Secured MCU Breaker Experts!

Posts Tagged ‘recovery ic archive’

Bills of materials are written by people, not by datasheets, and this part number shows it. The Microchip catalogue contains a PIC16C54C, which is one-time programmable, and a PIC16F54, which is flash. A line item that reads PIC16F54C is a blend of the two, and it usually means one of three things: the buyer meant the flash part and typed an extra letter, the buyer meant the OTP part and typed F out of habit, or the board carries whichever was cheapest in the quarter it was built. All three arrive as the same request, and the first job on the bench is not reading memory but deciding which of two very different devices is in front of you.

The difference is not cosmetic. It decides whether the recovered content can be turned into a working second unit, whether an erasure is possible at all, and how the protection behaves under a probe.

The two parts behind one part number

Two rows carry most of the consequence. No erase means the OTP part is written once, permanently, and a device that left the factory protected will stay protected no matter what the fixture does. And the protection mechanism is different in kind: a fuse, once blown, is a physical open circuit, while a flash protect bit is a latch that the programming interface set and that only a full erase clears.

Why 512 words is a comfortable size

There is an arithmetic accident worth knowing. The 12-bit core addresses program memory with nine bits inside GOTO and CALL, so a part with exactly 512 words needs no page selection at all: every address in the array is reachable from every other address without touching a status bit. That is why the 16C54 class is so easy to disassemble linearly and so hard to get wrong.

It also explains why the same family becomes difficult two steps up. Add paging and a linear disassembler starts labelling calls into the wrong half of the array, which is the failure mode that makes a 16C57 recovery look unsuccessful when it is merely misread. On a 512-word part, the only structural landmark is the reset vector at address zero and the calibration word at the top.

The last word is not code

On both variants the highest program address holds the factory oscillator calibration value, a single MOVLW instruction whose operand trims the internal RC oscillator. It is written at test, it differs from unit to unit, and it is not reproducible from a datasheet.

Two consequences follow. First, a blank part reads all ones at that address; on a clone built from an image that was not taken from a real unit, the core will run at an untrimmed frequency and every timing constant in the firmware will drift. Second, the tool must carry the word across as data rather than recompute it. A recovery that returns the instruction stream and loses the top word has delivered a program that will run at the wrong speed in about half the units built from it.

What “program” means when nothing can be erased

The word in the request is program, not code, and on the OTP variant that distinction is the whole engagement. A program is the deliverable that a production line can act on: an image plus the configuration word plus the calibration word, in a container that a device programmer will accept without editing.

On a flash part the same bundle can be burned into any blank unit and the job ends there. On an OTP part the bundle is only useful if the customer can still buy blanks, because the recovery cannot produce a second programmable device from a written one. That is a stock question, not a technical one, and it belongs in the first reply rather than after the work is done.

Reading the config word before the array

The configuration word sits outside the program array and describes the oscillator mode, the watchdog, the reset pin function and the protection state. On many units it can be read even when the array cannot, and it is worth reading first for three reasons: it tells you whether the array will answer at all, it tells you what clock the design expected, and on this family it tells you whether the last word you are about to protect is the calibration word or ordinary code.

A part that reads as a repeating pattern while the config word claims protection is off is the classic false positive of automated triage. The pattern is the protection behaviour leaking through the read path, not content, and treating it as data produces an image that disassembles into the same instruction over and over.

Where this part goes wrong in practice

Three patterns cover most of the units that arrive.

The first is a chip marked PIC16F54 with a date code that predates the flash version’s release, which means the marking is a remark or the board is a rebuild. Silicon identity matters more than the label here, and the die marking settles it.

The second is a program that reads cleanly but hangs immediately on a rebuilt unit. Almost always the config word was delivered with the protection bits still set, so the new part is protected from the first power-up and the programming fixture cannot verify what it wrote.

The third is a recovered image whose last word is all ones. That is not a reading error. It is a part whose calibration word was erased by a previous attempt, and the only honest recovery is to say so and to source a calibration value from a sibling unit of the same batch.

For the same die in its eight-pin form, where the pin budget rather than the array decides how the part is reached, PIC12C508A firmware reversal continues the argument. Where the array is twice this size and paging appears, PIC16C57C firmware shows what changes. And for the OTP part that shares this core but stores twenty-five bytes of RAM against a twelve-pin port, PIC16C56 code copying is the closest relative.

FAQ

Does the trailing C in PIC16F54C mean a revision? On the OTP part, C is a genuine die revision that Microchip documents. On the flash part there is no C; the letter in a BOM is either a typo or a carry-over from an older line item. Marking and die identify the device, not the purchase order.

Can an OTP part be unprotected? The fuse that protects the array cannot be regrown. Work on a protected OTP device is die-level work, and it recovers content rather than restoring the part to a programmable state.

Is 512 words enough for a real product? Routinely. Keyboard controllers, chargers, toy electronics and simple sensors fit comfortably in a 512-word array at 33 instructions, and a large share of the parts submitted under this number are exactly that.

The short version

One part number, two devices, two very different engagements. Decide which die is on the board before quoting, read the config word before the array, and carry the calibration word across as data. On the flash variant the deliverable is a clone; on the OTP variant it is a recovered program plus a conversation about blank stock.