The RX24T group is a motor-control family: RXv2 core at 80 MHz, single-precision FPU, 153.6 DMIPS, and a peripheral set built around inverter control – MTU3 with nine channels, a general PWM timer with four, three serial channels, one CAN port. R5F524TEADFP is the largest member, with 512 KB of ROM, 32 KB of RAM and 8 KB of E2 data flash in a 100-pin LFQFP.
What Makes RX Different From The 16-Bit Parts
Two things change the way a read is planned. The first is the ROM window: code is read from FFF80000h upward for a 512 KB device, not from a low address, because the RX memory map puts the on-chip flash at the top of a 4 GB linear space. The second is the block size: the array is divided into 2 KB blocks, and the block erase command works on exactly one of them. Protection is expressed against those blocks, not against the whole array.
Protection, Precisely
The RX24T manual lists four mechanisms, and they are worth separating because customers often describe all of them as “locked”.
– ID code protection: a 16-byte structure at FFFFFFA0h with a control code plus fifteen ID bytes. It gates boot-mode connection over SCI and connection from the on-chip debugging emulator. It does not gate a read of the array. – ROM code protection: a 32-bit value stored in block 0. 00000000h disables both reading and rewriting of the user and data areas through a parallel programmer; 00000001h disables reading only. Erasing block 0 unlocks it. – Start-up program protection: blocks 0 to 7 form the default area, blocks 8 to 15 the alternate. It exists so a bootloader can rewrite the start-up program without erasing it first. – Area protection: self-programming is restricted to selected blocks.
The Consequence For Recovery
None of the four erases the array by itself. The recovery order is therefore: read first, decide about unlocking only if the read fails electrically. On this part that means acquiring the ROM from FFF80000h to FFFFFFFFh, the E2 data flash separately, and the option bytes in the OFS0 and OFS1 window, then checking the block map before delivering anything.
E2 Data Flash Is Not ROM
Eight kilobytes of E2 data flash sits apart from the code array, rated for one million erase and write cycles and capable of background operation while the CPU executes from ROM. On an inverter design it usually holds calibration for the current sense path and a fault log. Dumping it as if it were part of the code array is a common error: the addresses differ and the block size differs.
Handover
The pack contains an Intel HEX over the full ROM window, a separate dump of the E2 area, the option bytes, a block map showing which 2 KB blocks were in use, and a page recording the ID code and the control code byte. On request we also read the unique ID registers, which are 96 bits of factory-programmed silicon identity and are useful when a customer needs to prove that a returned unit is the same die that shipped.
What 512 KB Implies
At half a megabyte the application almost certainly contains a communication stack as well as the control loop. Expect the low blocks to hold code that the control path never calls, and read them anyway.
Before Shipping
Say whether the board drives one motor or two, because dual-inverter designs use the GPT channels differently and the register capture is worth having. Note the supply rail: RX24T runs from 2.7 to 5.5 V, so a 5 V rail is normal and does not indicate a different part.
Quotes and turnaround begin at the services page; technical questions go to the contact form. The 384 KB variant is R5F524TCADFP, and the 256 KB part is R5F524TBADFP.