PAL18L8....Help please ! - Page 1
Forum section: electronics / general

author: powerchisper
author_rank: Contributor
timestamp: February 03, 2019, 09:54:18 am
content: Hello friends !My name is Paco and i am from Spain.Recently I received a pinball machine and the board was so damaged by ruined batteries I had to spend weeks fixing all the broken traces, etc.Most of the damaged IC's are easy to find and replace, but It has a PAL chip between the CPU and the ROM.. I have no way of testing wether this chip is ok or not.My question is :Is there anyway to know how the chip has to be programmed ?I can possibly get a chip burning device and all that stuff, but i woudn'k know what to do next.My intention iis to copy the chip to a new one.I have the schematics for this board, but I don't know if that can give me any clue about what the chip is doing..Any ideas are welcome, please throw in some light in this darkness.Thank you so much for reading ( and excuse me for my English.

author: Ian.M
author_rank: Super Contributor
timestamp: February 03, 2019, 10:29:21 am
content: The PAL probably implements the address decoding or some other glue logic function. Without documentation of its function or a known good one it will be difficult to reverse engineer and as its long discontinued, extremely difficult to source a blank one N.O.S. and a compatible programmer. To further confuse the issue there are probably a fair number of used ones from other applications crudding up the marketplace, which are useless as they are OTP (one time programmable) devices.Do everything you can to preserve and reuse the original chip, and pray that it hasn't been damaged by the lost connections and that its pins haven't rotted too far back inside its encapsulation.

author: Doctorandus_P
author_rank: Super Contributor
timestamp: February 03, 2019, 12:07:04 pm
content: Quote from: powerchisper on February 03, 2019, 09:54:18 amAs said before it is most likely an adress decoder. Something like an 74HC138 on steroids.From the schematic it should be easy to define the inputs and the outputs.You'll have a handfull of sinals coming from a microcontroller, and outputs going to chip select / chip enable / read / write lines of the various other chips.Also, the chip needs to be working (mostly) to be able to read it.And if it works, you don't have to copy it.I have also vague memories that sligtly less obolete GAL's could be used in the place of the older PAL's.I do not know if these old chips have some kind of read protection.The chips themself are relatively simple though, an for someone with experience with them they are probably easy to reverse engineer.

author: ebastler
author_rank: Super Contributor
timestamp: February 03, 2019, 12:48:56 pm
content: 18L8 is either a rather unusual type of PAL, or you got the designation wrong. Could you check again please?Anyway, obtaining a physical replacement should not be the limiting factor. You may not be able to find (and program) the original PAL. There may or may not be a GAL which can be programmed to be pin-compatible, but worst case you can make a little adapter board for a GAL with a different pinout.The real question is how to find or reverse-engineer the programmed function of the PAL. But this is a pointless discussion without details of the pinball machine you are dealing with. Could you tell us the make and model, and post the schematic?EDIT: Yes, PALs already came with "security fuses" to stop copycats from reading them. So even if the original chip still works, it might not be directly readable. But it should be possible to reverse-engineer a working chip with a bit of effort, without knowing anything about the circuit it was used in. The "L" PALs do not contain any flip-flops, so they are "state-free". You could reconstruct the complete truth table by having a microcontroller cycle through all the input combinations and read the outputs.

author: up8051
author_rank: Frequent Contributor
timestamp: February 03, 2019, 12:53:39 pm
content: What pinball?

author: Ian.M
author_rank: Super Contributor
timestamp: February 03, 2019, 12:57:44 pm
content: Quote from: ebastler on February 03, 2019, 12:48:56 pm... and count its pins so we can cross-check part no. against package size!

author: powerchisper
author_rank: Contributor
timestamp: February 03, 2019, 10:05:37 pm
content: Sorry for the confusion , its PAL16L8 actually.It´s a SEGA whitestar system, the Independence Day pinball. They actually sell the programmed chip for about 30$, which sent to Spain translates in 50.-60$ if it doesn´t get busted at the customs.They sale this as a U213 Security chip, I will post a picture of the connection diagram as soon as I can.You are all very kind reading and answering thaank you so much

author: BloodyCactus
author_rank: Frequent Contributor
timestamp: February 04, 2019, 01:09:04 am
content: I have a whitestar boardset (starship troopers). You can get U213 preprogrammed but there are 3 or 4 different versions, for different games. I think you need the Blue Dot version.That a lot of distributors have them means the JED file is around somewhere (I've been looking, never found it).There is a dump on githubhttps://github.com/psurply/ReGAL/tree/master/examples/whitestarbut it does not say what U213 is it (it is NOT the Lord of the Rings one, but it could be Sharky Shootout or Monopoly)

