R5F1007E closes the 24-pin row at 64 KB of code flash with 4 KB of RAM and the
4 KB data flash of the small-memory members, all inside a 4 by 4 mm HWQFN on a
0.5 mm pitch. It is the natural landing point for designs that started on a
16 KB 24-pin part and outgrew it without being able to change the layout, and
it shares the whole protection and boot architecture of the family while
adding nothing exotic of its own. What makes it interesting in practice is the
combination of a full 64 KB image with a package that offers twenty I/O and no
escape hatch for a probe that was not planned for.

Sixty-four blocks, four guarded

The code array splits into sixty-four one-kilobyte blocks. The first four are
the boot cluster, mirrored by a second cluster at 02000H for designs that use
the swap feature, and both clusters carry their own copy of the option bytes
and the two ten-byte identifiers at 010C0H and 010C4H. On a part this size the
swap feature is common because the image is big enough that field updates are
routine, which means a recovered dump frequently shows two generations of
firmware side by side: the running one in the active cluster and the previous
one in the other.

Reading both generations is not optional

A dump that only captures the active cluster loses the previous image, and the
previous image often contains the versions of routines that were patched in the
field. Reconstructing the update history of the board needs both clusters plus
the boot flag state, which lives in block 0 and flips with each swap. The
state of that flag, together with the wear counters in the 4 KB data flash,
usually reconstructs exactly how many updates the unit received and when.

Four KB of RAM and the self-RAM window

With 4 KB of volatile memory the part runs the flash library from RAM, and the
library reserves a window documented to start at FEF00H on the 64 KB members.
Images built with the standard tooling show the reservation clearly. The same
window is where a readout loader belongs: the sequencer halts code fetch from
the array during erase and write, so anything that must keep running while the
flash is busy has to be in volatile memory, and on this part there is just
enough room to do it properly.

The electrical frame

The supply window runs from 1.6 to 5.5 volts, and the clock system degrades
gracefully across it: the crystal path accepts 1 to 20 MHz only above 2.7
volts, drops to 16 MHz at 2.4 volts, and the low-voltage modes clock down to 4
MHz so a browning-out board keeps executing rather than latching up. The
voltage detector provides selectable reset thresholds and the power-on reset
holds everything until the rail settles, which together give the option byte
at 000C1H its meaning. On the bench, a chip that resets in a loop at nominal
supply is usually telling the truth about its supply rather than lying about
its flash, and that distinction saves hours.

No sub-clock, and why that matters twice

The 24-pin members share with the 20 and 25-pin row the absence of a 32.768 kHz
subsystem oscillator. The real-time counter runs from the internal 15 kHz
source and drifts. The first consequence is evidential: timestamps in the data
flash of such a part are approximate and must not be treated as wall-clock
facts. The second is practical: a clone of a board like this works or fails on
timing behaviour that the crystal-less design makes forgiving, which is one
reason these parts are popular in sealed appliance controllers where nobody
ever wants to open the enclosure again.

The converter and the pins it watches

Six channels, ANI0 to ANI2 plus ANI16 to ANI18, feed one 8/10-bit converter.
On 24-pin appliance boards the sixteen to eighteen range typically carries the
mains-synchronous sensing that the appliance safety standard requires, and
those samples end up in data flash logs. The pins are also part of the twenty
I/O, three of which are input-only, and two of the outputs are open-drain with
a six-volt withstand that interfaces directly to mains-side circuitry.

Where to go next

The smaller 24-pin members are in R5F1007A memory readout and R5F1007D locked flash, the
25-pin wafer-level row starts at R5F1008A program memory, and the 30-pin leaded
package with the same memory is R5F100AE firmware decryption. For the equivalent capacity in
the smallest 20-pin outline, see R5F1006E firmware decryption. Where the image needs to be
re-derived from silicon rather than read out, the IC decapsulation service page describes
the physical route, and IC clone service covers the full reproduction path
including data-flash reconstruction.