The Family Ceiling
The PIC16F727 is the largest 72x device: 8,192 words of flash (0x0000-0x1FFF), 368 bytes of SRAM, thirty-six I/O lines, and fourteen channels of the family’s eight-bit converter. Where the 726 devotes its pins to general I/O, the 727’s extra pins carry the touch-sensing multiplexer – boards built on it are dominated by capacitive button arrays, lamp dimming and serial reporting.
One Bit Stands Between You And The Image
All 72x members use the same mid-range protection: a single CP bit inside the configuration word at 0x2007. It is set by the production programmer, and once set, every array fetch through ICSP returns 0x000. What stays open on a locked part: the device ID at 0x2006 and the configuration word itself. That is enough to identify the die, document the lock, and drive the recovery – which proceeds through the device programming specification, not through any application-level door.
The sweep rule set:
– 0xFFFF = erased. – 0x000 inside 0x0000-0x1FFF = protected. – 0x000 above 0x1FFF = unmapped.
The 8K boundary must be set before the sweep; otherwise the report mixes protected cells with dead addresses, as it would on the PIC16F724 if read with 8K assumptions.
What A 727 Image Contains
Recovered images from the 727 show the densest peripheral setup in the family:
– A channel table for fourteen analog inputs, usually interleaved with touch keys. – mTouch scanning loops with charge timers on the CPS-multiplexed pins. – Two CCP modules – frequently one for PWM dimming, one for timing. – AUSART framed output against the internal 16 MHz oscillator.
The 8-bit converter keeps the sampling code short, and the 368-byte SRAM budget means buffers are sized tightly – ring buffers of 16 or 32 entries are the norm. Instruction-level review of these structures is the fastest verification that the recovered image is complete and consistent.
The Recovery Session
Two-wire ICSP, on-board or in a socket. The regulator note applies here as on the other 28/40-pin members: the VCAP pin’s capacitor must be healthy for the core to respond, and on aged boards that is the first thing to check when the interface stays silent. The array comes back in one pass; there is no EEPROM or HEF window on this member, so the program array is the whole story.
The Output Package
HEX file, configuration-word report, annotated disassembly, checksum. Clone parts can be re-flashed with or without the CP bit – that choice is documented, not assumed. For the smaller members, see the PIC16F726 and PIC16F722 pages; the procedure differs only in boundary addresses.
Eight Thousand Words On A 40-Pin Body
The PIC16F727 is the largest of the 72x line: 8,192 words of flash, 368 bytes of SRAM, 36 I/O pins, fourteen ADC channels, two ECCP and one CCP, one EUSART and one MSSP, in a 40-pin package. It is a mid-range part with a lot of pins, and it turns up in appliance controllers where many relays and many buttons share one board.
Many Outputs, Simple Logic
A forty-pin 72x design is usually a relay bank with a key matrix, and the firmware is a scan routine plus a decision table. The scan routine is regular and easy to find; the decision table is the product, mapping key combinations to relay patterns, and it is what the report annotates in detail because it is unrecoverable from any other source.
– Flash: 0x0000-0x1FFF (8K words), 0x3FFF erased, 0x0000 protected. – Configuration: 0x2007, device ID 0x2006.
Eight-Bit Conversion And Old Constants
The ADC on the 72x line is eight-bit, and the constants in the firmware are scaled to that range. A client moving the design to a ten-bit part has to rescale every threshold, and knowing the original values is the only reliable starting point – which is a common reason these parts are sent in years after production ended.
Output
HEX at word addresses, annotated disassembly with the key scan and the decision table expanded, configuration report, checksum tied to the die.
To schedule a 727 recovery, write to the services desk or use the contact form with the part marking and a photo of the board if available.