Both are 40-pin. Both hold 64 KB. Both run at 40 MHz and both are PIC18F parts that a distributor will happily cross-reference. One of them has a CAN controller and the other has a PWM module, and that is not a difference you can patch in a hex editor.
The PIC18F4680 belongs to the PIC18F2585/4585/2680/4680 family, DS39625. It carries 64 KB of flash as 32,768 words, 3,328 bytes of RAM, 1,024 bytes of data EEPROM, an ECAN module, eleven 10-bit ADC channels, two comparators, one CCP and one ECCP, and a parallel slave port on the 40-pin devices. It is the part that turns up in CAN gateways, chargers and small drives.
Two Parts, One Outline
PIC18F4620 is the other 64 KB, 40-pin PIC18F that ends up in the same drawer. The differences are not cosmetic:
| PIC18F4680 | PIC18F4620 | |
|---|---|---|
| Program memory | 64 KB | 64 KB |
| RAM | 3,328 B | 3,968 B |
| Data EEPROM | 1,024 B | 1,024 B |
| CAN | ECAN | none |
| ADC channels | 11 | 13 |
| Datasheet | DS39625 | DS39626 |
Put a 4620 into a 4680 board and the firmware runs, initialises the CAN registers, and gets nothing back, because the module is not there. The node never appears on the bus. Put a 4680 into a 4620 board and the code that drives the ECCP writes into registers that do not exist on that die, so the motor or the lamp driver simply does not switch. In both directions the board powers up and the failure looks like a firmware bug.
The RAM gap is quieter and nastier. Six hundred and forty bytes is the difference between a design that fits its buffers and one that overruns them. Firmware written for 3,968 bytes will allocate receive queues that run past 0xBFF into the access bank on a part with 3,328, and the corruption surfaces as a stack fault hours into a session rather than at boot.
The Array in Four
| Block | Byte range | Words | Bit |
|---|---|---|---|
| 0 | 0x000000–0x003FFF |
8,192 | CP0 |
| 1 | 0x004000–0x007FFF |
8,192 | CP1 |
| 2 | 0x008000–0x00BFFF |
8,192 | CP2 |
| 3 | 0x00C000–0x00FFFF |
8,192 | CP3 |
The bits are in CONFIG5L at 0x300008; CPB and CPD share CONFIG5H at 0x300009. CPD covers the 1,024 bytes of EEPROM, where a CAN product typically keeps its node address, its baud-rate override and the serial number the service tool reads over the bus. A file with a complete flash image and a zeroed EEPROM region is a file that will make a replacement unit indistinguishable from its neighbours.
The 96 KB Cousin
The PIC18F4685 shares DS39761 with the 2682 and the 4682, not DS39625, and carries 96 KB. It is often described as “the 4680 with more flash”, which is close enough to cause damage: a 4685 image written into a 4680 programs the low 64 KB and stops, so the application runs until the first call into code above 0xFFFF and then resets.
The file itself gives the difference away. A 4680 image never needs an extended linear address record above 0x0000 for program data, because 64 KB is the whole 16-bit space. A 4685 image carries :020000040001xx records for the region above 0x10000. If the file has one, it is not a 4680 image.
Verifying Without a Reference
Three checks survive the absence of an original:
1. Device ID. 0x3FFFFE separates 4680 from 4620 and from the 28-pin PIC18F2680, which shares the datasheet at 64 KB but has fewer pins and fewer ADC channels. 2. Zero-run alignment. Uniform zeros from 0x0000 to 0x3FFF, or on any other 16 KB boundary, is a protected block. Erased words read 0xFFFF; 0x0000 is NOP and disassembles without complaint. 3. Seams. Disassemble across 0x3FFF, 0x7FFF and 0xBFFF. A branch target landing mid-instruction at a seam means a word was lost while the blocks were joined.
For a board being rebuilt, the useful information to send is the marking, the package, the crystal frequency and a photograph: the frequency alone tells whether the file will come up on the right clock, and the reading the program memory page explains why the configuration block is captured with the array rather than after it. The services page lists what each delivery includes.