The R5F1006C sits in the same 20-pin outline as its 16 KB sibling but doubles
the code flash to 32 KB while keeping the 2 KB RAM and the 4 KB data flash of
the entry level. Renesas ships it as a 20-pin LSSOP on a 7.62 mm body and as a
20-pin TSSOP on a 4.4 by 6.5 mm body, both at 0.65 mm pitch, and the two
plastics share one die. That combination, middle-sized program store in the
smallest pin count the family offers, is what makes the part common in
consumer appliance boards where the firmware has outgrown 16 KB but the layout
cannot grow a single pin.

Thirty-two blocks, one of which guards everything

The array divides into thirty-two one-kilobyte blocks, and the block at the very
bottom is special. It holds the vectors, the four option bytes, the two ten-byte
security identifiers and the structures the boot swap logic reads. Block-level
erasure and programming protection ships enabled on every part, so a chip that
arrives from a production line has its block 0 already closed against accidental
rewrite even when nobody ever configured a security setting. Any work that
modifies that block has to first lift the protection through the documented
library calls, and a clean job records the original flags before touching
anything.

The debug gate and the erase bit

Byte 000C3H in the option area controls whether the on-chip debug interface
presents itself, and pairs that decision with a choice: when the ten-byte debug
ID at 000C4H fails to match, the chip can either refuse politely or erase the
entire code flash. Firmware authors who choose the destructive option turn the
device into a one-shot target. The practical consequence for recovery work is
that the ID must be recovered or reconstructed before the first debugger
connection, not after, and the safe route is a passive read of block 0 through
the serial path while the chip runs its normal code.

Reading through the serial link

Serial programming on this family runs over TOOL0, a single wire on P40 that
multiplexes a clocked UART handshake. The protocol the boot ROM speaks is
documented well enough that a host can authenticate, issue commands and stream
an image out when the ID bytes are blank, which they are on a meaningful share
of commercial boards. When the serial ID at 000CEH is populated, the same link
becomes the safest place to observe the chip: authentication failures there do
not carry the erase penalty that the debug path can, and the chip keeps its
firmware intact for the next attempt.

RAM is tight and the library knows it

With 2 KB of volatile memory, this part cannot run the flash self-programming
library from RAM the way larger members do. The library reserves a window at
the top of RAM and the linker has to place the loader so that it never collides
with that window, a detail that shows up in recovered linker maps and is one of
the tells that distinguish a professionally built image from a hobby one. For
extraction the tight budget matters less, because reading needs no library, but
it matters greatly for any repair that ends in rewriting a corrected block.

The data flash array

Four kilobytes of data flash sit at the top of the address space in their own
erase units, used by firmware for calibration tables and counters. The array
has a different block structure from code flash and its own protection flags,
so a dump that only captures code flash is incomplete for most appliance
boards. On these small parts the data flash often contains the serial number
and usage counters that make a recovered image actually useful for cloning a
unit, not merely for reading it.

What changes with the bigger packages

Moving to more pins does not change the protection model at all. The 30-pin
member with the same memory is catalogued under R5F100AA flash data, and the 32-pin
version under R5F100BA locked flash; both add converter channels and I/O without
touching the ID architecture. Downward, the 16 KB sibling is treated in
R5F1006A flash memory, and upward the 64 KB member is in R5F1006E firmware decryption. Cross-family
comparisons with older architectures, where protection meant a single security
bit rather than a pair of ten-byte identifiers, are drawn in the note on
MC68HC08GP32 flash extraction. Service-side, the firmware extraction service page describes the streaming
extraction flow, and microcontroller unlock service covers the cases where the chip only needs to
be opened for a legitimate owner.