The PIC18F8527 comes from the nanoWatt family documented in the PIC18F8722 data sheet (DS39646): 48 KB of flash — 24,576 single-word instructions — 3,936 bytes of SRAM, 1,024 bytes of data EEPROM, a 16-channel 10-bit A/D converter, two CCP plus three Enhanced CCP modules, two Enhanced USARTs, a parallel slave port, and an external memory interface. The package is an 80-pin TQFP.
The Sibling Trap, Again
Forty-eight kilobytes on eighty pins describes two unrelated devices. The PIC18F8525 is the other one: same flash size, same package, different family — 3,840 bytes of SRAM instead of 3,936, a different data sheet (DS39612 instead of DS39646), and no nanoWatt clock features. Code compiled for one usually runs on the other, which is why boards arrive repaired with the wrong part and fail only under conditions the bench never reproduces.
The discriminators are quiet but real. The 8527 has 29 interrupt sources and a Fail-Safe Clock Monitor that shuts the system down safely when the primary clock disappears; the 8525 does not. If the product’s specification mentions behaviour under clock loss, or the schematic shows the Fail-Safe feature used, that is a strong hint about which part is actually fitted. The ID read at 0x3FFFFE ends the argument in one instruction, and it answers even when every code protection bit is set.
Why nanoWatt Raises the Stakes on Config
The nanoWatt generation adds two-speed oscillator start-up and the Fail-Safe Clock Monitor, and both are configured in the config words at 0x300000 — oscillator selection, the two-speed start-up enable, the watchdog, the brown-out level. None of it is in the code, none of it survives a linear read of the array, and none of it is inferable from the disassembly.
A recovered array without the config words programs a blank part that may boot, pass a bench test at room temperature on a clean supply, and then fail the first time the primary oscillator glitches or the supply dips — exactly the conditions the Fail-Safe feature was bought to handle. This is the failure mode that makes a rebuilt industrial board look verified and then embarrass everyone in the field. The config words have to come off the device, or from a known-good reference, and they belong in the delivery as explicitly as the code does.
What the Image Typically Contains
The 8527’s peripheral set — three ECCP modules, two Enhanced USARTs, sixteen A/D channels, a parallel slave port — fits industrial control: process controllers, power monitoring, communication concentrators. The image is therefore usually structured, not exotic: a scheduler, a command parser on each USART, an A/D scan loop, and PWM or capture routines with board-tuned constants. Reading it is straightforward; the value is in identifying which constants belong to the board rather than to the compiler.
Two-Speed Oscillator Start-up deserves a specific mention because it changes boot behaviour visibly. Enabled, the part starts executing on the internal oscillator and switches to the primary clock once it is stable. A rebuilt board with this bit wrong either starts late or starts on the wrong clock and fails the Fail-Safe check — a symptom that looks like a crystal fault and sends the repair down the wrong path. The bit is in the config words, and the config words are in the delivery or they are not.
The Protection Map
Flash occupies byte addresses 0x000000 to 0x00BFFF, quartered into four blocks of 12 KB by CP0 through CP3. A full internal dump is 3,072 Intel HEX records at 16 bytes. Protected blocks read 0x0000 — a legal NOP on PIC18, so a locked quarter disassembles as plausible code — while erased flash reads 0xFFFF. The PIC18 copy protection scheme is a rewritable gate, not a fuse, so the part need not be destroyed by the read.
The 1,024-byte EEPROM at 0xF00000 carries setpoints and calibration for the typical industrial application, and it is read separately, twice. Chip extraction analysis covers what a post-read report should confirm; reading the program memory describes the two-pass standard.
A note on what a locked 8527 still gives up willingly: with every CP bit set, the programmer reads the device ID, the full config region and the EEPROM without obstruction. Only the protected array returns zeros. Since the config words are the part that most often decides whether a rebuilt board survives the field, the bench session is worth running before any decision about invasive work — it may turn out that the information a rebuild most needs was never locked in the first place.
What to Send
The marking photograph, a line about what the board controls, and — if known — whether the design uses the external memory interface, because code referencing addresses above 0xBFFF points at devices the internal dump does not contain. Our services page lists what a delivered image includes, and contact us with the part number if you are unsure which 48 KB family the board was built on.