author: ebastler
author_rank: Super Contributor
timestamp: February 04, 2019, 05:50:11 am
content: PAL16L8 is good news. That can be replaced with a 16V8 GAL, one of the flavors which are still in production (Atmel ATF16V8) and which pretty much every universal programmer can program. (Including e.g. the TL866 which has been extensively discussed on this forum.)The sample file BloodyCactus linked to confirms that the chip works as an address decoder. In the example, it produces select signals for RAM, ROM, sound, and other I/O. As BloodyCactus pointed out, the details may be different in your device. E.g. the address space used for the various devices may be assigned differently. But it should be possible to figure that out, either from the documentation or from measuring the old chip. (If the correct program file can't be found on the net.)How much damage has your original PAL chip incurred? Do you think it is still functional, so you could check its logic behavior?EDIT: Does your original PAL have a blue dot, by any chance? That would help to nswer the version question BloodyCactus pointed out!

author: ebastler
author_rank: Super Contributor
timestamp: February 04, 2019, 06:58:30 am
content: Have a look at the PDF here:https://www.researchgate.net/publication/291338452_Hacking_a_Sega_Whitestar_PinballThe author has reverse-engineered his flipper, and gives the PAL logic equation on page 8/9. If this looks like the PCB you have, these logic equations are probably what you need.The paper did remind me that all outputs of the PAL/GAL have tri-state capability. If one wants to reverse-engineer the logic equations, that needs to be taken into account: For each set of input states, you would need to determine whether the outputs are logic high, logic low, or high impedance. Makes the exercise a bit more tedious -- your microcontroller testbed would need to have the capability to pull all outputs high or low via resistors, to see whether they follow or have their own will... Seems that the author has done it this way, since he does give equations for the tristate enable signals.Annoyingly, the equation for the SNDSTB signal seems to be missing. Maybe worth asking the author?

author: ebastler
author_rank: Super Contributor
timestamp: February 04, 2019, 07:13:26 am
content: Alternatively, here's a guy who sells the programmed chips (or used to sell them...) at a low price, 5 Euro plus 1.20 shipping:http://www.pinballinfo.com/community/threads/u213-data-east-sega-stern.26247/

author: powerchisper
author_rank: Contributor
timestamp: February 04, 2019, 08:54:40 am
content: First of all , thank you so much to all for your response.It is not difficult for me to get the blank chip, 16L8 or GAL16V8.I have checked all the traces in the board, making lots of repairs. So now I have several chips which are possibly damaged.There you have a picture of the diagram, it's position U213. It seems every Whitestar game uses the same PAL, except for Lord of the Rings and Sharkey's Shootout.The links you posted seems like a hope to me !! now i need to learn about which chip burner is compatible.I also emailed the 5 dollar chip guy. I'd like this pinball machine fixed, but I want to learn as much as possible. Fixed lots of pinballs but never had this problem before.Thankx again

author: pelule
author_rank: Frequent Contributor
timestamp: February 04, 2019, 06:40:00 pm
content: You may program the 16V8 GAL device with the MiniPro TL866 (I used FW v6.60).But you may want 1st to check, if the device is still operating.You may find some tips here:https://www.eevblog.com/forum/repair/datron-cpu-board-pal-data-(1271-1281-)/msg1346121/#msg1346121/PeLuLe

author: obiwanjacobi
author_rank: Super Contributor
timestamp: February 05, 2019, 07:20:52 am
content: To be explicit: I think you will need something like WinCUPL to compile the logic equations (text) into a binary file that can be programmed.

author: PCB.Wiz
author_rank: Super Contributor
timestamp: February 05, 2019, 08:41:30 am
content: Quote from: obiwanjacobi on February 05, 2019, 07:20:52 amYes, WinCUPL includes a simulator, and would be very good for confirming operation.That said, the link given above for ReGAL seems to show quite good tools too, tho for a limited choice of 16V8/20V8, whilst WinCUPL supports all Atmel PLDs

author: ebastler
author_rank: Super Contributor
timestamp: February 05, 2019, 12:32:01 pm
content: We are getting sidetracked here. The immediate question is where to get the complete information on what goes inside the GAL. (Be it logic equations or the readymade JEDEC file.)

