Lower 3 bits of address are passed to the scoreboard's address lines. Lower 4 bits of data are passed to the scoreboard data lines. DEN1' (pin 8 on J1) and DEN2' (pin 9 on J1) connect to WR' on scoreboard ICs which presumably cause the displayed data to update itself. DEN1' is active if address bit 4 is set. Otherwise, DEN2' is active. Scoreboard is written to when total address range is between 0xE030 and 0xE03F.
The annunciator intercepts scoreboard pin 8 which is DEN1' and can optionally override it by going through a PAL 16 R4. PAL can detect when skill LED is being changed because the data will be 0xCC (however, Shaun Wood says that only data bits 1, 2 and 3 actually matter, so 0xC or 0xD would work also).
Address $E03E enables CADET LED, $E03D is CAPTAIN LED, $E03B is ACE LED. $E03F clears all skill LEDs. $E038 enables all LEDs. Dissected further, bit 4 of the address must be high (DEN1' is low).
So the algorithm for each of the outputs of the PAL translates into something like this:
|LEDSKILL' (internal signal that is not part of the schematic)||NOT(DATA3) OR NOT(DATA2) OR DATA1|
|CLK||LEDSKILL' OR DEN1'|
|WRITE' (the DEN1' pass through)||NOT LEDSKILL' OR DEN1'|
A flipflop (like a '374) would need to be used to retain state. ACE' would correspond to ADDR2, CAPTAIN' would correspond to ADDR1, and CADET' would correspond to ADDR0 (when stored by the flip flop).
For more info: http://wood1st.com/Other/Annunciator.txt
A note on timing
DEN1' won't go low until the Z80's W' pin goes low and the ADDR and DATA lines will be stable before and after this occurrence. In other words, DEN1' won't go low until ADDR and DATA are stable and will go high before ADDR and DATA become unstable. So using the flipflop's CLK should be safe. WRITE' also should not go low at all when the skill LED's are being changed.
0xC and 0xD will never be passed to the player1 area of the scoreboard
See this helpful youtube video: https://www.youtube.com/watch?v=DV5Nkk9Len0&feature=youtu.be
It proves that the annunciator U1 chip will suppress all attempts to send 0xC or 0xD through to the scoreboard.