A method of duplicating or replacing PAL devices

1 Introduction
In the maintenance of the board and servo module of CNC machine tool system, the damage of PAL devices sometimes leads to the scrapping of the whole board and even the system. Because they are often encrypted, even if these chips are not damaged, we cannot read the fuse diagram file, and then copy and replace them.
When the chip is in good condition, the logic analyzer can be used to analyze its logic function online, or build a simple circuit to test its input-output relationship, but once the chip is damaged, it is often helpless. In this paper, we introduce a method to solve the problem thoroughly.
The chip played the role of chip selection in the spindle servo module of Kollmorgen VFS5. On one occasion the module failed, the logic analyzer observed that an external program memory chip was not selected when the CPU was about to access it. And other states in the circuit all together judged that the PLD chip was not functioning or damaged. Duplicated and replaced the chip in the following way due to no spare parts.
2 Get the chip circuit image
First, put the chip into the dissolving agent to heat and remove the package, and then got a wafer of 2 or 3 square millimeter. And cleaned the surface using alcohol cotton.
The wafer was observed under a microscope with a power of more than 500, the fuse layer was most clear by focusing. The screenshots which show the details partly were saved, and the complete internal circuit image was assembled by image processing software (Fig. 1).

Fig. 1 A complete image of 6×5 screenshots of this example

3 Read logic function data
Read out the data in the data area carefully and arranged them according to the corresponding row and column addresses (Fig. 2). The data was “1” when fused, and “0” intact. This example has 2048 fuse data.

Fig. 2 Data mapping in this example

4 Get the logic function expression
According to the circuit diagram described in TI’s TIBPAL16L8-25CN datasheet (Fig. 3), the input and output logic expressions can be written out:

Fig. 3 TIBPAL16L8-25CN logic circuit diagram

\P19(O)=I1I2I3I4\I6I7\I8I9\I11\P15
\P18(I/O)=I1\P15
\P17(I/O)=I1I2I3I4\I6\P15(\I7I8+\I5I8I9+\I5\I7)
\P16(I/O)=I1I2I3I4\I6\I7\P15(I8I9+\I11)
\P14(I/O)=I1\P15(\I4+\I3+I6+\I2)
\P13(I/O)=P15+\I1
\P12(O)=I1\P15
Among them, I1-I11 represent 1-11 pins and P12-P19 represent 12-19 pins respectively. Obviously, P15 (I/O) was set as input, while other I/O pins were set as output. The “\” in front of the signal name indicates the logical NOT signal of it, the concatenation of the signal name indicates the logical AND, and the “+” indicates the logical OR.
5 Generate fuse diagram file
Using PLD design software could generate fuse diagram file and ABEL 4.0 was used in this example, the source file was as follows:
module U90
title ‘TIBPAL16L8-25CN_90’
U90 device ‘P16L8’;
I1,I2,I3,I4,I5,I6,I7,I8,I9,I11 pin 1,2,3,4,5,6,7,8,9,11;
P12,P13,P14,P15,P16,P17,P18,P19 pin 12,13,14,15,16,17,18,19;
equations
!P19 = I1&I2&I3&I4&!I6&I7&!I8&I9&!I11&!P15;
!P18 = I1&!P15;
!P17 = I1&I2&I3&I4&!I6&!P15&(!I7&I8#!I5&I8&I9#!I5&!I7);
!P16 = I1&I2&I3&I4&!I6&!I7&!P15&(I8&I9#!I11);
!P14 = I1&!P15&(!I4#!I3#I6#!I2);
!P13 = P15#!I1;
!P12 = I1&!P15;
End
The compiled fuse diagram file was as follows:
□ABEL 4.00 Data I/O Corp. JEDEC file for: P16L8 V9.0
Created on: Thu Sep 1 11:16:14 19;6
TIBPAL16L8-25CN_90
*
QP20* QF2048* QV0* F0*
X0*
NOTE Table of pin names and numbers*
NOTE PINS I1:1 I2:2 I3:3 I4:4
I5:5 I6:6 I7:7 I8:8 I9:9 I11:11
P12:12*
NOTE PINS P13:13 P14:14 P15:15 P16:16 P17:17 P18:18 P19:19*
L0000 11111111111111111111111111111111*
L0032 01010111011111111010011110110110*
L0256 11111111111111111111111111111111*
L0288 11011111111111111110111111111111*
L0512 11111111111111111111111111111111*
L0544 01010111011110111010111101110111*
L0576 01010111011111111010101101111111*
L0608 01010111011110111010101111111111*
L0768 11111111111111111111111111111111*
L0800 01010111011111111010101101110111*
L0832 01010111011111111010101111111110*
L1280 11111111111111111111111111111111*
L1312 11011111111111110110111111111111*
L1344 11011111101111111110111111111111*
L1376 11011011111111111110111111111111*
L1408 10011111111111111110111111111111*
L1536 11111111111111111111111111111111*
L1568 11111111111111111101111111111111*
L1600 11101111111111111111111111111111*
L1792 11111111111111111111111111111111*
L1824 11011111111111111110111111111111*
C506E*
□EB94
6 Duplicate or replace
By using the programmer wrote the fuse diagram file into a TIBPAL16L8-25CN blank chip, thus the duplicate was completed. And other compatible chips could also be selected for replacement. This example used the duplicated chip to make the spindle servo module return to normal.

