[time-nuts] FE-5680A ("New" version) fine frequency adjust

[Magnus Danielson]

On 11/18/2011 08:45 PM, Peter Bell wrote:
> The Xilinx chip (which is strictly speaking a CPLD) is programed via
> JTAG - all the required pins are on the test connector on the edge of
> the board.  In theory, you can also read back the fuse maps using the
> JTAG port if the chip hasn't been secured. I haven't actually tried
> it, because I expect the chip IS secured - and a raw fuse dump is not
> that useful anyway for anything except copying the device.

With CPLDs you still have a fair chance. I have reverse engineered PALs 
from the JEDEC dump. In the process I also concluded that they where PAL 
beginners, since they didn't use the internal feedback path but did it 
externally.

However, most of the CPLD logic should be easy to clone without the 
source just by monitoring what it does. Frequency dividers eats the 
flip-flops quickly, so with known ratios it becomes easy to estimate 
remaining terms.

Reverse-engineering is fun and you learn things. Somebody drawing a 
schematics in the process? Even partial schematics can be of help.

Cheers,
Magnus