TP-Link TL-WR703N PCB Details

This page is an attempt to understand the purpose of each and every component on the TP-Link TL-WR703N Wireless router PCB, Rev. 1:1, as pictured in the OpenWrt wiki page related to this product.

Having no access to the board schematic nor to the Atheros AR9331 SoC datasheet, this work is solely based on observation of the above pictures and experimentation on a real board. For this reason, this work cannot be certified to be 100% accurate or correct, and may well contain errors or mistakes. If you spot some, please report!

We don’t know for sure, but this board looks like it is only double-sided (or only contains a few not very complex internal layers), so studying the above picture should prove good enough to understand the board’s internals. Hopefully someone will take pictures of the bare PCB, so this assertion can be verified!

In order to make it easier to follow on the pictures without jumping back and forth, exploration will take place sequentially (top, then bottom picture), and in a zigzag fashion, starting from the top left corner.

Credits for the top and bottom PCB pictures go to Matt Joyce. Please note that these 2 pictures can be overlaid to match exactly (e.g. vias can be followed from one side to the other).

SW2 is a R/A SMT tactile momentary switch. The nearby R91 / R92 and C62 components are probably used to implement a low-pass filter for filtering out spurious glitches.

USB1 is a R/A SMT MicroUSB socket, out of which only VBUS and GND pins are used to power the device.

The D+/D- and ID remaining pins are unused and can thus be repurposed for another usage, like the D+/D- signals coming out of an USB/TTL UART converter connected to the serial console. Note however that this setup prevents access to the early bootloader character interrupt of the boot sequence, as in this case pluging the USB cable would power the device and not let a user have a chance to type in a character quickly because of the lengthy USB enumeration process. Maybe Reseting after Power Up solves this problem and the early boot process can be monitored.

Please note that the connector shield and GND are not connected together directly, so taking the ground on any connector shield is not a good idea!

J3 is a low-profile passive Ethernet RJ45 socket. It is located into a board cut-out to minimize its overall height. This connector does not contain any LED, nor transformers or EMC filters.

The differential RX/TX signals can be clearly identified, as they are routed away from any other traces with controlled impedance.

C37 is used to connect the Ethernet connector shield to GND.

LED1 / LED2 is a dual footprint blue LED, but it looks like the 3 mm through-hole LED2 is never mounted. R83 is the associated current-limiting resistor for the LED.

Note that the round copper pad is not a pad or a test point: it is a “fiducial mark” used for calibrating the component’s pick & place machine during assembly. There are 4 of them on the top side of the board, and 2 (1 is tinned!) on the bottom side.

T1 is an H1601CG (in Ver. 1.6 devices, it is replaced by an HST-0041S) 10/100baseT Single-Port Ethernet Transformer. This device contains both the dual 1:1 isolation transformer with mid-point connection (1 for each RX and TX pair), and the dual common-mode filter (again, 1 for each pair). The purpose of this component is both to provide a galvanic isolation between the internal circuitry and the Ethernet cable pairs, and to filter common-mode noise that may flow on these wires.

The solution to use a separate Ethernet transformer instead of the common integrated “MagJack™” socket is probably economic, but this also provide a better overall isolation because of the increased distance to nearby components.

The resistor/capacitor groups C52 / R78 / R79 / C48 / C49 on one side, and R76 / R77 / C50 / C51 / C53 on the other side, are 2 sets of common PI filters required for the Ethernet differential signals.

USB2 is a R/A SMT USB-A socket providing an USB host connector. The original purpose is for hooking up a 3G USB dongle, but it can be used for numerous other things.

C113 / C115 are used for decoupling the 5V at the USB2 3G USB connector.

D1 (and D2 on the opposite PCB side) is a dual clamping diode providing ESD (Electro-Static Discharge) protection by limiting the incoming voltages on D+/D- signals to both GND and VBUS.

R101 / R102 / R103 / R104 are USB impedance-matching resistors, in series with both D+ and D- signals. These are required to meet the USB specification, including the famous “eye-diagram”. The use of 2 sets of resistors is rather unusual.

The D+/D- signals can be clearly identified, as they are routed in parallel and away from other signals to provide controlled impedance.

There are 2 groups of resistors R57 / R60 / R62 / R63 and R15 / R16 / R17 / R18 that have no clear purpose. They look like pull-down resistors for a variety of signals.

A guess would be they are used for POR (Power-On Reset) identification/function selection, but this is infirmed by the fact that R15 has been identified by imperfect as being a pull-down resistor for the GPIO7 signal, and R17 for the GPIO29 signal.

Another guess is that the AR9331 SoC having “diversity” antenna capabilities (i.e. it can use 2 antennas and switch to the best one) and probably also external PA (Power Amplifier) drive capabilities, there may be some GPIO pins in this area that could be used for control purpose. As the TL-WR703N has only a single antenna and no external PA, they are thus unused and pulled down to GND by these resistors.

U1 is the main AR9331 CPU and Integrated Wifi Chipset from Atheros. Unfortunately, its datasheet is not publicly available, so we can only guess its pinout.

Note that strangely, this chip has 2 concentric rows of pins, as can be observed on NutBolt’s picture of the PCB with unsoldered U1:

C52 looks like a decoupling capacitor for U1, as well as C35 / C36, along with the L11 filter choke.

U2 is a 16Mbit x 16bit (16Mibit*16=256 mebibit. 256 mebibit/8=32MiByte) 400MHz chip Zentel a3s56d3040etp.pdf DDR1 SDRAM chip, providing 32MB of volatile memory.

This chip can be upgraded to any pin-to-pin compatible 32Mbit x 16bit 400 MHz (or even 333 MHz) DDR1 SDRAM chip to double the RAM capacity.