Three examples of Kollmorgen VFS5 servo repair

The VFS5 servo module was applied to the spindle unit of Cincinnati Sabre 1000 machining center.
Ex. 1 After power on, VFS5 servo module ACTIVE and FAULT lights were on, while SYS OK and CPU were not. Measured the power supply ±18V and +10V on the plug C4, all were normal. And the DC bus 325V also normal. The power supply +5V of microcontroller 136 (N80C196KB16) was normal. The logic analyzer showed that the internal clock signal CLKOUT (pin 65) was normal, but there was no data in the bus. Almost all the port lines were high level. Obviously, the program was not running.
When the power supply is within the tolerance range and the clock signal is stable, the microcontroller can be reset by adding a low level of no less than 4 state times at the reset end (pin 16). Using the logic analyzer tried to capture the falling edge on the reset end, and nothing was found.
The external reset circuit is shown in Fig. 1.


Fig. 1 External reset circuit of VFS5 microcontroller

The power on reset circuit is composed mainly of under voltage detection circuit 166A, resistor 193, capacitor 191 and Schmidt trigger 168A. It is integrated by the triodes 156 and 142 with the instruction reset circuit of microcontroller, and directed to pin 16 of microcontroller 136.
Monitoring the logic state of each point with logic analyzer, checked some devices with multimeter, decided that 168 and 158 were poor or damaged, and the reset circuit was normal after replacement (Fig. 2).

Fig. 2 The logic state waveform of each point after the reset circuit was normal

Ex. 2 After power on, the VFS5 servo module FAULT, SYS OK and CPU lights were on, but the ACTIVE light was off. Checked that the voltage of each power supply including DC bus was normal.
According to VFS5 control program (stored in EPROM AM27C256) and logic analyzer tracking, it was known that the cause of fault was the alarm 84 (OUT OF BOUNDS), which is caused by improper setting of VOSPD (overspeed setting) and VMAX (max. speed). Using MotionLink+ to read the variables in the module and compare with the backup file, it was found that the values of most variables had changed (Fig. 3).

Fig. 3 Comparison between real reading and backup of variables

The backup file was transferred to the module. Because the module is spindle servo, the ROTARY variable must be set to zero before transferring to avoid alarm. The fault light was still on after the transfer.
According to the tracking analysis, this time it was the No.18 alarm (BAD TL). Further tracking showed that the value of D672H (word) unit in SRAM DS1230Y had become 9096H (-28522D). The unit corresponds to the variable VOLTS, whose value should be 00E6H (230D).
This variable belongs to Kollmorgen Protected Variable to ensure the correct matching of servo and motor. Users can not modify it through online communication. So 5672H (word) unit was modified by using general programmer. This is because in the VFS5 servo module system, the starting address of SRAM DS1230Y is 8000H.
After the modification, the alarm became No.27 (R/D JUMPERS). The alarm was caused by the change of resolution setting of R/D conversion. The content of D6B9H (byte) unit was changed from ECH (236D) to 0CH (12D) in the same way of tracking and modifying, which is 12-bit resolution.
At this point, the FAULT light went out and the module returned to normal.
Ex. 3 The module FAULT light was on, and the cause of the fault could not be found after routine inspection. According to the logic analyzer, it was judged as No.17 alarm (FEEDBACK LOSS), that is, the feedback signal of revolver is missing.
Checked that the wiring and connectors of the revolver were normal.
The input and detection circuit of VFS5 resolver is shown in Fig. 4.

