Between The 18-Pin And 20-Pin Branches
The PIC16F1828 belongs to the 1824/1828 branch of the enhanced mid-range family: 4,096 words of flash ending at 0x0FFF, 256 bytes of SRAM, 256 bytes of data EEPROM at 0xF00000, and eighteen I/O lines on a 28-pin package. The analog set is the twelve-channel ten-bit converter shared across the whole 182x/184x generation, and the peripheral block includes two CCP modules, one ECCP, an MSSP and an EUSART – a general-purpose balance that made the part popular in instrumentation front ends, industrial sensor boards and handheld metering products where a 28-pin footprint had to carry both analog inputs and a serial link.
Configuration Space And Lock Bits
This generation stores configuration in the 0x8000 window: ID at 0x8006, CONFIG1 at 0x8007, CONFIG2 at 0x8008. The single CP bit in CONFIG1 gates program-array reads; CPD in the same word gates the EEPROM. Behavior on a locked part follows the family standard:
– Array reads return 0x000 while the lock is active. – Erased cells read 0xFFFF. – The ID and configuration words remain open for identification and documentation.
An asymmetric lock – CP set with CPD clear, or the reverse – appears often enough on this family that both windows must always be swept independently, into separate files, no matter what the first pass returns.
The Recovery Sequence
1. Identify through the ID word at 0x8006 rather than the package marking. 2. Read CONFIG1 and CONFIG2 to document lock state, oscillator setup and watch-dog policy. 3. Sweep the program array, 0x0000-0x0FFF, over two-wire ICSP. 4. Sweep the EEPROM window, 0xF00000-0xF000FF, as a separate artifact.
Verification is straightforward: enhanced mid-range instructions decode cleanly, the interrupt prologue with its automatic context save is a known pattern, and FSR-based table reads give the image its characteristic texture. A word reading 0x000 inside the array signals protection rather than empty space; above 0x0FFF the same value simply means nothing is mapped there.
What 1828 Firmware Looks Like
Typical images show a ten-bit ADC sampling loop with two result registers per channel, an EUSART framed against the 32 MHz internal oscillator, and one ECCP producing PWM while the CCP pair handles capture duties. The 256-byte SRAM budget keeps buffers modest – usually two ring buffers of 32 bytes for the serial path plus a small command parser. Constant tables cluster near the top of the array, and the EEPROM frequently holds calibration written during final test, which is why the data window is often the most valuable 256 bytes of the whole recovery.
Deliverables And Cloning Notes
The standard output: HEX file at word addresses, EEPROM dump as a separate file, an annotated disassembly with the converter, serial and PWM blocks labeled, a configuration-word report, and a checksum bound to the physical part. Replacement devices can be flashed with the original lock policy or with protection deliberately left off – the report documents both what was found and what was applied.
Recovery requires no decapsulation and leaves the part serviceable. For the 8K-word sibling with 1 KB of SRAM, see the PIC16F1829 page; the 18-pin 2K version is covered on the PIC16F1826 page, and the 20-pin 4K variant on the PIC16F1827 page.
Four Thousand Words On Twenty-Eight Pins
The PIC16F1828 offers 4,096 words of flash, 256 bytes of SRAM, 256 bytes of EEPROM, eighteen I/O pins in a 28-pin body, twelve ADC channels, four ECCP and three CCP, two EUSART and two MSSP. It is the 28-pin member of the 182x line, and the extra pins over the 1827 buy a wider display or a second connector.
The EEPROM Is The Differentiator
With 256 bytes of data EEPROM the design can keep serial numbers, calibration and user settings without touching the code space. That makes the EEPROM the region a client most often needs, and it also makes it the region most often lost when a replacement is programmed from a HEX file that contains only flash. The session reads it as a separate binary and the report notes which bytes are product-unique.
– Flash: 0x0000-0x0FFF (4K words), 0x3FFF erased, 0x0000 protected. – EEPROM: 0xF00000-0xF000FF. – Configuration: 0x8007-0x8008, device ID 0x8006.
Output
HEX at word addresses, the EEPROM binary, annotated disassembly with both serial ports labelled, configuration report, checksum tied to the die.
To book a 1828 extraction, send the part marking and application background through the services desk or the contact form. Turnaround for this family is typically one to two working days.