Reading a PAL fusemap with a microscope

I sent a PAL to MEFAS to be decapped.  They e-mailed me this picture of
the die before they sent it back.  I just received fedex confirmation
that the package arrived, but I'm out of state for the next few days.

Here is the photo:
http://media.diywelder.com/die%2520image.jpg

Its a 16R8 HAL, not actually a PAL but it should be the same.

I counted 8 groups, and 8 rows which makes 64 rows, and that sounds
right.  I only counted 16 olumns an not 32, but maybe when I get a
higher power shot it will make more sense.

Which areas would you like me to take a closer picture of?  I will post
some when I get back in.

Grant

I'm very excited to be traveling home Saturday!  To see the chip!  :)

The inputs to the chip are:

01 - CLK - 16MHz
02 - I - D0
03 - I - D1
04 - I - D2
05 - I - D3
06 - I - D4
07 - I - D5
08 - I - /DMA
09 - I - TC
11 - /OE - TSEN

12 - R - /DMALD
13 - R - PWM
14 - R - NC
15 - R - NC
16 - R - NC
17 - R - NC
18 - R - NC
19 - R - NC

So its a pretty simple device.  I'm going to try to ignore those output
pins when I am reading the device.  I want to make sure I try doing
this blind.  :)

When I got home I tried to take my own higher resolution pictures, but
it seems the chip has corroded...?  Or maybe my imaging technique is
bad.  Take a look:
http://media.diywelder.com/images3/091105-40xASG_DSCF0724.jpg

I am going to the university on Monday to use ther metallurgy
microscope.  It has a video camera mounted to it, and will go higher
than 40x.

Here is an image I took with a 40x microscope with my 3x camera zoomed
held to the eye piece  ;)  I'm pretty sure I'm zoomed in on the block
for pin 7.

http://media.diywelder.com/images3/091105-findingthemap_DSCF0724.jpg

And this is what the block should look like empty.  I'm having a hard
time locating the input and output feedback connections.  They don't
seem to be where I'd expect them.

http://media.diywelder.com/images3/091105-pin7fusemap.jpg

Here is an image showing how I identified the pins:

http://media.diywelder.com/images3/091105-ASGwithpinout.jpg

Is the gold blob I identified a fuse that has not been removed? Or in
this case since its a HAL a fuse that was deposited?  HALs probably
just wouldn't have a fuse where as a pal should have one burnt?

Any suggestions at all?  And is there a chance with this HAL that its
fusemap visually would be different from the datasheet organization or
a regular PAL?  Since its not programmed but manufactured at a factory?

Any industry contacts anyone could recomend?  I'd love to figure this
out.  :)  I'll try to get some better pictures on Monday.

I've had success reading the fuse map!  :)  It took 200x and a decent
microscope.  Still holding the cheap digital camera to the eye piece,
but hey...it works. :)

You can see in the images below that a HAL has all the fuses, but some
have been cut.  So my guess would be rather than them being
manufactured with a pattern, they are manufactured 100% connected and
then mechanically cut later?

Here is a huge picture of the entire silicon.  The fuse map is the big
rectangle array to the left.  50x
http://media.diywelder.com/images3/091205-wholechip_IMGP2074.jpg

Here is a 20pin DIP with an arrow pointing to the map.  Its amazing the
scale inside these chips...and they're 30 years old!  :)
http://media.diywelder.com/images3/091205-HALchip_IMGP2078.jpg

Here is one 8x32 256 fuse array with the inputs and flip flop results
annotated.  200x
http://media.diywelder.com/images3/091205-FusemapMap-IMGP2067.jpg

A shot of the bond wires, 200x.
http://media.diywelder.com/images3/091205-Pins_IMGP2070.jpg

MMI logo 200x
http://media.diywelder.com/images3/091205-MMILogo_IMGP2051.jpg

Those pictures were of the ASG, Apple Sound Generator, in the 128k to
Plus macintosh.  I'm going to write a program to visually read the
fusemap so that I don't have to.
Pretty cheap, $45 for a chemical decap and then a few hours writing
down 1s and 0s.  ;)

logjam wrote:
> I've had success reading the fuse map!  :)  It took 200x and a decent
> microscope.  Still holding the cheap digital camera to the eye piece,
> but hey...it works. :)
>
> You can see in the images below that a HAL has all the fuses, but some
> have been cut.  So my guess would be rather than them being
> manufactured with a pattern, they are manufactured 100% connected and
> then mechanically cut later?

