Reading contents of PALS like the 16L8 or 16R8

The early 20/24 pin PALs had a security fuse to prevent unauthorized duplication. I worked at Data I/O, the device programmer company, in the 1980s and figured out a way to determine the contents. I did a few experiments to prove the concept but never created a complete package. PAL programmers like the Data I/O LogicPak could apply test vectors to a PAL and check the output state of each pin. For a purely combinatorial device like a PAL16H8 you just need to apply all possible inputs and read the outputs. This will create a large truth table in inputs and outputs that can be minimized with PLD software like ABEL. Registered devices like PAL 16R8 require the bank of registers to cycle through all starting points with all inputs. Most of these devices supported pre-load, the programmer could force the internal registers to a known state. You could force a desired register state and inputs then apply the clock. These early registered PALs had a tri-state output buffer controlled by a dedicated pin so you could always read the register output. Later parts had the output buffer controlled by an internal logic function. I am sure that by now someone has developed a high speed tester that applies every combination of inputs then minimized the output to generate a programming file. I have copies of the early DOS based ABEL software; it runs in a DOS box on Windows 98. I believe that Xilinx now owns the copyright. I have donated copies of the software and source code to the Computer History Museum. Michael Holley