R5F35L36KFF is the 125-degree grade of the 128 KB, 64-pin member: the same M16C/60 core at 32 MHz, the same 12 KB of RAM and the same LQFP outline, qualified for a hotter operating range. Renesas sorted the K parts by test rather than by mask, so nothing about the memory map or the lock changes. The R5F35L26KFE note covers the 80-pin device at the identical temperature grade.
Same Die, Hotter Rating
Two 4 KB data flash blocks are the quiet story on this part. They sit at 0E000h to 0FFFFh, are rated for 10,000 cycles against 1,000 for the program arrays, and usually hold calibration or fault logs that no program dump reproduces. The NVRAM retention note explains why those cells drift with heat, and an RX513 firmware case shows how a later Renesas family treats the same E2 data area. A long service life at 125 degrees makes the block erase state worth recording explicitly.
The Two Data Blocks
Heat history rarely kills a flash array outright; it shows up as a handful of marginal bits that read clean once and disagree on a second pass. That is why our routine holds a steady rail and repeats the entire capture rather than trusting a single image. Compare an LPC2468 external-bus case: there the code may live off chip entirely, so the recovery target is a different memory device. Here everything is on die, including the 37-byte option window.
Non-Destructive Settings
Heat does not weaken the lock and the lock does not erase the heat history. On this K-grade 128 KB part the defences remain an ID comparison plus a protect flag inside the flash controller, both of them plain settings. A wrong key merely aborts the session. Because the array is never wiped by a failed attempt, the marginal cells caused by years at temperature can still be examined on a second pass.
E0000h marks the bottom of the 128 KB code region on this K-grade part. Above it, up to FFFFFh, are the vectors and the option fields. A separate 16 KB monitor array at 10000h is common to the whole group. Data flash covers 0E000h to 0FFFFh in two 4 KB halves, and the 12 KB RAM window runs from 00400h to 033FFh. Temperature grading leaves every one of these addresses unchanged.
Map And Option Window
Data sectors are deliberately left until last on this hot-grade part, so their erase state is still visible when the report is written. The E0000h array, the 16 KB monitor region, the two 4 KB halves and the options are read twice at a fixed supply. Program arrays tolerate a thousand cycles, data storage ten thousand. A third pass is added only if the first two disagree.
What leaves the bench is one Intel HEX, a binary per region, and a report covering the option field, the erase state of both data halves, four checksums, the capture supply and whether the two passes agreed. For a K-grade device the report adds any third-pass result. Symbol names are absent, as they are from any physical readout.
What The Report Records
A 32 kHz-class sub-clock and a dedicated 125 kHz oscillator for the watchdog keep the timing domain alive even when the main crystal has been removed from a scrap board.
Nine 16-bit multifunction timers, a 16-bit input-capture channel and four DMAC channels are available, and their registers must be recreated from the recovered image.
The device is marked obsolete by the manufacturer, and the supplier recommends a newer family for fresh designs, so field units are usually the only remaining source of the firmware.
Block A and block B are reported separately even when both read clean, because their erase counts reveal how heavily the logging routine was used.
A board from a hot environment often arrives with brittle conformal coating, and removing it before decapsulation is part of the quoted preparation.
The option window is never erased during our work, so the customer retains the original OFS1 and OFS2 settings for a later board-level comparison.
Ship the assembly off and protected from static, with whatever service-temperature record exists. A refused ID comparison is not a dead end: the contact form opens the die-level route and the verified archive. That record decides whether the occasional marginal byte is ordinary ageing or a reason to slow the final pass down.