Reading the programming of PAL chips

[brandon.arnold]

Hi all! I have a couple of old PAL chips from a board, of type PAL16L8. I guess they were the one-time programmable type, and I really have no idea which language or software was used to define the programming.

I do believe that I can put one of these chips in my chip reader (Xeltek Super Pro 610P) and read the PAL chip like a 27C020 EEPROM, as if the output wires are 8 bits of data and the input wires are 8 bit addresses.

Does anyone know if there is any method of making sense of this data dump, possibly generating a minimal PAL description for it? Perhaps there would be more than one viable PAL program for any dump, I don't know; this would just be to help me make sense of the PAL chip without having to analyze the address/data bytes by hand.

Thank you!

[dietert1]

As far as i remember those PAL chips include registers, so there is (partially hidden) state inside that makes reengineering much more difficult. But there seem to be "brute force" type methods to extract the programming bits.
Another difficulty is deriving the meaning of it. Similar problem as deriving a high level language project from a MCU disassembly. If you can run the chips in their intended environment and analyze the function using a logic analyzer, this will help a lot.

Regards, Dieter

[dorkshoei]

As far as i remember those PAL chips include registers, so there is (partially hidden) state inside

Indeed.

https://www.techtravels.org/2022/08/why-simply-dumping-a-pal-isnt-always-possible/

[brandon.arnold]

Thanks for this valuable insight, @dietert1 and @dorkshoei!

That link is super helpful, and apparently there is a Windows utility that can convert the dump from a programmer from purely combinatorial PALs, into their original PAL equations. Sadly that .exe file isn't available at the link in his blog anymore, so I will need to ask around for that.

I also don't quite understand the type of security presented by the dreaded "fuse map." Is this a result of reading addresses of the PAL, that make the PAL itself unusable? Or is it something else, and I should not worry about bricking my PAL by simply reading it like an EEPROM?

Edit: I think it's just for reading the programming of the PAL, and I should not worry about breaking my PAL by reading it.

[PCB.Wiz]

I also don't quite understand the type of security presented by the dreaded "fuse map." Is this a result of reading addresses of the PAL, that make the PAL itself unusable? Or is it something else, and I should not worry about bricking my PAL by simply reading it like an EEPROM?

Edit: I think it's just for reading the programming of the PAL, and I should not worry about breaking my PAL by reading it.

You are talking about two separate pathways.

Reading back the fuses, likely involves applying some higher voltage, and if they read back all 1's or 0's that part may be secured.
The 16L8 series have no registers, it is the 16Rx series that have flipflops.

You can use test vectors to scan the pins and read the outputs, but device programmers are really built to run expected results and pass/fail, not to scan unknown parts.

You could make an adaptor that does what you say, "read the PAL chip like a 27C020 EEPROM", but you need to map the PLD pins to a suitable memory.
Complicating things is that some IO might be used as inputs, so a circuit of the original unit helps here.

Another complication, is the design might create latches, which would be hard to detect from a linear, one pass scan of input pins.

If you do manage to get a (large) logical test table, some PLD tools can synthesise tables, so you might see if they can reduce a large table to a few equations.

[brandon.arnold]

@PCB.Wiz thank you so much! As usual I oversimplified my problem quite a bit, and I'm really glad you took time to clarify that.

So ways the PAL may not be purely combinatorial are:
1. The "output" pins are not purely output, and may create an IO internally.
2. If latches are used internally, then treating input combinations as "addresses," reading "addresses" in a different order might produce different outputs.

The logic analyzer monitoring the chip in its original environment may be a better method of understanding how this works. I have created schematics of the source PCB and have a good sense of how the PALs fit into the larger system.

[PCB.Wiz]

@PCB.Wiz thank you so much! As usual I oversimplified my problem quite a bit, and I'm really glad you took time to clarify that.

So ways the PAL may not be purely combinatorial are:
1. The "output" pins are not purely output, and may create an IO internally.
2. If latches are used internally, then treating input combinations as "addresses," reading "addresses" in a different order might produce different outputs.

The logic analyzer monitoring the chip in its original environment may be a better method of understanding how this works. I have created schematics of the source PCB and have a good sense of how the PALs fit into the larger system.

If you have a SCH, you can take educated guesses at the equations, and you could try vector testing. A logic Analyzer can make those guesses smarter.

I've not used Xeltek Super Pro 610P, so it depends on how good their editing menu's are.

If they are painful, you can edit externally in a text editor, and load the JED vector file.

[AK6DN]

As an example, my TopMaxII supports programming 16L8 PAL devices. Here is a dump of the fuse array of a National 16L8 device.
Pretty much all the vendors of 16L8/16R* devices used compatible fuse map arrays, so one could reprogram an MMI 16L8 with a National 16L8 fusemap, for example.

