Feasibility on an ON Semiconductor IC unlock job depends almost entirely on which part number is on your board. CAT24 and CAT25 serial EEPROMs are usually a straightforward read. Sanyo-derived LC87 flash MCUs and AX8052-family radio SoCs are case-by-case. Modern RSL10 and NCS36510 Arm Cortex-M parts with debug access permanently disabled are frequently not feasible. Send the marking and we’ll tell you which bucket you’re in before you ship anything.
That spread exists because onsemi is a stack of acquisitions rather than one MCU roadmap — Catalyst, Sanyo Semiconductor, AMI Semiconductor, AXSEM, Fairchild. Each brought a different silicon generation and a different idea of what “protected” means. There is no single answer for the whole brand, and any lab that gives you one without asking for the part number is guessing.
Which onsemi parts actually turn up on locked boards
In practice, most inquiries land on one of five groups. The table below is a feasibility outlook, not a promise — the specific die revision, date code, and how many samples you have all move the needle.
| Family | What it is | Typical protection | Feasibility outlook |
|---|---|---|---|
| CAT24Cxx / CAT25xxx / CAT93Cxx | I2C, SPI and Microwire serial EEPROM (Catalyst legacy) | Write protect pin and block-protect bits; read is generally not blocked | Usually routine — the work is careful removal and a clean read |
| LC87 series | 8-bit flash MCUs inherited from Sanyo Semiconductor | On-chip protect bits, vendor-specific programming interface | Case-by-case; often possible, but documentation is thin and legacy |
| AX8052F100 / F131 / F143 | 8051-core SoCs with sub-GHz radio (AXSEM heritage) | Debug lock plus flash read protection | Often workable — 8051 cores are well-understood ground |
| RSL10, NCS36510 | Arm Cortex-M BLE and 802.15.4 SoCs | Debug disable, protected NVR regions, optional encrypted images | Hard, sometimes not feasible; encrypted images may be unusable even if dumped |
| AMIS-30xxx, LC709203, smart drivers | Motor drivers and fuel gauges with parameter EEPROM/OTP | Register locks, OTP fuses | Parameter recovery is often practical; there is rarely a full firmware image to get |
One more group deserves a mention: mask ROM and OTP parts from the older Sanyo and AMIS catalogs. There is no electrical read path on those, so recovery means physical work on the die and optical or electrical readout of the array. That’s slow, needs more than one sample, and the cost is in a different class from a flash dump.
What determines whether your onsemi chip can be read
The protection mechanism, not the vendor logo
Engineers tend to ask “can you unlock onsemi?” when the real question is “what is guarding this flash array?” A protect bit on a 1990s-era 0.35 µm flash MCU and a debug port that has been fused off on a Cortex-M3 with an AES-protected image are different problems with different costs. On the older parts, protection is usually one or a few configuration bits that gate an interface. On the newer ones, protection is designed into the boot path, and that is exactly why we sometimes decline.
The same logic applies across vendors. If you’ve priced a TI MSP430 or C2000 readout before, you already know the pattern: an old device with a single fuse behaves nothing like a current part with a hardware-enforced lifecycle state.
How many samples you can send
Sample count chang
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote