A bit of a trip down memory lane for me. I performed an analysis of the thermo-mechanical cyclic fatigue in later packages using detailed CAD, FEA and empirical tests. A lot of work went into finding it wasn’t a big deal for the most part. Still, I don’t recommend that museums power cycle old PCs daily…
Knowing nothing about how survival/durability testing is done in VLSI: how did you do the empirical tests?
For example, I know that thermal samples for the Pentium 5-era Xeon (Jayhawk) were produced, but I'd always wondered Intel went from the dummy to realizing "oh, shit, this is going to be way too hot in the long run."
I can’t really speak to the thermals other than as an input to my work. I was narrowly focused on the cyclic loading based on the temperature gradients (etc.) I was given.
For museums, would it be an option to instead of a cooler have a temperature control unit that keeps the package at a set temperature no matter wether the PC is operating or not? Just heating the chips surfaces might be cheaper than having the full PC on 24/7 with a semi constant load.
I'm just glad someone is putting hybrid packaging information in the public domain. The generalized background information is really helpful for engineers new to this very small area. This wiring is not as complex as the old military hybrids for sure. It may be six layers but there is only one monolithic.
This isn't about CT scanning, but about the chip itself.
Since the bond wires are just hanging out in air, does this mean that a chip like this could be ruined by dropping it which might cause the bond wires to move enough to short something?
If the chip is subjected to a few thousand g's of shock the wires can bend and short.
This failure mode is quite low on the list among others, but it is something that people did investigate. For example: "Swing Touch Risk Assessment of Bonding Wires in High-Density Package Under Mechanical Shock Condition"
https://asmedigitalcollection.asme.org/electronicpackaging/a...
Yes, that can be a problem. Story from one of my professors who worked on instrumentation and telemetry for a defense lab. They built a data recorder for artillery shells. In the early "flight" tests, the recorders failed and nobody could figure out why. They worked before and after. Then someone realized the high acceleration bent some of the bond wires in the chips, causing them to touch and short. The fix was surprisingly simple: make sure all chips face top down.
I'm not an expert in this area but I'd expect that the bond wires' mass is low enough relative to their stiffness that any shock sufficient to bend them would also shatter the ceramic package.
Genuine question: the website doesn't work in Russia. Did you restrict the access or is it my ISP doing that? Someone tries to prevent me from studying of very niche info on ancient Intel CPUs. Thanks! P.S. Big fan of your work!
I did find that, while running a financial startup, I was able to significantly reduce attacks on the server by disabling access from Russia and China. Not saying that's happening here, just my experience. That was a while ago so I'm sure things have changed since then.
Startups don't have enough free time to analyze individual ASNs, because they don't have enough people for that.
That and financial businesses usually don't operate outside their host country anyway. Though you do want your customers to see their accounts when they're traveling.
Thanks for your reply! I hope this is the real reason of blocking. If that's not the case, that's at least not effective. Less effective than idk placing a banner in the header or whatever.
I mean I eventually read the article. Sorry for that. But we're at "Hacker News", sporting hackers ethics, aren't we?
Some smaller sites ban ips from countries that continually try to hack into your server or just make a ton of requests, it happens to be that traffic is often from Russia and China. Could just be that.
Yeah. In the same vein I also don't distribute my app in the Play Store in certain countries. I realize it completely sucks for them, but it's purely a business decision. Certain countries are just very vocal in terms of negative reviews, simply swap 5 star and 1 stars due to cultural differences, and also bring in almost zero revenue. The net result of distributing in these countries is literally negative: they hurt my ratings and reviews and don't make up for that in terms of money.
> Unfortunately there are also many people in Ukraine who didn't personally do anything to deserve what's happening. Consider the country filter a small reminder of the ongoing war and a suggestion that you might find better opportunities outside Russia.
Does it look like the almost connected pins could have been purposely severed during production? ie: could they have been connected and then using a calculated pulse of power, disconnected?
Lumafield does all the work; I just get the images :-)
The data says 130 kV, 123µA. The whole scan took 21 hours: 1200 projections of 60 seconds each. I assume that they avoid artifacts by using a whole lot more radiation than medical imaging would permit.
