One Step Up From The Floor
Where the 720 stops at 2K words, the PIC16F721 carries 4,096 words of flash – 7 KB – with 256 bytes of SRAM, in the same 20-pin footprint. Pin compatibility is the reason boards migrate between the two: the twelve-channel converter is 8-bit on both, the CCP, AUSART and SSP set is identical, and both run from an internal 16 MHz oscillator across 1.8-5.5 V. When a locked 721 arrives for recovery, the array that has to come back is exactly twice the length, ending at 0x0FFF instead of 0x07FF.
The Memory Map That Matters
– Program array: 0x0000-0x0FFF, fourteen-bit words. – High-Endurance Flash: the top 128 words, 0x0F80-0x0FFF, rated 100,000 cycles. – Configuration word: 0x2007, holding the single CP bit. – Device ID: 0x2006, readable on a locked part.
There is no separate EEPROM array. Applications that need persistent storage either use the HEF window or emulate a data block in the main array, which is why end-of-image constants are worth preserving during extraction – they are frequently the calibration record.
Lock State And Read Behavior
The 721 inherits the mid-range protection model: one CP configuration bit, set at production time. With the bit active, ICSP reads of the program array return 0x000 while the configuration word and ID locations stay visible. A careful sweep distinguishes erased words (0xFFFF), protected words (0x000) and addresses past the array end (also 0x000). Because the 4K boundary falls at 0x0FFF, a reader configured for the 8K PIC16F726 will misreport the upper half as one dead zone; matching the reader to the part is most of the diagnostic work.
Why The 8-Bit Converter Shapes The Image
Firmware images from the 72x family have a recognizable texture. The ADC routines work on eight-bit results, so the result registers are read as single bytes and the averaging loops are short. Interrupt vectors live at 0x0004 (peripheral) and 0x0008 (interrupt), and the reset vector at 0x0000 usually points to a short init that tunes the internal oscillator. These structures make a manual sanity check possible before the disassembly pass: if the image decodes into plausible mid-range instructions, the recovery succeeded.
The Extraction Procedure
Recovery uses the two-wire ICSP interface that production programming already exposed. The sequence is: identify through the ID word, read back the configuration word, then recover the 0x0000-0x0FFF array through the device programming specification. No board modification, no decapsulation – the 721 keeps its silicon intact and can be returned to service.
Four Thousand Words With A High-Endurance Block
The PIC16F721 is a 20-pin member of the 72x line with eighteen I/O: 4,096 words of flash, 256 bytes of SRAM, twelve ADC channels, two ECCP and one CCP, one EUSART and one MSSP – plus a 128-byte high-endurance flash block, which its 720 sibling also carries. It is the only pair in the 72x family with that block, and it changes what a recovery has to deliver.
Why The HEF Block Matters
Without a data EEPROM, the designers of these parts put frequently rewritten values into the high-endurance block: a run-hour counter, a cycle count, a last-known state. A dump that omits it produces a replacement that runs but has lost its history, and on a maintenance product that history is often the point of the unit.
– Flash: 0x0000-0x0FFF (4K words), 0x3FFF erased, 0x0000 protected. – HEF: 128 bytes at the top of the array. – Configuration: 0x2007, device ID 0x2006.
Reading Mid-Range Code
The 72x core has thirty-five instructions and no automatic context save, so the disassembly is explicit about banking and state preservation. Resolving those sequences into readable blocks is most of the annotation work, and it is what turns a raw listing into something a client can follow.
The output package contains the HEX file, a verified checksum, and a cross-referenced disassembly with the HEF window and oscillator tuning calls annotated. If the board pairs the 721 with an 8K sibling such as the PIC16F720, both can be handled in the same session. To book a recovery for a locked 721, message the service desk or reach us through the contact page.