Wide Analog, No Waveform Generator
The PIC16F1517 spreads the 1516’s core across a 40/44-pin package: 8,192 words of flash (0x0000-0x1FFF), 512 bytes of SRAM, thirty-six I/O lines, and twenty-eight channels of ten-bit ADC – the widest front end in the 8K tier. The “advanced control” column stays N: no CWG, so control outputs are plain CCP PWM. Two CCP modules, an EUSART and an MSSP complete the digital set. Boards built on it are process monitors and multi-sensor loggers whose channel tables dominate the recovered image.
Lock And Boundaries
CONFIG1 at 0x8007 with the single CP bit; ID at 0x8006; no EEPROM, with the top 128 words of the array (0x1F80-0x1FFF) as the High-Endurance Flash window. Sweep rules:
– 0x0000-0x1FFF: array, 0x000 under CP, 0xFFFF when erased. – 0x1F80-0x1FFF: HEF, swept with the array, annotated separately. – Above 0x1FFF: unmapped, 0x000.
The boundary distinguishes the 8K tier from the 4K PIC16F1513 and the 16K PIC16F1518 / PIC16F1519 – packages repeat across tiers, so the ID word at 0x8006 is the authority.
Image Anatomy
The recovered listing is organized around the scan: a twenty-eight-entry channel table with per-channel averaging, results streamed over the EUSART, and CCP PWM for local actuation. The 512-byte SRAM is nearly consumed by accumulators and the serial buffer – the compiler’s allocation pattern is dense bank switching, a reliable structural fingerprint. HEF contents – per-channel calibration and alarm thresholds – often explain board behavior that the schematic alone cannot.
The Session
Identify, read both configuration words, sweep 0x0000-0x1FFF over two-wire ICSP including the HEF tail, verify decoding word by word. No erasure, part serviceable, found lock policy documented before any clone is discussed.
Deliverables
HEX at word addresses, annotated disassembly with the scan table, serial and HEF regions labeled, configuration report, checksum tied to the die. For the 28-pin 8K sibling, see the PIC16F1516 page.
The 44-Pin 151x
The PIC16F1517 sits in the 151x line at 8,192 words of flash, 512 bytes of SRAM, 36 I/O pins, 28 ADC channels, two ECCP and two CCP, two EUSART and two MSSP. The line is the general-purpose workhorse of the enhanced mid-range family: enough pins for a panel, enough flash for a menu system, and no analog exotica beyond the ten-bit converter.
Menu-Driven Firmware
Products built on this part usually have a user interface, and that shows in the image as a large block of string and table data followed by a state machine that walks it. String tables are stored as packed bytes with a length prefix or a terminator, and locating them is what makes the disassembly readable – without that, the review is a hundred pages of table reads with no context.
– Flash: 0x0000-0x1FFF (8K words), 0x3FFF erased, 0x0000 protected. – Configuration: 0x8007-0x8008, device ID 0x8006.
Flash Endurance In The Field
This family is rated at 10,000 erase/write cycles for the flash array, which is generous until a product writes a settings block on every power-down. Parts that have done that for a decade arrive with a worn block near the top of the array, and the session reads it three times and reports any instability rather than quietly accepting the first pass.
Handover Package
HEX at word addresses, annotated disassembly with the string tables and the interface state machine marked, configuration report, checksum tied to the die.
Sending A Unit
Board or loose part both work. Where the product has a display, note whether it is still functional: a working display after recovery is the quickest confirmation that the image and the EEPROM were both reproduced correctly.
To submit a locked 1517, use the services desk or the contact form with the part marking and the channel count the board uses.