Stuck in a repair jam by a damaged PIC12HV615 and need help

[Perrin21]

Hi, i have been trying to repair an Eberspächer 400V controller on my car and ive come up against a problem.  I have found that the PIC12HV615 on the board is faulty and i do not know what software was on the chip.  How can i figure out the correct program for the chips function so that i can reprogram another and replace it?  Is this possible? 

Here is the board diagram ive made as ive been going along.  its not perfect and may have the odd error but this is what i have so far.  Ive replaced most of the other chips on the board but seem to get continuity on pins 1 and 2 of the HV615 (IC2) and i dont think i should have.  can someone with more knowledge than me take a look ?  is it possible to pull the software from the faulty chip?

here's the link to the datasheet for the hv615  https://ww1.microchip.com/downloads/en/DeviceDoc/41294b.pdf
here's a link to the schematic ive made.  https://photos.app.goo.gl/KyY8FG4wjSzxF4mJ6


Mark

[rstofer]

Download the actual datasheet and search for 'code protection'. Most Microchip devices have code protection which means, you can't extract the code in any reasonable manner.  Assuming the device manufacturer turned it on and they probably did.

Page 27 here:  http://ww1.microchip.com/downloads/en/devicedoc/41302d.pdf

There may be some NSA level methods of extracting the code but the casual user won't be able to do it.

[james_s]

If the chip is dead then you are screwed either way. Your only option is to either try to buy a replacement chip from the manufacture, or reverse engineer the function and write your own code to do the same thing.

[amyk]

There may be some NSA level methods of extracting the code but the casual user won't be able to do it.

Lots of "MCU break" services in China will do it for you, price varies between few hundred USD to few k USD depending on generation of part and how much security features it has; for a PIC12, I guess it will be on the cheaper end.

But if your chip is actually very dead, as in the die has been internally destroyed, those services would be unlikely to help either.

[Ian.M]

IIRC the 'MCU break' services usually require several samples of the programmed chip. 

6.0 CODE PROTECTION
For PIC12F609/12F615/12F617/16F610/16F616 and PIC12HV609/12HV615/16HV610/16HV616, once the /CP bit is programmed to ‘0’, all program memory locations read all ‘0’s.  The user ID locations and the Configuration Word read out in an unprotected fashion.  Further programming is disabled for the entire program memory.

The user ID locations and the Configuration Word can be programmed regardless of the state of the CP bit.

There were vulnerabilities in very old PICs that just scrambled readout when code protection was on, however the above paragraph stating it reads back  read all ‘0’s indicates its from after Microchip fixed the hobbyist-accessible ICSP security flaws.

[james_s]

Not necessarily, if the chip is dead I would not expect to read anything from it no matter what.

[Ian.M]

Yes, it *could* just be a fused blob, but its also possible to blow the GP5 (pin 2) I/O driver upper MOSFET and end up with a dead short to Vdd (pin 1), without killing the core and the other pins, so it still 'works' as long as that pin's function is non-critical.

However, my and Rstofer's point is that even if it is working enough for ICSP (i.e. the programmer returns the device ID and the CONFIG word successfully), if it is protected, its a dead end as the code cant be recovered by ordinary mortals, and manufacturers that don't protect their closed source code are significantly rarer than hens teeth!

[Perrin21]

i wasn't 100% certain it was this chip until yesterday when i tried powering up the circuit and it took out a mosfet, a resistor and the mosfet controller.  I have spares of the parts but im now certain the Pic12HV615 is the issue so im SOL.  im trying to appeal to the better nature of the manufacturer but im not hopeful.

[Perrin21]

Download the actual datasheet and search for 'code protection'. Most Microchip devices have code protection which means, you can't extract the code in any reasonable manner.  Assuming the device manufacturer turned it on and they probably did.

Page 27 here:  http://ww1.microchip.com/downloads/en/devicedoc/41302d.pdf

There may be some NSA level methods of extracting the code but the casual user won't be able to do it.

Ive already been researching Ghidra lol.

[james_s]

Take out the PIC and wire it up on a protoboard using a current limited power supply, that will let you get a better idea of its true state.