Author Topic: Reading a 16L8 PAL / question on early SRAM card  (Read 3216 times)

0 Members and 1 Guest are viewing this topic.

Offline metertech58761Topic starter

  • Regular Contributor
  • *
  • Posts: 196
  • Country: us
Reading a 16L8 PAL / question on early SRAM card
« on: December 18, 2024, 11:47:25 pm »
So I got my hands on a storage device for a piece of chip foundry equipment...

I took off the front panel to get at the EPROM and dumped it, but I'm sure I had quite the look on my face when I realized it also has a PAL.

PAL16L8A-2CN... circa 1989.

I have a TL-866 programmer... but there is no listing in its PLD database for the 16L8 (I assume the PAL16LV8C is NOT the same thing).

How would you suggest I dump the equations out of the device? I may end up getting my hands on a second unit, just so I can also get my hands on the SRAM cartridge this used.
(it probably predates the PCMCIA standard by a few years, as this storage device was developed in 1988).

As for the SRAM card slot, I counted the pins twice... there are only 40 pins. Does this ring a bell? The only clue I have is that the connector has the duPont logo on it.
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 7304
  • Country: ca
Facebook-free life and Rigol-free shack.
 

Offline metertech58761Topic starter

  • Regular Contributor
  • *
  • Posts: 196
  • Country: us
Re: Reading a 16L8 PAL / question on early SRAM card
« Reply #2 on: December 19, 2024, 02:09:45 am »
No I hadn't seen that thread... will keep it in mind, but I have 2 other assemblies to reverse engineer first.

Thank you!
 

Offline metertech58761Topic starter

  • Regular Contributor
  • *
  • Posts: 196
  • Country: us
Re: Reading a 16L8 PAL / question on early SRAM card
« Reply #3 on: December 22, 2024, 03:25:15 am »
A picture of the card slot... anyone recognize it?
 

Offline metertech58761Topic starter

  • Regular Contributor
  • *
  • Posts: 196
  • Country: us
Re: Reading a 16L8 PAL / question on early SRAM card
« Reply #4 on: December 31, 2024, 07:21:47 am »
Incidentally, I have access to a BPMicro programmer, and may well be the same unit that was used to program this PAL.

The BPMicro software even has a definition for an AMD 16L8 (I assume AMD bought MMI at some point), but I cannot for the life of me see how I can 'read' the PAL?
 

Offline Kleinstein

  • Super Contributor
  • ***
  • Posts: 15231
  • Country: de
Re: Reading a 16L8 PAL / question on early SRAM card
« Reply #5 on: December 31, 2024, 09:32:22 am »
AFAIK there is no way to read a PAL. In most cases they are used for combinatorial logic (no flip flop). In this case one could measure the truth table and than synthesize the logic from there. So not reading the chip but mesure the function and regnerate the required logic.
 

Offline Bruce Abbott

  • Frequent Contributor
  • **
  • Posts: 628
  • Country: nz
    • Bruce Abbott's R/C Models and Electronics
Re: Reading a 16L8 PAL / question on early SRAM card
« Reply #6 on: January 01, 2025, 07:50:00 am »
It would be possible to read if the security fuse isn't blown, but this unlikely.

Since the 16L8 doesn't have registers it should be quite easy to map out. Start by identifying the function of each pin (eg. address input, chip select output). That alone could be enough to guess most of the internal logic. Then apply inputs in all combinations and see what comes out.
 
 

Offline metertech58761Topic starter

  • Regular Contributor
  • *
  • Posts: 196
  • Country: us
Re: Reading a 16L8 PAL / question on early SRAM card
« Reply #7 on: January 01, 2025, 12:07:30 pm »
This is the schematic I've worked out so far... all the connections have been traced out.

I'm still trying to work out what to call some of the various lines. Identifying the full pinout of the early CF-style card at P1 would go a LONG way to getting it figured out.
 

