Teardown, Repair and Analysis of an Agilent 4338B (10uΩ - 100kΩ) Milliohmmeter - Page 1
Forum section: electronics / testgear

author: Hugoneus
author_rank: Frequent Contributor
timestamp: August 05, 2018, 12:49:51 am
content: You can watch the video here: [31 Minutes]youtu.be/aOIaFKSoaDUMore videos at The Signal Path:http://www.TheSignalPath.com

author: MadTux
author_rank: Frequent Contributor
timestamp: August 05, 2018, 08:09:28 am
content: Interesting video.BTW, it's quite easy to bruteforce-crack PALs. I've done so using HP-16500C/16557D card, a 20bit counter (5x 74HC193) and the Espresso logic minimizer together with a few shell scripts to convert HP16500C data so it can be fed to Espresso.If your recorded data is good, Espresso can solve it in a few seconds.Done it here on a PAL16L8 in my cheap (now unfortunately totally broken) TIG welder:https://www.mikrocontroller.net/topic/453109

author: madires
author_rank: Super Contributor
timestamp: August 05, 2018, 10:16:22 am
content: Isn't the PALCE more likely a GAL since it can be erased electrically?

author: MadTux
author_rank: Frequent Contributor
timestamp: August 05, 2018, 10:41:33 am
content: TI PAL datasheet says that they use titanium-tungsten fuses. Don't know what AMD used, but I guess it's something similar. Aparently they don't seem to be very reliable as they get old....PALs are OTP/one time programmable (because they use fuses) and have only dynamic (and/or/xor/not...) logic in it, there're no latches/flipflops in it which makes them easy to brute force.GAL use (E)EPROM instead of fuse map, so they are erasable. They have latches in it and can be programmed to act like a PAL (no latches used). Because of the latches, brute force is much more difficult/impossible with GALs (perhaps by using power analysis to detect when a latch is set). Classic methods such as decapping and UV flashing the security bit under the microscope are probably more successful there

author: HighVoltage
author_rank: Super Contributor
timestamp: August 05, 2018, 10:52:06 am
content: What a nice approach:"As long as I know the words, I can fix it"Thanks for another great video.

author: madires
author_rank: Super Contributor
timestamp: August 05, 2018, 01:57:08 pm
content: Quote from: MadTux on August 05, 2018, 10:41:33 amFrom AMD's datasheet for the PALCE16V8 family:- Pin and function compatible with all 20-pin GAL devices- Electrically erasable CMOS technology provides reconfigurable logic and full testabilityThe PALCE16V8 is an advanced PAL device built withlow-power, high-speed, electrically-erasable CMOStechnology. It is functionally compatible with all 20-pinGAL devices. The macrocells provide a universal devicearchitecture. The PALCE16V8 will directly replace thePAL16R8 and PAL10H8 series devices, with the excep-tion of the PAL16C1.

author: texaspyro
author_rank: Super Contributor
timestamp: August 06, 2018, 01:58:21 am
content: Reverse engineering a combinatorial pal is relatively easy. Registered pals with feedback terms are VERY hard to effectively impossible to do.

author: Hugoneus
author_rank: Frequent Contributor
timestamp: August 06, 2018, 02:34:17 pm
content: Thanks for your feedback. Reverse engineering the PAL internal code may be possible, but with a clock going into it and flip-flops it is not as easy as it sounds.

author: MadTux
author_rank: Frequent Contributor
timestamp: August 06, 2018, 03:15:38 pm
content: Sorry, I had the impression that PALCE are similar to PAL, but they are build like GAL, i.e. have internal flipflops with EEPROM.Makes the brute force approach much harder/impossible :-(

author: Kleinstein
author_rank: Super Contributor
timestamp: August 06, 2018, 04:19:22 pm
content: AFAIK HP/Keysight is selling spare parts - also some more special ones. So chances are, one might get an replacement from keysight, as this is just a programmed standard part.It may be a low test current setting, but the short performance test did not look that good. Especially odd is that the initial value before rotating / moving the resistor was way off and there was no warning / error with this.

author: Hugoneus
author_rank: Frequent Contributor
timestamp: August 06, 2018, 05:19:19 pm
content: Quote from: Kleinstein on August 06, 2018, 04:19:22 pmThe issue was with the fixture. I am trying to get a new one. They just cost way too much.

author: pigrew
author_rank: Frequent Contributor
timestamp: August 06, 2018, 05:23:04 pm
content: With the LCR meters, I connect the four guards together at the DUT.I think you mentioned issues using long cables. You may have better luck if the four guards are shorted together... but I've not studied your unit, so I don't know for sure.