Reading contents of Altera PLD - Page 1
Forum section: electronics / general

author: dorkshoei
author_rank: Frequent Contributor
timestamp: February 08, 2023, 11:08:31 pm
content: I have a couple of pcbs with Altera PLDs - late 1990s, early 2000s era - that I'd like to try to read the programming off.One is an EPM7128SQC100-10 (100-BQFP, MAX 7000 series) and the other a EP1K30QC208-1N (208-BFQFP, ACEX 1K series)The MAX 7000 data sheet states that it has a programmable security bit to prevent device contents from being read but I can't find similar mentioned in the ACEX 1K datasheet.Each pcb has a 10 pin header which appears connected to the PLD, JTAG? Will this (and appropriate software) be able to read the programming (if not security protected)?https://www.aliexpress.us/item/3256801662617764.html

author: AK6DN
author_rank: Regular Contributor
timestamp: February 09, 2023, 04:36:17 am
content: Yes, that hardware is a USB Blaster clone and is capable of programing images thru the JTAG port with the appropriate software (Quartus II 13.0sp1 for the EPM device).However, a couple of caveats. If the EPM security bit was set, you can't read it. It can only be erased and/or reprogrammed.Also, to actually read the EPM device requires a version of the Quartus software no longer available on the Intel/Altera website (ie, a version prior to 13.0sp1).You can get such software, but you now need to convince Intel to sign an NDA with you for access to it. Possible, but not easy.Better to assume that you don't need the images in the current devices and you just want to reprogram. The USB dongle plus public software will do that.I don't know anything about the ACEX device, never used it. I use Quartus 13.0sp1 with a TerAsic USB blaster clone with EPM7xxxS devices today.

author: dorkshoei
author_rank: Frequent Contributor
timestamp: February 09, 2023, 07:48:33 am
content: Quote from: AK6DN on February 09, 2023, 04:36:17 amI realize this.QuoteBut I do. This is the entire reason for the question.Is there no archive of the old software?

author: AK6DN
author_rank: Regular Contributor
timestamp: February 09, 2023, 10:51:52 pm
content: Quote from: dorkshoei on February 09, 2023, 07:48:33 amI am sure you are aware that the software image in the FPGA is just the bits. Can only be used to reprogram an exact same device.You can't tell what the functionality of the device is by looking at the program image (it is a .pof file and the format details are Altera/Intel proprietary).As to old software, under Altera they left all the old versions of MaxPlus and Quartus online for download.Once Intel bought Altera they undid this policy, in typical Intel fashion.So the earliest version of Quartus now available is 13.0sp1, which supports the MAX7xxxS series among others. Non-JTAG parts are not supported.Full synthesis, programming, and verification. But reading an existing device is NOT supported in the programmer tool. Exactly why who knows.The next most recent version of Quartus is then 17.0 and later, up to 22.4 which I think is now the most recent.Old versions of MaxPlus or Quartus are no longer online for download. If you can get Intel to offer you an NDA they may get you a deprecated versionvia private download. I have seen all the requests for this but have no personal experience doing it.

author: dorkshoei
author_rank: Frequent Contributor
timestamp: February 10, 2023, 12:14:58 am
content: Quote from: AK6DN on February 09, 2023, 10:51:52 pmIve never thought about things in the reverse direction. I assumed (wrongly) that as long as the security bit wasn't set there was some way to infer the design from the bitstream.I was able to find 12sp2 online but sounds like it won't do me much good.

author: AK6DN
author_rank: Regular Contributor
timestamp: February 10, 2023, 03:31:53 am
content: If you somehow get access to software to be able to read the .pof file from the device, this document:http://matthieu.benoit.free.fr/dataio/2900/2939u_book1.pdfon page 5-9 and following describes the .pof file data structure. However it won't tell you what the data bits mean with respect to logic inside the device.One interesting path is to use the Atmel/Microchip POF2JED program (https://www.microchip.com/en-us/development-tool/POF2JED)to translate an Altera .pof file to an Atmel .jed file to program a fit/form/function compatible device.The .jed file is ascii text and breaks the programming bits out into logical fields and macro blocks that give a lot more info about the device function.I think tho that some info from Atmel would still be needed (beyond what it supplied in the public datasheet) to parse the functions of all the bits.

author: dorkshoei
author_rank: Frequent Contributor
timestamp: February 10, 2023, 07:58:51 am
content: Quote from: AK6DN on February 10, 2023, 03:31:53 amThanks.so the AliExpress link in first post should work with 12sp2 to read the bitstream (assuming of course the security bit is not set).

