A single dump tells you what is in the memory. Two dumps from two units of the same product tell you what is in the memory *and which bytes are allowed to differ*. On a 12 KB part, that difference is small enough to read by eye.
The PIC18F4439 is the 12 KB member of the PIC18FXX39 family: 6,144 instruction words, 640 bytes of SRAM, 256 bytes of data EEPROM, 32 I/O pins, eight channels of 10-bit ADC, two 10-bit PWM modules, and a single-phase induction motor control kernel. It ships in 40-pin PDIP and 44-pin TQFP, and it shares DS30485 with the 24 KB PIC18F4539 and the two 28-pin members.
The ProMPT Kernel Is Silicon, Not Software
This is the part of the article that changes how you read the file. The ProMPT block generates the variable-frequency drive waveform in hardware. Firmware does not compute a sine table and push samples out of a timer; it writes a voltage-versus-frequency curve and a ramp into registers, and the kernel produces the PWM.
What that means for a recovered image: the interesting content of the 12 KB is not a control algorithm. It is a curve — a handful of voltage and frequency pairs — plus the ramp timing, plus the protection thresholds. The code around it is short. Twelve kilobytes is generous for this job, which is why the family exists at that size.
The curve is table data in flash. It comes out with the read. What does not come out automatically is which numbers in that table were trimmed per unit at end-of-line, and that distinction matters if the recovered image is going onto a replacement board with a different motor.
Why Two Units
Take two boards from the same production run — ideally the same batch, same motor, same firmware revision — and read both. Then compare, byte for byte.
Three outcomes appear:
| Pattern | Meaning |
|---|---|
| Long identical runs | Code and constant tables. Safe to transplant. |
| Isolated differing bytes inside an otherwise identical block | Per-unit trim, written by the test fixture. |
A whole block different from 0x1000 onward |
Different firmware revision. Stop; you have two products, not two units. |
On a 32 KB or 48 KB part this analysis is a chore. On 12 KB it is 6,144 words, and a diff that reports forty differing bytes gives you a map in an afternoon: here is the code, here is the calibration, here is the serial number.
That map answers the question a single dump cannot: if I put this image on a new board, what will be wrong? The answer is rarely “nothing”. It is usually “the current offset” or “the ramp rate”.
The Boundary Map
Twelve kilobytes is 0x000000 to 0x002FFF, in three 4 KB blocks:
0x0000–0x0FFF—CP0, contains the reset vector at0x0000and the interrupt vectors at0x0008and0x00180x1000–0x1FFF—CP10x2000–0x2FFF—CP2
CP3 is not implemented on this die, because the array ends at 0x2FFF. That single detail catches people who copy a configuration block from a 24 KB 4539 into a 4439: the extra bit is a don’t-care on the smaller part and a real protection bit on the larger one.
Configuration lives at 0x300000–0x30000B. Data EEPROM is at 0xF00000, 256 bytes. Device ID is 0x3FFFFE, revision 0x3FFFFF.
What to Ask For
A delivery that supports a rebuild contains:
1. The 12 KB flash image in Intel HEX, with the three block boundaries intact 2. The twelve configuration bytes 3. The 256 bytes of EEPROM, separately labelled 4. A note on which code protection bits were set 5. If two units were available, the diff summary
Item 5 is the one that is usually missing and the one that saves the most time. It is also the cheapest to produce, because the second read costs a fraction of the first.
When the Array Is Fully Closed
If all three blocks are set, the programming interface will not return data and the route runs through the die. The image that comes back is verified the same way: reset vector present, block boundaries continuous, 0x0000 runs only where they are expected, and — where possible — a second unit for comparison.
Reading the firmware out of a motor control board is routine work, and the read the firmware page describes the general sequence. What is specific to the 4439 is that the recovered curve is the product. Treat the curve as the deliverable and the code as the wrapper around it, and the acceptance conversation gets much shorter.
Two units and a board photograph is enough to start. Everything is handled under the non-disclosure agreement, and the services page lists what each route covers so the scope can be fixed before anything is quoted.