The Odd Story of Factory-Downgraded 486s

Counterfeits CPU were very common in the mid-90s. The worst period was between 1993 (just after the launch of the Intel 486 DX2) and 1998 (when the Pentium II started to be multiplier-locked). It was extremely easy for tricksters to remove the original marking and reprint another one with a higher frequency rating. Many DX4-75 were remarked to DX4-100, and even more Pentium 133/150 were remarked as Pentium 166 or 200s.

Genuine factory-remarked CPUs also exist, but they’re generally uncommon. The most well-known example is the double-sigma (ΣΣ) sign added on early 386s after they had been tested bug-free from the infamous 32-bit multiplier bug. Some rare Intel 486 SX were also later remarked with a higher speed grade. Here are two of them:

As for all factory-remarks, the addition is quite obvious. Intel probably binned twice these CPUs again at the request of a big customer (IBM?) and added the second rating later. Today’s story about factory-remarks is much more unusual because it concerns standard models.

Am486DX4-100SV8B (remarked 5×86)

After I published this analysis some weeks ago, a reader told me he had a strange Am486DX4-100 that seemed to be a AMD 5×86. After a careful look at the printings that looked 100% genuine at first sight, he was kind enough to lend it to me for further investigation with the UCA. Here it is:

The “9626” date code tells us it was manufactured in late June or early July 1996, which is quite late for a Am486DX4. I immediately noticed the 25544 package code, only used for the 350 nm die. This die was the basis of all Am486DX5 and Am5x86. The “C” stepping was also unusual as the Am5x86 is based on the A-step (from November 1995) or B-Step (from March 1997). A “C” Stepping build in 1996 is incoherent with the 5×86 line, but very coherent with the 486DX4 (later 486DX4 in the latest “C” Stepping were built on the 25498 package in May/June 1996). So it was time for a test on the Universal Chip Analyzer:

 

WOW! There is no doubt: this CPU is really based on the standard 350 nm die with a fully enabled 16 KB Write-Back L1 cache and a working 4x multiplier. Actually, it can even be overclocked easily to 133 MHz. All specs, including power consumption and CPUID (0x4F4), make it indistinguishable from an AMD 5×86. This CPU can of course also work with a 3x multiplier like an AMD 486DX4-100 (CPUID drops to 0x494).

After some research, it seems that all CPUs based on the 25544/C package are marked as 486DX4-100SV8B while being really DX5 SV16B (5×86). AMD produced them for quite some time between February 1996 and March 1997. They probably stopped the production of the old 500 nm die in early ’96 but still had some demand from customers for DX4s, so they just used the new 350 nm die and marked these CPUs as DX4-100s. As long as you use the default x3 multiplier, they behave exactly like the old one … except for the cache size.

Has Intel also done such weird things? I could have sworn no way. I was wrong…

Intel 486DX2-66 SK080 (remarked DX4)

The same reader also sends me a DX2-66 that could be “really a DX4-100”. That sounded odd and really unlikely to me because Intel has a strict policy on S-Spec. Intel DX4s also have a specific CPUID to help distinguish them from DX2s by software. Unlike AMD 486s, this CPUID does NOT change with the multiplier used, so it’s strange to have a DX2 with a DX4’s CPUID. Here is the original CPU:

Everything looks genuine here. SK080 is one of the least common S-Spec for Intel DX2s. The only other S-Spec beginning with “SK” is the extremely rare SK058. The SK080 is a 3.3V SL-Enhanced part which seems to have been produced only between WW18’94 (May 1994) and WW48’94 (November 1994). Let’s plug in into the UCA:

Awesome! This is really a DX4 factory-downgraded to DX2-66. The 0x480 CPUID leaves no doubt about the original die used here. The usual power consumption and the ability to work fine at 3.3V at 100 MHz let me think it’s probably a DX4-100. With the multiplier set at 2x, the SK080 also works at 2×33 MHz as expected for a CPU marked as a DX2-66. To be 100% sure, I was able to find another sample to confirm these findings.

[Guide] Am486 Die & Packaging

After weeks spent to test A LOT of AMD 486 with the Universal Chip Analyzer, messing with a gas torch  to decap some of them and speaking with a former AMD engineer that worked on them back in the 90s, I’m happy to publish here all the information I was able to get! Here it is:

The Ultimate AMD 486 Die & Packaging Guide

 

PS: If you have any more information about AMD 486, please leave a comment. Thanks!

