How exactly do PAL chips get programmed?

[Tony Duell]

> >If the original chip is a HAL, you are out of luck. HAL == Hard Array
> >Logic, it's a mask-programmed equivalent to a PAL. I've never found one
> >that can be read out, I suspect the circuitry simply isn't there.
> 
> There are a couple of articles in the archives about reverse 
> engineering the behaviour of PALs.   One article started out very 
> promisingly (to my inexperienced eye) and the author stated that 
> parts 2 & 3 were to follow, but they never did.  Oh well.


Well, here's a start... It only applies to PALs with no burried 
flip-flops -- that is it only works for chips where a change of internal 
state is visible on the pins. This applies to the classic PALs, but not 
necessarily to GALs (from what I rmember).

What you need is a device that has a fair number of TTL I/O lines (alas 
few modern computers have user ports or hacker-friendly buses, but 
anyway). You want to be able to drive each input of the PAL under test 
and read all the outputs (I asusme you know which pins are inputs and 
which are outputs, from the schematic if nowhere else).

The first thing to do is to indentify which (if any) outputs show 
sequential (i.e. internal latch/flip-flop) behaviour. In pseudocode it 
goes like this

set all output_states to COMBINATORIAL
for inputs=0 to (2^no_of_inputs)-1 do
  write(inputs)
  outputs_1= read (outputs)
  for this_input = 0 to no_of_inputs-1 do
    invert this_input 
    invert this_input /* this toggles each input in turn and sets it back
                          to the original state */
     new_outputs=read_outputs
     if new_outputs!=outputs_1 then set output_states for outputs that 
                                    changed to SEQUENTIAL

At the end of this, you will hopefully have some combinatorial outputs.

Then, try all possible input states again, record the outputs and look at 
those that are known to be combinatorial. Use your favourite logic 
minimalisation method to produce the logic equations for those.

That's part 1. I will think about cracking sequential terms...


> How heat sensitive are PALs and GALs?  Am I likely to deprogram the 
> thing when I desolder it from the board?

TAoE calles this 'Security through solder' or soemthing similar.

I've never desoldered a GAL. I've desoldered _many_ DIL-packaged PALs 
without damage. It depends on how good you are at soldering. If you're 
happy removing other ICs without problems, I don't think you'll have any 
problems with PALs/GALs

-tony