Analog Devices IC unlock work splits cleanly into two groups. The older ADuC mixed-signal microcontrollers (ADuC812, ADuC831, ADuC834, ADuC841, ADuC842, ADuC845, and the ARM7-based ADuC7xxx series) are the parts we read most often, and the ones where the odds are best. The DSP side — ADSP-21xx, Blackfin BF5xx, SHARC — depends almost entirely on whether the code lives on-chip or in an external boot flash. Send us the exact top marking and we’ll tell you which group your part falls into before you ship anything.
Why Analog Devices parts land on our bench in the first place
Almost every Analog Devices unlock request we see comes from one of four situations, and none of them involve copying somebody else’s product.
- Lost source code. An ADuC834-based weighing or gas-analysis board from the mid-2000s, the original developer retired, and nobody kept the hex file. The customer owns the design; the file is just gone.
- Legacy equipment support. Industrial instruments built around ADuC841 or ADuC7026 that still run in the field. A dead MCU means a dead instrument unless the firmware can be pulled from a working unit.
- Obsolescence. ADuC812 and ADuC842 are long past their prime. To move a design to a current part you need the existing binary as a functional reference, plus the calibration constants sitting in on-chip flash.
- Failure analysis. A field returns pile with intermittent behavior, and the on-chip data flash holds the fault log or trim values nobody documented.
We work under NDA, and we ask that you hold the rights to the design or have written authorization from whoever does. That’s the whole of the legal conversation — no lecture, just the condition we work under.
ADuC mixed-signal microcontrollers: the workhorse group
The ADuC8xx family is an 8052 core with a serious analog front end bolted on — 16- to 24-bit sigma-delta ADCs, DACs, an on-chip reference, and a separate Flash/EE data space alongthe program flash. Because the core is 8052-derived, the protection model is closer to classic lock bits and security fuses than to a modern debug-authentication scheme. Anyone who has worked on 8051-family unlock jobs will recognize the general shape of the problem: a small number of protection bits guarding a serial download path, and a die layout that is generous by 2020s standards.
ADuC812, ADuC831, ADuC834, ADuC841/842, ADuC845
These are the parts we handle most. Two things make them tractable. First, the geometry is old and the flash blocks are physically large, which matters for any approach that needs to see the die. Second, the on-chip serial downloader is a documented factory feature, and the protection bit that gates it is one specific piece of state rather than a chain of cryptographic checks.
What you should care about on these parts is the data flash, not just the program flash. Instrument designs from this era park their calibration constants — ADC gain and offset, thermocouple linearization tables, serial numbers — in the Flash/EE space. If we hand back only the code and not that data area, you get a board that boots and reads garbage. When we quote an ADuC845 job we quote both spaces, and we tell you if one of them appears to have been erased by a previous field-service attempt.
ADuC702x, ADuC703x, ADuC706x (ARM7TDMI)
The ADuC7020, ADuC7024, ADuC7026, ADuC7060 and their siblings put an ARM7TDMI core behind the same kind of precision analog. They’re a step up in difficulty: there’s a JTAG port, a protection mechanism that can disable it, and a flash controller that has to be persuaded rather than simply read. They’re still a family we take on regularly, and turnaround is usually longer than an ADuC842 by a meaningful margin rather than a small one.
Two details change the answer on ADuC7xxx parts. One is whether the JTAG protection was actually set — a surprising number of production boards were shipped with the debug path open because the manufacturing script never wrote the protection word. That’s a five-minute answer, and it’s the first thing we check. The other is whether the part is a later revision, since silicon revisions inside the same part number are not always equivalent from a protection standpoint.
ADuCM302x, ADuCM36x, ADuCM4050 (Cortex-M)
The Cortex-M generation is a different animal. ADuCM360 and ADuCM302x-class parts have modern debug-lock behavior and, in the higher-end devices, key storage and secure-boot features that were never present on an ADuC842. We evaluate these case by case and we say no more often than we say yes. If your project is an ADuCM part, tell us early — the honest answer may be that rebuilding the firmware against your surviving requirements documents is a better use of your budget than an extraction attempt.
Analog Devices DSPs: where the code lives decides everything
For Blackfin, SHARC and the older ADSP-21xx fixed-point parts, the first question isn’t about the DSP at all. It’s about the memory next to it. Most Blackfin BF531/BF533/BF537 designs boot from an external SPI flash or parallel NOR device, and most SHARC designs boot from an external EPROM or flash. If that’s your board, you may not need a DSP unlock at all — you need the external memory read, which is a far simpler and cheaper job.
Where it gets harder is the Blackfin parts that use on-chip O
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote