backing up PAL chips

Don Y dgy at DakotaCom.Net
Sun Jun 25 18:13:49 CDT 2006

Alexandre Souza wrote:
>>> Advice appreicated :) I'm used to working with EPROMs, but PALs are a
>>> total unknown to me!
>> Keep it all --- I don't think you need more than a floppy disk at one time
>> for all the software and data files for the older PAL's.
>     this is a good question: How to reverse-engineer PALs?
>     Maybe a simple all-possibilities-generator on all the inputs could lead
> me to derive the logical map?

If the device is not registered, then it's purely combinatorial
and you can map all the cumzouta's by stimulating all the gazinta's.
Brute force.  But, this can then be algorithmically reduced to a set
of simple equations.

If the device is registered AND THERE IS NO BURIED STATE, it's
a similar process to the above -- except now all of those
registered outputs are also inputs to the array.  The added
trick is that you need to keep track of how to *get* to a particular
state in order to have that set of inputs the way you want them
as you probe the array.  The easiest way I have found to do
this is to just build a map of each (present state, inputs)
condition and record the observed "next state" that results.
Initialize this to "unknown" for each possible set of state
and inputs.  When you find yourself in a state, see which
inputs have not been tried.  Try one.  Record the result.
Repeat.  If you find yourself in a state that is entirely
mapped, pick a set of inputs that will get you to some
OTHER state with some as yet unknown inputs.  There are
deterministic algorithms that will tell you if you can get
from A to B (and how many steps).  For small PAL's/PLA's,
the whole process takes a few seconds on a slow PC  :>
(assuming you have direct access to the inputs and outputs
of the device)

More information about the cctalk mailing list