A MAX II CPLD unlock means recovering the configuration data from a locked Altera MAX II device — EPM240, EPM570, EPM1270, EPM2210 and their Z/G variants — so you can reprogram replacement parts and keep a board in production or in service. Send us clear photos of the chip and the board plus the exact top marking, and we’ll tell you whether your specific device is a realistic candidate, what it costs, and how long it takes, before you ship anything.
MAX II is not a microcontroller, and that changes everything about this job. The logic lives in CRAM loaded at power-up from an on-chip flash block (the CFM), and the security bit that blocks readback is a device-level fuse, not a password you can guess. So the honest answer depends heavily on the exact die revision and how the part was locked.
Why engineers ask for a MAX II CPLD unlock in the first place
Almost every request we get falls into one of four buckets, and none of them involve copying somebody else’s product:
- The POF is gone. A machine builder from 2007 has a working board, a working EPM570, and no Quartus project anywhere. The engineer who wrote the logic left, the server was decommissioned, the backup tape is unreadable.
- Repair and spares. A CPLD died from a supply transient. Blank EPM240s are still available; the programming file is not. Without the configuration data the board is scrap.
- Obsolescence migration. You want to move to MAX V or a small MachXO, but you can’t rewrite the logic without knowing what the current part does.
- Failure analysis. Intermittent behavior on a fielded product, and you need to confirm the deployed device actually contains the revision you think it does.
All of these are ordinary maintenance engineering. We work under NDA, and we ask that you hold the rights to the design you’re sending — that’s the customer’s responsibility, and it’s the one thing we won’t take on trust for a product that clearly belongs to someone else.
What a locked MAX II device actually protects
Understanding the mechanism tells you why quotes differ so much between parts.
The security bit and verify protection
MAX II supports a security bit that disables readback and verify of the configuration flash through JTAG. Once it’s set, an ordinary programmer returns nothing useful. The device still runs normally — the CRAM loads from the CFM at power-up exactly as before — but the outside world can’t read the file back out. Unlike an STM32 with its RDP protection levels, there’s no tiered scheme to interrogate; it’s essentially set or not set.
What “unlocked” means here
The deliverable engineers usually want is a usable programming file — a POF, or a JAM/SVF stream — that programs a blank device of the same part number and produces a functionally identical board. In some cases the more practical route is a behavioral reconstruction: we characterize the device on the bench, derive the logic, and hand back source you can re-synthesize. That second path is slower but it gives you something you can maintain, which matters if the real goal is migrating off an end-of-life part.
How we work a MAX II job, step by step
- Marking and date-code review. The full top-line marking tells us the density, speed grade, package and often the fab revision. EPM240T100C5 and EPM240ZM100C7 are not the same problem.
- Electrical assessment. We check whether JTAG is reachable, whether the device responds to IDCODE, and whether the security bit reads as set. Sometimes a “locked” part turns out to be a broken JTAG chain, a series resistor someone stuffed wrong, or a TDO net tied into a buffer that’s holding the chain down. That’s a free finding, and it has saved customers real money.
- Feasibility call. Based on part number, revision, package and the condition of the device, we tell you go, no-go, or “we need to try and here’s the risk.” You get this before any invoice.
- Recovery work. Non-invasive electrical approaches first. If those don’t produce a clean result, semi-invasive work on the die is the fallback, which means the sample is consumed. We never take that step without written approval.
- Verification. This is the part that separates a real result from a hopeful one. We program a blank device of the same part number, install it on your board or on a test fixture, and compare behavior against the original: pin-by-pin logic states, clock and reset sequencing, and any interface the device drives. On a state machine driving a memory bus, we’ll capture both devices with a logic analyzer and diff the traces.
- Handover. The programming file, a note on the exact target part number it was validated against, and whatever bench notes we generated.
What to send us, and what you get back
Vague inquiries get vague answers. Send these five things and you’ll get a real quote, usually the same working day:
- The full chip top marking, transcribed as text, plus a sharp macro photo. Every line, including the date code and the small print.
