R5F100EG raises the 40-pin row to 128 KB of code flash with 12 KB of RAM,
the 8 KB data flash and nine converter channels in the 6 by 6 mm HWQFN. It
is the capacity where the segmented one-megabyte address space of the RL78
core becomes the central technical fact of any recovery, and where the
package’s generous I/O spread makes it the usual choice for boards with
relay banks and multi-sensor front ends.

Segmented addressing at 128 KB

At 128 KB the image is banked: the core reaches past its 64 KB logical
window with a segment register, and firmware here uses the upper windows
for code and constant tables throughout. Tooling that flattens the image
assembles something plausible-looking that never runs, the classic
failure at this capacity, so the capture keeps block boundaries and the
rebuild carries window assignments from the first kilobyte to the last.

Twelve KB of RAM and the library

Twelve kilobytes host the library, the updater and the application
together, and the reservation at the top marks an update-capable build.
Maintained boards carry both boot copies, the flag byte names the live
generation, and the retired copy preserves the firmware the unit shipped
with. The capture standard here is both copies, the flag and the option
block.

The relay-and-sensor profile

Thirty-six I/O with nine open-drain pins at a six-volt withstand drive
relay banks and interface mains-side circuitry directly, and the nine
converter channels carry the sensor front end. Calibration for those
channels lives in the 8 KB data flash with the fault and usage logs, and
recovering the array alongside the code is what makes a cloned board behave
like the original across its whole operating range. Boards built around
this member tend to fail in their drivers rather than their logic, and
the first diagnosis on the bench is usually electrical rather than
forensic. Cost pressure keeps such boards in service long past their
design life, which is part of why they arrive here at all.

Protection and the passive first read

Block protections ship enabled, the fourth option byte carries the debug
gate and its erase-on-failure choice, and the two ten-byte identifiers
wait beside the vectors. Serial-path authentication is nearly always
populated on boards of this size, since the production programmer used
it. The passive read of the first kilobyte settles the opening, and the
shield window, where present, is noted with the capture.

Row context

The 40-pin siblings are in R5F100EA program memory through R5F100EF flash memory and
R5F100EH firmware decryption. The 128 KB die in other packages is the 30-pin class, the
32-pin R5F100BG flash data, the 36-ball R5F100CG flash heximal and the 44-pin
R5F100FG memory dump. Architecture comparisons with an earlier generation that
needed bank switching to reach this program space are in MC68HC11E9 encrypted heximal, and
the family-level services are indexed on microcontroller unlock.

Banked code in a 40-pin QFN

At 128 KB the image spans the banked address space, and this member is
the largest 40-pin part, so the combination, a full segmented
application with nine converter channels and thirty-six I/O, marks it as
the flagship of mid-density motor-control and charger designs. The
capture flow is unchanged in outline: the array is walked block by
block, the lowest kilobyte is archived first, both boot copies are read
when the swap feature is present. What changes is the assembly step,
where segment assignments must survive into every rebuild, and the
write-back step, where patched code has to land in the same window the
banked image expects.

The 6 by 6 mm QFN adds its own bench consideration: the exposed pad
usually bonds to a ground flood, and hot-air work must plan for the
thermal mass or the lift takes longer than the rest of the session
combined. Once lifted, the part re-balls onto a carrier and behaves
like any leaded member for the remainder of the job.

Recognition of the banked layout happens during the session, not after: the linker map’s window assignments, the segment-loading stubs in the handler prologues and the placement of constant tables all confirm the structure while the fixture is still connected. Confirming early matters because a mis-assembled 128 KB image looks finished right up until the moment it is flashed and does nothing.