The Ceiling Of The 150x Line
The PIC16F1509 finishes the family at 8,192 words of flash (0x0000-0x1FFF), 512 bytes of SRAM, eighteen I/O lines, twelve channels of ten-bit ADC, two comparators, a DAC, four PWM modules, the CWG, the NCO, four Configurable Logic Cells, an EUSART and an MSSP. In twenty pins it runs complete smart-power products: multi-channel chargers, addressable lighting, small motor drives. Its array is large enough that firmware fills it unevenly, which matters for sweep interpretation.
Lock And Boundaries
CONFIG1 at 0x8007 with the single CP bit; ID at 0x8006; no EEPROM. The persistent region is the top 128 words of the array (0x1F80-0x1FFF), the High-Endurance Flash window where parameters accumulate over the product’s life. Sweep rules:
– 0x0000-0x1FFF: array, 0x000 under CP, 0xFFFF when erased. – 0x1F80-0x1FFF: HEF, inside the array sweep but annotated separately. – Above 0x1FFF: unmapped, 0x000.
The 8K boundary separates the 1509 from the 4K PIC16F1508 and the 2K PIC16F1507; all three share packages and markings, so the ID word decides.
What 8K Of 150x Firmware Looks Like
The recovered listing shows the family blocks at full width: four CLC function maps, CWG dead-band setups for multiple output pairs, an EUSART with a real command parser in the 512-byte SRAM, and a twelve-channel ADC scan whose results drive the logic cells directly in some designs – the peripherals reacting without CPU involvement is the generation’s signature. NCO increment words in the constants region record the output frequency plan; HEF parameters record what the field actually changed.
The Session
Identify, read both configuration words, sweep 0x0000-0x1FFF over two-wire ICSP, verify decoding word by word, deliver. No erasure, part serviceable, lock policy of any clone documented. As on every 150x member, the HEF tail gets its own annotation – it is the window where calibration and trip points drifted over the years, and clone firmware without those values behaves differently from the original.
Deliverables
HEX file at word addresses, annotated disassembly with CLC, CWG, NCO, serial and HEF regions labeled, configuration report, checksum tied to the die.
Eight Thousand Words With Configurable Logic
The PIC16F1509 pairs 8,192 words of flash with 512 bytes of SRAM, twenty pins, twelve ADC channels, two ECCP and two CCP, and four configurable logic cell blocks. The CLC is what sets this part apart: it lets the designer implement combinational and sequential logic in hardware instead of code, and firmware that uses it carries a small configuration table that describes a circuit nobody drew on a schematic.
Logic In A Register Table
A CLC block is configured by four registers that select inputs, apply a truth table and choose a flip-flop mode. When all four blocks are in use, the initialisation block contains sixteen register writes that together define a state machine, and reading them out is the only way to recover that part of the design. The report renders each block as a truth table alongside its input selection so a client can redraw the logic.
– Flash: 0x0000-0x1FFF (8K words), 0x3FFF erased, 0x0000 protected. – Configuration: 0x8007-0x8008, device ID 0x8006.
What Else Is In The Image
Beyond the CLC setup, the image is conventional enhanced mid-range code: a timer-driven main loop, an ADC sequencer and one serial port. Because the logic blocks offload the fast decisions, the firmware itself can afford to be simple, which makes the disassembly shorter than the array size suggests.
Output
HEX at word addresses, annotated disassembly with each CLC block rendered as a truth table, configuration report, checksum tied to the die.
To submit a locked 1509, use the services desk or the contact form with the part marking and a short board description.