Author Topic: PAL18L8....Help please ! (Read 7822 times)

powerchisper · « **on:** February 03, 2019, 09:54:18 am »

Hello friends !
My name is Paco and i am from Spain.
Recently I received a pinball machine and the board was so damaged by ruined batteries I had to spend weeks fixing all the broken traces, etc.
Most of the damaged IC's are easy to find and replace, but It has a PAL chip between the CPU and the ROM.. I have no way of testing wether this chip is ok or not.
My question is :
Is there anyway to know how the chip has to be programmed ?
I can possibly get a chip burning device and all that stuff, but i woudn'k know what to do next.

My intention iis to copy the chip to a new one.

I have the schematics for this board, but I don't know if that can give me any clue about what the chip is doing..

Any ideas are welcome, please throw in some light in this darkness.

Thank you so much for reading ( and excuse me for my English.

Ian.M · « **Reply #1 on:** February 03, 2019, 10:29:21 am »

The PAL probably implements the address decoding or some other glue logic function. Without documentation of its function or a known good one it will be difficult to reverse engineer and as its long discontinued, extremely difficult to source a blank one N.O.S. and a compatible programmer. To further confuse the issue there are probably a fair number of used ones from other applications crudding up the marketplace, which are useless as they are OTP (one time programmable) devices.

Do everything you can to preserve and reuse the original chip, and pray that it hasn't been damaged by the lost connections and that its pins haven't rotted too far back inside its encapsulation.

Doctorandus_P · « **Reply #2 on:** February 03, 2019, 12:07:04 pm »

Quote from: powerchisper on February 03, 2019, 09:54:18 am

I have the schematics for this board, but I don't know if that can give me any clue about what the chip is doing..
Any ideas are welcome, please throw in some light in this darkness.

As said before it is most likely an adress decoder. Something like an 74HC138 on steroids.
From the schematic it should be easy to define the inputs and the outputs.
You'll have a handfull of sinals coming from a microcontroller, and outputs going to chip select / chip enable / read / write lines of the various other chips.

Also, the chip needs to be working (mostly) to be able to read it.
And if it works, you don't have to copy it.

I have also vague memories that sligtly less obolete GAL's could be used in the place of the older PAL's.
I do not know if these old chips have some kind of read protection.
The chips themself are relatively simple though, an for someone with experience with them they are probably easy to reverse engineer.

ebastler · « **Reply #3 on:** February 03, 2019, 12:48:56 pm »

18L8 is either a rather unusual type of PAL, or you got the designation wrong. Could you check again please?

Anyway, obtaining a physical replacement should not be the limiting factor. You may not be able to find (and program) the original PAL. There may or may not be a GAL which can be programmed to be pin-compatible, but worst case you can make a little adapter board for a GAL with a different pinout.

The real question is how to find or reverse-engineer the programmed function of the PAL. But this is a pointless discussion without details of the pinball machine you are dealing with. Could you tell us the make and model, and post the schematic?

EDIT: Yes, PALs already came with "security fuses" to stop copycats from reading them. So even if the original chip still works, it might not be directly readable. But it should be possible to reverse-engineer a working chip with a bit of effort, without knowing anything about the circuit it was used in. The "L" PALs do not contain any flip-flops, so they are "state-free". You could reconstruct the complete truth table by having a microcontroller cycle through all the input combinations and read the outputs.

up8051 · « **Reply #4 on:** February 03, 2019, 12:53:39 pm »

What pinball?

Ian.M · « **Reply #5 on:** February 03, 2019, 12:57:44 pm »

Quote from: ebastler on February 03, 2019, 12:48:56 pm

18L8 is either a rather unusual type of PAL, or you got the designation wrong. Could you check again please?

... and count its pins so we can cross-check part no. against package size!

powerchisper · « **Reply #6 on:** February 03, 2019, 10:05:37 pm »

Sorry for the confusion , its PAL16L8 actually.
It´s a SEGA whitestar system, the Independence Day pinball. They actually sell the programmed chip for about 30$, which sent to Spain translates in 50.-60$ if it doesn´t get busted at the customs.
They sale this as a U213 Security chip, I will post a picture of the connection diagram as soon as I can.

You are all very kind reading and answering thaank you so much

BloodyCactus · « **Reply #7 on:** February 04, 2019, 01:09:04 am »

I have a whitestar boardset (starship troopers). You can get U213 preprogrammed but there are 3 or 4 different versions, for different games. I think you need the Blue Dot version.

That a lot of distributors have them means the JED file is around somewhere (I've been looking, never found it).

