The PIC16F18046 is the memory flagship of the 20-pin PIC16F180 generation: 28 KB of flash, 2048 bytes of SRAM and 256 bytes of data EEPROM, with a 10-bit ADC offering seventeen external plus four internal channels, two I2C, two SPI and two EUSART interfaces. A charge pump, zero-cross detect, an 8-bit DAC and four configurable logic cells round out a peripheral set that usually removes every external analogue part from the board. When protection is engaged, our copy locked PIC16F18046 memory service recovers flash and EEPROM from hardware you own.

Where the 180xx protection sits

This generation partitions program flash into application, boot and storage area blocks with programmable code and write protection, and keeps factory data in a device information area that also stores the Microchip unique identifier. Protection can be set per block, so the first bench step is reading the configuration words to learn the policy. A disciplined copy locked PIC16F18046 memory job then reads each recoverable region locked – flash, EEPROM and the information area – while the bulk erase that would clear protection stays out of the procedure.

EEPROM, ADCC and what they carry

The 256-byte data EEPROM typically holds calibration records and identity data in the units we recover, and the ADC with computation adds another layer: its averaging, filtering and threshold-comparison settings live in registers initialised from flash constants. A clone that skips the EEPROM or resets ADCC configuration will boot cleanly and then measure wrong – a failure mode that costs customers days when they meet it alone. Our capture includes all three regions, and verification exercises the analogue chain against the donor’s signature on a bench fixture. The delivered report marks which EEPROM bytes look like structured records, which ADC constants were found, and where the boot block’s update framing begins. General bench reasoning is in the how the MCU memory works guide, and the analogue-preserving approach is the same one described on our PIC16F15355 firmware page for the 183xx generation.

Charge pump and zero-cross detection in the capture

The charge pump that lifts gate-drive rails and the zero-cross detector that synchronises switching to the mains are both configured from registers the application initialises at boot. Their constants are small but load-bearing: a wrong charge-pump setting surfaces as noisy switching or missed drives, and a wrong zero-cross threshold as flicker or as protection trips at the wrong phase angle. Our capture preserves those constants with the rest of the configuration space, and verification watches the zero-cross output and the drive rails against the donor on a two-channel scope. Analogue-timed behaviour is where this generation hides its tuning, and it is exactly where a byte-perfect clone without analogue verification would still disappoint.

Two-EUSART designs and their capture

With two EUSARTs on one die, designs on this part typically bridge two buses – a field bus and a service bus, or two protocols at different rates. Each port carries its own framing, baud constants and interrupt priorities, and the pairing between them is the design’s real intelligence. We capture both ports’ initialisation together and exercise each against a live transaction in verification, because a clone that gets one port’s timing subtly wrong will pass every loopback test and still corrupt the bridge in production. The report records both ports’ settings side by side, which is also the cleanest specification your engineers will ever get of how the two buses were meant to interoperate.

Where clones fail in the field

The failure reports we hear about from unverified clone attempts cluster in the same three places: EEPROM identity mismatches at first handshake, ADCC thresholds drifting with temperature, and charge-pump constants causing noisy switching under load. All three are invisible to a byte-count check and all three are covered by our verification sequence. The pattern is worth knowing even if you never send us a board – it tells your team where to look when a hand-cloned 18046 misbehaves, and it explains why the verification step of a professional recovery takes as long as the read itself.

Duplication

Verified images are written into matching 20-pin blanks with flash, EEPROM and configuration words restored, and read-back comparison on every unit, through the MCU flash EEPROM data cloning pipeline. The lawful boundary of the work is framed in the semiconductor chip hardware security overview.

Family links

The 28-pin members are on the PIC16F18054 program and PIC16F18055 code pages, and the 40-pin members on the PIC16F18074 binary recovery.

Scope and contact

We accept only units you own or are authorised to service. Send the locked PIC16F18046 and we will confirm the package, quote a fixed fee, and return a verified image with EEPROM and configuration data attached.