The PIC18F8525 is documented in the PIC18F6525/6621/8525/8621 family data sheet (DS39612): 48 KB of enhanced flash — 24,576 single-word instructions — 3,840 bytes of SRAM, 1,024 bytes of data EEPROM, a 16-channel 10-bit A/D converter, two CCP modules plus three Enhanced CCP modules capable of twelve PWM outputs in total, two addressable EUSARTs, a parallel slave port, and an external memory interface addressing up to 2 MB. The package is 80-pin TQFP.
Forty-Eight Kilobytes Change the Arithmetic
Flash occupies byte addresses 0x000000 to 0x00BFFF, and the code protection bits divide it into four equal blocks of 12 KB — CP0 through CP3. Neither the 4 KB blocks of a 16 KB part nor the 8 KB blocks of a 32 KB part apply here; the array is quartered, and at 48 KB each quarter is 12 KB. A partial dump that stops at 0x4000 or 0x8000 is one or two quarters of the part, and the boundary holes are where protected-versus-erased confusion shows up.
A full internal dump is 3,072 Intel HEX records at 16 bytes. Protected blocks read 0x0000 — a legal NOP instruction on PIC18, so a locked quarter disassembles as if it were code. Erased flash reads 0xFFFF. The device ID at 0x3FFFFE distinguishes the two situations, and the PIC18 copy protection scheme is described in full on our method page.
ECCP in the Disassembly
Three Enhanced CCP modules with dead-time control, auto-shutdown and half-bridge or full-bridge modes put this part in motor drives, lamp ballasts and power supplies, and the image reflects it. Expect PWM period tables, dead-time constants chosen for a specific transistor pair, and shutdown-response code that runs only when a fault input fires. Those constants are board-specific by nature — they were tuned to the power stage the board was built with — so they are worth flagging in a delivery report rather than leaving buried in the disassembly.
The auto-shutdown sources are configured partly in the config words and partly in the ECCP control registers written at start-up, which means a code-only review understates the protection logic the design relied on. A rebuilt unit with the right code but blank config will run, drive its outputs, and skip the fault protection the original had — a failure that only appears when something goes wrong, which is the worst possible time.
Telling It Apart from the 8527
This is the trap specific to the 48 KB point. The PIC18F8527 is also a 48 KB, 80-pin part, but it comes from the nanoWatt family documented in DS39646, with 3,936 bytes of SRAM instead of 3,840, a different interrupt set, and different configuration behaviour including a Fail-Safe Clock Monitor. Same package, same flash size, different silicon — code compiled for one runs on the other more often than not, which is why boards get repaired with the wrong sibling and then misbehave under supply dips or clock loss.
The reliable discriminator is the ID read at 0x3FFFFE, not the marking. Conformal coating and resurfaced tops make even honest markings unreliable, and the two devices share a footprint, so a misidentified part costs a full working cycle before anyone notices.
What the Image Will Contain
Motor and power control is the typical application for a part with three ECCP modules, so expect PWM tables, dead-time constants and half-bridge or full-bridge control code. The ECCP auto-shutdown settings live in the config registers, not in the code — an image without the config words at 0x300000 programs a blank part that boots and then misdrives its outputs under fault conditions.
The 1,024-byte EEPROM at 0xF00000 carries the calibration and setpoints. Read it as its own region and read it twice; a rebuilt unit with the right code and a wiped EEPROM boots correctly and drifts the first time a parameter matters. The external memory interface adds the usual caveat: code referencing addresses above 0xBFFF points at external devices the internal dump does not contain, so check what the board carries beside the MCU. Chip extraction analysis covers the post-read review, and reading the program memory sets out the two-pass read standard.
One more boundary worth knowing: on a locked device the programmer still answers. The ID read, the config region read and the EEPROM read all work with every CP bit set — only the protected array returns zeros. That makes a single bench session with a standard programmer the cheapest diagnostic available: it distinguishes a locked part from a dead one, identifies the variant, and recovers the parameters region before anyone talks about opening the package.
Before You Send
One marking photo, one line about what the board drives, and whether the design uses external memory. The 64 KB sibling in the same family is the PIC18F8621. Our services page lists what a delivered image includes; contact us with the part number and we will confirm the layout before any work on the die.