author: powerchisper
author_rank: Contributor
timestamp: February 15, 2019, 06:53:35 pm
content: Hi friends.Thank you for your support.After days of reserach I finally found this code somewhere in the net.CUPL(WM) 5.0a Serial# 60008009Device g16v8ma Library DLIB-h-40-8Created Wed Aug 17 22:46:52 2011Name U213Partno U213RevisionDate 16/08/2011DesignerCompany Data East / Sega / SternAssemblyLocation*QP20*QF2194*G0*F0*L00000 11111111111111111111111111111111*L00032 11011111101111110111011111111111*L00064 01111111101111110111011111111111*L00256 11111111111111111111111111111111*L00288 10101011101111110110111111111111*L00320 10101011101111100111111111111111*L00352 10101011101111110111011111111111*L00384 10101011101111110111111110111111*L00416 10101011101111110111111111111011*L00448 10101011101111110111111111111101*L00512 11111111111111111111111111111111*L00544 10100111101111110110111110111011*L00576 10100111111101110110111110111011*L01280 11111111111111111111111111111111*L01312 10100111101110110110101101110111*L01536 11111111111111111111111111111111*L01568 10011111111111111111111111111111*L01792 11111111111111111111111111111111*L01824 10100111101101110111111110111111*L01856 10100111101111110111011110111111*L02048 00000000010101010011001000110001*L02080 00110011001000000000000000000000*L02112 00000000111111111111111111111111*L02144 11111111111111111111111111111111*L02176 111111111111111111*C5753*0F11They say I have to write this to a new GAL16V8 as a substitute for the PAL chip.Do I have to use as a text or convert to some kind of files ?Maybe I can get the burning device borrowed from a friend.

author: ebastler
author_rank: Super Contributor
timestamp: February 15, 2019, 08:18:07 pm
content: Great find! I'll keep fingers crossed that you found the right version for your flipper.The file you posted is a "JEDEC" file. You can use this text file as-is, and any GAL or universal programmer should be able to read it.The TL866 is a popular low-cost programmer on this forum. But pretty much any programmer should be able to handle the 16V8 GAL. Be sure to select the "flavor" of 16V8 from the programmer's menu which matches the specific chip you have. I believe the different variants (16V8A/B, ATF16V8 etc.) differ in their programming voltages and maybe other programming parameters.

author: up8051
author_rank: Frequent Contributor
timestamp: February 15, 2019, 08:49:33 pm
content: Hi,I decompiled this JED file but there something wrong:Pin13 - XA0 should be INPUT but in this file is configured as OUTPUTCode:;************************ MODIFICATION *****************************;*******************************************************************;PALASM Design Description;---------------------------------- Declaration Segment ------------TITLE U213.PDSPATTERN DecoderREVISION 0AUTHOR JarekC.DIYCOMPANY DIYDATE 03/17/90CHIP U213 PALCE16V8;---------------------------------- PIN Declarations ---------------PIN 1 A15 COMBINATORIAL ; INPUTPIN 2 A14 COMBINATORIAL ; INPUTPIN 3 A13 COMBINATORIAL ; INPUTPIN 4 ECOMBINATORIAL ; INPUTPIN 5 QCOMBINATORIAL ; INPUTPIN 6 VMA COMBINATORIAL ; INPUTPIN 7 RW COMBINATORIAL ; INPUTPIN 8 A11 COMBINATORIAL ; INPUTPIN 9 A12 COMBINATORIAL ; INPUTPIN 10 GNDPIN 11 MPINCOMBINATORIAL ; INPUTPIN 12 IOSTBCOMBINATORIAL ; OUTPUTPIN 13 XA0 COMBINATORIAL ; OUTPUTPIN 14 SNDSTBCOMBINATORIAL ; OUTPUTPIN 15 A10COMBINATORIAL ; INPUTPIN 16 A9COMBINATORIAL ; INPUTPIN 17 IOPORTCOMBINATORIAL ; OUTPUTPIN 18 RAMCSCOMBINATORIAL ; OUTPUTPIN 19 ROMCS COMBINATORIAL ; OUTPUTPIN 20 VCCSIGNATURE = #h00000004CC8C4CAAEQUATIONSROMCS.TRST = VCC/ROMCS = A15 * /E * VMA * RW+ A14 * /E * VMA * RWRAMCS.TRST = VCC/RAMCS =/A15 * /A14 * /A13 * /A10 * /E * VMA+ /A15 * /A14 * /A13 * /A9 * /E * VMA+ /A15 * /A14 * /A13 * /E * VMA * RW+ /A15 * /A14 * /A13 * /A11 * /E * VMA+ /A15 * /A14 * /A13 * /A12 * /E * VMA+ /A15 * /A14 * /A13 * /E * VMA * MPINIOPORT.TRST = VCC/IOPORT = /A15 * /A14 * A13 * /A12 * /A11 * /A10 * VMA * /E+ /A15 * /A14 * A13 * /A12 * /A11 * /A10 * VMA * QSNDSTB.TRST = VCC/SNDSTB = /A15 * /A14 * A13 * A12 * A11 * /A10 * /E * /Q * VMA * /RWXA0.TRST = VCC/XA0 = A15 * /A14IOSTB.TRST = VCC/IOSTB = /A15 * /A14 * A13 * /A11 * /E * VMA * Q+ /A15 * /A14 * A13 * /A11 * /E * VMA * RW;----------------------------------- Simulation Segment ------------SIMULATIONTRACE_OFF;-------------------------------------------------------------------

