+acadiel Posted March 13, 2022 Share Posted March 13, 2022 I'm recreating the floppy board for the 9900 Micro Expansion system right now since a lot of folks have the unit without the disk controller. It'll be open sourced and placed on Github when I'm done. (Anyone know where Mike Norton is if he's still with us?) Has anyone had luck in dumping the PALs? I suppose we can either brute force them with some sort of Arduino program to grab the equations or experiment and figure out all the combinations. There's three PALs on the disk controller board. My 844USB nor my TL866 can't read nor program anything that old (it prefers current stuff like the GAL16 and GAL20 chips.) Signetics PLS153N PAL Signetics PLS153N PAL Atmel AMPAL16R4APC PAL Anyway, here's the BOM for the 9900 MES disk board if anyone is curious. Corcomp 9900 PES Disk Controller BOM.pdf 8 1 Quote Link to comment Share on other sites More sharing options...
humeur Posted March 14, 2022 Share Posted March 14, 2022 On mine I have a pal 16l8 a 16r4 and only one Signetics PLS153N PAL . Written to disk A/2011 for the device Philips/Signetics PLS153 * F0* QF1842* QP20* L0 1111111111111110001111111111111111110000001000* L46 1111111111111011111111111111111111110000001000* L92 1111111111111111111011111111111111110000001000* L138 1111111111111111111110111111111111110000001000* L184 0101101001011111101011111111111111110100000000* L1564 0000000000000000111111111111111111111111111111* L1610 1111110000000000000000000000000000000000000000* L1748 0000000000001111111111111111111111111111111111* L1794 1100000000000000000000000000000000000001000010* L1840 00* C1D73* 0000 1 Quote Link to comment Share on other sites More sharing options...
+acadiel Posted March 14, 2022 Author Share Posted March 14, 2022 @humeur - Thanks. Here’s the MES disk board. The two 153’s are right under the 1773 and the AMPAL is directly to the left of the DRAM controller. (2nd row for all of them.) 2 Quote Link to comment Share on other sites More sharing options...
+Ksarul Posted March 14, 2022 Share Posted March 14, 2022 Based on the schematic, U9 is a 16L8. I suspect that the 153 is a suitable sub here. U10 is supposed to be a 12L6, and again, I suspect they used the 153 as a suitable sub. Both of these are part of the disk controller circuitry on the board. U11 is identified as a 16R4, so there doesn't seem to be any substitution there. This one is for the 32K portion of the board. 3 Quote Link to comment Share on other sites More sharing options...
humeur Posted March 14, 2022 Share Posted March 14, 2022 (edited) On mine U11 is 16R4 U10 is 153 U9 16L8 but 16L8 is read protected, I have the eprom dump too but it's easier. I do not have the diagrams, it is difficult afterwards to know the inputs or outputs of the components. Edited March 14, 2022 by humeur Quote Link to comment Share on other sites More sharing options...
+acadiel Posted March 14, 2022 Author Share Posted March 14, 2022 6 hours ago, Ksarul said: Based on the schematic, U9 is a 16L8. I suspect that the 153 is a suitable sub here. U10 is supposed to be a 12L6, and again, I suspect they used the 153 as a suitable sub. Both of these are part of the disk controller circuitry on the board. U11 is identified as a 16R4, so there doesn't seem to be any substitution there. This one is for the 32K portion of the board. The PLS153 can handle #9, #12, and #19 as bidirectional, whereas the PAL16L8 is either an input or output. The same goes with the PAL12L6 - where some are dedicated I or O on the 12L6, they can be bidirectional on the PLS153. My guess is that CorComp programmed them like a 16L8 and a 12L6. Tried reading U9 as a variety of 16L8 devices in my PG4UW/844USB. A bunch gave a ID mismatch, but several claimed to have read it - with all 1's returned. Haven't tried the others yet - the first one wasn't encouraging. 1 Quote Link to comment Share on other sites More sharing options...
+Ksarul Posted March 15, 2022 Share Posted March 15, 2022 CorComp almost always set the lock bits on their PALs, so reading them won't return anything useful. You'll probably have to use the brute force method. 1 Quote Link to comment Share on other sites More sharing options...
humeur Posted March 15, 2022 Share Posted March 15, 2022 On 3/14/2022 at 1:58 PM, Ksarul said: Based on the schematic, U9 is a 16L8. I suspect that the 153 is a suitable sub here. U10 is supposed to be a 12L6, and again, I suspect they used the 153 as a suitable sub. Both of these are part of the disk controller circuitry on the board. U11 is identified as a 16R4, so there doesn't seem to be any substitution there. This one is for the 32K portion of the board. Jim Do you have the diagram by chance and is it possible to have it? Thank Jean Louis Quote Link to comment Share on other sites More sharing options...
