Teardown: The router that took down my wireless network

Article By : Brian Dipert

When life gives you a failed router, take the opportunity to tear it apart.

Back in late November 2017, EDN published my hands-on experiences with a mesh Wi-Fi setup constructed of three Google/TP-Link OnHub units. The mesh access points are connected to the common router nexus via wired Ethernet in order to maximize the Wi-Fi channels’ utilization potential for network clients, although wireless “backhaul” is also an available option. The network had actually been in operation since late August of that year, and for the next two-plus years everything was pretty much smooth sailing. One morning last September, however, I woke up to find my wireless network completely MIA.

I suspected that the router itself might have gone awry, and the “red ring of death” indicator atop it (no, not that “red ring of death“) confirmed my suspicion. No amount of factory resetting brought it back to life. Fortunately, I had a spare router in storage, which I pressed into service, although to resurrect the network I had to set it up again completely from scratch.

I realize in writing this that one thing I forgot to mention in my earlier piece about working from home due to COVID-19 lockdowns is to make sure you have spares for all of your hardware; it’s one thing to have the network go down if you’re primarily using it for off-hours purposes, but quite another if you’re depending on it for your continued employment.

With that, I hereby present the deceased (the TP-Link model number TGR1900, to be exact) to you for dissection inspection purposes.

Let’s begin, as usual, with some unboxing shots (perhaps obviously, since the router had previously been in use, I had to re-box it to unbox it again). As you’ll see from the label on the top, it was factory refurbished, and I wasn’t even the original owner; I bought it used from someone on Ebay. So I’m not feeling too badly about its demise ;-).

TP-Link TGR1900 router box on a desk

TP-Link TGR1900 router view of box sides

Slide off the outer sleeve, and you realize that what you might have thought was the top of the router itself is only one of two pieces of introductory literature:

TP-Link TGR1900 router literature from the package

second view of TP-Link TGR1900 router literature

Now for the inner box, which is made of quite sturdy cardboard. Not quite wood, but it might as well be!

TP-Link TGR1900 router unboxing

Here’s a closeup of the overview instructions printed on the inside of the box top, within which the top of the router neatly nestles:

TP-Link TGR1900 router directions inside box

The bottom of the router has its own foam retainer, too, and underneath it are two more boxes, labeled “Power adapter” and “2 Ethernet cables.”

boxes containing TP-Link TGR1900 router power adapter and ethernet cables

Here’s the contents and a closeup of the AC/DC converter portion, so you can see its input and output specs:

TP-Link TGR1900 router power supply

TP-Link TGR1900 router power supply specs

TP-Link TGR1900 router Ethernet cables

Now for the router itself. The TGR1900’s dimensions are 7.5×4.1×4.6 in (190.5×104×117 mm). I’m here showing its backside, revealing the access to the two GbE ports (WAN and LAN), the reset button, the publicly unused (except by hackers that is … it runs Chrome OS, believe it or not!) USB port, and the power input, which you’ll be able to see when we remove the outer shell:

TP-Link TGR1900 router on a desk

Before continuing, some background: Google worked with both TP-Link (first to market) and ASUS on OnHub routers, initially introduced in August 2015 and to which mesh Wi-Fi functionality was later added. The TP-Link and ASUS model feature sets were fairly similar, with a few deviations:

  • TP-Link’s model was wider at the top than at the bottom, had status LEDs at the top, and included a front-located directional 2.4 GHz antenna.
  • ASUS’ version was wider at the bottom, had a single bottom-located status LED, no directional antenna, and supported “wave” gesture control.

Specifically, here’s what Google’s still-live product page reveals about the TP-Link model’s internals:

Google exploded view diagram of the TP-Link TGR1900 router

Keep this conceptual image in mind as the teardown proceeds. TP-Link’s own product page is a bit more specific about the router’s 2.4 and 5 GHz antenna counts and types:

  • 13 high-performance Wi-Fi antennas
  • 1 Bluetooth antenna
  • 1 Zigbee antenna

The router’s rugged plastic outer shell, finned on the inside to help direct heat up and out the top, rotates slightly to unlatch and then lifts off:

removing the TP-Link TGR1900 router outer shell shows fins to direct heat out

It comes standard in both dark blue (mine) and black, and TP-Link even sold standalone custom upgrades (presumably for use in conspicuous spaces; mine was hidden away in the furnace room):

