R5F100CE closes the small-memory half of the 36-ball row at 64 KB of code
flash with 4 KB of RAM, the 4 KB data flash and eight converter channels in
the 4 by 4 mm wafer-level package. It is the largest program store in the
row, the capacity where the self-programming library runs from RAM and the
boot swap machinery is used without a second thought, and the last member
before the data flash doubles to 8 KB at 96 KB.

Four KB of RAM and the FEF00H window

The 64 KB members map their volatile memory to FEF00H through FFEFFH, and
the flash library’s self-RAM window starts at FEF00H on these parts. Images
built with the standard tooling reserve it in the linker map, and the
reservation is the clearest sign that the firmware updates itself in the
field. For readout work the window is where the loader belongs, because the
sequencer stops code fetch from the array during erase and write and
anything that must keep running has to be in volatile memory.

Sixty-four blocks with the swap in service

The array divides into sixty-four one-kilobyte blocks, four forming the boot
cluster and four at 02000H the swap target, with both clusters carrying
option bytes and identifiers at 010C0H and 010C4H. On updated boards the
inactive cluster holds the previous firmware generation, and the boot flag
in block 0 selects the live one. The differences between clusters are the
update history in machine-readable form, and capturing them both is the
standard rather than the exception on this member.

Eight channels and the appliance loop

The converter’s eight inputs serve the control loop, with the higher-numbered
analog inputs typically carrying the mains-synchronous sensing the appliance
safety logic watches. Thresholds live in code, calibration in the data
flash, and logs accumulate with wear levelling in the same array. A recovery
that captures code without data produces a controller that runs but does not
regulate, so the data array is captured on every job here.

Protection under the balls

Block protection ships enabled, the debug gate in 000C3H carries its
erase-on-failure bit, and the two ten-byte identifiers at 000C4H and 000CEH
gate the emulator and the programmer independently. The passive read of
block 0 establishes both identifier states and the option-byte
configuration before anything connects, and on this member it also reveals
whether the swap feature is in use, which determines whether the capture
plan needs one cluster or two.

Access routes

The 0.5 mm ball grid accepts a sprung-pin fixture when the layout allows
clearance, and the lift-and-reball route onto an adapter is routine when it
does not. Either way the capture itself is quick: sixty-four blocks plus the
data flash stream out in seconds and verify per block, so a marginal contact
is a localised checksum failure rather than a corrupt whole. When the
package itself is the obstacle, the IC decapsulation service route reaches the die, and
the examination flow is on the chip reverse engineering service page.

Row context

The 36-pin siblings are in R5F100CA flash memory through R5F100CD firmware decryption and
R5F100CF locked flash and R5F100CG flash heximal. The 64 KB die in leaded packages is the
20-pin R5F1006E firmware decryption, the 24-pin R5F1007E flash heximal and the 30-pin
R5F100AE firmware decryption. For the data-flash doubling that begins at the next capacity,
see the 36-pin 96 KB member R5F100CF locked flash, and the family service overview
is the microcontroller unlock page.

Inside the boot ROM’s serial mode

The masked section at the bottom of the memory map speaks a documented
protocol over the single-wire interface: a handshake that self-tunes to
the host’s baud rate, an authentication step against the ten-byte serial
secret, and a command set covering erase, program, verify and readback.
The self-tuning matters on old boards, because a marginal oscillator or a
drifted internal clock still negotiates successfully. When the serial
secret is blank the same protocol reads the whole array, which is why a
blank identifier on a 64 KB member is not merely convenient but decisive:
the entire capture happens through pins the board already exposes.
Session notes record the negotiated rate and the retry counts,
because a serial link that needed retries on authentication usually
indicates a marginal clock, worth knowing before the same symptom is
blamed on the image.