R5F100AE brings the full 64 KB code flash of the family to the 30-pin leaded
package, with 4 KB of RAM, the 4 KB data flash of the small-memory row, eight
converter channels and twenty-six I/O. It is the capacity point where the
self-programming library runs comfortably from RAM, where the boot swap
feature stops being a luxury, and where the 0.65 mm leads of the LSSOP keep
every protection decision reachable at the bench. Many of the family’s field
behaviours were first observed on this class of board.

Four KB of RAM and a documented window

The 64 KB members map their volatile memory to FEF00H through FFEFFH, and the
flash library’s self-RAM window starts at FEF00H on these parts. Images built
with the standard tooling reserve it explicitly, and the reservation is the
clearest marker in a recovered map that the firmware supports in-place
updates. For readout work the window is also the answer to the sequencer
constraint: during erase or write the array stops serving code fetch, so any
routine that must keep running belongs in volatile memory, and this part has
exactly enough to host one.

Sixty-four blocks, two clusters, one flag

The array divides into sixty-four blocks, the first four being the boot
cluster and the second four at 02000H being the swap target. Both clusters
duplicate the option bytes and both ten-byte identifiers at 010C0H and
010C4H. The boot flag in block 0 selects the live set and flips on every
swap. On updated boards the inactive cluster preserves the previous
generation of the firmware, and capturing it is part of a complete job, not
an extra: the differences between the two clusters are the update history of
the board in machine-readable form.

The identifiers and their failure modes

The ten-byte debug ID at 000C4H to 000CDH gates the emulator, and the
ten-byte serial programming ID at 000CEH to 000D7H gates the programmer over
TOOL0. Both refuse all-FF, and the 000C3H option byte decides whether a
failed debug authentication wipes the array. On a part whose authors enabled
that bit, the first wrong connection destroys the evidence, so the passive
read of block 0 comes first on every job, and the decision of whether to
connect at all is made from those bytes rather than by trial.

The converter and the appliance loop

Eight channels of the 8/10-bit converter serve the control loop, and on
appliance boards the channel assignments follow the pattern the family has
used since the 20-pin row, with the higher-numbered analog inputs carrying
the mains-synchronous sensing. Thresholds live in code, calibration in the 4
KB data flash, and logs accumulate in the same array with wear levelling. A
recovery that captures code without the data array produces a controller
that runs but does not regulate, which is why the data side is never
optional on this member.

Bench notes

• The subsystem clock returns on this row; a 32.768 kHz crystal on X2 is normal and its presence confirms the package class.
• REGC needs its 0.47 to 1 microfarad capacitor; the internal regulator is otherwise unstable under load.
• Nine of the I/O are open-drain with a six-volt withstand, the interfacing pins to mains-side circuitry, and they are also the pins most often damaged on returned boards.

The 30-pin siblings are catalogued in R5F100AA flash data, R5F100AC flash memory,
R5F100AD code flash extraction and R5F100AF memory readout. The 20-pin member with the same memory is
R5F1006E firmware decryption, the 24-pin one is R5F1007E flash heximal, and the 32-pin version is
R5F100BE embedded memory. For the same protection decisions on an older architecture
whose vectors and security lived in entirely separate memory, see
MC68HC08GP32 flash extraction. The IC clone service page describes the full reproduction path
including both arrays.

Clock allowances across the supply range

The crystal path accepts 1 to 20 MHz only above 2.7 volts, stepping down to
16 MHz at 2.4 volts, while the internal oscillator reaches 32 MHz in the
high-voltage window and the low-voltage modes keep executing down to 4 MHz
at 1.6 volts. A board that runs this part from a lithium cell behaves
differently at end of charge than at start, and firmware that ignores the
clock scaling shows up in recovered logs as timing jitter that tracks the
battery curve. For the analyst, correlating those two is routine evidence
work on this member.