CPLD Unlock: Reading Protected MAX, XC9500 & MachXO

Why CPLD Unlock Matters in Legacy Recovery

Complex Programmable Logic Devices sit at the heart of thousands of industrial, telecom and automotive boards designed between the late 1990s and mid-2010s. When one of those boards reaches end-of-life and the original design files are gone, the CPLD often holds the only copy of the glue logic that ties the rest of the system together. A successful CPLD unlock lets an engineer read back that configuration so the board can be duplicated, redesigned, or simply kept running.

Unlike microcontrollers, CPLDs store their logic in non-volatile cells (EEPROM or flash) rather than external memory. The configuration is always “inside” the chip. That makes read-back protection the single gate between you and the data you need. Understanding how each vendor implements that gate is the first step toward a realistic recovery plan.

How CPLD Security Differs From MCU Protection

Microcontrollers such as STM32 devices with read-out protection typically guard a large linear flash space with multi-level lock bits and, in newer parts, hardware-backed secure enclaves. CPLDs are simpler in architecture but not necessarily easier to defeat. Their protection usually takes one of three forms:

• Security bit (single fuse or EEPROM cell) — disables the JTAG read-back path while leaving programming intact.
• Encrypted bitstream — the device accepts only an encrypted configuration file and stores it in an encrypted form. Read-back returns ciphertext.
• One-time-programmable (OTP) lock — a physical fuse that cannot be reversed by electrical means.

Most CPLDs from the era of MAX II, XC9500 and MachXO use the first method. The security bit is stored in the same EEPROM or flash array as the configuration data, which is both the weakness and the opportunity.

Altera (Intel) MAX Series: Security Bit Behaviour

MAX 7000 and MAX II / MAX V

Altera’s classic MAX 7000 family (EPM7032, EPM7064, EPM7128, EPM7256) uses an EEPROM-based architecture with a single security bit. When set, the bit blocks JTAG read-back and verify operations. However, a full-chip erase also clears the security bit — a design choice that protects intellectual property during normal use but means the data cannot be read without erasing it first, unless an alternative path is used.

For the MAX II (EPM240, EPM570, EPM1270, EPM2210) and MAX V families, Altera moved to a flash-based configuration fabric with a user-flash block (UFM). The security model is similar: a dedicated bit disables JTAG read-back. Programming and erase remain available. Key points:

Practical CPLD Unlock Paths for MAX Devices

For MAX 7000 through MAX V, the most common recovery approaches are:

1. Non-invasive JTAG probing — If the security bit was never set (more common than engineers expect), a standard read-back through Quartus or a third-party SVF player retrieves the full JED or POF file.
2. Voltage and timing manipulation — Carefully controlled supply glitching during the security-bit check can cause the device to skip the protection test. This technique is device-revision-dependent and requires precise lab equipment.
3. Decapsulation and micro-probing — The die is exposed and the EEPROM cells are read optically or with a probe station. This is the method of last resort because it is destructive to the package, though the die itself survives when handled correctly.

MAX 10 devices introduce AES-128 bitstream encryption stored in on-chip eFuse. When encryption is active, even a successful read-back returns ciphertext. Recovery then depends on whether the key can be extracted through physical analysis — a significantly harder problem that overlaps with FPGA bitstream extraction techniques.

Xilinx (AMD) XC9500 Series: ISP Security

XC9500, XC9500XL and XC9500XV

Xilinx’s XC9500 family remains one of the most widely deployed CPLDs in legacy industrial equipment. All three sub-families use EEPROM storage and a JTAG-based In-System Programming (ISP) interface. The security model consists of a read-protect bit per device (not per macrocell) that disables the JTAG VERIFY instruction.

Important details for anyone attempting a CPLD unlock on XC9500:

• The ERASE instruction clears both the configuration and the security bit. This is documented in the Xilinx BSDL and SVF programming specifications.
• The XC9500XL added a low-voltage (3.3 V) process that changed internal timing but not the fundamental security architecture.
• Unlike some FPGA families, the XC9500 does not support bitstream encryption. Protection relies entirely on the single read-protect bit.

Recovery Techniques

Because there is no encryption layer, the goal of any XC9500 unlock is to bypass or ignore the read-protect bit. The approaches mirror those for Altera MAX:

1. Check before assuming — Issue a standard JTAG IDCODE followed by a VERIFY sequence. If the original programmer forgot to set the bit (or set it only in the JED file without re-programming), the data comes back in clear.
2. Power-glitch attack — A controlled VCC dip during the security-bit evaluation window can cause the state machine to fall through to the read-back path. Success rates vary by silicon revision (older 5 V XC9500 parts are more susceptible than XC9500XL).
3. Die-level optical read — EEPROM floating-gate charge states can be distinguished under an optical or electron microscope after decapsulation. The bit pattern is then reassembled into a JEDEC file offline.

When the CPLD is part of a larger board recovery project — for example, an industrial control board that has passed end-of-life — the XC9500 unlock is usually combined with MCU and EEPROM reads to reconstruct the complete firmware set.

