Connect with us

Help to copy PAL16 / GAL16 / GAL20 ICs

Discussion in 'Electronic Design' started by Henry, Aug 1, 2005.

Scroll to continue with content
  1. Henry

    Henry Guest

    I'm currently working on a project to "clone" some old computer boards I
    have. The companies are long since out of business. These boards are from
    around 1983 to 1985.

    Please be a little patient with me as I'm not that familiar PAL/GAL ICs and
    can use all the advice I can get.

    I'm researching in to copying a few of the PAL16 / GAL16 / GAL20 ICs on
    these boards. I've been reading that it is possible to "read protect"
    (aka - registered) these chips and fear I may run in to this issue.

    I'm going to be purchasing an EPROM/PAL/GAL programmer in the near future
    and could use some advice on what models and software may be appropriate for
    my work. My needs are pretty basic and most of the technology I'll be
    working with is from the 1980s. I've been look at an Advin Pilot-MVP, but
    fear it may be more programmer then I might need. Any recommendations?

    If the PAL16 / GAL16 / GAL20 ICs are "read protected" (aka - registered)
    what options do I have to try and reverse engineer these chips? What
    options do I have to try and
    figure out how these chips are programmed? I have some basic electronics
    knowledge, enough to be dangerous, but nothing advanced enough to guide me
    with PAL/GAL ICs. Any and all advice will be appreciated.

    I'm also looking for someone to help or "tutor" me with these PAL/GAL ICs
    and I'd be willing to pay for this service.

    You can email me directly at "apl2research -at- comcast.net" or post a
    replay
    here. Thanks in advance for your help.


    Henry
     
  2. Rich Webb

    Rich Webb Guest

    [snip...snip...]

    Word of advice: If you feel that you absolutely most post the same
    question to multiple groups, please do cross-post instead of posting it,
    one at a time, to each group. That way all of the various replies in
    each of the groups show up as a single thread. It also saves people from
    replying in one group to a question that's been answered in another.
     
  3. <snippety>

    The protection you mention refers to disabling a device programmer's ability to read
    the JEDEC fuse pattern burned into the PAL during initial programming. It's more commonly
    referred to as the 'Security Fuse.'

    If the security fuse has indeed been blown, you will not be able to read the PAL in
    question. Reverse-engineering is possible, but it will likely require a logic analyzer. It
    will also most definitely require schematic diagrams of the circuit in question, showing how
    the PAL you're trying to reverse-engineer works into the circuit. Source code for the
    circuit's microprocessor for the specific application may also be of assistance (good luck).

    As far as a programmer goes, the Pilot MVP is an excellent choice. Don't think of it
    as "more than you need." Think of it instead as a relatively future-proof investment. It is a
    tool, and a quality one at that, one which will serve your needs for much more than just
    PALs.
    Such training could be hard to find. I'm not a good choice, as my knowledge of such
    devices is still at the "basic" level, and I don't make a very good tutor in any case (wrong
    personality for it). I would suggest checking with your local community colleges for
    electronics courses involving basic digital logic and PALs.

    Happy hunting.
     
  4. samIam

    samIam Guest

    I'm going to be purchasing an EPROM/PAL/GAL programmer in the near future
    Ebay is a good bet.
    I picked up a BP-MICRO PLD programmer (1126 I think ... dont quite
    recall the model number) almost a year ago. Works great, downloaded
    (and BURNED to cdrom) a copy of their software from teh online site.

    I have used it successful for 16L/R/V8 22V10s which are the type of PALS
    I buy from ebay in bundle.

    I bought the TOP-8048? USB Universal programmer. Thats worked well too,
    with 27Cxxx etc.

    Good luck
     
  5. Rock

    Rock Guest

    Used to have a BP programmer, it was great and never let me down unlike
    some of the others I've have during the years.

    Henry, if you can read out the fuses from the PLD's, there was a free
    program called Pal2gal, or something like that, that would
    automatically alter the fuse pattern for you to use a generic GAL. This
    was an old DOS program that was distributed by either Lattice of AMD (I
    think, its been a long time).

    Good luck.
     
  6. JeffM

    JeffM Guest

  7. Henry

    Henry Guest

    Just a brief update if anyone cares. There is hope, if anyone in the future
    has found these threads and was in the same boat as I. Seems there are a
    few options available to people with PAL's (not sure if this will work with
    GAL's, but I'm also going to try) that may be "protected" and need to copy
    them.



