R5F100AC doubles the program store of the 30-pin entry part to 32 KB while
keeping the 2 KB RAM, the 4 KB data flash and the eight converter channels of
the small-memory row. In the 30-pin LSSOP on a 7.62 mm body it remains one of
the easiest members of the family to work on at the bench, and it is the
capacity where many appliance and heating-control images actually live: large
enough for a full control loop and logging, small enough that every byte was
budgeted.

Thirty-two blocks with the same four guards

The array splits into thirty-two one-kilobyte blocks. Blocks zero to three are
the boot cluster, mirrored at 02000H when the swap feature is used, and block
zero additionally holds the vectors, the four option bytes, both ten-byte
identifiers and the boot flag. Because the erase unit is the block, the
protection configuration of the whole chip lives in one place, and that place
is also the block every field updater has to handle with the most care. The
four-byte programming word means even a one-byte patch in block 0 is a
block-level event.

A 32 KB budget shapes the image, and the image shapes the readout

Firmware at this size is typically built with the self-programming library
only if updates were planned, and the linker map tells which: the self-RAM
reservation on the 2 KB members is tight, so many 32 KB images keep the
library in ROM-resident mode and accept the restrictions. For the analyst the
map is a free briefing document. It shows where the update routines sit, which
blocks they touch and whether the boot swap logic is present at all, all
before a single byte is read from the live array.

The two identifiers in practice

The ten-byte debug ID at 000C4H and the ten-byte serial programming ID at
000CEH are independent, and production boards disagree with each other often
enough that checking both is standard procedure. A chip with a populated
serial ID and a blank debug area is a different job from the reverse: the
first blocks the programmer but leaves the emulator path open, the second
does the opposite, and the destructive erase bit in 000C3H can apply to
either connection depending on how the author configured it. The safe order
is to read block 0 passively, decide from the bytes what each connection
would do, and only then attach anything.

Eight channels, two of them extra

The converter reaches eight inputs on this package. Two of them are the
additions over the small packages, and on appliance boards they usually carry
the second sensor the control loop watches. The 8/10-bit block feeds
thresholds that live in code and logs that live in the 4 KB data flash, and a
complete recovery includes both, because the thresholds without the
calibration constants that produced them are only half the picture.

Data flash discipline

The separate 4 KB array survives many code-flash update cycles when the
updater is written correctly, and its wear-levelled structure records the
unit’s history whether or not the authors intended it to. Recovering the data
array means reading it with the same loader that streams code, but through the
data-flash command set, because the two arrays answer to different sequencer
controls and different protection flags.

Row context

The 30-pin siblings are in R5F100AA flash data, R5F100AD code flash extraction, R5F100AE firmware decryption and
R5F100AF memory readout; the 32-pin equivalents start at R5F100BA locked flash and the 20-pin
versions at R5F1006A flash memory and R5F1006C code flash extraction. For the protection model of an
entirely different architecture, where one lock bit replaced the pair of
identifiers, see MC9S08QD4 memory read. Board-level reproduction that includes the data
array is the IC clone service flow, and the microcontroller unlock service page covers the
owner-authorised opening cases.

Eight channels and where they land

The converter spreads across ANI0 to ANI7 on this package, one 8/10-bit
successive-approximation block serving all eight. Six external interrupt
lines bring mains-synchronous and zero-cross edges into the timer array,
and twenty-six I/O lines, two of them open-drain with a six-volt
withstand, connect the rest of the board. On appliance controllers the
channel-to-function mapping is stable across a product line, so one
recovered image plus its calibration array usually documents the sensing
plan of an entire family of boards, not merely the one under the probe.