I was under the impression that HALs were chaper than PALs.  Therefore
it would be unlikely that such a process would be used.  While the
gap at the "blown fuse" is small, it does not look significantly
different than other gaps in the metalization pattern.  I think
a mechanical process would have left some sort of recognizable
"scar" at the cut.  The other method used commonly to remove
metalization, "laser trimming", would also leave some visible
mark.

More likely the HAL started from the same mask set as the PAL, but
the cuts were added to the mask.  Also it is likely that to save
more on processing, the "fuse" metallization is actually the
standard aluminum used in the rest of the chip rather than the
alloys used for a fusible link.  All of the cuts would be in
a single mask layer, allowing the factory to pre-build most of
the chip and do quick turns for new patterns.

Just my 2 cents,
Gabor

Gabor is correct.

PAL's are programmed by blowing fuses or storing injecting charge like a 
flash device.  You can get factory programmed PAL's but they are still PAL's 
and are no different than the ones you buy.  Programming is a relatively 
expensive process.

HAL's are 'Hard Array Logic'.  They are programmed with a mask (the final, 
metal mask) during manufacturing.  They are generally ordered only in large 
volume because the cost of the mask, testing and marking must be spread over 
the end volume.  Also, sometimes they can be made on smaller die, though for 
the case of a 16X8 I doubt anyone bothers today.

Marc Reinig
System Solutions

"Gabor" <gabor@alacron.com> wrote in message 
news:1126617095.796923.239650@g43g2000cwa.googlegroups.com...
> logjam wrote:
>> I've had success reading the fuse map!  :)  It took 200x and a decent
>> microscope.  Still holding the cheap digital camera to the eye piece,
>> but hey...it works. :)
>>
>> You can see in the images below that a HAL has all the fuses, but some
>> have been cut.  So my guess would be rather than them being
>> manufactured with a pattern, they are manufactured 100% connected and
>> then mechanically cut later?
>
> I was under the impression that HALs were chaper than PALs.  Therefore
> it would be unlikely that such a process would be used.  While the
> gap at the "blown fuse" is small, it does not look significantly
> different than other gaps in the metalization pattern.  I think
> a mechanical process would have left some sort of recognizable
> "scar" at the cut.  The other method used commonly to remove
> metalization, "laser trimming", would also leave some visible
> mark.
>
> More likely the HAL started from the same mask set as the PAL, but
> the cuts were added to the mask.  Also it is likely that to save
> more on processing, the "fuse" metallization is actually the
> standard aluminum used in the rest of the chip rather than the
> alloys used for a fusible link.  All of the cuts would be in
> a single mask layer, allowing the factory to pre-build most of
> the chip and do quick turns for new patterns.
>
> Just my 2 cents,
> Gabor
> 

logjam wrote:

<snip>
> 
> Those pictures were of the ASG, Apple Sound Generator, in the 128k to
> Plus macintosh.  I'm going to write a program to visually read the
> fusemap so that I don't have to.
> Pretty cheap, $45 for a chemical decap and then a few hours writing
> down 1s and 0s.  ;)

  You could have reversed engineered this with a Vector testing 
programmer, original circuit, and a text editor, but probably not as 
much fun...

  You can verify your logic, when done fusemap extracting, with vector 
testing and even create a new device - this sounds like a std 20 in 16x8 
device ?

