Category: Electronics

When I designed the Universal Chip Analyzer, the goal was to be able to test everything from the 4004 to the 486 DX4-100 (and CPUs sharing the same pinout like AMD/Cyrix 5×86). Any Pentium-class CPU was out of scope due to physical limitation. Even if the UCA architecture can probably handle them from an electrical point of view, the size of adapters is just too small for the 200+ pins Socket needed for a Socket 4 or 5. Even the Socket 3 used by Pentium Overdrive on the PCB can’t fit between the two connectors. So P5 support on the UCA looked really impossible. Really? Wait a minute…

First, let’s have a look at the pinout of Pentium Overdrive, and especially at the outer pins rows :

As we can see, all pins but 8 are reserved (No connection) or used for power supply (VCC/VSS). Pentium ODs requires much more power than any 486, so Intel basically doubled the number of power supply pins to insure stability. The INIT (F19) pin is basically useless because it’s redundant with RESET and supplied with an internal pull-down to avoid spurious trigger. The 7 others pins are related to Write-Back L2 cache, which is useless on the UCA because the internal RAM is as fast as the L1 cache. So maybe the Pentium OD can work without connecting the outer rows?

To check that incredible possibility, I build a 486 adapter with a standard Socket.

The Pentium Overdrive 83 MHz fits perfectly with the outer pins floating.

And … IT WORKS! At the UCA boot frequency (FSB 16 MHz), the CPU was able to run perfectly fine at 40 MHz using its internal 2.5x multiplier!

After adding some code to support the new CPUID (0x1532), the UCA Analyzer tool was able to detect the Pentium Overdrive correctly and run the full test suite without issue.

The Pentium OD doesn’t support JTAG, unfortunately. Power consumption is quite low for a Pentium-class CPU: 865 mA at 40 MHz. The last question is: how high can it go without the additional power supply pins connected? I tried 20 MHz FSB (50 MHz clock) without issue, then I tried 25 MHz FSB for a 62.5 MHz clock (like the Pentium Overdrive 63 MHz)

And it still works! Current consumption rises to ~1.3A to reach 6.4W. I also tried running the Pentium OD at full speed (33.3 MHz FSB for a 83 MHz final clock) but unfortunately, it only runs for a couple seconds before crashing. There is no doubt that the crash come from the missing power supply pins, but being able to run it at 63 MHz on the UCA is quite impressive! 

 

With the development of the PGA Shields (now able to support all Intel CPUs from 80186 to 80486) and the rise of demand from collectors, it was time to think about producing a batch of the Universal Chip Analyzer. In January, I finally decided to rebuild everything from scratch to get rid of old issues and restart from a “clean” foundation. The original Mojo v3 board I used since the very beginning was a fantastic tool, but after way too many patches, I encountered “hard” limitations which would have become major issues later. As I don’t want to rework the base FPGA board nor the main interface (IF) board for years to come, the solution was to build the perfect PCBs one time for all.

So, let me introduce the Universal Chip Analyzer v2!

UCA FPGA Base Board

The Mojo V3 was a great tool, but it’s a 2013 Kickstarter product tailored as a development board.  I hesitated for a long time to replace the Xilinx Spartran-6 FPGA with a “new-gen” Spartran-7 or even an Artix-7. I finally decided to stay with the Spartran-6 for many reasons.

1. 1. Xilinx 7-Series FPGA are only available in BGA and not in QFP packaging. That mean more complex PCB and higher manufacturing cost.
   2. While 6-series are happy with two simple 3.3V and 1.2V linear regulators, 7-series FPGAs requires 3.3V/1.8V/1.35V and 1.0V. That mean noisy DC-DC buck converters, more filtering, and ultimately MUCH higher BOM and assembly costs.
   3. The speed and logic cells count on the Spartran-6 XC6SLX9-2 are enough for all actual and future uses I can think of. I could have used more Block RAM, but it’s not a limitation.
   4. Xilinx announced that that this FPGA is a “long term product” that will be manufactured at least until 2027. It’s also quite cheap now (< $10).

Switching to a Spartran-7 or Artix-7 would have just significantly increased the price and overall complexity without adding any feature. The only interesting point I will miss is related to the development toolchain. I could have finally got rid of the infamous Xilinx ISE for the new Xilinx Vivado Design Suite. But after all, I’m now quite comfortable with all the damn ISE’s bugs, so…

Here is the new Universal Chip Analyzer board next to the old one.

