Two chips on the same board can carry markings that differ by one letter and behave identically at the debug port. The LPC2364FBD100 and the LPC2364HBD100 are the same 128 KB flash, 34 KB SRAM, 72 MHz ARM7TDMI-S die in the same 100-pin LQFP with the same SOT407-1 outline. The F version is specified from minus forty to plus eighty-five degrees Celsius; the H version from minus forty to plus one hundred and twenty-five. A hack protected LPC2364HBD100 software job starts with accepting that the silicon is not different, but the service history almost certainly is.
What The Marking Tells You
NXP’s ordering table lists the two parts side by side with identical flash, SRAM, Ethernet, USB, CAN, ADC, DAC and peripheral counts. Only the temperature column changes. That is unusual and easy to misread: engineers sometimes assume the H part is a different revision with a different boot ROM, or that it carries extra protection. It does not. The CRP word, the sector map and the IAP entry point are the same.
What does change is the environment. A 125 C-qualified part is chosen for hot enclosures, under-hood modules or equipment with poor airflow. Years of thermal cycling affect the package, the solder joints and the charge held in flash cells. Conformal coating is more common on these boards, and removing it is a separate step before any package-level work. We record the full marking and date code at intake rather than treating the suffix as a cosmetic variation.
The Array, Briefly
One hundred and twenty-eight kilobytes is eight 4 KB sectors followed by three 32 KB sectors. The 8 KB boot block at 0x7E000 holds ISP, IAP and RealMonitor and cannot be written, erased or branched into by those commands. Sector 0 contains the eight exception vectors, the checksum at 0x14 and the CRP word at 0x1FC. The boot ROM requires the vectors to sum to zero before it transfers control to the application.
The H suffix changes no protection behaviour at all. The word at 0x1FC, the sector map and the IAP entry point are identical to the FBD version. What the boot ROM does with 0x12345678, 0x87654321 and 0x43218765 is the same: close the debug port and the read commands, then reduce ISP to a whole-chip erase, then ignore the P2.10 entry pin while the vector checksum passes. The practical difference is retention, not security, and that is what makes a second read worthwhile on a part that has lived hot.
Why Retention Is The Real Variable
Flash retention is specified over temperature, and a device that has spent its working life near the top of its range is more likely to hold marginal cells. On this family the flash controller applies error correction on read, which in normal operation hides a weak bit. In an extraction, the check bytes sit beside the user data; a capture that discards them can deliver an image that looks correct and fails verification later. We keep them, read twice from different angles, and note explicitly how any disagreement was resolved.
That is the practical consequence of the H suffix. It is not a stronger lock and not a different memory map. It is a reason to be more careful about the assumption that every bit in the array is still at its programmed value.
A Marking Error Is More Likely Than A New Silicon
A BOM that lists an HBD part where an FBD was fitted, or the reverse, is a common source of contradictory reports: two boards that look identical are said to behave differently when the real difference is a rework, a substitute lot or a misread character on a worn package. We photograph the marking under raking light and confirm it against the die before writing anything into the job notes. Assigning a protection scheme to the wrong variant wastes more time than any amount of careful identification.
Verification Steps
The delivered binary has the vector checksum recomputed, a sector map marking blank regions, and a note recording the boot ROM revision and CRP word actually found. ARM and Thumb code can alternate at subroutine boundaries on ARM7, so analysis uses a mixed decode rather than a flat 32-bit one. Where a region had to be reconstructed, that is stated rather than hidden behind a clean-looking file.
Related Work
Our service scope describes intake and accepted device states. The protection walkthrough sets out the layers in order, and this AT32F435 case is a useful contrast with a much larger banked array. For the commercial-temperature marking of the same die see the LPC2364FBD100; for a 512 KB variant that drops USB and CAN, see the LPC2367FBD100.