One hundred and twenty-eight thousand words of flash. That is the number that defines a TMS320F28067 job, and it is four times the capacity of the entry part in the same family. The device also carries 51,200 words of SARAM, a floating-point unit, six DMA channels and a hundred-pin package, but the array is what sets the schedule: a quarter of a megabyte cannot be read in one comfortable pass, and every stage boundary is a place where the reconstruction can drift.
Stitching An Array That Does Not Fit In One Window
The probe station reads a window at a time, and the windows have to overlap. We use an overlap of several hundred words and verify it by checksum before accepting the next window; a mismatch means the stage drifted and the window is re-read rather than patched. That costs time and is the only reliable way to produce an image that is correct across its whole length.
The anchor for the whole read is the low region where the vector table sits. It is small, it is unique, and it never moves, which makes it the reference against which every later window is aligned.
What Fills A Quarter Megabyte
A 256 KB image on this part is rarely a quarter megabyte of instructions. Typical content is a control loop of a few thousand words, a communication stack, a bootloader, and then large constant areas: harmonic compensation tables, per-speed gain schedules, sometimes a copy of the calibration data for several product variants in one image. Those tables dominate the file size and are the part a rebuild team most wants back.
They are also the part most likely to be misread. A table of 16-bit values with a regular pattern reads identically whether it is correct or shifted by one address, and the only way to tell is to follow the index arithmetic in the code that consumes it.
RAM That Holds A Hundred Kilobytes
Fifty thousand words of RAM means the program keeps a lot of state, and on this device the state often includes a shadow copy of the parameter tables so they can be updated without stopping the loop. That shadow copy is initialised from flash at start-up, which makes the initialisation routine a map of the tables — and a good cross-check on the reconstruction.
If the initialisation copies a thousand words from an address in flash to an address in RAM, both regions are now known, and the table’s extent is confirmed by the copy length rather than guessed.
Time, Risk And The Order Of Value
A full read on this part takes longer than any of its siblings, which raises the risk that a marginal unit does not survive the session. We therefore read in value order rather than address order when the package shows any sign of damage: vector table, control loop, parameter tables, then the communication stack, then the bootloader.
That ordering means an interrupted job still delivers the part a customer can use, and the report states exactly which regions were captured.
What The Package Says Before Anything Is Opened
The hundred-pin variant exposes fifteen PWM channels and seventeen ADC inputs; the smaller package of the same die exposes fewer of both. That count is visible in the marking and in the pinout, and it constrains the reconstruction before a single word is read: a design that needed seventeen analogue inputs cannot have been built around the reduced package, so the peripheral initialisation code will reference pins that only exist on the larger one.
We use that as a consistency check rather than as information. An image whose ADC initialisation enables seventeen channels, recovered from a part whose package only bonds out fourteen, is evidence that the die is shared across variants and that the program was written for the widest configuration.
Verification
The rebuilt image is programmed into a blank F28067 and run against the donor on a fixture that reproduces the original clock and load. Acceptance requires the PWM start-up sequence, the ADC trigger phase, the DMA transfer order and the first actuator value at a known operating point to match. A quarter megabyte of image with one wrong constant will pass three of those four.
Handover
The HEX, the binary, the window overlap log, the table map with extents and consumers, the parameter block, the password if recovered, and per-region checksums. Where the job was interrupted, the missing regions are named.
The 128 KB member with less RAM is the TMS320F28063 job, and the entry part of the family is on the TMS320F28062FP page. Large-array work is scheduled through the services desk or the contact form.