Eighteen pins, 12 I/O, 24 KB of flash, 2 KB of SRAM, 1 KB of data EEPROM and an eight-channel 12-bit converter. The dsPIC30F3012 is a strange and useful combination: the memory of a mid-range drive in the package of a sensor controller. Boards built on it are compact, often potted, and almost never have a programming header left free.
Big Memory, Small Package
8,192 instruction words of 24 bits in an 18-pin SOIC or PDIP. The array is four times the size of the 2011’s 12 KB, which means the firmware is not a single loop. Typical designs run a control loop, a serial protocol and a data logger, and 2 KB of SRAM gives them room to buffer.
For a recovery job the important consequence is that the image is large enough to contain structure but small enough to review completely. 8,192 words is a few days of careful annotation, not a month, and the boundary between used and unused program is usually visible without disassembly.
Twelve Bits Of Conversion
The converter resolves twelve bits across eight channels, which distinguishes this part from the ten-bit converters on the 3010 and 3011. Four times the resolution, and correspondingly larger constants in the firmware.
Recovery benefit: twelve-bit calibration values are distinctive in the instruction stream. A signed offset stored as an immediate looks different from an address computation, and an annotator can pick out the per-channel trim without running the code. That matters because the trim is factory data. It cannot be recomputed, and a replacement board without it will read every input with a small, systematic bias.
EEPROM And What It Holds
1 KB of data EEPROM, separate from the array. On this part it is usually populated with calibration and configuration: sensor offsets, output limits, a device address on a bus, sometimes a production date.
A program-only read leaves those behind, and the failure mode is quiet. The board boots, communicates, and returns values that are close but not right. Any report on this device should show the EEPROM block on its own, with a checksum, and say whether the contents look like a coherent parameter set or like a half-written page.
Protection And The Zero Test
Configuration registers at 0xF80000 hold the general segment protect bit. The scheme is segment-based, so ICSP returns either the array or zeros; there is no adjacent region to walk into.
Erased flash is 0xFFFFFF. Protected flash is 0x000000, which is NOP, so the locked dump disassembles into padding. Address zero settles it: working firmware places a GOTO at reset, a protected read leaves NOP, and that word is the one place a legitimate image never has padding. The protection models used on PIC and dsPIC parts explains the mechanics.
Potting, Coating And The Access Problem
An 18-pin part in a compact product is often potted or coated, and the ICSP pins are frequently shared with functions that make in-circuit access awkward. PGC and PGD usually sit on pins the application uses, so a read requires holding the device in reset and driving those pins from outside, with the rest of the board powered down or isolated.
That is routine work, but it needs the board, not just the chip. A customer who desolders the controller and posts it alone often loses the chance to do the read in circuit, which is the cheaper route. Reading program memory sets out the in-circuit procedure.
What These Boards Do
Sensor interfaces, small drives, battery management, valve and damper control, agricultural and HVAC controllers. The pattern is a product that needs real signal processing but has no space for a larger package, and where the enclosure is the design constraint rather than the electronics.
Note also what this package cannot give you: no CAN, no second UART, and one PWM block with three pairs. Designs that needed a bus went to the 4011 or the 3011, so a 3012 board is usually a self-contained controller with a sensor front end and a local actuator, which narrows the firmware’s likely structure before a single byte is read.
Verification
Two reads compared word for word. A reset vector that configures the ADC sequence and the port directions the code depends on. A boundary scan to find where real code ends. A consistency check on the EEPROM. And a programming test into a blank part where one is available, since a board that measures everything correctly and refuses to actuate is a firmware problem as often as a hardware one.
Our services page lists what is delivered. Send the marking, a photo of the board in its housing and a note on what it controls, then contact us and we will confirm the access route before quoting. The dsPIC30F3013 is the same memory in 28 pins with ten channels, and the dsPIC30F2012 is the 12 KB version without the EEPROM.