The R5F1008A takes the RL78/G13 architecture into a 3 by 3 mm wafer-level
package: twenty-five balls, no leads, 16 KB of code flash, 2 KB of RAM and the
4 KB data flash of the entry members. On the ordering tables it appears as a
25-pin WFLGA, and on the board it appears as nothing at all, because the balls
sit under a body that a fingertip can hide. That construction decides the whole
character of work on this device, from how the first electrical contact is
made to how the die is eventually reached if the balls will not cooperate.

Working under a 3 by 3 body

A wafer-level package has no wings. Every connection is a solder ball on the
underside, at 0.5 mm pitch, and after reflow those balls are under the part
where a probe cannot follow. In-circuit access therefore depends entirely on
what the board designer exposed: test pads, vias under or near the footprint,
or stubs on the wiring side. Boards that never intended the controller to be
serviced give the analyst three options, none of them electrical: lift the
part with hot air and re-ball it on an adapter, read it through vias with a
fixture built for the footprint, or go through the die. The lift-and-reball
route is routine for this package and is described as part of the standard
flow on the firmware extraction service page.

The identification problem the other way

Small packages lose their markings easily, and a 3 by 3 body carries a code
short enough to be ambiguous. Before anything is connected, the usual step is
to confirm the device from circuit context: the REGC pin and its single
capacitor, the single-wire TOOL0 pad on P40, the 1.6 to 5.5 volt rail and the
absence of any 32.768 kHz crystal identify this row of the family even when
the top marking is worn. Marking recovery from a worn body, where needed, is
the kind of work the chip reverse engineering service page covers under package-level examination.

Protection model, unchanged under the glass

The chip keeps the family architecture: option bytes at 000C0H to 000C3H with
the debug gate and its erase-on-failure bit in the fourth byte, a ten-byte
debug ID at 000C4H to 000CDH, a ten-byte serial programming ID at 000CEH to
000D7H, and block protections enabled as shipped. Sixteen kilobytes means
sixteen one-kilobyte blocks, four of which form the first boot cluster with
its mirror at 02000H. Nothing about the package weakens any of it, and the
half-configured states that leak on larger parts, a written debug ID with a
blank serial ID or the reverse, show up here just as often.

What the safety logic watches

Renesas certifies the family against the household appliance safety standard,
and the hardware carries the self-diagnosis hooks that certification expects:
clock monitoring, a voltage detector with defined thresholds, a watchdog that
the option byte can window, and an on-chip temperature sensor. Five external
interrupt pins bring the mains-synchronous edges in. For recovery work this
frame is context worth capturing: the fault flags the firmware latches, and
the thresholds it compares against, live in the image and the data flash
together, and a rebuilt controller that lacks either behaves differently from
the original in ways that are hard to trace after the fact.

Sixteen blocks and a tight RAM

With 2 KB of volatile memory the part cannot host the flash library in RAM,
so any rewrite has to work within the library’s ROM-resident mode, and any
readout loader has to be small enough to share the budget with the running
application if the read happens in circuit. In practice the cleanest readout
for this member is out of circuit: part lifted, adapter, direct serial link,
and the whole sixteen blocks plus the data flash streamed out in one pass
while nothing else competes for the RAM.

The data flash and the appliance context

The separate 4 KB array carries the calibration and wear-levelled logs that
appliance firmware depends on, and on a sealed consumer product those four
kilobytes are frequently the only record of the unit’s history. A complete
recovery for this part is therefore three artifacts: the code image, the data
array, and the option-byte block captured as it was, because the option bytes
decide how the recovered image will behave when it is written back onto a
replacement die.

Row and family context

The 48 and 64 KB members of the same 25-pin package are covered in
R5F1008D embedded memory and R5F1008E memory dump. Leaded equivalents with the same memory
range start at the 20-pin R5F1006A flash memory and continue through the 24-pin
R5F1007A memory readout. The serial-side of this family’s protection, including how the
ten-byte identifier gates the programmer, is treated in the dedicated note
R5F1006A serial programming ID, and the physical end of the route, opening the die itself,
belongs to the IC decapsulation service service.