Rather than a new device, the STM32H743AII6TR is simply the AII6 ordered on a reel. Inside the UFBGA169 lid there is a 480 MHz M7, 2 MB of flash arranged as two banks, a full megabyte of system RAM, and the LTDC/DMA2D/JPEG graphics chain. TR is an ordering suffix describing the carrier, not a second mask set: the die, its protection map and the readout procedure match the tray part exactly. High-volume lines prefer reels because feeders sustain placement throughput that trays cannot, whereas a prototype bench build usually orders the bare code; neither choice reaches the silicon. The bypass-protection overview explains why the ordering code never alters the lock behaviour. A locked STM32H743AII6 read covers the tray-form counterpart, which shares the map exactly.
Reel Code On A Panel Part
A copy of a secured STM32H730IBK6Q shows a no-external-memory H7 cousin carrying the same lock word, a useful reminder that the carrier never reaches the debug port. For a very different architecture, copying an STM32F103 firmware shows the classic Cortex-M3 baseline that many engineers still cut their teeth on. Because the part has graphics, the 1 MB of SRAM holds framebuffers the LTDC drives directly, so the recovery must capture the display registers as well as the code. The ordering code is a logistics tag that the silicon never sees, so it has no bearing on how the array is read or what the lock permits, and the bench treats the two carriers as one.
Test Budget Pressures
Volume builds that use the TR code tend to be the ones with the tightest test budgets, and that is exactly where a wrong assumption about the lock bites. A contract manufacturer may set RDP level 1 on the line to discourage field cloning, then discover during rework that the firmware cannot be read back for a legitimate fix. Knowing that the TR suffix carries no extra protection lets the test engineer plan a recovery path the production team did not anticipate, using the same bench procedure as the tray part. The reel is a packaging choice decided at the back end of the line, far from the protection logic that was set at programming time, so the two never interact.
Protection Is Identical
The reel suffix does not touch the lock, which is one option byte. 0xAA leaves the chip readable, 0xBB engages level 1; 0xCC is the permanent level 2. The byte is written to FLASH_OPTSR_PRG and locked with OPTSTART, becoming active once the option page reloads after a reset. At level 1 the array, its backup register file and backup SRAM vanish from the probe, and the 1 MB RAM is sealed once reset completes, so the ordering code never alters lock behaviour.
PCROP is programmed in FLASH_PRAR_PRG at a 256-byte alignment, so only instruction fetches reach the region while data traffic, DMA and debug get nothing. FLASH_WPSN holds the per-sector lock.
Sixteen Sectors Again
A sixteen-sector 2 MB map over two banks of eight makes the array, and SWAP_BANK_OPT can remap the halves. The reel the part ships on does not touch this layout at all. As with the tray part, the 1 MB SRAM holds the framebuffers the LTDC uses, so the capture must include the display and DMA2D registers, and the reader must first establish the running half before any vector address is credible. Graphics plus a two-bank array is the richest case in the H743 family.
| Bank | Sectors | Typical content |
|---|---|---|
| 0 | 0 to 7 | active application |
| 1 | 8 to 15 | staged update |
The option byte comes before the flash. Confirm the initial vector matches the density code, note the RDP level, the execute-only region and the WRP mask, then capture the sixteen sectors.
Two passes at the same supply make ECC errors visible in FLASH_ECCR rather than in the data. The core’s own LDO that supplies the 1.2 V core dislikes noise, so a clean VCAP is what keeps the capture free of spurious faults.
Tray And Reel Alike
Closed ports are handled by the extraction service for the package and board steps. The reel origin changes nothing about the read: a UFBGA169 is reflowed and reballed after the lid is off, and the two-bank dump with the display registers captured is the same job as the tray part. Treat TR as a logistics tag, not a technical variable.