author: TomS_
author_rank: Frequent Contributor
timestamp: February 18, 2019, 01:32:27 pm
content: Quote from: ebastler on February 15, 2019, 08:18:07 pmIf you want to program ATMEL ATFxxxx's you need a "TL866II Plus". The previous generations of TL866 can do Lattice GALs just fine.

author: ebastler
author_rank: Super Contributor
timestamp: February 18, 2019, 01:36:39 pm
content: Quote from: TomS_ on February 18, 2019, 01:32:27 pmThat is not correct. My first-gen TL866 programs the ATF16V8B and ATF20V8B just fine (and has dedicated parts definitions for them). Only the ATF22V10 is missing.

author: powerchisper
author_rank: Contributor
timestamp: February 19, 2019, 09:26:15 am
content: So...It is possible for me to program the chip, but theres a possibility that it won't work ?I am not sure what the XA lines are for. They go from the game rom to a 74LS374 (XA0 to XA5 ). Xa0 is the only one connected to the PAL chip.In the schematics it is labeled as input/output, but I am a beginner on this subjects.My friend has a "Willem 50" so we will check if it can write that on a GAL chip.Seems that this chip has the same programming on every Whitestar system except for Lord of the Rings and Sharkey. Also seen it socketed on several other boards, so I guess it is an usual repair.Thank you so much for taking the time to help me !!

author: ebastler
author_rank: Super Contributor
timestamp: February 19, 2019, 09:41:13 am
content: Quote from: powerchisper on February 19, 2019, 09:26:15 amYes, I'm afraid that is the summary. If up8051's decompilation of the JEDEC file is correct, it seems that the XA0 pin of the PAL/GAL gets configured incorrectly for this application. So the JEDEC file is possibly meant for use in a different PCB.QuoteThe "I/O" label which the schematic shows on the PAL itself just means that this is a PAL pin which can be configured as either an input or an output, depending on the programming of the PAL. To confirm the actual direction, please have a look at the other end of the signal line: Does it originate from an input or an output pin of the 74LS374?

author: powerchisper
author_rank: Contributor
timestamp: February 19, 2019, 10:13:19 am
content: The trace coes/comes from pin 2 of the LS374, and it is the only XA line that connects to this PAL chip. All of the XA lines have a pull-u resistor connected to 5V.All the XA traces go from the ROM adress I think to the LS374 pins labeled as "1Q...2Q..."

author: ebastler
author_rank: Super Contributor
timestamp: February 19, 2019, 11:41:51 am
content: Quote from: powerchisper on February 19, 2019, 10:13:19 amPin 2 (and all the other "Q" pins) of the LS374 is indeed an output. The XA signals go to the address inputs of the ROM chip; apparently some kind of bank switching logic? (Writing a data byte to a certain address causes [most of] that byte to be latched in the LS374, and serve as the high address bits for the ROM.)Anyway, this is consistent with the assumption that the XA0 PAL pin needs to be configured as an input as well. (You can't have two outputs fighting over the definition of the same signal line.) And this is also consistent with the partial analysis of the PAL logic in the PDF which I linked to in an earlier post.Hence, if the decompilation by up8051 worked out correctly, that would unfortunately suggest that we have the wrong JEDEC file here.

author: PCB.Wiz
author_rank: Super Contributor
timestamp: February 19, 2019, 06:55:35 pm
content: Quote from: powerchisper on February 19, 2019, 10:13:19 amQuote from: ebastler on February 19, 2019, 11:41:51 amIt's certainly not a perfect match, but may not be a complete dud.Can you check if anyone has used this PLD in a working system ? Can you find any other PLD that is a closer fit ?Where did this PLD come from, and how did they derive the code ?Looking at the wiring, it looks like LS374.OEN = A15, so it will float (pull-up) when A15=HIYou could need to add code XA.OE = A15, which would safely swap drive on the XA line between LS374 and PAL.Then/XA0 = A15 * /A14will be driven low by PAL, only when A15 = Hi and A14=low.Does that make sense in the memory map ?