author: AK6DN
author_rank: Regular Contributor
timestamp: February 11, 2023, 02:10:28 am
content: Quote from: dorkshoei on February 10, 2023, 07:58:51 amWell, I downloaded the Windows version of 12.0sp2 and installed on my laptop. No dice. Same behavior as 13.0sp1. 'Examine' (aka read) is NOT available.Program/Verify/Erase/BlankCheck/SetSecurityBit can all be enabled on/off. Not Examine(Read). Just like it is disabled in 13.0sp1.My recollection is you need a much earlier version like 9.x or 10.x which still had Examine capability.Or put the part on a 3rd party programmer. They can read the device images back. It is not a hardware issue, but a software issue/restriction/limitation.

author: dorkshoei
author_rank: Frequent Contributor
timestamp: February 11, 2023, 04:06:55 am
content: Quote from: AK6DN on February 11, 2023, 02:10:28 amMaybe someone will chime in with a location for v9/v10.The device list for my BK Precision 866 (rebadged Elnec BeeProg) contains EPM7128S support but nothing for EP1K (ACEX 1K):Altera EPM7128S  (743)Altera EPM7128S (ISP) (138)(9997)Altera EPM7128S (ISP-Jam) (138)Altera EPM7128S (ISP-SVF) (138)(138) Note: via ISP connector(9997) Paid ISP support, usage of this device require active 'Credit box' attached to PC(743) DIL48/QFP100 ZIF PLD-5 (ord.no. 70-0500)The 9997 is classic Elnec, I thought that !#$% only applied to their later programmersIf I fire up the software only the ISP-Jam and ISP-SVF options are available. I have no idea if I can read a device using these? They seem more geared to programming. I'm not buying the adapter.https://www.mouser.com/datasheet/2/612/m7000-1299427.pdfhttps://www.mouser.com/datasheet/2/612/acex-1299421.pdf

author: coromonadalix
author_rank: Super Contributor
timestamp: February 13, 2023, 10:39:37 pm
content: v9.1 sp2 ??https://archive.org/details/91sp-2-quartus-freev8https://archive.org/details/quartusii_80_winv9 ??https://archive.org/details/90-quartus-freeNote1: During the installation process the installer will give you anoption to enable "talk back feature". Make sure that you enable thisfeature, otherwise you will not be able to use "Signal Tap Logicanalyzer" in Quartus II.Note2: A separate announcement named "Troubleshooting" showsyou how to enable "talk back feature" if you forget to enable it duringthe installation step

author: dorkshoei
author_rank: Frequent Contributor
timestamp: February 13, 2023, 10:52:30 pm
content: Quote from: coromonadalix on February 13, 2023, 10:39:37 pmI'd already found v9.1 at the above location. I didn't post the URL here as I didn't want to risk potentially getting archive.org into trouble with Intel. Instead I PM'd it to AK6DN. It will install into Windows 10 sandbox and runs.Odd, after I found it I searched the site for other versions and drew a blank.I'm assuming IF these versions support examine, that the AliExpress device I linked to in OP will work to read it?[EDIT: @AK6DN can you confirm?]

author: AK6DN
author_rank: Regular Contributor
timestamp: February 14, 2023, 12:50:21 am
content: Using this search:https://archive.org/search?query=subject%3A%22quartus%22I found Quartus 9.1sp2, 9.0sp2, and 6.1 installs.Tried both 9.1 and 6.1 on my Win7 laptop, and neither one allows the EXAMINE of the Altera MAX EPM7064SLC-44 device I have on my test board.They both VERIFY and PROGRAM my device successfully. EXAMINE aka READ is not available however.Using this search:https://archive.org/search?query=subject%253A%22maxplusII%22I found MaxPlusII 10.23, 9.3, 8.0, and 7.22 installs.Haven't tried them yet, documents indicate they require WinXP at the latest; no mention of Win7 support (I think they predated its release).Not sure which (if any) of them support the USB Blaster, might require the older LPT port BitBlaster device. IDK at this point.I do have an EEtools TopMaxII which does support the MAX series parts (original and JTAG versions) for PROGRAM, VERIFY, ERASE, READ.I have the required PLCC44 to DIP48 adapter (just have to solder it together) and could try my EPM7064S device on the programmer.I believe tho that the programmer does not use the JTAG port for device access, it uses the legacy parallel programming access pins, even on JTAG devices.