I kept the overall form factor, just a bit (6 mm) higher, but many components changed.

1. 1. ARM Main microcontroller – The original 8-bit ATMEGA32U4 (at 16 MHz, with 32 KB Flash & 2.5 KB SRAM) has been replaced with a 32-bit ARM-based ATSAMD21G18. The new MCU is clocked at 48 MHz, Flash capacity is 8x higher (256 KB) and SRAM is now upgraded to 32 KB. It’s also MUCH faster and I have room for many future improvements. While the ATMEGA32U4 was 80% full, the new ATSAMD21G18 is under 20% after a full code rewrite, and with more features added!
   2. 512 Mb Flash Memory – The original Mojo v3 used a 4 Mb SPI Flash able to store a single FPGA configuration file. With the first UCA, I upgraded the flash to 128 Mb to store up to 40 different configuration bit-files. The final UCA now use a 512 Mb Flash to store more than 150 configurations file simultaneously.
   3. EEPROM – A small 64 Kb I2C EEPROM to store calibration constants, configuration, serial numbers, etc. has been added.
   4. USB-C Connector – The good old Micro-USB connector tend to become obsolete. The new reversible USB-C connector will soon become the standard. It is also more robust.
   5. Better XO. The main 50 MHz oscillator has been upgraded to a 20 ppm, low power one for lower jitter and better stability at high frequency.
   6. Stronger power filtering – The filtering/decoupling stage was limited on previous board. It is now much stronger, allowing higher noise immunity and better switching speed for fast CPU like 486s. Thermal dissipation has also been vastly improved.
   7. Power Connector – First prototype of the old UCA v2 used a tiny 1.35mm jack located on the IF board. The final one come with a standard 2.1mm jack with polarity reverse protection. An additional 9V or 12V power supply is mandatory for all supported Ics. I tested some USB to 9V/12V adapter, and they work fine, making testing from a power bank on the field possible.

There are also many layout changes, allowing for example I2C communication from the MCU to IF to Adapter boards.

UCA Interface (IF) Board

The final IF board has been upgraded to perfectly fit on top of the FPGA board. The PCB has been enhanced for reliability while lowering BOM cost. All but one tantalum capacitors have been replaced by MLCC (ceramic) caps. Layout has also been improved for better decoupling efficiency. Along the main voltage transceivers, the UCA IF board includes a 2A DC-DC voltage converter, precision voltage and current monitoring, and adjustable fast overcurrent protection. Voltage can be set by software (25 mV steps). A standard 3-pin fan header is available for high-power CPU like DX4s.

The slightly bigger PCB height allowed an optional 0.91″ 128×64 OLED display to fit on top of the board. It will be used later to display additional information about the test status. Right now, it shows the selected CPU Family and the voltage/current used.

UCA Adapters

The pinout on both 50-pin connectors located on the IF Board as slightly changed to accommodate previous modifications. I added some new signals to avoid future limitations. For example, the I2C is not passed from the ARM MCU to the adapter boards. Adapter’s ID also changed for their final values, so all currently designed adapters required a small layout change.

Let’s see the currently designed adapter and their current status.

• • UCA 80486 Adapter
    

The 486 adapter has been recently upgraded to support JTAG reading. From a hardware point of view, the adapter is almost finished. There is still a small side feature I would like to add, but it’s a minor modification. The 486 adapter is able to test all 486 ever released, from the Intel 486 SX-16 to the Cyrix 5×86-P133, but also 487s, AMD 586, Ti, UMC and IBM 486s.

• • UCA 80386 Adapter

The 386 Adapter has been the most difficult one to build so far. While the hardware is now almost fine, it still need some work on the FPGA code to fine-tune some timings.

• • UCA 80286 Adapter

Almost finished and working as expected with all kind of 286s. The internal MCU code must be rewritten to accomate the new communication protocol, but it’s not a very complex task.

