ATF15xx CPLD unlock is usually feasible, and it is a different job from unlocking a microcontroller. There is no firmware image to dump — what you get back is the device’s fuse map, converted into a working JED file that programs a blank ATF1502, ATF1504 or ATF1508 to behave exactly like the original. Feasibility depends on the specific die revision, whether the security bit was set at programming, and the physical condition of the part you send.
If you’re a maintenance engineer with a dead controller board and one surviving CPLD, that’s the outcome you care about: a JED file you can hand to a programmer, plus a verified blank part that works in the socket.
Why the ATF15xx family behaves differently from an MCU
The ATF1502AS, ATF1504AS, ATF1508AS and their low-voltage and “ASV/ASL” variants are EEPROM-based CPLDs. Logic lives in a fuse array — product terms, macrocell configuration, global clock and OE routing, pin assignments — not in a byte-addressable program memory. When the security bit is programmed, the JTAG and ISP verify path stops returning that array.
So “unlock” here means recovering the array contents in a form that can be re-programmed and re-verified, not extracting C code or assembly. That distinction matters for two reasons. First, there’s nothing to disassemble, so nobody can hand you readable source. Second, verification is unusually clean: once we have a candidate fuse map, we can program a blank device and compare its behavior pin-for-pin against the original on a bench fixture. Either the outputs match on every vector or they don’t.
What you can realistically get back
- A JED fuse file that programs a blank ATF15xx part of the same device and package.
- A programmed, tested sample — usually one or two units, verified against your original.
- A pin/signal map showing which pins are inputs, outputs, bidirectional, clock and OE.
- Optionally, recovered logic equations — a readable set of sum-of-products expressions derived from the fuse map, useful if you plan to port the design to a current part.
That last item is the one people underestimate. Atmel’s ATF15xx line is long discontinued in most package options, and the fitter software that produced the original JED is itself legacy. If your real problem is a ten-year production horizon rather than a single repair, ask for the equations, not just the fuse file.
What determines whether your ATF15xx CPLD unlock is feasible
We answer this per part, not per family. The variables that actually move the needle:
- Exact device and marking. ATF1502AS, ATF1504AS and ATF1508AS differ in macrocell count and array size, and there are several die revisions across the production life of each. Silkscreen and date code both matter.
- Package. PLCC44 and TQFP44 are straightforward to handle. PQFP100 and 160-pin parts take more fixturing time. BGA versions add a rework step before anything else can happen.
- Whether the security bit is actually set. Surprisingly often it isn’t. The first thing we do is attempt a normal JTAG readback — if that returns a valid array, the job is a read, not an unlock, and it’s fast and cheap.
- Physical condition. A part that survived a power event, a lightning strike or a reverse-polarity insertion may have damaged array cells. If the logic is partly corrupted, no recovery method gets it back cleanly.
- Board removal. Desoldering a PLCC from a 1990s FR-4 board with tin-lead pads and no thermal relief carries real risk. Send a spare if you have one.
Cases that are harder, and cases we decline
Honest list, because it saves both of us time. Later ATF15xx die revisions with tighter security handling are harder than early ones and sometimes need a semi-invasive route. Parts that have been repeatedly reprogrammed near end-of-endurance can produce marginal cells that read differently on consecutive passes — we flag that rather than ship a guess. Parts that are physically cracked, previously decapped by someone else, or already partly ground down are usually a decline. And if you only have one device in existence and the board still functions, we’ll tell you the risk honestly before touching it.
We never guarantee a specific device is recoverable. What we do is run a paid or free evaluation first, tell you yes/no/maybe with a reason, and only bill the full job on a verified result.
How the job actually runs, step by step
- Identification. Marking, package, date code, and any board-level clues about how the device is used — clock frequency, supply rail, whether ISP pins are brought to a header.
- Non-destructive readback attempt. JTAG chain check, device ID read, verify attempt. This tells us whether security is set and whether the part is electrically alive.
