The PIC16F1782 is the entry member of Microchip’s 178x advanced-analogue line, and it is smaller than its part number suggests: 2048 words of program flash – three and a half kilobytes – 256 bytes of SRAM and a 28-pin body carrying twenty-five I/O lines. What makes the die interesting is not the size but the converters: a 12-bit ADC across eleven channels, two rail-to-rail operational amplifiers, three comparators, an 8-bit DAC and two programmable switch-mode controllers, all on a part that costs like a commodity controller. When its code-protect bit is set, our dump protected PIC16F1782 code service recovers the image from hardware you own without touching the destructive erase path.

Twelve bits on a small die

Twelve-bit conversion changes what the firmware holds. Gain calibrations, offset corrections and comparator trip points become meaningful at that resolution, and they live as constants in flash – sometimes hand-tuned per production batch. A clone blessed only by checksum can carry every byte correctly and still measure differently, because one calibration word was captured from the wrong sector boundary. Our procedure reads the array in a single pass, checksums per sector, and then verifies behaviour: the bench fixture drives representative signals into the analogue inputs and compares conversion results and op-amp gains between clone and donor. On parts this small the test takes minutes, and it has caught mis-read calibration tables that no static check would flag.

The fixed voltage reference deserves its own line in any capture plan for this die. Converter accuracy and comparator behaviour both hang off the FVR ladder, and the startup code programs the reference levels from constants that were chosen when the product was calibrated. A replacement carrying default reference settings will pass a functional test and still read every sensor a little wrong – close enough to look healthy, far enough to corrupt a threshold decision. Our report therefore records the FVR configuration words next to the ADC calibration notes, and the bench comparison includes a swept input so the reference behaviour is measured rather than assumed. Where the application switches reference levels between modes, the level-change behaviour is exercised too, because a reference that rings on switching shows up only in the recordings.

Switch-mode controllers and their constants

The two PSMC blocks are the reason power engineers pick this die: each one runs a switching stage with frequency, dead-band and shutdown behaviour configured from constants the startup code streams in. Those constants decide how a charger or LED driver survives a shorted output, so they are captured as first-class targets rather than incidental bytes. Where the firmware enables auto-shutdown and restart, the recovery report records the trip behaviour observed on the bench, not merely the register values – the difference matters when a replacement unit meets a real fault instead of a datasheet example. General bench discipline for arrays of this class is in the how the MCU memory works guide.

Protection state and the erase that never runs

Protection on this generation is configured through the configuration words: code protect seals program flash from external reads, and data-protect does the same for the 256-byte EEPROM. Both yield only to a bulk erase, which destroys everything the owner is trying to save, so the erase stays permanently out of the plan. The capture instead maps the configuration words first, reads every region that answers in its protected state, and documents the policy verbatim. Lawful-access framing for this kind of work is described in the unlock microcontroller embedded memory guide, and the commercial boundary in the semiconductor chip hardware security overview.

Duplication

Recovered images go into matching 28-pin blanks with the EEPROM contents restored alongside the code, through the MCU flash EEPROM data cloning pipeline, with every unit read back and compared before it leaves the bench.

Family links

The 7 KB sibling on the same pinout is on the PIC16F1783 binary page, the 182x generation that followed on the PIC16F1827 program recovery.

Scope

Only devices you own or are authorised to service are accepted. Send the locked PIC16F1782, and the return is a verified dump with the calibration and PSMC notes attached – the parts of the image that decide whether the product works, not merely whether it boots.