Where The Analog Arrives
The PIC16F1704 introduces what the PIC16F1703 lacks: 4,096 words of flash (0x0000-0x0FFF), 512 bytes of SRAM, twelve channels of ten-bit ADC, two comparators, an eight-bit DAC, one operational amplifier and zero-cross detect – the analog toolkit that gives the 170x family its name. The digital set carries over: COG, two CCP plus four PWM modules, EUSART, MSSP, three Configurable Logic Cells and peripheral pin select. In fourteen pins this is a complete off-line power converter front end, which is exactly the product category that loses its source code most often.
Lock And Memory Windows
CONFIG1 at 0x8007 with the single CP bit; ID at 0x8006; no EEPROM, with the High-Endurance Flash window at 0x0F80-0x0FFF. Sweep rules:
– 0x0000-0x0FFF: array, 0x000 under CP, 0xFFFF when erased. – 0x0F80-0x0FFF: HEF, inside the sweep, annotated separately. – Above 0x0FFF: unmapped, 0x000.
The 4K boundary separates the 1704/1708 pair from the 2K members and the 8K PIC16F1705 / PIC16F1709 – packages repeat across tiers.
Image Anatomy
The listing shows the analog blocks configured at init: op-amp gain selection, DAC reference words, comparator hysteresis, and the zero-cross detector feeding the COG’s auto-shutdown. The power-conversion loop itself runs in hardware – COG from a PWM time base – while software handles feedback and housekeeping. The EUSART reports status; the 512-byte SRAM holds the control state. HEF contents are setpoints and limits, frequently field-tuned, and they are delivered as their own annotated table.
The Session
On this die the interesting read is the tail. The array proper is 0x0000-0x0FFF, but the last sixty-four words carry the high-endurance block, and on aged units that block shows the wear of years of self-writes – so it is read three times and the values compared before anything is reported. Configuration comes out first, and the ID word is checked against the package before the sweep begins.
Deliverables
HEX at word addresses, annotated disassembly with the analog, COG, serial and HEF regions labeled, configuration report, checksum tied to the die.
Four Thousand Words With A Real Analog Front End
The operational amplifier on this die is configured for a fixed set of internal gain settings, and the choice recorded in the register is a compromise between bandwidth and resolution that the designer made once and never revisited. Recovering it tells a client what signal levels the original front end expected, which matters when a sensor is replaced with a similar but not identical part and the product starts reading low.
The Analog Chain Is The Specification
A design built on this part typically conditions a signal before converting it: an op-amp buffer, a comparator for threshold events, and the ADC for the magnitude. Each of those stages is configured by a register write in the first page, and the gain selection plus the DAC threshold together describe the trip point of the product better than any schematic note. The report lists those values alongside the sensor range when the client supplies it.
– Flash: 0x0000-0x0FFF (4K words), 0x3FFF erased, 0x0000 protected. – Configuration: 0x8007-0x8008, device ID 0x8006.
Twelve Pins, Two Jobs
Twelve I/O lines means the analog inputs and the digital interface compete for the same pins, and the firmware resolves that by reconfiguring ports between measurement and communication phases. In the disassembly that appears as a repeated pattern of analog-select and digital-select writes around the same port register – a signature that identifies the measurement cycle and, incidentally, explains why a recovered image can look as though the port directions were set twice.
Handover Package
HEX at word addresses, annotated disassembly with the analog chain configuration and the measurement cycle labelled, configuration report, checksum tied to the die. Protection left as found.
To book a 1704 recovery, write to the services desk or the contact form with the part marking and what the board converts.