A discontinuance notice changes what a recovery is for. NXP issued one for the LPC2294HBD144 family in 2024, with last-time-buy and last-time-delivery dates in 2025, and the part is now marked end of life. It is a 144-pin LQFP ARM7TDMI-S at 60 MHz with 256 KB of on-chip flash, 16 KB of SRAM, four CAN channels, an 8-channel 10-bit ADC and an external memory controller. Every extract secured LPC2294HBD144 binary request now comes from keeping a fielded board serviceable, not from starting a new design.
The H Is A Specification, Not A Trim Level
| Suffix | Package | Temperature range | Typical use |
|---|---|---|---|
| FBD144 | LQFP144, 20 x 20 mm | -40 to +85 C | industrial control |
| HBD144 | LQFP144, 20 x 20 mm | -40 to +125 C | automotive, under-hood |
| FET144 | TFBGA144 | -40 to +85 C | space-constrained boards |
The FBD and HBD versions share the same die, pinout and peripheral set. What changes is the qualified temperature range, and with it the environments the part was designed to survive. A unit from a hot bay has seen long thermal cycling, possibly a different reflow profile, and often a conformal coating. All three matter when a package has to be opened, and flash charge retention is itself temperature dependent. The marking and date code are logged at intake so the chosen route matches the qualified grade.
Four CAN Channels In A 144-Pin Body
What defines this variant is four CAN controllers wired to one shared acceptance filter. The two-CAN LPC2292FBD144 has the same flash, SRAM and package; the four-channel LPC2194HBD64 has the same CAN count in a 64-pin body without the EMC. The controller registers, filter RAM and message objects are peripheral-side and volatile. A flash read returns the code that initialises them, not the identifier configuration a running gateway happened to hold.
Four interrupt sources in the vectored interrupt controller give a reliable way to locate the four handlers in a recovered image. The acceptance filter is shared, so one large table rather than four independent ones is the expected pattern.
Two Arrays With Different Rules
On a discontinued part the configuration word carries more weight than at design time: every documented way out of CRP begins with an erase and there is no second source. We read the state rather than challenge it: 0x12345678 removes the debug port together with read and compare while keeping sector erase, 0x87654321 leaves only a whole-chip erase, and 0x43218765 ignores the P0.14 entry pin. That last rule applies only while the vector checksum passes, so a board that no longer starts may be in a different state from the one its configuration suggests. The 256 KB array uses small sectors at the bottom, 32 KB sectors through the middle, and small sectors again near the top, with sector 0 holding the vectors and the checksum.
Four external banks begin at 0x80000000, each 16 MB and each with its own BCFG register. Two strap pins sampled during reset tell bank 0 whether the attached device is 8, 16 or 32 bits wide. Whatever sits out there is beyond the reach of the on-chip protection word, so the internal and external images are captured and delivered as separate files, with the strap state and register values documented alongside them.
Why Erasing Is Especially Unhelpful Here
An erase therefore destroys the only copy. The source tree, the toolchain and often the original engineers are gone. First steps are identification and non-destructive reads: boot code version over the serial port, the observable CRP state, and whether P0.14 is even brought out on the board.
Early bootloader revisions implemented only the 0x87654321 level. Later /00 and /01 devices support the three-level scheme, and a CRP change takes effect only after a full power cycle rather than a reset.
Delivery
A binary and Intel HEX for the internal array, separate files for any populated external devices, a sector map marking blank regions, and a note recording the CRP word, bootloader revision, BCFG settings and strap state. The vector checksum is recomputed so the image is bootable on a reference unit. Where a region was reconstructed rather than read directly, that is stated explicitly.
Related Work
Send markings, date codes and board photographs through the contact page. The protection walkthrough orders the checks, while this AT32F423 case contrasts a family with an execute-only protected region. Compare the two-CAN LPC2292FBD144 and the 208-pin LPC2468FBD208, which carries a much larger SRAM pool and an SDRAM-capable EMC.