http://dreamjam.co.uk/emuviews/pal/index.html
http://dreamjam.co.uk/emuviews/elec/pal.php

Introduction

This device recreates the logic equations (which can be compiled into a JEDEC fusemap) from read-protected PAL and GAL devices.

Project status

Revision 3 (pictured, leftmost) is currently in development. It supports 20-pin PALs. 24-pin PAL support is implemented in hardware but the software needs additional work to enable reading and analysis of those parts. It also has hardware to accomdate analysis of registered PALs, which is being developed. Consider this a work in progress.

Online documentation and tutorials are here.

Using the PAL Device Reader

(C) 2007-2008 Charles MacDonald

Disclaimer

Use the information presented within at your own risk. Some steps will involve modifying your operating system's settings, adding devices to your computer, and handling of electronic components.
Please take all proper precautions necessary.


Overview

You'll need to provide the following:

USB cable
"A"-type male connector to "B"-type male connector.

DC power supply
Only use a +9V DC regulated power supply, around 800mA. The power jack accepts a 2.1mm male connector, negative tip, positive sleeve.

This is identical to the power supply used in the Sega Master System.
I would recommend plugging it into a power strip with a switch so you can easily turn the PAL reader on and off.


Device Support

The PAL analysis hardware and software supports programmable logic devices, either PAL or GAL, that conform to the 16V8 pinout, that is:

Pins 1-9 are inputs.
Pins 11-19 are inputs, outputs or bidirectional.
Pin 10 is ground, pin 20 is 5.0V.
3.3V devices are NOT supported.
This includes devices such as:
10L4, 10L6, 10L8
12L4, 12L6, 12L8
16L4, 16L6, 16L8
16V8 (when not configured as registered)
18CV8 (when not configured as registered)
PAL types

Programmable logic devices primarily come in two types: combinatorial or registered. Only combinatorial devices are supported.

Any PAL with an "L" in its device name, such as PAL16L8, PALCE12L4, is combinatorial only.
Any PAL with an "R" in its device name, such as PAL16R8, PALCE12R4, is registered or partially registered/combinatorial. These are NOT supported
Any PAL with an "V" in its device name, such as GAL16V8 can be configured as combinatorial, registered, or partially combinatorial/registered. Only combinatorial configurations are supported
16V8 and 18CV8 devices are a superset of the PAL architecture and can be programmed to be combinatorial and/or registered. The analysis software will try to detect the attributes that a registered PAL would have, and warn you if it suspects the PAL is configured as registered.

One way to determine if a 16V8-type PAL is registered is to examine its connections on the PCB. All registered PALs use pin 1 exclusively as a clock input, and pin 11 exclusively as an active-low output enable. A common scenario for registered PALs is to have pin 11 tied to ground so the outputs are permanently enabled. Pin 1 may be tied to a nearby clock signal, though it isn't always easy to tell.

18CV8 devices, depending on how they are programmed, may not be detectable as being registered even when they are.

Replacements

You will be able to generate JEDEC files for GAL16V8 and GAL22V10 devices to function as replacements. Fuse maps for other devices are not supported.
Driver Installation

Uninstall old drivers

If you have an older FTDI driver installed, you may need to uninstall it.
Select "Add/Remove Programs" from the Control Panel, look for "FTDI USB Serial Converter Drivers", and choose "Change/Remove":

After it has been uninstalled, ensure no devices using FTDI chips are plugged in.
Then reboot your computer.

Install new drivers

Download the appropriate driver archive from FTDI's "D2XX Direct Driver" page:

http://www.ftdichip.com/Drivers/D2XX.htm
For example, if you are running Windows XP you'd want "CDM 2.04.06 WHQL Certified.zip" driver package.
Unzip the file to a directory, such as "C:\CDM 2.04.06 WHQL Certified\".
Take a look in the directory, there should be .INF and .CAT files present.
Connect the PAL analysis board to your PC and apply power.
The red LED on the PCB should light up.
Windows will recognize the FT2232 chip after a few seconds.
When prompted to install drivers, select the directory you unzipped them to and choose OK.
Windows should install the drivers and tell you that the device is now ready to use.

