Pi Pico 2 Extreme Teardown | Hacker News Reader

Pi Pico 2 Extreme Teardown

electronupdate.blogspot.com

178 pointscoder54334 comments

> interesting: the power supply on a USB interface is fixed at 5V... why not just a 'buck' supply?

> [...]

> The power supply is a buck-boost from Richtek. Interesting choice as it allows the assembly to be powered from a voltage as low as 1.8V (battery use, perhaps??)

That'd be consistent with how I've used the original Pi Pico in projects, yep. The Pico (and Pico 2) has VBUS and VSYS pins - VBUS being the USB port's 5V, and VSYS being intended for non-USB power sources, including batteries. The Pico 2 datasheet (https://datasheets.raspberrypi.com/pico/pico-2-datasheet.pdf) has some sample schematics for three use cases:

1. A simple case where you connect the external power source to VSYS through a Shottky diode - in which case the Pico will pull from whichever of USB or VSYS has the higher voltage

2. Based on #1, except with a MOSFET instead of a Shottky diode, and with the gate connected to VBUS - in which case the Pico will not pull from VSYS when receiving USB power

3. Based on #2, except there's a battery charger between the external power source and the MOSFET, and VBUS is also connected to the charger's input - in which case the Pico will charge the battery when receiving USB power, in addition to the behavior of #2

(The datasheet also mentions an additional use case: if you're using the Pico as a USB host, you'd want to supply 5V to VBUS in order to power both the Pico and the attached device)

I'm not an EE, but how does #2 prevent power from traveling back into where VBUS originally came from (like a PC USB port for example)?

I ain't an EE, either, but I'm pretty sure the answer boils down to "that's just how transistors work".

So you have:

- Some external power source into the MOSFET's source pin - VBUS into the MOSFET's gate pin - The MOSFET's drain pin into VSYS

And by some transistor magic that I as a lowly layman ain't privy to, the MOSFET only allows power to flow into the input/gate pins and out of the output pin, and prevents power from flowing back out of the input/gate pins. The datasheet does specify a P-channel MOSFET, so that might have something to do with it (the differences between P-channel and N-channel MOSFETs are a bit over my head).

If you wanted extra assurance that power won't flow back into VBUS, you could probably stick a diode between VBUS and the MOSFET's gate pin.

electronupdate also published a more detailed video for the teardown: https://www.youtube.com/watch?v=vb8AB8bsQSk

That channel is great, would be great to find repositories of similar hacker/electronics channels, if anyone has some.

zeptobars for die shots https://x.com/zeptobars

der8auer is mostly pc hardware focused, but has some interesting videos looking at chips https://www.youtube.com/@der8auer-en

bigclivedotcom for teardowns of random electronics https://www.youtube.com/bigclivedotcom

https://youtube.com/@mikeselectricstuff/videos Teardowns of biomedical/x-ray/optical machines, as well as deep dives into reverse engineering and clever electrical design.

The Pi5 southbridge was codenamed RP1, the RP2040 was RP2, and the RP2350 is apparently RP4. What might RP3 be I wonder? The boring prediction is that it's just a new southbridge for the Pi6, but one can hope they eventually split with Broadcom and do their own in-house Linux SoC which they would be able to document properly.

RP3 is the Pi Zero 2 W SiP

Oh, that's even more boring. Fingers crossed for RP5 then...

RP5 with CM5?

Are there any methods to automatically reverse-engineer transistors and their connections from these kinds of photographs?

Ken Shirriff regularly pops up on here with a ton of microcontroller reverse engineering [1], and IIRC he does everything by hand.

[1] https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

Any idea if there is a way to take pcb pictures and automatically convert them into a schematic? Obviously you would have to fill in the equipment in.

there are services that sand down PCBs layer by layer to allow electrically exact copies

not viable for ICs, though

There's some automated tooling, but at least the publicly available tooling isn't great.

This is not exactly what you're looking for, but is also pretty interesting: it's a tool for reverse engineering the bits from mask ROM photographs.

https://github.com/travisgoodspeed/maskromtool

Not from these types of photos, but there are computed tomography techniques that are being used to help reverse engineer chips.. not to point fingers but its somewhat of known secret that the Chinese are using CT to reverse engineer American made semiconductor designs where the IP has not been successfully exfiltrated.

Sea of gates for all cores so unfortunately we can't tell the area used for RISC-V vs ARM. Anyone from Raspberry want to enlighten us?

A question was asked at this year's DEF CON during the "Making The DEF CON 32 Badge" talk. Luke Wren responded by saying he couldn't compare size of the ARM and RISC-V cores, but said that taking them out wouldn't make the chip die smaller. He added that he knew exactly what shape hole the core was going to fit into, and designed it to fit.

I didnt attend this year but was super impressed at how DEF CON and Raspberry Pi worked together on this years badge + announced the release of RP2350 on the same day DC32 started!

I immediately put an order in for one and should get it pretty soon.

> how DEF CON and Raspberry Pi worked together on this years badge

rPi donated the chips, Entropic Engineering designed the boards, I wrote the firmware. DEFCON made the gameboy game the badge runs and designed the plastics.

I wonder if ARM told them not to say. Seems like an obvious question to ask and it wouldn't take that much work to get a ballpark answer.

ARM puts the number on their website. For a 40nm node, it's 0.028mm^2. That is configuration dependent, but it's a starting point.

It’s 40nm, so the die area from the cores themselves is quite small. Most of the area is dedicated to RAM/ROM and IO. I’d guess the area for all the cores is less than 10% of total die.

You could take a look at the photos in the article and then make a less wildly inaccurate guess...

Did you read the article and watch the video? He states (rightly) that the cores are somewhere in the “sea of gates mush”. You can’t tell visually where the cores are. And there’s so much more than just the cores in that blob of gates.

So the "power distribution network" bit is a big pile of standard components? Is this what you get if you show up with a big pile of verilog and say "print this"? Why do the other bits looks different?

PDN includes the PCB itself.

You need to think about the return currents closely matching. In many cases on 4 layer boards, you are required to have two Vias per... Via. (One for the forward current and a second for the reverse current).

The PCB also serves as the fastest capacitor. The PCB layers itself form a capacitor measured in hundreds of Picofarads in most cases but more importantly, almost no parasitic inductance or resistance.

In many cases, boards are simulated at the Maxwell equation level to understand crosstalk issues. It seems like RP2350 is just fast enough where these effects could be noticed (at the highest clock rate)

Because that portion is digital. Digital is fairly immune to noise, but it can produce a lot of noise. The power distribution network can carry that noise to other components that it passes over, but because that section is all digital, it's ok, it's reasonably tolerant if it.

The other portions that are uncovered have more sensitive analog circuits. You need to be more careful of how you route power, to avoid noise, so you don't cover it all in a big network on the top metal layer, but instead it's routed more selectively.

How did they remove "the package" for this one? The usual sodium hydroxide or?

My guess its laser and/or micromachining

Usually you use fuming nitric acid with or without sulfuric acid depending if you have copper bondings.

https://www.semitracks.com/reference-material/failure-and-yi...

In my experience just hot sulfuric acid works fairly well if you're looking to just get the die out. Just don't leave it too long or you won't have any bond pads left...

Reply on news.ycombinator.com