+acadiel Posted March 15, 2022 Author Share Posted March 15, 2022 10 minutes ago, humeur said: Jim Do you have the diagram by chance and is it possible to have it? Thank Jean Louis They are in this message: 1 Quote Link to comment Share on other sites More sharing options...
+acadiel Posted March 15, 2022 Author Share Posted March 15, 2022 18 hours ago, Ksarul said: CorComp almost always set the lock bits on their PALs, so reading them won't return anything useful. You'll probably have to use the brute force method. From what I'm reading, PLS153 chips cannot be protected, so I just need to find a reader that will grab their equations. We just need to read out that 32K PAL chip somehow. Supposedly, I have a new programmer enroute that can handle the older chips (going to have to sell my old 844USB to help pay for it...lol), so I should be able to get dumps on the PLS153s soon if the programmer isn't backordered. I did find an adapter that I'm going to build that will "dump" the locked PAL by throwing all the input combinations at it - but will need to experiment to see if it actually works on my equipment. 1 Quote Link to comment Share on other sites More sharing options...
+dhe Posted March 15, 2022 Share Posted March 15, 2022 I'm reading this with interest, as I've just started learning about PALs and their ?cousins? GALs. It looks like output lines can be internally redirected to input lines. Also, it looks like you could build latches. So I could envision a situation where maybe Input lines 1 & 2 are high and that cause output line 1 to be high, but then it triggers a latch - so next time through input L1 and L2 go high - Output L1 goes low instead. That kind of thing - if possible would make brute force really hard? Quote Link to comment Share on other sites More sharing options...
humeur Posted March 16, 2022 Share Posted March 16, 2022 I redid some work on the pls153 here is info I have hardware that can read and write this type of hardware. just have to find the equations. Thank Jim j'ai trouver les schémas. PLS153 ! POL ! !------------! !HL!HHHH!LHHH! -------------------------+------------! T! I ! B(I) ! B(0) ! E!---------+------------+------------! R! ! ! ! ! ! ! ! ! M!7654!3210!98!7654!3210!98!7654!3210! --+----+----+--+----+----+--+----+----! 00!L---!----!--!----!----!AA!AAAA!.AAA! 01!-L--!----!--!----!----!AA!AAAA!.AAA! 02!----!----!--!----!--L-!AA!AAAA!.AAA! 03!----!----!--!----!-L--!AA!AAAA!.AAA! 04!--HH!LLHH!--!----!---L!A.!AAAA!AAAA! 05!OOOO!OOOO!OO!OOOO!OOOO!AA!AAAA!AAAA! 06!OOOO!OOOO!OO!OOOO!OOOO!AA!AAAA!AAAA! 07!OOOO!OOOO!OO!OOOO!OOOO!AA!AAAA!AAAA! 08!OOOO!OOOO!OO!OOOO!OOOO!AA!AAAA!AAAA! 09!OOOO!OOOO!OO!OOOO!OOOO!AA!AAAA!AAAA! 10!OOOO!OOOO!OO!OOOO!OOOO!AA!AAAA!AAAA! 11!OOOO!OOOO!OO!OOOO!OOOO!AA!AAAA!AAAA! 12!OOOO!OOOO!OO!OOOO!OOOO!AA!AAAA!AAAA! 13!OOOO!OOOO!OO!OOOO!OOOO!AA!AAAA!AAAA! 14!OOOO!OOOO!OO!OOOO!OOOO!AA!AAAA!AAAA! 15!OOOO!OOOO!OO!OOOO!OOOO!AA!AAAA!AAAA! 16!OOOO!OOOO!OO!OOOO!OOOO!AA!AAAA!AAAA! 17!OOOO!OOOO!OO!OOOO!OOOO!AA!AAAA!AAAA! 18!OOOO!OOOO!OO!OOOO!OOOO!AA!AAAA!AAAA! 19!OOOO!OOOO!OO!OOOO!OOOO!AA!AAAA!AAAA! 20!OOOO!OOOO!OO!OOOO!OOOO!AA!AAAA!AAAA! 21!OOOO!OOOO!OO!OOOO!OOOO!AA!AAAA!AAAA! 22!OOOO!OOOO!OO!OOOO!OOOO!AA!AAAA!AAAA! 23!OOOO!OOOO!OO!OOOO!OOOO!AA!AAAA!AAAA! 24!OOOO!OOOO!OO!OOOO!OOOO!AA!AAAA!AAAA! 25!OOOO!OOOO!OO!OOOO!OOOO!AA!AAAA!AAAA! 26!OOOO!OOOO!OO!OOOO!OOOO!AA!AAAA!AAAA! 27!OOOO!OOOO!OO!OOOO!OOOO!AA!AAAA!AAAA! 28!OOOO!OOOO!OO!OOOO!OOOO!AA!AAAA!AAAA! 29!OOOO!OOOO!OO!OOOO!OOOO!AA!AAAA!AAAA! 30!OOOO!OOOO!OO!OOOO!OOOO!AA!AAAA!AAAA! 31!OOOO!OOOO!OO!OOOO!OOOO!AA!AAAA!AAAA! D9!OOOO!OOOO!OO!OOOO!OOOO! D8!----!----!--!----!----! D7!OOOO!OOOO!OO!OOOO!OOOO! D6!OOOO!OOOO!OO!OOOO!OOOO! D5!OOOO!OOOO!OO!OOOO!OOOO! D4!OOOO!OOOO!OO!OOOO!OOOO! D3!----!----!--!----!----! D2!OOOO!OOOO!OO!OOOO!OOOO! D1!OOOO!OOOO!OO!OOOO!OOOO! D0!OOOO!OOOO!OO!OOOO!OOOO! and another jedec Files. Programmateurs universels MicroPross serie ROM5000/3000 Fichier JEDEC pour : PLS153 *L0000 1111111111111110111111111111111111110000 0010001111111111111011111111111111111111 1100000010001111111111111111111011111111 1111111100000010001111111111111111111110 1111111111111100000010000101101001011111 1011111111111111111101000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000011111111111111111111 1111111111111111000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 0000000000000000000000000000000000000000 1111111111111111111111111111111111110000 0000000000000000000000000000000001000010 00 *C1D73 *61A7 1 Quote Link to comment Share on other sites More sharing options...
