it's
always possible to deduce the logic equations with a bit of work
without
having to dump out the fuse map, there is no hidden internal state). A
suprising number of classic computers, though, have unprotected
PALs, etc.
What about registered PALs? There are a great many of those
around. Figuring out the transfer function of a black box of
*sequential* logic isn't so trivial. :-(
You can, of course get sequential logic with a non-registered PAL. The
16L8 has feedback terms (the outputs can be fed back into the AND array),
so you can make flip-flops.
But I stand by what I said. Actually, registered PALs are easier than
16L8s in some cases. Firstly, you can tristate the outputs, force logic
levels onto them and clock the device. For a _PAL_ (although not a GAL),
the feedback is taken from the pins, so yuo can effectively force all the
inputs to the AND array this way. And IIRC registered PALs (and GALs?)
have a way to load the register for testing, and this is not disabled by
the securioty fuse.
Even without this, it should be possible to crack a PAL or GAL. The point
is that any change in intenral state is noticeable at the pins. You can't
have the device change state internally nad not see it (this is not true
of more complex devices, of course). It's not trivial, though.
-tony