All the resistors R21 / R23 / R25 / R27 / R29 / R31 / R33 / R35 / R50 / R52, as probably R54 / R56 are impedance-matching series resistors for the DDR address/control/data signals.

C103 is a large decoupling capacitor for the DDR SDRAM chip.

Q2 is a S8550M power PNP transistor. Its purpose, as well as the related parts C92 / R98 (not mounted)/R106 is unknown, but may be related to the SDRAM chip or the nearby LED.

Note there is a TPDDR test point in the vicinity.

R82 is a pull-up resistor for the incoming TP_IN UART RxD signal, and 2 unmounted capacitors C55 / C57 can be used for filtering the TP_IN/TP_OUT signals.

These signals seems to be LVTTL (3.3 V) compatible. In order to be usable on a PC, an RS232 level translator or USB/UART converter must be used.

R4 / R11 / R12 form an unidentified resistor group, although R4 has been identified by imperfect as a pull-down resistor for the GPIO0 signal.

Y1 is a 25 MHz SMT crystal, with the corresponding C60 / C61 bank capacitors.

This crystal frequency is used to feed PLLs inside the AR9331 SoC to generate all the required system frequencies (400 MHz for the CPU and SDRAM, 200 MHz for the AHB bus).

Several RF filter networks can be identified: C33 / C34 / L6 / L7 / L8 / L9, in parallel to C19 / C22 / C23 / C25 / L2 / L4, followed by C7 / C20 / C21 / C26 / C27 / C28 / C30 / L3 / L7.

J1 is a 0 ohm resistor shunt that provides a convenient way to disconnect the printed antenna on the other side of the PCB from the chip. Its pad closest to the U1 chip and the large GND pad on its right can then be used to solder an external antenna.

The bottom of the J3 Ethernet connector is located into a PCB cut-out. C45 provides the ESD 2kV protection for the Ethernet, and R64 / R65 / R68 / R71 are the Ethernet cable impedance-matching resistors.

Right below the USB1 MicroUSB connector is located U6, an unidentified (marking: 16GBC) USB power distribution switch (similar to TI's TPS2051B), with its related C119 capacitor.

R113 (not mounted) is a placeholder for a shunt 0 ohm resistor to be mounted as an alternative to U6. Putting a blob of solder across the empty pads labelled R113 bypasses U6 and is useful to power the router from external source, rather than vice-versa.

The purpose of the R107 / R108 / R109 / R110 / R111 / R112 resistor group is unknown, although some kind of resistor dividers for generating miscellaneous voltage references is suspected.

C107 / C108 are used for decoupling of the 5V input on the USB1 MicroUSB connector prior to the U5 switching regulator.

U5 is an AME5258 step-down 3.3 V switching voltage regulator (marking: BWMM7AG), along with the L14 ferrite-core self, C112 input filter ceramic capacitor, C109 output filter ceramic capacitor and feedback circuit R99 / R100 / C106.

2 test points TPGND and T3V3 are available, and 2 capacitors C110 (not mouted)/C111 are used to connect the GND to the RF antenna GND.

Below the USB2 connector is the capacitor C114 to connect the USB connector shield to GND, and the D2 dual clamping diode (see description on top PCB side).

Q1 is a S8550M power PNP transistor, but its purpose, along with the related components R93 (not mounted)/C70 / C84 / C47 / C38 / C46 is unsure.

However, the TP2V0 test point nearby suggests that this circuit might be used for controlling the Ethernet analog voltage at 2.0 V.

Below the U2 DDR1 SDRAM chip are located some additional impedance-matching series resistors for the DDR address/control/data signals R37 / R39 / R41 / R43 / R45 / R47 / R48 / R49 / R51 / R53, R22 / R24 / R26 / R28 / R42, R40 / R32 / R34 / R36 / R38 / R40 / R44 / R46 and R55 / R59 / R61.

There are also some decoupling capacitors C9 / C10 / C11 / C12 / C13 / C14 / C15 / C16 / C17 sprinkled all around.

Please note the serpentine traces for the impedance and length-matched signal between the CPU and the DDR SDRAM chip.

Below the U1 chip are located a lot of decoupling capacitors C1 / C2 / C3 / C4 / C5 / C63 / C64 / C65 / C66 / C67 / C71 / C72 / C73 / C74 / C75 / C76 / C77 / C78 / C79 / C80 / C81 / C82 / C83 / C86 / C87 / C88 / C89 / C90 / C91 / C93 / C94 / C96 / C97 / C99 / C100 / C105, 2 self L1 and L13 (this one probably for the Ethernet power supply) and a 0 ohm shunt resistor R94.

Please note the strange central hole below the U1 chip.

It looks like U1 is integrating several LDO voltage regulators, as there are several power supply-related test points TP2V0 (seen above, suspected to provide supply for analog Ethernet), TP2V5 (for supplying the U2 DDR1 SDRAM chip) and TP1V2 (for the core voltage supply).

U3 is a Spansion S25FL032P 32Mbit 104-MHz SPI Flash memory in an SO8 package (208 mil wide). This chip provides 4MB of Flash memory for permanent storage.

This chip can be upgraded to a 64 Mbit pin-to-pin compatible chip (like the Eon EN25Q64 chip) to provide 8MB of Flash memory.

C18 / C24 / C85 are probably decoupling capacitors related to the Flash memory chip U3 or the main CPU chip U1.

The role of the 2 resistors R84 and R95 is unclear, although R95 is large enough to be a possible removable option.

R7 / R96 / R97 and R2 / R3 / R13 / R14 are undefined resistors whose purpose is unknown.

AN1 is the PCB antenna, and C29 / C31 / C32 (not mounted) are the antenna matching capacitive divider network.