TP-Link TGR1900 router shell options
Here are a few overview shots of the TGR1900 with the shell removed, showing (among other things) its abundant ventilation slots and the aforementioned ports:

TP-Link TGR1900 router front ventilation slots

TP-Link TGR1900 router back ventilation slots and ports

Here’s a closeup of the branding (and more ventilation) at the front and the additional venting at the back:

TP-Link TGR1900 router front vents

TP-Link TGR1900 router back vents

Time to dive inside. I thought I’d start with the underside; here it is, along with a closeup of the FCC certification details:

TP-Link TGR1900 router bottom label

TP-Link TGR1900 router FCC certification

Any time I see a rubber cushion, I look for screws underneath, and I was right again this time, although their removal didn’t actually get me anywhere. Note, however, the second hidden reset button, found by our earlier-mentioned hacker friends:

removing the TP-Link TGR1900 router foot reveals screws

So I turned my attention to the top:

use a screwdriver to remove the TP-Link TGR1900 router top

TP-Link TGR1900 router top cover
TP-Link TGR1900 router top translucent bracket hole

This is encouraging! Note in the above that one of the mounting bracket holes is translucent; hold that thought for a bit.

opening the top of the TP-Link TGR1900 router

parts of the top of the TP-Link TGR1900 router

opening the top of the TP-Link TGR1900 router

Next to go is the translucent plastic ring underneath the top piece. In the first shot that follows, note the prescient “2.4” marketing on the edge of the exposed PCB underneath:

using a screwdriver to pry a plastic ring from the TP-Link TGR1900 router

top of the plastic ring on the TP-Link TGR1900 router

underside of the plastic ring on the TP-Link TGR1900 router

And with it removed, the LED array (with a transducer in the middle) is clearly exposed to view:

TP-Link TGR1900 router LED assembly

Remember that “2.4” marking I pointed out earlier? Here’s another view of the LED-and-speaker assembly, showing one marked “5” (there are six total in a ring around the edge, half of them marked “2.4” and half marked “5”; you’ll see them more clearly soon):

TP-Link TGR1900 router LED and speaker assembly

About that speaker, it’s one of the more notable oddities of the design. With other widgets like these that I’ve published hands-on reports (and, in some cases, teardowns) of before, the initial pairing with a mobile device occurs either over Bluetooth or an ad-hoc Wi-Fi connection. With the OnHub, on the other hand, initial pairing uses an audible audio tone emitted by the router, which the smartphone’s microphone (in conjunction with the Google Wifi app) listens for.

Judging from its looks, the transducer is likely fairly wide-range in its capabilities; had Google and its TP-Link and ASUS partners also included a microphone in the design, we’d conceivably have a fairly robust Home device on our hands (and an aesthetic one, as well, thanks to TP-Link’s shell accessories). Alas, it wasn’t meant to be, I guess.

Digression over; back to the teardown. Removing four more screws, which were identical to the ones on the router’s bottom, allowed me to lift the LED-and-speaker assembly partly away, but I could tell that it was still connected to something deeper inside.

screws removed from the TP-Link TGR1900 router with a penny for size comparison

lifting out the TP-Link TGR1900 router LED and speaker assembly

So I turned my attention to one of the side seams, using the same flathead screwdriver-as-wedge duo that had worked effectively on the top:

using a screwdriver to pry open the seam of the TP-Link TGR1900 router

TP-Link TGR1900 router side seam opened upTP-Link TGR1900 router side seam open

The “egg” has been cracked open!

TP-Link TGR1900 router case opened

Here’s our first peek at the router’s backside insides:

TP-Link TGR1900 router inside overview
Before exploring it further, let’s disconnect some remaining cabling so that we can take a complete look at the top pieces. The flat flex cable from the PCB to the LEDs has already been detached; its connector is in the upper left corner of the PCB.

TP-Link TGR1900 router LED antenna hookup

What’s left is the black-and-white audio wiring pair (which mates to a connector below the massive Faraday Cage on the PCB), along with a standalone black wire (normally tethered to a connector along the left side of the Faraday Cage, below the aforementioned flex cable connector). Remove them and we can now fully separate the various top “sandwich” pieces, which I’ll next show top-to-bottom.

