[UCA CPU Analysis] Prototype UMC Green CPU U5S-SUPER33

While sorting some new Engineering Samples I received lately, I exhumed some prototypes from my collection. They came without missing pins, so they are good candidates for an advanced investigation with the Universal Chip Analyzer.

Let’s begin with the first one, a UMC Green CPU U5S-SUPER33

It’s marked “Confidential” on the last line, which means it’s an engineering sample. The date code is quite early: 9416. It was manufactured on the third week of April 1994. This CPU is not one of the very first samples of the whole U5S line regardless of the frequency, but probably a prototype for the specific 33 MHz version. Also notice the famous “Not for U.S. sale or import” line, written here because UMC was afraid – and rightly so – of the legal consequences of infringing Intel’s ‘338 patent.

Let’s try it on the Universal Chip Analyzer:

The prototype works fine up to 33 MHz. One of the first interesting points to check is the support of the CPUID instruction on such an early prototype. A few weeks ago, I was chatting with mtx500 (another well-known and very technical-aware CPU collector) about the way to detect UMC CPUs. He told me he uses the SALC/FS method to distinguish UMCs. The idea is to use the undocumented Intel opcode 0xD6 “SALC” (Set AL on Carry) instruction with the 0x64 “FS:” prefix. Only on a UMC, the combined 0xD6 0x64 opcodes return the “magic” constant 0x0AB6B1B07 in the EAX register.

I was wondering why to use this method when the CPUID instruction is supported? Mtx500 told me that early U5S might not support the CPUID instruction, so I was impatient to try on an early U5S like this one. It looks like the CPUID instruction is well supported, with the expected “UMC UMC UMC” string reported as well as the usual 0x423 family/model/revision on U5S(X). At first sight, this prototype looks strictly identical to the retail version. I ran some benchmarks to compare with later U5S and the cycle count of the test instruction flow is exactly the same.

However, on closer inspection, I found a noteworthy difference: power consumption. I ran the same INT benchmark on my 4 U5S with the voltage set at 5.11V exactly on all of them. The UCA is quite precise at measuring power consumption. All of them were tested at a fixed 33.3 MHz frequency, no matter their rated maximum speed.

The results are quite interesting. As you can see, all my retail U5S consume (almost) the same current: about 308 mA at 33 MHz while running my benchmark code. For an unknown reason, the U5SD is a bit higher at 321 mA, but the difference in power is only 50 mW. In the opposite, the prototype U5S-33 need MUCH more power to process the exact same code in the same time at the same frequency with the same voltage: 421 mA, which translate to about 2.15 watts.

The most obvious explanation is a switch in manufacturing process between the early prototype and the commercial revision. UMC was, at that time, one of the two major IC manufacturers in Taiwan, along with TSMC. We can consider they can switch easily between processes. On the very first U5S datasheet published in 1993, UMC indicates the U5S is built using a 0.6 µm CMOS process. This is consistent with the power consumption seen on the sample. I was able to find a table of the manufacturing process evolution in Taiwan in the 90s.

UMC and TSMC switched from 0.6 µm in 1993 to 0.4 µm in 1994. According to this table, it seems likely that the prototype is build using the ’93 process (0.6 µm) while UMC switched to the ’94 process (0.4 µm) for their retail mass-volume production. The retail U5S tested here need about 27% less power than the prototype. The theoretical reduction in power consumption between 0.6 µm and 0.4 µm is 33%, so that makes perfect sense. This Engineering sample is probably an early U5S manufactured with the original 1993 0.6 µm process. It is unknown at this point if retail (non-prototype) UMC Green CPU have ever been built with that process. Another analysis with a retail U5S produced earlier than August 1994 (Week 33’94) would allow us to be sure…

Identifying “blank” 486s with the UCA #1

The Universal Chip Analyzer is useful to test and spot counterfeits CPUs, but also to help identify CPUs without markings. The lack of printings on a CPU can be caused by a poor ink quality that gradually faded out over years, by abrasion with other ICs (common when you saved a nice CPU from a “scrap lot”) or because it’s an early engineering sample (prototype). Here are two examples.

Let’s start with the first one.

It’s supposed to be an early engineering sample coming from ST Microelectronics. Hand-writing on top are “X2, Y4 #7”, probably related to the coordinates of this particular die on the wafer (X=2 , Y=4) and the wafer number (#7), and also “PLL”, which probably mean it was designed to test the integrated Phase-Lock Loop (clock multiplier). The back of the CPU shows that the PLL was configured for “3XCLK”. So it’s a DX4 class CPU. But it could also be a 5×86 ES. I have tested it on the UCA at 3.45V.