Hardware Overview

Turn the power OFF before removing or inserting PALs into the reader.

To remove a PAL that is in the socket, insert a small flat-head screwdriver underneath the chip and twist the handle gently to pry it up slightly.
The socket has a recession underneath the chip to facilitate this. Repeat the procedure on both ends until it is fully disengaged.
Always be very careful when removing or inserting PALs to prevent pins from being bent or damaged.
Make sure the PAL is inserted correctly or else it may be damaged when power is applied.
Double check that the orientation of the PAL is correct.

Revision 1 Hardware

NOTE: Supports 20-pin devices ONLY.
Insert the PAL with the pin 1 indicator (notch) facing towards the USB and DC power jack.
Revision 2 Hardware

NOTE: Supports 20-pin devices ONLY.
Insert the PAL with the pin 1 indicator (notch) facing towards the USB and DC power jack.
Revision 3 Hardware

Insert the PAL with the pin 1 indicator (notch) facing towards the DC power jack.
This also applies to 20-pin devices as well, they should be inserted at the rightmost side of the socket.

Indicator LEDs:
Red LED
Power supply indicator.
Lit when the PAL Device Reader is powered.
Green LED
PAL power supply indicator.
Lit when the PAL is being powered. This happens during a read operation.
Yellow LED
Fault indicator.
Brightly lit when there is a short circuit, like when a PAL is plugged in backwards. Turn off power immediately.
May flash briefly when power is turned on or off, this is normal.
Will be dimly lit or flicker during certain operations, this is normal.
The switch selects the type of PAL device you want to read.
The switch should be UP for 24-pin devices and DOWN for 20-pin devices.
Always ensure the switch is in the correct position before applying power.
Tutorial: Reading a PAL device

Open up a command prompt and go to the directory that contains the pd.exe program. Then apply power to the PAL reader.
Windows may take a few seconds to recognize the device, and during that time the application will report that there are no devices present.

When ready, type "pd dump <filename.bin>" and press Enter.

Now you have a binary dump of the PAL state. This is not a copy of its internal contents, but a collection of every possible output the PAL can generate for every possible given input.
The data needs to be analyzed to determine how the PAL was programmed.

Tutorial: Getting Started with WinCUPL

Overview

WinCUPL will be used to generate fusemaps for creating replacement PALs, and minimizing CUPL equations down to more manageable sizes.

Installing WinCUPL

Download and install Atmel's WinCUPL software:

http://www.atmel.com/dyn/products/tools_card.asp?tool_id=2759
The software is free, but you will have to register in order to download it.
Starting a new project

Launch WinCUPL by double clicking on the WinCUPL icon on the desktop.

Select "File -> New -> Design File"

Change the Name property to the name of your device.
For this example the PAL I am using is labeled "ROM1".

Use the default of zero input pins and choose "OK".

Use the default of zero output pins and choose "OK".

Use the default of zero pin nodes and choose "OK".

Erase the existing text in the edit window. Now we have our template for a PAL design created.
Note the path and filename shown in the edit window's title bar, this is where the output from this project will be written to.

Setting up options

Select Options > Compiler > Output Files tab.
Check the checkboxes as shown.

Select Options > Compiler > General tab.
Check the checkboxes as shown.
NOTE: Make sure "Secure Device" is not checked.

Select Options > Compiler > Minimization tab.

I would suggest Expresso and then Quine-McCluskey if that doesn't produce the kind of results needed.
Change the settings based on what device you are trying to fit the design into.

Change the settings based on what device you are trying to fit the design into.
Don't select "Keep XOR Equations".


Tutorial: PAL analysis

To analyze the contents of the data that was read, type "pd analyze <filename.bin>" and press Enter. The output will be written to stdout, so you may want to redirect it to a text file of the same name as the device. Use the PLD extension, this is the file extention for CUPL source code files.

You can open the file in a text editor to examine the results. Here is the sample output:



The PLD file contains a set of equations that represent the PAL logic and configuration in a format called CUPL. You can add "C"-style comments to the file, by prefixing a single line comment with // and enclosing a multi-line comment with /* ... */.

The equations are series of statements joined with '#'. Notice that pins B3-B7 have a one line equation each, and pin B0 is a multiple line equation. Some equations can have just one line, or several lines, or several thousand lines.

