R5F35L26DFE: Dumping 128 KB Of M16C Flash To Hex

Sixty-four pins or eighty, 96 KB or 128 KB, 3.0 V or 2.7 V – the M16C/5L and 5LD families are a grid, and R5F35L26DFE sits at one specific intersection: eighty pins, 128 KB, 2.7 V minimum supply, commercial temperature. Getting the intersection wrong is easy, and the penalty is a merged image that will not run on the target.

Reading The Part Number Properly

R5F35L26DFE decodes as group 5LD, pin digit 2 = 80 pins, capacity digit 6 = 128 KB, property code D, package FE = LQFP80. The J and K codes in the same position mean the 5L group with a 3.0 V floor. Both groups share the same flash geometry and the same 16 KB ROM 2 block, so a hex file is portable between them only if the application never relies on the lower supply behaviour.

The Five Regions To Pull

Region Address Size
Program ROM 1 E0000h to FFFFFh 128 KB
Program ROM 2 10000h to 13FFFh 16 KB
Data flash A 0E000h to 0EFFFh 4 KB
Data flash B 0F000h to 0FFFFh 4 KB
Option window FFFDBh to FFFFFh 37 bytes

Treating the data flash as one eight-kilobyte region is a common shortcut and a mistake. The two blocks are erased independently, and on a product that logs calibration or runtime counters the fill level of each block tells you how the firmware rotated its writes.

Why 128 KB In Eighty Pins

This combination is chosen when a product needs both a large application and a wide analog front end. The 64-pin 128 KB part exists and is cheaper, but it brings out sixteen analog channels instead of twenty-seven. If the board in front of you has more than sixteen sensor inputs populated, the 80-pin device is the only one that fits, and the 5LD group tells you the rail can sag.

The Read

Five duplicated passes, one per region, then a merge at true addresses. Nothing is erased at any point; ROM code protect and the ID code check are configuration items that gate the vendor ports, not damage to the array. A board returned from a read still runs exactly as it did, and the checksums in the report demonstrate it.

Rebuild Notes

If a replacement has to be built, three values decide whether it behaves. OFS1 sets the low-voltage detect threshold. OFS2 selects start-up options that the application assumes. The ID code may be used by the production line as a build marker, in which case it should be reproduced rather than randomised. All three are in the pack, in decimal and hex, with the byte offsets shown.

Why The Option Window Deserves Its Own Pass

Thirty-seven bytes at the top of the map, and they decide how the part behaves before a single instruction executes. Reading them as part of a general sweep works only if the sweep reaches FFFFFh; a dump that stops at the end of the data flash misses them entirely and produces an image that runs on a bench supply and misbehaves on a real one.

Treating the window as its own pass makes that omission impossible, and it keeps the thirty-seven bytes out of any bulk merge where an off-by-one in the length would quietly drop the last of them. It also gives a natural place to record the values in the report, where a rebuild team will look for them, and it makes the merged image easy to compare with the raw window byte for byte before anything is programmed.

Sending The Unit

Include the rail voltage, the crystal or the fact that the on-chip oscillator is used, and the product’s function in one sentence. Pack against foam; do not remove shields or coating.

Start with the services desk or ask through the contact form. The 96 KB version is R5F35L23DFE, and the 256 KB RX-family counterpart on the same bench is R5F524TEADFP.