The 8K 28-Pin Balance Point
The PIC16F1936 is the 28-pin, 8K-word member of the 193x line: 8,192 words of flash (0x0000-0x1FFF), 512 bytes of SRAM, 256 bytes of EEPROM at 0xF00000, twenty-five I/O lines, eleven channels of ten-bit ADC, three ECCP modules plus two CCP, an EUSART, an MSSP, two comparators with a five-bit DAC, and the 60-segment LCD driver inherited from the 28-pin branch layout. Products built on it are pump controllers, charge managers and panel meters – applications whose source code often lives with a contractor who has moved on.
Locks And Boundaries
CONFIG1 at 0x8007 carries both CP (array) and CPD (EEPROM); the ID is at 0x8006. The two windows lock independently, so the sweep is always double:
– Array: 0x0000-0x1FFF, reads 0x000 when CP is set. – EEPROM: 0xF00000-0xF000FF, gated by CPD alone.
Erased cells read 0xFFFF; above 0x1FFF the bus returns 0x000 for unmapped addresses. Boundary control separates the 8K members from the 4K PIC16F1933 and PIC16F1934 – a reader set for 4K on an 8K part silently truncates the image, and one set beyond 8K invents protected regions that do not exist.
Image Anatomy At 8K
Recovered 1936 listings separate into four recognizable blocks:
– LCD scan: the 60-element frame loop with bias control, sharing timers with PWM. – Analog: an eleven-channel scan table, two-register results, DAC-driven comparator trips. – Control: three ECCP time bases – power-stage control with auto-shutdown wiring. – Communication: EUSART framing plus MSSP in SPI or I2C mode.
The 512-byte SRAM allows two real ring buffers and a small state machine; the compiler’s bank-switching pattern in the disassembly is dense and distinctive. The EEPROM at 0xF00000 typically holds calibration written at final test and parameters updated in the field – on many boards it is the single most valuable 256 bytes of the recovery, and it is read even when the array is locked, because CP and CPD are independent bits.
The Session
Two-wire ICSP, on-board or socketed. Identify via the ID word, read CONFIG1/CONFIG2, sweep both windows, verify that every array word decodes as a legal enhanced mid-range instruction. Nothing is erased; the part remains programmable and returns to the board. The asymmetric-lock rule from the 193x family applies in full: report what each window returned, not what the lock bits were assumed to be.
Deliverables
HEX file at word addresses, EEPROM dump as a separate artifact, annotated disassembly with the four functional blocks labeled, configuration report documenting the found lock state, and a checksum tied to the physical die. Clone parts can be re-flashed with or without protection; both the found and applied policies are recorded.
Eight Thousand Words With Sixty Segments
The PIC16F1936 pairs 8,192 words of flash with 512 bytes of SRAM, 256 bytes of EEPROM, 25 I/O pins, eleven ADC channels, three ECCP and two CCP, and a sixty-segment LCD driver. It is the 28-pin panel controller with the larger array, used where a display and a real application have to coexist.
Display Plus Logic
With that much flash the firmware separates cleanly: a display refresh, a key scan, and an application layer with its own tables. The refresh is timer-driven and regular; the application is where the product behaviour lives. Because the two are usually in different address regions, the report can present them as separate listings, which makes review faster than walking a flat image.
– Flash: 0x0000-0x1FFF (8K words), 0x3FFF erased, 0x0000 protected. – EEPROM: 0xF00000-0xF000FF. – Configuration: 0x8007-0x8008, device ID 0x8006.
What The EEPROM Holds
On a display product the EEPROM usually carries language selection, setpoints and a serial number. Those bytes are the difference between a replacement that behaves identically and one that needs reconfiguration, so they are delivered as a separate file with a note on which bytes are product-specific.
For the 40/44-pin sibling at the same array size, see the PIC16F1937 page. To book a 1936 extraction, write to the services desk or the contact form with the part marking and the board’s function.