TP-Link TGR1900 router speaker underside

First off is the “congestion” antenna (with a hole in the middle for the speaker’s sound to pass through), which serves the following purpose, from Google’s product page:

OnHub automatically switches channels to maintain the best Wi-Fi signal strength and avoid congestion, without interrupting what you’re doing. That gives you the fastest possible speed for your devices.

And TP-Link’s product page:

Searches every five minutes for the least crowded Wi-Fi channel and will switch if it improves your performance.

TP-Link TGR1900 router congestion antenna

TP-Link TGR1900 router congestion antenna closeup

Next is an elementary piece of plastic, which I’m guessing is intended to isolate the RF antenna above it from the electronics below it:

TP-Link TGR1900 router spacer ring

Below that is the translucent plastic piece, designed to redirect all light coming from below it uniformly out the sides:

TP-Link TGR1900 router transluscent plastic layer

And below that is the speaker, surrounded by the multicolor multi-LED circuitry:

TP-Link TGR1900 router speaker and LED circuitry

Notable semiconductor content here includes two National Semiconductor (now Texas Instruments) LP5523 programmable 9-output LED drivers and, next to one of them, an ambient light sensor. Remember earlier when I noted that one of the top piece’s mounting bracket holes was translucent? The ambient light sensor is why; the translucence allows environment illumination to shine on it, dynamically controlling LED intensity (you can also manually do this via the Google WiFi app).

Before continuing, let’s have a look at the antenna ring that’s now fully exposed to view:

TP-Link TGR1900 router antenna array

If you do a wire count, you’ll note that each of the six antenna assemblies is actually a two-antenna array. There are three assemblies (six antenna total) for 5 GHz:

TP-Link TGR1900 router 5 GHz antenna array

And three/six for 2.4 GHz:

TP-Link TGR1900 router 2.4 GHz antenna array

The one shown above is at the very back of the router; it’s special. Hold that thought for a bit.

Next, let’s get rid of the other half of the enclosure (for orientation purposes, remember that it’s associated with the front of the router). Above the earlier-mentioned Faraday Cage is a black metal bracket; removing it enabled me to get the remaining enclosure piece partway off. However, it was still wire-attached:

TP-Link TGR1900 router retaining bracket

TP-Link TGR1900 router with the front enclosure removed

Here’s a closeup of the remaining intact antenna hookups:

TP-Link TGR1900 router antenna hookups
Disconnect one of them and I successfully completed this part of the mission:

disconnect TP-Link TGR1900 router directional antenna

TP-Link TGR1900 router directional antenna

That’s the “directional” antenna mentioned in the product documentation, which extends across the front of the router. And here’s a sneak peek at the now-revealed PCB frontside:

TP-Link TGR1900 router heat sink

That’s one massive heat sink!

Speaking of antennas, let’s return to the ring atop the PCB; specifically, let’s remove it. Disconnecting the remaining antenna wires, one of them extending partway down the right side of the Faraday Cage, accomplished this task:

TP-Link TGR1900 router Bluetooth Zigbee antenna hookup

disconnect TP-Link TGR1900 router antenna ring

That long wire goes to the aforementioned backside 2.4-GHz antenna assembly. One half of it (i.e. one antenna) seems to handle Zigbee, given its connector proximity to the controller IC I’ll discuss in more detail in a bit. On that note, and before continuing, let’s do a quick antenna count. TP-Link’s documentation, as mentioned earlier, documents 13 high-performance Wi-Fi antennas, 1 Bluetooth antenna, and 1 Zigbee antenna.

Six of the Wi-Fi antenna (alternatively stated: three two-antenna assemblies) are 5 GHz. Another five are contained within two of the three 2.4-GHz two-antenna assemblies, plus one of the two antenna in the third assembly. The remaining two Wi-Fi antennas are the “concentrator” and directional ones discussed earlier. And we now know where the Zigbee antenna lives; the Bluetooth antenna is instead embedded within the PCB (stay tuned). This latter hardware potential is a moot point, because as far as I know neither the Bluetooth or Zigbee resources have yet been software-enabled via router firmware and application updates.

Continue reading on EDN US: Uncovering the PCB

 

Brian Dipert is Editor-in-Chief of the Embedded Vision Alliance, and a Senior Analyst at BDTI and Editor-in-Chief of InsideDSP, the company’s online newsletter.

Related articles:

Leave a comment