+dhe Posted January 22, 2023 Share Posted January 22, 2023 Peak reverse engineering? https://github.com/DuPAL-PAL-DUmper/DuPAL_Board The DuPAL board is a simple circuit that mounts an AVR MCU (A classic ATmega328P of Arduino fame), three 74HC595 SIPO registers, one 74HCT166 PISO register, a MAX232 to adapt the serial port to RS232, a linear voltage regulator and a bunch of other passive components. This board was designed and built to help myself bruteforce PAL devices. It has the hardware facilities necessary to scan all the inputs of the PAL, to check whether an output is high, low or hi-z and to report back the status to the host. Details on how the features are implemented can be found on the Firmware's repository. 1 Quote Link to comment Share on other sites More sharing options...
RickyDean Posted October 18, 2023 Share Posted October 18, 2023 (edited) @Fritz442 , I have a question. I have purchased some ATF16V8C-7PU DIPs from Digikey, to try to use in place of the PALs on the Corcomp controller. I have the wd2793a version, and I tried to burn the Corcomp_DSDD_FDC_U2_w-2793_(DCCU2)_GAL.JED onto the ATF16V8C, as first as a ATF16VB, since my Minipro does not have the 16V8C in the list, then as a GAL16v8a, but neither is giving me a usable chip. What might I be doing wrong Edited October 18, 2023 by RickyDean subtracting content Quote Link to comment Share on other sites More sharing options...
Fritz442 Posted October 18, 2023 Author Share Posted October 18, 2023 (edited) 17 hours ago, RickyDean said: @Fritz442 , I have a question. I have purchased some ATF16V8C-7PU DIPs from Digikey, to try to use in place of the PALs on the Corcomp controller. I have the wd2793a version, and I tried to burn the Corcomp_DSDD_FDC_U2_w-2793_(DCCU2)_GAL.JED onto the ATF16V8C, as first as a ATF16VB, since my Minipro does not have the 16V8C in the list, then as a GAL16v8a, but neither is giving me a usable chip. What might I be doing wrong Atmel ATF16V8C simple mode PAL device emulation/PAL replacement. In the simple mode, eight product terms are allocated to the sum term. Pins 15 and 16 (center macrocells) are permanently configured as combinatorial outputs. Other macrocells can be either inputs or combinatorial outputs with pin feedback to the AND-array. Pins 1 and 11 are regular inputs. The compiler selects this mode when all outputs are combinatorial without OE control. The following simple PALs can be emulated using this mode: 10L8 10H8 10P8 "12L6" 12H6 12P6 14L4 14H4 14P4 16L2 16H2 16P2. So it should work? But I've never used a Minipro. It might be the A,B,C thing but I'm not sure. Tonight I can burn my 16V8B's as A or C and see if they work. Let me do some checking Edited October 18, 2023 by Fritz442 Quote Link to comment Share on other sites More sharing options...
RickyDean Posted October 18, 2023 Share Posted October 18, 2023 1 hour ago, Fritz442 said: Atmel ATF16V8C simple mode PAL device emulation/PAL replacement. In the simple mode, eight product terms are allocated to the sum term. Pins 15 and 16 (center macrocells) are permanently configured as combinatorial outputs. Other macrocells can be either inputs or combinatorial outputs with pin feedback to the AND-array. Pins 1 and 11 are regular inputs. The compiler selects this mode when all outputs are combinatorial without OE control. The following simple PALs can be emulated using this mode: 10L8 10H8 10P8 "12L6" 12H6 12P6 14L4 14H4 14P4 16L2 16H2 16P2. So it should work? But I've never used a Minipro. It might be the A,B,C thing but I'm not sure. Tonight I can burn my 16V8B's as A or C and see if they work. Let me do some checking Thanks, understood. Here's a screen shot of the Minipro with a ATF16V8 selected. On this older model this is what I have. There are no more updates for this Model TL866. Quote Link to comment Share on other sites More sharing options...
Fritz442 Posted October 18, 2023 Author Share Posted October 18, 2023 (edited) 1 hour ago, RickyDean said: Thanks, understood. Here's a screen shot of the Minipro with a ATF16V8 selected. On this older model this is what I have. There are no more updates for this Model TL866. If this is after you program the chip, you need to not lock "encrypt ch" to be able to read it back out. Edited October 18, 2023 by Fritz442 Quote Link to comment Share on other sites More sharing options...