I’m assuming each image was taken with 123 microamperes? Or is that total dosage over the 21 hours? If it’s total that’s much less than medical dosage, but if it’s per image that’s a lot more!
Thanks for the info, how interesting!
(for those who don’t know, mAs = mA • seconds = milliampere seconds. It’s how Radiographers measure how much x-ray photos are being produced by the tungsten filament in an X-ray tube. kVp is kiloVoltage potential and it’s how we measure the speed and thus the penetration power of the X-rays. 130kvp is slightly more than the 120kvp used for an avg human chest radiograph)
I took the metal lid off the chip to improve the scan quality. If I had left the chip intact, it would probably be fine. (I assume the X-ray levels are low enough to avoid damage, but I haven't confirmed that.)
With a good scope we could inspect 0.35um chips just fine. I honestly didn't look at die photos much after that until we started getting SEM images of 32nm and smaller chips
Went to a computer fair circa, gosh, 1989? My Dad bought me a 386 DX 25MHz with like 4MB of RAM and a whopping 40MB hard drive. This was a remarkable upgrade from the Tandy 286 16MHz that I was using. The 386 we got was not the standard 20MHz or 33MHz, 25MHz was some kind of hype thing, as I recall. The 33MHz was the bomb, but of course that cost more bones $$$$. The computer fairs were cool.
For 89 that's screamin! I remember early 90's getting a 50 mhz 8mb Gateway and it was amazing. Even just MS Paint and MS Word kept my sister and I plenty entertained making up stories and pictures to go along with them. Then I found MS DOS and QBasic and here I am posting on hacker news on a Saturday afternoon.
My father bought and built my first PC with an AMD 386DX40 in 1991 . I have good memories from these computer, and from the Spectrum +3 that He bought a year prior.
The anecdote about the 16-pin religion and the reluctance to use more pins is so good. It's often assumed that (later) successful companies were always making fantastic decisions in the earlier days, when in reality there were a few bizarre and harmful assumptions that were holding it back and needed to be forced out in order for rationality to prevail.
That lower level "Signals" CT image (layer 2) would have been an amazing background for the "Intel Inside" logo stickers. It has the proper era aesthetic and everything.
Anyways.. this is what I really like about kens work.. the accidental discovery of beautiful structures while trying to answer abstract questions. Thanks for doing all this!
with a bonding machine :)
doing that manually can be tedious, nowadays for IC that are bonded and not flipchipped it's all automatic. Manual bonding is still very used in research.
A20M# (F13) - when supported by motherboard you can L1 cache whole ram instead of leaving first 64KB uncached
FLUSH# (E13) - when supported by motherboard you dont have to use hacks and flush L1 on every DMA access. Hacks (BARB mode) seemed clever at the time until everyone had a Sound Blaster DMAing audio constantly invalidating cache while gaming.
RPLSET (C6) RPLVAl (C7)- L1 cache status debug outputs
SUSP# (A4) SUSPA# (B4)- suspend support, wakes on INT and NMI. Good for laptops.
>The surprising thing is that one of the No Connect pads does have the bond wire in place
Somehow Cyrix picked this particular pin (B12) for KEN# input (enable L1 cache) :O
>From the circuitry on the die, this pin appears to be an output
Meaning the _one_ NC pin Intel CPU actually wires, an output no less, Cyrix demands driven low to enable cache.
Since the 386 is a 32-bit processor, the address specifies a 32-bit word and doesn't use address bits A0 and A1. But what if you just want to read a byte or a 16-bit word? The trick is that the 386 provides four Byte Enable outputs (BE0#-BE3#) that indicate which bytes in the word are being transferred. Of course, it's not that simple. If the lower 16 bits of the data bus aren't being used, the upper 16 bits of the data bus are duplicated on the lower 16 bits to make 16-bit buses more efficient (somehow).
Yes and no. You replaced two address pins with four byte enable pins.
But the byte enable pins also implicitly communicate size, which would otherwise require another two pins. So this byte enable scheme breaks even (at least for chips with 16bit or 32bit buses).
The main goal is simplify the design of the motherboard.
> From the circuitry on the die, this pin appears to be an output. If someone with a 386 chip hooks this pin to an oscilloscope, maybe they will see something interesting.
