The word locked arrives on every third inquiry, and it means four different things on a PIC32MX210F016D. Sorting them out takes minutes and changes everything downstream, so it happens first — before quotes, before scheduling, before any promise is made. This part, the largest package of the smallest 2XX density, is a good lens on the whole subject: same 16 KB of flash and USB controller as its siblings, same 44-pin board real estate as parts three times its size, and the same single-bit security model underneath.
Four Conditions, One Register
The DEVCFG words at the top of the 3 KB boot flash describe the part’s security state completely. Code protect is DEVCFG0 bit 28, active low: a programmed zero arms it, and the flash controller then refuses external reads of the 16 KB program array at 0x1D000000 and the boot bank at 0x1FC00000 alike. Program write protect guards selected pages against modification during code execution — it says nothing about reading. Boot write protect does the same for the boot bank. The debug channel can be steered to non-default pins by a configuration field, which inconveniences a debugger without touching the programming interface.
So a part can be locked against writes and fully readable; readable and unprotected; or genuinely closed. Only the first register read distinguishes them, and that read comes before everything else. Treating write protection as code protection produces two opposite errors: jobs abandoned on parts that would have read in an hour, and parts declared open whose configuration words say otherwise.
The Arithmetic Of Code Protect
Once the protection bit is armed, Microchip’s programming specification is unambiguous: the flash cannot be read by an external device, and the only command that clears the protection is the chip erase — which blanks both partitions and destroys the firmware. There is no partial access, no region excluded from the ban, no degraded readout of the boot bank. The part becomes a sealed unit whose contents are known to exist and cannot be inspected.
That is a hard boundary, and honest reporting states it plainly. What can still be done for a code-protected 210F016D is context work: the board can be examined, the role of the part inferred from its connections, the replacement options costed. What cannot be done is the read. The copy protection page frames this assessment for whole products; the FAQ answers the follow-up questions customers ask after hearing the word erase.
Deciding Between Recovery And Replacement
Not every locked part needs unlocking. When the protection register says sealed, the honest fork is: reconstruct from the board, source replacement firmware, or redesign the product’s controller. The 44-pin package complicates the middle option — this density’s USB product in 44 pins has few drop-in equivalents, so replacement usually means redesign. That arithmetic is why the register read happens before the sales conversation: if the part is open, recovery is a schedule; if it is sealed, the discussion is about what the board needs, not what the chip hides. Saying so early costs one email and saves weeks of mismatched expectations.
Where the board itself carries the missing evidence — programming pads, test points, the loader’s serial traces — board-level analysis fills gaps the chip cannot. The chip extraction analysis service exists for exactly that middle ground between a chip read and a redesign, and the services overview lists how the routes divide.
The Part Itself
Forty-four pins carrying the smallest USB-capable density is an unusual combination, and it produces a specific kind of board: USB device with lots of discrete I/O — buttons, indicators, actuator drives — and little else. The peripherals are the family set: two UARTs, two SPI/I2S ports, two I2C buses, parallel master port, five timers, 10-bit converter at 1 Msps, M4K core at 50 MHz and 83 DMIPS. Flash geometry is 256-word pages and 32-word program rows; the boot flash holds 3 KB from 0x1FC00000 to 0x1FC00BFF.
When the part is unprotected, the read is routine: two independent captures of both partitions, compared word for word, device ID read back to pin the die, erased-word boundary mapped so the customer sees how much of the array was live. The reading process page describes it, and the chip extraction analysis service adds board-level interpretation when the job is bigger than the chip.
The Sequence That Pays
Device ID first, configuration words second, decisions third, captures fourth. Every step costs minutes; skipping the order costs parts. A locked 210F016D and an open one are indistinguishable from the outside — same marking, same board, same behavior in circuit. The difference lives in four bytes, those bytes are readable in seconds, and everything a customer is told afterwards should follow from them, not precede it. That discipline is the whole art of the locked-part conversation: say what the register says, promise what the register permits, and never the reverse.
For the wider branch, the PIC32MX extraction index lists every part with its geometry and package.