GAL/PAL Reversing

[@rt]

Hi Guys
With the acquisition of a vintage board it has become desirable to reproduce 3 x 22v10 PALs with stock logic
to reproduce a part of the board’s functionality. Company is long gone, and I’m sure nobody cares about the IP any longer.

Where have we come with this?
Googling did yield an interesting read, but the links for further information are now dead.
It went into brute force methods of input to analyse output.

Fortunately, the board is low volume production (test board), and the parts could have easily been used wastefully.
Cheers

[amyk]

It's either brute force (may take a long time) or decapping and reading the array directly ($$$, I'm not sure if it's possible to read these like that if they're the E/EEPROM version.)

[BrianHG]

If I remember correctly, for the GALs, they have a read protect fuse.  If you have a programmer, you may be able to read them if this fuse hasn't been set.  I don't remember any details about programming PALs.

Reverse engineering programmer & tools used to exist in the 90s, but, it takes something like running a PC & code for a week or more to workout the internal fuse map from a protected device & such tools were only available from 1 or 2 companies.

[mikeselectricstuff]

First thing is to try reading as they may not be protected.
22V10s are fairly straightforward to reverse as they can't have buried feedback paths. You should also be able to figure out a lot by looking at what the board does in normal operation. It could be that most of the pterms are doing trivial functions.