SPI Clock Doubling That Passed on the Bench and Failed in the Field
A pressure-sensor node uses an MCU as SPI master in mode 0 (CPOL=0, CPHA=0) to read a 16-bit sensor. The release firmware ran SCLK at 24 MHz. To shorten the read loop, an engineer raised SCLK to 48 MHz. Bench testing on two units at 22 °C passed 10 million consecutive reads with zero CRC errors, so the change shipped. In the field, 3 of 400 units report intermittent CRC failures during the first 200 ms after power-on (board at roughly 5 °C) and again when the enclosure reaches 70 °C; failures cluster on units built after a PCB revision that lengthened the SCLK trace. The sensor datasheet specifies MISO tCO = 6 ns typical at 25 °C and 14 ns maximum over −40 to +85 °C and 2.7–3.6 V. The MCU input setup time is 2.5 ns and input hold is 1 ns. Measured combined SCLK/MISO board skew plus jitter derating on the current layout is 1.2 ns. Each transaction is a single 16-bit register read; MOSI carries only the register address. The board has no room for a clock-delay device, and the MCU SPI peripheral has no receiver sample-delay control.
1. Compute the MISO read timing margin at 24 MHz and at 48 MHz, and explain why the bench test passed while field units fail.
Read the worked answer
Budget. In mode 0 the slave launches MISO on the SCLK falling edge and the master samples it on the next rising edge, so the available window is one half period:
margin = T/2 − tCO − t_su(master) − derating
- 24 MHz: T = 41.67 ns, T/2 = 20.83 ns. margin = 20.83 − 14 − 2.5 − 1.2 = +3.13 ns (about 15 % of the half period).
- 48 MHz: T = 20.83 ns, T/2 = 10.42 ns. margin = 10.42 − 14 − 2.5 − 1.2 = −7.29 ns. The path is broken by construction.
The bench result is explained by using typical instead of maximum tCO. With tCO = 6 ns at 48 MHz: 10.42 − 6 − 2.5 − 1.2 = +0.72 ns. That is nominally positive, so two room-temperature units can pass a long soak, but 0.72 ns is smaller than the accuracy of the derating estimate and leaves nothing for the temperature-driven increase of tCO toward its 14 ns maximum.
Failure correlation supports this: cold and hot corners are where tCO moves away from typical, and the lengthened SCLK trace increased the skew derating, pushing those units over the edge. Note the hold side is not the limiter here - the slave's data changes a half period away from the sampling edge.
Conclusion: the 48 MHz change is not marginal, it is outside the timing budget by roughly 7 ns; the passing bench test was luck, not evidence.
2. The team wants to keep the higher throughput. Determine what tCO the sensor would need to support 48 MHz, evaluate the obvious workarounds, and recommend a path.
Read the worked answer
Required sensor spec. Rearranging the budget with zero margin:
tCO_max ≤ T/2 − t_su − derating = 10.42 − 2.5 − 1.2 = 6.72 ns
No grade of this sensor meets 6.72 ns over temperature; the fastest grade available is around 8 ns, which at 48 MHz still gives 10.42 − 8 − 2.5 − 1.2 = −1.28 ns. Even at 40 MHz (T/2 = 12.5 ns) an 8 ns part leaves only +0.8 ns, which is not a defensible production margin. So "buy the faster grade" does not rescue 48 MHz.
Workarounds and their cost:
- Delay SCLK so the master samples later. The MCU has no sample-delay control, so this means an external delay element or CPLD - new skew source, new BOM line, new qualification, and the derating would have to be re-measured. Not justified for a register read.
- Change SPI mode. Modes 1/3 move the launch and sample edges but still give only one half period; the constraint is a fixed property of the slave, not the mode. No help.
- Reduce transactions instead of clock period. The sensor has a burst/FIFO read that returns several registers in one transaction. Doing one 8-register burst replaces eight address-plus-data transactions, cutting overhead far more than doubling SCLK ever could.
Recommendation: revert to a clock that restores margin, then recover throughput structurally. At 24 MHz the margin is only 3.13 ns, which is acceptable if and only if the 1.2 ns derating was measured on the current long-trace revision and covers jitter and crosstalk; confirm that first. If a comfortable margin is wanted, use ~18–20 MHz (T/2 = 27.8–25 ns, margin 9–6 ns) and adopt burst reads. The performance goal is met by fewer, not faster, transactions.
3. Define the verification and containment steps needed before the next production release.
Read the worked answer
1. Prove the failing path, not just the symptom. Probe SCLK and MISO at the sensor pins with a logic analyzer in timing mode, and compute the actual launch-to-sample interval on a failing unit at 5 °C and at 70 °C. Confirm the measured tCO approaches the datasheet maximum on failing units, and confirm the SCLK-trace revision is what changed the skew. Do not accept a CRC-error count alone as the diagnosis.
2. Re-measure the derating. The 1.2 ns figure must be measured on the current layout, including the longest SCLK stub, and must include cycle-to-cycle jitter and crosstalk from the adjacent data lines. A derating carried over from the previous board revision is the likely reason the original budget looked safe.
3. Corner test. Sample at least 10 units spanning sensor date codes and both PCB revisions, soak at −40, 25, 70 and 85 °C, and run at both the minimum and maximum supply rail (2.7 V and 3.6 V). Ten million reads per corner is a reasonable statistical floor given the observed failure rate.
4. Guard-band the design. After choosing the new clock, keep at least 30–40 % of the half period as margin so that future layout changes do not consume the budget silently.
5. Containment for shipped units. Field-updatable firmware should fall back to the safe clock; add a CRC error counter exposed over telemetry so a recurrence is visible in hours rather than months. Add a design-rule check that rejects SCLK/MISO length mismatch beyond a defined limit.