humeur Posted March 16, 2022 Share Posted March 16, 2022 (edited) acadiel do you have a photo of the straps on the card so that I can compare with mine Edited March 16, 2022 by humeur error Quote Link to comment Share on other sites More sharing options...
+acadiel Posted March 16, 2022 Author Share Posted March 16, 2022 19 hours ago, dhe said: I'm reading this with interest, as I've just started learning about PALs and their ?cousins? GALs. It looks like output lines can be internally redirected to input lines. Also, it looks like you could build latches. So I could envision a situation where maybe Input lines 1 & 2 are high and that cause output line 1 to be high, but then it triggers a latch - so next time through input L1 and L2 go high - Output L1 goes low instead. That kind of thing - if possible would make brute force really hard? Yeah, I think the software that's used figures out all the possible combinations and simply distills the equations from those. I have a PCB coming in from OshPark that I'm going to build and try (supposedly) with my tL866. It reads the PAL like a 27C020, so the file size is 256K. Two programs then analyze the file in steps to distill it into a JEDEC file and/or convert it to a GAL format. The original write-up from the now defunct webpage is here. 1 1 Quote Link to comment Share on other sites More sharing options...
+acadiel Posted March 16, 2022 Author Share Posted March 16, 2022 1 hour ago, humeur said: acadiel do you have a photo of the straps on the card so that I can compare with mine Straps? Pretty much the entire card is pictured above - is there a part not visible that you need to see? Can you circle it so I can get a different angle? Quote Link to comment Share on other sites More sharing options...
humeur Posted March 16, 2022 Share Posted March 16, 2022 37 minutes ago, acadiel said: Yeah, I think the software that's used figures out all the possible combinations and simply distills the equations from those. I have a PCB coming in from OshPark that I'm going to build and try (supposedly) with my tL866. It reads the PAL like a 27C020, so the file size is 256K. Two programs then analyze the file in steps to distill it into a JEDEC file and/or convert it to a GAL format. The original write-up from the now defunct webpage is here. I know it doesn't work on every programmer. Quote Link to comment Share on other sites More sharing options...
+acadiel Posted March 16, 2022 Author Share Posted March 16, 2022 2 minutes ago, humeur said: I know it doesn't work on every programmer. Yep, check the link under "two programs then analyze..." above - it has a list. Quote Link to comment Share on other sites More sharing options...
humeur Posted March 16, 2022 Share Posted March 16, 2022 38 minutes ago, acadiel said: Straps? Pretty much the entire card is pictured above - is there a part not visible that you need to see? Can you circle it so I can get a different angle? Ok wire ( Strap) under my card wires (strap) are welded between the pals and various points of the card just to see if there is a difference between the components used Quote Link to comment Share on other sites More sharing options...
humeur Posted March 16, 2022 Share Posted March 16, 2022 1 minute ago, acadiel said: Yep, check the link under "two programs then analyze..." above - it has a list. I say this because I realize this assembly, and it is not so great as that. Quote Link to comment Share on other sites More sharing options...
