1616 PAL reverse engineering

A project log for Applix 1616 Documentation

OCRd and typeset as html where possible. A work in progress.

keithKeith 10/22/2023 at 00:170 Comments

These devices are the only things standing in the way of the 1616 being a fully open source design.

Alas they had their security bits programmed, and the designers have lost the original source files.

From the circuit diagram, we can read the functions and the signal directions.

ChipTester V2 Pro says it analyses registered PAL chips. Yes it does, but only in the same way as it analyses combinatorial chips. Cefiar's binary files have 256 identical bytes, which suggests it did not do any clocking at all. The results are effectively useless.

What is needed

... is a gadget to apply clocked test sequences and examine the results. If one knows nothing about a PAL, one has to apply very many test sequences and a great deal of analysis. I think I recall someone trying to do this with a fairly powerful microcontroller, and eventually concluding it would need something based on an FPGA to do it fast enough.

If one knows something about the PAL, such as the input and output pin functions, one can make intelligent guesses and cut down the work greatly.

Parallel testing

One way to test if two chips work the same (without damaging the host board) is to run them in parallel with the same input signals, and then compare their output signals. This requires building a PCB that holds both chips and plugs into the original socket. Comparison can be done visually by comparing scope traces, or XOR gates. The latter will have many fine glitches but at least show how much outputs differ.

This will be a slow process if PALs are shipped from the UK to Australia.

An alternative is to ship a GAL programmer and email test patterns for the recipient to program and test.