• “3-wire” describes physical wiring + ownership switching (SDIO), not “3-bit” data width.
• Half-duplex describes time-division (TX phase vs RX phase), which may exist with separate lines or a shared line.

• Direction control: when and how SDIO changes between TX and RX.
• Turn-around (TA): the required gap for one driver to release and the other to safely take over.
• Tri-state window: the “Hi-Z” interval that prevents overlap driving.
• Contention risk: failure modes caused by overlap driving (wrong data, heating, EMI anomalies).
• Phase organization: command/address/TA/data partitioning and who owns SDIO in each phase.

• CPOL/CPHA modes: define sampling edge, but do not define SDIO ownership. → link to the “CPOL/CPHA Modes (0–3)” subpage
• SCLK quality & skew: affects sampling margin, separate from direction handoff rules. → link to the “SCLK Quality & Skew” subpage
• Long-trace SI / termination: deals with reflections/edge integrity; this page focuses on ownership timing. → link to the “Long-Trace SI” subpage
• DMA & throughput tuning: system throughput optimization is handled elsewhere. → link to the “DMA & High Throughput” subpage

Note: “primary limiter” is stated at the ownership/timing level. Signal-integrity-specific limits belong to the dedicated SI subpage.

• Choose Full-duplex when sustained throughput matters, bidirectional exchange is frequent, or lowest handoff risk is required.
• Choose Half-duplex when traffic is naturally phased (write then read), devices mandate dummy/TA cycles, or direction changes are infrequent but acceptable.
• Choose 3-wire (SDIO) when pin/isolation/channel cost dominates and the design can enforce strict SDIO ownership, safe defaults, and robust TA margin.
• Avoid 3-wire when multi-slave collisions are likely, streaming is required, or validation bandwidth is limited (intermittent contention is expensive to chase).

• Read-heavy or write-heavy? Direction handoff cost scales with how often the bus changes owners.
• Streaming required? Continuous, low-latency streams often favor Full-duplex or well-structured Half-duplex.
• Shared bus with many slaves? Shared SDIO raises collision risk; strict CS discipline is mandatory.
• Cross-board / cable involved? Handoff margins become more sensitive; prioritize ownership correctness and recovery hooks.
• Validation budget available? 3-wire demands explicit contention testing and TA margin verification across corners.

1. Ownership contract: define who drives SDIO in each phase (CMD/ADDR/DATA) and enforce it.
2. TA + Hi-Z window: explicitly allocate turn-around time (threshold placeholder: TA ≥ X ns).
3. Safe defaults: power-up and reset must default SDIO to input/Hi-Z until ownership is proven.
4. Contention containment: add practical protection (e.g., series resistance placeholder: R = X Ω) to limit bus-fight current.
5. Verification hooks: logic analyzer triggers for TA, ownership transitions, and intermittent error counters.

Direction handoff is defined as a timing contract. Signal-integrity phenomena are folded into tLINE_settle and handled on the dedicated SI subpage.

Where tDIS includes MCU mux latency and/or buffer tri-state delay, tLINE_settle is the observable time until SDIO becomes stable, and tSU is the receiver setup requirement before sampling.

• MCU IO switching delay: output-disable and input-enable may take multiple cycles (platform-dependent).
• Tri-state buffer delays: tPZ/tPLZ (disable/enable) add deterministic overhead.
• Bias recovery: weak pull-up/down (if used) needs time to restore a defined level during Hi-Z.
• Input threshold behavior: Schmitt vs CMOS threshold changes what “stable enough” means for sampling.
• Sampling window placement: the receiver must sample only after stability + setup are satisfied (mode specifics are handled elsewhere).

Long-trace termination and detailed SI are handled on the Long-Trace SI subpage; this section focuses on ownership enforcement and contention control.

• Mechanism: the same SDIO pin switches output ↔ input at phase boundaries.
• Key constraint: configuration writes are not instantaneous; the effective delay contributes to tDIS/tEN.
• Must-have: a safe default state (reset/power-up SDIO = input/Hi-Z) before any transaction.
• Verification hook: confirm Hi-Z during TA with timing + logic analyzer, then validate read data stability at the sampling window.

