The dsPIC30F1010 is the entry point to Microchip’s switch-mode power supply family: 6 KB of program flash, 256 bytes of SRAM, two PWM generators with nanosecond-scale resolution, a 10-bit converter sampling at 2 Msps, four analog comparators, and no data EEPROM at all. It exists to close a control loop inside a power supply, and that purpose decides how its firmware should be read and what a recovered image is worth.
Six Kilobytes Is 2,048 Instructions
The array is 24 bits wide, so 6 KB means 2,048 instruction words, which is 96 bytes per row across 64 rows of 32 instructions. On a hex listing that is a short file, and on a bench it means the whole program can be read in one pass and reviewed instruction by instruction, which is not true of anything in the 6010 class.
Small does not mean simple. A digital power supply spends its code on three things: the control law, the fault handling, and the sequencing at startup. All three are timing-critical, and none of them are visible in a disassembly unless the peripheral setup is read alongside the arithmetic. That is why a read of this part is delivered with the configuration registers and the peripheral initialisation annotated rather than as a bare binary.
No EEPROM Means Constants Live In The Array
There is no separate data EEPROM on this device, so every calibrated value, every current limit, every soft-start ramp coefficient is embedded in the program itself or recomputed at boot. Recovery therefore does not separate “code” from “data” the way it does on a 6014 with its 4 KB EEPROM.
Practically, this changes the deliverable. On parts with EEPROM, a customer often asks for the parameter block because the code can be rewritten from the schematic. Here the parameters are inside the code, so the array is the only copy of the calibration, and a partial read is close to useless.
Where Protection Is Configured
The general segment protect setting lives in the configuration registers at the top of the address map, in the 0xF80000 block, outside the linear program array. Protection on this family is segment-based rather than block-rotated the way PIC18 does it: the configuration bits decide whether the general segment can be read over ICSP, and the boot and secure segment options that later dsPIC30F devices carry are not all present on a part this small.
That distinction matters when quoting. A PIC18 with four protection blocks can leak one region while hiding another. A dsPIC30F1010 is closer to all-or-nothing, and the first test is simply whether the array responds. How the various PIC protection models differ is a useful baseline before assuming one device behaves like another.
0x000000 Means Two Different Things
Erased flash reads 0xFFFFFF on a 24-bit core. A protected array reads 0x000000, and 0x000000 is a legal instruction, NOP, so the protected read does not look like an error. It looks like a program made entirely of no-ops, with a plausible reset vector at address zero if the first word happened to be real.
The way out is corroboration rather than inspection. The device ID register at 0xFF0000 still answers on a locked part. The configuration registers still read. And the size of the array that responds tells you which die revision you are on, since the SMPS family spans 6 KB and 12 KB in the same package outlines. Two independent sessions that agree on zeros in the array and agree on the ID are enough to call the part locked rather than empty.
Fault Handling Is The Interesting Part
Power supply firmware is mostly protection logic. Overcurrent comparator trips, blanking windows after each switching edge, de-saturation detection, thermal fold-back, brown-out ride-through. Reading that logic out is usually what the customer actually needs, because the failure they are chasing is a supply that shuts down at a specific load rather than a supply that will not start.
Annotating the comparator thresholds and the blanking intervals turns a file into a maintenance document. That is the difference between reading a program and analysing an extraction, and on a 2,048-instruction image the analysis is where most of the work sits.
Package And Practical Risk
Twenty-eight pins in SOIC, SPDIP and QFN. The QFN version is the awkward one: no leads to probe, a large exposed pad, and a board that usually has power components on the same copper. Bench access to MCLR, PGC and PGD is often obstructed, so the read is done with the device lifted or with flying leads on a jig rather than in circuit.
If the device answers and only the array is blocked, the next step is a decision on package work, and that decision should be made with the board’s replacement cost in view. Our services page sets out what is included at each level.
Send the complete marking line, including the speed and temperature suffix, plus a photograph of the board and a note on what the supply feeds, then contact us. The dsPIC30F2020 is the same architecture with 12 KB and four PWM generators.