All 486s from ST are just rebranded Cyrix 486s and this one makes no exception. It identifies itself as a Cyrix Cx486DX4 (M0.7). The most interesting point is the stepping. I have one It’s ST ST486 DX4-100 (you can see it here) and another Cyrix Cx486DX-100GP4. Both come with stepping 3.6. This sample uses stepping 4.0. I do not have any Cyrix 486s (or IBM or It’s ST) with such a late stepping. I am not even sure this stepping finally reached the commercial status. This sample works perfectly fine at 120 MHz (3×40 MHz) with 3.45V while my Cyrix DX4-100 requires 3.6V to work at 120 MHz and the retail It’s ST doesn’t work at all when overclocked at 120 MHz.

At this point, I have no proof that this sample comes from TI and not directly from Cyrix. Anyway, it could be an engineering sample for a hypothetical Cx486DX4-120, that was finally canceled to avoid hurting 5×86 sales. Interesting.

Here is the other one.

The package marking (25253) tell us it’s an early AMD 486s assembled by Kyocera, but there is nothing more written on top or back of the chip. Package number is almost often used for 3.3V parts (while 5V parts from the same era come on the 25220 package). Time to plug it on the UC!

Early AMD 486s use the Intel 486 microcode, so they’re virtually indistinguishable by software. I’m testing a very nice way to distinguish them but that’s another story (I’m waiting for a new PCB and I’ll tell you more if it works as expected). The CPUID have 8 KB of L1 write-through cache and the CPU doesn’t support write-back, so it’s a (N)V8T revision and not a later SV8B. It doesn’t support 3x multiplier, so it’s a DX2 and not a DX4. Testing various frequencies shows it can work fine at 40 MHz. This unmarked CPU is probably an Am486DX2-80 NV8T, or maybe an Am486DX2-66 NV8T with a good overclocking capability. Nothings suggest it’s an engineering sample. Markings have probably faded over time (or have been removed due to mechanical action).

[UCA CPU Analysis] Intel 486 DX2-66 SYE36 ES

I’m starting a new section: IC Analysis! The goal is to study odd or rare CPUs with the Universal Chip Analyzer. As an avid CPU collector, I have many of them. Since I started collecting back in the early 00s, I have only been interested in Engineering Samples. These are basically prototypes of retail CPUs. Knowing their specification is often very interesting for historical purposes (ie: to retrace the timeline of the development).

Let’s start with this 486 DX2-66 Engineering Sample:

This processor is uncommon in many respects, even for an engineering sample. It comes with the standard Intel i486 DX2 logo but other writings are printed instead of being laser-engraved. The part number on the first line (“A80486DX2-66”) is the retail one, while Intel often used the code number (“P24” or “A80P24”) on early prototypes of the 486DX2.

The second line shows the date when the die (the piece of silicon where the CPU has been engraved) was assembled inside the ceramic packaging: week 22 of 1992, so between May 25th and May 31st, 1992. The date when the die itself has been produced is marked on the back: week 17 of 1992 (between April 20 & 26, 1992). Intel officially introduced the first clock-doubled 486DX2 at 50 MHz on March 3rd, 1992. The 486DX2 at 66 MHz was launched five months later, on August 10th, 1992. This sample has been produced before the initial production of the 486DX2-66.

Another very rare feature of this CPU is the Intel’s product spec number used. From the 70s until today, Intel has used a 5-digit alphanumeric code (named “S-Spec”) to identify all their retail products. An S-Spec always starts with the letter “S” (ie: SX366 is a 80386 DX-33 and SR147 is a Core i7 4770K). The only exception is for prototypes (engineering or qualification samples), where the code begins with a “Q”. The presence of that “Q-Spec” (also named QDF) on a CPU is the most effective way to distinguish a pre-production sample from its standard production counterpart. On this obvious engineering sample (also marked “ES” on front), the QDF starts with S: “SYE36”. For a very short period (1991/1992), Intel produced some 386/486 Engineering samples with a spec code starting with “SXE”, “SYE” and “SZE”. The reason is still unknown, but this sample is one of them.

It’s now time to test this SYE36 sample with the UCA

And It works fine! This early sample does not support the CPUID instruction, but the value at reset is 0x433. The first commercial stepping is A2 with a CPUID set at 0x432. Only a DX2-50 has been released with this stepping, which didn’t seem able to run properly at 66 MHz. This sample uses the B1 stepping, like the first retail 486 DX2-66 (SX645) released. Power consumption measured on FPU benchmark mode is quite high (4.3 W) but still within specs (4.5 W). Later DX2-66s need less energy.

