The 24-pin row of the RL78/G13 family begins with the R5F1007A, a 16 KB code
flash part in a 4 by 4 mm HWQFN with 0.5 mm lead pitch. It carries the same
2 KB RAM and 4 KB data flash as the 20-pin entry parts, six converter
channels, twenty I/O and one extra open-drain pair that tolerates six volts.
The package is the story here: no through-hole escape, no large pins to land a
clip on, and a die pad underneath that is usually soldered to a copper flood.
Anything that touches this chip electrically has to be planned around that
construction.

A QFN changes the access geometry

On a 20-pin TSSOP the pins are exposed leads that a fixture can reach. On this
24-pin QFN the leads are 0.5 mm wings on four sides and the centre pad bonds
directly to the board. In-circuit work therefore happens either on the wings,
where 0.5 mm pitch leaves just enough room for a fine probe, or through vias
the layout engineer placed for exactly that purpose. Boards designed for
testability route TOOL0 and the UART pins to pads; boards designed for
protection do not, and then the work shifts from electrical to physical, which
is where the chip reverse engineering service discussion of package-level access usually starts.

Same protection architecture, no shortcuts

Nothing about the small package relaxes the security model. The option bytes
still live at 000C0H to 000C3H, the debug ID at 000C4H to 000CDH, the serial
programming ID at 000CEH to 000D7H, all inside the first one-kilobyte block
along with the vectors. Block protection ships enabled. The 000C3H byte still
carries the bit that orders a full erase when the debug ID check fails, and on
a part where one wrong connection can cost the entire image, that byte is read
before any active step is taken.

Sixteen blocks, four of them special

Sixteen kilobytes divides into sixteen blocks, and the first four form the boot
cluster that the swap mechanism can exchange with the second cluster at
02000H. On a 16 KB part that means a quarter of the array is boot-critical, and
firmware authors who enable the swap feature have to maintain duplicate option
bytes and identifiers in both clusters at 010C0H and 010C4H. A dump of such a
part contains two copies of the protection configuration, and disagreements
between the copies are themselves informative: they usually mark the point
where an in-field updater ran out of power.

The absence of a sub-clock

Like the whole 20 to 25-pin row, this member has no 32.768 kHz subsystem
oscillator. The real-time counter runs from the 15 kHz internal low-speed
oscillator. For the bench this is a useful identification sign, because the
current waveform of a sleeping part without the sharp sub-clock startup is
distinctive. It also matters to anyone rebuilding a working clone: a board
layout that wires a crystal to a pin that does not accept a sub-clock on this
package is a sign that the layout was copied from a larger sibling, and the
firmware was ported without adjusting for the missing crystal.

What the six channels observe

The converter on this package covers ANI0 through ANI2 and ANI16 through ANI18,
six inputs sampled by one 8/10-bit successive-approximation block. On appliance
boards these pins typically carry temperature and voltage dividers, and the
values they feed firmware end up in the data flash as calibration constants.
Recovering those constants along with the code is what turns a raw image dump
into a usable clone, which is the difference between the IC clone service flow and a
plain readout.

The clock and timer frame of the 24-pin row

Around the flash sits a timing system worth knowing before any capture. The
timer array offers eight 16-bit channels with four output channels and three
pulse-width outputs on this row, a 12-bit interval timer, a real-time counter
and a watchdog, all clocked from a choice between a 1 to 20 MHz crystal in
high-speed mode and the internal oscillator up to 32 MHz. The voltage detector
guards the supply with selectable reset thresholds, and the power-on reset
holds the part down until the rail is valid. On the bench this frame matters
because the standby current signature, roughly 230 nanoamps in stop mode, is
the fastest way to confirm the chip is alive and unmodified before anything
is connected to it.

Neighbours in the row

The 24-pin members with more memory are catalogued in R5F1007D locked flash and
R5F1007E flash heximal, and the 25-pin wafer-level member with the same memory range
begins at R5F1008A program memory. The 20-pin equivalents are described in
R5F1006A flash memory and R5F1006C code flash extraction. For the same architecture in a bigger,
easier-to-fix package, the 30-pin row starts under R5F100AA flash data, and the
category overview at microcontroller unlock lists the service pages that apply across the
whole RL78 line.