The 4K-Word 20-Pin Member
The PIC16F1827 extends the 1826 with 4,096 words of flash (0x0000-0x0FFF), 384 bytes of SRAM and a doubled PWM set: two ECCP modules plus one CCP, driving up to four half-bridge outputs. The 256-byte EEPROM at 0xF00000, the twelve-channel ten-bit ADC, the two comparators and the 32 MHz internal oscillator are all carried over unchanged. It is the most common member of its family to reach the field in volume, which makes it a frequent recovery subject.
Lock Model
Enhanced mid-range, so: CONFIG1 at 0x8007 with the single CP bit, CONFIG2 at 0x8008, ID at 0x8006. Erased reads 0xFFFF, locked array reads 0x000. The EEPROM answers to CPD in the same configuration word – production builds normally set both, but a meaningful minority of boards set only CP, leaving 256 bytes of constants readable on an otherwise locked part.
The Two-Pass Sweep
1. Program array, 0x0000-0x0FFF. Everything decoded must be a legal enhanced mid-range instruction; the automatic context save makes interrupt prologues distinctive and easy to spot for verification. 2. EEPROM, 0xF00000-0xF000FF. Read separately, preserved separately. On this family the data window commonly holds factory calibration, a product serial or a lookup table the control loop indexes at runtime.
Unlike the older mid-range parts there is no HEF block to confuse the boundary – the array ends at 0x0FFF and the next mapped region is the configuration space at 0x8007.
Peripheral Fingerprints In The Image
Recovered 1827 code is recognizable from:
– Two ECCP setups with steer and dead-band registers touched in init. – An EUSART auto-baud sequence against the 32 MHz clock block. – Comparator switching driven from the SR latch, emulating a 555 in some boards. – Ten-bit ADC sampling with two-result registers per channel.
The data signal modulator shows up in remote-control boards as a carrier-generation block. All of these are labeled in the annotated listing that accompanies the raw image.
The Session Itself
Recovery is on-board through the ICSP pair whenever the header survived production; socket work is equally routine. Identify, read configuration, sweep the array, sweep the EEPROM, verify. Nothing is erased in the process – the PIC16F1826 note about asymmetric locks applies here verbatim: check the EEPROM even when the program array is dark, and check the array even when only CPD was set.
Output And Cloning
Deliverables: HEX at word addresses, EEPROM dump as a separate file, annotated disassembly, configuration report, checksum. Replacement parts can be flashed to match the original lock policy exactly. For the 8K sibling with 1 KB of SRAM, see the PIC16F1829 page; for the 2K version, the PIC16F1826 page.
Four Thousand Words, Twenty Pins
The PIC16F1827 carries 4,096 words of flash, 384 bytes of SRAM, 256 bytes of EEPROM, 16 I/O pins in a 20-pin package, twelve ten-bit ADC channels, four ECCP and three CCP modules, two EUSART and two MSSP. It is the 20-pin workhorse of the enhanced mid-range line, and its images are dense with serial traffic because two independent ports are available.
Two Ports, One Board
A design with two EUSARTs usually bridges two protocols, and the recovered image shows two receive state machines with a translation block between them. That block is the product: it maps command bytes from one side to actions on the other, and it is the part of the disassembly most worth reproducing as a table in the report.
– Flash: 0x0000-0x0FFF (4K words), 0x3FFF erased, 0x0000 protected. – EEPROM: 0xF00000-0xF000FF. – Configuration: 0x8007-0x8008, device ID 0x8006.
Turnaround is one to two working days for a single unit; the EEPROM is delivered alongside the code so the replacement boots with its stored parameters intact.
To submit a locked 1827, use the services desk or the contact form with the part marking and, if available, the last known build date.