The PIC16F1936 doubles the entry LCD member’s memory while keeping the 28-pin body: 8192 words (14 KB) of flash, 256 bytes of EEPROM, 512 bytes of SRAM, twenty-five I/O lines, an eleven-channel 10-bit ADC, and the same sixty-pixel LCD driver over four commons. This is the utility-metering sweet spot – enough code for a real protocol and a tariff table, enough display for a readable panel, few enough pins for a compact board. When its protection is set, our copy locked PIC16F1936 source code service recovers the image from hardware you own.

Timekeeping is part of the image

Metering products run Timer1 from a 32.768 kHz crystal, and the firmware around it – drift compensation, calendar logic, tariff switching – is configured from constants in flash. A clone that keeps time badly is worse than one that does not boot, because nobody notices for months. Verification therefore runs clone and donor clocks in parallel across an extended soak on the fixture and compares accumulated time and switching events, not just the code checksum. The LCD keeps driving in sleep on this family, and the sleep-current constants are captured the same way; a replacement that doubles standby draw gets caught on the bench. The storage layout beneath these behaviours is in the microcontroller internal storage structure analysis reference.

Tariff and calendar structures are the code-space consumers on this die: rate tables indexed by season and time-of-day, switch points written by the utility, occasionally a daylight rule. They read as ordinary constants but they are the compliance layer – a clone with the wrong tariff table bills correctly and reports wrongly, or the reverse. Recovery treats those tables as named deliverables: extracted, checksummed, and listed in the report by region, so a regulator’s question can be answered from the image rather than from memory, and the tables’ checksums go into the delivery alongside the code image. Where the tariff logic embeds a checksum of its own, it is recorded too.

Reading the protected array

The configuration words are the first thing read, because they hold the rules: code protect against the flash, data protect against the EEPROM. Releasing either means the bulk erase that clears the array – the move that defeats the whole purpose – so it is never taken. Instead the array is read region by region while still locked, each block checksummed, and the entire pass repeated until a second reading agrees with the first down to the byte. The EEPROM, which carries the meter’s accumulated energy and flags, is part of that same locked read and is restored into every copy with its checksum printed. Background on how such protection maps are read honestly is in the MCU reverse engineering concept article.

Brown-out behaviour is configured between two trip points on this family, and metering rails sag in ways that make the choice visible. The fixture replays a controlled rail-sag profile against clone and donor and records which point tripped and how the product recovered – a test that has caught default-configuration programming more than once, because a replacement carrying factory defaults passes every steady-state test and fails the first brown-out.

From code to maintainable source

Customers who receive the image often ask for more than a heximal: the recovery can be accompanied by a structured disassembly walk-through that names the scan loop, the tariff switch and the protocol handler, so a maintenance team can navigate the code without the original toolchain. That deliverable is deliberately conservative – it documents what the image does rather than inventing what it might – but it converts a locked array into something a service organisation can act on. Comparable work on the newer 180xx line is described on the PIC16F18054 program page.

Duplication and family

Once an image passes, it is loaded into a matching 28-pin blank with the EEPROM copied across, and every unit is read back before it ships, through the MCU flash EEPROM data cloning pipeline; the 7 KB entry member is on the PIC16F1933 memory page and the 40/44-pin 14 KB member on the PIC16F1937 EEPROM recovery.

Scope

Jobs are taken only for hardware you own or are permitted to maintain. Send the locked PIC16F1936 and the deliverable is a verified image, the clock-soak log and the protection map, with the array-destroying erase kept out of the procedure entirely.