The J11 Family Ceiling Without USB
The PIC18F26J11 tops the non-USB J11 line: 64 KB of program memory (0x0000-0xFFFF), 3,776 bytes of SRAM, 48 MHz (12 MIPS), nanoWatt XLP with Deep Sleep, peripheral pin select, a hardware RTCC, the CTMU, two ECCP modules, two EUSARTs, two MSSPs, ten channels of ten-bit ADC and two comparators. No EEPROM, 2.0-3.6 V supply. Boards choose it when the 32 KB PIC18F25J11 overflows – larger protocol stacks, more logging.
Lock And Sweep
PIC18 configuration at the 0x300000 window: CP0/CP1 code-protect, WRT write-protect, boot-block bits. Erased config bytes read 0xFF; a locked array returns 0x0000. Sweep:
– Array: 0x0000-0xFFFF. – Configuration: 0x300000 window. – ID: 0x3FFFFE-0x3FFFFF.
Image Anatomy
The 64 KB array fills unevenly: vendor stacks in the low half, application logic above, emulated-EEPROM parameter blocks near the top. The 3.8 KB SRAM carries dual serial ring buffers, a CTMU touch state machine, and an RTCC-driven wake scheduler. PPS routing tables in the constants region record the pin map – essential context when cloning onto replacement boards.
The Session
The array on this part is long enough that the read is split at the 0x8000 boundary and each half verified independently. The PPS table near the vectors is decoded first, because it names the pins the product used and therefore which parts of the image are live code rather than unpurposed library blocks.
Deliverables
HEX file, annotated disassembly with the stacks, scheduler and parameter regions labeled, configuration report, checksum tied to the die. For the USB-equipped members at this size, see the PIC18F26J50 page.
Sixty-Four Kilobytes In A 28-Pin J11
The 26J11 is the largest array in the 28-pin J11 line: 64 KB at 0x0000-0xFFFF, 3,776 bytes of SRAM, ten ten-bit ADC channels, two ECCP, two EUSART, two MSSP, RTCC, CTMU and PPS. It is the non-USB counterpart of the PIC18F26J50, and the two share a die footprint, which makes the pair common in product families where only some variants need a host interface.
Where The Code Sits
A 64 KB image on 28 pins carries more code than the package can exercise, so the disassembly usually shows conditional blocks that are never entered on this variant – drivers for peripherals that exist in the larger package but not here. Those blocks are kept in the image because the same source builds both variants, and finding them is a quick way to confirm the client’s build configuration.
– Array: 0x0000-0xFFFF. – Configuration: 0x300000-0x300007. – ID: 0x3FFFFE-0x3FFFFF.
The Remap Table Is The Diagram
Because the J11 has PPS, the pin assignment is data rather than wiring. On a board with no schematic the PPS table in the first pages is the only reliable record of which pin drove the relay, which pin read the sensor and which two pins were the serial port. The report reproduces that table as a pin list, which is often the part of the deliverable clients use first.
Verification
Per-block checksums, a second read of the configuration window, and a walk of every interrupt vector to confirm it lands inside the array. Where a vector points outside 0x0000-0xFFFF the block is re-read before the image is released.
Output
HEX at word addresses, annotated disassembly with the PPS table expanded to a pin list, configuration report, checksum tied to the die. Original protection intact.
Sending The Part
Loose parts in an antistatic tube are preferable to populated boards where the ICSP pads are inaccessible. If the board has to come, note whether the regulator can be isolated, since the session prefers to supply the part from the bench rather than through an unknown regulator.
Delivery Note
The report names the package variant the die came from, because the same part number is offered in PDIP, SOIC and QFN and the pin assignment differs enough to matter when a replacement is soldered in.
To copy a locked 26J11, use the services desk or the contact form.