R5F100GL closes the RL78/G13 line at the top: 512 KB of code flash, 32 KB of
RAM, the 8 KB data array, ten converter inputs and forty-four I/O in the
7 by 7 mm LFQFP on a 0.5 mm pitch, with an HWQFN option on the same pin
count. Half a megabyte is eight full segments of the core’s one-megabyte
space, five hundred twelve erase blocks, and the largest capture the family
asks a bench to produce. Everything the smaller members do, this one does
with the margins removed.

Five hundred twelve blocks and a banked image

The erase grid runs to five hundred twelve blocks of one kilobyte, the
lowest four forming the boot region with its mirror from 02000H. The
application spans eight 64 KB windows reached through the segment register,
with vectors and the security configuration pinned at the bottom.
Verification is strictly per block: a capture that streams the full array
in one pass still checks every kilobyte separately, so a tired fixture
contact costs one block, not the image. Reassembly is bank-aware end to
end, because a flattened half-megabyte binary is exactly as useless as a
flattened 128 KB one, only harder to diagnose.

Thirty-two kilobytes of working memory

The volatile memory hosts the flash library, the manufacturer’s update
protocol, a communication stack and the application’s working set at the
same time, and the reserved workspace at the top of RAM appears in every
image built for this part. Both boot copies are populated in practice, the
flag byte in the first block names the live one, and the inactive copy is
half a megabyte of history: the firmware generation the product shipped
with, every patched routine it contained, and the diff that explains what
field maintenance considered worth changing.

The 8 KB data array at full scale

The separate store keeps fault histories, calibration revisions and usage
counters under wear levelling, with its own blocks, flags and command set.
On long-lived industrial units this log can span years of operation, and
pairing it with the two firmware generations is what lets a rebuilt
controller inherit not just the code but the behaviour of the specific unit
it replaces. The array is captured in the same session as the code, always,
and its protection flags are recorded with the security state.

Security on the largest member

The posture is the family’s, at maximum consequence: four option bytes at
the bottom of block zero, the fourth gating debug and carrying the
wipe-on-failure choice, and two ten-byte secrets, one for the emulator, one
for the TOOL0 programmer. On boards of this class the serial secret is
almost always written and the emulator path is often left open, a
combination that defines the route in before any invasive step. The first
kilobyte is read passively first, in every case, because everything
downstream depends on what it says.

The bench

The LFQFP works with a 0.5 mm fixture; the HWQFN option trades leads for a
thermal pad and moves jobs toward lift-and-reball. A full capture is a
matter of minutes on the wire and the per-block checksums do the
verification work. Where every electrical route is closed, the part lifts,
re-balls and presents its serial wire; a die that resists even that goes to
the IC decapsulation service route. Streaming practice is on the firmware extraction service page.

Context

The row below runs from R5F100GA memory readout upward, and the member one step down
is R5F100GK code flash extraction. The same 512 KB die in the 44-pin LQFP is
R5F100FL firmware decryption. The family index of services is microcontroller unlock, and the update
mechanism that dominates capture planning here is detailed in
R5F100FE boot cluster recovery.

What the margins hide

The capacities below this one share the architecture but not the
consequences: at half a megabyte a single erased block is a
proportionally smaller loss, and the temptation to skip verification is
proportionally larger. The discipline that keeps the largest member
honest is the same manifest used lower in the family, applied without
exception. The 8 KB data store, both boot copies and the passive first
kilobyte complete the inventory, and the session that produces all of
them is still measured in minutes because the wire, not the analyst,
does the streaming.