Re: reading protected pals
I'm not sure about PAL, but I know that with re-programable/erasable chips, you can read them back even if protected. This, however, involve precise timing and control of the Vcc/Vpp lines.
The technique involved is known as 'glitching'. The way it work is that you do a device erase or similar action, but with precise timing, you glitch the power on the Vcc or Vpp lines. Now, don't ask me how it's done, and the timings, but you may be able to find something on the Net about this.
What happen is that when you perform the operation, you tell the chip to erase itself. This is usually performed inside the chip as a sequence of event, like a little program, but the glitching on the power pin will make the sequence go nuts. If done at the right time, with the right pulse (glitch) width, the device will be left in a mode which you can actually read back the content, or make only the protection fuse be unprogrammed.
For example, let's suppose the chip erase it's array content, and finally erase the lock bits. If, during the array erasure, you lower Vpp to a lower level, the array may be kept intact, and when it come to erase the lock bits, you put full Vpp, and the lock bits (and only the lock bits) get erased.
As you can see, this require very precise timing, you can't control this with a PC, you need a micro-controler (which can be controled via a PC if you wish).