The CUPL file is the important part that describes how the PAL works. Fusemaps do not convey this information in a human-readable form, and they are tied to specific devices whereas CUPL presents the information in a more generic way. This also means the CUPL source can be used to fit the design that into other PALs or GALs if needed.

Documentation

You can and should document your work. Add comments to the file, including details such as:

Text from added markings or labels on the PAL ("SEGA 315-5220", "WH-02")
Manufacturer and part number (Lattice GAL16V8B, MMI PAL16L6BCN)
Device package (PDIP-20, CERDIP-20)
This information may not be present in the part manufacturer's part markings alone.
PCB the device came from, and its location. (Namco System 2 PCB, location 9K)
You can add comments ot a CUPL file, such as what is present at the top of the output. I would strongly advise adding your own notes, this will help other people working with the same hardware to understand what the CUPL source code corresponds to.

For example, this is how the above sample could be edited:



And don't just stop there. Now that you know how the PAL is configured, trace out the connections on the PCB. Write down the other components the PAL connects to. The PAL equations themselves are worthless without knowing how the PAL is connected to other hardware on the board. This is not the case with EPROMs and PROMs which sometimes are self-explanatory.

What Went Wrong?

You may have analyzed a PAL dump and seen a warning at the start of the output that is similar to the following:



This means that during analysis, the utility found that one or more bidirectional pins had the attributes that a registered PAL would have. While this should be taken as a strong indication that the PAL is configured for registered operation, if you know for a fact that it is not, then consider this warning to be incorrect.

The purpose of this warning is to help identify registered PALs which are unlabeled, or are similar to the 16V8 type which can be configured to be combinatorial or registered.


Tutorial: Minimizing equations

You should attempt to minimize any multi-line equation.
Here's the output from a PLD dump that is a candidate for minimization.



To minimize this equation, follow these steps:

Create a new project as shown in the WinCUPL tutorial.
Cut and paste the output from your PLD file into the editor window.
Select Run > Device Dependant Compiler or press F9.
It should compile with no errors.

Now open up the .SIM file which is in the same directory as the .PLD file, this directory is listed in the title of the editor window.
For example, if your PLD file is "ROM1.PLD", the SIM file is "ROM1.SIM".

Near the bottom of the file, there is a section enclosed in "%EQUATION" and "%END". Within this area are the minimized equations.
Here's one of them:



You should cut and paste this in place of the larger set of equations that are in your .PLD file, in this case replacing the set of equations for B0.
Notice that the syntax isn't quite right for CUPL; change "=>" to "=" and add a semicolon at the end of the last line:



Try compiling it again (F9). If there are no errors, you have successfully replaced the original set of equations with the minimized ones.

This wasn't much of a reduction, just three lines down to two. However it's possible to have output that has hundreds of thousands of lines, and those can often be minimized to just a few lines as well.

Some pointers:

Don't try to minimize the minimized results.
If an equation cannot be minimized, even if it's fairly large, that's normal. Not everything will reduce.

Tutorial: Creating a JEDEC fuse map

Create a new project as shown in the WinCUPL tutorial.

Cut and paste the output from your PLD file into the editor window.

Select Run > Device Dependant Compile (or press F9).
It should compile successfully with no errors.

Now we need to "fit" the PAL design into a target device. Typically any modern replacement of an older device will be with a GAL16V8, because it's reprogrammable, inexpensive, and functions as a superset of all previous PAL architectures.

The PLD file has a suggested device type, though the actual device is set to virtual:



Edit the "Device virtual;" line in the source code to replace 'virtual' with the suggested device type, or whatever other device you are intending to use. Atmel's documentation lists which devices are supported by WinCUPL.

Now try a device dependant compile again and see what happens (Run > Device Dependant Compile or F9).

If compilation is successful, you will now have a JEDEC fusemap with the same filename as your project's name with a .JED extension, located in the same directory as your project files. This directory is printed in the title of the source code pane of WinCUPL, and is 'c:\wincupl\wincupl\rom1.jed' in my example screenshots. The .JED file can be programmed directly to a GAL16V8 part.

Verifying the replacement

I would strongly recommend dumping the replacement PAL you made and compare the new dump to the original device dump. You can do this in DOS by typing:

fc /b oldfile.bin newfile.bin
It will tell you if the files are identical or not. If not, then your replacement is not working identically to the original device and something is wrong.
This is important as an imporoperly programmed PAL could damage the circuit it's plugged into. The PAL analysis board can handle any type of PAL programming so it will always be safe to read a PAL in it for verification.


Troubleshooting

"Error: No devices attached."

Check the following:

Ensure the DC power supply is plugged into an outlet, and the other end is plugged into the PAL analysis board.
Ensure the red power LED is lit when power is applied. If it isn't, check your power connections again.
Ensure the USB cable is connected between the PAL analysis board and your PC.
If you continue to get this error message, you will need to verify that Windows has recognized the device.
Download the USBView utility from this page:
http://www.ftdichip.com/Resources/Utilities.htm
Run USBView and look for an entry called "USB Composite Device" which has an idVendor field set to Future Technology Devices International Limited


If you can't find it listed, you should uninstall and reinstall the FTDI device driver.


Revision 3 Fix

This modification allows the PIC to inhibit switching until enumeration has completed. Please read all of the steps first before attemping the modification.

1.) Solder side: Cut the following trace going to pin 6 of the PIC chip socket. Use a multimeter to verify the connection has been severed.

2.) Solder side: Solder a wire between pin 16 of the 40-pin USB module socket and pin 6 of the 8-pin PIC socket.

3.) Component side: Remove resistor R2. We will reuse it in the next step, or you can simply get a new 4.7K ohm, 1/8 watt resistor to replace it.

4.) Solder side: Solder one lead of resistor R2 to the circled point.

5.) Solder side: Solder the other lead to any +5V point. This includes the area that is circled or anywhere along the vertical track that is boxed.

Be extra careful that the leads of the resistor do not touch anything else.
You could place electrical tape underneath the resistor or use heat shrink tubing or an insulating sleeve on the leads to keep them from touching other exposed tracks underneath it.

6.) Reprogram the PIC12F675 with the new firmware (main.hex):

pic-rev3a.zip
The current utility program (pd-rev3.exe) will work with the modified hardware.

Hi....Where do i locate the informations for constructing the v3 pal-reader please ?

pic-rev3a.zip (9 downloads)
images.rar (8 downloads)

But in this archive is only firmware. Where I can find schematic, PCB design and pd-rev3.exe software?

This is all what we have, and were able to copy/save, now the site is gone... if you find somewhere else these files let us know, so we can add them here.

TS

Well I found design files and software for revisions 1 and 2 of this reader. They are still available at Wayback Machine: Link. I also asked author for files of revision 3, maybe he will answer.

Well done !!! Please yes, if you get more we will with pleasure update the topic. Attached the file directly to this post as well.

Admin

Hi !

Mail to him send but...no respond, it's shame.

We can find a most complet version here :
https://web.archive.org/web/20110807044645/http://cgfm2.emuviews.com/old2010.php

The schema of rev1 version :

Schema Rev1


TOP


BOTTOM


SILK

https://fjkraan.home.xs4all.nl/digaud/arduino/ppread/palread.html

Sanguino based PAL reader

PAL shield

Inspired by the interesting blog of Chuck Guzis on reading and analysing PALs and HALs, I created this shield for my Sanguino board and some software (sketches in Arduino speak) to read some PALs I have.

The goal is to create a sketch for each type of HAL/PAL that results in a file that can be analysed, manually or by some smart program. Currently only the first part is being developed.

As HAL and PAL devices vary wildly in their pinout, no shield with a socket is used. Instead I use an experimenters board and a flatcable terminated with compatible pins. This means that for every type of PAL the reader has to be rewired, but for low volumes this is acceptible. It is also allows easy rearrangement of the pins.

PAL being read

Created so far are these sketches. Each sketch contains a rudimentary description of how the pins should be wired and the signals interpreted. The output is in text-binary (0s & 1s) format.

