LPC1827JET100: 1024 KB Flash On The TFBGA100

The LPC1827JET100 is an NXP LPC18xx part: a Cortex-M3 at 180 MHz with 1024 KB on-chip array and 136 KB of working RAM in a TFBGA100. The contact form books the capture bench slot for a LPC1827JET100 that has locked its debug path.

Where The Read Protection Lives

The LPC1827JET100 guards its array with a code-read-protection bit in the flash signature and OTP area, a reversible setting. NXP’s CRP on the LPC1827JET100 is a bit in the flash signature region that blocks debugger reads but never erases the array. The readout-protection overview frames why a locked part still yields to a careful bench routine.

Peripheral Set

The LPC18xx character of the LPC1827JET100 comes from the HSADC near 80 Msps and the SCT state-configurable timer built in hardware. What makes a LPC1827JET100 more than a generic Cortex-M3 is the HSADC and the SCT, both configured by code in 1024 KB on-chip array. The RX24T motor note is a different vendor’s take on fast ADCs plus timers for control.

Reporting And Hand-Off

Delivery is one Intel HEX at the true addresses, a binary per region, and a report listing the CRP state and boot source. Customers get an Intel HEX merging all regions at real addresses, separate binaries, and a short report for the LPC1827JET100 TFBGA100. See the LPC1833JBD144 page for a parallel treatment of this silicon family.

Flash And Working Memory

The LPC1827JET100 maps 1024 KB on-chip array for execution and 136 KB of working RAM for data, with an EMC that can attach off-die SDRAM. Because the LPC1827JET100 includes an external-memory controller, a board may place code or data in off-chip SDRAM through the EMC. An AT32 firmware note shows a password region that returns fill bytes on data reads.

Bench Routine

We read 1024 KB on-chip array (or the SPIFI device on flashless parts), the OTP and signature area, then a live RAM image, then re-check. The capture order on the LPC1827JET100 is on-die flash or SPIFI image first, then the OTP region, then any live RAM, then a second pass.

Photographs of the 100-pin board are filed with the cover report so the LPC1827JET100 package can be audited later.

The report includes the option area or signature contents so the LPC1827JET100 lock can be re-applied if required.

A recovered LPC1827JET100 is cross-checked against the order photo so the marking matches the report.

The recovered files for the LPC1827JET100 are named by order number, never by the chip marking alone.

The 100-pin LPC1827JET100 is logged against its order code so a repeat job reuses the same bench setup.

Calibration stored in non-volatile memory is recovered alongside the main array of the LPC1827JET100.

We archive a checksum per region so a future read of the LPC1827JET100 can be compared byte for byte.

We keep the original oscillator value in the report, since a wrong crystal stops a rebuilt 100-pin board.

Our report flags any external memory the TFBGA100 board carried, since the LPC1827JET100 image may span parts.

A TFBGA100 LPC1827JET100 sent cold in foam reads more reliably than one that travelled powered and warm.

The 136 KB of working RAM on the LPC1827JET100 is captured live only when the board still comes up on power.

For a 100-pin LPC1827JET100 the alternate-function pins are decoded from the dump, not guessed from the silk.

For the TFBGA100 LPC1827JET100 we confirm the pin one mapping against the data sheet before closing the job.

We store the TFBGA100 board in anti-static foam until the read is done and the files are handed over.

We note any CAN or USB use on the TFBGA100, because the LPC1827JET100 peripheral setup lives in the flash.

Where a live TFBGA100 board is supplied we trace the serial lines before removing power from the LPC1827JET100.

The TFBGA100 outline of the LPC1827JET100 matches other group members, so the marking confirms the exact die fitted.

We keep the capture bench notes with the order so the LPC1827JET100 protection level is never lost between reads.

A second confirming read is offered when a customer wants proof no weak cell moved on the LPC1827JET100 TFBGA100.

The Cortex-M3 at 180 megahertz clock source is noted for the LPC1827JET100, because a clone with the wrong PLL will not start.

Most LPC1827JET100 jobs arrive with no compiler project, only the physical part and a failed recovery attempt.