The PIC16F1829 is the 182x family’s 20-pin statement that small packages no longer mean small memory: 8192 words (14 KB) of flash, 1024 bytes of SRAM and 256 bytes of EEPROM in a body with eighteen I/O lines, a twelve-channel 10-bit ADC, twelve capacitive-touch channels and two comparators. Three PWM engines – two enhanced CCP with full-bridge plus one half-bridge stage and two plain CCP – let it run small motor and converter stages that older 20-pin parts could only supervise. When the code-protect bit is set, our readout protected PIC16F1829 heximal service recovers the array from hardware you own.

Fourteen kilobytes changes the firmware’s shape

With real headroom, firmware on this die stops being a single loop and becomes structures: state machines, parameter tables, occasionally a small command interpreter. Reading it well means capturing the array as one object in a single protected-state pass, checksumming per sector and re-reading until two passes agree – partial captures are where clone projects quietly fail months later. The heximal’s word-addressed layout also deserves care: program memory is addressed in 14-bit words, so byte-oriented tools show convincing garbage unless the addressing notes travel with the image, and ours always do. The wider memory hierarchy behind this is set out in the microcontroller internal storage structure analysis reference.

Motion constants are the product

On motor-driven products the ECCP configuration – steering, dead-band, auto-shutdown thresholds – is tuned on the bench over weeks and then frozen into flash constants. A clone carrying nominal defaults spins the motor and burns the FET six months later. Verification therefore loads the clone and donor into the same fixture, steps the load, and compares switching edges and shutdown behaviour against recorded references. Comparator trip points from the internal ladder are swept the same way. Historical context for why these constants became the real target of recovery work is in the microcontroller cracking advancing history article, and the lawful-access frame in the unlock microcontroller embedded memory guide.

Touch trim deserves the same scepticism as motion constants. Twelve channels of capacitive sensing are tuned on the production line against the panel’s actual geometry, and the constants that result – oscillator settings, thresholds, scan intervals – are stored where a casual copy never looks. Our capture takes them with the flash array in the same session, and the comparison presses each pad on clone and donor in turn, comparing raw counts rather than just the decoded key events. A clone that decodes correctly but drifts at the edges of the panel’s tolerance is caught on the bench, which is where it costs minutes instead of warranty months.

Touch, EEPROM and the quiet half of the image

Twelve touch channels bring the same trim-table story as the rest of the family: oscillator settings and thresholds the factory tuned per product. The 256-byte EEPROM usually holds counters and calibration that a service organisation needs as much as the code. Both arrays are captured in the same session and restored into blanks together, because a replacement that boots with empty EEPROM announces itself as a unit that forgot its history.

XLP behaviour is measured rather than assumed on battery products built around this die: standby current is recorded from both units across the same sleep interval, and the numbers go into the report beside the code checksum. A clone that doubles the draw is rejected before it reaches the field, and the note usually points at a configuration word rather than at the code itself, which is the cheaper of the two problems to fix.

Duplication and verification

Verified heximals go into matching 14/20-pin blanks with per-unit read-back, through the MCU flash EEPROM data cloning pipeline; the 18/20/28-pin sibling is on the PIC16F1828 firmware page and the refreshed 1847 generation on the PIC16F1847 flash recovery.

Scope

Only units you own or are authorised to service are accepted, with the entitlement recorded per job. Send the locked PIC16F1829 and the return is a verified heximal with addressing notes, motion-constant verification and the protection map – the bulk erase nowhere in the log. The 183xx line that eventually succeeded this family is compared on the PIC16F18344 flash page.