The gaps in a selection table are often more informative than the entries. The LPC2367FBD100 is a 512 KB flash, 58 KB SRAM, 72 MHz ARM7TDMI-S in a 100-pin LQFP, and it carries SD/MMC and an RMII Ethernet MAC but no USB device controller and no CAN channels at all. It is the cost-reduced member of the LPC236x line. A readout secured LPC2367FBD100 MCU job has to work with fewer live interfaces than its better-known sibling.
What Was Removed
| Feature | LPC2367FBD100 | LPC2368FBD100 |
|---|---|---|
| Flash | 512 KB | 512 KB |
| SRAM | 58 KB | 58 KB |
| Ethernet | RMII | RMII |
| USB device | no | yes |
| CAN | none | 2 channels |
| SD/MMC | yes | yes |
| ADC | 6 channels | 6 channels |
The peripheral mix is a deliberate choice, not a defect. A product that never needed USB or a CAN bus could save on the die and on the board. For recovery work the consequence is a smaller capture surface: there is no USB endpoint RAM to observe, no CAN traffic on the pins, and one fewer DMA path generating bus activity. What remains is the Ethernet MAC with its own DMA on a separate AHB, the SD/MMC controller, four UARTs, three I2C buses, two SSP controllers, SPI and I2S.
So Where Is The Code?
In the on-chip 512 KB flash array on the ARM local bus. There is no external memory controller on this device, so nothing is off-die. That is a useful constraint: no parallel bus to monitor, no second chip to misidentify as the program store. The SD/MMC interface may hold data or even a secondary image on a card, but the boot code is in the internal array.
Five hundred and twelve kilobytes on this family yields 504 KB for user code and data, because an 8 KB boot block at 0x7E000 to 0x7FFFF holds ISP, IAP and RealMonitor. Twenty-eight sectors cover the array: 4 KB at the bottom, 32 KB through the middle, 4 KB near the top. A flat 512 KB read crosses into the boot block, which no ISP or IAP command is permitted to write, erase or branch into.
Protection, And The Order Of Checks
Rather than memorise three level names, we tabulate what the boot ROM leaves available after it reads 0x1FC.
| Value | Debug | Read / compare | Write to RAM | Erase | P2.10 |
|---|---|---|---|---|---|
| other | on | yes | yes | per sector | open |
| 0x12345678 | off | no | yes | not sector 0 | open |
| 0x87654321 | off | no | no | whole chip | open |
| 0x43218765 | off | no | no | none | closed |
Two caveats sit behind that table. The last row holds only while the vector checksum passes, so a disturbed first sector drops the part into ISP regardless of the protection word; reading the first 32 bytes settles the question. An early boot ROM may implement fewer tiers than a later /00 or /01 device, which is why the first serial exchange is a version query rather than a read. With no USB endpoint RAM or CAN filter on this variant, there is also less volatile state to mistake for the array.
IAP Still Works
In-application programming is unaffected by CRP: it is a ROM routine at 0x7FFFFFF0 called by code already running on the chip. Writes need a 256-byte-aligned destination and move 256, 512, 1024 or 4096 bytes from local-bus SRAM. The 58 KB total is split into 32 KB on the local bus, 16 KB for Ethernet, 8 KB for USB/GPDMA and 2 KB on the RTC battery domain; only the first can serve as an IAP source. That 32 KB is large enough to stage a whole 32 KB sector, which shows up as a characteristic loop in a field-update routine.
Delivery
The handover lists the internal array up to the 504 KB ceiling (binary and HEX), a blank-sector map, and the protection word and ROM revision measured on the bench. Two independent reads are compared word by word; ECC bits come with the capture, because letting a marginal cell resolve itself into a plausible opcode hides the very defect a second read is meant to expose. Card content, if any, is delivered separately.
Related Work
The contact page handles intake. The memory-type comparison explains why this array is neither OTP nor mask ROM, and this STM32F407 case is a useful contrast. For the high-temperature 128 KB member see the LPC2364HBD100; for the 144-pin device that adds a MiniBus and 104 GPIO, see the LPC2378FBD144.