Proper way to protect a SPI bus with external access

[Faranight]

Hi, just making sure...
I have a PCB in the works with a microcontroller that is an SPI master and a Winbond SPI NOR flash as a slave device. The two ICs are directly connected with MISO, MOSI, SCK and /CS traces. I would like to have easy access to the SPI slave from an external SPI master device i.e. a flash programmer. I'm thinking about adding an extra pin header to the board that taps into the SPI bus, but I'm curious to know what's the proper way to do this with bus protection in mind.

For example, if a careless user (me) accidentally forgets to force the uC into a reset state, connects the programmer and initiates a flash operation while the SPI bus is in use. So the uC will be driving a certain SPI line low while the external device will be driving it high (or vice-versa) and this will likely cause a short on the bus. Some websites suggest to use series resistors in order to limit the current flow in such case. For example, the microcontroller pins can sink/source a maximum of 20 mA according to datasheet. Presumably, the pin voltage will be 5V (technically it's 3.3V, but let's assume it's 5V). In order to keep the current under the 20 mA limit one would have to add appropriate (330 Ohm) series resistors somewhere on the SPI line.

My question is where would these resistors be best placed?
Is something like what is shown in the attached picture sufficient?

[DavidAlfa]

Add another pin that shorts the MCU reset pin to gnd, so it automatically avoids any conflict.

[julian1]

Maybe something like 74HC244/74LVC244, to mux the control lines, and with the MCU reset connected to the OE of the '244.
 
So in normal operation, mcu drives CS,CLK,MOSI to communicate with the slave device. 

But with MCU held in reset, its gpio/spi pins go high-z, while the '244 outputs are enabled to permit external slave communication without without contention.

[T3sl4co1l]

What bitrate is the MCU running at?

If boring say <20MHz SPI then it can be pretty much anywhere on board, just don't make a circuitous route around everything.  The higher you go from there, the more critical line length is, and the closer the connector should be.  (More to the point, due to edge rate; difference being, faster MCUs have stronger pin drive than slower ones. Often selectable too. Use the lowest (analog) bandwidth for the interface you can.)  Resistor position doesn't really matter; any source termination resistors are long past (within the programmer hopefully, or by the MCU and Flash output pins respectively).  ...Perhaps that's not as good an assumption as it is a reminder: use source termination resistors *at* the output pins.

As far as minimizing stub length with respect to each driver, putting the resistors in the middle of the MCU-Flash route would be optimal.  But, the Flash programmer may not need such resistors at all, and be perfectly comfortable driving such stub length (or more, whether placed near MCU or Flash).  Again, so long as you ensure MCU in reset.

Note these aren't clear statements, and not even proportions.  Even 100M SPI (usually QSPI at that) isn't so fast that a connector can't be dropped in the middle, or to one side or the other, as long as the two chips in question are nearby.  It's pretty non-critical.

Tim

[Faranight]

T3sl4co1l: Hey!
Speed of the SPI bus isn't that critical, or even an issue. The uC is running at 24 MHz, and the fastest available SPI speed is CLK/2, according to the datasheet. The external SPI programmer can run even slower. I was mainly concerned about potential shorts on the bus as the SPI drivers are push-pull, not open-drain like I2C. With two masters (accidentally) operating on the same bus at the same time it may be an issue. There is some confusion about this on my end.

You're suggesting to put resistors close to the driving pins. I heard this suggestion a few times before. The driving pins in this case would be MISO on the slave device, MOSI+CLK on the uC and MOSI+CLK on the flash programmer, yes? I'm not sure about /CS since there is a pullup resistor on the line; I believe that it's open-drain on both uC and the flash programmer? Anyway, what would that look like on the given circuit? One 330R resistor close to the MISO pin on the slave device, 2 resistors close to the MOSI and CLK pins of the uC and another 2 resistors on the same lines close to the external pin header? I wonder, if the single resistor on the MISO slave pin is even needed since there is only a single driving pin on the MISO line.

[DavidAlfa]

Shorting a pin won't cause any damage, a pin can typically supply 20mA or so.
The only real problem would be a short to a voltage higher than vdd, as the esd diodes would cause a low impedance path, possibly frying everything connected to vdd or damaging the pin circuitry.

[T3sl4co1l]

Source termination resistors are to make up the difference between average pin resistance (for LVCMOS, typically 30-70 ohms depending on up/down direction, VCC, and mfg variance) and trace impedance (typically 50-120 ohms for average board traces).  Small resistor values are typical: say 22-47 ohms.  More can be used, to increase rise/fall time (may be helpful for EMI -- only use what bandwidth you need), but limited by required drive strength (e.g. pull-ups matter) and maximum rise time (particularly important for SCK).