There is a dump on github

https://github.com/psurply/ReGAL/tree/master/examples/whitestar

but it does not say what U213 is it (it is NOT the Lord of the Rings one, but it could be Sharky Shootout or Monopoly)

ebastler · « **Reply #8 on:** February 04, 2019, 05:50:11 am »

PAL16L8 is good news. That can be replaced with a 16V8 GAL, one of the flavors which are still in production (Atmel ATF16V8) and which pretty much every universal programmer can program. (Including e.g. the TL866 which has been extensively discussed on this forum.)

The sample file BloodyCactus linked to confirms that the chip works as an address decoder. In the example, it produces select signals for RAM, ROM, sound, and other I/O. As BloodyCactus pointed out, the details may be different in your device. E.g. the address space used for the various devices may be assigned differently. But it should be possible to figure that out, either from the documentation or from measuring the old chip. (If the correct program file can't be found on the net.)

How much damage has your original PAL chip incurred? Do you think it is still functional, so you could check its logic behavior?

EDIT: Does your original PAL have a blue dot, by any chance? That would help to nswer the version question BloodyCactus pointed out!

ebastler · « **Reply #9 on:** February 04, 2019, 06:58:30 am »

Have a look at the PDF here:
https://www.researchgate.net/publication/291338452_Hacking_a_Sega_Whitestar_Pinball

The author has reverse-engineered his flipper, and gives the PAL logic equation on page 8/9. If this looks like the PCB you have, these logic equations are probably what you need.

The paper did remind me that all outputs of the PAL/GAL have tri-state capability. If one wants to reverse-engineer the logic equations, that needs to be taken into account: For each set of input states, you would need to determine whether the outputs are logic high, logic low, or high impedance. Makes the exercise a bit more tedious -- your microcontroller testbed would need to have the capability to pull all outputs high or low via resistors, to see whether they follow or have their own will... Seems that the author has done it this way, since he does give equations for the tristate enable signals.

Annoyingly, the equation for the SNDSTB signal seems to be missing. Maybe worth asking the author?

ebastler · « **Reply #10 on:** February 04, 2019, 07:13:26 am »

Alternatively, here's a guy who sells the programmed chips (or used to sell them...) at a low price, 5 Euro plus 1.20 shipping:
http://www.pinballinfo.com/community/threads/u213-data-east-sega-stern.26247/

powerchisper · « **Reply #11 on:** February 04, 2019, 08:54:40 am »

First of all , thank you so much to all for your response.

It is not difficult for me to get the blank chip, 16L8 or GAL16V8.

I have checked all the traces in the board, making lots of repairs. So now I have several chips which are possibly damaged.

There you have a picture of the diagram, it's position U213. It seems every Whitestar game uses the same PAL, except for Lord of the Rings and Sharkey's Shootout.

The links you posted seems like a hope to me !! now i need to learn about which chip burner is compatible.
I also emailed the 5 dollar chip guy. I'd like this pinball machine fixed, but I want to learn as much as possible. Fixed lots of pinballs but never had this problem before.

Thankx again

pelule · « **Reply #12 on:** February 04, 2019, 06:40:00 pm »

You may program the 16V8 GAL device with the MiniPro TL866 (I used FW v6.60).
But you may want 1st to check, if the device is still operating.
You may find some tips here:
https://www.eevblog.com/forum/repair/datron-cpu-board-pal-data-(1271-1281-)/msg1346121/#msg1346121
/PeLuLe

obiwanjacobi · « **Reply #13 on:** February 05, 2019, 07:20:52 am »

To be explicit: I think you will need something like WinCUPL to compile the logic equations (text) into a binary file that can be programmed.
[2c]

PCB.Wiz · « **Reply #14 on:** February 05, 2019, 08:41:30 am »

Quote from: obiwanjacobi on February 05, 2019, 07:20:52 am

To be explicit: I think you will need something like WinCUPL to compile the logic equations (text) into a binary file that can be programmed.

Yes, WinCUPL includes a simulator, and would be very good for confirming operation.

That said, the link given above for ReGAL seems to show quite good tools too, tho for a limited choice of 16V8/20V8, whilst WinCUPL supports all Atmel PLDs

ebastler · « **Reply #15 on:** February 05, 2019, 12:32:01 pm »

We are getting sidetracked here. The immediate question is where to get the complete information on what goes inside the GAL. (Be it logic equations or the readymade JEDEC file.)

powerchisper · « **Reply #16 on:** February 15, 2019, 06:53:35 pm »

Hi friends.

Thank you for your support.
After days of reserach I finally found this code somewhere in the net.

