This example details cloning the Creative Sound Blaster CT1350B U12 PAL. If you're just starting out on this thread, go to the start at Part 1.

Okay, so we've got a weird looking PAL "brute force" dump, that has 10 inputs and 8 outputs, but it doesn't work. In particular, we've noticed that the data from dumping the dupe doesn't match the original:

000000  A1 A9 B1 BB BB BB BB BB-A1 A9 B1 BB BB BB BB BB
008000  A1 A9 B1 BB BB BB BB BB-E1 E9 F1 FB FB FB FB FB
In particular, note that exactly half of the samples in the second 32K all have bit 6 set. This corresponds to pin 13 on the PAL and, a little tracing on the PCB shows that it's connected to pin A10 on the ISA connector, "IO Channel Ready". So now we know what kept the 5160 from booting--the system was kept in an "IO Busy" state, so nothing got started.

So what happens if the last 1024 bytes of the dump is used instead of the first? Here's the resulting Minilog output:

S = 0
T = G'
U = AHI'
V = F'H'I'
W = F'H'J'
X = A' + E'
Y = F'H'J' + F'H'I'
Z = F
Aha! Note that T (pin 13) is now dependent upon pin 4, which has been unused up to this point. Let's think about this--why does this happen only in the second 32K samples? Well, bit 15 of our sample counter is used to "nudge" (through a 1K resistor) pin 13 so that it can be determined if 13 is an input or an output pin. tt16l8 correctly spotted pin 13 as an output, but clearly, it's not your garden-variety output. In fact, the reason that we see the pin's true behavior only in the second 32K samples is because bit 15 in our counter is HIGH, and so pulls up pin 13.

If we were working in ancient TTL, we might conclude that this was an open-collector output, but the PAL16L8 doesn't have OC outputs. But it does have tri-state outputs. A little thinking indicates that pin 4 must be the tri-state enable and that the output from pin 13 is 0V when enabled. So where to get a logic 0?

Going back to the CT1350B, we notice that pins 7, 8, 9 and 10 of the PAL are connected together on the back side of the board. In other words, all three inputs are grounded--and that's where we can get our low logic level.

Twiddling the EQN file a bit gives us:
CHIP SB20 16V8

pin1=1 pin2=2 pin3=3 pin4=4 pin5=5 pin6=6 pin7=7 pin8=8 pin9=9 gnd=10
pin11=11 pin12=12 pin13=13 pin14=14 pin15=15 pin16=16 pin17=17
pin18=18 pin19=19 vcc=20


;  pin12 = nc
;	note that pin 7 8 and 9 are tied to gnd on the PAL socket

pin13.trst = /pin4
pin13 = pin7				; IO CH RDY/  tristated
/pin14 = pin11*pin3*/pin2		; CS/ for YM3812
/pin15 = /pin5*/pin3*/pin2		; CS/ for first SAA1099P
/pin16 = /pin5*/pin3*/pin1		; CS/ for second SAA1099P
/pin17 = /pin11 + /pin6			; U14, 74LS74, PS2
/pin18 = /pin5*/pin3*/pin1 + /pin5*/pin3*/pin2	 ; U14, D2
/pin19 = pin5				; U14, CLK2
And what do you know? The darned thing works.

For those who just want the programmer JEDEC file, I've attached it as SB20JED.ZIP.

With that done, let's try a harder case--the ROM address PAL for the Trantor T130B SCSI adapter.