- Behavioral characterization. The original goes into a test fixture. We drive the inputs, log the outputs, and build a truth-table and timing picture. For a synchronous design we clock through state sequences. This step is also how we detect internal registers and feedback that a static test would miss.
- Array recovery. The technical work of getting the fuse map out. Route depends on the die revision and on what step 2 told us. Some parts go a non-invasive electrical path; others need decapsulation and a semi-invasive approach.
- Reconstruction and fit. The raw array is assembled into a JED file with correct pinout and device selection.
- Verification. A blank part is programmed and compared against the original on the same fixture, same vectors, same clock rate. If a single output disagrees, we go back to step 4.
- Handover. JED file, pin map, optional equations, programmed samples, and your original device returned.
Step 3 is where a lot of budget labs cut corners. A fuse map that programs without error but was never behaviorally compared against the original is not a verified result — it’s a hypothesis. Ask any vendor how they verify, and listen for whether the answer involves the original part.
What drives cost, and what drives lead time
Two different things, so we price them separately in the quote.
| Factor | Effect on cost | Effect on lead time |
|---|---|---|
| Security bit not set (plain readback) | Lowest tier | Shortest — often same-week |
| ATF1502 / ATF1504, PLCC or TQFP | Baseline | Baseline |
| ATF1508, high pin count package | Higher — more macrocells, more test vectors | Longer fixturing and verification |
| Late die revision needing semi-invasive route | Meaningfully higher | Meaningfully longer |
| Only one device available, no spare | Higher — slower, more cautious handling | Longer |
| Recovered logic equations requested | Add-on | Adds a few days of analysis |
| Programmed spare parts supplied | Add-on, depends on blank availability | Depends on sourcing obsolete blanks |
Blank part availability is the schedule risk people don’t anticipate. ATF15xx devices in some packages have thinned out badly in the distribution channel, and the counterfeit rate on marketplace stock is not zero. If you need programmed replacements rather than just a file, tell us the quantity up front so sourcing runs in parallel instead of after the fact.
We won’t quote a number on a web page, because the range across the cases in that table is wide enough that any single figure would mislead you. Send the device details and you get a real number, usually within a business day.
What to send us to get a quote
Keep it to this and we can usually answer without a phone call:
- Clear photos of the chip top marking — full part number, date code, and any second-line marking. Shoot straight down, in even light, no flash glare across the laser mark.
- Photos of both sides of the board on a dark background, whole board in frame, so we can see the package, the surrounding circuitry and whether an ISP header exists.
- Board dimensions and how many devices are on it.
- Whether the board still powers up and whether the CPLD is believed good.
- How many units you have — one, a spare, or a shelf of them.
- One line on deliverables: file only, file plus programmed parts, or file plus equations for a redesign.
Back from us: a feasibility opinion with the reasoning behind it, a lead time, a price, and a statement of what happens if it fails. If we think the honest answer is “try a redesign instead,” we’ll say that. Recovering a small ATF1502 design from behavior alone is sometimes cheaper than unlocking it, and we’d rather tell you than take the larger invoice.
Legitimate use, and where this fits
The ATF15xx work we see is almost entirely obsolescence and repair: a machine tool controller from 2003 whose CPLD source is on a dead server, a medical instrument with a five-year service obligation, a defense spare where the original design house no longer exists. Failure analysis and authorized security research come up too. You need to hold the rights to the design or have the owner’s authorization, and complying with applicable IP law is your responsibility — every project runs under NDA, and we’re happy to sign yours rather than ours.
If your CPLD sits on a board you also need reproduced, the two jobs pair naturally: array recovery on the logic device, plus schematic and Gerber recovery on the board itself. Neighboring families we handle the same way include Xilinx XC9500 CPLD recovery and Altera MAX II decryption work, and if there’s a companion microcontroller on the same board — an 8051 derivative, a PIC, a
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.Working on a board like this?
Related reading