What's new
By:
Filters

Can someone school me on PALs and GALs?

twistedsymphony

twistedsymphony

Enlightened
Staff member
Immortal
Joined
Jul 21, 2015
Messages
11,663
Reaction score
13,084
Location
NH, USA
Several projects I've been following and even a few of my own recent projects have necessitated me getting a PAL made. I'd like to know more about what's actually going on in these and maybe get enough understanding so that I can work with them myself.

It's my understanding that a PAL/GAL etc. is just a custom logic array. This is what I THINK I understand so far, please let me know if any of this is wrong or misguided.

I'm guessing these are typically used to modify the data buses on the PCB so when ROM swapping say a CPS2 game you may need a different PAL because it will direct the data to different locations on the ROMs? (please let me know if this is correct). And that these are sometimes used as a form of security since the logic used can be difficult to extract and without it it can be difficult to determine how things are routed.

I'm also assuming that micro-controllers are usually used for this task? or does this vary?

Looking around MAME source I really don't see much mention of PALs specifically, sometimes if there is a PCB layout diagram the PAL will be identified but that seems to be it, unless there is some other term or name used that I'm not aware of, or maybe I'm looking in the wrong place? So how are these emulated in MAME? or is it simply not needed due to how the ROMs are mapped? If this is the case is it possible to modify a ROM set to work with a different PAL? (am I correct in assuming this is part of what is done with the ROMs on the multis)

Finally what is needed to build my own PAL/GALs? is there enough info in MAME to build them or do you have to rely on dumps/reverse engineered versions outside of MAME?

I realize there are a lot of questions here but in my search for answers I got even more questions than answers. Any info that can help better my understanding would be appreciated. :thumbup:
 
twistedsymphony said:
I'm also assuming that micro-controllers are usually used for this task? or does this vary?

Looking around MAME source I really don't see much mention of PALs specifically, sometimes if there is a PCB layout diagram the PAL will be identified but that seems to be it, unless there is some other term or name used that I'm not aware of, or maybe I'm looking in the wrong place? So how are these emulated in MAME? or is it simply not needed due to how the ROMs are mapped? If this is the case is it possible to modify a ROM set to work with a different PAL? (am I correct in assuming this is part of what is done with the ROMs on the multis)

Finally what is needed to build my own PAL/GALs? is there enough info in MAME to build them or do you have to rely on dumps/reverse engineered versions outside of MAME?

I realize there are a lot of questions here but in my search for answers I got even more questions than answers. Any info that can help better my understanding would be appreciated. :thumbup:
Click to expand...
I'm by no means an expert on this, so I may have some details wrong, anyho..

A PAL/GAL is not a micro-controller, and should not be thought of as such. They are are (one of?) the first iterations of programmable logic, like an FPGA, and a better mental image could be to think of them like a programmable 74 series logic chip. They hold a small 'program' which tells it how to behave, but this is not something that 'runs' sequentially like a program - but 'hard logic', like if input pin A is low, output pin B should be high.

AFAIK, you don't dump a GAL/PAL - but simply run all combinations of input and analyze the output to figure out how the logic works.

The 'source files' are .jed files, and you can use this with a fancy eprom programmer or dedicated GAL programmer.

Difference between a PAL and GAL, is that GAL can be erased and reprogrammed.

Some more info here:
http://www.armory.com/~rstevew/Public/Pgmrs/GAL/jedec.htm

And some info on how the CPS2 PAL3 chips work here:
http://wiki.pcbotaku.com/wiki/CPS2_PAL3#Version_F

A bunch of 'dumps' related to arcade by the good folks over at jammarcade.net
http://www.jammarcade.net/pal-dumps/
 
Last edited:
Just adding some information here, about complexity tier for these things:

PLD (Programmable Logic Device) = stuff like these PALs/GALs seen on CPS1/CPS2

CPLD (Complex Programmable Logic Device) = Stuff like smaller Altera, AMD, MMI, ACTEL and Xilinx chips (40 pins or bigger) used on prototypes and as protection on some arcade boards

FPGA (Field Programmable Gate Array) = Large programmable chips capable of integrating obscene amounts of logic in them including even custom micro processors, sound chips or even a video processor.
 
In order to understand how programmable logic parts work, it might be helpful to see an example what some logic source code looks like.

Here are the equations I reverse engineered from a Crystal System mobo which uses ATF16V8 (atmel brand GAL16V8). Code to be compiled with WinCUPL.