Fig. 4 VFS5 resolver input and detection circuit

The 8.5kHz sine reference signal REF is generated by the op amp 349, triodes 363, 364 and other components, and goes to the resolver to output SIN and COS signals. SIN, COS and REF are divided and sent respectively to the pins SIN I/P, COS I/P and REFERENCE I/P of the R/D converter 60 (AD2S82AKP). At the same time, the circuit composed of diodes 361, 362, triode 383 and reverser 111D detects the status of SIN and COS signals, which are integrated by pal logic device 171 (TIBPAL16L8) and then sent to the microcontroller.
The sine wave of 8.26kHz and 1.66Vpp at REF end was observed by oscilloscope, but there was no signal at SIN or COS end, and the same was true when the motor was rotated. Thus decided that the resolver was damaged.
Considering the convenience of disassembly, the fault was further judged. Loosened the set screws on the stator of the resolver and pulled it out. Placed it on a wooden block, and put the rotor of another resolver (of the same model) into it. After power on, the FAULT light went out. The sine waveforms of 6.6Vpp could be observed at the ends SIN and COS with oscilloscope, while that of REF was 14.4Vpp.
After replacing the resolver and adjusting the zero point (using MotionLink+), the servo and motor run normally.

Analysis of VFS5 Main Program

The analysis of the flow chart of the main program is as follows:

2080H-2092H:
After power-on reset, N80C196KB16 starts at 2080H.
First, write zero to the output lines O1-O8 (ULN2803A, 28) of the servo module VFS5.

2093H-2096H:
Set the stack to 8000H-82FFH.

2097H-20B0H:
Check whether the parameter LOAD (RAM:F762H) is 1, and if 1, the user program that is solidified in ROM is loaded to the external RAM, of which the starting address is 8300H (the external RAM address space is 32K, that is, 8000H-FFFFH). The so-called loading is actually a copying of the user program stored in ROM to RAM, which copies the content of 4D6AH-5D09H in a total of 4000 bytes in ROM. In this VFS5 module, the actual location of the user program is 4D6AH-5B41H, with a total of 3544 bytes. Then check the number of characters of the program (not more than 20000) and fix it, the number of program instructions is stored in D130H, the address of the offset of the end byte FFH to 8300H is stored in D132H, the program’s character ASCII value sum (discarding those higher than two bytes) are stored into D676H (PGMCKSUM) and D128H-D126H’s two lower bytes. D129.7 is used as the flag bit. “1” indicates that the program is wrong, and “0” normal.
If LOAD is 0, the process is dropped. In fact, the contents of external RAM (DS1230Y-120) will not be lost after power-off.
Then the program jumps to 0100H.

0100H-0125H:
Add all the bytes of 0100H-7FFFH (except 1FFCH-1FFDH) in the ROM to see if the sum is equal to the content of 1FFCH-1FFDH (8626H). If not, it goes into a dead loop, and the CPU LED flickers to indicate firmware errors; if equal, it lights up the CPU LED and then executes the program down.

0126H-0134H:
Check whether the setting of revolver resolution RDRES (manufacturer set, stored in the external data memory D6B9H unit) matches the hardware. If so, give information 199 (DRIVE POWERED UP). Otherwise light the FAULT LED, and put the No.27 message (R/D JUMPERS) into the buffer.

0135H-0177H:
Initialize parameters, reset outputs, etc., such as setting the servo motor as induction motor.

0178H-017AH:
Check the variable BAUD to see if it is among the values of 300, 600, 19200. If it is, be ready to receive. If not, try to autobaud and flash CPU LED. The attempt maintains until success. The setting of ABAUD switches between checking and direct autobauding. FAULT LED turned OFF within this subroutine.

017BH-0194H:
(to be continued…)

Data Sheet of Main IC Chips

(6, 90, 164, 284, 339, 438) UC3705T

(28) ULN2803A

(32, 109, 163, 300, 374, 464) MC3423

(43) AD652BQ

(51) 74HCT374

(52, 54) LS540

(56) AD7548JP

(60) AD2S82AKP

(60F, 133F, 215F, 324F, 405F, 467F) HP4503

(67) AD7528JP

(76) ALS138A

(78) HCTL-2000

(90, 171)TIBPAL16L8, (75)TIBPAL16R4

(114) DS1230Y-120

(122) DM74ALS245AWM

(123) DG418

(136) N80C196KB16

(137) AM27C256

(164) DM74ALS373WM

(166A) 34064

(189) SN75155P

(253) UC3524AN

VFS5 Main Program

From the circuit diagram, it can be seen that the core of the VFS5 spindle module is the MCS-96 Series MCU or micro controller N80C196KB16(136) of Intel company, with a small amount of RAM in the chip, but without ROM, it usually needs external expansion. The module uses AM27C256(137) and DS1230Y-120(114) as external program and data storage, and the memory space is 32K, respectively. AM27C256 has no security byte, and programmers can read the code directly. The N80C196KB16 fetches code from the address 2080H after reset, It is easy to obtain the assembly language program by disassembling code from the address. Then the control flow chart can be drawn (see below).

VFS5 Main Program