Lattice MachXO, ispMACH and LC4000 Families

MachXO and MachXO2

Lattice’s MachXO (LCMXO) and MachXO2 (LCMXO2) are flash-based CPLDs that blur the line between CPLD and FPGA. They contain both a non-volatile flash configuration and a volatile SRAM fabric that loads at power-up. Security features include:

• Security bit — blocks JTAG read-back of the flash configuration.
• Feature row protection — a separate set of bits that controls access to the feature row (device ID, user code, trace ID).
• AES-128 encryption (MachXO2 only) — optional encrypted bitstream with a key stored in flash or one-time-programmable (OTP) fuses.

MachXO (first generation) devices without AES encryption follow the same single-bit protection model as the Altera and Xilinx parts discussed above. MachXO2 with AES active is a harder target, comparable to encrypted FPGA bitstreams.

ispMACH 4000 and LC4000

The older ispMACH 4000 series uses EEPROM cells and a straightforward security bit. These devices are common in telecom line cards and networking equipment from the 2000s. Their unlock path is well understood and follows the same glitch or decap methodology. The LC4000V/ZE variants added lower-voltage operation but did not change the protection architecture.

Lattice-Specific Toolchain Notes

Lattice Diamond and ispLEVER both expose a “read back” function that respects the security bit. Third-party JTAG tools (OpenOCD, UrJTAG, custom SVF scripts) can sometimes access undocumented JTAG instructions that bypass the bit on older silicon revisions. This is not guaranteed and must be tested per device lot.

Comparing CPLD Unlock Difficulty Across Vendors

Devices rated 1–2 are routinely recovered with non-invasive or low-invasive methods. Ratings of 4–5 involve encryption and may require physical key extraction, which is not always feasible.

Step-by-Step: What a Typical CPLD Unlock Project Looks Like

1. Identify the device — Read the part marking, cross-reference the package and confirm the family. Mis-identification wastes time and can damage the chip if the wrong voltage is applied.
2. Attempt a standard read-back — Connect a JTAG adapter, verify the IDCODE, and try a full read. If the security bit is not set, you are done.
3. Assess protection level — If read-back fails, determine whether the device uses a simple security bit, encryption, or OTP lock.
4. Select the recovery method — For security-bit-only devices, non-invasive electrical techniques are tried first. Decapsulation is reserved for cases where electrical methods fail or the device is an older part with well-characterised die geometry.
5. Verify the recovered data — The extracted JED or bitstream is loaded into the vendor’s fitter tool to confirm it compiles without errors and matches the pin-out observed on the original board.
6. Deliver files — The output is a programming file (JED, POF, SVF or BIT) plus, when requested, an equivalent HDL netlist for future maintenance.

If the CPLD is only one part of a larger board, the recovered logic is combined with data from other chips — for instance, EEPROM or flash data recovery for parameter storage, or DSP chip decryption for signal-processing co-processors — to produce a complete firmware package.

When CPLD Unlock Feeds Into a Larger Board Duplication

In many real-world projects the CPLD is not the end goal — it is one piece of a full board recovery. The glue logic inside the CPLD defines address decoding, bus timing and peripheral control. Without it, even a perfect schematic is useless because the behavioural layer is missing.

A typical workflow might look like this:

• The physical board is scanned and the schematic is extracted through a board-level duplication process.
• Every programmable device — MCU, CPLD, EEPROM — is read or unlocked.
• The combined file set is verified on a prototype before volume production.

When the original CPLD is obsolete (many XC9500 and MAX 7000 parts are now end-of-life), the recovered netlist can be re-targeted to a current-production device as part of a redesign that updates the board without changing its behaviour.

Common Questions About CPLD Unlock

Does erasing the CPLD help?

Erasing removes the security bit and the configuration data simultaneously. It is useful only if you already have a backup and simply need to clear the lock for re-programming — not for recovery.

Can I unlock a CPLD myself with open-source tools?

If the security bit was never set, OpenOCD or UrJTAG can read back many CPLD families. If the bit is set, you need either glitching equipment or a decapsulation lab. DIY attempts on encrypted devices are unlikely to succeed.

Is CPLD unlock legal?

In most jurisdictions, reading back your own hardware for maintenance, repair, or interoperability is permitted. If you are working on a competitor’s product, consult legal counsel before proceeding. The same principles apply as with MCU unlock for Renesas or other vendor families.

How much does it cost?

Non-encrypted CPLDs with a simple security bit typically cost between USD 200 and USD 800 depending on the family and urgency. Encrypted devices (MAX 10 with AES, MachXO2 with AES) start higher because physical analysis may be required. Contact us for an exact figure through our project quote page.

Key Takeaways

• Most legacy CPLDs (MAX 7000, MAX II, XC9500, ispMACH 4000, MachXO) rely on a single security bit with no encryption — making CPLD unlock feasible and routine.
• Newer devices (MAX 10, MachXO2 with AES) add encryption that raises the difficulty significantly.
• Always attempt a standard JTAG read-back first; a surprising number of deployed devices were never locked.
• The recovered configuration file can be re-targeted to a current-production CPLD when the original part is obsolete.
• CPLD unlock is usually one step in a larger board recovery workflow that includes MCU, EEPROM and PCB extraction.

Related reading

• Sep 2026RF PCB Copy: What Changes With Layer Count
• Sep 2026NXP MCU Unlock: Kinetis, LPC and S12 Security Bytes
• Sep 2026GD32 Unlock: Where It Differs From STM32 in Practice