UDM Pro SE, which has a 2.5 GBE WAN port and built in PoE which I quite like. Basically:

  • Separate subnet ( instead of for the main subnet)
  • Firewall rules to:
    • Permit traffic from the IOT subnet to the other subnet
    • Block traffic out to the WAN
Annoyingly Unifi wouldn’t let me put the firewall rule above the pre-defined, so I created a redundant one

I verified that I could connect between the two and not to the internet, and I assigned it to some of the ports on the UDM Pro SE.

For whatever reason, enterprise class printers don’t seem to be a huge fan of getting the scanner to work over AirPrint which was a bit annoying. As a result, I wanted the printer (which is located in the IOT subnet since printers shouldn’t phone home to Russia) to scan to a SMB share on the main subnet.

I maintain an old Windows laptop with RDP for running windows applications and browsing over RDP from my work laptop when I don’t want the mothership company to see my personal info. I simply created an SMB share there, and figured the printer could scan to that share. NOPE!

Windows 10 by default sets up firewall rules for SMB which define that the SMB related processes can only be connected to from the local subnet. Thus I could not connect to my SMB share from the DMZ subnet (although RDP worked fine).

To fix this, opened the magical firewall msc application:

You can see the SMB rules here

For each of these SMB things, I modified it so that any subnet which can connect to SMB can connect to the shares:

It initially had only local subnet under remote scope

Now it works! Hopefully you’ll find this helpful.

Fixing ffmpeg mov ‘error reading header’ ‘cannot allocate memory’

So I recently created a video with Filmic Pro on my iPhone for a podcast. The app 💩 itself abruptly in the middle of recording, and the resulting video would crash Premiere when imported. Quicktime would play it but not export or trim it. ffmpeg gave me the following:

% ffmpeg -i 10292020_175544.mov 
ffmpeg version 4.3.1 Copyright (c) 2000-2020 the FFmpeg developers
  built with Apple clang version 11.0.3 (clang-1103.0.32.62)
[mov,mp4,m4a,3gp,3g2,mj2 @ 0x7fdf99806a00] error reading header
10292020_175544.mov: Cannot allocate memory

This seemed to be a pretty severe error within the header parsing, such that no amount of “ignore error” options would override the failure.

Obviously this would not do; I even debated using screen recorder to record the quicktime output, but thankfully I found a trick that recovered the video.

Basically I opened the OSX 10.15 preview screen, and it the trim button. This then allowed me to trim off a wee bit of the video and the resulting output had correct headers. Highlight the file in Finder, press space, and then hit the little trim button that looks like a sideways iPhone with two arrows:

Second button from the left there

Also note that the Yodot MOV repair utility _did not_ work.

Car AC Service for Dummies

Let’s say you have a habit of collecting ancient cheap vehicles and you notice that sometimes the AC system doesn’t work so hot. A few examples:

  1. The jabroni offering the vehicle says the AC “just needs a recharge” (always a lie) and when you do recharge it, it lasts about 18 hours and starts hissing refrigerant and oil out of the seam of the compressor.
  2. The AC works but lacks some pep, cycles on and off when it should be running continuously, etc.

I’m going to walk you through how to do AC work!

Nick’s qualifications:

  1. A lot of time spent watching YouTube videos trying to figure out how the hell you do this.
  2. Repairing 2 car AC systems.
  3. Buying a lot of toys/equipment.

How to evaluate AC performance

The yahoos over at your Vehicle Manufacturer probably provided some helpful tips on how to evaluate your performance of your AC, particularly in the Factory Service Manual. An example is provided here for your reference from the Honda Accord 6th gen FSM:

If everything is hunky dory, you should be able to use a good old pen, a thermometer, the weather report, and a set of manifold gauges to evaluate your system performance. Measure:

  • The temperature of the ambient air, relative humidity.
  • The system high and low pressures while running at slightly elevated RPM.
  • The system air delivery temperature in the cabin with no occupants.

For example, if it’s 77 degrees and 50% relative humidity, you can draw little lines through the middle of each of those black bars and see that your:

  • Delivery temperature should be 47 degrees.
  • Your intake pressure should be something like 16 psi.
  • Your delivery pressure should be something like 170 psi.

If things are wildly outside of those limits, you have problems. Here are a list of common problems:

  • Compressor unhappy, exploding.
  • Low refrigerant charge — over time, all car systems will lose some refrigerant and will require more be added. In my Honda from 2002, only 11.8 oz was left inside with unclear previous service history.
  • Condenser completely covered with gross detritus, dents, and bug juice. This will result in the condenser getting much hotter to dissipate the required amount of heat energy across what is effectively insulation and reduced airflow.
  • For vehicles with electric fans, both fans should be spinning and not making any horrifying noises when the AC is on. If they’re not, this will destroy AC performance.

For my Honda, the delivery pressure was exceptionally high and the charge was quite low.

