The LCD Generation
The PIC16F1902 pairs the enhanced mid-range core with an on-chip LCD driver: four commons and nineteen segment lines, enough for a 72-segment display in 1/4 multiplex. Around it: 2,048 words of flash (0x0000-0x07FF), 128 bytes of SRAM, eleven channels of ten-bit ADC, and – notably – no EUSART and no MSSP. The 1902/1903 branch dropped the serial peripherals that the 193x branch kept, so recovered images contain no baud-rate tables and no SPI or I2C handlers; everything leaves the chip through GPIO pins and the LCD block itself.
Storage: HEF, Not EEPROM
There is no data EEPROM on the branch. In its place the top 128 words of the program array (0x0780-0x07FF) form a High-Endurance Flash block rated for 100,000 write cycles – ten times the endurance of the main array. Applications store calibration, alarm trip points and accumulated counters there. For recovery this means two things:
– The array sweep must include the HEF window; it lives in the same address space as the code. – The HEF words are frequently the most valuable region of the image, because that is where parameters ended up after years of field updates through the self-write routines.
Lock Model
CONFIG1 at 0x8007 carries the single CP bit; the die ID sits at 0x8006. Locked arrays read 0x000, erased cells 0xFFFF, and unmapped space above 0x07FF also reads 0x000 – the usual three-state rule. Because the array is small the entire sweep is quick, but boundary discipline still applies: a reader configured for the PIC16F1903 at 4K words will misjudge the upper half of the 1902’s address space and report phantom protected regions.
What The Image Contains
A 1902 application is a display controller with a scanning loop: the LCDSEG registers are rewritten per frame from a buffer in the 128 bytes of SRAM. The eleven ADC channels feed trip comparisons; the two timers pace the scan. Recovered disassemblies show a tight frame loop with the segment buffer handled between update and visible halves – a structure that is easy to verify at instruction level. Firmware that later migrated to the serial-equipped PIC16F1906 shows the additions clearly, since the LCD block code carries over almost unchanged between the two.
The Recovery Route
Two-wire ICSP, identify via 0x8006, read CONFIG1 and CONFIG2, sweep 0x0000-0x07FF including the HEF window, verify, deliver. On-board work through the production header is normal; nothing is erased and the part returns to service. The configuration report records the lock state and the LCD setup, which matters for exact re-flashing onto a replacement die.
Output Package
– HEX at word addresses, checksum tied to the physical part. – Annotated disassembly: frame loop, ADC trip logic, HEF constants labeled. – Configuration report with the lock policy documented for cloning.
The Smallest 190x Part
The PIC16F1902 has 2,048 words of flash, 128 bytes of SRAM, 25 I/O pins spread across a 28-pin package, eleven ADC channels, two ECCP and two CCP – and neither a EUSART nor an MSSP. That absence defines the part: it is a stand-alone controller that talks to nothing, used for timers, controllers and simple machines.
No Bus, No Protocol
Without a serial port the firmware has no host interface to document, and the image collapses to input conditioning, decision logic and outputs. That makes the 1902 the simplest part in this batch to annotate in full, and it means the deliverable can be a commented listing rather than a summary. The constants that matter are the debounce counts and the trip thresholds.
– Flash: 0x0000-0x07FF (2K words), 0x3FFF erased, 0x0000 protected. – HEF: 128 bytes at the top of the array. – Configuration: 0x8007-0x8008, device ID 0x8006.
Output
HEX at word addresses, the HEF block separately, a commented listing, configuration report, checksum tied to the die.
To submit a locked 1902 – or its 4K sibling the PIC16F1903 – use the services desk or the contact form. LCD-driver recoveries are routine for this family and typically complete within two working days.