A board built around the R5F35L30JFF carries the smallest member of the M16C/5L line: 64 KB of program ROM 1, 4 KB of RAM, and an 8 KB data flash in a 64-lead LQFP. It runs a 16-bit M16C/60 core at 32 MHz from 3.0 to 5.5 V, and it is long out of promotion, so the die is usually the only surviving copy of the application. The R5F35L33JFF readout shows what shifts when the array grows by 32 KB.
Where The Vector Table Lives
What makes the 64 KB part unusual is that its reset vector and the whole fixed vector table sit inside the user array rather than in a separate boot region. ROM 1 begins at F0000h and runs to FFFFFh, so the top of the map is the code itself. A general readout protection overview helps frame why that matters, and the R8C/2x note shows the same top-down arrangement on a smaller Renesas cousin. Any capture that stops short of the last 37 bytes loses the option settings the firmware was compiled against.
Three Flash Regions, One Map
Field units often arrive with no schematic and no archive, which is why the peripheral budget has to be reconstructed from the package. With 64 leads this chip exposes 16 channels of 10-bit A/D, four UART or clock-synchronous serial channels and one CAN module with a 32-slot message buffer. A twelve-bit PIC note is a useful contrast: on that family the protection bits are separate from the code array, whereas here the ID word lives at the very top of the same flash that holds the vectors.
How The Lock Actually Behaves
Two registers decide whether a programmer gets anywhere with this die. An ID comparison looks at the bytes at FFFDBh and rejects a mismatch before any bulk transfer begins; a separate protect setting in the flash controller then refuses readout over the built-in rewrite path. Both are ordinary configurable values. Engaging either one leaves the 64 KB untouched, and a rejected attempt changes no bit in the array.
F0000h is the lowest address of the user array on this model; everything from there to FFFFFh is application code, including the reset vector. A separate 16 KB boot and monitor block lives at 10000h through 13FFFh. Two 4 KB data sectors sit at 0E000h to 0FFFFh. Volatile memory is 4 KB from 00400h to 013FFh. The special page vectors and the option bytes occupy the last few dozen bytes above FFE00h.
Read Order And Deliverables
Our sequence begins at F0000h and climbs, then drops to the monitor block, then reads the two data sectors, then collects the option bytes. A complete second pass follows, and each region gets its own checksum. Program and erase require 3.0 to 5.5 V; the two code arrays are rated for a thousand cycles and the data sectors for ten thousand. A disagreement triggers a fresh read, never a corrected byte.
| Region | Address range | Size | Notes |
|---|---|---|---|
| Program ROM 1 | F0000h to FFFFFh | 64 KB | Reset and fixed vectors at the top |
| Program ROM 2 | 10000h to 13FFFh | 16 KB | Boot and monitor area, PRG2C can hide it |
| Data flash A | 0E000h to 0EFFFh | 4 KB | EEPROM emulation, 10,000 cycles |
| Data flash B | 0F000h to 0FFFFh | 4 KB | Second block, erase state reported |
| RAM | 00400h to 013FFh | 4 KB | Sits below the SFR window |
| ID and options | FFFDBh to FFFFFh | 37 B | ID code, OFS1, OFS2 |
One Intel HEX file merges the code window, the monitor block and both data sectors at their actual addresses. Raw binaries for each region come with it. A written sheet records the 37-byte option record, whether each data sector was erased, and a checksum per region. Source labels do not survive a die readout, so what is returned corresponds to compiler output rather than to a debugger session.
What Leaves The Bench
The 64-lead body is PLQP0064KB-A, formerly 64P6Q-A, with 0.5 mm pitch and a 10 by 10 mm footprint that most bench sockets already accept.
Power the board down, wrap it in ESD foam and ship it as it is; a bare die is fine if the lid is already off. Once the ID comparison refuses a session, our services desk takes over the package work and delivers a checked image. Tell us whether CAN is in use, because its acceptance filters live in registers that a plain hex file cannot describe.