The dsPIC30F2023 keeps the 12 KB array and four PWM generators of the dsPIC30F2020 and moves them into a 44-pin package with 35 I/O and twelve analog input channels instead of eight. Same silicon family, same missing EEPROM, different board. That last detail, the extra analog channels, is what most recovery jobs on this part actually turn on.
Same Array, Different Analog Front End
4,096 instruction words of 24 bits, 512 bytes of SRAM, a 10-bit converter running at 2 Msps, four sample-and-hold units, four comparators, and 1 ns PWM resolution. The converter channels rise from eight to twelve, which is what a three-phase inverter with per-leg current sensing plus DC bus and two temperature sensors needs.
Per-channel calibration is the consequence. Offset and gain corrections for twelve channels take space, and on a device with no data EEPROM they live in the array as tables. A recovered image therefore contains the factory trim for each channel, and reusing that image on a replacement board with a different sense resistor value will produce a supply that regulates correctly and reports current incorrectly.
What Four PWM Generators Are For
Four generators, each with a high and low output and seven operating modes, are enough for a full three-phase bridge plus a PFC leg, or for two interleaved half bridges with synchronous rectification. The firmware’s job is timing: dead time, blanking after each edge, phase alignment between generators, and a fault path that can shut everything down from a comparator without the CPU being involved.
That is also why this part resists casual reverse engineering. A recovered C decompile will not show you the dead time, because the dead time is a register value. Reading the peripheral initialisation, and the writes that change it under fault conditions, is where the engineering value sits. Chip extraction analysis covers that annotation step; reading a program covers getting the bytes off the device.
Protection On A Segment-Based Device
The configuration registers sit at 0xF80000, outside the linear array. Protection is expressed as segment read and write restrictions rather than the four rotated blocks a PIC18 uses, so an ICSP session either returns the general segment or does not. There is no way to walk around a locked region by reading a neighbouring one.
Before that conclusion is drawn, three things should be checked: the device ID at 0xFF0000, which answers even when the array does not; the configuration registers, which also read on a locked part; and whether the zeros start at address zero or partway in. Zeros from the outset are protection. Zeros after a plausible block of code are a failed read, and the answer is to repeat it rather than to reach for the decapsulation bench. The range of PIC protection mechanisms puts this in context.
Reading 0x000000 Correctly
Erased words read 0xFFFFFF. Protected words read 0x000000. Since 0x000000 is NOP, a protected dump looks like a program built entirely of padding, and padding is something real firmware also contains.
The discriminator is the reset vector. A working image has a GOTO at address zero, because the first instruction after reset must transfer control somewhere useful. A protected image has NOP there, which no compiler and no hand-written startup code produces. That single word is usually enough to settle the question.
The Physical Side Of A 44-Pin Part
TQFP-44 or QFN-44, on a board that typically carries a bridge, a transformer and a heatsink within a few millimetres. Removal has to be planned around the power stage, and the controller is often under the transformer’s shadow. Where the array is reachable electrically, none of this matters. Where it is not, package work on a power board carries a real risk of collateral damage, and the customer should know that before authorising it.
The alternative, for a board that still runs, is to work from behaviour: capture the PWM timing, the fault thresholds and the serial configuration, and rebuild rather than recover. Some customers choose that once they see the cost comparison, and it is worth presenting alongside the read-out price.
One practical note on the analog side: twelve channels on a 44-pin part means several inputs share pins with digital functions, so the port configuration in the recovered image is the only reliable record of which pin did what. That configuration survives a lock, which makes it worth capturing even on a part that will not read.
What Comes Back
Array, configuration block, device ID, and the per-channel calibration tables called out separately, because those are the values a replacement board cannot regenerate. Two independent reads compared word for word, and a programming test into a blank part where one exists.
Our services page sets out the deliverable at each level. Send the complete marking, a photo of the controller in place and the supply’s topology, then contact us and we will confirm the array size and access route. The dsPIC30F2020 is the same core in 28 pins, and the dsPIC30F1010 is the 6 KB member of the same family.