Aha- my bad on Sea Duel- I hadn't corrected the bit you found about a year ago. Still nice to confirm the lower 7 bits of 6 rev E games.
It would be nice not to have to destroy every TMS1100, but definitely a lot more work! I probably wouldn't even need to use any acid on the die just to extract the PLAs.
I was talking to Kevin about the possibility of loading in addresses of opcodes to execute that would output the different O PLA patterns, but I haven't worked on it. It's similar to his idea about how to figure out the 8th bit by executing the instruction and seeing if the new program counter indicates that a jump was taken.
Or, since the O PLA is limited to 20 patterns, I could just do an LA capture of the port while exercising the game to try to grab them all. For games with 7-segment LEDs, half of them would be pretty easy to figure out. But I couldn't be sure that I got them all, and I wouldn't know what accumulator value each one was associated with. I guess comparing the capture to a run through MESS could answer the questions.
It would be good to have a method in case we had access to a TMS1100 that the owner didn't want to destroy. In fact, Rik has Black Knight Pinball. That one's probably a simpler case because it likely has the same PLAs that Raise the Devil had, so the (8-bit) ROM dump would be enough.