RickyDean Posted October 18, 2023 Share Posted October 18, 2023 16 minutes ago, Fritz442 said: If this is after you program the chip, you need to not lock "encrypt ch" to be able to read it back out. Okay, I'll give that a try soon. Thanks Quote Link to comment Share on other sites More sharing options...
RickyDean Posted October 18, 2023 Share Posted October 18, 2023 38 minutes ago, Fritz442 said: If this is after you program the chip, you need to not lock "encrypt ch" to be able to read it back out. Okay I unchecked the "encrypt ch box, then also unchecked the lock box before programming the chip. When I tried it in the working corcomp, I get a cyan screen, nothing else. I then read the chip in and used WinMerge to compare the two jeds. had differences shown below. Maybe this will shed light on what I'm doing wrong? I am including the saved JED here so you can look at it. The steps I take are: 1. Open the Corcomp_DSDD_FDC_U2_w-2793_(DCCU2)_GAL.JED file. 2. Place the ATF chip in the Minipro and lock it in place. 3. uncheck "encrypt ch". 4. Hit P, then when the dialog box appears, I uncheck the lock bit box. 5. Hit program, let it do its thing. 6. "Read" the chip, then save it for this comparison. corcomp u2 jed.JED 1 Quote Link to comment Share on other sites More sharing options...
Fritz442 Posted October 18, 2023 Author Share Posted October 18, 2023 (edited) 2 hours ago, RickyDean said: Okay I unchecked the "encrypt ch box, then also unchecked the lock box before programming the chip. When I tried it in the working corcomp, I get a cyan screen, nothing else. I then read the chip in and used WinMerge to compare the two jeds. had differences shown below. Maybe this will shed light on what I'm doing wrong? I am including the saved JED here so you can look at it. The steps I take are: 1. Open the Corcomp_DSDD_FDC_U2_w-2793_(DCCU2)_GAL.JED file. 2. Place the ATF chip in the Minipro and lock it in place. 3. uncheck "encrypt ch". 4. Hit P, then when the dialog box appears, I uncheck the lock bit box. 5. Hit program, let it do its thing. 6. "Read" the chip, then save it for this comparison. corcomp u2 jed.JED 2.95 kB · 2 downloads Ok, I took your 'corcomp u2 jed.jed' file and burned it to a Lattice GAL16V8D chip and installed it on my CC at U2, and it works fine. So the data file is correct. Your file is just separated line by line instead of clusters of 8 sections together, here is your file back and you'll see it's the same. So this must be a chip issue or a different version of the board. Can you post a pic of that board? Also are both your boards the same? EDIT: I just burned your file to my GAL16V8D on my T56, as a GAL16V8A, GAL16V8B, GAL16V8C, GAL16V8D and all worked fine, there is also a GAL16V8 <--with no letter-the TI booted normally, but the card did not work, Disk Manager error No disk drive(0). corcomp u2 jed.JED_returned.jed Edited October 18, 2023 by Fritz442 Quote Link to comment Share on other sites More sharing options...
RickyDean Posted October 18, 2023 Share Posted October 18, 2023 (edited) 1 hour ago, Fritz442 said: Ok, I took your 'corcomp u2 jed.jed' file and burned it to a Lattice GAL16V8D chip and installed it on my CC at U2, and it works fine. So the data file is correct. Your file is just separated line by line instead of clusters of 8 sections together, here is your file back and you'll see it's the same. So this must be a chip issue or a different version of the board. Can you post a pic of that board? Also are both your boards the same? corcomp u2 jed.JED_returned.jed 2.88 kB · 0 downloads @Fritz442 the post at https://forums.atariage.com/topic/246297-corcomp-9900-disk-controller-problems/?do=findComment&comment=3854864 has photos of both my Corcomp FDC's. I did burn your file and tried it, but the same result. Edited October 19, 2023 by RickyDean Quote Link to comment Share on other sites More sharing options...
Fritz442 Posted October 18, 2023 Author Share Posted October 18, 2023 4 minutes ago, RickyDean said: @Fritz442 the post at https://forums.atariage.com/topic/246297-corcomp-9900-disk-controller-problems/?do=findComment&comment=3854864 has photos of both my Corcomp FDC's. Yeah I was looking for that post but could not find it, that is the exact card I have. Just asking, since the boards are not marked, you are placing U2 at the bottom socket near the peb connector? Quote Link to comment Share on other sites More sharing options...
