# S6 reliability candidate

The owner reports that S5 eventually crashes at 40, 50 and 60 MHz. The exact
workload, failure signature and lower-speed comparison have been requested.
No root cause or hardware fix is established yet. S5 remains preserved as
`setup-s5-20260917`; this branch prepares a candidate for comparison.

FPGA **PI FMG260917S650Mhz** retains the S5 clock/OSD ABI and pairs with the
unchanged **MM2609S5** ARM firmware. Default 50 MHz and all five turbo profiles
are retained. No ARM update is required when MM2609S5 is already installed.

## Targeted changes

S5's read-completion-to-cache-write-enable path had only +0.511 ns slack at
60 MHz, crossing from a rising-edge synchronizer into falling-edge BRAM.
S6 adds a falling-edge ready register after the existing two rising-edge
synchronizer stages. Refill control then gets a full CPU cycle before BRAM
commit. The external ACK still follows the actual fill receipt. Uncached
reads take one additional CPU cycle; cache-hit timing is unchanged. The
extra stage also increases held-data settling time. Abort clearing and the
registered-word lifetime are retained.

S5's longest chipset path ran from the floppy FIFO write pointer through
DMA selection to SRAM write-enable: 19 logic levels and +0.281 ns slack.
S6 registers the post-edge full flag from both next pointers. This preserves
full/empty/count and data behaviour, including simultaneous transfers and
pointer wrap, while removing pointer comparison from the DMA output path.

CPU frequency constraints, ACK/output budgets, jitter reserve and existing
Normal-only classifications are unchanged. No new timing exception is added.
The read-capture audit now checks the ready-stage half-cycle, its full-cycle
receipt path and the longer 2.5-cycle refill/3-cycle ACK lower bounds. Source
proofs reject bypasses of the new admission/receipt stage.

## Checks

The FIFO test covers 208198 cycles, full/drain, simultaneous read/write and
wrap. CPU-return tests check aborts, release skew, ownership, data hold and
refill-before-ACK, with five mutation controls. The release-skew negative
control uses the opposite CCK parity to compensate for the extra Normal
read cycle. The late-write-strobe negative control likewise uses phase 0
and a paired unmodified-core check after the changed read latency shifted
its later write alignment. A separate stress runner performs 100000 CPU/cache reads and
writes at each of 40, 50 and 60 MHz using the existing pin-delay model.

The full FPGA regression suite, additional CPU-return/SRAM/retirement checks
at 40 and 60 MHz, and all three 100000-transfer stress runs pass. The full
suite includes the default 50 MHz, Normal mode, all profile transitions,
peripherals and source-proof negative controls. The ARM build and host tests
also pass, including reading the new S6 FPGA identity. The rebuilt ARM raw
and upgrade images are byte-for-byte identical to released MM2609S5.

The initial stress harness declared its adjustable parameters in a form
that prevented overrides; those parameters now appear in the module's
parameter list. The late-strobe negative control needed the phase adjustment
described above. Both test-only corrections were rerun successfully; their
initial logs and final results are retained. The 28 FPGA build inputs stayed
identical throughout qualification.

## Routed timing

The selected implementation is **batch B, seed 8**, built from
`07b02e051cee8a6400fd42afd2c5459de5c84b5d`. Three groups of four simultaneous
ISE compiles produced 12 routes from exactly the same FPGA inputs. Main,
Normal and component timing each have zero errors for B/8, and all seven
independent route audits pass. Failed routes and the other qualified
candidates are preserved in the evidence archive.

| Timing measure | Released S5 F/8 | S6 B/8 |
| --- | ---: | ---: |
| CPU slack, 16.584513 ns period | +0.511 ns | +2.576 ns |
| Chipset 28 MHz slack | +0.281 ns | +3.798 ns |
| Chipset 7 MHz slack | +2.783 ns | +5.777 ns |
| Read-return output slack, 16 ns budget | +1.393 ns | +1.886 ns |
| ACK output slack, 5.75 ns budget | +0.359 ns | +0.095 ns |
| Worst ACK output delay | 5.391 ns | 5.655 ns |
| 120 MHz divider slack | +2.126 ns | +1.005 ns |
| Minimum external ACK reference margin at 60 MHz | +1.079 ns | +1.040 ns |
| Clock-mux minimum margin | +3.072 ns | +3.381 ns |

CPU and chipset headroom improve substantially. ACK/output and divider
headroom are lower, so this is not an improvement to every path. The ACK
reference includes the routed forwarded clock, the existing 5 ns setup
reference and 0.5 ns reserve; its worst margin loses 0.039 ns. B/8 was chosen
for its balance of CPU/chipset margin and external bus timing. C/11's raw ACK
delay was lower, but its minimum external ACK reference margin was only
0.858 ns after accounting for its different clock route.

The S6 B/8 worst CPU path is clock-startup control to `CPU1/t_as`. The old
synchronizer-to-BRAM half-cycle refill path has been replaced by the ready
stage. Its synchronizer-to-ready setup margin is 5.982 ns and ready-to-receipt
setup margin is 13.558 ns, including the capture audit's 0.5 ns reserve.
The minimum held-data-to-refill bundle margin is 33.952 ns. Main timing
continues to check the actual BRAM controls independently.

B/8 uses 5531 LUTs, 3432 slices, 16 BRAMs, 6 multipliers and 6 global buffers.
ISE warning identifiers and counts match S5, including 61 synthesis warnings;
none were suppressed. The ARM rebuild has no compiler warnings. The package
records the exact binary/source hashes, original reports, all 12 sweep
results, functional tests and route-audit evidence.

These digital checks cannot reproduce board heating or prove the reported
intermittent crash resolved. The external timing reference is not an
electrical characterization of an overclocked 68SEC000 or the PCB; hardware
comparison remains necessary.

## Install and compare

Replace the SD-card root `MINIMIG1.BIN` with the candidate and restart.
If ARM **MM2609S5** is already installed, no ARM update is needed. The package
includes that same `FIRMWARE.UPG` for boards still on older firmware; install
it through the existing ARM upgrade menu if needed. The raw
`ARM_MM2609S5.bin` is for SAM-BA, not the menu updater.

Confirm FPGA **PI FMG260917S650Mhz** and ARM **MM2609S5** in the OSD. The FPGA
version suffix is the build default; the CPU clock footer shows the applied
speed. In Settings → Chipset select Turbo and the desired speed, then
**Apply clock & reset**. Save Settings retains that selection.

Repeat the workload that crashed, starting at 50 MHz and then comparing
40/60 MHz. Run long enough to exceed the previous time to failure, and also
check cold boots, Normal mode and OSD navigation. Record the active profile,
elapsed time and failure symptoms. Keep the same RAM configuration and the
enabled slow-RAM-priority command in User-Startup. FAST RAM remains uncached;
the additional uncached-read cycle may reduce its throughput.

To return to S5, copy `ROLLBACK-S5.BIN` to the SD-card root as `MINIMIG1.BIN`
and restart. ARM MM2609S5 can stay installed. The package changes no disk
image or startup configuration. S5's original release remains preserved;
its reported instability is recorded in the updated hardware notes.