author: dorkshoei
author_rank: Frequent Contributor
timestamp: February 14, 2023, 04:15:43 am
content: Quote from: AK6DN on February 14, 2023, 12:50:21 amCould the lack of examine be related to the specific device you're using or some other local-to-your-hw issue?It seems odd to have an examine option present but disabled for 7 major releases (6.1 to 12.1). You'd think they'd remove it.

author: AK6DN
author_rank: Regular Contributor
timestamp: February 14, 2023, 06:39:36 am
content: Quote from: dorkshoei on February 14, 2023, 04:15:43 amWell, because of the way the software is setup (the programming screen) you have a spreadsheet like row(s) of devices and columns of capabilities that you enable on/off via checkboxes. Like PROGRAM, VERIFY, etc. Here is the image of the screen, attached at the end.Documentation indicates that as of 13.0sp1 EXAMINE is no longer supported for the MAX series. It was not something I ever had a need to use anyway, so it really does not matter to me. I always had the source and .pof file image. PROGRAM and then VERIFY is how I operate.Notice that the EXAMINE, ERASE, and ISP CLAMP checkboxes are greyed out and cannot be selected for this device. This is a screen shot of 13.0sp1, but I see the same basic layout on the 6.1 and 9.1 versions of QuartusII. Same boxes are greyed out." alt="" class="bbc_img" />

author: dorkshoei
author_rank: Frequent Contributor
timestamp: February 14, 2023, 07:00:02 am
content: Thanks. I'd seen the general spreadsheet format when I ran 9.1 in the sandbox but because I didn't have the usb programmer it wasn't as obvious as on your attached screenshot.I just ordered the usb blaster and will see what I can see when it arrives.So the docs claim examine for this max series was removed starting in 13.1?Oh and thank you for all your help.

author: AK6DN
author_rank: Regular Contributor
timestamp: February 14, 2023, 06:09:00 pm
content: Quote from: dorkshoei on February 14, 2023, 07:00:02 amNot quite. 13.1 is the last version of Quartus that supports the MAX series. I happen to use 13.0sp1 the prior version. It does NOT support examine.I also have both 9.1sp2 and 6.1 Quartus installed on my laptop and neither support examine for the MAX series.None of the release notes for 6.1, 9.1sp2, or 13.0sp1 say anything about lack of examine capability for the MAX series parts.It may very well be that MaxPlusII, the prior incarnation of Quartus, is the last version that supported this capability. Just guessing at this point.

author: dorkshoei
author_rank: Frequent Contributor
timestamp: February 14, 2023, 06:29:14 pm
content: https://www.intel.com/content/www/us/en/support/programmable/articles/000080100.htmlYes, you can use the Examine feature in the Quartus® II Programmer to read back the .pof. You can then save this file and use it to program other CPLDs (of the same device code) or EPCS devices.If the security bit for a CPLD is enabled, you will not be able to read back a valid .pof.[this article applies to 2 products MAX® 7000B CPLD MAX® 7000A CPLD, Last Reviewed: 09/11/2012]

author: AK6DN
author_rank: Regular Contributor
timestamp: February 14, 2023, 10:35:11 pm
content: Quote from: dorkshoei on February 14, 2023, 06:29:14 pmTechnically yes that is what I would expect.The 5.0V MAX7000S, 3.3V MAX7000A, and 2.5V MAX7000B are all 2005 or so generation devices.They all are JTAG programmable.But that article does not indicate a QuartusII version that specifically supports the EXAMINE feature.QuartusII v9 handbook I have is from 11-2009; Quartus v12 handbook is from 11-2012. The article is from 09-2012.So one would expect v9 Quartus to be able to EXAMINE the device via JTAG. But it can't...

author: dorkshoei
author_rank: Frequent Contributor
timestamp: February 14, 2023, 10:45:47 pm
content: Quote from: AK6DN on February 14, 2023, 10:35:11 pmWhen I get my USB blaster I'll try. If I can't get examine to work I'll ask Intel and reference that article.

author: AK6DN
author_rank: Regular Contributor
timestamp: February 15, 2023, 01:41:35 am
content: For reference, using 13.0sp1:I can PROGRAM/VERIFY the EPCS4 eprom attached to my CycloneII EP2C20 device via the .jic file I use.I can also read it back via EXAMINE to a new .jic file. And PROGRAM and VERIFY using that file.I can PROGRAM the .sof file directly to the EP2C20 device. VERIFY or EXAMINE options are not supported.So maybe the EXAMINE function only works on attached image storage EPROMs? Just guessing at this point.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: February 16, 2023, 09:54:31 am
content: Regarding the ACEX: it is a SRAM-based FPGA without permanent storage. Look for external EPCxx configuration EPROM near it - that’s the part to read.