RickyDean Posted October 19, 2023 Share Posted October 19, 2023 (edited) 5 minutes ago, Fritz442 said: Yeah I was looking for that post but could not find it, that is the exact card I have. Just asking, since the boards are not marked, you are placing U2 at the bottom socket near the peb connector? Yes, on my working board to test it. But it just boots to a cyan blank screen. When I reinstall my original for that controller it boots up fine. Maybe I should just purchase GAL's and try them? Edited October 19, 2023 by RickyDean added content Quote Link to comment Share on other sites More sharing options...
Fritz442 Posted October 19, 2023 Author Share Posted October 19, 2023 (edited) 26 minutes ago, RickyDean said: Yes, on my working board to test it. But it just boots to a cyan blank screen. When I reinstall my original for that controller it boots up fine. Maybe I should just purchase GAL's and try them? Yeah, I've had zero issues with the Lattice chips GAL16V8D-15LP and 25LP, and my T56 can burn all five variants of this one. Edited October 19, 2023 by Fritz442 Quote Link to comment Share on other sites More sharing options...
RickyDean Posted October 19, 2023 Share Posted October 19, 2023 1 minute ago, Fritz442 said: Yeah, I've had zero issues with the Lattice chips, and my T56 can burn all five variants of this one. I just tried burning it as a Gal16V8a, but the same lock up. I will try to order some GAL's in and then we'll see. GAL' can be erased correct? Quote Link to comment Share on other sites More sharing options...
Fritz442 Posted October 19, 2023 Author Share Posted October 19, 2023 (edited) 18 minutes ago, RickyDean said: I just tried burning it as a Gal16V8a, but the same lock up. I will try to order some GAL's in and then we'll see. GAL' can be erased correct? Oh yes, over and over. I think I read somewhere about 100 times. From the GAL16V8D datasheet, "Unique test circuitry and reprogrammable cells allow complete AC, DC, and functional testing during manufacture. As a result, Lattice Semiconductor delivers 100% field programmability and functionality of all GAL products. In addition, 100 erase/write cycles and data retention in excess of 20 years are specified." Edited October 19, 2023 by Fritz442 3 Quote Link to comment Share on other sites More sharing options...
RickyDean Posted October 22, 2023 Share Posted October 22, 2023 @Fritz442Well, I got in my Gal's and have tried programming both variants, they both give me a locked up screen when I try to fire up the TI with them plugged into U2 on the FDC. Maybe it's my programmer, but you did check my file I sent. So its doing something right. I even tried on the other Corcomp FDC that has the damaged PAL's to burn both of yours and plug them into U1 and U2 to see if it came up. It did but only with a TI screen, The FDC wasn't being seen, no light, nothing. Any suggestions? I have an old mod-emup-a universal programmer that @dhe graciously gave me awhile back. I have to get an old Isa PC running to try that, and it burns both Pal's and Gal's I believe, but that's not work I wanted to do at this time. Quote Link to comment Share on other sites More sharing options...
Fritz442 Posted October 22, 2023 Author Share Posted October 22, 2023 (edited) 8 hours ago, RickyDean said: @Fritz442Well, I got in my Gal's and have tried programming both variants, they both give me a locked up screen when I try to fire up the TI with them plugged into U2 on the FDC. Maybe it's my programmer, but you did check my file I sent. So its doing something right. I even tried on the other Corcomp FDC that has the damaged PAL's to burn both of yours and plug them into U1 and U2 to see if it came up. It did but only with a TI screen, The FDC wasn't being seen, no light, nothing. Any suggestions? I have an old mod-emup-a universal programmer that @dhe graciously gave me awhile back. I have to get an old Isa PC running to try that, and it burns both Pal's and Gal's I believe, but that's not work I wanted to do at this time. I can burn both GAL's and test them and send them to you. PM me. Edited October 22, 2023 by Fritz442 1 Quote Link to comment Share on other sites More sharing options...
+acadiel Posted December 22, 2023 Share Posted December 22, 2023 Precompiled firmware for DuPAL: https://github.com/hexbus/DuPAL_PAL_precompiled_fw/tree/main 5 Quote Link to comment Share on other sites More sharing options...
+dhe Posted December 22, 2023 Share Posted December 22, 2023 Thanks for the assist @acadiel You got to love a github (DuPal's) that starts off with "Don't expect no hand holding here." Wow.. Ok. Glad we got that out of the way! 😃 2 Quote Link to comment Share on other sites More sharing options...
