HP / HPE ProCurve 2910al-24G J9145A Switch teardown and shenanigans (WHL #108)
Earlier this year, I got my hands on a bunch of old HP switches, 20+4+x ports in 1U, in basic configuration without like fancy 10G addon cards. These were thrown out when my employer moved, but realistically, they should have been in the trash years ago. PCB date late 2008, component date more like mid-2009, so they were a solid 15 years in 24/7 operation. Good stuff.
So I had a peek. Like I always do 
Hardware is of course ancient, the main processor is some (dual!) ARM11(56T2S) chip with ARMv6 architecture from like 2002. And while the thing has all the oomph it needs for 24/7 sustained 100% load on all ports with VLAN and filtering and sniffing, it’s doesn’t come lightly from a single ASIC like a modern switch would. Oh no, this has 100 horsepower to compete with a modern minivan, but it sources it from a marine diesel with 80 liters of displacement. On full idle, with not a single active port and no SFPs inserted, this tank draw 45 watts of power. FOURTY-FIVE. And on full throttle, HP specs 82W. Jesus. I think we had seven of these (plus a much bigger core switch!), times 24/7, times 15 years. That’s like 60000 kWh of consumption…for a bunch of gigabit ports. Madness.
Anyway – here’s the inside:
Rather simple construction, huge PCB over the full 19″ width (these were also sold in 48 port variants, the board is shared but not fully populated here), approx 43cm x 25cm. There’s one fan that cools the actual switch, there’s one that is somewhat cooling optional addon cards and the power supply, and there’s a fan deep in the corner that does fuck all yet makes noise and consumes power.
These are all Delta FFB0412SHN 12V/0,60A = 7,2W fans, apparently 13k RPM, and only one of them made scratchy bearing noises, all the others were fine after 15 years of non-stop operation. They are bundled onto a strange 1-to-3 connector and are labelled 1-3, so that’s a HP-specific assembly – but nothing that couldn’t be fixed with a bit of solder or a suitable crimp for the 2.54mm headers
The other large piece in the chassis is the open frame power supply, classic wide-input 100-240V 50/60Hz jobby, with a twist: It also has a 12V battery backup input that bypasses the entire power supply – I’ll come back to that interesting bit later. It’s connected via a 7W2 D-Sub power connector, from which only the power pins seem in use.
(these photos stem from several different units, I apologize for their various states of disassembly or even PCB revisions and component population!)
There are two expansion bays in the back with PCIe x8 connectors. I doubt these are actually PCIe, but the form factor is very convenient (we also use these at work!), they’re readily available, likely tested in other HP(E) gear and designed for high frequency applications. Some 10GbE cards and similar accessories were available for these. Finding such a module on the used market however is near impossible, so these switches are just 1G units with 20x copper and 4x shared copper/SFPs, and are therefore clearly not worth keeping for round-the-clock use. I still stashed a single unit for, dunno, maybe a LAN party or something, these would have been the ducks guts for every early 2000s party 
Back to the like-a-tank construction: This switch used tons of large chips:
* Main CPU of course, “HP Innovation” branded, ProCurve Networking “Shire”, 2DS4-0004 1825-0254 unit, made in the Philippines. Variable markings, checked on different units: NOU180/N1B505, 0929/0947 (date code, amiright?), 92920189/94620361.
Can’t really say much about this, it’s the typical switch ASIC. Well, and it’s a trap for young players, since what you see in here isn’t the actual chip. I was wondering why it did look glass-like when viewed from the side, and then I noticed that the surface is totally uneven, while the heat sink was not:
That heat sink and the two smaller ones have a metal grid as part of their thermal pad, and that would have made terrible contact with such an uneven chip. Safe to say: I did that when forcefully removing the heat sink. It’s just a heat spreader mounted onto the actual silicon and connected by another layer of thermal paste. The silicon chip itself is completely unmarked.
* Besides the CPU: An Altera EPM3128ATC100-10N Max CPLD with 128 macrocells and 80 I/O pins. octopart lists previous prices in the region of 10€.
* On the other side, towards the PSU: An Altera EPM570T144C5N MaxII CPLD, 440 macrocells, 116 I/O pins, still available for 46€ a piece in one-off quantities.
* And on the corner towards the 1GB Compact Flash card: An Altera (notice a pattern here?) EPM240T100C5N MaxII CPLD, 192 macrocells, 80 I/O, also still available for 15€ a pop.