• • UCA 80186 Adapter

The 186 Adapter was the first adapter to be build directly for the new UCA “v2”. It was used to debug the new communication protocol between the different part of the UCA. Both Hardware and Software are now done. The only missing feature is the automatic detection of 186 vs 188 (currently, you have to select the correct bus type with the DIP Switch)

• • UCA DIP40 Adapter (8088/8086 & more) 

The “iAPX-86 Adapter” has been renamed the “DIP40” Adapter as it is able to also test various other DIP40 IC. Along 8086 & 8088, the UCA DIP40 Adapter can also test 8085s, NSC800s, MCS48 and MCS51 MCUs, RCA “COSMAC” CDP1802s without the need of any adapters. With a specific adapter that plug on top of the DIP40 ZIF, it can also test Zilog Z80s, 8080s, MOS 65xx and Motorola 68xx.

• • UCA 8087 Adapter

The 8087 Adapter has been quickly developed to show the UCA’s ability to also test FPUs. It requires a fixed 8086-compatible CPU that runs in MAX mode (while the DIP40 Adapter uses the MIN Mode).

• • UCA 8080 Adapter

After discussion with fellow CPU collectors, I developed a standalone adapter for Intel 8080s. The price and feature of this one are the same than the Adapter that fit on top of the DIP40 Adapter :

At this time, I’m sure witch solution is the best. Maybe the standalone version is better to avoid mistake with DIP Switches… Leave a comment to give your thoughts!

• • UCA Debug Adapters

These Adapters are just for internal use, but I wanted to share some pictures just for fun.

The left one is fitted with many precision power resistors and is needed to calibrate the power monitoring IC at various current load (10 mA, 50 mA, 100 mA, 250 mA and 2×500 mA). The right one is mainly used to test all signals of a newly-assembled FPGA/IF boards. It can detect shorts to VCC, open-circuits or adjacent-signal shorts. A backplate “Firmware Programmer” board with tiny pogo-pins has also been developed to flash the initial bootloader inside a blank UCA.

Stay tuned for more news about IC support and UCA production soon!

 

Released in 1991 and marketed as a floating-point coprocessor for the Intel 486 SX, the Intel 80487 was actually a fully featured Intel 486 DX with a slightly different pinout. Intel added an unconnected 169^th pin as a mechanical key for the 487 Socket. Another pin known as “MP#” (Math Present) was used to entirely disable the original 486 SX by triggering its “back-off” (from bus) mode. Being almost 100% compatible with the 486 DX, supporting the 486 SX with the Universal Chip Analyzer was trivial. I bought many Socket 168 socket and I just drilled a 1 mm hole and it worked immediately.

 

 

According to the 487’s datasheet, it was rated at 25 MHz maximum, but it also run fine at 33 MHz. It is possible to detect a B0-step Intel 487 by its unique CPUID (0x421). AFAIK, all retail 487s are B0-Step. A0-step are Engineering Sample only (with an unknown CPUID, maybe 0x420).

While testing the 487, I noticed a strange behavior that will deserve more investigation later.  It seems the 487SX needs a longer reset period to initialize properly compared to a standard 486. Technically, it makes sense: this additional delay might be needed to let the original 486SX disable itself and back off properly from the bus (before the 487SX takes full control).

 

Early in the development process, “UCA” meant “Universal CPU Analyzer”. Then I thought it could also be used to test non-CPU like FPUs, Bitslicers or RAM chips and I finally changed the name for “Universal Chip Analyzer”. The 8087 FPU is the first supported IC that’s not a CPU or MCU. Released in 1980, it’s a much more complex chip than its companion 8086. While the later is built with 29.000 transistors, the 8087 integrates 50% more of them for a total of roughly 45.000! It handles various floating-point arithmetic operations (additions, multiplication, square root, etc.) as well as transcendental functions from exponential to trigonometric calculations. The 8087 was the very first FPU to implement the draft of what was to become the initial IEEE 754 standard (circa 1985).

Building an adapter for the 8087 starting with the iAPX-86 code already done was quite easy. Emulating the CPU with the FPGA was technically feasible, but this would have limited the complexity of the x86/87 ASM code able to run. Fortunately, 8086s are still widely available for cheap and every collectors have spares.

The UCA 8087 FPU Adapter requires any 8086 with a rated speed of 10 MHz of more (the fastest 8087 is clocked at 10 MHz). While the standard 8086/8088 UCA Shield configures the CPU in the simplified “MIN” mode, this adapter requires the “MAX” mode with additional bus decoding stages. The original Intel 8288 Bus Controller had been translated in Verilog HDL and implemented in the FPGA. After some tuning, everything was running properly :

An option to automatically subtract the power consumption of the 8086 (to show only the one from the 8087) will be added later . Target frequencies are 4, 6, 8 and 10 MHz.