RickyDean Posted January 20 Share Posted January 20 I asked @Fritz442 to decode one of my Myarc Geneve video PAL IC's, and here are the resulting PAL and GAL jedec files that he sent me. The GAL file has been burned to a Lattice GAL16V8D-15LP and works great on the two working Geneve's I have. One of them has a V9938 and the other using a Tang 20k as a vdp substitute. This is the standard video PAL for the Geneve as the Turbo Video PAL has been released in another thread. I tested in each graphic mode on both systems, running Memetest, Kalidescope, and Myart loading several pictures on each one, HDRAGON, HWOLF, AND HUNICORN. they all loaded without issues. I let the Kalidescope program run for about 20 minutes on each machine. Thanks you Doug for these, appreciate your hard work, sir. Myarc_Geneve_9640_Video_PWB_EW001_U202_GAL.JED Myarc_Geneve_9640_Video_PWB_EW001_U202_PAL.JED 4 Quote Link to comment Share on other sites More sharing options...
+mizapf Posted January 20 Share Posted January 20 Is there an easy way to decode this into equations? Quote Link to comment Share on other sites More sharing options...
RickyDean Posted January 20 Share Posted January 20 (edited) 14 minutes ago, mizapf said: Is there an easy way to decode this into equations? You may be able to use Jed2eqn http://www.brouhaha.com/~eric/retrocomputing/mmi/palasm/ to do this? I think @Fritz442 has used this? Someone posted the pal.circ file here on atatiage a couple of weeks ago, but I didn't find away to convert that to the jed yet, that's why I asked Fritz442 to decode the pal for me. Edited January 20 by RickyDean spelling, added content Quote Link to comment Share on other sites More sharing options...
+mizapf Posted January 20 Share Posted January 20 Funnily, I found JED2EQN in my DOSBOX directory. I obviously used that some time. The Geneve PAL: ; JED2EQN -- JEDEC file to Boolean Equations disassembler (Version V063) ; Copyright (c) National Semiconductor Corporation 1990-1993 ; Disassembled from genevep.jed. Date: 1-20-124 chip genevep PAL16R4 CLK=1 i2=2 i3=3 i4=4 i5=5 i6=6 i7=7 i8=8 i9=9 GND=10 /OE=11 o12=12 o13=13 rf14=14 rf15=15 rf16=16 rf17=17 o18=18 i19=19 VCC=20 equations /o18 = i4 * rf14 * i9 + i4 * rf15 * i9 + i4 * rf16 * i9 + i4 * rf17 * i9 + /i3 * /i9 + /i3 * /i4 o18.oe = vcc /rf17 := /i19 * i3 * /rf16 * /rf15 * /rf14 + i3 * i4 * /rf16 * /rf15 * /rf14 * i9 + i4 * rf17 * rf16 * i9 + i4 * rf17 * rf15 * i9 + /i19 * rf17 * rf14 + /i19 * rf17 * rf15 + i4 * rf17 * rf14 * i9 + /i19 * rf17 * rf16 rf17.oe = OE /rf16 := i4 * /rf17 * rf16 * i9 + i4 * /rf16 * /rf15 * /rf14 * i9 + i4 * rf17 * /rf16 * i9 + /i19 rf16.oe = OE /rf15 := i4 * /rf17 * /rf16 * rf15 * i9 + i4 * rf17 * /rf15 * i9 + i4 * /rf16 * /rf15 * /rf14 * i9 + i4 * rf16 * /rf15 * i9 + /i19 rf15.oe = OE /rf14 := i4 * /rf17 * /rf16 * /rf15 * i9 + i4 * /rf14 * i9 + /i19 rf14.oe = OE /o13 = i5 * /i8 + /i5 * /i6 o13.oe = vcc /o12 = /i2 * /i7 o12.oe = vcc 3 Quote Link to comment Share on other sites More sharing options...
atrax27407 Posted January 20 Share Posted January 20 Here is a series of PAL-GAL crossreference tables that might be of interest to programmers. Lattice GAL Cross Reference.pdf LATTICE GALs Discontinued.pdf PAL Cross Reference.pdf 4 Quote Link to comment Share on other sites More sharing options...
Fritz442 Posted January 24 Author Share Posted January 24 (edited) Just updated zip files, decoded all thru the DuPAL and added the following Jedec's: Corcomp_256k-512k_Memory_Plus_U24_(MP3C)_PAL.JED Corcomp_256k-512k_Memory_Plus_U25_(MP2C)_PAL.JED Myarc_Geneve_9640_Video_PWB_EW001_U202_PAL.JED Myarc_Geneve_9640_TURBO_Video_PWB_EW001_U202_PAL.JED DataBioTics_TI-Workshop_16R4_PAL.JED Rave99_Speech_Adapter_SPA-01_U1_TI994A_GAL.JED Edited January 24 by Fritz442 1 3 Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.