• Please review our updated Terms and Rules here

Cloning a HAL/PAL, Part 11

Chuck(G)

25k Member
Joined
Jan 11, 2007
Messages
44,225
Location
Pacific Northwest, USA
This example details cloning the Creative Sound Blaster CT1350B U12 PAL. If you're just starting out on this thread, go to the start at Part 1.

Okay, so we've got a weird looking PAL "brute force" dump, that has 10 inputs and 8 outputs, but it doesn't work. In particular, we've noticed that the data from dumping the dupe doesn't match the original:

Code:
000000  A1 A9 B1 BB BB BB BB BB-A1 A9 B1 BB BB BB BB BB
...
008000  A1 A9 B1 BB BB BB BB BB-E1 E9 F1 FB FB FB FB FB
In particular, note that exactly half of the samples in the second 32K all have bit 6 set. This corresponds to pin 13 on the PAL and, a little tracing on the PCB shows that it's connected to pin A10 on the ISA connector, "IO Channel Ready". So now we know what kept the 5160 from booting--the system was kept in an "IO Busy" state, so nothing got started.

So what happens if the last 1024 bytes of the dump is used instead of the first? Here's the resulting Minilog output:

Code:
S = 0
T = G'
U = AHI'
V = F'H'I'
W = F'H'J'
X = A' + E'
Y = F'H'J' + F'H'I'
Z = F
Aha! Note that T (pin 13) is now dependent upon pin 4, which has been unused up to this point. Let's think about this--why does this happen only in the second 32K samples? Well, bit 15 of our sample counter is used to "nudge" (through a 1K resistor) pin 13 so that it can be determined if 13 is an input or an output pin. tt16l8 correctly spotted pin 13 as an output, but clearly, it's not your garden-variety output. In fact, the reason that we see the pin's true behavior only in the second 32K samples is because bit 15 in our counter is HIGH, and so pulls up pin 13.

If we were working in ancient TTL, we might conclude that this was an open-collector output, but the PAL16L8 doesn't have OC outputs. But it does have tri-state outputs. A little thinking indicates that pin 4 must be the tri-state enable and that the output from pin 13 is 0V when enabled. So where to get a logic 0?

Going back to the CT1350B, we notice that pins 7, 8, 9 and 10 of the PAL are connected together on the back side of the board. In other words, all three inputs are grounded--and that's where we can get our low logic level.

Twiddling the EQN file a bit gives us:
Code:
CHIP SB20 16V8

pin1=1 pin2=2 pin3=3 pin4=4 pin5=5 pin6=6 pin7=7 pin8=8 pin9=9 gnd=10
pin11=11 pin12=12 pin13=13 pin14=14 pin15=15 pin16=16 pin17=17
pin18=18 pin19=19 vcc=20

EQUATIONS

;  pin12 = nc
;	note that pin 7 8 and 9 are tied to gnd on the PAL socket

pin13.trst = /pin4
pin13 = pin7				; IO CH RDY/  tristated
/pin14 = pin11*pin3*/pin2		; CS/ for YM3812
/pin15 = /pin5*/pin3*/pin2		; CS/ for first SAA1099P
/pin16 = /pin5*/pin3*/pin1		; CS/ for second SAA1099P
/pin17 = /pin11 + /pin6			; U14, 74LS74, PS2
/pin18 = /pin5*/pin3*/pin1 + /pin5*/pin3*/pin2	 ; U14, D2
/pin19 = pin5				; U14, CLK2

And what do you know? The darned thing works.

For those who just want the programmer JEDEC file, I've attached it as SB20JED.ZIP.

With that done, let's try a harder case--the ROM address PAL for the Trantor T130B SCSI adapter.

View attachment SB20JED.ZIP
 
Wow!

I guess "never say never" really applied here :)

So what tools / devices does one need to create such a chip?
 
Not much, actually. I used a cheap Chinese TOP853 programmer (that will also do EPROMs and some µPs), but you could just as easily use a Willem programmer or even a Genius 540/840--or something much more costly.

And you need a bunch of GAL16V8 chips. Fortunately, you can recycle used ones, as they're erasable.
 
Back
Top