R5F100BC moves the 32-pin QFN to 32 KB of code flash while keeping the 2 KB
RAM, 4 KB data flash and eight converter channels of the small-memory row.
The 5 by 5 mm body with 0.5 mm pitch is shared across the whole 32-pin row,
and this member is the capacity where appliance and metering images typically
settle: enough program space for a full protocol stack, not enough to tempt
the linker into waste. The 2 KB RAM keeps the flash library out of volatile
memory, which shapes both the update strategy the firmware can use and the
readout plan the bench applies.

Thirty-two blocks, one block that decides everything

The array divides into thirty-two one-kilobyte blocks. Block zero carries the
vectors, the four option bytes with the debug gate and its erase-on-failure
bit, both ten-byte identifiers, and the boot flag that selects between the
two four-kilobyte boot clusters. Block protection ships enabled, including
the boot-area reprogramming guard. Because the block is the erase unit, every
change to that configuration is a block-level rewrite, and a field updater
that loses power mid-rewrite leaves the classic signature: intact vectors
with a half-written option area, which the first read of block 0 exposes.

ROM-resident library and what it allows

With 2 KB of RAM the self-programming library runs in ROM-resident mode: the
code flash cannot serve the CPU while the sequencer is busy, so the
application halts during any erase or write. Firmware authors accept that for
rare updates of a few blocks. For the analyst the same mode means in-circuit
readout has the whole CPU to itself whenever the sequencer is idle, and the
read path needs no RAM at all, which is why the 2 KB members are among the
straightforward readout targets of the family despite their small buffers.

The eight channels and where they point

Eight inputs feed the 8/10-bit converter. On metering boards the higher
channels carry the supply divider and the neutral-monitor inputs that the
safety logic watches, and the thresholds that act on them are constants in
code while the logged events are records in the 4 KB data flash. The pair
together explains how the board behaved, and recovering both is what
separates a diagnosis from a guess. The data array also holds the metering
calibration that any replacement board must inherit.

Identifiers in metering practice

Production lines for metering products almost always populate the serial
programming ID at 000CEH, because the field programming stations
authenticate with it. The debug ID at 000C4H is set far less often, and the
destructive erase bit in 000C3H is usually disabled in metering because a
failed tool session in the field must not brick the unit. The result is a
protection posture that is closed to programmers and open to emulators, an
asymmetry the passive read of block 0 reveals before anything is connected.

Access on the QFN

The 0.5 mm wings carry the single-wire TOOL0 pad, the UART pair and the
supply, and layouts that route them to test pads make the first connection a
minutes-long affair. Where they are not routed, the lift-and-reball route
onto an adapter is standard and returns the part to service afterwards. The
die itself remains reachable through the IC decapsulation service service when the
electrical routes are all closed, and the broader handling is on the
firmware extraction service page.

Row context

The 32-pin siblings are in R5F100BA locked flash, R5F100BD program memory, R5F100BE embedded memory,
R5F100BF memory dump and the 128 KB R5F100BG flash data. Leaded equivalents with the
same memory are R5F1006C code flash extraction and R5F100AC flash memory, and the 36-pin row begins
at R5F100CA flash memory. For the protection contrast with a previous generation
that had no separate data array, see LPC2101FBD48 processor memory, and the family-level
service overview is the microcontroller unlock page.

Watchdog policy in the option area

The first option byte, at 000C0H, sets whether the watchdog runs and
whether it operates as a plain interval counter or a windowed one. The
windowed choice is the certification-friendly setting: feeding the dog
outside its permitted window is treated as a fault, which is what the
household-appliance standard wants to see. For recovery the setting is
evidence of engineering discipline, and it is also a trap for anyone
repairing a board blindly, because a replacement image written without the
original option bytes can leave a controller that resets on a schedule no
disassembly will ever explain.