How exactly do PAL chips get programmed?
swtpc6800 at comcast.net
Thu Nov 17 20:43:34 CST 2005
As mentioned in other post you need the correct programmer to read the PAL
fuse pattern. You must specify the exact manufacture and part number to
configure the programmer or you can ruin the PAL.
Around 1985 I did an experiment on decoding the logic of PALs with the
security fuse programmed. This used just TTL levels to apply test patterns
to the inputs and read the outputs. For registered devices you would also
apply the clock. You would develop large truth tables that could be
reduced to provide equivalent logic equations. I used the test vector
feature on a Data I/O Logic Pack but you could build a simple test fixture
to apply inputs and read the output levels.
This process should work with simple PALs, 22V10s and 16V8s.Combinatorial
devices like the 16L8 are easy to decode. Apply all possible inputs and read
the outputs. You will need to treat I/O pins as inputs and determine if the
pin is tri-state.
Registered devices such as the 16R8 require a bit of work. Apply an input
and clock it through all possible states, Eight registers would require up
to 256 clocks. Some devices power up in a known or repeatable state, early
devices power up in a random state. Suppose a device powers up to all zeros,
from that state you need to find all possible next states by applying
various inputs. Reset the part, go to a known state and try input pattern 1
and record the output. Repeat with input pattern 2 and so on. The idea is to
build a state table with all inputs and transitions.
A logic reduction program such as Espresso will simplify these large tables
to minimized equations. I used Data I/O's ABEL program to do this.
This method will only work on devices where the feedback is from the pin so
there are no hidden registers. These PALs have the output enable controlled
by a pin so you can always read the register state. Some devices allowed the
registers to be preloaded to a known state to speed testing. These make it
simple to get to each state to find the transitions to the next state. You
must have the correct programming algorithm to use the feature or you could
ruin the device.
I did this experiment 20 years ago and don't have any more information on
More information about the cctalk