The Intel 8087 And Conditional Microcode Tests

January 11, 2026 by Maya Posch 19 Comments

Continuing his reverse-engineering of the Intel 8087, [Ken Shirriff] covers the conditional tests that are implemented in the microcode of this floating point processing unit (FPU). This microcode contains the details on how to perform the many types of specialized instructions, like cos and arctan, all of which decode into many microcode ops. These micro ops are executed by the microcode engine, which [Ken] will cover in more detail in an upcoming article, but which is effectively its own CPU.

Conditional instructions are implemented in hardware, integrating the states of various functional blocks across the die, ranging from the instruction decoder to a register. Here, the evaluation is performed as close as possible to the source of said parameter to save on wiring.

Implementing this circuitry are multiplexers, with an example shown in the top die shot image. Depending on the local conditions, any of four pass transistors is energized, passing through that input. Not shown in the die shot image are the inverters or buffers that are required with the use of pass transistors to amplify the signal, since pass transistors do not provide that feature.

Despite how firmly obsolete the 8087 is today, it still provides an amazing learning opportunity for anyone interested in ASIC design, which is why it’s so great that [Ken] and his fellow reverse-engineering enthusiasts keep plugging away at recovering all this knowledge.

As Cheap As Chips: The MiFare Ultra Light Gets A Closer Look

June 26, 2024 by Jenny List 8 Comments

If you take public transport in many of the world’s cities, your ticket will be an NFC card which you scan to gain access to the train or bus. These cards are disposable, so whatever technology they use must be astonishingly cheap. It’s one of these which [Ken Shirriff] has turned his microscope upon, a Montreal Métro ticket, and his examination of the MiFare Ultra Light it contains is well worth a read.

The cardboard surface can be stripped away from the card to reveal a plastic layer with a foil tuned circuit antenna. The chip itself is a barely-discernible dot in one corner. For those who like folksy measurements, smaller than a grain of salt. On it is an EEPROM to store its payload data, but perhaps the most interest lies in the support circuitry. As an NFC chip this has a lot of RF circuitry, as well as a charge pump to generate the extra voltages to charge the EEPROM. In both cases the use of switched capacitors plays a part in their construction, in the RF section to vary the load on the reader in order to transmit data.

He does a calculation on the cost of each chip, these are sold by the wafer with each wafer having around 100000 chips, and comes up with a cost-per-chip of about nine cents. Truly cheap as chips!

If NFC technology interests you, we’ve taken a deep dive into their antennas in the past.

A Classy SDR Chip, Decapped

May 27, 2018 by Jenny List 20 Comments

If you are a regular searcher for exotic parts among the virtual pages of semiconductor supplies catalogs, you will have probably noticed that for a given function it is most often the part bearing the Analog Devices logo that is the most interesting. It may have more functionality, perhaps it will be of a higher specification, and it will certainly have a much higher price. [Zeptobars] has decapped and analyzed an AD chip that holds all three of those honors, the AD9361 SDR transceiver.

It’s placed under a slightly inflammatory title, “when microchips are more profitable than drugs“, but does make a good job of answering why a semiconductor device at the very cutting edge of what is possible at the time of release can be so expensive. The AD9361 is an all-in-one SDR transceiver with an astonishing bandwidth, and as such was a particularly special device when it reached the market in 2013. We see some particularly fine examples of on-chip inductors and PLL circuitry that must have consumed a significant design effort to preserve both bandwidth and noise characteristics. This is an item of physical beauty at a microscopic scale as well as one of technical achievement.

The financial analysis puts Analog Devices’s gross profit at about $103 of the $275 retail purchase price of an AD9361. The biggest slice at $105 goes to the distributor, and surprisingly the R&D and manufacturing costs are not as large as you might expect. How accurate these figures are is anybody’s guess, but they are derived from an R&D figure in the published financial report, so there is some credence to be given to them.

We’ve featured [Zeptobar’s] work before more than once. A look at fake Nordic Semi parts for example or a Soviet i8080 clone have received their treatment. Always a source to watch out for!

Get Inside A TCXO Clock Chip

August 9, 2017 by Elliot Williams 28 Comments

[Pete] wondered how real-time clock modules could be selling on eBay for $1.50 when the main component, the Maxim DS3231 RTC/TCXO chip, cost him more like $4 apiece. Could the cheap modules contain counterfeit chips?

Well, sure they could. But in this case, they didn’t, and [Pete] has the die shots to prove it. He started off by clipping the SOIC leads rather than desoldering — he’s not going to be reusing this chip after he’s cut it in half. Next was a stage of embrittling the case by heating it up with a lighter and dunking it in water. Then he went at it with sandpaper.

It’s cool. You can see the watch crystal inside, and all of the circuitry. The DS3231 includes a TCXO — temperature-corrected crystal oscillator — and it seems to have a bank of capacitors that it connects and disconnects depending on the chip’s temperature to keep the oscillator running at the right speed. [Pete] used one in an offline situation, and it only lost sixteen seconds over a year, so we’d say that they work fine.