  (Also watch that some devices have pin polarity fuses)

-jg

I posted this in another thread, but didn't hear from anyone.  Maybe
here it will get more exposure?

I'm beginning to question the organization of the fuse map in a HAL.
It doesn't seem to be related to the datasheets.  I've collected a lot
of data so far and have outlined it below.

Here is an x-ray of the actual package to show where the bond wires go:
http://media.diywelder.com/images3/091405-HAL16R8chip2_Image412.jpg

Here is the whole chip:
http://media.diywelder.com/images3/091205-wholechip_IMGP2074.jpg

Here is the map which is connected to "Pin 2", but the connections to
the fusemap seem to indicate pin 3:
http://media.diywelder.com/images3/091205-FusemapMap-IMGP2067.jpg

Here is the fuse map schematic for pin 2.  Note the locations of the
input and feedback fuses.
http://media.diywelder.com/images3/091105-PALdatasheetimage.jpg

Can anyone give me any insight?  Will I have to translate the location
of the vertical fuse columns to what they "should be" in a GAL?

Thanks,
Grant

On 16 Sep 2005 13:52:05 -0700, "logjam" <grant@cmosxray.com> wrote:
>I posted this in another thread, but didn't hear from anyone.  Maybe
>here it will get more exposure?

Probably not. We all read the same news group and articles.

>I'm beginning to question the organization of the fuse map in a HAL.
>It doesn't seem to be related to the datasheets.  I've collected a lot
>of data so far and have outlined it below.

You do seem to be having too much fun. Considering the performance
of todays PCs, it would seem you could get to a solution by doing
an exhaustive search with a PC controlling the device via some simple
circuitry hanging of a printer port.

It seems you have hung much of your analysis on the assumption that
the chip layout should follow the diagrams in the data book.
There is no such requirement, and it would surprise me if you did
find a perfect match. The diagram in the data book is laid out
for easy of viewing and presenting a logical view of the functionality
of the device. The chip layout is laid out to minimize area,
to leverage repeated structures, to meet power/noise/other requirements.

For example, in the data sheet you see the FF feedback coming
across the fuse array as two adjacent lines. But if the Q and Q-bar
outputs were not adjacent as they come out of the FF structure, then
on the chip the lines may not be adjacent. It is also very common to
see structures that share something are laid out as alternating
normal lay out and then mirrored layout, so that the shared
resource (a signal line, a power/ground, a control line) is only
needed once per pair of things.

>Can anyone give me any insight?  Will I have to translate the location
>of the vertical fuse columns to what they "should be" in a GAL?

Hope the above helps expand what you are looking for. I still think
that a PC based sw/hw exploration would get you to a complete picture
with a few days of programming (changes as you learn stuff), and probably
less than an hour of CPU time.

FYI: The HAL products were promoted as Hard Array Logic, with the intent
of mask programming the devices for high volume cost reduction. In fact
many HAL devices were just normal PALs that were programmed at the
factory. Have you plugged the device into a PAL programmer and seen if
it can be read back? I hope so.

>Thanks,
>Grant

Philip Freidin
MMI FAE 1980-1983

Yes, Its read as nothing.

I've read a bunch on reverse engineering and PALs, but have not found
any information on brute force methods.  In fact all I found were
testimonials about Apple using PALs to slow down people copying their
computers.  Also heard a few people talking about IBM slowing down the
first clone with a state machine PAL in the FPU?

I try not to do TOO much book learning without actually getting dirty,
but from what I heard its pretty hard to guess a PALs function by logic
tests.  Would the program you suggest I write already have a hint of
what the PAL does and test for input sequences that make sense for THAT
PAL?

I know what this "ASG" PAL does, and I'm trying to ignore it.  You're
right, I am having too much fun.  :)  A lot of things I do once, and
afterwards pledge to never do again.  This may be one of them, but at
least its looking possible.  ;)

I've printed out photos of the fuse maps and by Saturday night Alaska
time should have a working replacement.  :)