Twice the flash of the dsPIC30F1010 and twice the PWM hardware: the dsPIC30F2020 is the 28-pin workhorse of Microchip’s digital power line, with 12 KB of program memory, 512 bytes of SRAM, a 10-bit 2 Msps converter sampling up to eight channels, four analog comparators and no data EEPROM. It has been designed into multiphase buck converters, power factor correction stages, inverter front ends and LED drivers since the mid-2000s, and a fair number of those boards are still in service with no source code behind them.
What 12 KB Looks Like On The Bench
4,096 instruction words of 24 bits, programmed in rows of 32 instructions, which is 128 rows for the full array. The counter loop, the compensator, the state machine and the protection logic all fit with room left over for a serial command interface, which is why this part turns up in supplies that are configured over a bus rather than by a trim pot.
That extra room changes the recovery problem. A 1010 image can be read and understood in an afternoon. A 2020 image usually contains a parameter table, a communication protocol and a boot sequence, and the review has to establish which routines are control and which are housekeeping before anything can be annotated.
No Data EEPROM, So The Protocol Holds The Parameters
There is no EEPROM on this device. Any configuration the customer can change at runtime has to be written somewhere, and the options are limited: recompute it at boot from a fixed table in flash, accept it over a serial link and hold it in SRAM, or store it in the upper rows of the array with a checksum.
Finding that choice early is worth the effort. If the firmware writes parameters into its own flash, the array contains values that were never in the original build, and a read-out that is compared against a vendor hex file will not match. If the parameters arrive over a bus, the recovered image plus the board’s host controller is the complete system, and the file alone is not enough to reproduce behaviour.
Reading The Protect Bits
Configuration registers occupy the 0xF80000 block, above the linear program array, and the general segment protect bit among them decides whether ICSP returns the array or zeros. On the SMPS parts the segment options are narrower than on the 6010 class, so in practice the outcome is close to binary: readable, or not.
Three signals are worth capturing before any conclusion. The device ID at 0xFF0000, which still answers when the array is blocked. The configuration register contents, which also still read. And the exact address at which returned data stops looking like code. A part that returns zeros from 0x0000 upward is protected. A part that returns real code for the first thousand words and then zeros has a different problem, and it is usually a read that was interrupted rather than a lock.
0xFFFFFF Is Empty, 0x000000 Is Ambiguous
Erased flash on a 24-bit core reads all ones, so an unwritten row is easy to spot. Programmed-then-erased is the same value, which means the boundary between used and unused program is visible in the dump without any disassembly at all.
Protected flash reads all zeros, which is NOP. Because a device that genuinely contains a long run of NOP padding exists, the two cases cannot be separated by inspection. The tell is structural: real firmware has a reset vector that loads the stack pointer and jumps, and a GOTO at address zero pointing into the array. A protected read has zeros at address zero, which is the one place a legitimate program never leaves them.
Where These Boards Fail
The common failure is not the controller. It is a capacitor that dried out, a gate driver that died and took the PWM pin with it, or a current-sense resistor that drifted. When the replacement board is unobtainable and the supply is carrying a production line, the controller is the only part that cannot be bought pre-programmed, and that is when a read-out becomes a maintenance decision rather than a curiosity.
A 28-pin SOIC or QFN soldered to a board with switching copper underneath is not a friendly probing target. Access to the programming pins is often the limiting factor, and on the QFN version the package has to come off before anything useful happens. Semi-invasive extraction is the usual route when the die has to be reached, and reading program memory describes what happens before that point.
Deliverable
The array, the configuration block, the device ID, and a note on whether any region showed evidence of runtime parameter writes. Two independent reads compared word for word. A programming test into a blank part if one is available, since a control loop that starts and immediately trips its overcurrent comparator looks identical to a bad read until it is on real hardware.
Our services page lists what each level includes. To start, send the full marking, a photo of the board and the supply’s ratings, then contact us. The dsPIC30F2023 is the same array in a 44-pin package with twelve converter channels.