Reading a 16L8 PAL / question on early SRAM card - Page 1
Forum section: electronics / general

author: metertech58761
author_rank: Frequent Contributor
timestamp: December 18, 2024, 11:47:25 pm
content: So I got my hands on a storage device for a piece of chip foundry equipment...I took off the front panel to get at the EPROM and dumped it, but I'm sure I had quite the look on my face when I realized it also has a PAL.PAL16L8A-2CN... circa 1989.I have a TL-866 programmer... but there is no listing in its PLD database for the 16L8 (I assume the PAL16LV8C is NOT the same thing).How would you suggest I dump the equations out of the device? I may end up getting my hands on a second unit, just so I can also get my hands on the SRAM cartridge this used.(it probably predates the PCMCIA standard by a few years, as this storage device was developed in 1988).As for the SRAM card slot, I counted the pins twice... there are only 40 pins. Does this ring a bell? The only clue I have is that the connector has the duPont logo on it.

author: Bud
author_rank: Super Contributor
timestamp: December 19, 2024, 01:34:19 am
content: Did you see this topichttps://www.eevblog.com/forum/fpga/reading-the-programming-of-pal-chips/msg5298922

author: metertech58761
author_rank: Frequent Contributor
timestamp: December 19, 2024, 02:09:45 am
content: No I hadn't seen that thread... will keep it in mind, but I have 2 other assemblies to reverse engineer first.Thank you!

author: metertech58761
author_rank: Frequent Contributor
timestamp: December 22, 2024, 03:25:15 am
content: A picture of the card slot... anyone recognize it?

author: metertech58761
author_rank: Frequent Contributor
timestamp: December 31, 2024, 07:21:47 am
content: Incidentally, I have access to a BPMicro programmer, and may well be the same unit that was used to program this PAL.The BPMicro software even has a definition for an AMD 16L8 (I assume AMD bought MMI at some point), but I cannot for the life of me see how I can 'read' the PAL?

author: Kleinstein
author_rank: Super Contributor
timestamp: December 31, 2024, 09:32:22 am
content: AFAIK there is no way to read a PAL. In most cases they are used for combinatorial logic (no flip flop). In this case one could measure the truth table and than synthesize the logic from there. So not reading the chip but mesure the function and regnerate the required logic.

author: Bruce Abbott
author_rank: Frequent Contributor
timestamp: January 01, 2025, 07:50:00 am
content: It would be possible to read if the security fuse isn't blown, but this unlikely.Since the 16L8 doesn't have registers it should be quite easy to map out. Start by identifying the function of each pin (eg. address input, chip select output). That alone could be enough to guess most of the internal logic. Then apply inputs in all combinations and see what comes out.

author: metertech58761
author_rank: Frequent Contributor
timestamp: January 01, 2025, 12:07:30 pm
content: This is the schematic I've worked out so far... all the connections have been traced out.I'm still trying to work out what to call some of the various lines. Identifying the full pinout of the early CF-style card at P1 would go a LONG way to getting it figured out.

author: PCB.Wiz
author_rank: Super Contributor
timestamp: January 01, 2025, 09:02:42 pm
content: See this older thread for using available ATF16V8 parts to replace PAL16L8 partshttps://www.eevblog.com/forum/microcontrollers/pal16l8-pal16r4-gal16v8b/You can reverse engineer a known good pal, with a MCU with enough pins.Working blind with no sch, you need to drive all pins and read all pins to check for H,L,ZIirc some parts have pull-ups, so sense of Z needs care.it it not common, but some pins at be used as OE on other pins.It was possible to build latches in non register pads, and those are harder to reverse engineer.Simple decoders / memory mapping should be easy.

author: metertech58761
author_rank: Frequent Contributor
timestamp: January 01, 2025, 10:06:30 pm
content: I strongly doubt there was any security used on this, given its application and where used.I'm leaning towards breadboarding it as if it was a 2716, reading it as an EPROM, and working out the equations from the buffer dump.

author: AK6DN
author_rank: Regular Contributor
timestamp: January 02, 2025, 04:08:36 am
content: Quote from: Kleinstein on December 31, 2024, 09:32:22 amOf course there is. Just about any professional programmer that can program a PAL via a .jed file can read the PAL contents back into a .jed file.I have an EEtools TopmaxII and I know it can read a PALs programming into a .jed file that I can then save, and use to verify other PALs against or program blank devices.I know the original DataIO 2900B could do the same, as well as some of the recent Xeltek programmers that support PALs.

author: PCB.Wiz
author_rank: Super Contributor
timestamp: January 02, 2025, 08:27:55 am
content: QuoteOnlyProvidedthe security is not blown.

author: metertech58761
author_rank: Frequent Contributor
timestamp: January 02, 2025, 10:09:29 am
content: I have a GQ-4X and a TL-866II programmer at home, and neither have definitions for the 16L8.I have access to an MPLab PM3 programmer, as well as a BPMicro unit (which is what it was likely programmed on), and the latter DOES have definitions for the 16L8.

author: AK6DN
author_rank: Regular Contributor
timestamp: January 03, 2025, 12:21:46 am
content: Quote from: PCB.Wiz on January 02, 2025, 08:27:55 amWell yeah of course. If the security fuse is blown on a device, the internal programming will be unreadable.The only way to determine the functionality of a device with its security fuse blown is a brute force approach, stimulate all inputs, observe all outputs, write equations, and optimize.Of course this assumes no internal feedback or internal state, which can increase the reverse engineering complexity dramatically.But my point was that legacy PAL programmers provided the capability to both read and write/program the fuse arrays.So reading the device on a legacy programmer may produce the fuse programming if it is unsecured, or at worst an all blown and/or all unblown fusemap if it is secured.In my experience the TL866/T48/T56 (I have the latter two devices) are useful for programming modern EEPROMs and uControllers, or simple RAM or 74xx chip testing.But they do not support legacy devices like PALs and BIPOLAR PROMs. For those I have my trusty EEtools TopMaxII series device which supports all the old stuff, and most new stuff too.