The 40-pin row of the RL78/G13 family opens with the R5F100EA: 16 KB of code
flash, 2 KB of RAM, 4 KB of data flash, nine converter channels and
thirty-six I/O in a 6 by 6 mm HWQFN with a 0.5 mm pitch. It is a large
package carrying the smallest memory configuration, which makes it the
choice for boards with many I/O and a compact control law, and the first
member with the nine-channel converter that distinguishes the 40-pin row
from everything below it.

A big package with a small image

Sixteen kilobytes divides into sixteen blocks, four of them the boot cluster
with the swap mirror at 02000H. At this capacity most images skip the swap
feature, and the mirrored option bytes at 010C0H show it immediately: present
when the feature is enabled, erased when not. The leadless QFN keeps the
access discipline of its smaller siblings, but the 6 by 6 mm body and 0.5 mm
wings leave a little more room for a fixture than the 5 by 5 mm row does.

Nine channels, one more than the row below

The converter reaches nine inputs on this package, the extra channel being
the row’s signature. On appliance boards the additional analog input usually
carries a second temperature point or a reference divider that the control
law watches, and the calibration constants for all nine live in the 4 KB
data flash. Recovering the constants with the code is what lets a cloned
controller track the original across its whole range.

The 2 KB budget and ROM-resident library

With 2 KB of volatile memory the flash library cannot run from RAM, so
field updates on this member use the ROM-resident mode with the application
halted during erase and write. For readout the mode is irrelevant, but the
budget still shapes the capture: an in-circuit loader has to be tiny, and on
sealed boards the clean path is out of circuit after a lift onto an
adapter. Sixteen blocks plus the data flash stream out in one pass and
verify per block.

Protection posture as shipped

From the factory the boot-area guard is on, the fourth option byte holds
the debug gate and its erase-on-failure bit, and the two ten-byte
identifiers wait beside the vectors in the first block. A passive read
of that block, before anything connects, shows whether the chip is open,
half-closed or fully armed, and it is the move every job here begins
with.

The I/O spread

Thirty-six I/O with nine of them open-drain at a six-volt withstand give
this package its reach into mains-side circuitry, and three more are
input-only. The pins most often damaged on returned boards are the
open-drain ones, and a board that arrives with a dead controller is
frequently a board whose controller died protecting those pins. The
distinction between a killed controller and a killed pin pair is the first
diagnosis on such units, and the chip reverse engineering service flow covers it.

Row context

The rest of the 40-pin row steps up through R5F100EC embedded memory to
R5F100EH firmware decryption. The same 16 KB die appears in leaded form as the 20-pin
R5F1006A flash memory, the 24-pin R5F1007A memory readout and the 30-pin
R5F100AA flash data, and in the QFN and ball rows as the 32-pin
R5F100BA locked flash and the 36-ball R5F100CA flash memory. The 48-pin equivalent is
R5F100GA memory readout, and the general service entry is the microcontroller unlock service page.

Nine channels in a six millimetre square

The 40-pin HWQFN gives the converter nine inputs and the core thirty-six
I/O with seven external interrupt lines, all on a 6 by 6 mm body with an
exposed pad that usually bonds to ground. Nine inputs are enough for a
full sensing front end on a motor-drive or charger board: current,
voltage, temperature and one or two spare points of monitoring. The
calibration constants those channels accumulate live in the data array,
and reading them alongside the code is the difference between a capture
that documents the board and one that can reproduce it. The exposed pad is worth respecting from the
start: it grounds the part, sinks the heat of any rework and is the
last thing to release during a lift.