 

The Intel 80186 is one of the lesser known early x86 CPUs. In February 1982, 4 years after the 8086’s introduction, Intel released its successor, the 80286 (or “286”). Simultaneously, Intel also quietly released the 80186 to target different markets. While the 286 is a generic microprocessor like the 8086 was, but based on a new microarchitecture, the 186 could be considered as the first x86-based microcontroller. The difference between a microprocessor (CPU) and a microcontroller (MCU) is the level of integration inside the chip. A microprocessor requires a lot of support components (memory controller, bus arbitration logic, etc.) and is primarily used to build computers. A microcontroller integrates many of these components along with a (less powerful) microprocessor and is used for embedded purposes.

The 80186 integrates an enhanced 8086 CPU with a 16-bit bus and many support components: a clock generator, various controllers (DMA, Interrupt, bus, etc.), programmable timers, wait-state generator, chip-select logic, and even more. All these features greatly reduce the overall component count and the complexity of the board. Here is the original 186’s block diagram:

The 80186 is basically a hybrid concept that has been used in embedded applications as a microcontroller, but also as a CPU to build cheap 8086-class computers. For example, it was at the heart of the Tandy 2000 PC released in 1983, but also buried inside the Intel 14.4EX Modem to compute complex algorithms. They later used the 80188, an even cheaper offshoot almost identical to the 80186 but based on an external 8-bit bus (like the 8088). As 8086-class CPUs, both the 80186 and the 80188 can be linked to the 8087 FPU, but this association was almost never found in real-world products. Original 80188/80186s were built on Intel’s HMOS 3 µm process at 6 MHz, 8 MHz and 10 MHz. They came in 3 different packages: PGA-68, leadless ceramic (CLCC-68) and leadless plastic (PLCC-68). The Universal Chip Analyzer is now able to test and run code on all these CPUs:

In 1987, Intel released the 80C188 and 80C186, built on Intel’s 1.5 µm CMOS process. Clock speeds reached 16 MHz and power consumption was vastly reduced. Some features were also added: a power-save mode, a refresh controller to handle RAM refresh cycle without external components and a FPU interface to support the newly released 80C187 (support for the old 8087 was dropped). The uncommon 80C187 is essentially a 80387 repackaged into a DIP-40 or PLCC-44 package. The UCA is able to test and detect 80C186 and 80C188 in various packages:

In 1991 (the 486 was available at that date), Intel released the improved “XL” variant. Thanks to the CMOS 1 µm process, the 80C186XL and 80C188XL were able to reach up to 25 MHz at a lower power consumption. They now use a static design (able to be clocked down to DC for even more power reduction) while the 80C18x were based on a dynamic design (with a minimum clock frequency needed to retain internal register values). The UCA can also test all members of the “XL” family and even detect their stepping (A-/B- or C-step) :

The maximum frequency for the UCA is 20 MHz because 186/188 requires a clock doubled input and I wanted to avoid an external PLL to keep cost low (the 186 adapter is a simple 2-layer PCB). Adding  support for it to reach 25 MHz (or much more) is trivial but that will almost double the BOM price for the adapter (from ~$10 to ~$20).

Intel also released the 80C186EB (5V) and 80L186EV (3V) in 1990 and the 80C186/188EA & 80C186/188EC one year later (also available in ‘L’ version).  The 80C186EA in PLCC-68 package is very close to the 80C186XL. The main differences are some more advanced power saving modes and TTL-level inputs compatibility (while the XL requires CMOS-level inputs). I’m still looking for one, but they should work fine on the UCA. The “EB” line adds an improved chip-select unit, two UART for serial communication and 16 GPIO. While electrically able to run on the UCA, they come in a bigger PLCC-84 and PGA-88 packages and don’t fit physically. The “EC” line adds even more GPIOs and is only available in SMD QFP-100 packaging. Designing an adapter for EB and EC 186/188s is not planned at this time.

Stay tuned for another big UCA milestone in the next few days!

PS: PLCCs 80188/186 are also supported!