author: ebastler
author_rank: Super Contributor
timestamp: February 19, 2019, 07:21:55 pm
content: Quote from: PCB.Wiz on February 19, 2019, 06:55:35 pmI would not poke around in the dark, trying to modify the GAL code.Look at the PDF which I linked to in reply #9 above:https://www.researchgate.net/publication/291338452_Hacking_a_Sega_Whitestar_PinballSomeone has reverse-engineered the PAL by actually measuring its behaviour (but seems to have missed an output or two, unfortunately). Looking at his results on page 9, there are further differences: e.g. the outputs are all tri-state, enabled via the /E input.I see two possibilities:The JEDEC file is just right, and up8051's decompilation is giving wrong results, orthe JEDEC file is quite different from what is needed, in which case it is best to look for the correct one.While I don't have a GAL decompiler to verify, it just occurs to me that I could try to re-compile up8051's reconstructed source file and compare the JEDECs. I will give that a try.EDIT:I just tried to decompile the JEDEC with JED2EQN from Nat Semi's old OPAL suite (http://www.brouhaha.com/~eric/retrocomputing/mmi/palasm/). Looks like I get the same result which up8051 posted earlier. Hence, more likely than not, the JEDEC file is just plain wrong.You could still try to program a GAL with the JEDEC code, but I would not have high hopes that it works in the flipper. As a fallback, you could try merging the information from the PDF I had linked to (which seems to have plausible equations for everyting but the SNDSTRB) with the SNDSTRB equation reverse-engineered from the JEDEC?

author: powerchisper
author_rank: Contributor
timestamp: February 23, 2019, 07:47:30 am
content: I found these elsewhere in the internet :GAL16V8U213A15 A14 A13 /E Q VMA RW A11 A12 GNDMPIN IOSTB XA0 SNDSTB A10 A9 IOPORT /RAMCS /ROMCS VCC/ROMCS.T = A15 + A14 + IOPORT/ROMCS.E = /ERAMCS.T = A15 + A14 + A13 + A12 * A11 * A10 * A9 * /RW * /MPIN/RAMCS.E = /EIOPORT.T = A15 + A14 + /A13 + A12 + A11 + XA0IOPORT.E = /EIOSTB.T = /A15 * /A14 * A13 * /A11IOSTB.E = /EDESCRIPTION:Sega Whitestar PinballU213 (Address space decoding)This is not JED file, but I think these are the equations to generate that.Is there any kind of software for doing this ?Thank you very much.

author: up8051
author_rank: Frequent Contributor
timestamp: February 23, 2019, 09:04:16 am
content: Equations are rather flawed:- inputs VMA, and Q not used- no equations for SNDSTB- outputs as three-state.In what condition is the original chip (U213)?

author: powerchisper
author_rank: Contributor
timestamp: February 23, 2019, 03:50:43 pm
content: I had to desolder it, because of all the damaged traces underneath it.The numers on the IC are all erased , the pins tarnished by alkaline corrosion.I had to clean the pins with a nail polisher, even after desoldering.I am also afraid that, if it wasn't in a good shape when I first got the board, I could have damaged even more when desoldering.So...I see in the link above that the guy did the equation by connecting that to an arduino and running some code on it.

author: PCB.Wiz
author_rank: Super Contributor
timestamp: February 24, 2019, 03:48:16 am
content: Quote from: powerchisper on February 23, 2019, 07:47:30 amYes, download Atmel WinCUPL - it will produce JED files from boolean equationsYou need to use valid equations for the part, and .oe and ,clk terms are inferred on some small SPLDsUsual Flop is a .D extension, but you can use .T if you tell CUPL to build that from a .D-FF which is inside the part. (register_select fwir)WinCUPL can also create simulate vectors, which you can run on the original part and the programmed copy, to check they react the same.The tricky part is getting 100% test coverage of the original part.Quote from: powerchisper on February 23, 2019, 03:50:43 pmIf the part is async only, (no registers) a simple memory-like scan can give 100% coverage.If it includes registers, you need to consider the register state too.

author: Hamster
author_rank: Regular Contributor
timestamp: April 12, 2021, 05:56:08 pm
content: Quote from: powerchisper on February 15, 2019, 06:53:35 pmI just tested this, it appears to work...