[UCA CPU Analysis] Prototype UMC Green CPU U5S-SUPER33

While sorting some new Engineering Samples I received lately, I exhumed some prototypes from my collection. They came without missing pins, so they are good candidates for an advanced investigation with the Universal Chip Analyzer.

Let’s begin with the first one, a UMC Green CPU U5S-SUPER33

It’s marked “Confidential” on the last line, which means it’s an engineering sample. The date code is quite early: 9416. It was manufactured on the third week of April 1994. This CPU is not one of the very first samples of the whole U5S line regardless of the frequency, but probably a prototype for the specific 33 MHz version. Also notice the famous “Not for U.S. sale or import” line, written here because UMC was afraid – and rightly so – of the legal consequences of infringing Intel’s ‘338 patent.

Let’s try it on the Universal Chip Analyzer:

The prototype works fine up to 33 MHz. One of the first interesting points to check is the support of the CPUID instruction on such an early prototype. A few weeks ago, I was chatting with mtx500 (another well-known and very technical-aware CPU collector) about the way to detect UMC CPUs. He told me he uses the SALC/FS method to distinguish UMCs. The idea is to use the undocumented Intel opcode 0xD6 “SALC” (Set AL on Carry) instruction with the 0x64 “FS:” prefix. Only on a UMC, the combined 0xD6 0x64 opcodes return the “magic” constant 0x0AB6B1B07 in the EAX register.

I was wondering why to use this method when the CPUID instruction is supported? Mtx500 told me that early U5S might not support the CPUID instruction, so I was impatient to try on an early U5S like this one. It looks like the CPUID instruction is well supported, with the expected “UMC UMC UMC” string reported as well as the usual 0x423 family/model/revision on U5S(X). At first sight, this prototype looks strictly identical to the retail version. I ran some benchmarks to compare with later U5S and the cycle count of the test instruction flow is exactly the same.

However, on closer inspection, I found a noteworthy difference: power consumption. I ran the same INT benchmark on my 4 U5S with the voltage set at 5.11V exactly on all of them. The UCA is quite precise at measuring power consumption. All of them were tested at a fixed 33.3 MHz frequency, no matter their rated maximum speed.

The results are quite interesting. As you can see, all my retail U5S consume (almost) the same current: about 308 mA at 33 MHz while running my benchmark code. For an unknown reason, the U5SD is a bit higher at 321 mA, but the difference in power is only 50 mW. In the opposite, the prototype U5S-33 need MUCH more power to process the exact same code in the same time at the same frequency with the same voltage: 421 mA, which translate to about 2.15 watts.

The most obvious explanation is a switch in manufacturing process between the early prototype and the commercial revision. UMC was, at that time, one of the two major IC manufacturers in Taiwan, along with TSMC. We can consider they can switch easily between processes. On the very first U5S datasheet published in 1993, UMC indicates the U5S is built using a 0.6 µm CMOS process. This is consistent with the power consumption seen on the sample. I was able to find a table of the manufacturing process evolution in Taiwan in the 90s.

UMC and TSMC switched from 0.6 µm in 1993 to 0.4 µm in 1994. According to this table, it seems likely that the prototype is build using the ’93 process (0.6 µm) while UMC switched to the ’94 process (0.4 µm) for their retail mass-volume production. The retail U5S tested here need about 27% less power than the prototype. The theoretical reduction in power consumption between 0.6 µm and 0.4 µm is 33%, so that makes perfect sense. This Engineering sample is probably an early U5S manufactured with the original 1993 0.6 µm process. It is unknown at this point if retail (non-prototype) UMC Green CPU have ever been built with that process. Another analysis with a retail U5S produced earlier than August 1994 (Week 33’94) would allow us to be sure…

Identifying “blank” 486s with the UCA #1

The Universal Chip Analyzer is useful to test and spot counterfeits CPUs, but also to help identify CPUs without markings. The lack of printings on a CPU can be caused by a poor ink quality that gradually faded out over years, by abrasion with other ICs (common when you saved a nice CPU from a “scrap lot”) or because it’s an early engineering sample (prototype). Here are two examples.

Let’s start with the first one.

It’s supposed to be an early engineering sample coming from ST Microelectronics. Hand-writing on top are “X2, Y4 #7”, probably related to the coordinates of this particular die on the wafer (X=2 , Y=4) and the wafer number (#7), and also “PLL”, which probably mean it was designed to test the integrated Phase-Lock Loop (clock multiplier). The back of the CPU shows that the PLL was configured for “3XCLK”. So it’s a DX4 class CPU. But it could also be a 5×86 ES. I have tested it on the UCA at 3.45V.

