Here is a part number that misleads almost everyone at first reading. The dsPIC30F6013A has eighty pins, more I/O than the 64-pin dsPIC30F6012A, and less memory: 132 KB of program flash instead of 144 KB, 6,144 bytes of SRAM instead of 8,192, and 2,048 bytes of EEPROM instead of 4,096. In this family the pin count and the array size are independent choices.
44K Instructions, 80 Pins
132 KB is 44,032 instructions of 24 bits, programmed in 1,376 rows of 32. The array is organised in pages for erase and in rows for write, and a read-out has to walk both boundaries when it checks that the image is complete.
Eighty pins buys 68 I/O, which on this generation is what a machine controller needs: several sensor inputs, a display bus, two CAN ports, a motor control PWM block and a quadrature encoder, all at once. The memory is the smaller of the two 80-pin configurations, which in practice means firmware written to fit rather than firmware written without a budget.
What The Extra Pins Do That The Memory Cannot
On a 6012A the limit is pins, so peripherals get multiplexed and features are traded. On a 6013A the limit is memory, so the firmware tends to be lean and the peripheral set full. That shows up in the recovered image as dense initialisation code and fewer conditional compilation artefacts, and it makes the annotation faster: fewer options means fewer dead paths.
The other side of it is that 132 KB is enough for a bootloader plus an application but not much more. Bootloader designs are common on this part, and a bootloader changes what a recovery should deliver, because the application may be updatable over CAN while the boot sector is fixed.
No Audio Port On This Variant
The 6012A and 6014A carry a data converter interface for I2S and AC’97. The 6013A does not. If a product needed audio it went to the other two, so a 6013A board is a control product: drives, inverters, machine axes, power stages.
That matters for scope. There is no DCI register block to reconstruct, and the sixteen-channel 12-bit converter is used for current, voltage, temperature and position rather than for signal processing.
CodeGuard Segments And The Lock
This generation implements segment-based protection with boot, secure and general segments, each with separate read and write restrictions, configured in the registers at 0xF80000. It is not the rotated four-block scheme of a PIC18, and the practical result on a bench is binary: the general segment reads over ICSP, or it returns zeros.
Three things still answer on a locked device and should be captured before a conclusion is drawn. The device ID at 0xFF0000, which also separates this die from the 6012A and tells you the silicon revision. The configuration registers, which give oscillator, watchdog and brown-out settings. And the EEPROM array, which has a separate access path and is sometimes readable when the program array is not. How the dsPIC and PIC protection models compare explains why that asymmetry exists.
Zero Is A Legal Instruction
Erased flash is 0xFFFFFF. Protected flash is 0x000000, which decodes as NOP, so a locked dump looks like a program built of padding. Address zero settles the question: real firmware branches there, and 0x000000 at the reset vector is something no compiler produces.
Board And Access
80-pin TQFP, 12 by 12 millimetres, on a board that is usually the main controller of a machine. Removing it is a scheduled operation, not an improvisation: the surrounding connectors are plastic, the ground plane is heavy, and the board often cannot be replaced.
In-circuit access to MCLR, PGC and PGD is the preferred route and usually possible on this class of board, since the pins are brought to a programming header for production. That header is the best thing a customer can photograph before sending anything. Reading program memory describes what happens next.
One practical consequence of 68 I/O: the board has room for a programming header, and production boards from this generation usually carry one. A photograph of that header, or of the silkscreen beside it, lets a bench plan the read before the board ships, which shortens the quote cycle more than any other single piece of information.
Deliverable
Array, configuration block, device ID and the 2 KB EEPROM separately, with two independent reads compared and a boundary scan locating the end of real code, which on a bootloader part is usually inside the array rather than at its end. Our services page lists what each level includes, and chip extraction analysis describes the report.
Send the marking with the A suffix, a photo of the board including any programming header, and a line about what the machine does, then contact us and we will confirm the array size before quoting. The dsPIC30F6013 is the non-A revision of the same memory, and the dsPIC30F6012A is the 64-pin part with twelve more kilobytes.