Hold reset low, look at two pins, and the whole boot path is decided. The LPC2290FBD144 is a ROMless 144-pin ARM7TDMI-S device: 16 KB of on-chip SRAM, two CAN channels, an 8-channel 10-bit ADC, and an external memory controller, but no on-chip flash program memory. Restoring secured LPC2290FBD144 data is not an unlock job on the microcontroller. It is an identification job on the memory device sitting next to it.
The Strap State Comes First
| BOOT1 (P2.27) | BOOT0 (P2.26) | CS0 device width | Typical part |
|---|---|---|---|
| 0 | 0 | 8-bit | 8-bit parallel flash |
| 0 | 1 | 16-bit | 16-bit flash, two chips in parallel |
| 1 | 0 | 32-bit | 32-bit flash or four 8-bit devices |
| 1 | 1 | 16-bit | same as 01 |
Both pins have internal pull-ups, so an unconnected pair selects the 32-bit case. The boot ROM configures the EMC, reads the first eight words from chip select 0 and transfers control to the reset vector. If the physical bus width and the strap state disagree, the part fetches nonsense. Recording the strap resistors is therefore not optional: it is the difference between a valid image and a byte-swapped file that disassembles into garbage.
Where The Code Actually Lives
A restore secured LPC2290FBD144 data brief is really an identification job on a separate memory device.
The EMC offers four banks of 16 MB at 0x80000000, 0x81000000, 0x82000000 and 0x83000000, each configurable for 8-, 16- or 32-bit devices through BCFG registers at 0xFFE00000. Bank 0 is the boot source; the others commonly hold data tables, frame buffers or additional code. A gateway design with two CAN channels may keep protocol tables in a second flash device entirely.
That second device is easy to miss. A customer who asks for “the firmware” may need both chips, and a read confined to CS0 will produce an image with references into a region that was never captured. We identify every non-volatile device by marking and pinout before deciding what belongs in the delivery.
Why There Is No CRP Word On This Part
Code Read Protection is implemented as a value at 0x1FC inside sector 0 of on-chip flash, interpreted by the boot ROM on reset. With no on-chip flash there is no sector 0, no CRP word and no ISP read command to refuse. The boot block, ISP, IAP, JTAG and the ETM are present, but they are about configuring and debugging the MCU, not about handing out application code.
Protection therefore belongs to the external memory. A parallel flash may implement sector protection or a write-protect pin; a mask ROM cannot be altered; an OTP device cannot be erased. Each has a different read procedure. Attempting an “unlock” sequence designed for an on-chip array on a board like this is at best wasted time and at worst destructive.
Dual CAN, And What It Does Not Store
The two CAN controllers with their shared acceptance filter are peripheral-side. Identifier ranges, message objects and filter tables live in registers and RAM, and all of it disappears at power-down. A flash read returns the code that initialises those structures. On a board that has been in service for years, the difference between recovering the program and recovering the running configuration has to be stated at the outset.
A related trap is the board that no longer boots. On a ROMless design the cause is often the external device rather than the MCU: a marginal flash cell, a failed solder joint on an address line, or a strap resistor that has drifted. Replacing the MCU changes nothing. We power the board on a current-limited supply and capture the first bus cycles after reset before deciding which component to read, so that a hardware fault is not misdiagnosed as a protection state.
Practical Notes
Reset is held under control during any in-circuit read so the MCU is not driving the bus against the programmer. Byte lane order follows the strap-selected width, and the ARM vector checksum still applies to the external image: the eight vectors at the start of the code device must sum to zero, with 0x14 holding the two’s complement of the other seven. We recompute it when rebuilding a bootable file.
Related Work
The contact page is where board photographs and schematics go. The memory-type comparison helps distinguish a parallel flash from a mask ROM or OTP device, and this 32-bit ARM case is a useful contrast. For the ROMless part without CAN see the LPC2210FBD144; for the 256 KB, dual-CAN member with on-chip flash see the LPC2292FBD144.