Teardown: The router that took down my wireless network Looking for DataSheets?

Back in late November 2017, EDN published my hands-on experiences with a mesh Wi-Fi setup constructed of three Google/TP-Link OnHub units. The mesh access points are connected to the common router nexus via wired Ethernet in order to maximize the Wi-Fi channels’ utilization potential for network clients, although wireless “backhaul” is also an available option. The network had actually been in operation since late August of that year, and for the next two-plus years everything was pretty much smooth sailing. One morning last September, however, I woke up to find my wireless network completely MIA.

I suspected that the router itself might have gone awry, and the “red ring of death” indicator atop it (no, not that “red ring of death“) confirmed my suspicion. No amount of factory resetting brought it back to life. Fortunately, I had a spare router in storage, which I pressed into service, although to resurrect the network I had to set it up again completely from scratch.

I realize in writing this that one thing I forgot to mention in my earlier piece about working from home due to COVID-19 lockdowns is to make sure you have spares for all of your hardware; it’s one thing to have the network go down if you’re primarily using it for off-hours purposes, but quite another if you’re depending on it for your continued employment.

With that, I hereby present the deceased (the TP-Link model number TGR1900, to be exact) to you for dissection inspection purposes.

Let’s begin, as usual, with some unboxing shots (perhaps obviously, since the router had previously been in use, I had to re-box it to unbox it again). As you’ll see from the label on the top, it was factory refurbished, and I wasn’t even the original owner; I bought it used from someone on Ebay. So I’m not feeling too badly about its demise ;-).

Slide off the outer sleeve, and you realize that what you might have thought was the top of the router itself is only one of two pieces of introductory literature:

Now for the inner box, which is made of quite sturdy cardboard. Not quite wood, but it might as well be!

Here’s a closeup of the overview instructions printed on the inside of the box top, within which the top of the router neatly nestles:

The bottom of the router has its own foam retainer, too, and underneath it are two more boxes, labeled “Power adapter” and “2 Ethernet cables.”

Here’s the contents and a closeup of the AC/DC converter portion, so you can see its input and output specs:

Now for the router itself. The TGR1900’s dimensions are 7.5×4.1×4.6 in (190.5×104×117 mm). I’m here showing its backside, revealing the access to the two GbE ports (WAN and LAN), the reset button, the publicly unused (except by hackers that is … it runs Chrome OS, believe it or not!) USB port, and the power input, which you’ll be able to see when we remove the outer shell:

Before continuing, some background: Google worked with both TP-Link (first to market) and ASUS on OnHub routers, initially introduced in August 2015 and to which mesh Wi-Fi functionality was later added. The TP-Link and ASUS model feature sets were fairly similar, with a few deviations:

Specifically, here’s what Google’s still-live product page reveals about the TP-Link model’s internals:

Keep this conceptual image in mind as the teardown proceeds. TP-Link’s own product page is a bit more specific about the router’s 2.4 and 5 GHz antenna counts and types:

The router’s rugged plastic outer shell, finned on the inside to help direct heat up and out the top, rotates slightly to unlatch and then lifts off:

It comes standard in both dark blue (mine) and black, and TP-Link even sold standalone custom upgrades (presumably for use in conspicuous spaces; mine was hidden away in the furnace room):

Here are a few overview shots of the TGR1900 with the shell removed, showing (among other things) its abundant ventilation slots and the aforementioned ports:

Here’s a closeup of the branding (and more ventilation) at the front and the additional venting at the back:

Time to dive inside. I thought I’d start with the underside; here it is, along with a closeup of the FCC certification details:

Any time I see a rubber cushion, I look for screws underneath, and I was right again this time, although their removal didn’t actually get me anywhere. Note, however, the second hidden reset button, found by our earlier-mentioned hacker friends:

So I turned my attention to the top:

This is encouraging! Note in the above that one of the mounting bracket holes is translucent; hold that thought for a bit.

Next to go is the translucent plastic ring underneath the top piece. In the first shot that follows, note the prescient “2.4” marketing on the edge of the exposed PCB underneath:

And with it removed, the LED array (with a transducer in the middle) is clearly exposed to view:

Remember that “2.4” marking I pointed out earlier? Here’s another view of the LED-and-speaker assembly, showing one marked “5” (there are six total in a ring around the edge, half of them marked “2.4” and half marked “5”; you’ll see them more clearly soon):

About that speaker, it’s one of the more notable oddities of the design. With other widgets like these that I’ve published hands-on reports (and, in some cases, teardowns) of before, the initial pairing with a mobile device occurs either over Bluetooth or an ad-hoc Wi-Fi connection. With the OnHub, on the other hand, initial pairing uses an audible audio tone emitted by the router, which the smartphone’s microphone (in conjunction with the Google Wifi app) listens for.

