The PIC10F222 is the top of Microchip’s six-pin ladder: 512 words of 12-bit program memory, 24 general purpose registers, an 8-bit A/D converter with two input channels, and the same 4 MHz trimmed internal oscillator as the rest of the family. It has no data EEPROM. It also has no way to be debugged once the protect bit is set, which is precisely the situation most of these boards are in.
The Largest Array In The Family
512 words from 0x000 to 0x1FF, addressed by a 10-bit program counter, with 0x1FF reserved for the oscillator trim constant. Beyond that the addressing wraps, so a programmer that reports content past 0x1FF is showing a mirror of the same array, not a second bank.
Twenty-four bytes of RAM sounds like a rounding error and is not. On a 256-word part, RAM holds a couple of counters. Here it holds a small buffer, and firmware that fills a buffer is doing something with structure: averaging a converter reading, tracking a debounce history, or holding a short pattern for an output sequence. That is the first thing to look for when the disassembly is reviewed.
The Converter And What It Cannot Do
Two channels, eight bits, referenced either to VDD or to an external reference. No programmable gain, no differential mode, no automatic sequencer. The firmware selects a channel, waits, reads, and decides.
That simplicity is an advantage in recovery, because the code that touches the converter is short and repetitive enough to identify by pattern. Find the channel-select write, find the settling delay, find the compare against a constant. The constant is the product’s calibration, and on a device with no EEPROM it is the only copy that exists.
Configuration Memory Begins At 0x200
Programming mode extends the address space to 0x3FF. The lower half is the array. The upper half, 0x200 to 0x3FF, is configuration memory: four user ID words, a backup oscillator trim value, and the configuration word at the top of the block containing the code-protect bit, the watchdog enable, the master-clear function and the oscillator mode.
Reading the array without reading that block produces a file that is not wrong so much as incomplete. A replacement part programmed with only the code will run, then misbehave in ways that look like a fault in the new chip: resets under brown-out, watchdog time-outs, a clock that differs from the original by enough to shift every software delay.
Interpreting A Uniform Dump
Erased 12-bit flash is 0x3FF. A protected array returns 0x000. Since 0x000 is NOP on this core, the protected dump disassembles into tidy padding, and a reviewer who is not paying attention can mistake a locked part for a nearly empty one.
The reliable discriminators are structural rather than numerical: the device ID response, the absence of any plausible reset vector behaviour at 0x000, and the fact that configuration memory still reads on a protected part while the array does not. The model used for copy protection on PIC devices explains why the lock sits outside the array.
Why These Boards Come In
Typical uses: a thermostatic switch, a light-sensitive timer, a battery low-cut, a potentiometer-trimmed relay. The failure is usually the board, not the silicon: a swollen electrolytic, a cracked solder joint from thermal cycling, a pot that has worn. The chip is fine and locked, and the customer needs either a replacement programmed part or the behaviour documented well enough to reimplement.
If the plan is a programmed replacement, the configuration block and the trim constant are as important as the code. If the plan is a reimplementation, the thresholds and the timing constants are. The two deliverables are different, and a report that does not state which one it supports tends to satisfy neither.
One question is worth asking before work starts: does the customer want a programmed replacement or a description of behaviour? The first needs the array plus the configuration block. The second needs thresholds and timing constants annotated, which is a longer job on the same read.
Verification Path
Two independent reads compared word for word. A reset vector that initialises the registers the code actually uses. A scan for the boundary where real instructions end and 0x3FF begins, which establishes how much of the 512 words the project occupied. And, where a blank part is available, a programming test that confirms the image and configuration together produce a running device.
Reading program memory describes the sequence, chip extraction analysis covers the report, and our services page lists what is included at each level.
If the part on your board is marked PIC10F222 and the flash is locked, send a photo of the marking and one sentence on what the product does, then contact us with the board reference. The PIC10F220 is the 256-word version with the same converter, and the PIC10F206 matches this array size without the analog block.