Evaluating AC system charge

As the book goes, the primary way to evaluate AC charge is by weight, i.e. by removing it from the vehicle and weighing it.

Low charge is not just bad for performance reasons, but the oil in the system is designed to mix with the liquid refrigerant and zip along the system. If the refrigerant level is very low, not enough oil will move through the system and you can end up with an unhappy compressor due to insufficient oil.

The major TL;DR is that it is very difficult to evaluate correct AC charge from the pressures alone. If I had been looking exclusively at the pressures on my Honda, I would have seen the high side exceptionally high and concluded that my vehicle was overcharged. It is probably a bad idea ™ to charge using one of those AutoZone cans that just has a gauge on the low side, unless your system was entirely empty before hand and you can charge by weight. At best you have to be very careful to check the internal temperature in your car as you charge; overcharging is easy when topping off which can result in bad things not to mention overall poor system performance.

If you have been convinced that you should weigh the charge using a recovery machine, skip this next section.

Superheat/Subcooling charge estimation

Best recommendations aside, you can use the superheat/subcooling method to evaluate the system charge. The Honda uses a Thermostatic Expansion Valve (TXV), whose job it is to regulate the amount of liquid refrigerant entering the evaporator coil and maintain a certain amount of “superheat.”

“Superheat” is measured by comparing the temperature of the vapor line exiting the saturation temperature on the liquid side. In a functional AC system, liquid enters through the expansion valve into the evaporator and then meanders through the evaporator soaking up heat energy as it boils. The boiling point is determined through the pressure, which is constant across the entire vapor side of the line. In a functional system, all the liquid will have boiled away inside the evaporator and then slightly more heat energy absorbed by the refrigerant in the liquid state — it is very bad ™ to have liquid making its way back to the compressor, since the compressor is not expecting to have liquid slam into it and it can be destroyed if a large quantity of liquid enters it. A TXV will basically adjust the flow of liquid refrigerant to ensure that we have 12-15 degrees of “superheat” or heat above the saturation temperature.

For this reason, you have to evaluate car AC systems with a TXV using the subcooling method, or the difference between the saturation temperature on the high side and the temperature exiting the condenser. See this video on how to do this.

The Repairs

First, go ahead and check for leaks. It’s quite easy to use a halogen leak detector and check all the valves and such on your vehicle. You’ll want to fix any leaks.

Compressor: If your compressor is oozing, it will have to be replaced. FYI cheap replacement parts can be acquired online — for my GMC Sonoma I was able to acquire a Sanden style aftermarket part for just over $100. GM probably wins the cheap aftermarket parts contest. If your compressor does fail, you need to replace the condenser and receiver-dryer and flush the evaporator and lines to minimize the chance that various detritus will meander back over to your shiny new compressor and abrading it to death. I did a video on my GMC Sonoma doing this process and it was…fun.

Valve cores: if your service ports are leaking refrigerant, you’ll want to replace the core. It is not necessary to replace the entire AC line unless additional bits are leaking. You can get pressurized valve core replacement tools on Amazon or you can drain the system and use one of the simple screwdriver type things. Bear in mind that if you opened the valve core while the system was empty, you will have to vacuum the system afterwards to remove the air.

Condenser: Probably your best bang for your buck in rejuvenating old AC systems is replacing the condenser, especially if it has been assaulted by 400k miles of rocks and bug essence. My head pressures were quite literally halved by doing this, which will extend the life of your compressor and dramatically improve performance.

Evaporator: before beginning AC investigations, it is appropriate to pray to the evaporator gods that yours is intact. Replacing these ranges from moderately painless (like in my Honda Accord requiring maybe 2 hours) to utter death-defying hell of disassembling an entire dashboard billed at 15 hours of labor alone for a $20 part in some modern GMs. Sticking your leak detector into the dashboard region should be enough to determine your fate. Make sure not to tweak your evaporator if you’re in the process of connecting or disconnecting lines (use the old dual crescent wrench strategy on either side of the fitting to avoid torquing the soft aluminum). In failed compressor cases you can sometimes get away with just flushing the evaporator as long as there is some reasonable receiver-dryer preventing the detritus from getting back to the compressor (or so I’m told…).

Recovering Refrigerant

Recovering is the major bit of work before you can just start wrenching.

Basically as a novice, just get a recovery machine, scale, and cylinder and pull out from the vapor side. The instructions should do you. I got a Robinair RG3, here’s a quick video:


Probably the simplest part. From an empty system, vacuum and then add by weight. You want to get a good vacuum on the system before and make sure it holds (to be totally PC use a vacuum gauge to measure and do a 10 minute standing vacuum test to make sure the pressure stabilizes).

The other important tidbit: when disconnecting, you want to bleed the liquid refrigerant out of the high side line back into the low side, leaving all your hoses at the relatively low vapor side pressure. To do this, you want to close the high side at the service port, cap the center fill port (or leave your can attached). open the low side all the way and then sloooooowly crack the high side valve to let the liquid flow into the low side. In this fashion you won’t horribly burn yourself with liquid refrigerant trapped in the high side line. Look up “manifold gauge disconnect procedure” on YouTube.

