The PIC16F1718 is the 28 KB flagship of the 28-pin 171x tier: double the flash of the 14 KB entry part, 2048 bytes of SRAM, and the full intelligent-analogue set – two op amps, two comparators, a 10-bit ADC over seventeen channels, one 8-bit and one 5-bit DAC – around the 32 MHz enhanced mid-range core. Designs that outgrow the smaller member land here on an identical pinout, which makes this package a common consolidation point and its firmware a valuable single file. When protection is engaged, our dump locked PIC16F1718 firmware service recovers it from hardware you own.

Protection through configuration words

The code-protect bit in the configuration words is the whole story of access control on this die: set, it refuses every external read of program flash; cleared, it costs the bulk erase that destroys the array. A professional dump locked PIC16F1718 firmware job therefore characterises the configuration state first, reads every region that still answers, and never issues the destructive sequence. The report keeps the configuration words verbatim so a replacement part is programmed with the same policy the manufacturer chose.

Where 28 KB firmware gets dense

Twenty-eight kilobytes on a mid-range core usually means more than one program: a communication protocol with real state handling, a sensor or power-stage front end tuned through the op amps and DACs, and frequently a small boot flow in the last sectors. Reading it correctly means capturing the whole array in one pass and checksumming per sector, because partial recoveries are where clone projects go wrong. It also means the flash’s 128-byte high-endurance block, which some applications use for wear-levelling counters or serialisation data, is captured alongside – it is not EEPROM in the classic sense, and forgetting it has cost customers a re-programming cycle more than once. Our verification exercises the communication and analogue paths against the donor board, so the delivered image is proven as a controller rather than blessed as bytes. Bench discipline for this class of array is in the how the MCU memory works guide, and the wider commercial boundary in the semiconductor chip hardware security overview.

The addressing arithmetic of a 16K-word array is worth a word to anyone reading the recovered heximal in a disassembler. Program memory on this core is word-addressed in 14-bit words, so the file’s byte offsets do not map one-to-one onto device addresses, and configuration words sit at a fixed location above the code rather than inside the first sector as on some other families. Tools that assume byte addressing produce convincing-looking garbage; our delivery therefore includes the addressing notes and a sector map so your engineers can walk the image with the right arithmetic from the first hour.

The upgrade path within the 28-pin tier also explains why this part appears so often in recovery queues. Boards designed around the 14 KB member migrate to the 28 KB die without a schematic change, so a single product family can carry both images across its fleet. When a customer sends units from different production years we diff the two images and report which regions changed – usually a handful of parameter tables plus a protocol revision – which turns an opaque fleet into a documented lineage.

Duplication

Verified images go into matching 28-pin blanks with configuration words and the high-endurance block restored, through the MCU flash EEPROM data cloning pipeline with read-back comparison on every unit.

Word count is also a rough dial on firmware generation. Early images on this die cluster in the low tens of kilobytes with short parameter regions; later revisions add protocol layers and push the tables upward. When a customer sends several donors we plot image sizes and diff boundaries across them, which usually reveals the product’s own revision history – and occasionally an undocumented engineering build still living in one unit of the fleet.

Family links

The 14 KB entry member is on the PIC16F1717 heximal page, the 40/44-pin sibling on the PIC16F1719 flash recovery, and the newer 152xx generation on the PIC16F15255 firmware page.

Scope

Only devices you own or are authorised to service are accepted. Send the locked PIC16F1718 and we will confirm the package, quote a fixed fee, and return a verified dump with sector-level integrity proof.