The TMS320F28075 belongs to a different security generation than the rest of the F280x line, and the difference is not a matter of degree. Where earlier parts kept a 128-bit password in the flash array and let the debugger try again after a wrong guess, this device keeps its zone passwords in one-time-programmable memory, offers a permanent JTAG disable, and can mark sectors execute-only so that even code running inside the zone cannot read them back. Two hundred and fifty-six thousand words of flash and fifty thousand words of RAM sit behind all of that, at a hundred and twenty megahertz.
Where The Password Lives Now
Dual-zone security on this part splits memory into Zone 1 and Zone 2, each with its own 128-bit password and its own set of protected sectors. The passwords live in OTP, not in the array, which removes the simplest recovery route: there is no flash window to read that happens to contain the key. The zone configuration and the passwords are written once, at production, and a part whose OTP has been programmed cannot have them changed.
Three consequences follow. First, a password recovered from a sibling unit is the only credential that transfers, and only if the same project file produced both. Second, a mass erase clears the array but does not clear the OTP, so a part that was locked stays locked in configuration even when its flash is empty. Third, an erased-looking part may be a locked part with nothing in it, which is a distinction worth establishing before quoting a decapsulation.
The Switch That Cannot Be Flipped Back
JTAGLOCK, when programmed, disables the debug port permanently. There is no unlock sequence, no factory backdoor, and TI states plainly that failure analysis will be refused on a locked device. Designs that enable it are telling you the code is worth more than the board it runs on.
For a readout this closes the debug-port route entirely and leaves only the physical one. It also raises the stakes on the diagnosis: a part with JTAGLOCK and a working program is a legitimate decapsulation job, while a part with JTAGLOCK and a failed flash is a piece of scrap that will cost money to prove is scrap.
Execute-Only Sectors
The third mechanism is subtler. A sector can be marked execute-only, which means the CPU may fetch instructions from it but cannot read it as data — not even from code running inside the same zone. A debugger sees nothing; a program that tries to copy the routine into RAM gets an error instead of bytes.
That setting is why some images come back with a region that reads as protected while everything around it is open. The protection is not a password this time; it is a permission. Recovering such a region requires the physical read, because the memory controller will refuse every logical access regardless of credentials.
Reading A Half-Megabyte Array
Five hundred and twelve kilobytes is the largest array in this batch and it is read in windows with overlap, anchored on the vector table and validated by checksum at every stage boundary. The read plan also accounts for ECC: the array stores check bits alongside data, and a window captured without them cannot be validated against the corrected image later.
We capture the OTP configuration before the array, because it defines the zone boundaries and states which sectors are execute-only. That map turns the reconstruction from a search into an assignment of regions to zones.
Saying What Cannot Be Undone
Irreversibility belongs at the top of the report, not in a footnote. If a unit arrives with JTAGLOCK programmed and the array unreadable, no amount of work reopens the debug port, and a customer who expected a software solution should learn that before the invoice rather than after it.
What The Customer Gets
The HEX, the binary, the zone map with both ranges labelled, the OTP configuration dump, whichever passwords were recovered, the parameter block, and per-region checksums. Where a sector was execute-only and had to be read physically, the report records it, because that fact affects how the image can legally be reused.
The same device discussed from the output-format side is on the TMS320F28075 binary page; the previous security generation, where passwords still sit in flash, is covered by the TMS320F28067 job. Dual-zone and JTAGLOCK questions go to the services desk or the contact form.