Other Parts Discussed in Thread: CC2640
We have been experiencing an issue where sometimes (usually, actually) our device will not connect to a Bluetooth peripheral because during the interrogation process where services and characteristics are discovered, we fail to respond to the request from the client (BT Developer Studio on Win10). The NP receives the command and passes to the AP. The AP receives the command, and prepares and sends a response, but the NP doesn't receive the response. Note that we get plenty of successful transactions, but once a response fails to make its way to the NP from the AP, the rest of the interrogation fails, as does the connection.
After hours of troubleshooting, we hooked up a scope to the SPI lines (we are using low-power mode with SRDY and MRDY pins on SSI (SPI). We found that in the failure case, the AP de-asserts the MRDY pin while the SCLK is still running and data is still being sent. Our AP is an STM32L4 running FreeRTOS, and we are using DMA for our NPI SPI communications.
In the scope screenshots below, which are increasingly zoomed-in versions of the same event, we have the following NPI frame:
0xFE - 0x1B - 0x00 - 0x55 - 0x87 - 0x00 - 0x00 - 0x00 - 0x26 - 0x00 (23 times) - 0xEF
0xFE - 0x001B - 0x55 - 0x87 - 0x00 - 0x00 - 0x00 - 0x26 - 0x00 (23 times) - 0xEF (Combined 2-byte length/reserved parameter, considering Little Endianness)
SOF = 0xFE
Len = 0x1B -> 27 bytes
Cmd0 = 0x55 -> Asynchronous Command type for the BLE simple network processor
Cmd1 = 0x87 -> SNP_CHAR_READ_IND (Response to SNP_CHAR_READ_REQ from NP)
Data = 0x00 - 0x00 - 0x00 - 0x26 (Characteristic Handle 38) followed by 0x00 23 times
FCS = 0xEF
The full AP response NPI frame is shown below. Note the seemingly rogue activity on the MISO line (from NP to AP).
Below, we zoom in with cursors showing 215us time for 216 bits (27 bytes) of data within the NPI frame. I failed to capture a second shot with cursors, but note that the seemingly rogue activity on MISO occurs almost exactly 100us before the de-assertion of MRDY pin. This 100us coincidentally aligns with recommended the AREQ timing shown in Table 3 of the NPI user's guide, version 1.1, between the END of data and the de-assertion of the MRDY pin. Due to this coincidence, we think that the rogue activity on MISO is triggering some timer which is causing premature de-assertion of the MRDY pin.
What could possibly be causing the seemingly rogue activity on the MISO line?
Is this activity something that would trigger the 100us timer to release MRDY?
How can the AP release MRDY while still clocking data? The entire frame is perfect, but since the MRDY line is released too early, the frame is not properly captured in the NP, so the response is not parsed to be sent out on Bluetooth.
EDIT: Clarity on 100us delay between MISO activity and MRDY de-assertion.