The TMS320F280200 is the smallest Piccolo: eight kilowords of flash in two sectors of four, three kilowords of RAM, forty megahertz, and a converter that needs half a microsecond. Sixteen kilobytes of program memory is about the size of a small photograph, and it is enough for a fan controller, a charger, a lighting ballast or a protection relay. It is also the part on which security is most often skipped, because a sixteen kilobyte image feels like it could not be worth protecting, and because a small appliance manufacturer has other things to do on the day the production file is written.

Two sectors, one of them precious

The array occupies the top of the flash address space in two blocks, and the last one holds the interrupt vectors, the branch word that the boot read-only memory follows and the eight password words. With only two sectors there is no scratch area: a field update has nowhere to run from except RAM, and the erase of one sector removes half the program. Products built on this device are therefore programmed once and never updated, which is why the ones that arrive here are usually the only surviving unit of a machine whose manufacturer has moved on.

The unsecured default

A device whose password words are all ones is defined as unsecured, and that is the state in which parts ship. An unsecured device hands its array to anyone who connects a debugger, with no password, no authorisation and no trace. A large fraction of the F280200 population is in exactly that state, and establishing it takes one connection and one read. Before quoting a recovery on this part, the first minute should be spent asking whether the customer has tried reading it, because frequently nobody has.

When it is locked

Then the rules are the family’s rules: eight password words, eight key registers, dummy reads before the values, keys lost on reset, a refused read returning zero. Three kilowords of RAM sit behind the same lock, so a running capture of unprotected memory is not available on this device in the way it is on the larger hundred megahertz parts. That closes one of the cheaper routes and leaves two: a service image, or the die.

Sixteen kilobytes is quick to image

At this size the physical route is short. The package is small, the die is small, and the array images in a single pass under a microscope with a suitable stage. Preparation dominates the time rather than imaging, and the risk is in the opening rather than in the reading. Reports for this device are correspondingly compact: sixteen kilobytes of binary, the OTP block, and a note on whether the last sector’s vector table was intact, which is the cheapest hour of the project, which is the difference between a device that can be cloned and one that has to be reconstructed from behaviour. A sixteen kilobyte image is also small enough that a competent engineer can read all of it, which is not true of anything larger.

What a clone is worth here

On a sixteen kilobyte part, the firmware is often less valuable than the calibration and the production test procedure, both of which are in the customer’s hands and not in the device. That changes the shape of the engagement: the image proves the behaviour, and the customer supplies the numbers. When neither exists, the clone is a re-engineering job and should be quoted as one. The reading work is at firmware extraction service, the package work at IC decapsulation service, and the rebuild at chip reverse engineering service.

Related devices

The three kiloword forty megahertz members above it are TMS320F28020 and TMS320F28021, the six-channel variants are TMS320F280270, and the thirty-two kiloword parts start at TMS320F28023. For the category index see microcontroller unlock.