  1. Easiest/best for novice to charge exclusively with vapor. Things will go a lot faster if you secure a valve core removal tool, which can allow you to fill the system without the valve core restriction in place. You don’t want to dump liquid into the low side since you can trash the compressor if you’re not careful. It is possible to charge liquid first into the high side to shorten charge times as well, but if you’re doing it at home you can charge exclusively through the low side with vapor through the existing valve core, it will just take a while (perhaps 20-30 minutes).
  2. Weigh the cans before and after to determine how much refrigerant you loaded in.
  3. You should find pure R134a, not oiled or with “stop leak” in it. It’s available for like $6/can at Harbor Freight and the AC capacity is just shy of 2 cans. If you need to add oil do so separately according to the recommended manufacturer replacement volume. With the system opened you can just pour it in or use a vacuum pump to pull from one port while you add it to the other after removing a valve core.
  4. If you don’t know what was in your car, it’s probably best to use fresh R134a — it’s quite cheap to buy. If you’re going to reuse what you recovered, you want to carefully check the pressure-temperature relationships for your refrigerant after the cylinder has sat for ~24 hours and the temperature has stabilized. If the pressure is off, the refrigerant may be contaminated — air contamination is the most common, but it will settle to the top of the refrigerant and can be bled off after the tank has been sitting, and then after several more hours you can recheck the pressure-temperature relationships to make sure it’s as expected. FYI it’s common for used car dealerships to reuse highly questionable refrigerant to get their cars working (at least temporarily) so if you’re unsure, best to not reuse, especially if bleeding the top bit of the tank doesn’t result in pressures spot on for R134a.

GMC Full System

Honda Condenser Replacement

When I got the car, the AC was working but it was a little weak. I hooked up manifold gauges to it and the high side was reading something like 235 psi (which corresponds to a saturation temp of 141 degrees for R134a). That was pretty concerning because it’s well outside the usual recommendation for nominal system performance, not to mention running the AC on a hot day like that could kill the compressor.

I attempted to clean the condenser up front but 300k+ highway miles will leave 90% bugs and dents on the front, and it wasn’t very effective. I know there are stronger cleaners out there, but I opted to just get a replacement condenser unit since it was like $50. You’ll want to get a new dryer and an o-ring set while you’re at it.

I ended up getting a recovery machine, cylinder, and scale off Amazon and recovered the refrigerant, and was interested to find that the charge was actually quite low. Local shops wanted some absurd amount of money to recover the refrigerant (like $120). From what I’ve told all compressors will leak a marginal amount of refrigerant over the life of the car (some say up to 1 oz per year). The system capacity is 21.2-22.9 oz of refrigerant and I only removed about 11.8 oz for a 2002 MY. Unclear when/if it was last serviced.

The condenser replacement was pretty straightforward: after removing the bumper, there are two clamps on the front of the condenser and then it pops out. I was able to get the condenser out without removing the radiator or hoses by undoing those clamps and pushing it towards the engine — the condenser was pretty thin after the clamps are removed. After that I added a little over an ounce of PAG46 oil to the system to make up for the stuff trapped in the condenser when it was replaced.

After that I replaced all the o-rings involved in the replacement, vacuumed the system, and recharged with just shy of two 12 oz cans. While I was in there I also replaced the cabin air filter (and there was like half a tree worth of seeds inside that poor box). A quick leak check shows everything holding just fine.

The high pressure is now reading 120 psi with much better performance, which aligns pretty much spot on with the manufacturer recommendations (this is a great article)

As a side note, the service manual does recommend replacing the TXV (the expansion valve inside the cabin with the evaporator) when you open the AC system, however it’s a bit of a chore so I wanted to test everything prior to cracking that open and sure enough it’s working quite acceptably. I do have a spare just in case, but I think i’ll leave that for now 🙂

For anyone interested in getting into AC work, there are a lot of great videos by certified AC techs on YouTube which will help you understand procedures, terminology, and best practices. The equipment you need isn’t necessarily cheap but it is quite handy to have since you can use it for all your vehicles.


TLS Certificate for Unifi with certbot/Let’s encrypt

I have a nifty new Unifi setup. Typically it runs on TLS with a self-signed certificate that won’t pass verification.

For things like guest network splash page, it can be quite helpful to have a TLS-capable Unifi server. In this case, the server runs on a LAN and is not by default routable from the outside world. Nor is it easy to provision a TLS cert to a private domain (e.g. nick-unifi.summerwind.local, which is what the server would ordinarily DNS by).

