How exactly do PAL chips get programmed?

Jeff Walther trag at
Fri Nov 18 14:23:09 CST 2005

>Date: Thu, 17 Nov 2005 23:33:45 +0000 (GMT)
>From: ard at (Tony Duell)

>Some manufactuerers did not copy-protect their PALs. For example, all the
>PALs in the VAX 11/730 CPU are readable (for all they're the key to the
>design). All PALs in every PERQ I've seen (including the AGW3300) are
>readable. All PALs in the Torch XXX -- apart from those on the (3rd
>party?) 68020 kludgeboard -- are readable. But then again, most PALs on
>clone ISA boards are protected.
>If the original chip is a HAL, you are out of luck. HAL == Hard Array
>Logic, it's a mask-programmed equivalent to a PAL. I've never found one
>that can be read out, I suspect the circuitry simply isn't there.

There are a couple of articles in the archives about reverse 
engineering the behaviour of PALs.   One article started out very 
promisingly (to my inexperienced eye) and the author stated that 
parts 2 & 3 were to follow, but they never did.  Oh well.

I would like to clone the external floppy drive and SCSI adapter for 
the Outbound Model 125.   I've acquired most of the required parts 
for each.  However, they each have a GAL 16V8 (just one per product) 
installed.   The terror at trying to figure the contents of that GAL 
has been stalling me for months (well that, plus all the other stuff 
around here, like getting the autumn garden planted).

How heat sensitive are PALs and GALs?  Am I likely to deprogram the 
thing when I desolder it from the board?

Jeff Walther

More information about the cctech mailing list