Fast converters lie politely. The 12-bit converter on the PIC32MZ1024EFF100 samples through six sample-and-hold circuits at up to 18 Msps across 48 channels, and no board ships with its accuracy intact unless someone calibrated it — gain, offset, sometimes per-channel timing skew. That calibration lives in the firmware image, usually in dedicated pages with version stamps, and a program read that captures it casually is a read that destroys the one thing field service cannot regenerate. This part’s extraction review starts there.
Locating The Tables
Three habits cover most builds: a reserved page near the top of the 0x1D000000–0x1D0FFFFF array, a constant table compiled beside the acquisition driver, or a parameter block the application rewrites during factory test and again after servicing. The read-back review looks for all three signatures — whole pages with numeric pairs in plausible ranges, dense constant clusters near converter setup code, and erase-page gaps marking the rewrite boundary. Where calibration was written by a production fixture rather than compiled in, its absence from source repositories is exactly why the client is asking; the flash is often the only copy. The firmware reading pipeline treats such pages as first-class output.
The Rest Of The Capture
Beyond the calibration pages, the standard six regions: the 1 MB program array in sixty-four 16 KB pages, twin 80 KB boot panels, and both configuration tails with their ECC-guarded DEVCFG words, dedicated code-protection word and alternate mirror set. The core behind it all is EF-generation microAptiv UC — up to 252 MHz, about 415 DMIPS, seven-stage FPU, 32 KB caches, dual CAN and the crypto engine available but often idle on acquisition-heavy boards. The H in the part number marks a silicon revision, not a feature cut; the letter rules differ completely from the EC family, as the family overview documents.
Verification Tailored To Numbers
Checksum verification runs page by page as always. The converter-specific pass adds range checks: calibration constants are floating-point or fixed-point values whose plausible bands are known from the converter’s own datasheet envelope, and values outside those bands indicate either a corrupt read or a page misidentified as calibration. Both findings matter — one means re-read, the other means the real calibration pages are elsewhere and the search continues. Bench verification boots the image on a reference board and samples a known signal, closing the loop that page checks open.
A practical marker helps the search: calibration pages almost always carry a checksum or version field of their own, because the production fixture that wrote them needed to confirm the write. Finding that self-describing structure is usually the moment the search ends; pages that lack it but match numerically get flagged for the bench stage instead of trusted outright.
Bench Evidence For The Numbers
Page checks and range checks prove the bytes; the bench proves the behavior. Acquisition boards come to the lab with their own test points, and the verification rig uses them: a known signal into the input channel, the recovered image running, samples captured through the board’s legitimate interfaces and compared against the calibration the extraction recovered. Where the original accuracy holds, the calibration pages are confirmed live, not just structurally. Where it drifts, the drift itself is evidence, usually of a table misidentified or of runtime trimming the application applies after boot. That second case matters to clients who assumed the flash held the final constants; the trim values are derivable from the code, and the report distinguishes what flash carried from what the firmware computes.
Protection, Briefly
The single active-low code-protection word locks ICSP and 4-wire JTAG together once cleared, and only a chip erase — which takes the calibration pages with it — releases the part. Ownership verification precedes everything, through the contact desk.
The 64-pin sibling, whose images exercise the FPU more than the analog front end, is covered on the 1024EFF064 page.