Judging from its looks, the transducer is likely fairly wide-range in its capabilities; had Google and its TP-Link and ASUS partners also included a microphone in the design, we’d conceivably have a fairly robust Home device on our hands (and an aesthetic one, as well, thanks to TP-Link’s shell accessories). Alas, it wasn’t meant to be, I guess.

Digression over; back to the teardown. Removing four more screws, which were identical to the ones on the router’s bottom, allowed me to lift the LED-and-speaker assembly partly away, but I could tell that it was still connected to something deeper inside.

So I turned my attention to one of the side seams, using the same flathead screwdriver-as-wedge duo that had worked effectively on the top:

The “egg” has been cracked open!

Here’s our first peek at the router’s backside insides:

Before exploring it further, let’s disconnect some remaining cabling so that we can take a complete look at the top pieces. The flat flex cable from the PCB to the LEDs has already been detached; its connector is in the upper left corner of the PCB.

What’s left is the black-and-white audio wiring pair (which mates to a connector below the massive Faraday Cage on the PCB), along with a standalone black wire (normally tethered to a connector along the left side of the Faraday Cage, below the aforementioned flex cable connector). Remove them and we can now fully separate the various top “sandwich” pieces, which I’ll next show top-to-bottom.

First off is the “congestion” antenna (with a hole in the middle for the speaker’s sound to pass through), which serves the following purpose, from Google’s product page:

OnHub automatically switches channels to maintain the best Wi-Fi signal strength and avoid congestion, without interrupting what you’re doing. That gives you the fastest possible speed for your devices.

And TP-Link’s product page:

Searches every five minutes for the least crowded Wi-Fi channel and will switch if it improves your performance.

Next is an elementary piece of plastic, which I’m guessing is intended to isolate the RF antenna above it from the electronics below it:

Below that is the translucent plastic piece, designed to redirect all light coming from below it uniformly out the sides:

And below that is the speaker, surrounded by the multicolor multi-LED circuitry:

Notable semiconductor content here includes two National Semiconductor (now Texas Instruments) LP5523 programmable 9-output LED drivers and, next to one of them, an ambient light sensor. Remember earlier when I noted that one of the top piece’s mounting bracket holes was translucent? The ambient light sensor is why; the translucence allows environment illumination to shine on it, dynamically controlling LED intensity (you can also manually do this via the Google WiFi app).

Before continuing, let’s have a look at the antenna ring that’s now fully exposed to view:

If you do a wire count, you’ll note that each of the six antenna assemblies is actually a two-antenna array. There are three assemblies (six antenna total) for 5 GHz:

And three/six for 2.4 GHz:

The one shown above is at the very back of the router; it’s special. Hold that thought for a bit.

Next, let’s get rid of the other half of the enclosure (for orientation purposes, remember that it’s associated with the front of the router). Above the earlier-mentioned Faraday Cage is a black metal bracket; removing it enabled me to get the remaining enclosure piece partway off. However, it was still wire-attached:

Here’s a closeup of the remaining intact antenna hookups:

Disconnect one of them and I successfully completed this part of the mission:

That’s the “directional” antenna mentioned in the product documentation, which extends across the front of the router. And here’s a sneak peek at the now-revealed PCB frontside:

That’s one massive heat sink!

Speaking of antennas, let’s return to the ring atop the PCB; specifically, let’s remove it. Disconnecting the remaining antenna wires, one of them extending partway down the right side of the Faraday Cage, accomplished this task:

That long wire goes to the aforementioned backside 2.4-GHz antenna assembly. One half of it (i.e. one antenna) seems to handle Zigbee, given its connector proximity to the controller IC I’ll discuss in more detail in a bit. On that note, and before continuing, let’s do a quick antenna count. TP-Link’s documentation, as mentioned earlier, documents 13 high-performance Wi-Fi antennas, 1 Bluetooth antenna, and 1 Zigbee antenna.

Six of the Wi-Fi antenna (alternatively stated: three two-antenna assemblies) are 5 GHz. Another five are contained within two of the three 2.4-GHz two-antenna assemblies, plus one of the two antenna in the third assembly. The remaining two Wi-Fi antennas are the “concentrator” and directional ones discussed earlier. And we now know where the Zigbee antenna lives; the Bluetooth antenna is instead embedded within the PCB (stay tuned). This latter hardware potential is a moot point, because as far as I know neither the Bluetooth or Zigbee resources have yet been software-enabled via router firmware and application updates.