Three hundred and eighty-four kilobytes is the middle of the RX24T range and, in practice, the variant that turns up in dual-inverter designs where the application has a field-orientated control loop plus a communication stack. R5F524TCADFP pairs that array with 32 KB of RAM and 8 KB of E2 data flash in a 100-pin LFQFP, running at 80 MHz from a 2.7-5.5 V rail.
The Address Depends On The Capacity
RX flash is read at the top of the address space, and the start address moves with capacity: FFF80000h for 512 KB, FFFA0000h for 384 KB, FFFC0000h for 256 KB, FFFE0000h for 128 KB. Reading a 384 KB part with a 256 KB assumption returns the top 256 KB and silently omits the lowest 128 KB of the array – which, in a motor application, is where the parameter tables and the fault handling usually sit.
Block-Level Thinking
The array is organised in 2 KB blocks and erased one block at a time. Protection and area restrictions are expressed in those units, and so is any analysis of what was in use. When we deliver a dump, the block map shows which blocks contained non-blank data and which were fully erased, because that pattern is a fingerprint of the build: a production image fills blocks contiguously, a development image leaves gaps.
Reading Order
E2 data flash first, because it is small and independent and often holds the calibration the customer actually needs. Then the option bytes in the OFS window. Then the ROM from FFFA0000h upward, in 2 KB block order, with each block verified as it is acquired. The pass is duplicated, and a block that disagrees with its duplicate is re-read rather than patched.
What The Protection Actually Blocks
ID code protection gates the boot-mode SCI port and the debugging emulator. ROM code protection, a 32-bit value in block 0, disables reading and rewriting through a parallel programmer when it is zero. Start-up program protection lets a bootloader rewrite blocks 0 to 7 using the alternate blocks 8 to 15. Area protection limits self-programming to selected blocks. None of these erase the array on its own; a full erase is a deliberate act, and it is not part of a recovery.
E2 Area, Separately
Eight kilobytes with a one-million-cycle rating and background operation. Reading it as part of the code array produces a file that looks plausible and is wrong at every address. It ships as its own binary, with a note on which 2 KB blocks had been written and whether the fault log showed a repeating pattern.
Two Motors, One Array
Dual-inverter firmware splits the array in a recognisable way: the control code is shared, the parameter blocks are duplicated per motor, and the fault handlers diverge late. Seeing two nearly identical parameter blocks in a dump is a strong signal that the design drives two axes.
That matters for the rebuild because the two blocks are calibrated independently. Copying one over the other produces a drive that runs one motor correctly and the other with the wrong current scaling – a fault that is easy to miss on a test stand with a single load.
Handover And Questions
The pack: Intel HEX over the ROM window, E2 binary, option bytes, block map, and a configuration page with the ID code and control code. If the board still runs, add a register capture of the MTU3 and GPT configuration – on a dual-inverter design that capture explains more about the product than the disassembly does.
Tell us at intake whether the unit drives two motors and what the DC bus voltage is. The contact form is the place for that; packing details are on the services page. The 512 KB top variant is R5F524TEADFP, the 256 KB part with 32 KB RAM is R5F524TBADFP.