Termination CS isn't a bad idea either, though rarely a problem as it should be low and stable, long before a transmission begins.

Likewise, MISO/MOSI aren't as important as they have a half-cycle to settle before being clocked.

Clock signal quality is paramount.

Putting the MCU in reset guarantees it can't assert the bus (do check the datasheet, that pins in reset go tristate; they usually do, but not always), solving the conflict without resistors.

Tim

[Doctorandus_P]

Such series resistors (even when as low as 100Ohm) help and are probably enough for hotplugging external hardware, but connections to the outside world (or even long cables) are always a concern. Such series resistors also help a bit with ESD discharge, both because they slow the rising flank (combined with the bus capacitance) and they limit the current a bit.

If you want to go more robust, you can add bigger TVS diodes and PPTC polyfuses. With that combination you can also survive things like injecting 50Vdc

[Berni]

Shorting digital pins to Vcc or GND is perfectly safe.

The transistors in digital output pins are so weak that they are incapable of passing a damaging current even with full supply voltage across them. It is when you pull the pin outside of the supply range where you can damage it. Such as applying 8V to a pin of a 5V chip or applying -2 V. In those cases the internal ESD diodes will pass a lot of current, enough current to blow up the ESD diodes and potentially other silicon circuitry near them.

So no resistors required at all for just a programing header. Also do add the reset pin on the connector and then wire the mating connector to put GND on that pin, so it automatically gets put into reset once plugged in.

If you want to protect from high voltage overloads on that connector then i recommend having a T shaped resistor, TVS, resistor. Place this between the chip and connector and it will clamp unsafe voltages while limiting the current into internal ESD diodes.

[T3sl4co1l]

Well, I wouldn't say "perfectly safe", but you can definitely get away with it a lot of the time.

You rarely see logic devices with "unlimited" short duration, but the main limitation is power, and, obviously, pulling a lot of pins at once will burn that up quickly (or violate VCC/GND pin limits!).  Occasionally you see a time like 1s or something.

But just one at a time, at room temperature, it's definitely unlikely.

It's probably worse for devices with small output structures (not sure if any logic families have this limit; FPGAs generally warn to avoid DC loads though?), where electromigration might also cause failure.

Tim

[DavidAlfa]

To my understanding this is just a programming header where you plug the programmer directly, perhabs with a 5" ribbon cable.
If hot plugged, make the gnd pins longer or use a specific connector that connects gnd first, that way there won't be any harmful potential between signals.
But this barely needs any  protection, it's not a 100m rs485 line running through machinery, maybe just a connector that avoid plugging it backwards.

[NorthGuy]

Do you have any access to the MCU? If so, you don't need extra headers - program the flash through the MCU.

[Siwastaja]

Series resistors are placed at the driver, so MOSI,SCK,NSS at the master, MISO at slave.

330ohms start to slow down the edges - do the math or test&measure (with oscillosscope) to see if it's acceptable. But realistically the IO pins can take way more than said 20mA when it's not continuous, and it won't be continuous, but bursts of pulses. Also remember that the output resistances of the two driving sources act in series, sharing the hit, so this kind of short circuit is less dramatic than hard short to VCC/GND net; in practice, parts often survive even without the resistors, and with as little as 47ohms added, damage would be very uncommon / extremely bad luck. 47 ohms would series terminate the line only slightly overdamping it so edge rate wouldn't be a problem even at higher SPI rates (say 20MHz).

[Siwastaja]

Shorting digital pins to Vcc or GND is perfectly safe.

The transistors in digital output pins are so weak that they are incapable of passing a damaging current even with full supply voltage across them.

Not true. I have seen actual damage caused by shorted output pins several times in real world. Not too common, but doing it deliberately is pushing your luck.

The reason is, this "weakness" which limits the current also means the same "weak" transistors are destroyed easily.

[Faranight]

But realistically the IO pins can take way more than said 20mA when it's not continuous, and it won't be continuous, but bursts of pulses.

You are probably right about this one. I checked the microcontroller datasheet, and the absolute maximum ratings are listed as +/- 50mA. The 20mA was just the rated current.

[Doctorandus_P]

Well, I wouldn't say "perfectly safe", but you can definitely get away with it a lot of the time.

Indeed. Such things nearly always "work" on your desk, but once you start putting your projects out in the field all kind of *&^%$#@! happens, and any connector that is (or can be) connected to the outside world is something that needs consideration, and likely some extra protection.