Renesas built the RL78/G13 entry level around one idea: keep the smallest package
and the smallest memory fast enough to hold its own against 32-bit parts. The
R5F1006A is the bottom rung of that ladder, a 20-pin device with 16 KB of code
flash, 2 KB of RAM and a separate 4 KB data flash array, running a 16-bit core at
32 MHz from an internal oscillator. In the lab this part shows up in two
plastics, a 20-pin LSSOP with 0.65 mm pins and a 20-pin TSSOP at 4.4 by 6.5 mm,
and both carry the same die with 13 CMOS I/O plus three input-only pins and six
8/10-bit converter channels. Because the protection model is entirely different
from the 8051 and PIC parts that usually sit next to it on a board, most of the
work on this device starts with reading the option bytes before anything else is
attempted.

The option bytes decide what the debugger sees

At 000C0H to 000C3H the chip stores four bytes it reads on every reset release.
The first three configure the watchdog, the voltage detector and the 32 MHz
high-speed oscillator. The fourth, 000C3H, is the one that matters to any
extraction attempt: it decides whether the single-wire debug interface is
enabled at all, and it carries a second bit that orders the flash to be wiped
when the security ID check fails. A chip whose author enabled that bit does not
just refuse the debugger. It erases itself the first time somebody connects with
the wrong ID. For that reason the first pass on an unknown board is always a
read of block 0 rather than a debugger attach.

Two ID areas, ten bytes each

The part carries two independent ten-byte identifiers. The on-chip debug ID sits
at 000C4H to 000CDH and gates the E1 emulator. The serial programming ID sits at
000CEH to 000D7H and gates the Renesas flash programmer over the TOOL0
single-wire link. Both refuse an all-FF pattern, which means an erased chip
starts its life wide open and a programmed chip is only as closed as the bytes
its author remembered to write. Many production lines write one and forget the
other, which is exactly the gap a careful examination looks for.

Block 0 holds more than vectors

The first kilobyte block contains the reset and interrupt vectors, the option
bytes, both ID areas and the boot flag logic that controls the swap between the
two four-kilobyte boot clusters. Because the block is one erase unit, changing a
single ID byte in the field means erasing everything from address zero upward,
which is why firmware authors rarely touch it after production. For the analyst
the same structure is convenient: the whole protection posture of the chip lives
in one readable block at the very bottom of the array.

Reading the array without tripping the sequencer

The 16 KB array is organised as sixteen one-kilobyte blocks, and reads are
always free. The complication is that the same flash sequencer that serves the
CPU cannot serve a host at the same time during any erase or write, so the
standard approach is to let the chip read itself out: a small loader placed in
RAM streams the array over the UART while the CPU keeps executing from volatile
memory. On this smallest member the RAM budget is only 2 KB, so the loader has
to fit alongside the self-RAM window the flash library reserves, and the
data-flash side of the house has to be copied separately because it is a
physically distinct array with its own blocks.

What the data flash adds

The separate 4 KB data flash array holds calibration constants and wear-levelled
logs in production. It survives chip erase cycles ordered through the code flash
side only when the erase command explicitly excludes it, which is a common
surprise: a full-array wipe that was supposed to leave the calibration alone
frequently does not. Recovering a working image therefore means reading both
arrays and noting which one was logged at which time.

Practical notes for the bench

• The REGC pin needs its 0.47 to 1 microfarad capacitor to ground; without it the internal regulator misbehaves and reads become unreliable.
• TOOL0 on P40 is the single programming wire; the UART pins P11 and P12 double as the debug receive and transmit lines.
• High-speed oscillator settings in 000C2H default to 32 MHz, which is well above the 20 MHz crystal limit, so a mis-set option byte is itself a clue that the image was configured by tooling.
• The six converter channels on this package are ANI0 through ANI2 plus ANI16 through ANI18, a mapping that repeats across the smallest members of the family.

Where this part sits in the family

The 20-pin members top out at 64 KB of code flash, and the 32 KB sibling is
described under R5F1006C code flash extraction, while the full 64 KB version is covered under
R5F1006E firmware decryption. Larger packages with the same die start at the 30-pin member in
R5F100AA flash data. Where the customer needs the physical die opened rather than a
socket read, that work belongs to the IC decapsulation service, and the broader flow is
summarised on the MCU crack service page.