• SkyExtenderDissection

SkyPilot SkyExtender Dual Band

In August 2009, we received some SkyPilot SkyExtender DualBand devices from the City of Portland to evaluate for possible re-use. One of them was dismantled and an investigation ensued. Over the next few months, 11 more SkyExtenders were received from the City of Portland, for a total of 12. More recently, we've been working on getting access to a SkyPilot SkyGateway. A gateway device is required in order to try to use the stock SkyPilot firmware.

Last Spring, SkyPilot was acquired by another company, Trilliant. Since August, the websites were integrated and the SkyPilot forum was taken offline.

Mechanical

We received the SkyExtenders with PowerOverEthernet injectors, Street Light Power Tap cords and mounting hardware intact.

DualBand Exterior Disassembly

From memory, please FIXME next time we have the opportunity to disassemble one.

• Remove the nuts from the threaded rods, freeing the lower bracket
• Remove bolts holding the upper bracket to the foot of the mounting mast
• Remove screws holding the access panel cover in place on the bottom of the bezel
• Disconnect the cat5 inside the access panel
• Replace the access panel cover, turning the screws back in
• Cut zipties holding the cat5 to the mounting mast
• Remove the nuts holding the PoE injector to the platform near the base of the mounting mast, and once loose, replace the nuts on the bolts for safekeeping
• Remove the electrical tape and coax-seal from the omni-directional antenna connections
• Unthread the omni-directional antennas
• Remove the bolts holding the top flange of the mounting mast to the bezel
• Replace the bolts in the bezel for safekeeping

Disassembed Exterior Components

• SkyExtender DualBand Main Body
  This is the enclosure where all the smarts reside. It consists of a tapering cylinder approximately 24" tall, slightly over 12" in diameter at the base and about 9" in diameter at the top. The bottom is a heavy aluminum bezel with a weather-sealed cover for the cat5 entry and also exposing a serial port and two bulkhead mounted N-female connectors protruding downward. Most of the cylinder consists of a radome covering the sectorized mesh backhaul antenna array.

• Mounting mast (two length variants)
  • tiltable base, 4-3/4" wide, 5-1/4" long
  • 1-1/4" outside diameter mast, with an overall height of either:
    • 20"
    • 6"
  • circular top flange, ~4-1/8" diameter, with 9/32" holes in a 2-3/8" square pattern
• Other Mounting Hardware
  • Mounting brackets
  • Bolts
    • 4 x (S30400 ABP) 1" length (9/16") hex-head 3/8-16, attaching mounting bracket to mast base (with one lock washer each)

    • 4 x (S30400 THE) 3/4" length (7/16") hex-head 1/4-20, attaching mast top flange to SkyPilot (with one lock washer each)

  • Nuts:
    • 12 x 3/8-16 nuts (3 per rod, sometimes fewer)
  • Threaded rods
    • 4 x 12" length 3/8-16
  • Washers (odd numbers, the count here is over approximately 11 skypilots)
    • flat
      • 42 x 7/8" OD
      • 20 x 3/4" OD
      • 3 x 5/8" OD
    • lock 80 x 43/64" OD (probably two per threaded rod)

• 2.4 GHz omni-directional antennas (two length variants)
  Two variants of the antennas were found, both N-male-terminated Comet 7.5 dBi omnis:

  • with vertical symmetry, about 17" overall length, there were found on the 20" tall masts
  • with 12-degree uptilt, SF245G+12X-S, about 24" overall length, found on the 6" tall masts

• PowerOverEthernet enclosure with cat5
  

  The PoE injectors enclosures, Bud ~6-5/8" x 4.75" x 2-1/8", mount onto a base flange of the mast with two bolts drilled through the middle of the large face and sealed with large washers and sealant. Cat5 and power cables enter though glands on the small edge face. The interior of the enclosure holds a "Mean Well" S-25-24 AC-DC converter, supplying +24V on the blue pair of the cat5 and Ground on the brown pair, made in Taiwan.
  If one wishes to convert the injector from Street Light Power Tap to conventional wall AC input, the practical thing to do is to unscrew the terminals inside the enclosure and remove the Street Light tap intact. Standard AC power cords can be cut off and wired into the now-empty screw terminals.

• ANSI C136.10 Street Light Power Tap and cord
  This is a connector for attaching to the standard street light coupling provided for daylight sensors. The power tap has three poles: line, neutral and load. When the sun goes down, the light sensor closes a switch and connects the line to the load. Other devices can connect directly to line and still pass the light sensor load pole on through. In this way, a light sensor can be removed, the tap placed on the street light, and the light sensor replaced on the tap and normal light sensor function maintained while simultaneously extracting power from the 110V AC. The coupling locks in place by twisting. A foam seal prevents water infiltration. The Power Taps are ~$100 to buy new and may have some resale value.