To do this, it was a bit of a kludge:

  1. Provision a routable domain name e.g. nick-awesome-unifi.example.org and set up DNS properly.
  2. Get a certbot certificate — set up Apache and certbot to do their magical handshake thing.
  3. I found someone who had written a handy script to slurp the Let’s Encrypt cert into Unifi, which I ran.
  4. Provision a local DNS entry such that your ordinarily public domain resolves to a local IP.

Thus the magic: your Unifi server will now sign requests on the local network under a public domain with a valid TLS certificate.

Provisioning a suitable hostname

Head on over to your DNS provider/server for a valid domain, and then set the IP there to match your public IP.

Set up forwarding through your NAT router on 80 and 443.

Then you should be able to (from outside your LAN) reach a web server.

Set up Apache

You’ll want to install apache and openssl and all the related bits. Make sure at this point you can reach the Apache server and get the test page.

Set up Certbot

I used snap to install certbot, and then ran certbot, providing it with the public domain as ready.

Run Unifi slurp script

You’ll need to modify a few of the parameters (I run Ubuntu locally, so uncomment those lines and change it to let’s encrypt mode.

Set up local DNS resolution for the public domain

This was made a little bit more annoying by my recent adoption of a Unifi security gateway as my primary router. The EdgeRouter line had a handy CLI and config tree that allowed you to easily set static mapping of domain names to IP addresses. However, although the USG has the same command line interface, it is apt to be re-provisioned by the controller at any time which will overwrite the configuration if you do it through the CLI.

The correct way to configure these options (that are not available in the CLI) is to set a special config.gateway.json file with your extra options. This file (on Ubuntu) goes in /usr/lib/unifi/data/sites/default/config.gateway.json (I had to create the ./sites/default directories), and then dump the following into the file:

    "system": {
         "static-host-mapping": {
             "host-name": {
                  "nick-awesome-unifi.example.org": {
                       "inet": [

Then head on over to your Unifi setup, navigate to Devices, your gateway, then gear menu and click “force provision” in the side bar:

Lower box there, under “Devices” => Your router => Gear menu

After this miraculous series of steps, try to execute a dig on your local network:

nickandre-macbookpro:~ nickandre$ dig nick-awesome-unifi.example.org

; <<>> DiG 9.10.6 <<>> nick-awesome-unifi.example.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62867
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

; EDNS: version: 0, flags:; udp: 4096
;nick-awesome-unifi.example.org.	IN	A

nick-awesome-unifi.example.org.	0	IN	A

;; Query time: 139 msec
;; WHEN: Thu Aug 27 15:54:12 PDT 2020
;; MSG SIZE  rcvd: 64

And you should get something like that. I had to wait a short while for my DNS cache in my browser to expire (I always set the TTL to like 600 for this reason) and then I was able to access unifi over TLS.

Now go ahead and set up Unifi for TLS splash page under Settings => Hotspot => Advanced. I checked:

  1. Use secure portal
  2. HTTPS redirection
  3. Redirect using hostname (fill out your public domain)

Then you should be good to go! Make sure to set up renewal and the crontab for the cert.

Consolidated Communications & Frontier ADSL DMT Static IP setup

I’m currently rocking it at the family beach house in Scarborough Maine, serviced by the glorious new cable conglomerate Spectrum. They have now deployed faster internet speeds in the area, offering up to gigabit plans on DOCSIS 3.1 (I believe).

Recently though they had a 12 hour outage where the entire beach lost TV and internet. That was a bummer (everyone was wandering aimlessly about outside in tears). So I went out in search of an additional ISP to achieve redundancy.

RedZone wireless has acceptable reviews, but unfortunately they were unable to offer service to my address due to land obstruction.

This left Consolidated Communications, which still offers DSL service in the area. They’re now offering (in my area) 1.5 mbps DSL service without a phone line (life pro tip: disable ad blocker to query service for your address) for ~$23.79/mo, which seemed acceptable for a backup option, particularly to keep the IoT devices running if we want to cancel Spectrum over the winter, etc. I also had the pleasure of working over DSL service on Vashon Island outside Seattle, and it’s doable.

Configuring the DSL modem

Configuring DSL modems in static IP mode is apparently somewhat of a lost art (the tech spent literally hours on the phone trying to find the one person at the support center who still knew how to do this setup).

First note: in my location, Consolidated has a positively vintage ADSL setup which negotiates as ADSL_G.dmt. As far as I can discern, DMT is a more noise resistant mode of DSL that is limited to 8 mbps / 1.2 mbps or so. For negotiation, they’ve provided me with a static IP service. It does not use PPPoE or any such magic. Do not select PPPoE or PPPoA as it will not function or negotiate.

The simplest configuration:

  • Set the modem to ATM mode.
  • Enable modem “bridge” feature.
  • Connect computer to LAN port (with Trendnet; sometimes WAN on others like ZyXEL?)
  • Open up your computer’s (or router’s) IP settings, and provision the address they provide into the IP settings. I’m in 64.222.XXX.XXX/24 with a router at the .1 address.
  • Once you do this, your computer will route.

