Two boards can carry the same PIC18F4420 and need completely different jobs done. One has a 40-pin PDIP that drops into a socket and may not need to be touched physically at all. The other has an 8×8 mm QFN soldered down by its thermal pad. The part number is identical; the work is not.
The device holds 16 KB of flash — 8,192 instruction words — with 768 bytes of SRAM, 256 bytes of data EEPROM, 36 I/O pins, a thirteen-channel 10-bit ADC, one CCP and one enhanced CCP. It is the 44-pin sibling of the PIC18F4410, sharing datasheet DS39632.
Three Packages, Three Routes
| Package | Size and pitch | Removed from board? | What it means for the job |
|---|---|---|---|
| PDIP-40 | 0.600 in row spacing | No | Socketable; interface read first, decap only if locked |
| TQFP-44 | 10×10 mm, 0.8 mm pitch | Yes | 44 leads to lift; generous die window once open |
| QFN-44 | 8×8 mm, exposed pad | Yes | Hot-air lift; thin mould above the die; tight window |
The PDIP row is where the cost saving hides. A through-hole 0.600-inch part fits a standard programmer socket, so the entire diagnostic sequence — device ID, EEPROM, flash read pattern — can run without any physical intervention, and without desoldering the device from a board that may be the only one in existence.
Why the QFN Is the Hard One
Package choice changes the geometry of the opening, and the geometry sets the margin.
On a PDIP there is a substantial column of mould compound above the die, and the cavity walls are far from the bond wires. An invasive approach has room to work: the etch can be stopped, inspected, and resumed without touching anything fragile.
On the 8×8 mm QFN the exposed pad on the underside *is* the die-attach paddle. The compound above the die is thin because the package is thin, so the window between “die visible” and “bond wires compromised” is narrow, and it closes fast. The part also cannot be worked while attached to a board — the pad is soldered down across its whole area, so it has to be lifted with hot air first, and lifted without flexing the package, because a cracked die is unrecoverable.
None of that makes the QFN a bad candidate. It makes it a job that needs the package identified before the quote rather than after.
Orientation After the Package Is Gone
Pin 1 disappears with the plastic. On a decapped PIC18 there are two usable references: the bond pad ring, whose gap and corner pad arrangement is asymmetric, and the top-metal marking on the die itself. Both survive the opening; neither is obvious if the operator is working from a generic photograph.
Getting this wrong is not a subtle error. A die read 180° rotated returns data from the wrong end of the array, which passes a blank check and fails every structural test afterwards. It is the single most common cause of a “the dump looks like noise” report on this family.
The Read Plan for 16 KB
| Region | Address | Size |
|---|---|---|
| Program flash | 0x000000–0x003FFF |
16 KB |
| Config words | 0x300000–0x30000D |
14 bytes |
| Data EEPROM | 0xF00000–0xF000FF |
256 bytes |
| Device ID | 0x3FFFFE |
2 bytes |
8,192 words is small enough that the read is not the constraint — verification is. Three passes matter: the reset vector at 0x0000 must branch into real code, the interrupt entries at 0x0008 and 0x0018 must resolve inside the image, and a filler scan across 64-byte blocks must find no region that the read failed to retrieve. That is chip extraction analysis work, and on a 16 KB part it takes minutes rather than hours.
Before Committing to Physical Work
Two questions decide whether the package matters at all. Is the data EEPROM protected? The CPD bit is separate from the flash protection bits and is often left clear, in which case 256 bytes of calibration and identity come back over a plain socketed connection. And is the flash protected across all three blocks, or only the first?
A read-out of the array over the programming interface answers both in ten minutes on a PDIP, and on a soldered QFN it answers them the moment the board arrives at a bench with test points.
Send the package type, the marking photograph and the board photograph together. Jobs on this family are usually scoped from those three images, and every one is handled under a non-disclosure agreement as a matter of course.