• Mechanism: OE gates which side is allowed to drive SDIO (ownership becomes hardware-enforced).
• Key constraint: buffer disable/enable timing (tPZ/tPLZ) consumes TA and must be budgeted.
• Control rule: OE transitions must occur only inside TA (no mid-data switching).
• Verification hook: monitor OE vs SDIO to ensure zero overlap driving across process/voltage/temperature corners.

• Mechanism: connect/disconnect SDIO path to prevent simultaneous strong driving.
• Key constraint: on-resistance and parasitics (Ron/Cpar) may increase settle time (modeled as tLINE_settle here).
• Control rule: switch state changes only in TA; allow stability before sampling.
• Verification hook: verify logic levels remain valid across temperature and supply variation during read windows.

• Must: safe default (SDIO input/Hi-Z) + explicit TA cycles + ownership transitions only at phase boundaries.
• Recommended: series-R current limiting (X–Y Ω), weak bias if SDIO floats, single OE controller.
• Optional: contention detection via current/temperature/error counters and event logging for field diagnostics.

• Transaction layer: CMD/ADDR/DATA sequencing and protocol framing.
• Ownership/IO layer: pin-mux / OE / switch control; enforces “one driver at a time.”
• Contract between layers: explicit requests (MASTER_DRIVE / SLAVE_DRIVE / Hi-Z(TA)) with timeout-based acknowledgements.

CPOL/CPHA and detailed sampling-edge rules remain on the SPI mode subpage; this section focuses on ownership transitions, timeouts, and recovery.

• Before switching: stop/gate SCLK (or keep quiet), then enter TA and disable the current driver.
• During TA: wait tDIS(driver_off) + tLINE_settle before enabling the new driver.
• After switching: support optional dummy cycles or discard-first-bit/byte if the target requires alignment.
• At any failure: force SDIO to input/Hi-Z first; then apply recovery steps.

Detailed DMA throughput tuning is handled on the DMA subpage; this table focuses on robustness parameters that prevent hangs and silent corruption.

1. Level 0 (soft exit): deassert CS → SDIO input/Hi-Z → clear context → restart.
2. Level 1 (device soft reset): issue device reset command/register write (device-defined) → wait X ms.
3. Level 2 (CS pulse sequence): toggle CS X times with a guard delay to exit stuck internal states.
4. Level 3 (bus release): force SDIO input/Hi-Z for X us; re-enter IDLE; retry with safe TA.
5. Level 4 (system reset): last resort; use watchdog/power-cycle policy.

• One active CS: at most one CS asserted for any SDIO transaction.
• Hi-Z when not selected: each slave must guarantee SDIO output is tri-stated when CS is inactive.
• Safe power-up defaults: all CS lines default to “not selected” (defined pull state).
• Guard time: enforce TA_GUARD = X cycles around CS changes and direction changes.
• Single owner controller: one state machine controls CS + ownership transitions (no competing writers).
• Recovery order: deassert CS first, then force SDIO input/Hi-Z before attempting retries.

• CS guard time: add a guard delay around CS edges (X us placeholder) to avoid overlap selection.
• Defined CS defaults: ensure power-up CS = not selected via pull states; avoid floating CS.
• Enforced TA_GUARD: treat TA as a mandatory protection period for both direction change and CS switching.
• Centralized control: one state machine owns CS + ownership decisions; prevent competing firmware writers.

Risk checklist (real-world failure mechanisms)

• Power-up tri-state: MCU pins may start as Hi-Z. If CS floats, narrow pulses or unintended levels can accidentally select sensitive devices (flash/config/PMIC-like targets).
• Brown-out split reset: some devices reset while others remain partially alive. Bus state machines become out-of-sync, and legal-looking fragments can occur during recovery.
• Hot-plug transients: connect order and ground bounce can create CS glitches or partial frames before the system is stable.
• Ghost powering: IO injection through CS/MOSI/MISO can partially power a device into a half-awake state, causing non-Hi-Z behavior or unexpected bus loading.

