Quotes for this part are often built around the array size. The array is 32 KB. The product is usually between four and ten. The difference is not a discount — it is a different job, with different failure modes, and it is visible in the file before anyone opens the chip.
The PIC18F4520 carries 16,384 instruction words — 32 KB — with 1,536 bytes of SRAM, 256 bytes of data EEPROM, 36 I/O pins, thirteen channels of 10-bit ADC, one CCP and one ECCP module, and 40-pin PDIP or 44-pin TQFP and QFN packages. It is the 40-pin member of the DS39631 family, which also covers the 28-pin 2420 and 2520 and the 16 KB 4420.
The Census
Erased flash reads 0xFFFF. On PIC18 that is not a valid instruction, so a region of 0xFFFF is unambiguously unused.
The size of the real program is one loop away:
“ used = 0 for word in image: if word != 0xFFFF: used += 1 print(used, "of", len(image), "words") “
Run that on a recovered 4520 image from a typical appliance controller and the answer is often 3,000 to 5,000 words out of 16,384 — twenty to thirty percent occupancy.
This is not a defect: the part was chosen for pin count, peripherals and price, not because the firmware needed 32 KB. An appliance controller with a keypad, a display and a relay driver does not.
What the Census Changes
Three things, all of them practical:
1. Effort. Reading 32 KB and reading 5 KB of real code are different jobs when the hard part is interpretation rather than extraction. The extract firmware scope should be set on used words. 2. Risk of a partial read. A lock on the block containing the actual code costs you everything. A lock on a block that is entirely 0xFFFF costs you nothing. Knowing which is which before the work starts is worth more than a lower quote. 3. Rebuild feasibility. Five thousand words of compiled C is a reconstructable product. Fifteen thousand words of hand-tuned assembly is a different conversation.
None of this requires opening the chip. If the device is in a socket, the census runs in a minute; if not, a marking photograph plus the product’s function usually narrows it enough to scope.
The Top of the Array Is Where Bootloaders Live
There is a second reason to look at the shape of the file rather than its size.
On PIC18, a bootloader design puts the bootloader at the top of the flash and the reset vector at 0x0000 contains a GOTO to it. The application then lives below, and the bootloader jumps to it after the update check.
That arrangement produces a characteristic file:
0x0000–0x0007: a jump, not the application entry- A large
0xFFFFgap where the application’s unused space sits - The top 2 KB or 4 KB: a second complete program
A recovery that reads the bottom blocks and stops at the first 0xFFFF run returns an image whose reset vector points into empty space. The device is dead on power-up, and the file looks fine. If the product has a firmware update path — USB, serial, CAN — assume the top block matters and say so.
The Block Map
Thirty-two kilobytes is 0x0000 to 0x7FFF in byte addresses, in four protection blocks of 8 KB each, controlled by CP0 through CP3 in CONFIG5L. Configuration is at 0x300000, the data EEPROM at 0xF00000, the device ID at 0x3FFFFE, the revision at 0x3FFFFF.
Four independent bits is still four ways to end up with an incomplete file. In practice most locked 4520s are either fully open or fully closed; partial protection is more common on designs where a contractor wrote one module and the OEM wrote another.
Substituting Upward
The 4520 and the 48 KB PIC18F4525 share the same 40/44-pin footprint and the same peripheral layout, and the 4525 is in the PIC18F2525/2620/4525/4620 family. A 4520 image programs into a 4525 and runs — the extra 16 KB stays erased — which is the usual answer when the 32 KB part is hard to source.
The reverse does not work, and a 4525 file truncated to 32 KB loses whatever lived above 0x7FFF. On a bootloader product that is exactly the block you cannot lose.
Reading the memory out of this family is routine, and the reading the memory page describes the sequence. What is worth insisting on is the shape report: used words, erased runs with boundaries, and whether the top block is occupied. That page tells you more than the byte count does, and it is the difference between a quote built on chip extraction analysis and one built on a part number.
Photograph the marking and describe what the board does. The services page lists what each route includes, and most 4520 jobs can be scoped from those two items alone.