+acadiel Posted March 16, 2022 Author Share Posted March 16, 2022 2 hours ago, humeur said: Ok wire ( Strap) under my card wires (strap) are welded between the pals and various points of the card just to see if there is a difference between the components used Gotcha. Here you go! Four wires appear to go to the left PLS153 and one to the right PLS153. They all appear to go to the 9901. There's also a wire between the right most 1416 RAM IC and goes to a via to the other side of the board - edit: it' goes to the sixth pin from the bottom on J1. 1 Quote Link to comment Share on other sites More sharing options...
+dhe Posted March 16, 2022 Share Posted March 16, 2022 Glad this video was saved! 6 Quote Link to comment Share on other sites More sharing options...
humeur Posted March 16, 2022 Share Posted March 16, 2022 31 minutes ago, acadiel said: Gotcha. Here you go! Four wires appear to go to the left PLS153 and one to the right PLS153. They all appear to go to the 9901. There's also a wire between the right most 1416 RAM IC and goes to a via to the other side of the board - edit: it' goes to the sixth pin from the bottom on J1. Good I have the same thing, now find the equation of the two 1 Quote Link to comment Share on other sites More sharing options...
+Ksarul Posted March 17, 2022 Share Posted March 17, 2022 7 hours ago, acadiel said: Yeah, I think the software that's used figures out all the possible combinations and simply distills the equations from those. I have a PCB coming in from OshPark that I'm going to build and try (supposedly) with my tL866. It reads the PAL like a 27C020, so the file size is 256K. Two programs then analyze the file in steps to distill it into a JEDEC file and/or convert it to a GAL format. The original write-up from the now defunct webpage is here. One important note: when I read the description on the linked webpage, it specifically noted that it wouldn't work with registered (R-type) PALS/GALS. The PAL for the memory section is a registered device. You should have no problems dissecting both of the PALs for the Disk Controller portion of the board, but the 16R4 may be a bit more difficult, unless his later updates cover that eventuality. Do note that the most recent version of the project is on Github. 1 Quote Link to comment Share on other sites More sharing options...
+acadiel Posted March 17, 2022 Author Share Posted March 17, 2022 2 hours ago, Ksarul said: One important note: when I read the description on the linked webpage, it specifically noted that it wouldn't work with registered (R-type) PALS/GALS. The PAL for the memory section is a registered device. You should have no problems dissecting both of the PALs for the Disk Controller portion of the board, but the 16R4 may be a bit more difficult, unless his later updates cover that eventuality. Do note that the most recent version of the project is on Github. Yep. I’m sure that they’ll eventually figure it out - it’s math, maybe incredibly hard to distill, but still math. I'm going to build this other board too, it operates differently and I'm hoping someone just puts a binary of the firmware somewhere to where I can just write it it from my programmer. If I can't find one, I'll pull it off the 328 when I get it programmed and put it here. The pro to the first one is that it supports being read as a standard 256K EPROM, which may be a lot easier to do if the PAL is on the supported list. Edit: I just ordered 5 from Smart-Prototyping (it's a new provider for me, but they appear to be pretty reasonable), so we will see how they do. I'll be glad to mail you one as soon as I get them in. Shenzhen is having a lockdown right now due to COVID (March 13th for about a week), and then I selected the 10 day option for DHL, so hopefully we'll see them here in 2-3 weeks. It was $20 compared to $63 at OshPark, so I'm not that much in a rush. 2 Quote Link to comment Share on other sites More sharing options...
humeur Posted March 18, 2022 Share Posted March 18, 2022 On 3/17/2022 at 3:49 AM, acadiel said: Yep. I’m sure that they’ll eventually figure it out - it’s math, maybe incredibly hard to distill, but still math. I'm going to build this other board too, it operates differently and I'm hoping someone just puts a binary of the firmware somewhere to where I can just write it it from my programmer. If I can't find one, I'll pull it off the 328 when I get it programmed and put it here. The pro to the first one is that it supports being read as a standard 256K EPROM, which may be a lot easier to do if the PAL is on the supported list. Edit: I just ordered 5 from Smart-Prototyping (it's a new provider for me, but they appear to be pretty reasonable), so we will see how they do. I'll be glad to mail you one as soon as I get them in. Shenzhen is having a lockdown right now due to COVID (March 13th for about a week), and then I selected the 10 day option for DHL, so hopefully we'll see them here in 2-3 weeks. It was $20 compared to $63 at OshPark, so I'm not that much in a rush. I also saw this project Du PAL - PAL Reversing Tools but I did not order with what is happening on our planet at the moment, everything becomes complicated Quote Link to comment Share on other sites More sharing options...
Like us on Facebook
Follow us on Twitter
AtariAge on Instagram
Watch us on YouTube
Chat on Discord
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.