I had been reading microcontroller datasheets as if an ESD number and a pin-voltage number were two ways of saying the same thing. They are not. I noticed while I was working out protection for signals that leave a board through a connector, including the external I/O on the ESP32 platform.
The ESP32-S3-WROOM-1 / 1U datasheet lists, under Product Handling, a human-body-model rating of ±2000 V and a charged-device-model rating of ±500 V. The ESP32-S3 chip datasheet puts a related pair in its reliability table: HBM ±2000 V to JS-001, and CDM ±1000 V to JS-002. Two kilovolts is a large number. It is easy to file it next to “this GPIO can survive a static zap.” That filing is wrong, and the datasheets are fairly direct about why, once you read the heading the number sits under.
A handling test
HBM and CDM are component qualification models. They describe a controlled stress used to decide what manufacturing and handling process the part was qualified against. On the chip datasheet the ESD rows share a table with high-temperature operating life, moisture soak, and reflow. The footnotes cite JEDEC JEP155 and JEP157: 500 V HBM, and 250 V CDM, are what those documents treat as enough for safe manufacturing with a standard ESD control process. On the module datasheet the same kind of number sits in section 12, Product Handling, between storage conditions and the reflow profile.
That is the question the rating answers. Can this part survive assembly and ordinary handling under a stated ESD-control process? It does not answer what happens when a finished board is touched at a connector, when a cable is plugged in, or when someone walks across a floor and grabs a screw terminal.
The two models are also different tests. HBM is a charged human body, classically a 100 pF capacitor discharged through 1.5 kΩ. CDM is the part itself carrying charge and then finding a pin to dump it through. CDM is a faster, sharper event. A part can carry a 2 kV HBM number and a much smaller CDM number at the same time. The WROOM module’s CDM figure is ±500 V. The chip’s is ±1000 V. Remembering only “±2 kV” has already thrown away which test, and which document, the number came from.
The pin limit is a voltage
The other figure I had been mixing in is the DC pin limit. In the ESP32-S3 DC characteristics table, a high-level input is specified up to VDD + 0.3 V, and a low-level input down to −0.3 V. Those are bounds on the pin voltage. They are not an energy rating, and they do not mean the GPIO “can only tolerate 0.3 V of ESD.”
The 0.3 V is how far a logic level is allowed to sit beyond the rail, or below ground, as a DC condition. An ESD event is a short high-current pulse. The silicon may survive a pulse that drives the pin well outside that DC window, because a qualification test said it survived that particular model. It may also be damaged by a smaller system-level event that the qualification never claimed to cover. The DC limit does not tell you the pulse energy. The pulse rating does not give permission to hold the pin at 2 kV, or at a few volts above the rail, during normal operation.
The absolute-maximum table nearby is a third document inside the same PDF. On the ESP32-S3 it is headed as a stress rating, and the voltage row I keep seeing people cite for “the pin” is the input power pins, from −0.3 V to 3.6 V, plus storage temperature and a cumulative IO current. Stress ratings say where permanent damage becomes the concern if you stay there. They still are not a description of an ESD pulse. Three tables, three questions. I had been treating them as one reassuring number.
What is usually on the die
Most microcontroller I/O has some on-chip protection structure. The common shape is a clamp that can steer a positive excursion toward a supply rail, and a clamp that can steer a negative excursion toward ground. Some parts use snapback devices or other structures. Analog pins, reset, USB, and RF pads often differ from a plain GPIO. I have not opened an ESP32 to trace its pad ring, and I am not going to claim every MCU, or every pin on one MCU, uses that diode pair.
Where that shape does exist, the structures are small. They are there so the silicon can pass a component-level test and survive ordinary handling. They are not a power device, and they are not a part you selected because a connector is exposed to people. When they conduct, they also dump current into a rail or into ground. If that rail cannot absorb the charge, the voltage the die sees is not the tidy number in the table.
A positive strike steered into VDD has to go somewhere. A stiff rail, a regulator that can sink, or enough capacitance close to the clamp, moves a little. A regulator that only sources current, with the nearest capacitor an inch away, lets the rail jump, and every other pin on that rail jumps with it. A negative strike into a skinny ground has the same shape of problem at the edge rate of the pulse. “There is a diode to VDD” is the start of the layout, not the end of it.
A different test, at the box
System-level ESD, the kind IEC 61000-4-2 describes, is a test of a finished product. The model is 150 pF discharged through 330 Ω, into a point on the equipment: a connector, a shell, a screw, a user-accessible surface. Contact discharges of several kilovolts, and air discharges higher than that, are ordinary commercial targets. The peak current is in a different league from HBM. Two kilovolts through 1.5 kΩ is on the order of an amp. A system-level contact discharge at the higher test levels is tens of amps, for a few nanoseconds, with a fast edge.
Nothing in the module’s ±2 kV HBM line says a board passes that test. I have not run IEC 61000-4-2 on the ESP32 platform, and I am not going to imply the handling rating already did.
A signal that leaves the board
If a net leaves through a connector that a person or a cable can touch, I treat the MCU pin as unprotected for that purpose and add something outside the chip. The pieces I actually reach for are ordinary, and they are not a universal circuit:
- A TVS or ESD diode chosen for the signal’s normal voltage, placed at the connector. The clamp should start conducting before the pulse has traveled across the board to the pin.
- Some series impedance between the connector and the MCU, when the signal can tolerate it, so the external clamp takes the current.
- A short, low-inductance path from that clamp to the return it is supposed to use. A long trace to ground is how a protected pin still rings above the rail at the die.
- Filtering, when the signal is slow enough that a capacitor or a ferrite is acceptable. A fast edge and a large capacitor is its own design.
Where the return current goes matters as much as the part number. Steering a strike into signal ground, into a chassis, or into a plane that every IC shares are different decisions. The wrong one couples the hit into the rest of the board. I do not have one ground recipe that fits every enclosure, and this post is not pretending to.
The on-chip clamps are still there after all of that. They are the last, smallest structure. They are not the design.
Why it came up
The ESP32 platform is a general-purpose controller meant to leave the bench: a wide input, a battery path, switched loads, and connectors instead of a row of headers on a desk. Once a signal is on a connector, Product Handling is the wrong section of the module datasheet. It tells me how to store and solder the part. It does not tell me the GPIO is safe to hand to the outside of the box.
±2 kV is a real number, and it is useful. It answers a manufacturing question. VDD + 0.3 V and −0.3 V answer a DC question. Neither one is an ESD protection circuit.