How exactly do PAL chips get programmed?

Michael Holley swtpc6800 at
Thu Nov 17 20:43:34 CST 2005

As mentioned in other post you need the correct programmer to read the PAL 
fuse pattern. You must specify the exact manufacture and part number to 
configure the programmer or you can ruin the PAL.

Around 1985 I did an experiment on decoding the logic of PALs with the 
security fuse programmed. This used just TTL levels to apply test patterns 
to the inputs and read the outputs. For registered devices you would also 
apply the clock.   You would develop large truth tables that could be 
reduced to provide equivalent logic equations. I used the test vector 
feature on a Data I/O Logic Pack but you could build a simple test fixture 
to apply inputs and read the output levels.

This process should work with simple PALs, 22V10s and 16V8s.Combinatorial 
devices like the 16L8 are easy to decode. Apply all possible inputs and read 
the outputs. You will need to treat I/O pins as inputs and determine if the 
pin is tri-state.

Registered devices such as the 16R8 require a bit of work. Apply an input 
and clock it through all possible states, Eight registers would require up 
to 256 clocks. Some devices power up in a known or repeatable state, early 
devices power up in a random state. Suppose a device powers up to all zeros, 
from that state you need to find all possible next states by applying 
various inputs. Reset the part, go to a known state and try input pattern 1 
and record the output. Repeat with input pattern 2 and so on. The idea is to 
build a state table with all inputs and transitions.

A logic reduction program such as Espresso will simplify these large tables 
to minimized equations. I used Data I/O's ABEL program to do this.

This method will only work on devices where the feedback is from the pin so 
there are no hidden registers. These PALs have the output enable controlled 
by a pin so you can always read the register state. Some devices allowed the 
registers to be preloaded to a known state to speed testing. These make it 
simple to get to each state to find the transitions to the next state. You 
must have the correct programming algorithm to use the feature or you could 
ruin the device.

I did this experiment 20 years ago and don't have any more information on 

Michael Holley

More information about the cctalk mailing list