The R5F100AD fills the gap between the 32 and 64 KB members of the 30-pin row:
48 KB of code flash with the 3 KB RAM that is the signature of the 48 KB
class, the 4 KB data flash and eight converter channels, in the leaded LSSOP
with 0.65 mm pins. The intermediate capacity is common in motor-control and
pump-management boards, and the 3 KB RAM makes this one of the members where
the flash library’s residency question has a specific, checkable answer.

FF300H and what it implies

On the 48 KB members the 3 KB of volatile memory maps to FF300H through
FFEFFH, and the flash self-programming library reserves a self-RAM window
starting at FF300H on exactly these devices. A recovered linker map that shows
application segments below FF300H and the library at the top is evidence that
the image supports field updates. It also fixes the readout strategy: a
streaming loader placed below the window coexists with the running
application, while the window itself stays reserved for any repair that ends
in rewriting a block.

Forty-eight blocks and the swap question

The array has forty-eight one-kilobyte blocks, with the boot cluster in blocks
zero to three and the swap target at 02000H to 03FFFH. At 48 KB the swap
feature costs eight percent of the array rather than a quarter, so it is much
more common here than on the 16 KB members. Both clusters carry option bytes
and identifiers at 010C0H and 010C4H, and the boot flag in block 0 selects the
live set. A dump that captures only the active cluster misses the previous
image, which on updated boards is the version the product actually shipped
with.

Shipped protection and the four-byte word

Block erasure and programming protection are enabled at shipment on every
member, and this one is no exception, with the boot-area reprogramming
protection alongside. The debug gate in 000C3H and its erase-on-failure bit,
plus the two ten-byte identifiers in block 0, complete the posture. Code flash
programs in four-byte words, so a repair that patches constants has to
assemble whole words, and an interrupted write leaves the mixed-word signature
that marks exactly where an update stopped.

The leaded advantage

The 0.65 mm pins of the LSSOP make this member accessible in circuit on most
boards: the TOOL0 single wire, the UART pair and the supply pins all reach
testable geometry. That accessibility does not weaken the protection, it only
shortens the path to a legitimate readout when the identifiers allow one. When
they do not, the same leads make the lifted-part and adapter route
straightforward, and the die itself remains available through the
IC decapsulation service route as the last resort.

Calibration and the data array

The 4 KB data flash carries the calibration tables that motor-control images
depend on, and its wear-levelled history reconstructs how the unit was used.
Reading it uses the data-flash command set rather than the code-flash one, and
the arrays are protected by separate flags, so a capture plan that treats them
as one item will lose half the evidence. On pump and fan controllers the
data-flash content frequently explains a fault that the code alone cannot.

Row context

The 30-pin siblings are in R5F100AA flash data, R5F100AC flash memory, R5F100AE firmware decryption and
R5F100AF memory readout; the same die in the 25-ball package is R5F1008D embedded memory and in
the 24-pin QFN R5F1007D locked flash. The 64 KB leaded member is R5F100AE firmware decryption.
Cross-architecture notes on how a previous generation handled the same
48 KB class, with a completely different block scheme, are in
LPC2101FBD48 processor memory, and service-level handling is summarised on the firmware extraction service page.

A three kilobyte budget on a leaded body

The 48 KB class maps its 3 KB of volatile memory from FF300H, and the flash
library reserves the top of that range for self-programming. Images built
for field updates show the reservation; hobby-built images usually do not,
and the difference is one of the quickest credibility checks a recovered
linker map supports. For a readout, the space below the reservation holds
a compact streaming walker with room to spare, and the leaded package
means the UART lines it streams through are on exposed leads rather than
buried balls, which shortens the session measurably.