If the router supports IPoE, you can configure the same IP address, subnet, and default gateway into the router. However, not all DSL modems from the modern era seem to support this static IP mode.

Other miscellaneous settings (most default):

  • UBR without PCR service category
  • LLC encapsulation mode
  • VPI 0, VCI 35 (both default)
  • I believe you can enable a VLAN on your router and set the same VLAN on your router (will test)
Trendnet ADSL DMT bridge configuration

Choosing a modem

ADSL2 modems are getting hard to find. Consolidated offered to sell me one for $160 or rent for like $12/month, which seemed absurd. I attempted to buy my own, but the router I bought does not support IPoE, however any router can be used in bridge mode to a different router.

TrendNet AC750 Wireless VDSL2/ADSL2+ modem

I purchased a TrendNet AC750 Wireless VDSL2/ADSL2+ modem off of eBay. I ran into two problems with this modem:

  • No native IPoE support for DSL, so it will only work in bridge mode.
  • For some unknown reason, the noise figures on this router are far inferior to the ancient dinosaur router the tech installed (attainable rate was something like 3700 kbps as opposed to 9352 kbps on the Comtrend).

Comtrend AR-5319

The installation tech found this dinosaur somewhere in the truck. It supports IPoE and negotiates to 9352 kbps attainable rate, which would allow me to order their 3mbps service. However, the management UI has a “security check” requesting I solve a CAPTCHA which reappears every 30 seconds, which makes using the config UII maddening.

ZyXEL C1100Z

A more modern router that I just ordered on eBay. Hopefully this will get me:

  • A UI that doesn’t make me want to kill myself.
  • Higher negotiated rate.
  • Bridge mode.

I assume it doesn’t support IPoE config.


With the new rate plan ($24/mo without phone service for DSL in Maine) I think that this service offers a compelling Plan B internet for your residence. The config is a bit of a nightmare, so I hope this article explains what I could not find with the google XD


Interestingly when trying the Trendnet I get a higher SNR but also higher attenuation:

Comtrend stats page shows 40.5 dB attenuation w/ 20.1 dB SNR
Trendnet shows 52.5 dB attenuation but 27 dB SNR; much lower attainable rate.

Same phone wire and everything…maybe I will check with the ZyXEL and report back.

Chevy S10, Blazer, GMC Sonoma hunting, high hanging idle while moving fix

This post has been updated 4/20/20 after I replaced the throttle body.

I recently acquired a 2000 GMC Sonoma for the princely sum of $1900, which came with a few $1900 car problems.

The most annoying of which for actually driving the vehicle was a really weird hanging and hunting idle behavior. The following things would happen:

  • When I got the vehicle, I noticed the idle would jump up to 1800 RPM sometimes while driving with clutch out. When the wheel speed got low enough, it would drop back to normal.
  • I cleaned the throttle body and it got worse.
  • I replaced the IAC and it got worse. The idle would sometimes hang at 1800, 2000, or even 3000 RPM while operating the vehicle. Once the vehicle slowed down the idle would return to ~700 RPM.
  • The idle would hunt while I was driving with clutch in or in neutral, with spark timing varying wildly between 0 and 35 degrees while the RPM oscillated. This happened especially when the engine was hot-started and the Intake Air Temp sensor was heat soaked. I have a video showing this behavior on the HPTuners readout.
  • The idle was high even with the IAC fully extended (reading 0 units on the scan tool).

I believe this applies primarily to the 2000 and earlier model year vehicles but may apply to later ones as well (there is different software and compensation tables on 2001 and up).

After spending $700 on various tuning implements (GM Tech 2 and HPTuners software and dongle), reading out data, learning the ins and outs of the GM PCM control algorithms in the 2000 MY vehicles, I have figured out what the hell is going on.

The TL;DR Fix

This issue is caused by an IAC that isn’t behaving to spec, which seems to be an IAC reading ~60 counts on a Tech 2 with the following conditions:

  • Engine Coolant temp normal and the engine/oil is fully warmed up
  • Idle at 650 RPM
  • Spark timing 17-19 degrees

To fix this, you need to;

  • Back out the throttle plate stop screw all the way and check the IAC count. It should be >60 counts. If that doesn’t work:
  • Check for a vacuum leak which results in the IAC being fully extended at idle. Plug the PCV hose with a screw wrapped in electrical tape, cap the vacuum nipple that runs to the brake booster, check the intake manifold, check the seals after the MAF and the throttle body shaft.
  • If everything looks normal vacuum-wise but your IAC is still reading lower, you need to swap the IAC for an OEM part. Non-OEM parts seem to have a different ratio of IAC to counts to airflow, and the GM PCM has hard-coded values for IAC park position and ratio of IAC counts to % airflow. The easiest way I found was a junkyard throttle body with IAC and TPS still attached for $40 shipped on eBay, and I contacted the seller first to confirm there was no play in the shaft.

