The PIC18F8520 is the 32 KB member of the PIC18FXX20 family documented in DS39609: 16,384 single-word instructions, 2,048 bytes of SRAM, 1,024 bytes of data EEPROM, a 16-channel 10-bit A/D converter, five CCP modules, two addressable USARTs, and an 80-pin TQFP package with ports A through J. Unlike the smaller 6520, the 8520 also implements an external memory interface, and that detail changes what a recovered image means.
The Protection Map
Flash occupies byte addresses 0x000000 to 0x007FFF, and the code protection bits split it into four blocks of 8 KB each — CP0 through CP3. This is one of the cases where a general “PIC18 has 4 KB blocks” claim is wrong: the block size scales with the array, so a 16 KB device divides into 4 KB blocks while this 32 KB device divides into 8 KB blocks. A board can protect some blocks and leave others readable, and the dump reflects exactly that split.
A protected block reads back as 0x0000, not as an error, and since 0x0000 is a legal NOP instruction the hole disassembles as plausible code. The erased value is 0xFFFF. Telling a protected region from an unused one requires the device ID at 0x3FFFFE and the array size from the data sheet — the copy protection scheme on PIC18 is a gate, not a cipher.
The External Memory Interface
The program counter on the 8520 can address up to 2 MB when the external memory interface is enabled, mixing on-chip flash with external devices in several operating modes. Two practical consequences follow for a read-out.
First, the image may contain code that walks external memory: table-read sequences pointed beyond 0x7FFF, bus setup around the PSP port, or address arithmetic in the region above the internal array. That code is present and correct in the dump, but it references data the dump does not contain.
Second, if the board was designed in extended or microprocessor mode, part of the program may live on an external flash or EPROM entirely. The internal 32 KB can be complete and the product still cannot be rebuilt without the external device. Asking what the board carries next to the MCU — before the die is opened — saves a wasted cycle. This is a board-level question, and our services page separates die-level read-outs from board-level recovery for exactly this reason.
What the Image Looks Like
A 16,384-instruction image on a part with this peripheral set is usually control software: five CCP channels timing captures or PWM outputs, two addressable USARTs running independent links, and the A/D sequence scanning sixteen channels. In the disassembly that shows up as dense table access — TBLRD sequences walking constant tables, multiply routines for scaling, and the bank-select rhythm of 2,048 bytes of SRAM spread across banks.
The external bus leaves its own fingerprint. Address arithmetic on 21-bit pointers, code that initialises the PSP port as a bus master, or constant tables located at addresses above 0x7FFF are all signs the design used the interface. They are recognisable by shape without symbols, and they are the difference between reporting “image verified” and reporting “image verified, external references present”. A bare file and a file plus a statement of what it references are different deliverables, and only one of them lets whoever rebuilds the board know the job is finished.
The EEPROM Is Small but Real
Unlike the LCD family siblings, the 8520 has a genuine 1,024-byte data EEPROM, mapped at 0xF00000 in programming space. On industrial controllers built on this part, that is where setpoints, calibration and counters live. It is read as its own region, separately from the array, and it should be read twice — EEPROM cells with high write counts can return marginal values on a first pass. Losing it produces a rebuilt unit that boots correctly and then behaves unlike the original the first time an operator changes a setting.
Verification
A full internal dump is 2,048 Intel HEX records of 16 bytes. Delivery standard: two independent reads compared, the reset vector resolving into real code, no abrupt holes at the 8 KB block boundaries, the EEPROM read twice, and the config words at 0x300000 recorded — oscillator selection, brown-out level and watchdog are not inferable from the code. Reading the program memory sets out the full procedure, and chip extraction analysis covers what a post-read report should state about external references in the image.
The 64 KB sibling is the PIC18F8620, same family and package. Confirm which device you hold before anything else — the markings are easy to misread under conformal coating, and the difference is 32 KB. Contact us with the marking photo and what the board does.