If you’d like to know more about how crystals are used to keep time, check out [Jenny]’s excellent article. And if sixteen second per year is way too much for you, tune up your rubidium standard and welcome to the world of the time nuts.

Project 54/74 Maps Out Logic ICs

April 4, 2017 by Lewin Day 4 Comments

Integrated circuits are a fundamental part of almost all modern electronics, yet they closely resemble the proverbial “black box” – we may understand the inputs and outputs, but how many of us truly understand what goes on inside? Over the years, the process of decapping ICs has become popular – the removal of the package to enable peeping eyes to glimpse the mysteries inside. It’s an art that requires mastery of chemistry, microscopy and photography on top of the usual physics skills needed to understand electronics. Done properly, it allows an astute mind to reverse engineer the workings of the silicon inside.

There are many out there publishing images of chips they’ve decapped, but [Robert Baruch] wants more. Namely, [Robert] seeks to create a database of die images of all 5400 and 7400 series logic chips – the eponymous Project 54/74.

These chips are the basic building blocks of digital logic – NAND gates, inverters, shift registers, decade counters and more. You can build a CPU with this stuff. These days, you may not be using these chips as often in a production context, but those of you with EE degrees will likely have toyed around a few of these in your early logic classes.

There’s only a handful of images up so far, but they’re of excellent quality, and they’re also annotated. This is a great aid if you’re trying to get to grips with the vagaries of chip design. [Robert] is putting in the hard yards to image as many variations of every chip as possible. There’s also the possibility of comparing the same chip for differences between manufacturers. We particularly like this project, as all too often manufacturing techniques and technologies are lost and forgotten as the march of progress continues on. It looks like it’s going to become a great resource for those looking to learn more about integrated circuit design and manufacture!

Decapsulation Reveals Fake Chips

September 12, 2016 by Brian Benchoff 37 Comments

A while back, [heypete] needed to get a GPS timing receiver talking to a Raspberry Pi. The receiver only spoke RS-232, and the Pi is TTL level serial. [Pete] picked up a few RS-232 to TTL conversion boards from an online vendor in China. These boards were supposedly based on the Max3232, a wonderchip that converts the TTL serial to the positive and negative voltages of RS-232 serial. The converters worked fine for a few weeks, before failing, passing a bunch of current, and overheating.

On Mouser and Digikey, the Max3232 costs about $1.80 in quantity one, and shipping is extra. You can pick up a ‘Max3232 converter board’ from the usual online marketplaces for seventy five cents with free shipping. Of course the Chinese version is fake. [Pete] had some nitric acid, and decided to compare the die of the real and fake Max3232s.

After desoldering two fake chips from their respective converter boards, and acquiring a legitimate chip straight from Maxim, [Pete] took a look at the chips under the microscope. The laser markings on the fakes are inconsistent, but there was something interesting to be found in the date code markings. It took two to four weeks for the fake chips to be etched with a date code, assembled into a converter board, shipped across the planet, put into [Pete]’s project, run for a little bit, and fail spectacularly. That’s an astonishing display of manufacturing, logistics, and shipping times. Update: The date codes on the fakes had 2013 laser etched on the plastic package, and 2009 on the die. The real chips had a date code just a few weeks before [Pete] decapped them — a remarkably short life but they gave in to a good cause.

Following the Zeptobars and CCC (PDF) guides to dropping acid, [Pete] turned his problem into solution and took a look at the dies under a microscope. The legitimate die was significantly larger, and the fake dies were identical. The official die used gold bond wires, but the fake ones didn’t.

Unfortunately, [Pete] isn’t an expert in VLSI, chip design, failure analysis, or making semiconductors out of sand. Anything that should be obvious to the layman is not, and [Pete] has no idea why these chips would work for a week, then overheat and fail. If anyone has an idea, hit [Pete] up and drop a note in the comments.

Russian Decapping Madness

July 18, 2016 by Elliot Williams 37 Comments

It all started off innocently enough. [mretro] was curious about what was inside a sealed metal box, took a hacksaw to it and posted photographs up on the Interwebs. Over one hundred forum pages and several years later, the thread called (at least in Google Translate) “dissecting room” continues to amaze.

If you like die shots, decaps, or teardowns of oddball Russian parts, this is like drinking from a firehose. You can of course translate the website, but it’s more fun to open it up in Russian and have a guess at what everything is before peeking. (Hint: don’t look at the part numbers. NE555 is apparently “NE555” in Russian.)

From a brief survey, a lot of these seem to be radio parts, and a lot of it is retro or obsolete. Forum user [lalka] seems to have opened up one of every possible Russian oscillator circuit. The website loads unfortunately slowly, at least where we are, but bear in mind that it’s got a lot of images. And if your fingers tire of clicking, note that the URL ends with the forum page number. It’d be a snap to web-scrape the whole darn thing overnight.

We love teardowns and chip shots, of old gear and of new. So when you think you’ve got a fake part, or if you need to gain access to stuff under that epoxy blob for whatever reason, no matter how embarrassing, bring along a camera and let us know!

Thanks [cfavreau] for the great tip!