Most requests for the PIC18F6390 ask for the EEPROM, and the datasheet’s answer is uncomfortable: the device does not have one. DS39629 — the PIC18F6390/6490/8390/8490 data sheet — lists Data EEPROM (bytes) as 0 for every member of the family. The URL this page sits on is a fossil of that assumption. The data customers are looking for does exist; it just lives somewhere else, and knowing where is most of the recovery. The rest is knowing what the part cannot do, so that nobody spends a week searching an image for a store that was never in silicon.
What the Part Actually Is
The PIC18F6390 is a 64-pin member of the LCD metering family: 8 KB of flash — 4,096 single-word instructions — 768 bytes of SRAM, a 10-bit A/D converter with twelve channels, two CCP modules, an EUSART with LIN support, and an integrated LCD driver for 128 pixels (32 segments × 4 commons) with an on-chip voltage boost regulator. Tariff meters, thermostats, water and gas meters. Its siblings divide by capacity and pins: the PIC18F6490 has 16 KB in the same 64-pin package; the 80-pin PIC18F8390 and PIC18F8490 drive 192 pixels instead of 128.
So Where Is the Data
Three places, in order of likelihood. First, a flash page the firmware erases and rewrites at test time or at calibration — on an 8 KB part this shows up in the image as a region of non-code constants surrounded by code, usually near the top of the array. Second, the configuration words at 0x300000, which hold the LCD bias and drive settings and the clock choices. Third, outside the chip entirely: an external serial EEPROM on the board, which many meter designs use precisely because the MCU lacks one. A recovery that stops at the internal array answers only the first of the three, and for metering products the third is often the one that matters.
Reading the External Store
When the board does carry a serial EEPROM — and on meter boards it usually does, in an eight-pin package near the controller — the read is a separate, quieter job. Two passes, checksum compared, and the first bytes inspected for a sane structure: metering products almost always store a record with a fixed header, so a dump that begins with plausible fields is probably right and one that begins with random values probably was not read at all. The internal flash page, by contrast, arrives with the array; identify it by shape — a region of non-code values near the top of the 512-record file, bounded by code on both sides.
The LCD boost regulator deserves a mention in the same breath, because it is the part of this silicon that a rebuild exercises hardest: the display runs from a boosted rail while the controller sleeps, and the boost and bias settings are configuration, not code. Configuration words at 0x300000 ship with the image on every job from this family, without exception.
Reading the Array Correctly
Flash occupies byte addresses 0x000000 to 0x001FFF — 512 Intel HEX records at 16 bytes. The erased value is 0xFFFF; the code protection scheme is a single gate over the whole array rather than blocks, and a locked part reads 0x0000 back across the array while the device ID at 0x3FFFFE stays readable. Both the 8 KB and 16 KB members share that map, which is why the ID read matters: the same package carries two capacities, and a file of 1,024 records does not belong to this part.
The Metering Rebuild Reality
A rebuilt meter with correct code and no stored calibration measures wrong. The trim constants — metering coefficients, temperature compensation, the LCD’s segment map expectations — are data, not code, and no disassembly reconstructs them. So the delivery for this family is the flash array plus the configuration words plus, where the board has one, the external serial EEPROM’s contents. If a second unit exists, its stored values can seed a replacement even when the first unit’s stores were wiped before it reached the bench.
There is a sequencing rule worth stating plainly, because it has saved more than one job: read the stores before any erase or reprogram attempt touches the sample. A diagnostic pass that clears the external store to test the MCU has destroyed the only copy of the calibration that existed. Everything recoverable on this family is recoverable without erasing anything first, so the order of operations is fixed — stores first, always, and only then any other intervention.
Verification
Two independent flash passes compared byte for byte, config words as a separate region, external EEPROM read and checksummed where present, reset vector resolved, ID reconciled with the marking. Chip extraction analysis covers the review and reading the program memory the two-pass standard.
Send the marking photograph and say whether the board carries an external memory device. The services page lists what is delivered; contact us with the part number for a specific device.