18.6.3 Clock Failure Detection Operation

The Clock Failure Detector (CFD) allows the user to monitor the external clock or crystal oscillator clock signal provided by the External Multipurpose Crystal Oscillator (XOSCn). It detects failing operation of the XOSCn clock, and supports switching to a safe clock in case of clock failure. The user can also switch from the safe clock to the XOSCn clock in case of clock recovery. The safe clock is derived from the DFLL48M with a configurable prescaler. This supports configuring the safe clock in order to fulfill the operative conditions of the microcontroller. The CFD operation is automatically suspended when the XOSCn clock is not requested in ONDEMAND mode or halted in STANDBY.

The user interface registers allow to enable, disable and configure the CFD. The Status register gives status on failure and clock switch conditions. The Clock Failure Detector can optionally trigger an interrupt or an event when a failure is detected.

Clock Failure Detection

At reset, the CFD is disabled. The CFD does not monitor the XOSCn clock when the oscillator is disabled (XOSCCTRLn.ENABLE = 0).

Before starting the CFD operation, the user must start and enable the safe clock source (DFLL48M). To start the CFD operation, the user must write a one to the CFD Enable bit in the External Oscillator Control register (XOSCCTRLn.CFDEN).

Note: Disabling then re-enabling the Clock Failure Detector must be done as follows:
  1. Disable the XOSC (XOSCCTRLn.ENABLE = 0).
  2. Disable the Clock Failure Detector (XOSCCTRLn.CFDEN = 0).
  3. Re-enable the Clock Failure Detector (XOSCCTRLn.CFDEN = 1).
  4. Re-enable the XOSC (XOSCCTRLn.ENABLE = 1).

After the start or restart of the XOSCn, the CFD does not detect failure until the start-up time, as configured by the Oscillator Start-Up Time (XOSCCTRLn.STARTUP) in the External Multipurpose Crystal Oscillator Control register, is elapsed. Once the XOSCn Start-Up Time is elapsed, the XOSCn clock is constantly monitored.

During a period of 4 safe clocks , the CFD watches for a clock activity from the XOSCn. There must be one rising and one falling XOSCn clock edges during a 4 safe clock periods to meet a non failure status. If no activity is detected, the failure status is asserted. The Clock Failure status bit in the Status register (STATUS.XOSCFAILn) is set. The Clock Failure interrupt flag bit in the Interrupt Flag register (INTFLAG.XOSCFAILn) is set. If the XOSCFAILn bit in the Interrupt Enable Set register (INTENSET.XOSCFAILn) is set, an interrupt is generated . An output event is generated as well, if the Event Output enable bit in the Event Control register (EVCTRL.CFDEOn) is set.

The XOSCn clock continues to be monitored after a clock failure. The Clock Failure status bit in the Status register (STATUS.XOSCFAILn) reflects the current XOSCn clock activity.

Note: The XOSC Ready bit (STATUS.XOSCRDY) must be ignored when a clock failure is detected: STATUS.XOSCFAIL must always be checked before STATUS.XOSCRDY, and STATUS.XOSCRDY must always be ignored when STATUS.XOSCFAIL=1.

Clock Switch

When a clock failure is detected, the XOSCn clock is replaced by the safe clock in order to maintain an active clock during the XOSCn clock failure. The safe clock source is the DFLL48M oscillator clock. The safe clock source can be downscaled with a configurable prescaler to ensure that the safe clock frequency does not exceed the operating conditions selected by the application. When the XOSCn clock is switched to the safe clock, the Clock Switch bit (STATUS.XOSCCKSWn) in the Status register is set.

When the CFD has switched to the safe clock, the XOSCn is not disabled. The application must take the necessary actions to disable the oscillator N. The application must also take the necessary actions to configure the system clocks to continue normal operations.

In the case the application can recover the XOSCn , it can switch back to the XOSCn clock by writing a one to Switch Back bit (XOSCCTRLn.SWBEN) in the External Oscillator Control register. Once the XOSCn clock is switched back, the Switch Back bit (XOSCCTRLn.SWBEN) is cleared by the hardware.

Note: Entering Low-Power Sleep mode will not be possible if the clock switch back cannot complete due to a persistent failure. In this specific situation, disable the Clock Failure Detector (XOSCCTRL.CFDEN = 0) which will also clear the XOSCCTRL.SWBEN bit.

Prescaler

The CFD has an internal configurable prescaler (XOSCCTRLn.CFDPRESC) to generate the safe clock from the DFLL48M clock. The prescaler size allows to scale down the DFLL48M clock such that the safe clock is not higher than the XOSCn clock frequency monitored by the CFD. The frequency divider is 2^CFDPRESC where CFDPRESC range from 0 to 15.

Example: for an external crystal oscillator at 8 mHz and the DFLL48M internal oscillator configured to generate a 48 mHz clock, the prescaler should select a downscale value above 6 (48/8), eg. 8, thus CFDPRESC=3.

Event

If the Event Output enable bit in the Event Control register (EVCTRL.CFDEOn) is set, the CFD clock failure will be output on the Event Output. When the CFD is switched to the safe clock, the CFD clock failure will not be output on the Event Output.

Sleep Mode

The CFD is halted depending on configuration of the XOSCn and the peripheral clock request. For further details, refer to the Sleep Behavior table above. The CFD interrupt can be used to wake up the device from sleep modes.