The PIC18F6490 is the 16 KB member of the DS39629 metering family, in the 64-pin package: 8,192 single-word instructions, 768 bytes of SRAM, a 10-bit A/D converter with twelve channels, two CCP modules, an EUSART with LIN support, and the integrated LCD driver — 128 pixels, 32 segments by 4 commons, with an on-chip voltage boost regulator that lets the display run from a battery while the silicon sleeps at 0.1 microamps. Water meters, gas meters, thermostats, home security. It is the part the PIC18F6390 doubles in code space without changing anything else, and that single-number relationship is the most common source of confusion in its recoveries.
Sizes and Boundaries
Flash occupies byte addresses 0x000000 to 0x003FFF: 1,024 Intel HEX records at 16 bytes. Erased cells read 0xFFFF. Code protection is a single gate over the whole array — no blocks on this family — and a locked part returns 0x0000 across the flash while the device ID at 0x3FFFFE remains readable. The same 64-pin package carries the 8 KB and 16 KB variants, so the ID read is not ceremony: a 512-record file and a 1,024-record file describe different devices, and only the ID says which one is on the board.
The Display Configuration Problem
On this family the LCD settings are configuration bits, not code: bias mode (static, 1/2 or 1/3), multiplexing, the drive clock source and its divider. They sit in the configuration region at 0x300000, outside the flash array. A recovery that delivers the array alone produces a rebuilt meter whose firmware is byte-identical to the original and whose display is dark, dim, or showing ghosts — because the panel is being driven with the wrong bias while the code waits for keys that never register. The configuration words are read and delivered with the array, every time.
Why Wrong Bias Looks Like Ghosts
It is worth spelling out what a wrong LCD configuration actually does, because the symptom misleads. Bias mode sets the voltage levels the driver places on the segments and commons; multiplexing sets how many commons share the timing. Get either wrong and the panel does not go dark — it ghosts: faint digits where nothing should display, segments that respond to the wrong columns, contrast that shifts with temperature. The firmware is innocent in all of it. That is why the configuration words at 0x300000 are delivered with the array on this family without exception, and why the delivery notes state which bias and mux settings were recovered rather than letting the rebuilt unit’s behaviour speak for itself.
The segment map belongs to the same story. With 32 segments across 4 commons, the mapping between array indices and display positions lives in the code as a table; a complete image carries it, and a spot check against the panel’s expected output confirms both image and map at once.
Where the Metering Data Lives
There is no data EEPROM on the 6490. The calibration coefficients and usage counters that a meter must survive power cycles with are held in a flash page the firmware rewrites, which is inside the array and therefore recovered with the code — the good news — or in an external serial device on the board, which is not. For a rebuild, identify which case applies before promising a working unit: a flash-stored page arrives with the image; an external store has to be read from the board.
The flash-stored page has its own signature in a complete image. Because erasure on this family happens in pages while programming happens in rows, a rewritten parameter region shows as a block of uniform 0xFFFF boundaries around non-code values — a shape no compiler produces for code. Finding it confirms both that the read is complete and that the design stored its data internally, which settles the rebuild’s data question in the same glance.
The EUSART’s LIN support rounds out the picture. Water and heat meters increasingly report over LIN rather than optical probes, and the node’s assignment — its address, its response table — lives in the same stored regions as the calibration. A rebuild whose metering is correct but whose LIN identity was lost joins no network; so for connected meters the identity fields are checked and called out in the delivery notes alongside the trim values, not left for the integrator to discover on site.
Verification
Two independent flash passes compared byte for byte, configuration words as a separate delivered region, reset vector resolved to real code, the region between the last used record and 0x003FFF scanned for abrupt holes, and the ID reconciled with the marking. Chip extraction analysis covers that review; reading the program memory sets the two-pass standard.
The 80-pin members of the same family — the PIC18F8390 and PIC18F8490 — drive 192 pixels instead of 128 and follow the same recovery logic. Send the marking photograph and what the display is supposed to show when the board works; the services page lists deliverables, and contact us for a specific device.