CUPL(WM) 5.0a Serial# 60008009
Device g16v8ma Library DLIB-h-40-8
Created Wed Aug 17 22:46:52 2011
Name U213
Partno U213
Revision
Date 16/08/2011
Designer
Company Data East / Sega / Stern
Assembly
Location
*QP20
*QF2194
*G0
*F0
*L00000 11111111111111111111111111111111
*L00032 11011111101111110111011111111111
*L00064 01111111101111110111011111111111
*L00256 11111111111111111111111111111111
*L00288 10101011101111110110111111111111
*L00320 10101011101111100111111111111111
*L00352 10101011101111110111011111111111
*L00384 10101011101111110111111110111111
*L00416 10101011101111110111111111111011
*L00448 10101011101111110111111111111101
*L00512 11111111111111111111111111111111
*L00544 10100111101111110110111110111011
*L00576 10100111111101110110111110111011
*L01280 11111111111111111111111111111111
*L01312 10100111101110110110101101110111
*L01536 11111111111111111111111111111111
*L01568 10011111111111111111111111111111
*L01792 11111111111111111111111111111111
*L01824 10100111101101110111111110111111
*L01856 10100111101111110111011110111111
*L02048 00000000010101010011001000110001
*L02080 00110011001000000000000000000000
*L02112 00000000111111111111111111111111
*L02144 11111111111111111111111111111111
*L02176 111111111111111111
*C5753
*0F11

They say I have to write this to a new GAL16V8 as a substitute for the PAL chip.
Do I have to use as a text or convert to some kind of files ?
Maybe I can get the burning device borrowed from a friend.

ebastler · « **Reply #17 on:** February 15, 2019, 08:18:07 pm »

Great find! I'll keep fingers crossed that you found the right version for your flipper.

The file you posted is a "JEDEC" file. You can use this text file as-is, and any GAL or universal programmer should be able to read it.

The TL866 is a popular low-cost programmer on this forum. But pretty much any programmer should be able to handle the 16V8 GAL. Be sure to select the "flavor" of 16V8 from the programmer's menu which matches the specific chip you have. I believe the different variants (16V8A/B, ATF16V8 etc.) differ in their programming voltages and maybe other programming parameters.

up8051 · « **Reply #18 on:** February 15, 2019, 08:49:33 pm »

Hi,

I decompiled this JED file but there something wrong:
Pin13 - XA0 should be INPUT but in this file is configured as OUTPUT

Code: [Select]

;************************ MODIFICATION *****************************
;*******************************************************************
 
;PALASM Design Description
;---------------------------------- Declaration Segment ------------
TITLE    U213.PDS
PATTERN  Decoder
REVISION 0
AUTHOR   JarekC.DIY
COMPANY  DIY
DATE     03/17/90

CHIP  U213 PALCE16V8

;---------------------------------- PIN Declarations ---------------
PIN 1 A15  COMBINATORIAL             ; INPUT
PIN 2 A14  COMBINATORIAL             ; INPUT
PIN 3 A13  COMBINATORIAL             ; INPUT
PIN 4 E	   COMBINATORIAL             ; INPUT
PIN 5 Q	   COMBINATORIAL             ; INPUT
PIN 6 VMA  COMBINATORIAL             ; INPUT
PIN 7 RW   COMBINATORIAL             ; INPUT
PIN 8 A11  COMBINATORIAL             ; INPUT
PIN 9 A12  COMBINATORIAL             ; INPUT
PIN 10 GND

PIN 11 MPIN	COMBINATORIAL             ; INPUT
PIN 12 IOSTB	COMBINATORIAL             ; OUTPUT
PIN 13 XA0      COMBINATORIAL             ; OUTPUT  
PIN 14 SNDSTB	COMBINATORIAL             ; OUTPUT
PIN 15 A10     	COMBINATORIAL             ; INPUT
PIN 16 A9	COMBINATORIAL             ; INPUT
PIN 17 IOPORT	COMBINATORIAL             ; OUTPUT
PIN 18 RAMCS	COMBINATORIAL             ; OUTPUT
PIN 19 ROMCS    COMBINATORIAL             ; OUTPUT
PIN 20 VCC

SIGNATURE = #h00000004CC8C4CAA

EQUATIONS

ROMCS.TRST = VCC
/ROMCS =   A15 * /E *  VMA *  RW
       +   A14 * /E *  VMA *  RW

RAMCS.TRST = VCC
/RAMCS =
         /A15 * /A14 * /A13               * /A10        * /E *   VMA 
       + /A15 * /A14 * /A13                      * /A9  * /E *   VMA
       + /A15 * /A14 * /A13                             * /E *   VMA * RW
       + /A15 * /A14 * /A13        * /A11               * /E *   VMA
       + /A15 * /A14 * /A13 * /A12                      * /E *   VMA
       + /A15 * /A14 * /A13                             * /E *   VMA * MPIN

IOPORT.TRST = VCC
/IOPORT = /A15 * /A14 *  A13 * /A12 * /A11 * /A10 *  VMA * /E
        + /A15 * /A14 *  A13 * /A12 * /A11 * /A10 *  VMA *  Q    

