The PIC10F200 is the smallest thing Microchip still sells as a microcontroller: six pins in SOT-23, four I/O, 256 words of 12-bit program memory and sixteen bytes of RAM. There is no data EEPROM, no A/D converter, no comparator and no UART. What it does have is a 4 MHz internal oscillator trimmed to one percent at test, 33 instructions, a two-level hardware stack, and a single code-protect bit that decides whether the 768 bytes of firmware inside can be read back.
That last bit is why boards arrive at a bench with one of these soldered to them. A six-pin part usually sits on a small board whose only copy of the firmware left with the contractor who wrote it.
The Smallest Image You Will Ever Read
256 words of 12 bits is 384 bytes by the data sheet’s count, or 768 bytes if each word is stored in two bytes the way most hex formats do it. Either way the file is short enough to read line by line, and that changes the shape of the work. On a 128 KB device the question is whether a read is complete. Here the question is whether each of the 256 words makes sense.
Erased flash on this core reads 0x3FF, not 0xFFF and not 0xFFFF. Twelve bits, all ones. A dump full of 0x3FF is a blank or mostly-blank part. A dump full of 0x000 is either protected or padded, because 0x000 is a legal instruction, NOP, on the 12-bit core. The two cases cannot be told apart by looking at the values alone.
Where the Protect Bit Actually Lives
In normal execution the program counter addresses 0x000 to 0x0FF and nothing beyond. In programming mode the address space doubles: 0x000 to 0x0FF is user program memory, and 0x100 to 0x1FF is configuration memory, which the CPU never executes and the programmer reaches directly. The configuration word sits at the top of that second block, and the code-protect bit is one bit of it, next to the watchdog enable, the master-clear setting and the oscillator mode.
Three things follow. First, a read of the array can look perfect while the part is locked, because the lock is not stored in the array. Second, whatever sits in configuration memory survives only if it is captured deliberately, and how copy protection is implemented across PIC families explains why the mechanism differs from device to device. Third, four user ID words live in that same block, and on production boards they often carry a build number or date code that identifies which firmware revision shipped.
The Word at 0x0FF
The last word of user memory on a 256-word part, 0x0FF, holds the factory oscillator calibration value stored as a MOVLW instruction. The data sheet is blunt: this value should never be overwritten. It is specific to that die, it is not derivable from anything else, and a code image that loses it produces a board that runs but keeps time badly.
Any read-out that returns “the firmware” without that word is incomplete, and the omission does not announce itself. The program still executes. It simply drifts with temperature and part.
What a Locked Part Answers
A protected PIC10F200 still talks over the two-wire ICSP interface. It answers the device ID, it lets the programmer read configuration memory, and only the array comes back wrong. That asymmetry is the cheapest diagnostic available, because it separates a locked part from a dead one in one bench session, before anyone considers opening the package.
A genuinely dead part, one that does not answer at all, is a different job at a different price. On a six-pin SOT-23 the difference matters, since there is very little silicon to work with once the epoxy is gone.
Why Anyone Bothers
The commercial case for reading a PIC10F200 is rarely the sophistication of the code. These parts do one thing: a delay timer, a soft latch, a PWM dimmer, a two-button interface. The value is that the function exists nowhere else. No source, sometimes no schematic, occasionally no supplier, and the alternative is redesigning a board that also carries a custom transformer.
Verification Before Delivery
A short image still needs checking. Read the array twice from independent sessions and compare. Confirm the reset vector at 0x000 loads a sensible bank and oscillator setup rather than falling straight into the calibration word. Walk all 256 words looking for 0x3FF runs inside code, which mark where the used program actually ends. And confirm the calibration word against the backup copy if one was retained.
Reading program memory describes the full procedure, and our services page lists what a read-out includes. If the board in front of you carries a PIC10F200 and the firmware is the only thing you cannot replace, send a photograph of the marking and a line about what the board does, then contact us and we will confirm the memory layout before anyone touches the package. The PIC10F202 is the same core with twice the array and follows identical rules.