The R5F1007D occupies an odd position in the RL78/G13 catalogue: 48 KB of code
flash in the 24-pin 4 by 4 mm QFN, with 3 KB of RAM rather than the 2 KB of the
smaller members or the 4 KB of the 64 KB parts. That intermediate volatile
memory size is not cosmetic. It decides where the flash self-programming
library parks itself, it changes what a linker map reveals, and it sets the
practical limit on how much of the array can be rewritten from a running
application. The part keeps the 4 KB data flash of the small-memory row and
six converter channels in the same package as its 16 and 64 KB siblings.

Three kilobytes at FF300H

Renesas maps the 3 KB RAM of the 48 KB members to FF300H through FFEFFH, and
the flash library documentation names FF300H as the start of its self-RAM
window on exactly these parts. A recovered memory map that shows code segments
avoiding FF300H and above, with the library placed there, identifies both the
compiler flow that built the image and the fact that the authors planned for
in-field self-programming. For a readout job the same window is free real
estate: a streaming loader that fits below FF300H can run while the array is
being serviced, on a device that has just enough volatile memory to permit it.

Forty-eight blocks across three clusters

The array divides into forty-eight one-kilobyte blocks. Blocks zero to three
form the first boot cluster, blocks sixteen to nineteen in linear terms are not
special, but the swap target cluster sits at 02000H to 03FFFH and consists of
the next four blocks after the first. On this member that means more than
eight percent of the program store is boot-critical, duplicated when the swap
feature is used. Both copies must carry identical option bytes at 010C0H and
identical ten-byte identifiers at 010C4H, and the chip swaps them as a set.

The four-byte word

Code flash on this family programs in four-byte words, not bytes. A recovered
image that was written by hand, or a repair that patches a single constant,
has to respect that granularity, and the erase-verify cycle runs per block.
The practical effect in recovery work is that partial writes leave a
recognisable signature: a word that was interrupted mid-program reads back as
a mix of old and new bits in a fixed pattern, and recognising that pattern
tells the analyst which region of the image was being updated when a power
failure or tamper event stopped the write.

Protection unchanged by package

The four option bytes, the two ten-byte identifiers and the block protections
enabled at shipment are identical to every other member. What the QFN changes
is access, not policy. The 0.5 mm wings and the bonded centre pad mean that
the readout either happens through vias on a cooperative board or after the
part is lifted and re-ballasted on an adapter. Lifted-part work is standard
for this package class and is part of the routine described on the
firmware extraction service page rather than an exceptional measure.

Arithmetic support and transfer engines

Two pieces of the periphery shape what a recovered image looks like. The core
is assisted by a hardware multiplier that forms 16 by 16 products into 32 bits,
a divider for 32 over 32, and a multiply-accumulator, so calibration loops and
filter code stay compact enough for a 48 KB budget. Moving data, the part
offers a two-channel DMA controller plus the data transfer controller, and
field-update routines lean on the pair: DMA streams blocks while the sequencer
works, the DTC handles the byte-sized transaction choreography. In a recovered
image the interrupt structure shows which engine carried which load, and that
in turn identifies the compiler flow that built the image.

The data flash and the appliance licence

Four kilobytes of data flash hold the calibration and usage data, and the
household appliance safety standard that Renesas certifies this family against
expects that data to be intact through any update sequence. Recovering a board
therefore means treating the data array as evidence: the wear-levelled write
history in it often reconstructs the service life of the unit, and the
calibration constants it holds are required to make any cloned controller
actually regulate like the original.

Reading further

The 24-pin members below and above this one are in R5F1007A memory readout and
R5F1007E flash heximal; the 25-pin wafer-scale equivalents begin at R5F1008A program memory,
whose 48 KB member is R5F1008D embedded memory. The same die in a leaded 30-pin package
is catalogued as R5F100AD code flash extraction. Comparisons with the previous generation of
small 8-bit controllers, where a 3 KB RAM class did not exist at all, are in
the note on MC68HC08AZ60 eeprom memory recovery, and the general service workflow lives on the
MCU crack service page.