Offline PCB.Wiz

  • Super Contributor
  • ***
  • Posts: 2142
  • Country: au
Re: Reading a 16L8 PAL / question on early SRAM card
« Reply #8 on: January 01, 2025, 09:02:42 pm »
See this older thread for using available ATF16V8 parts to replace PAL16L8 parts

https://www.eevblog.com/forum/microcontrollers/pal16l8-pal16r4-gal16v8b/

You can reverse engineer a known good pal, with a MCU with enough pins.
Working blind with no sch, you need to drive all pins and read all pins to check for H,L,Z
Iirc some parts have pull-ups, so sense of Z needs care.
it it not common, but some pins at be used as OE on other pins.
It was possible to build latches in non register pads, and those are harder to reverse engineer.
Simple decoders / memory mapping should be easy.
 

Offline metertech58761Topic starter

  • Regular Contributor
  • *
  • Posts: 196
  • Country: us
Re: Reading a 16L8 PAL / question on early SRAM card
« Reply #9 on: January 01, 2025, 10:06:30 pm »
I strongly doubt there was any security used on this, given its application and where used.

I'm leaning towards breadboarding it as if it was a 2716, reading it as an EPROM, and working out the equations from the buffer dump.
 

Offline AK6DN

  • Regular Contributor
  • *
  • Posts: 65
  • Country: us
Re: Reading a 16L8 PAL / question on early SRAM card
« Reply #10 on: January 02, 2025, 04:08:36 am »
AFAIK there is no way to read a PAL. In most cases they are used for combinatorial logic (no flip flop). In this case one could measure the truth table and than synthesize the logic from there. So not reading the chip but mesure the function and regnerate the required logic.

Of course there is. Just about any professional programmer that can program a PAL via a .jed file can read the PAL contents back into a .jed file.
I have an EEtools TopmaxII and I know it can read a PALs programming into a .jed file that I can then save, and use to verify other PALs against or program blank devices.
I know the original DataIO 2900B could do the same, as well as some of the recent Xeltek programmers that support PALs.
 

Offline PCB.Wiz

  • Super Contributor
  • ***
  • Posts: 2142
  • Country: au
Re: Reading a 16L8 PAL / question on early SRAM card
« Reply #11 on: January 02, 2025, 08:27:55 am »
Quote
Of course there is. Just about any professional programmer that can program a PAL via a .jed file can read the PAL contents back into a .jed file.
I have an EEtools TopmaxII and I know it can read a PALs programming into a .jed file that I can then save, and use to verify other PALs against or program blank devices.
Only Provided the security is not blown.
 

Offline metertech58761Topic starter

  • Regular Contributor
  • *
  • Posts: 196
  • Country: us
Re: Reading a 16L8 PAL / question on early SRAM card
« Reply #12 on: January 02, 2025, 10:09:29 am »
I have a GQ-4X and a TL-866II programmer at home, and neither have definitions for the 16L8.

I have access to an MPLab PM3 programmer, as well as a BPMicro unit (which is what it was likely programmed on), and the latter DOES have definitions for the 16L8.
 

Offline AK6DN

  • Regular Contributor
  • *
  • Posts: 65
  • Country: us
Re: Reading a 16L8 PAL / question on early SRAM card
« Reply #13 on: January 03, 2025, 12:21:46 am »
Quote
Of course there is. Just about any professional programmer that can program a PAL via a .jed file can read the PAL contents back into a .jed file.
I have an EEtools TopmaxII and I know it can read a PALs programming into a .jed file that I can then save, and use to verify other PALs against or program blank devices.
Only Provided the security is not blown.

Well yeah of course. If the security fuse is blown on a device, the internal programming will be unreadable.
The only way to determine the functionality of a device with its security fuse blown is a brute force approach, stimulate all inputs, observe all outputs, write equations, and optimize.
Of course this assumes no internal feedback or internal state, which can increase the reverse engineering complexity dramatically.

But my point was that legacy PAL programmers provided the capability to both read and write/program the fuse arrays.
So reading the device on a legacy programmer may produce the fuse programming if it is unsecured, or at worst an all blown and/or all unblown fusemap if it is secured.

In my experience the TL866/T48/T56 (I have the latter two devices) are useful for programming modern EEPROMs and uControllers, or simple RAM or 74xx chip testing.
But they do not support legacy devices like PALs and BIPOLAR PROMs. For those I have my trusty EEtools TopMaxII series device which supports all the old stuff, and most new stuff too.
« Last Edit: January 03, 2025, 03:20:35 am by AK6DN »
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf