The R5F100CA opens the 36-pin row of the RL78/G13 family as a 4 by 4 mm
wafer-level package: thirty-six balls, no leads, 16 KB of code flash, 2 KB of
RAM and the 4 KB data flash of the small-memory members, with eight converter
channels and thirty-two I/O. It is the family’s answer to boards that need
the analog and I/O spread of a 36-pin part inside a footprint with no
protrusions at all. The protection architecture is identical to every
sibling; the package decides that all contact happens under the body.

Balls at 0.5 mm on a 4 by 4 body

Every connection is a solder ball on the underside. After reflow, a probe
reaches nothing directly, so the access options are the board’s own test
features, a fixture aligned to the ball grid, or lifting the part and
re-balling it on an adapter. The lift route is routine at this size and
returns the part to service, which matters when the customer needs the
original unit back. Boards that never planned for service give up nothing
else: the die underneath remains reachable through the IC decapsulation service route as
the final step.

Sixteen blocks and the shipped protections

The 16 KB array divides into sixteen one-kilobyte blocks with the boot
cluster in the first four and the swap mirror at 02000H. On the smallest
members most images skip the swap, and the mirrored option bytes at 010C0H
reveal that choice immediately. Block zero still carries the vectors, the
four option bytes with the debug gate and its erase bit, both ten-byte
identifiers and the boot flag, and block protection ships enabled whether or
not the author configured anything. The passive read of that block is the
opening move of every job.

The 2 KB budget and the readout

With 2 KB of volatile memory the flash library stays ROM-resident and
in-circuit rewrite options are narrow. Readout needs no library, but the
budget still shapes the work: an in-circuit loader shares space with the
application, and on sealed consumer boards the cleanest capture is out of
circuit after a lift. Sixteen blocks plus the data flash stream out in one
pass on the adapter, and the option bytes are recorded as found so a
repaired image can be written back with the original protection posture.

Eight channels in a wafer-level body

The converter reaches eight inputs on this package, the full spread of the
30 to 36-pin row, and on appliance boards the added channels carry the
second sensor or the supply divider that the safety logic watches. The
calibration constants for those channels live in the data flash, and the
thresholds live in code; a complete recovery captures both, because a
controller without its calibration runs but does not regulate.

Row context

The 36-pin members with more memory are in R5F100CC code flash extraction through
R5F100CG flash heximal. The 16 KB die in leaded packages is the 20-pin
R5F1006A flash memory, the 24-pin R5F1007A memory readout and the 30-pin R5F100AA flash data; in
the 32-pin QFN it is R5F100BA locked flash. For the serial-side protection details
that this package exposes only through its balls, see R5F1006A serial programming ID,
and the service entry points are the firmware extraction service and microcontroller unlock service pages.

A thirty-six ball grid and its regulator pin

The 36-ball WFLGA puts thirty-two I/O, eight converter inputs and six
external interrupts on a 4 by 4 mm body, and it carries the same internal
1.8 volt regulator as the rest of the line, served by the REGC pin and its
single 0.47 to 1 microfarad capacitor. On a ball package that capacitor
sits on a ball, and a board that skimped on it produces exactly the kind
of intermittent misbehaviour that gets sent for recovery in the first
place. Confirming the regulator pin and its capacitance early is cheap
and eliminates a whole class of false leads before any flash-side work
starts.

Identification from circuit context follows the family pattern: the
regulator capacitor on its dedicated ball, the single-wire pad, the
1.6 to 5.5 volt rail. What the 36-ball grid adds is density enough
that a board rarely exposes all of it, so planning the session around
the two or three balls that actually matter is normal practice here.