The LPC1815JET100 is an NXP LPC18xx part: a Cortex-M3 at 180 MHz with 768 KB of flash and 136 KB of SRAM in a TFBGA100. Our extraction desk captures the TFBGA100 die and delivers a merged HEX for the LPC1815JET100.
Where The Read Protection Lives
The LPC1815JET100 guards its array with a code-read-protection bit in the flash signature and OTP area, a reversible setting. NXP’s CRP on the LPC1815JET100 is a bit in the flash signature region that blocks debugger reads but never erases the array. The NVRAM methodology is the reference for why the data region is read on its own.
Reporting And Hand-Off
Delivery is one Intel HEX at the true addresses, a binary per region, and a report listing the CRP state and boot source. Customers get an Intel HEX merging all regions at real addresses, separate binaries, and a short report for the LPC1815JET100 TFBGA100. The LPC1820FBD144 reference describes a sister device in the same LPC1815JET100 series.
Bench Routine
We read 768 KB of flash (or the SPIFI device on flashless parts), the OTP and signature area, then a live RAM image, then re-check. The capture order on the LPC1815JET100 is on-die flash or SPIFI image first, then the OTP region, then any live RAM, then a second pass.
Flash And Working Memory
The LPC1815JET100 maps 768 KB of flash for execution and 136 KB of SRAM for data, with an EMC that can attach off-die SDRAM. Because the LPC1815JET100 includes an external-memory controller, a board may place code or data in off-chip SDRAM through the EMC. An R8C code note shows a Renesas 16-bit cousin with the same program-and-data split.
Peripheral Set
The LPC18xx character of the LPC1815JET100 comes from the HSADC near 80 Msps and the SCT state-configurable timer built in hardware. What makes a LPC1815JET100 more than a generic Cortex-M3 is the HSADC and the SCT, both configured by code in 768 KB of flash. The RX563 extraction case documents a Renesas part with a comparable fast-ADC emphasis.
The Cortex-M3 clocked at 180 MHz on the LPC1815JET100 runs the recovered code in place, so the write-up notes the boot setup for a spare TFBGA100.
Most LPC1815JET100 jobs arrive with no compiler project, only the physical part and a failed recovery attempt.
The 100-pin LPC1815JET100 is logged against its order code so a repeat job reuses the same bench setup.
We archive a checksum per region so a future read of the LPC1815JET100 can be compared byte for byte.
Where a bootloader stage exists that region is captured in full for the LPC1815JET100, the usual third-party omission.
A TFBGA100 LPC1815JET100 sent cold in foam reads more reliably than one that travelled powered and warm.
The 768 KB of flash on the LPC1815JET100 is read at the true addresses, not a relocated image a tool might invent.
Where the LPC1815JET100 arrived with corroded pins, we clean the TFBGA100 before the first bench attempt.
The customer receives the files with a short note on reflashing the TFBGA100 without tripping the read lock again.
Photographs of the 100-pin board are filed with the write-up so the LPC1815JET100 package can be audited later.
The report includes the option area or signature contents so the LPC1815JET100 lock can be re-applied if required.
A 100-pin LPC1815JET100 that failed a previous shop usually still yields to a careful second pass.
The 136 KB of SRAM on the LPC1815JET100 is captured live only when the board still comes up on power.
A TFBGA100 LPC1815JET100 that locked mid-project is common; the code array is intact, only the debug path is closed.
A recovered LPC1815JET100 is cross-checked against the order photo so the marking matches the report.
The Cortex-M3 clocked at 180 MHz on the LPC1815JET100 is documented in the write-up so a replacement part boots identically.
Where a live TFBGA100 board is supplied we trace the serial lines before removing power from the LPC1815JET100.
For a 100-pin LPC1815JET100 the alternate-function pins are decoded from the dump, not guessed from the silk.
A LPC1815JET100 that has been partially read elsewhere often arrives with the option area region already corrupted.
Calibration stored in non-volatile memory is recovered alongside the main array of the LPC1815JET100.
A second confirming read is offered when a customer wants proof no weak cell moved on the LPC1815JET100 TFBGA100.