Short answer: Altera IC unlock is realistic on older EEPROM-based CPLDs — the MAX 7000 family (EPM7032, EPM7064, EPM7128, EPM7256) and MAX II / MAX V parts such as EPM240 and EPM570 — where the goal is recovering a POF or JEDEC file you already own. Cyclone and Stratix FPGAs have no internal user flash, so the work moves to the external configuration device instead. Anything with AES bitstream encryption enabled is normally not feasible.
That’s the honest shape of it. Below is what actually determines the answer for your specific part, what we need from you, and where the limits sit.
What “unlocking” an Altera part really means
Altera devices don’t hold firmware in the sense an MCU does. A CPLD holds a fuse map — the logic configuration — and that map is protected by a security bit set at programming time. When the bit is set, Quartus can still verify a blank check and read the device ID, but a readback returns garbage or fails outright. That’s the barrier.
So an Altera IC unlock job has one deliverable: a usable configuration file. Depending on the part, that’s a POF, a JEDEC (.jed) fuse map, an SOF, or a raw RBF/binary dump of the configuration device. From there you can reprogram fresh silicon, or hand the fuse map to a logic engineer for further analysis.
CPLD versus FPGA — two different jobs
This distinction changes everything about feasibility, cost, and lead time, and most pages on this topic blur it.
CPLDs (MAX series) store the configuration on-chip in EEPROM or flash. The design lives inside the package. Recovery means getting past the on-die security bit.
FPGAs (Cyclone, Arria, Stratix) are SRAM-based. They lose everything at power-down and reload from an external device on every boot — an EPCS/EPCQ serial flash, an EPC configuration device, or a host CPU pushing the bitstream over passive serial. If your board has a Cyclone on it, the design you want is almost certainly sitting in an 8-pin or 16-pin flash chip next to it, and that’s a far simpler read.
Which Altera parts are realistic and which aren’t
| Family / part | Where the config lives | Typical feasibility |
|---|---|---|
| MAX 7000, 7000S, 7000AE (EPM7032–EPM7256) | On-chip EEPROM, single security bit | Usually good — mature, well-characterized parts |
| MAX 3000A (EPM3032–EPM3256) | On-chip EEPROM | Usually good, similar to MAX 7000 |
| MAX II / MAX IIZ (EPM240, EPM570, EPM1270) | On-chip flash (CFM) | Case by case — depends on date code and lot |
| MAX V (5M40Z, 5M240Z, 5M1270Z) | On-chip flash | Harder; evaluate before quoting |
| MAX 10 (10M08, 10M50) | On-chip flash, optional AES | Difficult; not feasible if encryption is enabled |
| Cyclone / Cyclone II–V, Arria, Stratix | External EPCS/EPCQ or EPC device | Read the external device instead — usually straightforward |
| EPC1, EPC2, EPC1441 config devices | On-chip, OTP or reprogrammable | Often feasible; EPC1 one-time-programmed parts are their own case |
| Any part with AES bitstream encryption active | Key in fuses or battery-backed RAM | Not feasible — we will tell you no |
Two things worth flagging in that table. First, “usually good” is not a guarantee, and we don’t publish success rates because a single number across dozens of die revisions would be meaningless. Second, the AES row is not a soft no. If Stratix or MAX 10 encryption was turned on, the design is protected by a mechanism we won’t defeat, and no amount of lab time changes that.
What actually decides feasibility on your part
When a customer sends a part marking and asks “can you do it,” here’s what we’re weighing before answering:
- Exact orderable part number, not just the family. EPM7128SLC84-15 and EPM7128AETC100-10 are different silicon with different process nodes. The suffix matters more than the base number.
- Date code and lot. Later shrinks of the same part number sometimes behave differently. We look at the marking on the actual package, not the datasheet.
- Whether encryption is in play. On MAX 10 and the big FPGAs, this is a yes/no gate.
- Package and quantity. A PLCC-84 in a socket is easy to work with. A 484-ball BGA soldered to a six-layer board means desoldering, reballing, and a real risk to the only sample you have.
