The 30-pin row of the RL78/G13 family opens with the R5F100AA: 16 KB of code
flash, 2 KB of RAM, 4 KB of data flash, eight converter channels and
twenty-six I/O in a leaded LSSOP on a 7.62 mm body with 0.65 mm pins. It is
the smallest member that still offers real leads at a comfortable pitch, which
makes it the preferred service target for boards that grew out of the 20-pin
row, and it introduces the package features the larger members share: a
subsystem clock option, more open-drain outputs with six-volt withstand, and
enough pins to route the programming interface to a proper pad.

Leads change the first hour of the job

With 0.65 mm pins on all four sides, an in-circuit fixture is practical on
this package in a way it is not on the QFN and wafer-level members. The
single-wire TOOL0 pad on P40 is often routed to a test point on production
boards precisely because the factory needs it, and on such boards the first
connection takes minutes rather than hours. The protection model does not
soften with accessibility: block protection ships enabled, the debug gate and
its erase-on-failure bit live in 000C3H, and both ten-byte identifiers sit in
block 0 alongside the vectors.

Sixteen blocks, four boot-critical

The 16 KB array divides into sixteen blocks, the first four forming the boot
cluster with its mirror at 02000H. On a part this small, enabling the swap
feature costs a quarter of the array, so many 16 KB images skip it, and the
boot flag stays in its shipped state. Recognising which choice the firmware
author made is immediate from block 0: the mirrored option bytes at 010C0H
are either present or all erased, and that single observation tells whether
the second cluster holds a real previous image or empty space.

The subsystem clock returns

From thirty pins upward the family offers the 32.768 kHz subsystem clock that
the 20 to 25-pin row lacks. The real-time counter can run from a crystal
instead of the 15 kHz internal source, and appliance firmware that logs events
with wall-clock intent relies on it. In the lab the difference is visible in
the standby current signature: the crystal-started counter draws its own
small, stable component. For evidence purposes it means timestamps from this
row can be taken seriously in a way that small-package timestamps cannot.

Reading the arrays

The 2 KB RAM means no library in volatile memory, so the readout loader shares
the budget with the application when the work happens in circuit, or the part
comes off the board onto an adapter for a clean pass. Either way the capture
is three items: the sixteen code blocks, the separate 4 KB data flash with its
calibration tables and wear counters, and the option-byte block as it was
found. The third item decides how the recovered image behaves when it is
written back, which is why it is recorded before anything else is modified.

The converter spread

Eight channels of the 8/10-bit converter reach the pins on this package,
extending the six-channel range of the smaller members with two more analog
inputs. On appliance boards the added channels typically carry the second
temperature sensor or a supply divider that the safety logic watches. The
samples and the thresholds that act on them both live in the firmware, and
recovering the thresholds along with the code is what makes a cloned
controller behave like the original rather than merely run.

Row context

The larger 30-pin members are catalogued in R5F100AC flash memory, R5F100AD code flash extraction,
R5F100AE firmware decryption and the 96 KB R5F100AF memory readout. The 20-pin equivalents with the
same memory are under R5F1006A flash memory and R5F1006C code flash extraction, and the 32-pin
versions begin at R5F100BA locked flash. The serial-programming side of the family’s
protection, which this package exposes readily, is treated in
R5F1006A serial programming ID, and the general service entry points are the microcontroller unlock service
and firmware extraction service pages.

The sub-clock returns at thirty pins

Unlike the 20 to 25-pin row, this package brings the 32.768 kHz crystal
back. The real-time counter can run from a true sub-clock again instead of
the 15 kHz internal source, and timestamps written by firmware on this
member are wall-clock facts rather than drift-prone estimates. That
distinction matters twice in recovery practice. It changes how much weight
a log timestamp carries as evidence, and it changes identification: a
sleeping part whose current signature shows the sharp sub-clock startup is
a 30-pin or larger member even before the marking is read.