DualBand Interior Disassembly

Disassembly of the main body proceeds as follows (provisional, from memory, pending confirmation):

• Loosen the hex nut retaining screws on the two N-female connectors.
• With the main body placed thin-end down, remove 8 phillips head screws around the edge of the radome.
• Gently lift the bezel and attached antenna array out of radome.
• Loosen two screws at the top holding a bracket over a square GPS patch antenna (has an odd dot of solder in the middle) and free the GPS antenna, then replace the bracket and screws for safe keeping.
• Remove screws holding the antenna array to the bezel. Various cables will prevent them coming far apart.
• Unplug the ribbon cable from the lower board attached to the bezel.
• While not damaging the cables by pulling excessive, carefully moving the antenna array successively aside, remove 3 screws from the upper board screwed to the bezel, the upper board can be pulled loose from three pin header blocks from the board immediately beneath it, allowing the 802.11a radio to be reached and the u.fl antenna connector to be gently disconnected.
• Disconnect the u.fl connector from the GPS unit on the lower board still attached to the bezel, and gently pull the thin coaxial cable through the body of the antenna and set the GPS antenna aside.
• Disconnect the short section of cat5 network cable between the lower board and the Peplink board still attached inside the antenna array.
• Remove remaining screws from a ring plate inside the bezel and from the lower board.
• Finish detaching the N-female connectors from the bezel. The antenna array should be free now.
• Hmm. When does the ribbon cable get pulled from the rf ferrite choke?
• If possible, carefully reach inside and disconnect the coaxial cables from the radio on the Peplink board.
• From the antenna array, remove three screws that hold the clear plastic bottom plate to the hex rods. This will allow the plate (with the ferrite choke) to be detached, but also for all the antenna edges and reflectors to come loose.
• Reach in and gently remove the white coaxial cable from the antenna selector board at the middle of the antenna array.
• Spend the next 5 minutes (if you are lucky or in good practice) trying to align all 8 reflector sections and 8 antenna edges simultanously while seating the clear plastic bottom plate in place on the hex rods and replacing the 3 screws. Don't be surprised if there is some cursing here.
• Remove 4 screws holding the Peplink board to the metal plate.
• Remove the Ubiquiti SR2 radio from the Peplink board.

Disassembled Interior Components

• GPS Antenna and attached coaxial cable ending in a u.fl connector
• 5.8 GHz antenna array with antenna selector board
• Peplink WINTI board

• SkyPilot's custom PPC board, logically one board, but physically two boards, which controls the mesh backhaul radio and antenna selection, also holds a Trimble GPS unit.

• Ubiquity SR2 400 mW 802.11b/g radio

• Atheros-based a/b/g radio for the 802.11a mesh backhaul (using special SkyPilot drivers for TDD communications)

• N-female bulkhead to u.fl pigtail (connects to the SR2)
• N-female bulkhead to MMCX pigtail (connects to the SR2)
• 1-foot length of cat5 cable (connects the skypilot-custom board to the Peplink board)
• Screws
• Washers

Non-mechanical

SkyPilot Custom Board

Serial Console

There are two RJ45 connectors accessible under the access plate, connecting to the SkyPilot custom board. One is for the PowerOverEthernet, and the other (pointing perpendicular to the plane of the bezel) is a connector for the serial console. The serial parameters are 38400 bps, 8 data bits, no parity, one stop bit, no flow control. The pinout is as follows (source: Installation Guide page 50):

1. Not connected (white/orange)
2. Not connected (orange)
3. TxD (white/green)
4. GND (blue)
5. Not connected (white/blue)
6. RxD (green)
7. Not connected (white/brown)
8. Not connected (brown)

Once restored to factory defaults (see "Password Recovery"), the password should be "public".

Password Recovery

All of the device we have received are from the defunct network abandoned by MetroFi. MetroFi left behind the devices without informing anyone of passwords necessary to access them for administration. According to a helpful person (username: salad) on the SkyPilot forums, the SkyPilot devices can be reset to factory default settings by logging in over the serial console with the password "!!!skypilotfactory!!!" or "!!!skypilotreset!!!" or something similar (when a working one is confirmed, please FIXME, thanks!).

PePLink WINTI03 Board v2.5

All but one of the five skypilots that have been dismantled so far have been the v2.5 version. The other, labelled v3.1, includes two ethernet connectors and a somewhat different layout. This description is for v2.5. The board is based on the Micrel/Kendin KS8695PI chip (the "I" stands for Industrial, supporting a wider temperature range of operation). It has an ethernet port, a mini-PCI slot, 16 megabytes of Flash storage (on two 8 meg chips) and 32 megabytes of SDRAM.

• J1 is a two-pin header for a reset switch
• J23 is 1x9 pins for JTAG (it comes without pin-headers, so you'll need to solder some in):
  1. VREF
  2. TRSTN
  3. TDI
  4. TMS
  5. TCK
  6. TDO
  7. SRSTN
  8. Not connected
  9. GROUND
• J4 is a 2x5 pin header
  1. N/A
  2. N/A
  3. N/A
  4. N/A
  5. TX
  6. RX
  7. N/A
  8. N/A
  9. GROUND
  10. N/A

• U17 is a TexasInstruments LV08A AND gate array, numerous inputs attached have pullup resistors. The apparent function is to combine various reset signals, on their way to the CPU. A tiny 4-pin chip marked only APRR (apparently GROUND, VCC, IN and OUT) in tied up in the chain of AND gates. Speculation is that it's either a static discharge protection for the CPU or perhaps a delay device.

• U18 (on the side with the CPU) is a SOIC-20 (or very similar) package, has a sanded off top in 3 of 4 instances of the board we have seen, but on one is labelled as "PePLink PL-2302" with a silly dog logo. Despite the similar part number, it does not appear to be Prolific PL-2302 (USB Network Bridge) as that is a 28-pin part.
  1. ??
  2. ??
  3. ??
  4. ??
  5. GROUND
  6. GROUND
  7. ??
  8. ??
  9. ??
  10. ??
  11. ?? 10k resistor (connects to H15 (GPIO4/TOUT0) on the CPU)
  12. ?? 10k resistor (connects to H14 (GPIO5/TOUT1) on the CPU)
  13. ?? 10k resistor
  14. ?? 10k resistor
  15. VCC
  16. VCC
  17. one side of Y2, a 32768Hz oscillator (it doesn't seem to oscillate??)
  18. other side of Y2
  19. ??
  20. ??