Code: 
/* Dedicated input pins */

pin 1 = I0;
pin 2 = I1;
pin 3 = I2;
pin 4 = I3;
pin 5 = I4;
pin 6 = I5;
pin 7 = I6;
pin 8 = I7;
pin 9 = I8;
pin 11 = I9;

/* Input and/or bidirectional pins */

pin 19 = B7;

/* Dedicated output pins */

pin 12 = B0;
pin 13 = B1;
pin 14 = B2;
pin 15 = B3;
pin 16 = B4;
pin 17 = B5;
pin 18 = B6;

/* Output and output enable equations */

B6 =  B7;
B5 =  I8;
B4 = !I0 & !I3 & !I4 & !I7;
!B3 = !I1 & !I2 & !I3 & !I4 & !I7 & !I9;
B2 =  I5 &  I6 &  I7;
!B1 = !I3 &  I4 & !I7 & !I9;
!B0 = 'b'0;


/* End */
Logic parts have truth tables; a definition of how outputs will change based on stimulus provided to input pins. The logic state of all output pins are defined through written equations which are then programmed to the chip.

The code above has a section for inputs, outputs, and equations (logic). Sections for input and output, assign the physical pin number to a port name. Equations are written boolean algebra using logical operators. (ie; AND, NOT, XOR)

20160107_102325.jpg

@invzim touched on the subject of how to 'dump' programmable logic. Here is a photo of an adapter that I built that is used in combination with software written by Charles MacDonald to solve logic from non-registered PAL/GAL devices. It is used with an EPROM programmer and read as 27C020 device in order to produce an output file that is technically all combinations of inputs and outputs toggled. It is not compatible with registered PAL/GAL devices, which for example use a clock source to drive the truth table (think state changes based on a counter value).

Also worth a mention is the inexpensive chinese programmer TL866 supports programming PAL/GAL/ATF devices.

Feel free to ask other questions about programmable logic parts, including CPLD/FPGA as well.
 
wow, I wish I knew about this stuff years ago, it would have been super beneficial for more than a few projects. I'm thinking back to a Sega Saturn to Xbox 360 controller adapter i built years ago using a PIC chip. I could have easily done that whole thing with a GAL and it probably would have been faster too.

I've got a Top3000 and a GQ-4X that I use for burning ROMs I'm hoping I can do at least GAL22V10 and GAL16V8 on them.

Are there limits to the length/complexity of the logic you can use? Also how do the fuses fall into this and how do you avoid blowing them when brute forcing the logic?
 
twistedsymphony said:
wow, I wish I knew about this stuff years ago, it would have been super beneficial for more than a few projects. I'm thinking back to a Sega Saturn to Xbox 360 controller adapter i built years ago using a PIC chip. I could have easily done that whole thing with a GAL and it probably would have been faster too.

I've got a Top3000 and a GQ-4X that I use for burning ROMs I'm hoping I can do at least GAL22V10 and GAL16V8 on them.

Are there limits to the length/complexity of the logic you can use? Also how do the fuses fall into this and how do you avoid blowing them when brute forcing the logic?
Click to expand...
Just a word from my experience, the Top3000 is picky but will program GAL16V8D. I've used them for CPS2 and such. However, half the time the programmer would mess them up. I finally tracked it down to it not liking the external power supply for GAL chips. I use it for larger EPROMS and never thought twice about it, but since I switched to USB power only for GAL chips they've programmed fine every time. YMMV.
 
yeah from what I was reading it was flaky on GALs... my GQ-4X is flaky on everything else though .... I'm surprised no one has been able to make a cheap, reliable programmer for arcade use. it doesn't seem like rocket science.

Thanks for the tip on NOT using external power, I'll keep that in mind once I get my chips in.
 
Amazingly (aside from this crazy GAL issue) I've had really good luck with my TOP programmer. Aside from probably faulty or very old EPROMS, it's programmed basically everything I've thrown at it. Once I figured out the power thing it's been fine for GALs too. I may just pick up a spare to have it on hand.
 
that's good to hear. I bought the top3000 because the GQ-4X was causing me all kinds of headaches, though I haven't had much chance to use it beyond burning a couple of BIOS chips.
 
twistedsymphony said:
wow, I wish I knew about this stuff years ago, it would have been super beneficial for more than a few projects. I'm thinking back to a Sega Saturn to Xbox 360 controller adapter i built years ago using a PIC chip. I could have easily done that whole thing with a GAL and it probably would have been faster too.
Click to expand...

