Two different non-volatile arrays can sit behind one part marking. The LPC2212FBD144 has 128 KB of on-chip flash and 16 KB of SRAM, and it also carries the external memory controller that lets a board add up to four 16 MB banks of parallel memory. Reading a protected LPC2212FBD144 file therefore means establishing which array the customer actually cares about, because the two are governed by completely different rules.
The Address Map
| Region | Start | Size | Governed by |
|---|---|---|---|
| On-chip flash | 0x00000000 | 128 KB | boot ROM and CRP word at 0x1FC |
| On-chip SRAM | 0x40000000 | 16 KB | volatile, no protection |
| External bank 0 | 0x80000000 | 16 MB | external device and BCFG0 |
| External bank 1 | 0x81000000 | 16 MB | external device and BCFG1 |
| External bank 2 | 0x82000000 | 16 MB | external device and BCFG2 |
| External bank 3 | 0x83000000 | 16 MB | external device and BCFG3 |
Boot ROM code, ISP and IAP routines, and the RealMonitor sit in the 8 KB boot block at the top of the memory map. ISP and IAP commands cannot write, erase or branch into it. Bank 0 is special because BOOT0 and BOOT1, sampled on P2.26 and P2.27 while reset is low, can select it as the boot source with an 8-, 16- or 32-bit width.
Internal Flash Follows The Usual Rules
The on-chip 128 KB is organised as 4 KB sectors at the bottom and 32 KB sectors above. Sector 0 holds the eight ARM exception vectors, the reserved checksum word at 0x14 and the Code Read Protection word at 0x1FC. The checksum must make the eight vectors sum to zero or the boot ROM enters ISP rather than running the application.
CRP1 (0x12345678) disables JTAG and ISP read and compare and blocks writes to sector 0 while allowing sector erases. CRP2 (0x87654321) leaves only a full-chip erase. CRP3 (0x43218765) disables ISP entry through P0.14 when valid user code is present. Early bootloader revisions had only the middle level, so a version query over the serial interface comes before anything else.
External Memory Follows None Of Those Rules
A parallel flash on CS0 has no idea what CRP means. It may have its own software-protected sectors, a write-protect pin or no protection at all. A mask ROM cannot be reprogrammed. An SRAM bank loses everything at power-down and must be loaded from somewhere else. Treating the two arrays as one “firmware” is the most common mistake on these boards, and it usually shows up as a dump that stops at 128 KB while the application clearly references addresses above 0x80000000.
Disassembly helps here. A reset vector that immediately configures BCFG0 and then jumps into the 0x80000000 range is a design that boots externally even though internal flash is present. A build that keeps everything below 0x00020000 may use the external banks only for data logging.
Pin Budget Is A Practical Constraint
Any read protected LPC2212FBD144 file request has to name which of the two arrays actually matters.
The 144-pin package offers up to 112 GPIO in single-chip mode, but enabling the external bus consumes 36 of them for address, data and control lines, leaving 76. JTAG, the ETM trace port and the ISP entry pin compete with that budget. On a production board, the signals needed for a non-invasive read may simply not be brought out to a header, which is a design decision rather than a protection feature.
Reading The External Device
Where the parallel memory is socketed, removing it and reading it in a dedicated programmer is the least invasive route and avoids any contention with the MCU. A soldered part needs reset held low while the bus is accessed. Byte lane order follows the strap-selected width, so a 16-bit boot device stores the vector table differently from an 8-bit one; a dump taken with the wrong assumption looks complete and disassembles into nonsense. We capture the strap state from the board and state it in the delivery note.
What We Hand Back
Separate files for the internal array and each populated external device, the CRP word and bootloader revision if internal flash was read, the BCFG configuration actually observed, and the BOOT strap state. The vector checksum at 0x14 is recomputed for the internal image so it can be verified on a reference board.
Related Work
The contact route handles intake of board photographs and schematics. The NVRAM article covers retention on volatile and battery-backed stores, and this STM32F407 case is a contrast with a single-array device. Within this family, the ROMless LPC2210FBD144 has no internal flash at all, while the LPC2214FBD144 doubles the internal capacity to 256 KB.