Low supply, many analog inputs, no room for a bigger package: R5F35L23DFE is what that combination looks like in silicon. It is the 80-pin body of the M16C/5LD group, ninety-six kilobytes of program flash, eight kilobytes of RAM, twenty-seven channels on the ten-bit converter, and a minimum supply of 2.7 V rather than the 3.0 V floor of the J and K grades.
Why The 2.7 V Floor Matters To A Rebuild
A board designed around this part can run from a rail that a J-grade device would not tolerate. That has two consequences for anyone rebuilding the product. First, the low-voltage detect configuration in OFS1 is probably set lower than on a 3.0 V design, and copying OFS1 from a different board is a reliable way to produce a unit that resets under load. Second, the clock source is often the on-chip oscillator rather than an external crystal, which shifts every timing constant in the firmware.
Both facts live in flash, not in the schematic. They are part of what an extraction has to return.
The Four Windows
Program ROM 1 runs from E8000h to FFFFFh. Program ROM 2 is the fixed 16 KB block at 10000h to 13FFFh and is present on every device in the family, regardless of package or grade. Data flash sits at 0E000h to 0FFFFh as two 4 KB blocks. The option window occupies the final 37 bytes at FFFDBh.
RAM is 8 KB at 00400h to 023FFh. At this size the firmware rarely uses dynamic allocation, so the RAM image, when one is captured, tends to be a set of fixed buffers with recognisable structure.
Analog Heaviness Changes The Deliverable
Twenty-seven channels means the product was reading sensors, not just one pot. On a live unit we capture the ADC mode registers, the scan order if a sequencer is in use, and the trigger source. That table is usually more useful to a rebuild team than the hex itself, because it says which pins were inputs and in what order the firmware sampled them – information that takes days to infer from disassembly and minutes to read from registers.
Protection, Stated Plainly
ROM code protect closes the vendor programming port to reads. The ID code check closes the boot-mode serial path and the debugger. On this family neither of them erases the array, and neither of them prevents a read that does not go through those ports. The unit goes back with its contents and option bytes unchanged, and the report carries checksums from intake and handover so the claim is verifiable rather than asserted.
Sequence
Data flash block A, block B, ROM 2, ROM 1 ascending from E8000h, then the option window. Each pass is duplicated. A disagreement triggers a third pass; a region that will not settle is reported as unstable rather than smoothed over.
What The Rail Voltage Tells You
Ask for the supply rail before anything else. A 5LD board runs from 2.7 V minimum, a 5L board from 3.0 V, and the two look identical on a bench with a 5 V supply. The distinction only matters when the product is at the bottom of its tolerance, which is exactly the condition the customer is usually trying to reproduce.
Files
Merged HEX at true addresses, five region binaries, a checksum sheet, and a configuration page. On request the pack includes a gang-programmer job so a contract manufacturer can build replacements without translating the HEX by hand.
Send the board with the rail voltage written down, because that is what separates a 5LD device from a 5L one. Quotes: services page. Technical questions: contact form. The 128 KB version of this package is R5F35L26DFE, and the 64-pin 5LD part is R5F35L33DFF.