Two thousand words of EPROM, 128 bytes of RAM and a five-channel 8-bit converter: the PIC16C72A is the 28-pin member of the 16C7x line, and each of those numbers changes how a read gets planned. The array is small enough that a full dump arrives in one pass, and the converter is coarse enough that a reconstruction has to be verified against the analogue path rather than against the code alone.
EPROM, Not Flash — Why The Difference Is Physical
The C suffix means the program memory is erasable EPROM, supplied either as a windowed ceramic part that can be cleared with ultra-violet light or as a plastic OTP part that cannot be cleared at all. That matters because the code-protect element on these devices is not a floating-gate cell inside the array. It is a separate fuse structure outside the memory matrix, and it does not respond to the same stimuli as the bits it guards.
Practically, this gives two different jobs. A windowed part is opened, cleared and re-read with a programmer, and the fuse state is irrelevant once the die is exposed. A plastic OTP part has to be read at the array, because there is no erasure path that preserves the customer’s data.
Five Channels At Eight Bits
The converter resolves eight bits across five input channels, which is enough for a potentiometer or a thermistor and not enough to hide a reconstruction error. A rebuilt image that has the ADC control register at the wrong address still produces numbers in the right range, and the error only shows up as a channel that follows the wrong pin.
We verify by pin, not by register: each analogue input is driven with a known divider, the resulting code is logged, and the sequence is compared against the donor board. On an eight-bit converter the difference between a correct and a shifted channel is a few counts, so the test has to be done at two different input levels.
What The 28-Pin Read Actually Involves
A 28-pin SOIC or DIP opens cleanly, and the die sits close enough to the package centre that a standard acid window exposes the whole matrix without undercutting the bond pads. The 2K word array is a single page, so there is no PCLATH banking to reconstruct — one of the few places in this family where the rebuild is straightforward.
| Region | Address | Size | What it holds |
|---|---|---|---|
| Program | 0000h–07FFh | 2048 words | User code, reset and interrupt vectors |
| Device ID | 2000h | 1 word | Revision and family code |
| Configuration | 2007h | 1 word | Oscillator, watchdog, code protect |
The configuration word is read before the array, because it tells us what the part was doing: oscillator mode, watchdog state, and whether the protect bit was ever programmed. A part with the fuse intact and a clean array is a failed protection job, not a failed read, and it is worth knowing which one you are looking at.
When The Sample Is The Only One
OTP parts remove a safety net that flash-based jobs take for granted. If a read is wrong there is no second attempt on the same die — the package is open, the bond wires are exposed, and the part will not go back into a socket. Every 72A job therefore starts with a photograph of the top metal and a note of the lot code, because the only way to cross-check a doubtful block later is against a sister part from the same lot.
Where a customer sends two or three units, we read them independently and compare. Blocks that agree across all samples are accepted; a block that differs on one sample is re-probed rather than trusted.
Rebuilding The Firmware
The dump is disassembled with the reset vector as the anchor, and the interrupt vector at 0004h is checked against it. Cross-page calls do not exist on this device, which removes the single largest source of reconstruction error in the larger members of the family.
The delivered file set is the raw binary, a HEX with the configuration word restored, a disassembly listing, and a channel map that records which ADC input was verified against which pin. The configuration word is included as a separate line so a production programmer can apply it without touching the code.
The same array with eight channels and 33 I/O is the PIC16C74A job, and the 8K member of the line is covered on the PIC16C76 page. If the part in hand is a windowed ceramic device rather than a plastic OTP, say so when you send it — the handling differs from the first minute. Scope and turnaround go through the services desk.