The GM PCM is not prepared for an IAC value out of spec and goes haywire due to a few causes which I’ll talk about later. You need to adjust the system until you get the IAC to read about 60 counts in park/neutral with RPM at 650 and engine up to temperature and the problem should vanish.

The long-winded version:

Step 1: Double check for Vacuum leaks:

  1. Plug the PCV valve hose with a screw wrapped in electrical tape. I dropped 150 RPM when this was plugged.
  2. Plug the vacuum nipple that drives the brake booster and check for difference in idle. I did not notice a difference in idle speed after I did this, indicating that there was no vacuum leak in the brake/transfer case/climate control system. Also, check the climate control holds in the defrost position after you turn off the vehicle. If everything is functioning properly, there is a check valve that prevents the vacuum from leaking out of the vacuum cylinder.
  3. Maybe replace decrepit vacuum lines that look sad.
  4. Worn throttle body can let air in through the shaft. Double check for that, replace, and/or slather the shaft with grease on the outside. You’ll need to peel the spring back. I ended up just ordering a junk yard part on eBay which came with an OEM IAC and TPS bolted in.
  5. You can create a DIY smoke machine. Pump smoke into the vacuum nipple below the PCV valve and see where smoke comes out. Could be intake manifold etc. Also worth pumping smoke in after the MAF (you can use a nitrile glove with the finger cut off to pump smoke into the intake hose; just wrap the wrist around the hose and use the finger with a rubber band or hose clamp around the smoke hose).
  6. Double check the seal around the plastic throttle body adapter piece that connects to the intake hose. Slather with grease if that’s leaking.

Step 2: Back out the Throttle Body screw until the IAC has some wiggle room

Using a scan tool you can check the IAC position. Supposedly the IAC should be close to 60. The problem got better when I got the IAC to 30 and I started to notice difficulty starting the vehicle while hot once the IAC got to 76 counts at idle. The GM PCM seems to expect a certain behavior of the IAC — the “park position” is hard coded based on engine coolant temp in the PCM, so

  • if you adjust it too low you get a large flare up (1500-2000 RPM) at engine start and then it ratchets down once the PID feedback control kicks in.
  • If you adjust it too high the engine will not be getting enough air right after you start it when the ECT is at operating range. The result is a slow start when engine is up to temp.
  • If the throttle plate screw is dialed in, the IAC runs out of space to lower the idle it causes the GM PCM to compensate with spark timing.

FYI — cleaning the throttle body can make the “previous owner adjusted the throttle plate screw to compensate for a failed IAC issue” worse since it can allow more air to seep in for a given screw position. Clean the TB before you adjust the screw, then adjust the screw back to close the plate.

Step 3: high quality IAC, double check MAP and MAF

I’m not sure if this is important, but using a $7 IAC from eBay made this behavior worse. Switching to a $100 IAC from a reputable brand resulted in less problems. An OEM IAC from the junk yard seems to be the best bet since the PCM can’t compensate for different IAC count-to-airflow ratios.

Also make sure there aren’t leaks in the intake hose or on the other gaskets.

Double check the MAP and MAF report reasonable values.

The full story

As best I can discern the problem in my vehicle was caused by:

  1. There was an issue with the IAC which limited its motion.
  2. The previous owner adjusted the TB screw such that the car would idle more or less normally with the limited IAC range.
  3. This confused the computer and resulted in some of the high idle behavior (more detail below).
  4. I noticed this behavior and tried to fix it. The first recommendation for high idle is sticky throttle plate, so I cleaned the throttle body. This allowed more air through and raised the idle, making the problem worse.
  5. I brought it to a shop, which noticed the IAC code but noticed that the problem got even worse when the IAC was replaced.
  6. I carried on futzing with it, reading out more data, getting traces from the tuner chip, noticing the PCV was leaking a bit. etc. Finally realized I could adjust the TB screw.
  7. Using different brand IACs has different results. OEM IAC seems necessary.

What’s the stupid PCM doing and why does it react like this

As far as I can tell, several things contribute to the weird behavior when the GM PCM is operating out of range:

  1. When the PCM cannot reach idle at full IAC extension, it starts to perturb the spark timing in order to lower the RPM further. The timing advance should be like 17-19 degrees at idle but it can be reduced if the idle is offset. Ordinarily, the intent is that the spark timing could be used to refine the speed on quick intervals, but when the IAC runs out of room that will result in more or less permanent degree shifting. So the result is that at normal spark timing the idle will be quite high even if the PCM can get the idle closer to correct with spark tweaking.
  2. Hanging idle: The GM PCM cannot deal with weird IAC count to airflow ratios. As a result, in some regions of its operation it will hang the idle. I’m not entirely clear as to why this happens, but it may have something to do with the fact that the GM uses hybrid MAF and VE mode which it will toggle back and fourth between. It also uses different cells of operation on dynamic airflow depending upon the throttle position and whether the PCM thinks it’s in idle mode. If the GM PCM doesn’t think it’s in idle, it won’t enter the idle cell #2. See the HPTuners documentation on GM Dynamic Airflow calculations. (cached pdf)
  3. Slow decaying idle: The PCM in the 2000 Sonoma has a “throttle follower” feature designed to more gently lower the throttle. Under normal circumstances: if you are accelerating, the IAC valve opens proportionally to the RPM to let more air in given a fixed set of tables it’s programmed with. However, the fact that the IAC is regulated proportional to the RPM and totally ignorant of the throttle position sensor (TPS) means that it can be unstable. So it adds 75-120 counts of air relative to 0, the spark timing is back to “normal” and the result is that the idle can hang since the IAC opening of 100 counts is sufficient to hold the engine at 2000+ RPM where it’s programmed to open 100 counts.
  4. Hunting Idle Spark: the computer appears to be swapping back and fourth between the idle spark table and the main spark table. The result is that the spark flies from 35 down to 0. The logic here is a bit weird, but it seems to be a follow-down effect from the computer being confused about whether the car is at idle when the IAC is open to 100+, the throttle is closed, but the vehicle is moving quickly. During my recording, the IAC never closed but the spark timing kept jumping around.
  5. Hunting idle MAF vs VE?: The GM PCM uses a hybrid VE and MAF mode, switching between the VE mode and MAF mode. Volumetric Efficiency (VE mode) uses Intake Air Temperature (IAT) sensor, engine RPM and volume, and the Manifold Absolute Pressure sensor to calculate fuel. MAF mode relies on the Mass Airflow sensor to provide an absolute airflow amount to calculate required fuel. When the IAT is heat soaked (reading very high because the car was parked with a hot radiator that heat up the IAT sensor from the outside of the hose), the VE calculation will be thrown off. During some conditions, it would appear that the PCM switches between the modes and oscillates between them. I believe this is related to the hanging idle problem. In particular, the GM 2000 and earlier PCM appears to compensate poorly for the heat soaked IAT. Some people have relocated their MAP sensor to the intake manifold or another region where it will not be heat soaked as easily. It may be possible to swap in a later PCM but that might require shenanigans.

Note: the GM troubleshooting tool does mention the Throttle Body adjustment screw. But it was confusing because you’re not ordinarily supposed to adjust it.

Anyways, feel free to drop me a comment if this works/doesn’t work for you.

Fixing the slowly decaying idle

The GM PCM is programmed with a rather slow decay on the throttle follower and a high airflow to hold the IAC open while the engine is operating. Basically:

  1. User is holding the accelerator down.
  2. The IAC opens proportional to the RPM.
  3. User releases the throttle.
  4. The IAC is programmed to decay slowly to prevent backfire etc.

This behavior can be considered annoying. Additionally, this PCM has a higher value while the vehicle is in gear to keep the driveshaft from clunkying when you release the accelerator. The result is much less engine braking in some circumstances.

To tune this away, I’m going to try:

  • Equalizing the “In Gear” and “Neutral” throttle follower tables.
  • Doubling the decay rate of the throttle follower.
  • Perhaps also decreasing both throttle follower tables by 25% or so to start.

I’ll report back when that’s done.

Goal Zero Yeti Local WiFi REST API

Update: Goal Zero generously provided me with a Postman file to show all the routes supported by the Yeti. I’ve added info on that to the bottom.

I have acquired a new Goal Zero Yeti 3000 and was curious how to use its WiFi functionality for evil. The app is acceptable, but I’ve discovered you can query the local REST API using some glorious wireshark monitor mode.

Basically, hit http://GOAL_ZERO_IP/state. GET returns:

"thingName": "yetiXXXXXXXX",
"v12PortStatus": 1,
"usbPortStatus": 1,
"acPortStatus": 1,
"backlight": 1,
"app_online": 1,
"wattsIn": 245.3,
"ampsIn": 21.9,
"wattsOut": 161.3,
"ampsOut": 14.4,
"whOut": 3682,
"whStored": 2070,
"volts": 11.2,
"socPercent": 69,
"isCharging": 1,
"timeToEmptyFull": 681,
"temperature": 30,
"wifiStrength": -37,
"timestamp": 317529,
"firmwareVersion": "0.7.2",
"version": 2

and POST can be used with this JSON:

POST /state HTTP/1.1
Content-Type: application/json
User-Agent: YetiApp/1340 CFNetwork/1125.2 Darwin/19.4.0
Connection: keep-alive
Accept: application/json
Accept-Language: en-us
Content-Length: 19
Accept-Encoding: gzip, deflate
Cache-Control: no-cache

and the payload to turn off USB:


Or to set the 12V port:


Or you can set all 3 states at the same time:

"acPortStatus": 1}
  • In direct connect mode, it creates a WiFi network and the phone queries its HTTP server at /state. GET returns status and POST can be used to change settings.
  • In remote mode (called “anywhere connect”), it joins your network and phones home to AWS _but_ it can still be queried over the local HTTP server.

