Five serial channels are the reason a designer picks the R5F35L23JFE over its 64-pin cousin. The part carries 96 KB of program ROM 1, 8 KB of RAM, 27 channels of 10-bit A/D and 71 I/O ports in an 80-lead LQFP, all driven by a 32 MHz M16C/60 core on 3.0 to 5.5 V. ROM 1 begins at E8000h. The R5F35L2EKFE page shows the 256 KB, high-temperature end of the same 80-pin line.
Why Five Serial Channels
Pin multiplexing is where a faithful rebuild usually fails. With five UART or clocked serial channels competing for a finite set of alternate functions, the pin direction and function registers are as important as the code that sets them. The OTP and flash comparison explains why the separate 8 KB data area must be archived on its own, and an R8C/2x binary note shows a related Renesas 16-bit family with the same top-down ROM 1 arrangement. Neither reference changes the density boundary here.
Registers Matter As Much As Code
The extra leads also mean a wider address and bus interface on some board revisions, so we photograph the PCB and record the oscillator values before the die is removed. Those details do not live in flash. For a contrast in how vendors place their lock state, an STM32F407 readout case keeps readout protection in option bytes separate from the user array; on M16C the ID word sits in the last 37 bytes of ROM 1 and travels with the vectors.
Two Settings, No Fuse
Consider what a locked 23JFE will not do: it will not self-erase on a bad ID, and it will not blank the array after repeated failed connections. Its protection is a comparison against stored option bytes plus a flash-control flag that refuses the programmer. Both remain ordinary settings. The practical consequence is that a non-destructive readout can be attempted as many times as the bench schedule allows.
Ninety-six kilobytes from E8000h to FFFFFh sounds simple until the other regions are counted. A 16 KB monitor block at 10000h, two 4 KB data sectors at 0E000h, and 8 KB of RAM from 00400h all share the same 1 MB space. The five serial channels do not get their own memory; their configuration is code. Special page vectors and the ID bytes round out the top of ROM 1.
The Full 96 KB Map
Where a live 80-pin board is supplied, a short logic-analyser trace of the serial lines is taken before power is removed. Afterwards the E8000h code, the monitor area, both data sectors and the option bytes are read at a steady 3.0 to 5.5 V, then repeated. Code endurance is 1,000 cycles against 10,000 for data. Checksums are computed per region, not over the merged file alone.
Customers get a merged HEX, one binary for each region, and a report that carries the option values, both sector states, four checksums and the confirmed E8000h base. Where a live board was supplied, the serial-line trace and the oscillator values are appended. Compiler symbols are not recoverable, so the hex represents emitted machine code only.
Files And Board Notes
The 80-pin device also provides a 16-bit input-capture and output-compare timer, four DMAC channels and a CRC calculator on the same 32 MHz core.
A watchdog timer with a dedicated 125 kHz on-chip oscillator, a real-time clock and a low-voltage detector are all configured through option settings.
Because the family is no longer promoted for new designs, most requests concern field units for which no compiler project or source archive survives.
A logic analyser trace of the five serial lines, where a live board permits it, often identifies which channel carried the field-update protocol.
The 71 I/O ports are not all available simultaneously with the analogue inputs, and the recovered pin registers show which compromise the designer chose.
We keep the original oscillator values in the report because a rebuilt board fitted with the wrong crystal will fail even with a perfect flash image.
Keep the unit powered down and foam-packed in transit, or send the die if it is already open. A locked ID gate simply moves the job to the contact form, where the bench work is scheduled and the checked image returned. Tell us how many of the five serial channels the firmware actually drives, because that narrows the pin-function registers we rebuild.