What The 20-Pin Part Actually Contains
The PIC16F720 sits at the bottom of Microchip’s 72x value-line family: 2,048 words of flash (3.5 KB), 128 bytes of SRAM, and a twelve-channel analog front end that is 8-bit, not 10-bit. Distributor pages copy the 10-bit figure from other PIC16 families, so a first pass at reconstructing the firmware often mis-labels the converter routines. The part carries one CCP module, an AUSART, an SSP for SPI and I2C slave duties, and an internal 16 MHz oscillator. There is no data EEPROM; instead the top 128 words of the program array (0x0780-0x07FF) form a High-Endurance Flash block rated for 100,000 write cycles, where the application parks calibration constants.
Protection On The 72x Family
The 720 uses the classic mid-range protection model: one CP bit inside the configuration word stored at 0x2007. When a programmer sets that bit during production, code-protect is enabled. An erased configuration word reads 0x3FFF; a protected device still exposes the configuration word and the device ID at 0x2006, so identification never requires breaking anything. Reading the program array itself is where the lock bites: every fetch through ICSP returns 0x000 instead of instruction data.
What A Sweep Returns
Three regions behave differently during a blocked read:
– 0x0000-0x07FF: program array, returns 0x000 when protected. – 0x0780-0x07FF: the HEF block, also silenced by CP. – Above 0x07FF: unmapped, and it also returns 0x000.
That makes a three-state interpretation necessary: 0xFFFF means erased, 0x000 means protected or nonexistent. The 2 KB size keeps the sweep short, but the boundary test matters – a tool that assumes a larger array will report one giant protected region instead of the truth. The same single-bit model applies to the PIC16F721, its 7 KB sibling.
The Recovery Path
Because the 720 is a mid-range core with 35 instructions, the disassembly is compact once a raw image is obtained. The procedure is the standard ICSP route: identify the part through 0x2006, confirm the configuration word is readable, then recover the array through the programming specification rather than the application interface. Nothing on the target board needs to be removed, and the two-wire ICSP header that production used for flashing is usually accessible on the test points.
What Comes Back
The deliverable is a HEX file keyed to word addresses, twice the byte length in the file, plus a commented disassembly. Converter calibration tables normally show up as a block of near-identical words inside the HEF window, and the 8-bit ADC sampling loops are easy to recognize from their short turnaround times. For boards built around the larger members such as the PIC16F726, the same sweep method applies with a different end address.
Two Thousand Words With A High-Endurance Block
The PIC16F720 is the smallest 72x part with the 128-byte high-endurance block: 2,048 words of flash, 128 bytes of SRAM, twenty pins with eighteen I/O, twelve ADC channels, two ECCP and one CCP. Two kilowords with a persistent block points at a product that counts or accumulates something and has to remember it across power cycles.
Counting Products
Run-hour meters, cycle counters and dosing controllers are built on exactly this combination. The firmware reads the HEF block at start-up, increments it through a self-write routine on a timer, and writes it back – a pattern that appears in the disassembly as a small block of code that is called rarely and does almost nothing except arithmetic and a write sequence. Recognising it tells the reviewer where the product’s persistent state lives.
– Flash: 0x0000-0x07FF (2K words), 0x3FFF erased, 0x0000 protected. – HEF: 128 bytes at the top of the array. – Configuration: 0x2007, device ID 0x2006.
Endurance And Wear On The Counter
The HEF block is rated far above the main array precisely because it is written often. Even so, a unit that has run for years may show a worn location, and the session reads it twice and reports any instability rather than returning a value that happens to be readable on the first pass.
If your 720-based board has lost its source and the programmer refuses to read, send the part number and package to our services desk or use the contact form – the 72x family is a routine job with a one-to-two day turnaround.