But that’s not all! There is of course a populated back side, which houses some more
* Another EPM240T100C5N:
* And a third EPM240T100C5N besides an absolute unit of a MLCC cap 
So these are five Altera CPLDs that already sum up to about 100€ today in single quantities, plus the main CPU, plus the ICs that are the actual networking frontend:
Bottoms up!
These are 2x Broadcom BCM5466RA0KFBG (Quad Gigabit Transceiver) and 2x BCM54980C1KFBG (Octal Gigait Transceiver), both can be had for sub-5€ nowadays and are of course EOL. I have no idea what makes the two 4x more betterer™ than one additional 8x chip in this 24-port environment, maybe the split copper-or-SFP interface works better with the smaller chips. The three unpopulated footprints for the 48-port version indicate that the other copper ports would have been used the more economical 3×8 configuration instead of another 2×8 + 2×4, though.
What’s more? Well, the strange thermal pad with aluminium inlay: Haven’t seen these before, difficult to remove without breaking.
And now for the shenanigans part: Power delivery. As I said, this thing has a non-redundant AC power supply, plus a DC inlet. And part of the huge consumption is the old PSU design. This is the wall power draw after full boot, but the thing sometimes moves up to 52W and then goes back down. Fans seem to not change in speed, altough I have never tested these with more like 4 ports in use, since, well, I don’t have 24 machines here for a stress test
Removing the power supply from a running unit yields something like this. The PSU only turns on by sensing load, and this seems to be the idle consumption. That’s, umm, terrible (but it is a 20 year old design, way before the 80plus PSU efficiency standards)
Under load, it’s more like this: 44W in, 2.3A x 12V = 27-28W out. That’s 15W+ or one third of total consumption wasted in PSU efficiency. Again, for a 24/7 unit that is TERRIBLE.
Can this be exploited via the 12V port? Yes, it can. But even that can be bypassed, since the PSU doesn’t talk to the main PCB, it just delivers 12V. Consumption-wise, it does not make a difference if the 12V are fed to the 7W2 connector (which I specifically bought from Aliexpress, and these are impossible to find in single quantity with free “Choice” shipping, so I paid like 4€ for one of these), or are directly routed onto the Molex connector.
The 20-pin Minifit connector is only partially used, and of the 15 active pins, there’s 5x GND, 5x 12V and five various pins that can all be disconnected and the thing is still running. In fact, the switch doesn’t really know anything is wrong, there is no beeping, or fans acting weird, or messages in the UI. Some pins do provide a voltage but serve little to no current, maybe this for flagging faults or something. But the thing will turn on with just the 5x red and 5x black wiring present – or even less, since they’re not individual rails, but all commoned:
Pinout (Dr. ChatGPT is unwilling to make one, despite telling me multiple times that my image is ready when it’s clearly not):
Top Row (1–10): [12V][12V][12V][12V][12V][3.2V U][3.2V U][3.3V S][ ][ ] [RED][RED][RED][RED][RED][YELLOW][WHITE ][BROWN ][ ][ ] Bottom Row (11–20): [GND ][GND ][GND ][GND ][GND ][ ][1.3V ][ ][0V ][ ] [BLK ][BLK ][BLK ][BLK ][BLK ][ ][WHITE][ ][BLUE][ ]
Yellow transfers some 20mA of unstable 3.2V, White top does the same, wherever these come from (supplied by the board, the PSU doesn’t have these voltages present). Brown is 3.3V stable, but has no current flow.
Power supply reads like this – I was too lazy to run four wires for proper sensing, so I did add a little bit of extra voltage. At 12V sharp, it wouldn’t properly boot, which is a pitfall for real 12V battery backup. Current goes up with voltage, there seems to be circuitry besides the many buck converters that takes increasing current with higher voltage (maybe just the fans?). But even at that 12.5V / 2.7A, we’re talking about 34W instead of 44W, plus some 10% extra for power supply efficiency.
That aside, a more efficient PSU could also save two of the three fans because it wouldn’t get so hot. These do run in much lower RPM mode than they could (7.2W, 13k RPM), but removing them is like 1 to 2W each. So in total, a tad below 35W drawn from the wall outlet seems a reasonable number, instead of 45 to 50W with the original PSU. Not that anybody should still use these, but, you know, one could mod these for slightly higher efficiency…
Some thermal images: Right after power-up:
And after a couple minutes of runtime. Note that this is the stripped version with all heat sinks and also the CPU heat spreader removed, hence the much sharper contrast on all high power ICs.
Time to scrap my last unit and get on with more pressing things…