- Photos of both sides of the board on a dark, non-reflective background, whole board in frame, in focus, no flash glare across the silkscreen.
- Board dimensions and roughly how many components — this matters if you may also want the board itself documented.
- How many devices you have, and whether you can spare one for destructive work. One sample versus five changes what we can attempt.
- One line on the deliverable: POF only, POF plus a programmed sample, or reconstructed logic source for a migration.
Back from us: a feasibility opinion with the reasoning behind it, the recommended approach, lead time, and price. If the answer is no, you get the no in plain language, not a stall.
Which MAX II cases are harder, and which we sometimes decline
This is where most vendor pages go quiet. Here’s the honest picture.
| Situation | How it usually goes |
|---|---|
| Security bit not actually set (surprisingly common) | Straight readback. Cheapest and fastest outcome — we check this first, free. |
| EPM240 / EPM570 in TQFP, security set, multiple samples available | Most tractable group. Larger package and spare parts both help. |
| EPM1270 / EPM2210, higher logic density | Feasible, but more configuration data to recover and verify, so longer and more expensive. |
| MBGA / micro-BGA packages, single sample | Harder. Handling and rework risk go up; if the one sample is destroyed there’s no second attempt. |
| Z-series low-power variants, late revisions | Case by case. We won’t quote these off a photo alone without saying the risk out loud. |
| Device already damaged, cracked, or previously decapped | Often no-go. We’ll say so rather than bill you for a study. |
| Board still functions and logic is simple | Behavioral reconstruction may be cheaper and better than recovery. We’ll suggest it if it’s the right call. |
Two things reliably change the answer: how many samples you can give up, and whether the board still powers up. A live board lets us verify against real behavior, which raises confidence enormously. A single dead chip pulled from a scrapped assembly is the hardest starting point there is.
We won’t quote a success rate. Anyone who quotes you a percentage on a specific MAX II die revision is making it up.
How MAX II compares to the MCU work we do
If you’ve had an MCU unlocked before, calibrate your expectations. On a locked microcontroller the target is a flash image you can disassemble and inspect — the workflow on a locked HCS12 automotive controller or a PIC24F with its code-protect bits ends with a hex file and a readable instruction stream. A MAX II result is configuration data, not code. It programs a replacement part correctly, but you can’t read it like firmware without a separate reconstruction effort.
That distinction matters for planning. If the goal is “keep building this board,” the programming file is enough. If the goal is “understand and modify the logic,” budget for the reconstruction step too, and expect it to take meaningfully longer than a simple readout on an 8-bit part.
Lead time and what drives price
A device where the security bit was never set can turn around in a day or two. A locked EPM240 with several spare samples is usually a matter of days. Higher-density parts, BGA packages, single-sample jobs and anything needing behavioral reconstruction and full bench verification run substantially longer, because the verification is the slow part, not the extraction.
Price tracks the same variables: device density, package, how many samples you can provide, whether destructive work is authorized, and which deliverable you need. We don’t publish a number for MAX II because the spread between the easy case and the hard case is large enough that any figure would mislead you. Send the marking and you’ll get the real one.
FAQ
Can you unlock an EPM240 or EPM570 with the security bit set?
Often, but not always, and it depends on the exact part number and die revision. Send us the full top marking and we’ll give you a specific answer instead of a generic yes. The number of spare samples you can provide has a big effect — with several devices we can attempt approaches that carry destructive risk, which are off the table with only one.
Will you damage my board or my chip?
Non-invasive electrical work leaves the device intact. Semi-invasive die-level work consumes the sample, and we never proceed to that stage without your written go-ahead and an explicit statement of what will be destroyed. If you send a populated board, tell us whether we may desolder the CPLD; we’ll quote both ways.
Do I get a POF file I can program myself?
That’s the standard deliverable where recovery succeeds — a programming file validated against a blank device of the same part number, so you can program spares with your own tooling. If you need editable logic for
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote