🛠 Auditer le stepping de son RP2350 : fuite Bank 0 (E9), errata bootrom et parades

Objectives

The RP2350 has a history: the A2 silicon (first batches) carries documented errata, the most famous of which — RP2350-E9 — poisons power consumption and floating inputs: a Bank 0 pin configured as an input sources ~120 µA when the potential floats between logic levels, and rises on its own to 2.2 V. Initially described as a "latching pull-down," the issue was reclassified as "increased leakage in Bank 0 when the pad input is enabled," notably reported by Bus Pirate developers, and fixed in the A3/A4 steppings announced in July 2025 (pico-feedback#401 ; A3/A4 + RP2354 announcement). This tutorial covers identifying your stepping, measuring the leakage, and making any design robust regardless of the batch.

Hardware

• 1 × generic RP2350 board (the stepping is etched into the silicon, not on the PCB: we read it via register)
• 1 × pico-sdk 2.x (C) or a PICOBOOT probe + picotool
• Ideally: a µA-meter or a 1 kΩ shunt + multimeter to observe the 120 µA

Identifying the stepping

// stepping.c — CHIP_ID.REVISION : 0x3 = A4 (datasheet Appendix C)
#include "pico/stdlib.h"
#include "hardware/regs/io_bank0.h"   // accès registre via SDK/regs
// Lire CHIP_ID.REVISION (bloc sysinfo/CHIP_ID) :
//   0x3 -> A4 ; les A2/A3 ont d'autres valeurs — table Appendix C.
// 
// cherche CHIP_ID dans hardware/regs de ton pico-sdk.
picotool info            // affiche aussi des infos puce via PICOBOOT

Measuring E9 leakage (A2)

// fuite.c — une entrée flottante du Bank 0 vue au multimètre
#include "pico/stdlib.h"
int main(void) {
    stdio_init_all;
    gpio_init(5);                    // GP5 = broche basse du Bank 0
    gpio_set_dir(5, GPIO_IN);        // entrée, SANS pull : cas du bug
    sleep_ms(1000);
    // Multimètre entre GP5 et GND (haute impédance) :
    //   A2 fautif : ~2,2 V et ~120 µA SOURCE par la broche (!)
    //   A3/A4     : potentiel instable mais courant négligeable
    gpio_pull_down(5);               // la parade : forcer un niveau
    //   -> la tension s'effondre à 0 V, le courant de fuite n'existe plus
    for (;;) { sleep_ms(1000); }
}

Design mitigations (valid for all steppings)

1. Never leave inputs floating: gpio_pull_up/gpio_pull_down on EVERY unused pin — the golden rule of EMC becomes a power consumption rule on A2.
2. Analog inputs: a voltage divider/sample-and-hold that lets the ADC hover at mid-voltage triggers the leakage — bias your sources.
3. Low-current sleep: sleep consumption is dominated by pad leakage — on A2 with 20 floating inputs, 20 × 120 µA = 2.4 mA, which is on the order of your entire battery budget (the LDO has a low-power standby mode, up to 1 mA for retention during sleep, datasheet §6.3).
4. Buy recent stock: A3/A4 fix E9 and the bootrom errata E13 (invalid IMAGE_DEF blocks boot), E14 (connect_internal_flash ignores the CS1 pin), E15 (OTP page 62/63 permissions), E18 (invalid ECC pattern in the OTP partition field = bricked boot), E22–E23, E25 (datasheet Appendix C/D) — and the fault injection mitigations E20/E21/E24/E26.

Expected verification

On an A2: a floating GP5 shows ~2.2 V on the multimeter and the leakage current is readable via the shunt; gpio_pull_down(5) brings it back to 0 V and the budget returns to normal. On A3/A4: the floating pin no longer sources this current. CHIP_ID.REVISION = 0x3 confirms an A4. Best practice: note the stepping in your board's BOM — two batches may coexist at your distributor.

Common mistakes

• Concluding there is an external short circuit: 120 µA SOURCED by an input pin is the RP2350-A2 leaking, not your PCB — do not replace the regulator before reading the stepping.
• Believing the bug is "latching" (the old description): requalified as simple leakage, it disappears as soon as the pad is no longer at mid-voltage — no reset needed.
• Extending the panic to Bank 1: the documented E9 errata targets Bank 0 — test your own pins before redesigning.
• Ignoring E18 before writing to OTP: on A2, an invalid ECC pattern in the partition field can brick the boot — only write to OTP on A3/A4 if possible.
• Relying on frequency: 150 MHz nominal (not the 200 MHz of an overclocked RP2040) — a "slowdown" after migration often comes from the clock, not from tired silicon.
• Forgetting the -40…85 °C range (datasheet §14.9.3) and the regulator's thermal shutdown (junction 100–150 °C config) in a closed enclosure: leakage measurements increase with temperature — measure both cold and hot.