The ordering table prints the PIC32MX110F016B as 16+3 KB. That arithmetic is the first thing a recovery has to get right, because the plus sign is not decoration: the device carries 16 KB of program flash and a separate 3 KB boot flash, two partitions with different addresses, different erase behavior and different jobs. A dump that captures only the 16 KB has missed the third of the boot bank that actually runs at reset.
Two Partitions, One Image
Program flash starts at 0x1D000000 and ends at 0x1D003FFF on this part. Boot flash starts at 0x1FC00000 and ends at 0x1FC00BFF, which is exactly 3 KB. Microchip reserves the boot bank for startup code and, at its top, the four device configuration words. Those DEVCFG values decide oscillator source, watchdog behavior, debug channel and code protection. They are not optional cargo: a board programmed with a correct 16 KB image and default configuration words can refuse to start, clock itself from the wrong source, or come up with JTAG and ICSP semantics the original designer never intended.
So a complete image for the 110F016B has three components: the 16 KB program array, the 3 KB boot bank, and the configuration words read back from their fixed position. Anything less is a partial. The firmware extraction overview describes how the pieces are assembled into one deliverable.
What The Entry Density Buys You
Sixteen kilobytes is the floor of the family, and it shapes what the image can contain. The MIPS32 M4K core here runs to 50 MHz at 83 DMIPS, and the compiler front end offers MIPS16e encoding, which shrinks typical C output by up to 40 percent. A designer squeezing a product into 16 KB leans on it, and that choice is visible in the recovered words: the ISA mix of a hand-budgeted image is different from one written against a 128 KB sibling. The 220F032D page takes that mixed-instruction-set problem up directly.
The peripherals behind the 16 KB are the fixed 1XX set: two UARTs, two SPI/I2S ports, two I2C buses, a parallel master port, five timers and a 10-bit converter sampling at 1 Msps. None of it changes with density. What changes is how much of the array is filled: production images at this size are usually tight to the ceiling, so the boundary between used words and erased ones carries little slack, and a verification pass matters more, not less.
Code Protection On The Small Parts
The code-protect switch lives in DEVCFG0, bit 28, and it is active low: a programmed zero enables protection. When set, the flash controller refuses external reads of both partitions. There is no partial readout, no degraded mode where half the array still answers. The Microchip programming specification is blunt about the only sanctioned exit: a chip erase, which returns the part to blank and takes the customer’s firmware with it. That is why the reading stage happens before any protection question is even discussed, and why the first diagnostic on an unknown part is the device ID and the configuration words, not a blind read attempt.
Write protection is a separate register field with a separate meaning. The program write protect bits guard selected pages against modification during execution; they do not block an external reader. Quoting the two as the same thing produces false “locked” verdicts on parts that are actually wide open.
How A Read Is Verified
Two independent captures of all three regions, compared word by word. Config words are read back a second time and cross-checked against the device ID, which pins the part as a 110F016B rather than a 120F032B in the same SOIC or QFN footprint. Erased words read as all ones, and the transition between code and padding is recorded so the customer can see how much of the array was live.
That packet — program flash, boot bank, config — is what turns into a buildable HEX. The reading process page walks through the capture side in detail, and the FAQ covers the questions that arrive before a purchase order does.
The Board Around The Part
The part runs from 2.3 to 3.6 volts with 5-volt-tolerant input pins, a combination that shapes how a read is staged. In-circuit reading avoids a desolder cycle, and on boards whose 5-volt rails reach the programming pins directly, the input tolerance is what makes a direct connection safe; on boards where the routing is less kind, the semi-invasive extraction route takes the part out instead. Pins source and sink 10 mA, and fixtures respect that without ceremony. None of this is exotic — it is the ordinary discipline of reading a part in place rather than in a socket, and at 28 pins the decision usually favors trying the board first.
When The Part Is Not Alone
Recovery jobs at this density rarely involve one chip. The same board often carries serial memory, an supervisor, or a second controller holding complementary tables, and the chip extraction analysis service reads the set as a unit so the reconstructed firmware and its data land in step. For product owners, the practical summary is short: the 110F016B is readable when it is unprotected, and the work of reading it is the accounting — knowing that 16 plus 3 means two partitions and one configuration page, and delivering all of it.
The full family index, with page geometry and package for every part, sits on the PIC32MX extraction overview.