Reading Secured PALs

Table of Contents


Quick Start

  1. Construct an adapter to read a 20-pin PAL (such as PAL16L8) as a 27C020 EPROM in a device programmer.
  2. Analyze binary image from device programmer with analysis software which produces HDL (CUPL) output.
  3. Minimize boolean equations in CUPL source by hand or with a dedicated logic minimization tool (WinCUPL, ISP Lever, Logic Friday, etc.)
  4. Modify CUPL source to target a replacement device (e.g. Lattice GAL16V8) and compile it to produce a JEDEC fusemap.
  5. Program a blank device with the fusemap to make a replacement for the original PAL.
  6. Test the device to verify replacement functions correctly.


Overview

20-pin devices from the PAL and GAL family have a security bit to prevent duplication. The fusemap can be reconstructed by logging the outputs for all possible input combinations and analyzing the results. This allows a fusemap to be produced which is logically equivalent to the original device.


Limitations

This approach does not work for the following devices:

  • All registered PAL devices. (PAL16R4, PAL16R6, PAL16R8, etc.)
  • All GAL devices configured to be registered. (GAL16V8, etc.)
  • PEEL devices (18CV8, etc.) which have a different architecture than PALs/GALs.
  • Non-PAL or GAL devices (82S153, PLS153, etc.) which have a different architecture and pinout than PALs/GALs.

In general all registered devices cannot be dumped, which includes purely combinatorial devices that implement latches through combinational logic.

Specific limitations for GAL16V8

A GAL16V8 can be configured as combinatorial, registered, or mixed. Only purely combinatorial configurations can be dumped. To aid in identifying a registered configuration you may note that pin 11 (OE#) is tied to ground and pin 1 (CLK) is tied to a clock source or write strobe. However these types of connections are not reliable indicators of a registered configuration.


Adapter overview

To construct the adapter you need:
  • Eight 4.7KΩ resistors (1/8W or more, tolerance is irrelevant).
  • 32-pin DIP socket, .600", to fit in device programmer.
    Some people like using square pin headers instead.
  • 20-pin DIP socket, .300", to place PAL into (consider using a ZIF socket).

The wiring must be kept as short as possible.

The effectiveness of the adapter depends your device programmer which introduces some uncertainty into reading a PAL. There is no way to guarantee success when using the adapter. Some people have had luck trying the adapter with several different device programmers to find a combination that works.

Device programmer Works?
Xeltek SuperPro 280U Yes
Elnec BeeProg 2 No
EETools ChipMax2 No
TL866CS, TL866CS/A Yes
GQ-4X Yes
Wellon VP-390 No
BP Micro 1400 Yes
BK Precision 865 Yes

Downloads


Analysis software

Running the executable (pa.exe) from the command line shows the following output:

usage: pa  [-options]
Available options:
-force      : Force processing of registered PAL dumps.
-alloe      : Force OE equations to be listed for all pins.
-polarity   : Use specified bitmask to force output polarity.
-oepolarity : Use specified bitmask to force output enable polarity.
-ignore     : Use specified bitmask to ignore processing outputs.
-signal     : Specify user-supplied pin names.
-verbose    : Print informational messages.

Type `pa help <option>' for more information on that option.
Results are written to stdout.

For example assuming you have binary output called "paldata.bin" from your device programmer. You can analyze it by typing:

pa paldata.bin > paldata.txt
... and the CUPL output will be written to "paldata.txt". The output is intended for use with Atmel WinCUPL so you may have to edit the source to use it with other HDL software or minimization tools.


Minimization software


Support and Assistance

It is your responsibility to have sufficient knowledge in digital design and electronics to understand the concepts involved in reading a PAL and making a replacement for it.
Nobody will do this work for you, you must learn how to do it yourself. I do not provide technical support for reading PALs.

I used to sell dedicated PAL reading devices that solved several issues associated with the adapter method. However the demand for support and assistance was too much for a hobby project so I stopped doing that. Please don't contact me about this. The adapter method is sufficient for most cases.

All content (C) 2017 Charles MacDonald