Teardown, Repair and Analysis of an Agilent 4338B (10uΩ - 100kΩ) Milliohmmeter

[Hugoneus]

You can watch the video here: [31 Minutes]
youtu.be/aOIaFKSoaDU

More videos at The Signal Path:
http://www.TheSignalPath.com

[MadTux]

Interesting video.
BTW, it's quite easy to bruteforce-crack PALs. I've done so using HP-16500C/16557D card, a 20bit counter (5x 74HC193) and the Espresso logic minimizer together with a few shell scripts to convert HP16500C data so it can be fed to Espresso.

If your recorded data is good, Espresso can solve it in a few seconds.

Done it here on a PAL16L8 in my cheap (now unfortunately totally broken) TIG welder:
https://www.mikrocontroller.net/topic/453109

[madires]

Isn't the PALCE more likely a GAL since it can be erased electrically?

[MadTux]

TI PAL datasheet says that they use titanium-tungsten fuses. Don't know what AMD used, but I guess it's something similar. Aparently they don't  seem to be very reliable as they get old....

PALs are OTP/one time programmable (because they use fuses) and have only dynamic (and/or/xor/not...) logic in it, there're no latches/flipflops in it which makes them easy to brute force.

GAL use (E)EPROM instead of fuse map, so they are erasable. They have latches in it and can be programmed to act like a PAL (no latches used). Because of the latches, brute force is much more difficult/impossible with GALs (perhaps by using power analysis to detect when a latch is set). Classic methods such as decapping and UV flashing the security bit under the microscope are probably more successful there

[HighVoltage]

What a nice approach:
"As long as I know the words, I can fix it"

Thanks for another great video.

[madires]

TI PAL datasheet says that they use titanium-tungsten fuses. Don't know what AMD used, but I guess it's something similar. Aparently they don't  seem to be very reliable as they get old....

From AMD's datasheet for the PALCE16V8 family:

- Pin and function compatible with all 20-pin GAL devices
- Electrically erasable CMOS technology provides reconfigurable logic and full testability

The PALCE16V8 is an advanced PAL device built with
low-power, high-speed, electrically-erasable CMOS
technology. It is functionally compatible with all 20-pin
GAL devices. The macrocells provide a universal device
architecture. The PALCE16V8 will directly replace the
PAL16R8 and PAL10H8 series devices, with the excep-
tion of the PAL16C1.

[texaspyro]

Reverse engineering a combinatorial pal is relatively easy.   Registered pals with feedback terms are VERY hard to effectively impossible to do.

[Hugoneus]

Thanks for your feedback. Reverse engineering the PAL internal code may be possible, but with a clock going into it and flip-flops it is not as easy as it sounds.

[MadTux]

Sorry, I had the impression that PALCE are similar to PAL, but they are build like GAL, i.e. have internal flipflops with EEPROM.
Makes the brute force approach much harder/impossible :-(

[Kleinstein]

AFAIK HP/Keysight is selling spare parts - also some more special ones. So chances are, one might get an replacement from keysight, as this is just a programmed standard part.


It may be a low test current setting, but the short performance test did not look that good. Especially odd is that the initial value before rotating / moving the resistor was way off and there was no warning /  error with this.

[Hugoneus]

AFAIK HP/Keysight is selling spare parts - also some more special ones. So chances are, one might get an replacement from keysight, as this is just a programmed standard part.


It may be a low test current setting, but the short performance test did not look that good. Especially odd is that the initial value before rotating / moving the resistor was way off and there was no warning /  error with this.

The issue was with the fixture. I am trying to get a new one. They just cost way too much.

[pigrew]

With the LCR meters, I connect the four guards together at the DUT.

I think you mentioned issues using long cables. You may have better luck if the four guards are shorted together... but I've not studied your unit, so I don't know for sure.