Logic is essentially instant. If input changes, output changes within 5ns on most logic parts. Compared to a microcontroller, it must first read the input port, check/store the state of port, then output state on different port. On a PIC mcu that would be around 12-16 clock cycles. 25mhz = 25ns per clock, approx 400ns to read input and output state on another pin.

Microcontroller = Sequence code driven by clock
Logic device = State machine, all states occur at same type

twistedsymphony said:
I've got a Top3000 and a GQ-4X that I use for burning ROMs I'm hoping I can do at least GAL22V10 and GAL16V8 on them.
Click to expand...

GQ4X does not support GAL/PAL.

gq4x history.PNG

My unit works exactly how it should, never had a problem. Literally programmed thousands of chips, and this is one of many programmers in the fleet.

But snag the TL866 for PAL/GAL -- I bought one a few years ago specifically just for those chips, has been a great little device. Tests 74 series parts and RAM too!

twistedsymphony said:
Are there limits to the length/complexity of the logic you can use? Also how do the fuses fall into this and how do you avoid blowing them when brute forcing the logic?
Click to expand...

Yes, there are logic limits to devices. For example the PAL/GAL part numbers indicate pin count and macrocells (available logic).

Different devices use different units to describe and measure available logic, but an easy summary would be this:

PAL = 50 logic gates (a few 74-series parts)
CPLD = 50-500 logic gates (20-30 74-series parts)
FPGA = 500-millions logic gates (able to replace complex logic devices like CPUs)

Here is an example fitment report for a Xilinx CPLD from a project:

xilinx fitment report.PNG
 
brizzo said:
My unit works exactly how it should, never had a problem. Literally programmed thousands of chips, and this is one of many programmers in the fleet.
Click to expand...
I bought one a few years ago when I wanted to burn some new BIOSes for my 6 or so NAOMIs I bought the GQ-4X with the adapter for those chips and 10 or so brand new chips.

It programed the first 3 flawlessly, I packed it away in a box for about a week and then it refused to program reliably anymore. it would verify that the chip was erased, write about 1%-2% and then claim that the chip was write protected, I tried re-erasing the chips, even bought an industrial chip eraser, tried a different external PSU, tried some alternate settings that people recommended to no avail.

Basically it seemed that brand new chips would burn if they were fresh out of the package, but anything that had been erased, or even minimally exposed to UV (like sitting out in the open for a few days) would fail. It read chips fine and it burned non-uv erasable chips fine too. Once I picked up the Top3000 it was able to burn all of the chips that the GQ-4X failed to do.

It's kind of moot now that I have the Top3000, I'll see how that does with GALs and if it gives me any grief I'll pick up a TL866 ;)
 
I think this is a good topic to bump for this. I'm curious what I need to start dumping PALs.

How do I determine if it's registered or has protection?

what do I need to brute force one?

I have a number of games that I noticed don't have their PALs dumped and I'd like to contribute if possible.
 
What about fuses? I've heard mention of fuses in some setups, is that something that could be accidentally tripped and brick a PAL?
 
twistedsymphony said:
What about fuses? I've heard mention of fuses in some setups, is that something that could be accidentally tripped and brick a PAL?
Click to expand...
I'm honestly not positive. My rudimentary understanding would tell me it's possible to cause issues but I'm just guessing. Since PAL chips can pull pins high or low, if a certain pin was mis-programmed in the logic, I could certainly see the possibility of frying something. Again this is just my thoughts on the matter, I'm not going to try to actually reproduce it :P (and honestly I hope I'm wrong. I'm still learning a lot of this just as you are).
 
twistedsymphony said:
What about fuses? I've heard mention of fuses in some setups, is that something that could be accidentally tripped and brick a PAL?
Click to expand...
The first generation of programmable chips (bipolar ROMs and some types of PLD devices like the PALs) were based on the PROM concept. PROM are a type of ROM which store information through a matrix of bridges (fuses) which are blown by an high current, high voltage source during programming time. It's the original type of "OTP" (One Time Programming) device. It existed before EPROMs.

Since the writing happens by physically vaporizing traces in the chip die, it's not reversible. If you program incorrect data on a PROM chip it will be useless (aka brick, no?).

First gen PAL devices were based on PROM matrix and therefore were OTP devices. Newer devices like PALCE and GAL are flash/eeprom based and can be erased.
 
that makes sense. I was more worried that a brute force testing to reverse engineer such a device might lead to new fuses being blown and thus the "programming" getting corrupted.
 
read the datasheet,
most old devices needed a high voltage for programming.
 
You must log in or register to reply here.
Back
Top