An ISP command that names sector 27 is valid on this part and fails on the 512 KB member of the older LPC213x line. That is the sort of small difference that decides whether a field-update script works. The LPC2368FBD100 is the full-featured 100-pin member of the 72 MHz LPC23xx family: 512 KB of flash, 58 KB of SRAM, an RMII Ethernet MAC, a USB 2.0 full-speed device, two CAN channels, SD/MMC, six ADC channels and 70 GPIO. An open encrypted LPC2368FBD100 firmware job starts with counting the sectors correctly.
Twenty-Eight Sectors, 504 KB Usable
| Sectors | Count | Size each | Address span |
|---|---|---|---|
| 0 to 7 | 8 | 4 KB | 0x00000000 to 0x00007FFF |
| 8 to 21 | 14 | 32 KB | 0x00008000 to 0x00077FFF |
| 22 to 27 | 6 | 4 KB | 0x00078000 to 0x0007DFFF |
| Boot block | n/a | 8 KB | 0x0007E000 to 0x0007FFFF |
The boot block holds ISP, IAP and RealMonitor routines and is not a user sector. ISP and IAP are forbidden from writing, erasing or executing a go into it. Because it occupies the last 8 KB, a 512 KB device offers 504 KB for user code and data. That figure is a useful family fingerprint: the older LPC2138FBD64 reserves 12 KB at 0x7D000 and offers 500 KB instead. An image rebuilt with the wrong ceiling places its last sectors inside the boot ROM.
Sector 0 Carries Three Things
An ISP command names a start and an end sector. Send a number past the real last sector and the operation fails; on a protected unit the only erase still offered may be the whole-chip one, so there is no cheap way to discover the boundary by trial. Sector 0 holds the vectors, the checksum and the word at 0x1FC that sets the access policy. The three published values step from a closed debug port with sector erase intact, through whole-chip erase only, to an ignored P2.10 entry pin.
Since CRP3’s strongest rule is conditional on valid user code, a partially disturbed sector 0 changes the observed state: the checksum fails first and the part enters ISP. Reading those first 32 bytes is more informative than any assumption about the protection level. Boot ROM revisions differ in how many levels they implement, so a version query is the first serial exchange.
Four SRAM Pools, One IAP Constraint
The 58 KB of SRAM is 32 KB on the ARM local bus, 16 KB for Ethernet descriptors and buffers, 8 KB for USB and general-purpose DMA, and 2 KB on the RTC battery domain. In-application programming requires its source data in the local-bus block; the USB and Ethernet pools cannot feed an IAP write. With 32 KB available, an updater can stage a whole 32 KB sector, and that loop is usually obvious once the image is disassembled.
The dual AHB arrangement lets Ethernet DMA, USB DMA and instruction fetches from flash proceed concurrently. A live capture on external pins therefore shows peripheral traffic, not a clean instruction stream. The array sits on the ARM local bus and is best read as an array.
Peripherals Are Not Storage
The Ethernet MAC needs an external PHY, the two CAN controllers keep their acceptance filter in RAM, and the SD/MMC interface may address a removable card. None of those is the on-chip program store. A card can hold data or a secondary image, and we ask whether one was present in the unit, but the boot code is in the internal 512 KB. The 2 KB RTC-domain SRAM is the only on-chip place where customer state may survive a main supply loss.
What We Deliver
Deliverables are split by origin. The internal image stops at the 504 KB boundary and ships as both raw binary and HEX, with a sector-by-sector blank map. Any SD card content is a separate file, never concatenated. We log the protection word, the ROM revision and the recomputed checksum, and we keep the ECC bits attached to each captured word: quietly resolving a weak cell into a valid opcode is exactly the kind of error a customer cannot detect later. Reconstructed regions are flagged in the manifest.
Related Work
Our service scope covers intake and accepted device states. The NVRAM article explains retention on the battery-backed pool, and this AT32F435 case is a useful contrast with a banked megabyte-class array. Compare the cost-reduced LPC2367FBD100, which drops USB and CAN while keeping the same 512 KB, and the LPC2468FBD208, which adds an SDRAM-capable memory controller and 98 KB of SRAM.