While developing the 486 Adapter for the Universal Chip Analyzer, I was worrying about how to distinguish between early CPUs from AMD and Intel (the ones without CPUID instruction support). There is no way to distinguish them because they’re basically the exact same chip: same microcode, same architecture, same power consumption, etc. AMD used the Intel’s die for its whole early 486 line and only the external packaging was different. Thus, no BIOS nor any software detection tool can distinguish between an early AMD Am486DX2-66NV8T and an Intel 486 DX2-66. Both even share the same ID set in EDX register at boot.

I carefully read the datasheets and finally found a small difference between them. It’s located in the JTAG controller, embedded in all AMD 486s and Intel 486s starting with the DX-50. The JTAG controller is used as an internal test tool since the late 80s, standardized in 1990 as IEEE 1149.1 (“Standard Test Access Port and Boundary-Scan Architecture“). It’s now an industry-standard feature present in all complex ICs for debugging purposes. JTAG was commonly used in the 90s to remotely sense the state of all hardware pins with the ability to toggle them individually between 0, 1 and High-Z (floating).

The JTAG controller is generally totally isolated from the CPU: you can’t access any of the internal test features nor test registers from the code running on the CPU. (Some years ago, Intel added a feature to access JTAG from USB, which caused some serious vulnerabilities). Back in the 90s, JTAG access had to be done from dedicated CPU pins called the TAP (Test Access Port). The TAP uses 3 input pins (TMS for Chip Select, TCK for Clock and TDI for Data Input) and one output pin (TDO for Data Output). JTAG has been designed to daisy chain many ICs (boundary-scan).

The basic early JTAG implementation in 486s supports 5 instructions:

• • (0000b) EXTEST – Arbitrary setting of pins on the CPU to a given state (0, 1, Z)
  • (0001b) SAMPLE – Poll and report the status of all CPU pins.
  • (0010b) IDCODE – Used for chip identification
  • (1000b) RUNBIST – Launch the internal self-test, built-in on all CPUs since the 386s
  • (1111b) BYPASS – Connect TDI with TDO to bypass the chip (when talking with another IC in the chain)

According to Intel’s datasheet, the IDCODE instruction reports a 32-bit register with the following format:

The Manufacturer Identity is a 11-bit value linked to the chip manufacturer:  0x09 for Intel and 0x01 for AMD. That’s how you can distinguish between an Intel and AMD 486. JTAG is not available on Cyrix, TI and UMC 486s, but these CPUs don’t use the Intel Microcode and they have other identification methods. Accessing the IDCODE register to distinguish AMD and Intel 486s requires specific hardware. Due to limitations in I/O lines available from the FPGA and the tiny space available on the PCB, I chose to add an extremely tiny ATMega328P-MN (0.5 mm pitch!) on the 486 Adapter to access the JTAG port:

The code for bit-banging JTAG commands and communicating with the JTAG controller was quickly written, thanks to this blog that published a nice proof-of-concept many years ago. I then added the link between the FPGA and the outside world to grab the JTAG data from the Windows companion tool. I took the opportunity to rewrite almost all the communication stack between the Universal Chip Analyzer, its integrated MCU and the FPGA.  Let’s try with some real-world 486s!

* AMD Am486DX2-66NV8T

The JTAG IDCODE register reported (0x00432003) strictly follows Intel’s datasheet:

• • • Bit[0] = 1 (JTAG constant)
    • Bit[11:1] = 0x01 (AMD’s Manufacturer ID)
    • Bit[27:12] = 0x0432 (Part Number = CPUID Family/Model/Revision)
    • Bit[31:28] = 0 (Revision not set)

As expected, the Part Number filed by AMD is the same as the value reported in the DX register just after boot. All Am486s I tested follow this scheme. I noted that the value reported on the JTAG IDCODE register changes with features activated (2x or 3x multiplier, WT or WB cache mode) just like the CPUID value.

 * Intel 486DX2-66

Here is the most interesting part. For some reason, Intel does not follow its own public datasheet on most of its CPUs. Many Intel’s 486-era datasheets show the JTAG bit order as previously described, but the real value returned by many CPUs I tested often reports a totally different organization (only described properly on a printed Intel Datasheet I own).

