LPC1820FET100: Flashless TFBGA100 Booting From SPIFI

The LPC1820FET100 is an NXP LPC18xx part: a Cortex-M3 at 180 MHz with no on-chip flash and 200 KB SRAM block in a TFBGA100. The contact form books the read bench slot for a LPC1820FET100 that has locked its debug path.

Flash And Working Memory

The LPC1820FET100 maps no on-chip flash for execution and 200 KB SRAM block for data, with an EMC that can attach off-die SDRAM. Because the LPC1820FET100 includes an external-memory controller, a board may place code or data in off-chip SDRAM through the EMC. An AT32 firmware note shows a password region that returns fill bytes on data reads.

Peripheral Set

The LPC18xx character of the LPC1820FET100 comes from the HSADC near 80 Msps and the SCT state-configurable timer built in hardware. What makes a LPC1820FET100 more than a generic Cortex-M3 is the HSADC and the SCT, both configured by code in no on-chip flash. The RX24T motor note is a different vendor’s take on fast ADCs plus timers for control.

Reporting And Hand-Off

Delivery is one Intel HEX at the true addresses, a binary per region, and a report listing the CRP state and boot source. Customers get an Intel HEX merging all regions at real addresses, separate binaries, and a short report for the LPC1820FET100 TFBGA100. See the LPC1823JBD144 page for a parallel treatment of this silicon family.

Bench Routine

We read no on-chip flash (or the SPIFI device on flashless parts), the OTP and signature area, then a live RAM image, then re-check. The capture order on the LPC1820FET100 is on-die flash or SPIFI image first, then the OTP region, then any live RAM, then a second pass.

Where The Read Protection Lives

The LPC1820FET100 guards its array with a code-read-protection bit in the program flash signature and OTP area, a reversible setting. NXP’s CRP on the LPC1820FET100 is a bit in the program flash signature region that blocks debugger reads but never erases the array. The readout-protection overview frames why a locked part still yields to a careful bench routine.

The no on-chip flash on the LPC1820FET100 is read at the true addresses, not a relocated image a tool might invent.

The Cortex-M3 @180 MHz on the LPC1820FET100 runs the read-back code in place, so our report notes the boot setup for a spare TFBGA100.

We keep the original oscillator value in the report, since a wrong crystal stops a rebuilt 100-pin board.

A second confirming read is offered when a customer wants proof no weak cell moved on the LPC1820FET100 TFBGA100.

A TFBGA100 LPC1820FET100 that locked mid-project is common; the program array is intact, only the debug path is closed.

The Cortex-M3 @180 MHz clock source is noted for the LPC1820FET100, because a recovered copy with the wrong PLL will not start.

Where decapsulation was needed the bare die of the LPC1820FET100 is photographed before the lid is fully removed.

Most LPC1820FET100 jobs arrive with no compiler project, only the physical part and a failed recovery attempt.

We keep the read bench notes with the order so the LPC1820FET100 protection level is never lost between reads.

For the TFBGA100 LPC1820FET100 we confirm the pin one mapping against the data sheet before closing the job.

Our report flags any external memory the TFBGA100 board carried, since the LPC1820FET100 image may span parts.

A 100-pin LPC1820FET100 that failed a previous shop usually still yields to a careful second pass.

We keep the LPC1820FET100 away from strong fields on the bench, since flash can be disturbed by magnets.

The delivery keeps the original protection state of the LPC1820FET100, so a later comparison reuses the same settings.

We confirm the 100-pin count against the marking so the read-back LPC1820FET100 netlist lines up with the board.

The customer gets a plain summary with the LPC1820FET100 files, written for a non-engineer to follow.

We record the supply rail used on the TFBGA100, because the LPC1820FET100 flash timing is sensitive to voltage.

A LPC1820FET100 that has been partially read elsewhere often arrives with the option region already corrupted.

We store the TFBGA100 board in anti-static foam until the read is done and the files are handed over.

Where the LPC1820FET100 arrived with corroded pins, we clean the TFBGA100 before the first bench attempt.

The recovered files for the LPC1820FET100 are named by order number, never by the chip marking alone.