Hardware mitigations (default-safe first)

Firmware mitigations (boot order + recovery sequences)

Diagram · Power-up Hi-Z can float CS unless SAFE/EN gates selection

The 3-step isolation method (fast, repeatable)

Analyzer trigger templates (CS-focused)

• CS edge + protocol decode: run per-CS decode sessions and compare transaction counts and error ratios.
• Glitch capture: trigger on pulses shorter than a defined width (or use a “runt pulse” detector if available).
• Frame boundary break: trigger when CS toggles during an active transfer or mid-byte.
• Turnaround window audit: measure time between CS deassert and next CS assert; compare to the required safe window budget.

Signature patterns → likely cause (fast interpretation)

Diagram · Debug flow: symptom → checks → fix path (contention / glitch / timing / wrong select)

• Ownership contract is explicit: which phase drives SDIO (CMD/ADDR/DATA) and when TA is inserted.
• TA guard is defined: TA_GUARD = X cycles (placeholder) and includes disable/enable + line settle + receiver setup.
• Safe default states: at power-up/reset SDIO is forced to input/Hi-Z; all CS lines default to not-selected.
• Contention energy is limited: series-R (X–Y Ω placeholder) and/or OE gating isolates drivers during TA.
• Dummy/discard hooks exist: configurable dummy cycles and/or discard-first-bit/byte after handoff.
• Recovery ladder exists: L0/L1/L2 recovery steps; all exits end with CS deasserted and SDIO Hi-Z.
• Logging fields are reserved: txn_id, phase_fail, error_code, retries, duration_us, own_grant_us, recovery_level.
• Multi-slave discipline is enforceable: exactly one active CS at a time; CS guard time around switching.
• Probe points are planned: access to CS/SCLK/SDIO (and optional OE/DIR) for bring-up and production.

• Capture the minimum set: CS, SCLK, SDIO (plus optional OE/DIR).
• TA Hi-Z proof: SDIO has no drive activity inside TA; trigger on CS edge + TA window.
• Handoff glitch proof: no short spikes/pulses on SDIO at TA enter/exit.
• First-byte stability: verify whether dummy cycles / discard-first is required; confirm with first-byte anomaly trigger.
• Fault injection A (direction stuck): intentionally prevent direction switch; verify bounded timeout and recovery (no deadlock).
• Fault injection B (reduce TA): reduce TA_GUARD; confirm errors increase in the expected window (proves sensitivity and tooling).
• Boundary sweep: sweep SCLK from low to high; record first-fail frequency and failure phase (CMD/TA/RX/TX).
• Recovery ladder exercise: verify L0/L1/L2 recovery returns to IDLE (CS deasserted, SDIO Hi-Z) within X ms (placeholder).

• Corner coverage: validate across temperature/voltage corners; record phase_fail distribution.
• Lot-to-lot consistency: compare boundary sweep results and retry/timeout rates between lots.
• Production test mode: fixed pattern write/read (or read-only) that exercises TA and first-byte regions.
• Minimum logging retained: txn_id, phase_fail, error_code, retries, duration_us, recovery_level.
• Thresholds (placeholders): retry rate ≤ X ppm; timeout rate ≤ X ppm; transaction duration P99 ≤ X us.
• Failure triage: define an action when thresholds are exceeded (retest/repair/derate mode), without allowing indefinite stalls.

• Sensors and mixed-signal peripherals that expose a single SDIO pin to save package pins (direction and dummy rules vary by vendor).
• Tightly pin-limited modules where a single isolation channel or single connector pin is preferred.
• Multi-drop boards where contention safety and reset defaults dominate overall reliability more than raw SCLK.

• No explicit statement of when the slave drives SDIO vs Hi-Z (ownership contract is ambiguous).
• CS inactive behavior is not guaranteed to be Hi-Z (multi-slave SDIO becomes unsafe).
• No tri-state timing guidance (tDIS/tEN absent) and system refuses to budget TA conservatively.
• Reset/power-up defaults allow active drive (first transaction fails or contention occurs at boot).