Also some other routes:

GET /sysinfo HTTP/1.1
Accept-Encoding: gzip, deflate
Accept: application/json
User-Agent: YetiApp/1340 CFNetwork/1125.2 Darwin/19.4.0
Accept-Language: en-us
Cache-Control: no-cache
Connection: keep-alive
{ "name": "yetiXXXXXXXXX", "model": "Yeti 3000", "firmwareVersion": "0.7.2", "macAddress": "XXXXXXXX", "platform": "esp32" }
POST /join-direct HTTP/1.1
Content-Type: application/json
Content-Length: 0
Connection: keep-alive
Accept: application/json
User-Agent: YetiApp/1340 CFNetwork/1125.2 Darwin/19.4.0
Accept-Language: en-us
Cache-Control: no-cache
Accept-Encoding: gzip, deflate

When queried on my laptop, returned:

{ "name": "yetiXXXXXX", "model": "Yeti 3000", "firmwareVersion": "0.7.2", "macAddress": "XXXXXXXX", "platform": "esp32", "state": {
  "thingName": "yetiXXXXXXXX",
  "v12PortStatus": 1,
  "usbPortStatus": 1,
  "acPortStatus": 1,
  "backlight": 1,
  "app_online": 1,
  "wattsIn": 229.6,
  "ampsIn": 20.5,
  "wattsOut": 142.2,
  "ampsOut": 12.7,
  "whOut": 3743,
  "whStored": 2100,
  "volts": 11.2,
  "socPercent": 70,
  "isCharging": 1,
  "timeToEmptyFull": 552,
  "temperature": 30,
  "wifiStrength": -39,
  "timestamp": 319152,
  "firmwareVersion": "0.7.2",
  "version": 2
} }

Other Routes from Goal Zero

Quick summary

  • GET /sysinfo – gives system info from the ESP32
  • POST /factory-reset with “{}” body does a factory reset
  • GET /rpc/Sys.Reboot will trigger a reboot

GET/POST to /loglevel

  "app": 3,
  "ota": 3,
  "ota_cleanup": 3,
  "mqtt": 3,
  "mqtt_shadow": 3,
  "mqtt_jobs": 3,
  "yeti": 4,
  "wifi": 3,
  "http_server": 3,
  "http_client": 3,
  "main": 3,
  "uart": 3,
  "pic_btldr": 3,
  "chain": 3,
  "sys": 3

POST to /join to join the wifi

"wifi": {
"name": "NetworkName",
"pass": "Password"
"iot": {
"env": "prod",
"hostname": "a1xyddj5i8k7t5-ats.iot.us-east-1.amazonaws.com",
"endpoint": "https://yeti-prod.goalzeroapp.com/v1/thing"

GET to /wifi to show the available wifi networks the GZ can see

    "NickPixel": {
        "db": -38
    "networky-saved": {
        "db": -43,
        "saved": true
    "something-else": {
        "db": -67

POST to /password-set to change the Yeti password

"new_password": "ABCDEFGH"

POST to /join-direct to join direct (not clear exactly what this does when in cloud mode)

POST to /start-pair again, not clear exactly what this does

Note: when I POST to /state the yeti began sending its network again but is still joined to the main WiFi network. Not sure if there’s a good configuration for local network only without IoT phone home feature.

Motorola Iridium 9570 Portable Dock Pinout

The Motorola 9570 is a portable speakerphone dock made for the Motorola 9500 Iridium phone, and it was also available with an adapter for the 9505 phone. It could fit two batteries for battery backup operation, which is cool.

Unfortunately, there was no power connector pinout available, but I managed to track down a power supply (SPN4645B) and measure the voltages.

Looking at the connector like this:

the potential difference between the left and middle connector is +2.25V, and the potential difference between the left and right is +4.55V.

This doesn’t make very much sense since the PSU lists:

Output: 4.4VDC 3.6A : 6.5 VDC 2.5A

Which suggests that this PSU has voodoo magic going on inside it.

May crack in open and take a look…

Reverse Engineering Motorola Iridium 9505

I’ve started taking apart a Motorola 9505.

As I noted in a previous post, upgrading the firmware in the 9505 (not the 9505A) is very difficult to impossible.

I was looking into the possibility of a DIY, but it’s looking a bit difficult. Some bits I’ve found out about the 9505:

  • Uses a custom ASIC from Atmel, the at56406
  • Several custom Motorola parts
  • Exposes a FFC on the rear for debugging similar to the Motorola 9500
  • Has a ton of what appear to be debug pads on the main circuit board that are covered with tape.
RF parts from Raytheon seem mostly identical to the 9500.

May try to get a JTAGulator hooked up to this and see what I can see.

From here:
*#06# IMEI
*#300# software versiom
*#301# keypad functions
*#303# set defaults
*#304# engineering mode
19980722 Ok master unlock code