There are four devices in the PIC10F200 family and only one of them combines the larger array with the analog block. The PIC10F206 has 512 words of 12-bit program memory, 24 general purpose registers, 33 instructions and a comparator with its inputs on GP0 and GP1. It has no A/D converter, no data EEPROM and no serial port. Everything it knows is in those 1,024 hex bytes.
What 512 Words Buys
A 10-bit program counter, 512 physically implemented words from 0x000 to 0x1FF, eight special function registers and 24 general purpose bytes. Twice the code of the PIC10F204 for the same pin count, which in practice means the firmware moved past a single fixed function.
On a 256-word part, code is usually one loop with a couple of branches. On 512 words it is common to find a small state machine, a debounce routine with its own timer, or a table-driven output sequence. That matters for a read-out: a longer image needs structure, and structure is what makes a disassembly reviewable rather than a wall of twelve-bit words.
CMCON0 At Address 0x07
The comparator is configured through CMCON0 at file address 0x07. Modes cover two independent analog inputs, an external reference on GP0 with the signal on GP1, an internal voltage reference divided from VDD, and an output that can be steered to GP2 either as a level or as a latched event.
Two consequences for anyone reading the code. First, the first write to 0x07 tells you which of those modes the design used, and therefore what the sixth pin actually was. Second, because there is no EEPROM, the threshold is an immediate constant loaded by a MOVLW, so the numbers in the annotation of a good report are read straight out of the instruction stream rather than inferred.
Where The Lock Sits
Programming mode exposes 0x000 to 0x3FF: the lower half is the array, the upper half from 0x200 to 0x3FF is configuration memory holding four user ID words, a backup oscillator trim value and the configuration word. The code-protect bit is one bit of that word.
This is the detail that decides whether a recovered image is usable. A file that contains only 0x000 to 0x1FF programs correctly into a blank part and then runs with the wrong watchdog setting, the wrong master-clear behaviour, or the wrong oscillator mode. Anyone who has replaced a PIC10F206 and found the new board resetting under load has met this problem. The copy-protection mechanisms used across PIC families explains how the configuration block relates to the lock on each core.
Reading The Erased State
Erased flash is 0x3FF on a 12-bit core. Protected flash reads as zeros, and zero is NOP here, so the two conditions look like opposites in the dump: one is a uniform field of ones, the other a uniform field of zeros that disassembles cleanly as padding.
Because both look plausible, the useful checks are indirect. The device ID still answers on a protected part. Configuration memory still reads on a protected part. The boundary between real code and trailing 0x3FF tells you how much of the 512 words the project actually used, and that number is often surprisingly small, under 200 words on a single-function board.
The Trim Word At 0x1FF
The last implemented word of the array holds the factory calibration constant for the internal oscillator, stored as a MOVLW so startup can copy it into OSCCAL. The data sheet warns against overwriting it. It is unique to the die and cannot be recomputed.
When a read-out is delivered as “the hex file”, this word is either in it or not, and there is no way to tell from the file alone. A report that lists the array, the configuration block and the calibration word separately is worth more than one that hands over a single binary blob.
Six Pins, One Job, No Spare
Boards built on this part tend to be small and finished: a timer relay, a battery cut-off, a coin-cell flasher. There is no debug port left free, no spare pin for a header, and often no schematic. The recovery value is the behaviour, not the source code, and the deliverable that matters is a file that can be programmed into a replacement part and produce the same behaviour on the same board.
That is a higher bar than “a complete read”, and it is why chip extraction analysis includes a programming test rather than ending at the dump. The procedure itself is described under reading program memory.
If the board carries a PIC10F206 and the only other copy of the firmware is gone, send a clear photo of the marking and a description of how the product behaves when it works, then contact us with the board’s part number. Our services page sets out what is delivered for a read-out of this size, and the PIC10F204 is the same analog block with half the array.