SkyPilot SkyExtender Dual Band
In August 2009, we received some SkyPilot SkyExtender DualBand devices from the City of Portland to evaluate for possible re-use. One of them was dismantled and an investigation ensued. Over the next few months, 11 more SkyExtenders were received from the City of Portland, for a total of 12. More recently, we've been working on getting access to a SkyPilot SkyGateway. A gateway device is required in order to try to use the stock SkyPilot firmware.
DualBand Exterior Disassembly
From memory, please FIXME next time we have the opportunity to disassemble one.
- Remove the nuts from the threaded rods, freeing the lower bracket
- Remove bolts holding the upper bracket to the foot of the mounting mast
- Remove screws holding the access panel cover in place on the bottom of the bezel
- Disconnect the cat5 inside the access panel
- Replace the access panel cover, turning the screws back in
- Cut zipties holding the cat5 to the mounting mast
- Remove the nuts holding the PoE injector to the platform near the base of the mounting mast, and once loose, replace the nuts on the bolts for safekeeping
- Remove the electrical tape and coax-seal from the omni-directional antenna connections
- Unthread the omni-directional antennas
- Remove the bolts holding the top flange of the mounting mast to the bezel
- Replace the bolts in the bezel for safekeeping
Disassembed Exterior Components
SkyExtender DualBand Main Body
This is the enclosure where all the smarts reside. It consists of a tapering cylinder approximately 24" tall, slightly over 12" in diameter at the base and about 9" in diameter at the top. The bottom is a heavy aluminum bezel with a weather-sealed cover for the cat5 entry and also exposing a serial port and two bulkhead mounted N-female connectors protruding downward. Most of the cylinder consists of a radome covering the sectorized mesh backhaul antenna array.
- Mounting mast (two length variants)
- tiltable base, 4-3/4" wide, 5-1/4" long
- 1-1/4" outside diameter mast, with an overall height of either:
- circular top flange, ~4-1/8" diameter, with 9/32" holes in a 2-3/8" square pattern
- Other Mounting Hardware
- Mounting brackets
- 4 x (S30400 ABP) 1" length (9/16") hex-head 3/8-16, attaching mounting bracket to mast base (with one lock washer each)
4 x (S30400 THE) 3/4" length (7/16") hex-head 1/4-20, attaching mast top flange to SkyPilot (with one lock washer each)
- 12 x 3/8-16 nuts (3 per rod, sometimes fewer)
- Threaded rods
- 4 x 12" length 3/8-16
- Washers (odd numbers, the count here is over approximately 11 skypilots)
- 42 x 7/8" OD
- 20 x 3/4" OD
- 3 x 5/8" OD
- lock 80 x 43/64" OD (probably two per threaded rod)
2.4 GHz omni-directional antennas (two length variants)
Two variants of the antennas were found, both N-male-terminated Comet 7.5 dBi omnis:
- with vertical symmetry, about 17" overall length, there were found on the 20" tall masts
- with 12-degree uptilt, SF245G+12X-S, about 24" overall length, found on the 6" tall masts
PowerOverEthernet enclosure with cat5
The PoE injectors enclosures, Bud ~6-5/8" x 4.75" x 2-1/8", mount onto a base flange of the mast with two bolts drilled through the middle of the large face and sealed with large washers and sealant. Cat5 and power cables enter though glands on the small edge face. The interior of the enclosure holds a "Mean Well" S-25-24 AC-DC converter, supplying +24V on the blue pair of the cat5 and Ground on the brown pair, made in Taiwan.
If one wishes to convert the injector from Street Light Power Tap to conventional wall AC input, the practical thing to do is to unscrew the terminals inside the enclosure and remove the Street Light tap intact. Standard AC power cords can be cut off and wired into the now-empty screw terminals.
ANSI C136.10 Street Light Power Tap and cord
This is a connector for attaching to the standard street light coupling provided for daylight sensors. The power tap has three poles: line, neutral and load. When the sun goes down, the light sensor closes a switch and connects the line to the load. Other devices can connect directly to line and still pass the light sensor load pole on through. In this way, a light sensor can be removed, the tap placed on the street light, and the light sensor replaced on the tap and normal light sensor function maintained while simultaneously extracting power from the 110V AC. The coupling locks in place by twisting. A foam seal prevents water infiltration. The Power Taps are ~$100 to buy new and may have some resale value.