SNDSTB.TRST = VCC
/SNDSTB = /A15 * /A14 * A13 * A12 * A11 * /A10 * /E * /Q *  VMA * /RW

XA0.TRST = VCC           
/XA0 = A15 * /A14

IOSTB.TRST = VCC
/IOSTB = /A15 * /A14 *  A13 * /A11 * /E *  VMA * Q    
       + /A15 * /A14 *  A13 * /A11 * /E *  VMA * RW

;----------------------------------- Simulation Segment ------------
SIMULATION

TRACE_OFF
;-------------------------------------------------------------------

TomS_ · « **Reply #19 on:** February 18, 2019, 01:32:27 pm »

Quote from: ebastler on February 15, 2019, 08:18:07 pm

The TL866 is a popular low-cost programmer

If you want to program ATMEL ATFxxxx's you need a "TL866II Plus". The previous generations of TL866 can do Lattice GALs just fine.

ebastler · « **Reply #20 on:** February 18, 2019, 01:36:39 pm »

Quote from: TomS_ on February 18, 2019, 01:32:27 pm

If you want to program ATMEL ATFxxxx's you need a "TL866II Plus". The previous generations of TL866 can do Lattice GALs just fine.

That is not correct. My first-gen TL866 programs the ATF16V8B and ATF20V8B just fine (and has dedicated parts definitions for them). Only the ATF22V10 is missing.

powerchisper · « **Reply #21 on:** February 19, 2019, 09:26:15 am »

So...It is possible for me to program the chip, but theres a possibility that it won't work ?

I am not sure what the XA lines are for. They go from the game rom to a 74LS374 (XA0 to XA5 ). Xa0 is the only one connected to the PAL chip.
In the schematics it is labeled as input/output, but I am a beginner on this subjects.

My friend has a "Willem 50" so we will check if it can write that on a GAL chip.

Seems that this chip has the same programming on every Whitestar system except for Lord of the Rings and Sharkey. Also seen it socketed on several other boards, so I guess it is an usual repair.

Thank you so much for taking the time to help me !!

ebastler · « **Reply #22 on:** February 19, 2019, 09:41:13 am »

Quote from: powerchisper on February 19, 2019, 09:26:15 am

So...It is possible for me to program the chip, but theres a possibility that it won't work ?

Yes, I'm afraid that is the summary. If up8051's decompilation of the JEDEC file is correct, it seems that the XA0 pin of the PAL/GAL gets configured incorrectly for this application. So the JEDEC file is possibly meant for use in a different PCB.

Quote

I am not sure what the XA lines are for. They go from the game rom to a 74LS374 (XA0 to XA5 ). Xa0 is the only one connected to the PAL chip.
In the schematics it is labeled as input/output, but I am a beginner on this subjects.

The "I/O" label which the schematic shows on the PAL itself just means that this is a PAL pin which can be configured as either an input or an output, depending on the programming of the PAL. To confirm the actual direction, please have a look at the other end of the signal line: Does it originate from an input or an output pin of the 74LS374?

powerchisper · « **Reply #23 on:** February 19, 2019, 10:13:19 am »

The trace coes/comes from pin 2 of the LS374, and it is the only XA line that connects to this PAL chip. All of the XA lines have a pull-u resistor connected to 5V.
All the XA traces go from the ROM adress I think to the LS374 pins labeled as "1Q...2Q..."

ebastler · « **Reply #24 on:** February 19, 2019, 11:41:51 am »

Quote from: powerchisper on February 19, 2019, 10:13:19 am

The trace coes/comes from pin 2 of the LS374, and it is the only XA line that connects to this PAL chip. All of the XA lines have a pull-u resistor connected to 5V.
All the XA traces go from the ROM adress I think to the LS374 pins labeled as "1Q...2Q..."

Pin 2 (and all the other "Q" pins) of the LS374 is indeed an output. The XA signals go to the address inputs of the ROM chip; apparently some kind of bank switching logic? (Writing a data byte to a certain address causes [most of] that byte to be latched in the LS374, and serve as the high address bits for the ROM.)

Anyway, this is consistent with the assumption that the XA0 PAL pin needs to be configured as an input as well. (You can't have two outputs fighting over the definition of the same signal line.) And this is also consistent with the partial analysis of the PAL logic in the PDF which I linked to in an earlier post.

Hence, if the decompilation by up8051 worked out correctly, that would unfortunately suggest that we have the wrong JEDEC file here.


EEVblog Main Site	EEVblog on Youtube	EEVblog on Twitter	EEVblog on Facebook	EEVblog on Odysee

Author Topic: PAL18L8....Help please ! (Read 7822 times)

Share me