An example:

GAL16V8 read v1.1
B0, B1, B2, B3, B4, B5, B6, B7, A0, A1, C0, C1, C2, C3, C4, C5, C6, C7
1 2 3 4 5 6 7 8 9 11 12 13 14 15 16 17 18 19
IIN,IOUT,IA0,IA1,IA2,IA3,IA4,IA5,IA6,IA7,OACT,OC0R,OC1R,OC1W,OC2R,OC8FCS,ODBDR,O0

A0-A1,B0-B7 C0-C7
0000000000 1111111
0000000001 1111111
0000000010 1111111
0000000011 1111111
...
skipping some uninteresing stuff
...
1011111100 1111111
1011111101 1111111
1011111110 1111111
1011111111 1111111
1100000000 0111100
1100000001 1111111
1100000010 0111100
1100000011 1111111
1100000100 0110010
1100000101 1110110
1100000110 0111010
1100000111 1111111
1100001000 0101110
1100001001 1111111
1100001010 0101110
1100001011 1111111
1100001100 1111111
...
Tri-state detection

Quite a lot of PALs have tri-state capable pins. To detect this, two pins of the microcontroller are used, as shown on the diagram, one as output, one as input.

detecting tristate pins

By measuring the level at the PAL pin, both when pushing it high and pulling it low, a tri-state can be detected. If the pin follows the output, it is tri-state. If it remains stuck at one level it is an output. The PAL16R6 sketch has the tri-state detection. The current program does not try to detect the state itself, it just prints both levels. Note the difference between a tri-state output or 'buried' output pin and a input pin cannot be detected. Only if the analysis finds more terms are needed to describe the behaviour than would fit inside the PAL, some 'buried' outputs should be assumed.

Registered pins

Even some of the older PALs have pins that clocks a value in a register. For the PAL16R6 this happens on the transition from low to high. Every combination for the other input pins has to be checked in this order. Note it is not simple to find matching terms for registered PALs which also use 'buried' outputs.

Using this method to crack PAL based dongles is probably a waste of time.

Sketches completed

Source for reading the DMPAL16C1 Not tested yet, as I do not have a loose PAL yet. Planned soon.
Source for reading the GAL16V8 Just for testing, I programmed this one myself. It attempts to implement address decoding for the Tandy TRS-80 harddisk interface to a WD1002/HD0.
Source for reading the MMI PAL16R6 This PAL has six registered outputs and two pins that can be both input and output (tri-state). For both provisions have been made in the software and hardware.
Additional remarks:

No handshake on the serial line is implemented, hardware or software, so not all capture software works properly. The Arduino IDE monitor sometimes looses data. I find a specialised terminal program, like minicom (using Linux) is much more reliable. As all lines should have the same length, it is easy to spot if data has been lost.
Having now a workable version of the hardware and software, I am looking for the best way to present data. Binary looks ok and is relatively easy to check, but may not be 'compatible' with existing analysing software.

Last update: 2012-09-17

e-mail fjkraan@xs4all.nl

-----------------

https://fjkraan.home.xs4all.nl/digaud/arduino/ppread/index.html

This board is my implementation of the Sanguino an Arduino compatible platform based in the Atmel AT Mega (AVR) range of microcontrollers.

There is no standard PCB for the Sanguino, so I made it with some modifications.

The headers copy all usable pins one for one, so the chip pin layout is reflected in the headers
A USB-serial converter makes a direct interface with the Arduino IDE possible, so it is programmed just as a normal Arduino board, provided the Sanguino library is added to the IDE.
An voltage converter steps the USB voltage up to 5 V, so no external power supply is needed.
The projects realised are listed below. It is not my intention to build a complete multi-programmer out of this, although it is possible. Merely I want to be able to read and analyse old devices for better understanding and maybe replication (using more modern devices and separate programmers).

- PROM reader https://fjkraan.home.xs4all.nl/digaud/arduino/ppread/promread.html

- PAL reader
https://fjkraan.home.xs4all.nl/digaud/arduino/ppread/palread.html

Yes, Sanguino project exist (already tested), not complete enough.
For example, don't work with Tristate.

We made (with a friend), a STM32 version (with BluePill).
We manage the tri-state.
No distribution is planned for now, the script is being stabilized.
Need more tests with timing/probe pin on PAL chipset.