The R5F100CD is the 48 KB member of the 36-ball wafer-level row: 4 by 4 mm
with no leads, 3 KB of RAM, the 4 KB data flash and eight converter channels.
The 48 KB class brings its characteristic RAM size and the FF300H self-RAM
window of the flash library, and the ball-grid package brings the usual
access discipline: nothing is reachable except through the board, a fixture,
or a lift onto an adapter.

FF300H in a 3 KB budget

The 48 KB members map their volatile memory to FF300H through FFEFFH, and
the flash library reserves its self-RAM window from FF300H. A recovered
linker map with the reservation proves the image supports field updates and
shows where a readout loader can coexist with the running application. On
this member the budget is tight but workable: the loader fits below the
window, and the sequencer’s idle time belongs to the read path.

Forty-eight blocks, two clusters

The code array divides into forty-eight one-kilobyte blocks, the first four
being the boot cluster and the second four at 02000H the swap target. At 48
KB the swap costs eight percent, common enough that field-updated boards are
the norm, and both clusters carry option bytes and identifiers at 010C0H and
010C4H. A complete capture takes both clusters plus the boot flag in block
0, because the inactive cluster preserves the firmware generation the
product originally shipped with.

The four-byte word and interrupted updates

Programming is four-byte word oriented with per-block erase and verify. An
update that lost power leaves a mixed word at the boundary it reached,
surrounded by intact content. On a board that arrives dead, finding that
signature early distinguishes a failed field update from a hardware fault,
and the two lead to entirely different next steps: the first is recoverable
by completing the update, the second needs the diagnosis that the
chip reverse engineering service flow describes.

Access under the 4 by 4 body

Thirty-six balls at 0.5 mm pitch give a fixture a fair target if the layout
leaves clearance, and test pads for TOOL0 are common on production boards
because the factory needs one session. Where nothing is exposed, the
lift-and-reball route is routine and the part survives it. The protection
posture underneath is unchanged by the package: block protections enabled at
shipment, the debug gate and its erase bit in 000C3H, and both ten-byte
identifiers in block 0 alongside the vectors.

The data flash and calibration

The 4 KB data flash carries the calibration tables and wear-levelled logs,
read with the data-flash command set and protected by its own flags. On
motor and pump boards at this capacity the array’s history frequently
explains the fault, and the calibration it holds is required for any
replacement controller to regulate like the original. Both arrays, plus the
option-byte block, are the standard deliverable from this member.

Row context

The 36-pin siblings are in R5F100CA flash memory, R5F100CC code flash extraction and
R5F100CE memory readout through R5F100CG flash heximal. Leaded 48 KB equivalents are the
30-pin R5F100AD code flash extraction, the 24-pin R5F1007D locked flash and the 25-ball
R5F1008D embedded memory. For the same class in a package with leads and a bigger
analog spread, the 40-pin member is R5F100ED memory dump. Service-level entry
points are the firmware extraction service page for imaging and IC clone service for full
reproduction.

Interrupt tables as evidence

The vector table at the bottom of the array records which events the
firmware chose to service, and the interrupt structure distinguishes the
two transfer engines behind it. The two-channel DMA controller carries the
block-sized loads, the transfer controller handles the short, frequent
ones, and the split between them is visible in the table plus the handler
code. A recovered image whose table shows both engines in use was almost
certainly built with the standard tooling by an experienced team, which
shapes expectations about the security configuration: such teams usually
wrote both identifiers, and the recovery plan should assume a closed chip
until the first kilobyte proves otherwise. Reconstructing that
structure is routine: the table gives the entry points, the handler
code gives the engines, and the data array gives the counters that
show which paths the product actually exercised in service. For a
repair, the same structure defines what may not move.