The PIC16F1828 packs the enhanced mid-range core into a 14- or 20-pin body: 4096 words (7 KB) of flash, 256 bytes of SRAM, 256 bytes of EEPROM, eighteen I/O lines, a twelve-channel 10-bit ADC, twelve capacitive-touch channels and one enhanced CCP with full-bridge plus half-bridge PWM alongside two plain CCP modules. It is the compact sibling of the 1827, chosen when a product needs the same touch and PWM behaviour from fewer pins, and it turns up in hand tools, small chargers and sensor pods. When protection is engaged, our copy secured PIC16F1828 firmware service recovers the image from hardware you own.

Sleep, wake, and what the constants decide

Battery products built on this die live between two states: deep sleep and a brief, carefully budgeted wake. Which comparator wakes the core, what threshold it watches, and how the ADC scans on wake are all configured from constants in flash, and they are the layer a casual copy most often gets subtly wrong – the clone runs, but battery life drops by a third. Our verification therefore replays sleep-wake cycles on the fixture and measures wake latency and current between clone and donor, not just the code checksum. Remanence considerations for storage that has held the same counters for years are covered in the clone microcontroller memory content remanence reference.

The SR latch on this die is a small feature with a large shadow in field behaviour: firmware that emulates classic 555-style latch behaviour sets its reset and set sources from constants, and a clone carrying defaults latches differently under noise. Our fixture includes a noise-injection step at the latch inputs during the comparison, which is how marginal set-source constants have been caught before shipment. It is a five-minute test on a die this size, and the alternative is a product that resets itself on a customer’s workbench for reasons no schematic shows.

Capture discipline on a small array

Seven kilobytes reads quickly, which is its own trap: a rushed capture produces a file that verifies on the first pass and betrays the project on the third unit. The working pattern is slower and boring on purpose – map the configuration words, read the whole array in one protected-state pass, checksum per sector, then re-read until two passes agree before anything is written to a blank. EEPROM is captured in the same session; on this die it holds the calibration and wear data that makes the difference between a replacement that behaves and one that drifts. General storage mechanics behind that discipline are in the how the MCU memory works guide.

Low-voltage programming entries deserve a note in the delivery. Production lines that used the LVP mode leave the configuration word set accordingly, and a replacement programmed with high-voltage-entry settings instead can behave differently on the original fixture – usually by refusing to re-enter programming. The recovered configuration words prevent exactly this, which is why they are delivered verbatim rather than summarised, and the programming-mode implications are spelled out for whoever owns the fixture.

Protection without the destructive path

Code protect in the configuration words refuses external flash reads once set, and data protect seals the EEPROM; both surrender only to a bulk erase that destroys the very image being saved. That erase is therefore permanently out of the plan – the recovery reads what answers, records the protection policy verbatim, and leaves the decision about sealed regions documented rather than forced. Family behaviour across the 182x line is consistent here, which is why the siblings are worth reading together: the 28-pin member on the PIC16F1827 program page and the larger-memory 20-pin member on the PIC16F1829 heximal recovery.

Duplication and next step

Verified images are written into matching 14/20-pin blanks with EEPROM restored and per-unit read-back, through the MCU flash EEPROM data cloning pipeline; the successor 20-pin generation is compared on the PIC16F1847 flash page.

Work is accepted only for units you own or are authorised to service. Send the locked PIC16F1828 – the board helps – and the return is a verified image with the sleep-wake measurements and protection map attached.