 

The raw JTAG IDCODE register value reported on an early i486 DX2-66 (SX626) is 0x00432013 as expected, but a late one (SX955) returns another encoding: 0x40285013. It decodes as follows:

• • • Bit[0] = 1 (JTAG constant)
    • Bit[11:1] = 0x09 (Intel’s Manufacturer ID)
    • Bit[16:12] = 0x05 (Proprietary Model Code)
    • Bit[20:17] = 0x04 (CPUID Family, 0x04 = 486)
    • Bit[26:21] = 0x01 (Intel Architecture Type, 1 = x86)
    • Bit[27] : 0x00 (Core Voltage – 1 = 3.3V / 0 = 5V)
    • Bit[31:28] = 0x04 (Proprietary Revision Code)

The Model Code reported in the 5-bit field in bits 16:12 is different than the 4-bit “Model” code read in DX at reset. Here is what I noted:

• • • 0x01 = 486 DX
    • 0x02 = 486 SX
    • 0x05 = 486 SX2 or DX2
    • 0x07 = 486 DX2 w/ WT Cache
    • 0x08 = 486 DX4

Support for JTAG is definitely an interesting feature to dive deeper in the 486 architecture. As for today and as far I know, the Universal Chip Analyzer is the only hardware or software tool to distinguish between an Am486 and an Intel 486.

More UCA news soon!

 

Another milestone – albeit not the hardest one – has been reached! The 80286 is the 2^nd gen 16-bit x86 CPU introduced by Intel in 1982. The most important improvement was the use of a separated data and address bus. Its predecessor, the famous Intel 8086, used the same pins to send address and then data. The lack of that slow time-multiplexed bus on the 286 allowed a major performance boost, sometimes more than 100% at a similar clock speed. The microarchitecture also evolved with a more advanced (dedicated) address calculation unit and a faster multiplier. The 80286 was also able to support up to 16 MB of RAM, thanks to its 24-bit address bus.

The 80286 also introduced the protected mode, designed to allow much more advanced memory management, with the ability to build multi-user systems using multitasking applications. Unfortunately, due to several limitations in that first implementation, along with several hardware errata found in earlier stepping, protected mode wasn’t really used by software developers on the 286. Intel only solved all these issues with the 80386. The Intel 80286 was initially released at 4, 6 and 8 MHz on nMOS 1.5 µm process. Later released reached 12.5 MHz in 1 µm CMOS process. Several other companies produced CPU fully based on Intel’s 286 microcode like AMD, Siemens and Harris, with speed up to 25 MHz!

Three common 68-pin packages were used for the vast majority of the 80286s ever produced: the original ceramic PGA, a leadless LCC (also ceramic) and a plastic PLCC. On the picture above, you can see an AMD R80286-8 (LCC) and a Harris CS80C286-25 (PLCC). The Universal Chip Analyzer is able to test all three packages just by plugging the related socket on the PGA DIP Socket. Frequencies available (by DIP Switches or software) are 4, 8, 10, 12.5, 16 and 20 MHz.

Why not 25 MHz? Because the 80286 requires a clock-doubled input and feeding a 50 MHz clock to get the 25 MHz core frequency would have required an external PLL. Not a big deal, but there is only one rare 286-class CPU that supports this frequency (the Harris/Intersil CS80C286-25 pictured above) and its timings is not fully compliant with the 286 specifications. Designing a special UCA adapter just for this chip is trivial, but quite useless because the 286 Adapter is already able to test it at 20 MHz. Speaking about “high” frequencies, using the right socket is crucial  

The UCA 286 Adapter is fitted with a high-quality DIP Socket. Directly plugging a PGA 286 CPU is possible but not convenient for testing multiple CPUs in a row.  I was able to secure some ZIF Sockets for 68-pin PGA like the blue one pictured here (from AMP) and also some 3M LCC sockets complete with top cap. About PLCCs, I first tried some cheap socket from eBay. That was a disaster: contact pins were too weak and bent after 2-3 insertions. Worst, the maximum frequency allowed was 8-10 MHz. Replacing these crappy sockets with other ones from Foxconn or 3M solved all the issues. I also bought some awesome Yamaichi test Socket for PLCC (on the right), but unfortunately, they use a specific pinout. As the 286 Adapter uses a simple 2-layer PCB, I will consider designing a specific PCB just for them.  

With the hardware finished, I’ll later tune the software-testing code to see if I can detect various stepping, and maybe also the manufacturer.