- How many samples you can supply. One irreplaceable part limits what we’re willing to attempt. Two or three opens up approaches that carry some risk to the device.
- Whether the board still runs. A working board lets us verify a recovered configuration functionally, which is the difference between “we got a file” and “we got the right file.”
The verification step nobody talks about
A fuse map that programs cleanly into a blank device is not proof of anything. What we do is program a fresh part with the recovered POF or JEDEC file, put it back in the original socket or a test fixture, and compare behavior against the known-good board — clock outputs, state machine transitions, chip-select timing, whatever the device is actually driving. If the recovered part behaves identically, you have something you can build with. If it doesn’t, we say so rather than shipping a file and calling it done.
This is also why we ask for the board and not just the chip whenever it’s possible. Recovering data is one problem; proving the data is correct is a separate one, and the board is the only reference that settles it.
Exactly what to send us, and what comes back
Getting a real answer instead of a vague one takes about five minutes of your time:
- A clear photo of the chip marking. Full top surface, in focus, readable. Include the date code line. Angle the light so laser marking doesn’t wash out.
- Photos of both sides of the board on a dark, matte background, whole board in frame, plus one close-up of the area around the Altera device. We’re looking for an adjacent EPCS/EPCQ flash, JTAG headers, and whether the part is socketed.
- Board dimensions and approximate layer count if you know it.
- How many samples you have and whether the board powers up and functions.
- One line on what you need: a POF for reprogramming, a JEDEC fuse map, a raw config-device dump, or the file plus a run of programmed replacement parts.
What you get back is a feasibility assessment for your specific part number — feasible, case-by-case, or no — plus a lead time and a price. If we think the answer is no, you hear it in that first reply, not after three weeks of billed lab time. Pricing on Altera work is driven by family and die revision, package and whether desoldering is needed, sample count, and whether you want verification and replacement programming on top of the file.
One more thing on scope. We work on parts our customers own. You confirm you hold the rights to the design, projects run under NDA, and complying with applicable IP law is on you. That’s the whole of it.
Why engineers come to us with Altera parts
The pattern is consistent. A machine built in 2003 has an EPM7128 doing address decoding and glue logic, the engineer who wrote the AHDL retired, and the source files were on a workstation that got scrapped. The CPLD still works, but there are no spares and the part is on allocation. Recovering the fuse map means you can program new devices and keep the line running.
The other common case is obsolescence-driven migration. You need the existing logic in a readable form so you can retarget it to a MAX V or MAX 10 part that’s still in production. That’s a documented engineering activity, and it’s usually paired with board-level work — the same customers often need the surrounding circuit captured too.
Failure analysis shows up less often but it does happen: a device that behaves oddly in the field, and you want to confirm the silicon holds the configuration you think it holds.
If your part is from a neighboring vendor, the approach is family-specific rather than universal — Lattice CPLD and FPGA recovery has a different security model, and the same is true for TI parts and their code security modules. Ask about the exact part you have rather than assuming the answer carries over.
Frequently asked questions
Can you read an EPM7128 with the security bit set?
Often, yes. MAX 7000 parts are mature and well-characterized, and this family is where most of our Altera IC unlock work sits. But the answer depends on the exact suffix and date code — an EPM7128S and an EPM7128AE aren’t the same silicon. Send a photo of the marking and we’ll give you a direct yes, no, or case-by-case answer.
My board has a Cyclone IV. Can you get the bitstream?
Almost certainly, but not from the FPGA. Cyclone parts are SRAM-based and hold nothing at power-off. The design lives in the external EPCS or EPCQ serial flash beside it, and reading that device is a much simpler job than attacking an FPGA die. Photograph the small flash chip near the Cyclone and include it in your inquiry.
How long does an Altera CPLD recovery take?
Reading an external configuration flash is typically a matter of days. An on-chip CPLD fuse map is meaningfully longer, because it involves device characterization, and adding functional verification and programmed replacement parts extends it further. We commit to a lead time only after we’ve seen the actual part
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote