The PIC18F8722 tops the DS39646 family: 128 KB of program memory — 65,536 single-word instructions — with 3,936 bytes of SRAM, 1,024 bytes of data EEPROM, sixteen 10-bit A/D channels, two CCP plus three ECCP modules, two enhanced USARTs, and the nanoWatt clock features: Fail-Safe Clock Monitor and Two-Speed Start-up. All of it in an 80-pin TQFP running DC to 40 MHz. It is the biggest of the family whose 48, 64 and 96 KB members were covered elsewhere, and the one whose recoveries most often arrive with a truncated file already in hand.
Boundaries and Blocks
Flash occupies byte addresses 0x000000 to 0x01FFFF: 8,192 Intel HEX records at 16 bytes. The four code protection blocks quarter the array into 32 KB regions, gated by CP0 through CP3 — the same block size as the PIC18F8720. A locked part returns constants from protected blocks while the device ID at 0x3FFFFE and the configuration words at 0x300000 stay readable. Erased reads 0xFFFF, protected or absent reads 0x0000, and only the ID read separates the two.
The truncation failure mode deserves repeating at this capacity: reset vector and C start-up live in the first 32 KB, so a file of 4,096 records looks structurally sound in a hex editor. Completeness is checked arithmetically against the ID — 8,192 records — not visually.
Against the 8720, Same Size, Different Family
Two parts carry 128 KB in these packages and they are not interchangeable in description. The 8722 has the ECCP trio, the second enhanced USART and the FSCM; the 8720 has five standard CCP modules and no clock-monitor fallback. Peripheral register usage in the disassembly distinguishes them quickly, but the device ID distinguishes them before the read starts, which is the order we prefer. The distinction also decides the substitution question: an 8720 image runs on an 8722 with room to spare, but the peripherals the code expects — five CCPs — do not map one-to-one onto the 8722’s ECCP arrangement, so substitution across that boundary needs a peripheral-by-peripheral look rather than a capacity check alone.
Where the nanoWatt Features Enter the Report
FSCM and Two-Speed Start-up are configuration bits, not code. A recovered image with the wrong settings produces a unit that runs on the bench and hangs or resets on a supply transient — the intermittent fault that motivated the recovery request in the first place. The configuration region at 0x300000 is therefore delivered with the array, not assumed. The 1,024-byte EEPROM at 0xF00000 carries the calibration and setpoints typical of instruments this size, read separately and twice, with disagreement between passes arbitrated by a third pass rather than an average — instruments in continuous service rewrite setpoints often enough that the busiest cells can read marginally, and an averaged marginal value is indistinguishable from a correct one on the bench and wrong in the field.
What the Block Tails Hold
At 128 KB the tail of each 32 KB block is where a design’s history collects. Firmware updated in the field tends to leave page-erased holes at block ends; parameter storage that outgrew its region leaves copied tables with old generations still present. Those patterns are informative in both directions: a uniform tail says the image is complete and the design never used the space, while a structured tail with stale generations says the read captured a living, updated product — and the freshest copy of each table is the one a rebuild needs. A delivery that includes the full array preserves that history; a compressed or trimmed one destroys it. Flag the anomaly rather than cleaning it silently.
The nine parallel ports — A through J — and the 29 interrupt sources with priority give the disassembly its texture on this part. A complete image of a product that drives this many pins shows vector-table entries spread across the source list; sparse vectors in a supposedly feature-complete file are one more hint that the read stopped short.
Instrument panels, networked controllers and metering heads are the applications this capacity was sold into, and they share a habit that shapes recoveries: long production lives with mid-life firmware updates. The 128 KB array usually contains more than one generation of code — the current image plus remnants of an earlier one in a page-erased region. Those remnants are not garbage; they date the sample, confirm the update path, and occasionally hold a routine the current image calls through a pointer that survived the update. A delivery preserves the full array precisely so that history stays available to whoever rebuilds the product.
Verification Before Delivery
Two independent flash passes compared byte for byte, config words and EEPROM as separate regions, reset vector resolved, each 32 KB block tail scanned for abrupt holes, ID reconciled with the marking and its silicon revision noted. Chip extraction analysis describes the review; reading the program memory sets the two-pass standard; where protection blocks block electrical access, semi-invasive IC extraction is the fallback.
Send the ordering suffix and the marking photograph. The services page lists deliverables; contact us for a specific device.