Would be a fun surprise if the 386 had its own Halt and Catch Fire mode.
It had ICE mode (precursor to SMM, but used for production testing and low-level debugging), and according to this article, the pins were exposed at least on some of the chips you could buy:
>On the standard Intel 80386 DX, asserting the undocumented pin at location B6 will cause the microprocessor to halt emulation and enter ICE mode.
[this is written from an ICE perspective - for "emulation", read "normal operation"]
This mode was introduced in the 80286, but I don't think the pins were exposed except in the special bond-out variant for ICE, and maybe early samples. You can trigger it in software (opcode 0F 04 on the 286, or by enabling a bit in DR7 on the 386), but then the processor disconnects from the bus and you have to reset it.
Super cool! This was the CPU in my very first PC (which I got to build myself, under the tutelage of a family friend). I remember that it was cooled by nothing but a tiny stick-on heatsink and a small plastic fan that clipped on top of that.
8MB of DRAM, a 250MB spinning disk hard drive, 5.25 and 3.5 inch floppy bays, removable bios that I had to sort through a tupperware of chips to find the correct unit, some unnamed AGP video card that I had to slot removable chips into as well and a great big 16" CRT.
I think I had to install a special serial card in an ISA slot to use a mouse too.
I was talking about what was on the card itself rather than the interface, because the poster I was responding to mentioned the card, but your point about interfaces is well made.
Back in the day - late 80s, very early 90s - I’d see Amstrad (ugh!) 286-based desktop systems on sale in our local branch of Dixon that included graphics cards fitted with VGA chipsets, but cards compatible with the AGP interface on then newer motherboards didn’t cross my radar until the second half of the 90s.
A Local bus ?
The VESA Local Bus (VLB) was a thing in 486 boards and, I think, early Pentium boards. but was predated by privative local buses. I don't know if there was one on 386 boards.
The VGA cards often had a mouse port, I think. I don't recall having to add a serial card on 386s, but maybe we did. IBM machines were really oddball, too, with that fancier type of bus. I stayed away from IBM.
Hey @kens, congrats on the page! Extremely super small usability note/suggestion: if you changed your inputs (above the tool that lets you see all of the layers) to something like this:
then it would be possible to click the label name (i.e. Pins, I/O Vcc, etc.) instead of having to click the small radio circles.
It's a small thing, but I think it's a lot more fun/easy/fast to click the different label names rather than the circles. It's truly a small nit - just in case it's an easy fix for you. Cheers!
(just to make sure: you need to add a unique "id" attribute for each "input", and then make a <label> tag for each label referencing that id in the "for")
> (just to make sure: you need to add a unique "id" attribute for each "input", and then make a <label> tag for each label referencing that id in the "for")
Nesting the <input> inside the <label> is simpler. Then you don't need the id and for attributes. I think it avoids an unclickable space between them too.
For example, I know that thermal samples for the Pentium 5-era Xeon (Jayhawk) were produced, but I'd always wondered Intel went from the dummy to realizing "oh, shit, this is going to be way too hot in the long run."
Since the bond wires are just hanging out in air, does this mean that a chip like this could be ruined by dropping it which might cause the bond wires to move enough to short something?
Thanks for all your hard work!
This failure mode is quite low on the list among others, but it is something that people did investigate. For example: "Swing Touch Risk Assessment of Bonding Wires in High-Density Package Under Mechanical Shock Condition" https://asmedigitalcollection.asme.org/electronicpackaging/a...
That and financial businesses usually don't operate outside their host country anyway. Though you do want your customers to see their accounts when they're traveling.
In all fairness, this isn’t a good use of that technique. But most websites are of no interest outside a handful of countries.
I mean I eventually read the article. Sorry for that. But we're at "Hacker News", sporting hackers ethics, aren't we?
> kens on April 10, 2022
> Are you trying to access from Russia? Russia is currently blocked.
https://news.ycombinator.com/item?id=30974444
> kens on Dec 3, 2022
> Unfortunately there are also many people in Ukraine who didn't personally do anything to deserve what's happening. Consider the country filter a small reminder of the ongoing war and a suggestion that you might find better opportunities outside Russia.
https://news.ycombinator.com/item?id=33846782
Yet he doesn't consider to 'find better opportunities outside of the USA' despite the actions of the USA government in the last 30 years.
