Working out equations from a PAL "EPROM dump" - Page 1
Forum section: electronics / projects

author: metertech58761
author_rank: Frequent Contributor
timestamp: February 08, 2025, 05:10:26 pm
content: So, I found that one board I reverse engineered had an old PAL16L8, and when I asked about reading it so I could work out the equations, I was told it wasn't directly possible.But, then, I got the idea of hooking up the lines as if it was a 2716 and reading it that way.It was also mentioned there was a possibility of there being a protection bit, but between this being used to condense the glue logic to save space and the niche application, I don't think that would be the case here.Anyway, I got my hands on some hookup wire and a breadboard, wired it to one of my EPROM programmers (leaving pins 18-21 open), and I think I got a valid dump.Attached is the schematic, and here are the pin assignments as hooked up to the programmer:A0: I1 / Addr_R (RAM card address select)A1: I2 / Address A10A2: I3 / Address A11A3: I4 / Address A12A4: I5 / Address A13A5: I6 / Address A14A6: I7 / Address A15A7: I8 / _RD line (read)A8: I9 / _WR line (write)A9: I10 / PSEN line from 8031D0: O1 / CSel1 (RAM card chip select)D1: IO1 / CSel0 (RAM card chip select)D2: IO2 / Kbd (Keyboard buffer select)D3: IO3 / Disp (Display select)D4: IO4 / NVRAM (NVRAM select)D5: IO5 / ROM (ROM select)D6: IO6 / NVSEL (NVRAM select)D7: O2 / Data_R (RAM card data select)Also attached is a raw dump from the hex editor - 64 lines of 16 bytes.So, if there is a tool that can work out the equations and regenerate a JED file or if someone can help work out the equations, I would appreciate it.

author: PCB.Wiz
author_rank: Super Contributor
timestamp: February 08, 2025, 07:22:21 pm
content: Quote from: metertech58761 on February 08, 2025, 05:10:26 pmYou will need to do a little text massage, but Atmel WinCUPL software has a table command that the logic minimizers can reduce to equations.You define each line with input pattern in decimal/hex/bin and each output ( hex is 'h'0A etc )Simple exampleCode:Field Idx = [Idx6..Idx0]; /* Counter used as a 7bit index, but only the end values used in Smart BAR */Field RomRow = [RomRow4..RomRow0];TABLE Idx => RomRow {'d'5 => 'b'00000; /* Five On - and all values 6..127 give this too */'d'4 => 'b'00100; /* Four On */'d'3 => 'b'01010; /* Three On */'d'2 => 'b'10101; /* Two On */'d'1 => 'b'11011; /* one On */'d'0 => 'b'11111; /* none On */}

author: metertech58761
author_rank: Frequent Contributor
timestamp: February 08, 2025, 07:36:41 pm
content: I did convert the hex values to binary and a little sorting and selective hiding, I came up with this so far:D0 active low = A4 low, A5 high, A6 highD1 active low = A4 high, A5 high, A6 highD2 active low = A1 low, A2 low, A3 low, A4 low, A5 lowD3 active high = A1 low, A2 low, A3 low, A4 low, A5 low, A6 high, A8 lowD4 active low = A6 lowD5 active low = A5 low, A6 lowD6 active low =D7 active low = A0 low, A5 high, A6 high

author: Benta
author_rank: Super Contributor
timestamp: February 08, 2025, 08:32:54 pm
content: It's a bit more difficult.The PAL16V8 is not purely combinatorial (which would make your effort possible), but also contain flip-flops, which makes it much harder.

author: PCB.Wiz
author_rank: Super Contributor
timestamp: February 08, 2025, 09:57:26 pm
content: Quote from: Benta on February 08, 2025, 08:32:54 pmGood point, but the possible 16V8 clock is only on Pin1, but I1 seems to be a combin use.There may be latch actions coded into logic, but this is a reasonable first pass.Quote from: metertech58761 on February 08, 2025, 07:36:41 pmHmm. A7 (RDN) and A9 (PSEN) seem to not be used ?PSEN looks to go direct to ROM.OE, so maybe was never used ?NVSEL goes to NVRAM.OE, which I would expect to include RDN, tho you have no eqn for NVSEL ?

author: metertech58761
author_rank: Frequent Contributor
timestamp: February 08, 2025, 10:13:27 pm
content: Benta: This is the 16L8, not the 16V8. According to the data sheet I have, the L version is strictly logic fabric - no flip-flops.

author: metertech58761
author_rank: Frequent Contributor
timestamp: February 08, 2025, 10:16:42 pm
content: Would it help if I uploaded the full raw dump? There will be two full repeats since A10 was not used.

author: Benta
author_rank: Super Contributor
timestamp: February 08, 2025, 10:56:52 pm
content: Quote from: metertech58761 on February 08, 2025, 10:13:27 pmOh, sorry. As you said 16V8 is your first post, I assumed that that was actually the part. Silly of me, I should have consulted my crystal ball.

author: metertech58761
author_rank: Frequent Contributor
timestamp: February 09, 2025, 01:41:41 am
content: Bento: Can I join you in facepalming?I took all that time in making sure I had my ducks in a row and I make a dumb typo.

author: metertech58761
author_rank: Frequent Contributor
timestamp: February 15, 2025, 10:28:30 pm
content: This is what I have so far for equations:ROM Address: 00xx xxxx / $00xxKbd Address: 1000 00xx & _RD low / $80xxDisp Address: 1000 00xx & _WR low / $80xxData_R Address: 11xx xxxx & Addr_R low / $CxxxCSel0 Address: 110x xxxx / $CxxxCSel1 Address: 111x xxxx / $CxxxNVRAM TBDNVSel TBDGetting the ROM disassembled would go a long way towards clearing up the addresses, but I'm struggling on that front.

author: metertech58761
author_rank: Frequent Contributor
timestamp: March 14, 2025, 05:26:18 pm
content: Here's the raw dump, but I know there is a data table towards the end that I need to see how to rewrite in a format that an 8031 assembler can understand... too bad the tool I used (D52) didn't include the raw bytes for each line of disassembled code.

author: PCB.Wiz
author_rank: Super Contributor
timestamp: March 14, 2025, 08:56:03 pm
content: If you assemble that, you should get the same HEX file, and the .LST file should include the raw bytes to usually 4, so you can see where tables should start.example:804: ; Rule: Copy Register Map Reg 15-92,149-170,183 (178–182 Reserved)805: 00D9 09 0F 00 4F ... DB 09, 15, 00h,4Fh,080h,080h,080h,080h,080h,080h,080h806: 00E4 87 1B 7D 00 ... DB 128+07, 27, 7Dh,00h,0Ah,15h,00h,00h,3Fh807: 00ED 83 2B 01 00 ... DB 128+03, 43, 01h,00h,02h808: 00F2 81 B7 D2 DB 128+01, 183, 0D2h