PIC16F1934 Locked Program Copying On The 40/44-Pin Die

The Wide Analog Member

The PIC16F1934 takes the 1933 formula to a 40/44-pin package: 4,096 words of flash (0x0000-0x0FFF), 256 bytes of SRAM, thirty-six I/O lines, fourteen channels of ten-bit ADC, 96 LCD elements on four commons, three ECCP modules plus two CCP, an EUSART, an MSSP, two comparators with a five-bit DAC, and a true 256-byte EEPROM at 0xF00000. Boards built on it tend to be process controllers and metering units where many analog inputs, a big display and a serial uplink coexist on one die.

Lock Model

Enhanced mid-range configuration: ID at 0x8006, CONFIG1 at 0x8007 with CP and CPD, CONFIG2 at 0x8008. The array and the EEPROM lock independently. A CP-locked part returns 0x000 on array reads; the EEPROM answers only to CPD. The double sweep is mandatory:

1. Program array, 0x0000-0x0FFF. 2. EEPROM, 0xF00000-0xF000FF, into a separate file.

Erased cells read 0xFFFF; above 0x0FFF the bus returns 0x000 for unmapped addresses. Identifying the boundary correctly distinguishes the 4K members from the 8K PIC16F1936 and PIC16F1937 – a reader set for 8K on a 4K part invents a phantom protected region in the upper half.

Image Anatomy

The listing separates naturally into blocks:

– LCD scan: a 96-element frame loop with bias and charge-pump control. – Analog front end: fourteen-channel scan table, two-register results, five-bit DAC trip points. – Control: three ECCP time bases with auto-shutdown wiring – motor or power-stage control. – Communication: EUSART framed output, MSSP in SPI or I2C mode.

The 256-byte SRAM is the constraint that shapes everything: buffers are fixed-size, scan tables are packed, and the compiler’s allocation shows in the disassembly as dense bank switching. Recognizing the bank patterns is part of verification.

The Session

Two-wire ICSP through the surviving production header, or socket work. Identify, document the configuration words, sweep both windows, verify decoding. Nothing is erased and the part remains serviceable; the lock policy of any clone is a documented choice. As on the PIC16F1933, check the EEPROM even when the array is dark – the calibration record has outlived many a lost source tree on this family.

Deliverables

HEX at word addresses, EEPROM dump, annotated disassembly with the four functional blocks labeled, configuration report, checksum tied to the die. If the board pairs the 1934 with a larger-memory sibling, both can be processed in one session with boundaries set per part.

Four Thousand Words Driving Ninety-Six Segments

The PIC16F1934 carries 4,096 words of flash, 256 bytes of SRAM, 256 bytes of EEPROM, 36 I/O pins, fourteen ADC channels, three ECCP and two CCP, and the same ninety-six segment LCD driver as the 1937 – with half the code space. It is the cost-reduced panel controller, and images for it are tight: the display refresh, the key scan and the application all compete for the same four kilowords.

What Compression Looks Like

Where the 1937 has room for tables, the 1934 computes. Segment patterns that would be stored are generated by shifting and masking, and menu text is packed rather than stored as characters. Recognising that style is what allows a reviewer to find the segment map at all, since it exists as an algorithm rather than as data.

– Flash: 0x0000-0x0FFF (4K words), 0x3FFF erased, 0x0000 protected. – EEPROM: 0xF00000-0xF000FF. – Configuration: 0x8007-0x8008, device ID 0x8006.

The EEPROM Holds The Settings

On a panel product the EEPROM usually carries the user settings – setpoints, calibration offsets, a language selection – and those bytes are what a replacement unit must be given to behave like the original. The session reads the EEPROM in full and delivers it as a separate file so it can be programmed independently of the code.

Handover Package

HEX at word addresses, the EEPROM binary, annotated disassembly with the display refresh and the segment generation code labelled, configuration report, checksum tied to the die.

To schedule a 1934 recovery, write to the services desk or the contact form with the part marking, package code and a short application description.