Despite its unusual markings, it seems this sample was a qualification sample rather than a “true” engineering sample. It was probably sent to Intel’s customers for validation some weeks before the official launch. Other than that, it’s strictly identical to a SX645 486 DX2-66.

Spotting Counterfeit Am486 with the UCA

While I was adding support for AMD CPU on the Universal Chip Analyzer, I spotted what looked-like a strange chip at first sight. I was then working on the L1 cache size detection, to distinguish between CPUs with 8 KB and others with 16 KB. In their BIOS Development Guide, AMD wrote a specific code that checks the status of a tag bit in a test register (TR4). After implementing this test path in the x86 code run by the CPU on the UCA, I needed a CPU with 16 KB L1 cache to try on 486 (5x86s were OK). I found this uncommon Am486 :

This is a nice Am486 DX4-100V16BGI. This part number decodes as follows:  A clock tripled (“DX4”) CPU rated at 100 MHz (“100”) and 3.3V (“V”), with a 16 KB (“16”) Write-Back (“B”) L1 cache in a 168-pin PGA package (“G”) and qualified at Industrial temperature range (“I”). This last point is uncommon because the vast majority of Am486 are “Commercial” grade (0°C to 85°C) and not “Industrial” (-40°C to +100°C). That’s probably why I bought this CPU years ago.

But the AMD code was not working: the size of the cache detected was 8 KB instead of 16 KB. I began to have doubts about the genuineness of this CPU. I started to play with the UCA. No way to enable Write-Back: the CPU stays in Write-Through Mode and the CPUID does not change accordingly as on “SV8B” AMD 486s. This CPU does not support Write-Back. I suspected a remarked early “NV8T” DX4-100, but that was not the case: they come with a CPUID 0x484 and this CPU was 0x482 in 3x Mode and 0x432 in 2x Mode.

I was able to find a very early Am486DX2-80 V8T (notice the lack of “N”) manufactured in 1994 with the first A-Stepping. The UCA detects a CPUID set at 0x432, which match with my fake DX4 (in 2x Mode). Early Am486DX4-100 V8T also exists with a CPUID 0x482 in 3x Mode. Some of them seem to have been later remarked to Am486 DX4-100V16BGI.

On closer inspection, several points should have caught my attention about this CPU. No way to be certain of what it really was without the UCA, but the fact that it was a fake could have been known sooner.

    1. Package code is wrong

The AMD package code is written in bottom left of all AMD CPUs from this era. The first AMD Am486s like the Am486DX-33/40 or very early Am486SX2/DX2s use the “24361” package. Later 486DX2 “V8T” and “NV8T” CPUS come in the “25220” or “25253” package. Enhanced “SV8B” DX4s (with SMI and Write-Back) are assembled with the “25398” package. Then we have package “25498” for newer CPUs like the Am486DE2. Later models (SV16B and 5×86) use the “25544” package”. This later one was expected for a genuine Am486DX4-100V16BGI, but the fake CPU comes with an old “25253” (N)V8T package.

Package code is “25253”, similar than old (N)V8T Am486
    1. Markings without hatching

As you can see in the picture below, AMD markings on CPUs from this era use a typical hatching pattern. This pattern is not present at all on the fake CPU.

    1. Marking error

But the most obvious error is a big mistake on printing. Here you can see the word “COMPATIBLE” is actually spelled “COMPATTBLE”, with a double “T”.

There is no doubt at this point that this CPU is a counterfeit Am486DX4. The only question remaining is when was it remarked by fakers? Counterfeits CPUs – especially 486s – were common in the 90s to boost frequency, but here, the original CPU was already an Am486DX4-100 (albeit a very early one with 8 KB L1 Write-Though Cache, instead of the expected 16 KB L1 Write-Back Cache). More recently, in the mid-2010s, old CPUs from the 90s were also faked to target CPU collectors all over the world.

Looking at eBay listings right now (2020-04-23), I found 4 vendors selling Am486 DX4-100V16BGI for a (very) high price. Two of them – including one who only sells multiple 30 pcs lots – are obviously the same fake as the sample analyzed here. The other two look different but still highly suspicious, with a Windows Logo not on par with the unusual Windows printing from AMD for the first one, and a very odd font for the second one (seems also marked “COMPATIBLF”)

Collectors beware of these CPUs!