STM32H7 Quad SPI broken bit when output is switching to input with NOR flash

[SLesh.1]

Hi there!

I have a problem when using QSPI with NOR flash. Some read commands return data with first 4 bits corrupted.

After investigation, I have found that the issue only appears if there is switch from output to input without dummy cycles.

For example (see picture): I send a 4-line, 1 byte instruction (2 cycles) and read 4-line 3 bytes (6 cycles). I expect IO2 (blue) to switch from output to input prior to clock's (yellow) third falling edge. Instead, it seems to be held at some grey level, that is sometimes sampled as 1 at the third rising edge.

 

Same issue was observed on STM32H7 with 2 different flash chips, using quad-spi and dual-spi.

Yellow is clock, blue is IO2

I can’t find something similar in errata.

Are some ideas, guys?

[Mike_ST]

Hello

What QSPI reference are you using ?

QSPI might need dummy cycles to work as expected, this should be written in the datasheet of the flash.

[SLesh.1]

I'm using Winbond W25Q32JV and ISSI IS25LP032D

f.e. https://www.issi.com/WW/pdf/25LP-WP032D.pdf page 75 - according the document JEDEC ID should be read without dummy cycles.

[Andreas Bolsch]

W25Q32JV doesn't support 4-4-4 mode at all, so it's out of consideration, and 0x9F only in 1-1-1 mode accourding to 8.1.2 and 8.1.3.

Unfortunately the picture is rather bad (Your scope has USB and LAN, so most likely you could provide a screenshot?). What's the timebase? Keep in mind that most quad-capable flash chips allow only a rather slow clock for most commands, and the prominently advertised high clock rates only for a very limited set of commands like quad read, but *NOT* for the read id command. That's one reason why dummy clocks are necessary for the high speed reads. Some devices even don't support the 0x9F read id at all in 4-4-4 mode.

[Mike_ST]

In page 76 figure 8.55 in QPI mode you need 8 clock cycles before reading the ID.

Page 75: 8.31 "The RDMDID

instruction code is followed by two dummy bytes and one byte address (A7~A0), "

But from what I understand you are expecting incoming data after 3 clock cycles.

[SLesh.1]

I'm using 0x9F command - page 75 (not 76), figure 8.30. No dummy cycles demand in this case.

[Tesla DeLorean]

If it's in 1-bit mode why is the state of IO2 changing?

The state of IO1 would be more interesting, as would the clock edge you're sampling on. Tv is on the order of 7-8 ns

In QPI mode the QUADSPI peripheral may have a turn-around time also, I haven't dug into the specs.

[Ilya Balov]

Here are better quality pictures (yellow - clock, blue - IO0, IO1, IO2, IO3):

As you can see, IO1 and IO2 have some strange behaviour after second falling edge. As a result, we read 0xFD instead of expected 0x9D.

[Ilya Balov]

I also tried to reproduce a minimal example:

I have sent command 0xAB (Read Product ID) in qpi mode (4-4-4), then 0 or 1 dummy cycles, then read 1 byte. There are 6 dummy cycles required by flash datasheet, so flash should not write anything.

0 dummy cycles:

1 dummy cycle:

As you can see, IO1 keeps high signal without dummy cycles. I also tried connecting IO1 to ground via 9kOm resistor.

With resistor, 0 dummy cycles:

With resistor, 1 dummy cycle:

 

It seems that controller does not switch IO1 to input on the second falling edge, but instead does it on the third rising edge, where data is already being sampled.

[KShim.1738]

I am sorry if I interrupt this discussion. I have the very similar problem as of Ilya Balov.

This is the timing diagram of my QSPI device. And there is no dummy cycles I can add.

Below is the value of SIPO3. The command is one byte and occupies first 2 clocks. I expect 3 rd bit to be one from the slave device. The voltage level is around 1.2V as can be seen in the picture below.

 

I did experiment with every single options of STM32F7 QUADSPI controller but it didn't work.

I suspect that the SPIO3 pin was not switched to input on time. Then the equivalent circuit of voltage divider connecting the slave output to the master output of F7 gives the weird result I guess.

I hope I can get some hint from this discussion.

Kyle

[Andreas Bolsch]

Frankly speaking I can hardly recognize anything in that picture. "red" is ???, and "blue" is ???.

[KShim.1738]

Sorry for the confusion. I thought it was self explaining.

Red is SPICLK and blue is SPIO3. They were scaled differently so that the signal can be recognized easily.

The command reads one byte from the slave and sampling was delayed by half cycle, which is why there are 5 clocks.

It's the same problem I think, i.e. SPIO3 and other data pins are not switched to input on time. There is no problem when the first bits of response on data pins are zeros. Only 1's are corrupted when they are the first response bits of SPIOx pins.

More precisely, my suspicion is...

Output block of F7 QSPI controller remains active when input block gets active on 3rd clock. That makes the total impedance of F7 SPIOx very small. 44Ohm is used to supress ringing(for termination purpose). This termination resistor divides ~3V with the output block of F7 SPIOx. Reading level gives 1.2V at this point. On the rising edge of 3rd clock, output block of F7 SPIOx gets inactive and the total impedance of F7 SPIOx is now restored to the impedance of input block of F7 SPIOx pins and so the voltage level gets back to ~3V.

 

In case of Ilya Balov, the commands ends with 1 and output register has value 1. And it causes the voltage level not to be zero.

 

equivalent measurement of the same pin with ATSAMV71 and the same device. no half cycle delay for sampling and data pin pulled up. And sampling polarity(or whatever) is different. No problem with the QSPI device.

red is clock and blue is data pin.