The 20-Pin Analog Member
The PIC16F1708 widens the PIC16F1704 to twenty pins with the same 4,096 words of flash (0x0000-0x0FFF), 512 bytes of SRAM, and the same analog toolkit: twelve channels of ten-bit ADC, two comparators, an eight-bit DAC, one operational amplifier and zero-cross detect. The COG, two CCP plus four PWM modules, EUSART, MSSP, three Configurable Logic Cells and PPS complete the set. Off-line converters and motor drivers choose it when more pins are needed for sense lines.
Lock Model
CONFIG1 at 0x8007 with the single CP bit; ID at 0x8006; no EEPROM, with the High-Endurance Flash window at 0x0F80-0x0FFF. Sweep rules:
– 0x0000-0x0FFF: array, 0x000 under CP, 0xFFFF when erased. – 0x0F80-0x0FFF: HEF, swept with the array. – Above 0x0FFF: unmapped, 0x000.
The 4K boundary separates the 1708 from the 2K PIC16F1707 and the 8K PIC16F1705 / PIC16F1709 pair. The configuration word read at session start is the authoritative record of the lock state – one bit decides the whole image’s visibility.
Image Anatomy
The init block carries the analog configuration: op-amp gain, DAC reference, comparator hysteresis, zero-cross detector wired to the COG’s auto-shutdown. The conversion loop runs in hardware; software on the 512-byte SRAM handles feedback averaging and housekeeping. The EUSART reports status. HEF holds setpoints and thermal limits – often field-tuned – and is delivered as its own annotated table because clone firmware without those values regulates differently.
The Session
The session on this die begins with pin continuity, not with the programmer. Twenty pins carrying twelve analog channels and two op-amps means a shared pin can be back-driven by an external circuit during the read, and a single back-driven input produces plausible but wrong data. Once the board is isolated, the configuration pair comes out, then 0x0000-0x0FFF in thirty-two word blocks.
Deliverables
HEX at word addresses, annotated disassembly with the analog, COG, serial and HEF regions labeled, configuration report, checksum tied to the die. Clone policy documented as found and as applied.
The Full-Analog 20-Pin Part
Twenty pins with twelve analog channels forces sharing, and the sharing is where reviews go wrong. A pin that serves as an ADC input in one phase and a digital output in another carries two configuration writes in different parts of the init block, and an automated splitter will report them as unrelated peripherals. The report groups them by pin so the alternation is visible, which is usually what a client needs when they are tracing why an output glitches during a conversion.
Analog Peripherals In The Code
Because the comparators, op-amps and DAC are configured through a small set of registers, the initialisation block on this part is longer than its memory size would suggest. The DAC output value that sets a comparator threshold is a design constant: it encodes the trip point of whatever protection or control loop the product implements, and it is one of the few values a client can check against their own test data.
– Flash: 0x0000-0x0FFF, 0x3FFF erased, 0x0000 protected. – Configuration: 0x8007-0x8008, device ID 0x8006.
Failures On Analog Boards
Boards that route op-amp inputs close to a switching node often arrive with a damaged input pin rather than a damaged core. Such a part reads normally and the image is valid; the client is told which channel no longer meets its input range so the replacement can be tested before installation. The genuinely unreadable case is a part whose configuration words were corrupted by a supply transient during a self-write, which returns a valid ID with an inconsistent protect state.
Handover Package
HEX at word addresses, annotated disassembly with the comparator, DAC and op-amp configuration labelled, configuration report, checksum tied to the die. Protection left as found.
Delivery
Alongside the listing the report gives the DAC code that sets each comparator threshold, converted to the equivalent input voltage for the reference the design used. That conversion is the step clients most often get wrong when rebuilding.
To book a 1708 extraction, write to the services desk or the contact form.