Code: [Select]


JEDEC file generated by Max Loader*
DM NATIONAL*
DD PAL16L8*
QP20*
QF2048*
QV0*
G0*F0*
L00000 00000000000000000000000000000000*
L00032 00000000000000000000000000000000*
L00064 00000000000000000000000000000000*
L00096 00000000000000000000000000000000*
L00128 00000000000000000000000000000000*
L00160 00000000000000000000000000000000*
L00192 00000000000000000000000000000000*
L00224 00000000000000000000000000000000*
L00256 00000000000000000000000000000000*
L00288 00000000000000000000000000000000*
L00320 00000000000000000000000000000000*
L00352 00000000000000000000000000000000*
L00384 00000000000000000000000000000000*
L00416 00000000000000000000000000000000*
L00448 00000000000000000000000000000000*
L00480 00000000000000000000000000000000*
L00512 00000000000000000000000000000000*
L00544 00000000000000000000000000000000*
L00576 00000000000000000000000000000000*
L00608 00000000000000000000000000000000*
L00640 00000000000000000000000000000000*
L00672 00000000000000000000000000000000*
L00704 00000000000000000000000000000000*
L00736 00000000000000000000000000000000*
L00768 00000000000000000000000000000000*
L00800 00000000000000000000000000000000*
L00832 00000000000000000000000000000000*
L00864 00000000000000000000000000000000*
L00896 00000000000000000000000000000000*
L00928 00000000000000000000000000000000*
L00960 00000000000000000000000000000000*
L00992 00000000000000000000000000000000*
L01024 00000000000000000000000000000000*
L01056 00000000000000000000000000000000*
L01088 00000000000000000000000000000000*
L01120 00000000000000000000000000000000*
L01152 00000000000000000000000000000000*
L01184 00000000000000000000000000000000*
L01216 00000000000000000000000000000000*
L01248 00000000000000000000000000000000*
L01280 00000000000000000000000000000000*
L01312 00000000000000000000000000000000*
L01344 00000000000000000000000000000000*
L01376 00000000000000000000000000000000*
L01408 00000000000000000000000000000000*
L01440 00000000000000000000000000000000*
L01472 00000000000000000000000000000000*
L01504 00000000000000000000000000000000*
L01536 00000000000000000000000000000000*
L01568 00000000000000000000000000000000*
L01600 00000000000000000000000000000000*
L01632 00000000000000000000000000000000*
L01664 00000000000000000000000000000000*
L01696 00000000000000000000000000000000*
L01728 00000000000000000000000000000000*
L01760 00000000000000000000000000000000*
L01792 00000000000000000000000000000000*
L01824 00000000000000000000000000000000*
L01856 00000000000000000000000000000000*
L01888 00000000000000000000000000000000*
L01920 00000000000000000000000000000000*
L01952 00000000000000000000000000000000*
L01984 00000000000000000000000000000000*
L02016 00000000000000000000000000000000*
C0000*
0000
If you look at an old datasheet for a 16L8 device they will typically have a logic diagram with labeled fuses.
See attached for an example diagram. It shows the location of each of the 2048 fuses listed above.

[c64]

Thanks for this valuable insight, @dietert1 and @dorkshoei!

That link is super helpful, and apparently there is a Windows utility that can convert the dump from a programmer from purely combinatorial PALs, into their original PAL equations. Sadly that .exe file isn't available at the link in his blog anymore, so I will need to ask around for that.

You can try wayback machine. It saves not just pages but all downloads as well

[c64]

You could make an adaptor that does what you say, "read the PAL chip like a 27C020 EEPROM", but you need to map the PLD pins to a suitable memory.
Complicating things is that some IO might be used as inputs, so a circuit of the original unit helps here.

Or output enable.
Need to use series resistors and then read the value back.

[brandon.arnold]

As an example, my TopMaxII supports programming 16L8 PAL devices. Here is a dump of the fuse array of a National 16L8 device.
Pretty much all the vendors of 16L8/16R* devices used compatible fuse map arrays, so one could reprogram an MMI 16L8 with a National 16L8 fusemap, for example.
...
If you look at an old datasheet for a 16L8 device they will typically have a logic diagram with labeled fuses.
See attached for an example diagram. It shows the location of each of the 2048 fuses listed above.

Great information, thanks! I will definitely try this with my Xeltek, which apparently supports reading these. I'm sure I won't so lucky and they may have some security in place to make it fail.

You could make an adaptor that does what you say, "read the PAL chip like a 27C020 EEPROM", but you need to map the PLD pins to a suitable memory.
Complicating things is that some IO might be used as inputs, so a circuit of the original unit helps here.

Or output enable.
Need to use series resistors and then read the value back.

Yep I will keep this in mind as well as PCB.Wiz's warning.

[EduardoLM]

The website is still there! But SSL is broken. You can try pure http:
http://dreamjam.co.uk/emuviews/readpal.php

[JacobPilsen]

https://github.com/DuPAL-PAL-DUmper
https://www.8bity.cz/2022/dupal-hardware-software-for-pal-analysis/