All 486s from ST are just rebranded Cyrix 486s and this one makes no exception. It identifies itself as a Cyrix Cx486DX4 (M0.7). The most interesting point is the stepping. I have one It’s ST ST486 DX4-100 (you can see it here) and another Cyrix Cx486DX-100GP4. Both come with stepping 3.6. This sample uses stepping 4.0. I do not have any Cyrix 486s (or IBM or It’s ST) with such a late stepping. I am not even sure this stepping finally reached the commercial status. This sample works perfectly fine at 120 MHz (3×40 MHz) with 3.45V while my Cyrix DX4-100 requires 3.6V to work at 120 MHz and the retail It’s ST doesn’t work at all when overclocked at 120 MHz.

At this point, I have no proof that this sample comes from TI and not directly from Cyrix. Anyway, it could be an engineering sample for a hypothetical Cx486DX4-120, that was finally canceled to avoid hurting 5×86 sales. Interesting.

Here is the other one.

The package marking (25253) tell us it’s an early AMD 486s assembled by Kyocera, but there is nothing more written on top or back of the chip. Package number is almost often used for 3.3V parts (while 5V parts from the same era come on the 25220 package). Time to plug it on the UC!

Early AMD 486s use the Intel 486 microcode, so they’re virtually indistinguishable by software. I’m testing a very nice way to distinguish them but that’s another story (I’m waiting for a new PCB and I’ll tell you more if it works as expected). The CPUID have 8 KB of L1 write-through cache and the CPU doesn’t support write-back, so it’s a (N)V8T revision and not a later SV8B. It doesn’t support 3x multiplier, so it’s a DX2 and not a DX4. Testing various frequencies shows it can work fine at 40 MHz. This unmarked CPU is probably an Am486DX2-80 NV8T, or maybe an Am486DX2-66 NV8T with a good overclocking capability. Nothings suggest it’s an engineering sample. Markings have probably faded over time (or have been removed due to mechanical action).

[UCA CPU Analysis] Intel 486 DX2-66 SYE36 ES

I’m starting a new section: IC Analysis! The goal is to study odd or rare CPUs with the Universal Chip Analyzer. As an avid CPU collector, I have many of them. Since I started collecting back in the early 00s, I have only been interested in Engineering Samples. These are basically prototypes of retail CPUs. Knowing their specification is often very interesting for historical purposes (ie: to retrace the timeline of the development).

Let’s start with this 486 DX2-66 Engineering Sample:

This processor is uncommon in many respects, even for an engineering sample. It comes with the standard Intel i486 DX2 logo but other writings are printed instead of being laser-engraved. The part number on the first line (“A80486DX2-66”) is the retail one, while Intel often used the code number (“P24” or “A80P24”) on early prototypes of the 486DX2.

The second line shows the date when the die (the piece of silicon where the CPU has been engraved) was assembled inside the ceramic packaging: week 22 of 1992, so between May 25th and May 31st, 1992. The date when the die itself has been produced is marked on the back: week 17 of 1992 (between April 20 & 26, 1992). Intel officially introduced the first clock-doubled 486DX2 at 50 MHz on March 3rd, 1992. The 486DX2 at 66 MHz was launched five months later, on August 10th, 1992. This sample has been produced before the initial production of the 486DX2-66.

Another very rare feature of this CPU is the Intel’s product spec number used. From the 70s until today, Intel has used a 5-digit alphanumeric code (named “S-Spec”) to identify all their retail products. An S-Spec always starts with the letter “S” (ie: SX366 is a 80386 DX-33 and SR147 is a Core i7 4770K). The only exception is for prototypes (engineering or qualification samples), where the code begins with a “Q”. The presence of that “Q-Spec” (also named QDF) on a CPU is the most effective way to distinguish a pre-production sample from its standard production counterpart. On this obvious engineering sample (also marked “ES” on front), the QDF starts with S: “SYE36”. For a very short period (1991/1992), Intel produced some 386/486 Engineering samples with a spec code starting with “SXE”, “SYE” and “SZE”. The reason is still unknown, but this sample is one of them.

It’s now time to test this SYE36 sample with the UCA

And It works fine! This early sample does not support the CPUID instruction, but the value at reset is 0x433. The first commercial stepping is A2 with a CPUID set at 0x432. Only a DX2-50 has been released with this stepping, which didn’t seem able to run properly at 66 MHz. This sample uses the B1 stepping, like the first retail 486 DX2-66 (SX645) released. Power consumption measured on FPU benchmark mode is quite high (4.3 W) but still within specs (4.5 W). Later DX2-66s need less energy.

Despite its unusual markings, it seems this sample was a qualification sample rather than a “true” engineering sample. It was probably sent to Intel’s customers for validation some weeks before the official launch. Other than that, it’s strictly identical to a SX645 486 DX2-66.

Spotting Counterfeit Am486 with the UCA

While I was adding support for AMD CPU on the Universal Chip Analyzer, I spotted what looked-like a strange chip at first sight. I was then working on the L1 cache size detection, to distinguish between CPUs with 8 KB and others with 16 KB. In their BIOS Development Guide, AMD wrote a specific code that checks the status of a tag bit in a test register (TR4). After implementing this test path in the x86 code run by the CPU on the UCA, I needed a CPU with 16 KB L1 cache to try on 486 (5x86s were OK). I found this uncommon Am486 :

This is a nice Am486 DX4-100V16BGI. This part number decodes as follows:  A clock tripled (“DX4”) CPU rated at 100 MHz (“100”) and 3.3V (“V”), with a 16 KB (“16”) Write-Back (“B”) L1 cache in a 168-pin PGA package (“G”) and qualified at Industrial temperature range (“I”). This last point is uncommon because the vast majority of Am486 are “Commercial” grade (0°C to 85°C) and not “Industrial” (-40°C to +100°C). That’s probably why I bought this CPU years ago.

But the AMD code was not working: the size of the cache detected was 8 KB instead of 16 KB. I began to have doubts about the genuineness of this CPU. I started to play with the UCA. No way to enable Write-Back: the CPU stays in Write-Through Mode and the CPUID does not change accordingly as on “SV8B” AMD 486s. This CPU does not support Write-Back. I suspected a remarked early “NV8T” DX4-100, but that was not the case: they come with a CPUID 0x484 and this CPU was 0x482 in 3x Mode and 0x432 in 2x Mode.

I was able to find a very early Am486DX2-80 V8T (notice the lack of “N”) manufactured in 1994 with the first A-Stepping. The UCA detects a CPUID set at 0x432, which match with my fake DX4 (in 2x Mode). Early Am486DX4-100 V8T also exists with a CPUID 0x482 in 3x Mode. Some of them seem to have been later remarked to Am486 DX4-100V16BGI.

On closer inspection, several points should have caught my attention about this CPU. No way to be certain of what it really was without the UCA, but the fact that it was a fake could have been known sooner.

    1. Package code is wrong

The AMD package code is written in bottom left of all AMD CPUs from this era. The first AMD Am486s like the Am486DX-33/40 or very early Am486SX2/DX2s use the “24361” package. Later 486DX2 “V8T” and “NV8T” CPUS come in the “25220” or “25253” package. Enhanced “SV8B” DX4s (with SMI and Write-Back) are assembled with the “25398” package. Then we have package “25498” for newer CPUs like the Am486DE2. Later models (SV16B and 5×86) use the “25544” package”. This later one was expected for a genuine Am486DX4-100V16BGI, but the fake CPU comes with an old “25253” (N)V8T package.

Package code is “25253”, similar than old (N)V8T Am486
    1. Markings without hatching

As you can see in the picture below, AMD markings on CPUs from this era use a typical hatching pattern. This pattern is not present at all on the fake CPU.

    1. Marking error

But the most obvious error is a big mistake on printing. Here you can see the word “COMPATIBLE” is actually spelled “COMPATTBLE”, with a double “T”.

There is no doubt at this point that this CPU is a counterfeit Am486DX4. The only question remaining is when was it remarked by fakers? Counterfeits CPUs – especially 486s – were common in the 90s to boost frequency, but here, the original CPU was already an Am486DX4-100 (albeit a very early one with 8 KB L1 Write-Though Cache, instead of the expected 16 KB L1 Write-Back Cache). More recently, in the mid-2010s, old CPUs from the 90s were also faked to target CPU collectors all over the world.

Looking at eBay listings right now (2020-04-23), I found 4 vendors selling Am486 DX4-100V16BGI for a (very) high price. Two of them – including one who only sells multiple 30 pcs lots – are obviously the same fake as the sample analyzed here. The other two look different but still highly suspicious, with a Windows Logo not on par with the unusual Windows printing from AMD for the first one, and a very odd font for the second one (seems also marked “COMPATIBLF”)

Collectors beware of these CPUs!