Thanks for the info, how interesting!
(for those who don’t know, mAs = mA • seconds = milliampere seconds. It’s how Radiographers measure how much x-ray photos are being produced by the tungsten filament in an X-ray tube. kVp is kiloVoltage potential and it’s how we measure the speed and thus the penetration power of the X-rays. 130kvp is slightly more than the 120kvp used for an avg human chest radiograph)
Anyways.. this is what I really like about kens work.. the accidental discovery of beautiful structures while trying to answer abstract questions. Thanks for doing all this!
and Cyrix 486DLC hijacks 7 of those :)
A20M# (F13) - when supported by motherboard you can L1 cache whole ram instead of leaving first 64KB uncached
FLUSH# (E13) - when supported by motherboard you dont have to use hacks and flush L1 on every DMA access. Hacks (BARB mode) seemed clever at the time until everyone had a Sound Blaster DMAing audio constantly invalidating cache while gaming.
RPLSET (C6) RPLVAl (C7)- L1 cache status debug outputs
SUSP# (A4) SUSPA# (B4)- suspend support, wakes on INT and NMI. Good for laptops.
>The surprising thing is that one of the No Connect pads does have the bond wire in place
Somehow Cyrix picked this particular pin (B12) for KEN# input (enable L1 cache) :O
>From the circuitry on the die, this pin appears to be an output
Meaning the _one_ NC pin Intel CPU actually wires, an output no less, Cyrix demands driven low to enable cache.
But the byte enable pins also implicitly communicate size, which would otherwise require another two pins. So this byte enable scheme breaks even (at least for chips with 16bit or 32bit buses).
The main goal is simplify the design of the motherboard.
Pedantic note: I think "quadratically" makes more sense here: we're talking about two dimensions.
Would be a fun surprise if the 386 had its own Halt and Catch Fire mode.
https://www.rcollins.org/ddj/Jan97/Jan97.html
>On the standard Intel 80386 DX, asserting the undocumented pin at location B6 will cause the microprocessor to halt emulation and enter ICE mode.
[this is written from an ICE perspective - for "emulation", read "normal operation"]
This mode was introduced in the 80286, but I don't think the pins were exposed except in the special bond-out variant for ICE, and maybe early samples. You can trigger it in software (opcode 0F 04 on the 286, or by enabling a bit in DR7 on the 386), but then the processor disconnects from the bus and you have to reset it.
On the 286, you can get it to dump some otherwise hidden internal state, by using a prefix that no longer exists on 386s: https://rep-lodsb.mataroa.blog/blog/intel-286-secrets-ice-mo...
8MB of DRAM, a 250MB spinning disk hard drive, 5.25 and 3.5 inch floppy bays, removable bios that I had to sort through a tupperware of chips to find the correct unit, some unnamed AGP video card that I had to slot removable chips into as well and a great big 16" CRT.
I think I had to install a special serial card in an ISA slot to use a mouse too.
Do you mean VGA rather than AGP? AGP came much later than the 386 and wouldn’t have been supported by its motherboard chipsets.
Full ISA connector (potentially missing the bit in the middle) and then a further piece? VLB
Shorter than ISA but higher density? AGP (it's even a bit shorter than PCI)
Was it at least a Pentium? Can't be AGP otherwise.
Going to ignore PCI-X, PCIE and obscure AGP variants
Back in the day - late 80s, very early 90s - I’d see Amstrad (ugh!) 286-based desktop systems on sale in our local branch of Dixon that included graphics cards fitted with VGA chipsets, but cards compatible with the AGP interface on then newer motherboards didn’t cross my radar until the second half of the 90s.
I can’t remember if those were available on 386s or started in the 486 era.
It's a small thing, but I think it's a lot more fun/easy/fast to click the different label names rather than the circles. It's truly a small nit - just in case it's an easy fix for you. Cheers!
(just to make sure: you need to add a unique "id" attribute for each "input", and then make a <label> tag for each label referencing that id in the "for")
Nesting the <input> inside the <label> is simpler. Then you don't need the id and for attributes. I think it avoids an unclickable space between them too.