R5F100FE is the 64 KB member of the 44-pin LQFP row, and by any practical
count the most common RL78/G13 part on general-purpose boards: 64 KB of
code flash, 4 KB of RAM, the 4 KB data flash, ten converter channels and
forty I/O in the 10 by 10 mm 0.8 mm-pitch package. It is the capacity and
package combination where the family’s in-field update machinery, its
protection architecture and a serviceable package all meet, and where most
of the family’s recovery techniques were first worked out.

The FEF00H window on the reference package

The 64 KB members map their volatile memory to FEF00H through FFEFFH, and
the flash library reserves its self-RAM window from FEF00H upward. Images
built for updates show the reservation in the linker map, and on this
member the same map can be checked against a live chip through 0.8 mm leads
without any packaging gymnastics. During erase and write the sequencer
halts code fetch, so the loader that streams a readout lives in the window
or beside it.

Sixty-four blocks and the two-cluster pattern

Sixty-four erase blocks make up the array, the bottom four holding the
boot region and the next four its mirror, each copy carrying its
security bytes at 010C0H and 010C4H. The flag byte in the first block
names the live copy, and on boards that have been updated the retired
one still holds the firmware the product shipped with. Both are
captured as a matter of course, and their difference is the update
record.

Ten channels and the complete capture

The converter’s ten inputs carry the sensor front end, with calibration in
the 4 KB data flash and thresholds in code. The wear-levelled log in the
same array dates the unit’s service life. A complete capture on this member
is four artifacts: code flash including both clusters, the data array, the
option block as found, and the boot flag state. Anything less and the
rebuilt board either boots wrong or regulates wrong.

Protection and the passive opening

Block protections including the boot-area guard ship enabled; the debug
gate and its erase-on-failure bit live in 000C3H; the ten-byte debug ID
occupies 000C4H to 000CDH and the ten-byte serial ID occupies 000CEH to
000D7H. Reads are never gated, so the option block is captured passively
before any tool connects. On boards of this class the serial identifier is
usually populated, and the destructive bit’s state decides how careful the
first emulator connection must be.

Access and the bench

The 0.8 mm pitch makes in-circuit fixtures, adapters and lifted-part work
all straightforward, and the part survives a lift and returns to service.
The die remains reachable through the IC decapsulation service route when the image must
be recovered below the package, and the imaging workflow is the firmware extraction service
page. The boot-swap mechanism that dominates this member’s update story is
treated in detail in the companion note R5F100FE boot cluster recovery.

Row context

The 44-pin siblings are in R5F100FA memory readout, R5F100FC locked flash, R5F100FD flash heximal
and R5F100FF embedded memory through R5F100FL firmware decryption. The 64 KB die in other packages
is the 20-pin R5F1006E firmware decryption, the 24-pin R5F1007E flash heximal, the 30-pin
R5F100AE firmware decryption, the 32-pin R5F100BE embedded memory, the 36-ball R5F100CE memory readout and
the 40-pin R5F100EE flash data. The family service index is microcontroller unlock.

Verification discipline on a 64 KB capture

Sixty-four blocks make per-block verification cheap and worthwhile. Each
kilobyte is checksummed as it is captured, the checksums are stored with
the image, and any block that fails is re-read before the session ends
while the fixture is still in place. The same discipline governs the
write-back side of a repair: program, verify per block, and only then
touch the boot flag if the update machinery requires it. On a part
whose first erase block holds the vectors, the security bytes and the
flag together, skipping the verification is how a working capture turns
into a board that never starts.

The capture’s manifest, sixty-four checksums plus the option and flag records, is kept with the image, because a repair authorised months later is verified against it rather than against memory. Session notes also fix which fixture and which adapter were used, so the re-read that any repair triggers reproduces the original conditions.