DualBand Interior Disassembly
Disassembly of the main body proceeds as follows (with approximate times):
- Remove 4 hex-head bolts and washers that originally held the bezel to the mounting mast. (0:30)
- Remove 2 hex nuts and washers from the N-female RF connectors. (0:40)
- Remove 8 phillips screws (panhead #8-32 x 3/8") holding the radome to the bezel (using power screwdriver and needle nose pliers). (2:30)
- Lift the bezel and antenna out of the radome, set the radome aside and set the guts down on the bezel end. (0:30)
- Remove 2 phillips screws holding down the retaining plate over the WS3957 GPS antenna, and replace the screws and plate leaving the antenna loose. (1:00)
- Remove 4 phillips screws holding the clear plastic base of the antenna array to the bezel. (1:20)
- Gently moving the loosened antenna array to the side, remove the three screws holding the upper circuit board to the bezel. Gently remove the upper circuit board while detaching the white coaxial cable's u.fl connector from the attached miniPCI radio. (2:10)
- Gently detach the GPS antenna's black coaxial cable's u.fl connector from the lower circuit board and gently pull the antenna and cable up through the antenna array and set aside. (0:30)
- Remove the 6 phillips screws holding the inner metal ring from the bezel, again holding the loosened antenna array gently to the side. Lift the antenna array and gently free the two N-female connectors from the bezel and reach under the lower circuit board and free the short section of cat5 cable. The antenna array section should now be free of the bezel, so set it down on its top. (5:00)
- Remove the 3 phillips screws holding the lower circuit board to the bezel, set the circuit board aside, place the inner metal ring back inside the bezel loose and set the inverted radome on top (the ring will hold the slightly convex radome steady). (1:00)
- With the antenna array inverted, carefully reach in with some diagonal cutters and snip the zipties holding the ferrite choke over the ribbon cable. Use needle nose pliers to remove the cut zipties. Use a small flathead screwdriver the unlatch the retaining clips at the end to release the ribbon cable. (1:00)
- Reach in and remove the short piece of cat5 from the circuit board inside the antenna array. Use a flathead screw driver to release the retaining clip. (0:15)
- Remove three screws that hold the clear plastic bottom plate to the hex rods. This will allow the plate (with the ferrite choke and the attached circuit board) to be detached, but also for all the antenna edges and reflectors to come loose. (1:00)
- Remove the pigtails from the radio card, remove the screws holding the circuit board to the metal plate. Set the parts aside. (1:40)
- Gently reach in and detach the end of the white coaxial cable from the antenna selector board at the middle of the antenna array, by lifting straight up and perhaps twisting slightly. (0:15)
- Next, trying to align all 8 reflector sections and 8 antenna edges simultanously while seating the clear plastic bottom plate in place on the hex rods and replacing the 3 screws. Don't be surprised if there is some cursing here. (10:00)
- Place the antenna array back inside the radome with the foam padded side down and remove the radios from the respective circuit boards put away the various parts. (1:00)
Other panhead screws removed:
- #6-32 x 7/16"
- #4-40 x 1/2"
- #4-40 x 5/16"
- #4-40 x 3/16"
Disassembled Interior Components
- GPS Antenna and attached coaxial cable ending in a u.fl connector
- 5.8 GHz antenna array with antenna selector board
- Peplink WINTI board
SkyPilot's custom PPC board, logically one board, but physically two boards, which controls the mesh backhaul radio and antenna selection, also holds a Trimble GPS unit.
- Ubiquity SR2 400 mW 802.11b/g radio
Atheros-based a/b/g radio for the 802.11a mesh backhaul (using special SkyPilot drivers for TDD communications)
- N-female bulkhead to u.fl pigtail (connects to the SR2)
- N-female bulkhead to MMCX pigtail (connects to the SR2)
- 1-foot length of cat5 cable (connects the skypilot-custom board to the Peplink board)
SkyPilot Custom Board
There are two RJ45 connectors accessible under the access plate, connecting to the SkyPilot custom board. One is for the PowerOverEthernet, and the other (pointing perpendicular to the plane of the bezel) is a connector for the serial console. The serial parameters are 38400 bps, 8 data bits, no parity, one stop bit, no flow control. The pinout is as follows (source: Installation Guide page 50):
- Not connected (white/orange)
- Not connected (orange)
- TxD (white/green)
- GND (blue)
- Not connected (white/blue)
- RxD (green)
- Not connected (white/brown)
- Not connected (brown)
Once restored to factory defaults (see "Password Recovery"), the password should be "public".
All of the device we have received are from the defunct network abandoned by MetroFi. MetroFi left behind the devices without informing anyone of passwords necessary to access them for administration. According to a helpful person (username: salad) on the SkyPilot forums, the SkyPilot devices can be reset to factory default settings by logging in over the serial console with the password "!!!skypilotfactory!!!" or "!!!skypilotreset!!!" or something similar (when a working one is confirmed, please FIXME, thanks!).
PePLink WINTI03 Board v2.5
All but one of the five skypilots that have been dismantled so far have been the v2.5 version. The other, labelled v3.1, includes two ethernet connectors and a somewhat different layout. This description is for v2.5. The board is based on the Micrel/Kendin KS8695PI chip (the "I" stands for Industrial, supporting a wider temperature range of operation). It has an ethernet port, a mini-PCI slot, 16 megabytes of Flash storage (on two 8 meg chips) and 32 megabytes of SDRAM.
- J1 is a two-pin header for a reset switch
- J23 is 1x9 pins for JTAG (it comes without pin-headers, so you'll need to solder some in):
- Not connected
- J4 is a 2x5 pin header
U17 is a TexasInstruments LV08A AND gate array, numerous inputs attached have pullup resistors. The apparent function is to combine various reset signals, on their way to the CPU. A tiny 4-pin chip marked only APRR (apparently GROUND, VCC, IN and OUT) in tied up in the chain of AND gates. Speculation is that it's either a static discharge protection for the CPU or perhaps a delay device.
- U18 (on the side with the CPU) is a SOIC-20 (or very similar) package, has a sanded off top in 3 of 4 instances of the board we have seen, but on one is labelled as "PePLink PL-2302" with a silly dog logo. Despite the similar part number, it does not appear to be Prolific PL-2302 (USB Network Bridge) as that is a 28-pin part.
- ?? 10k resistor (connects to H15 (GPIO4/TOUT0) on the CPU)
- ?? 10k resistor (connects to H14 (GPIO5/TOUT1) on the CPU)
- ?? 10k resistor
- ?? 10k resistor
- one side of Y2, a 32768Hz oscillator
- other side of Y2