    I first found a service that used a Brute Force Analyzer to try to recover
    and create a JEDEC file from my PAL's. After they had some issues with the
    analyzer, due to the age of the machine, I then found a buddy who had a few
    good ideas on working with HAL's from the early Mac's. His idea was to
    expose the silicon "chip" so it could be examined by a microscope. Once
    exposed pictures could then be taken of the "fuse field" that is inside a
    HAL/PAL (see data sheet of PAL if you never seen the "fuse field") and it
    could then be possible to recreate a JEDEC file, manually of course. I'm a
    basic idiot (due to frequent parental droppings and lack of experience) and
    probably would have never occurred to me to try such a thing.



    He tried a few different ideas to expose the chip, but most were
    unsuccessful. His Website chronicles different ideas and stages of things
    he has tried. The address is
    http://www.stockly.com/forums/showthread.php?p=6 to see some failed
    attempts. The real good stuff is here:
    http://www.stockly.com/forums/showthread.php?t=17&goto=nextnewest. Take a
    look around the whole site. He's really quite smart.



    Anyway. he found a service that will "decap" the IC, called MEFAS.com. They
    do failure analysis, so really we just use "part" of the services they
    offer. If you visit their Website you'll see that they offer a LIB service.
    Basically they can "jumper" the security fuse and then you will be able to
    "read" the JEDEC file from the PAL. Right now I have a HAL I sent to be
    decapped ($175 with return shipping, pics are more if you need them, about
    $350 total). There are issues with HAL's that I go in to in a moment that
    the LIB process won't work. The idea with the HAL is simple - I found a
    version of a HAL (from an Apple IIe) that was in PAL form. Luckily I was
    able to read the PAL with my programmer, convert the PAL code to GAL form
    and burn a working GAL. Sounds like quite an accomplishment? Naaa. If any
    unschooled idiot like me can do it, trust me - you could too. Anyway,
    converting the PAL to a GAL is just kids play - the real luck with this is
    that I found a PAL which I could read. Since I know the HAL is identically
    the same, programmed and logic (fuse field), then I can use the JEDEC as
    sort of a "Rosetta Stone" to read HAL. I could have purchased some old PAL's
    (and YES they are still for sale in some places!) and burned a few and had
    then decapped, but knowing the JEDEC file AND having a piece of equipment to
    test the PAL with is really quite a find!



    Now for some HAL info. These things are VERY rare. I'm not too sure if
    anyone outside of Apple even used them. Basically they are the same as a
    PAL, but they lack the "programming" circuitry that a PAL has. A PAL can be
    programmed "in the field" where as a HAL could only be programmed in the
    factory. HAL's were made by request only. They were a way to "mass
    produce" a PAL, which is just a custom piece of logic. The HAL was
    programmed, or burned, while in the manufacturing process. Since the
    manufacture had access to the bare chip they didn't need any of the
    programming circuitry and that helped keep the cost of the finished IC down
    since it was a "simpler" IC to produce. Since a HAL lacks any programming
    circuitry it also can't be read, so it acts as a copy protection like the
    security fuse does in a PAL. Oh sure, you can read a HAL if you want to
    try, but all you'll get is a "block" of un-blown fuses somewhere in a JEDEC
    file. Nothing useable that will let you recreate the IC. So since HAL's
    don't have a security fuse the LIB process offered by MEFAS.com won't help
    much.



    Hopefully I won't need to manually decode my PAL's. I'm hoping to just have
    MEFAS.com "jumper" the security fuse back and be able to read it. Feel free
    to contact me if I can be of any help in the future. I can be reached via
    email on any of these two sites: www.reactivecomputerservices.com and
    www.gse-reactive.com. My email is listed on both sites.



    Thanks again for everyone's input. My next project involves recreating some
    of the PAL logic in CPLD's. If anyone is familiar with CPLD's and their
    programming, please get in touch with me. I could use some help!





    Henry

    GSE-Reactive.com

    My email is listed on the site if you wish to contact me directly.
     
Ask a Question
Want to reply to this thread or ask your own question?
You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.
Electronics Point Logo
Continue to site
Quote of the day

-