14.6.3 Clock Failure Detection Operation
The Clock Failure Detector (CFD) allows the user to monitor the external clock or crystal oscillator signal provided by the external oscillator (XOSC). The CFD detects failing operation of the XOSC clock with reduced latency, and supports switching to a safe clock source in case of clock failure. The user can also switch from the safe clock back to XOSC in case of recovery. The safe clock is derived from the OSC48M oscillator with a configurable prescaler. This allows configuring the safe clock in order to fulfill the operative conditions of the microcontroller.
In sleep modes, CFD operation is automatically disabled when the external oscillator is not requested to run by a peripheral. See the Sleep Behavior table above when this is the case.
The user interface registers allow to enable, disable, and configure the CFD. The Status register provides status flags on failure and clock switch conditions. The CFD can optionally trigger an interrupt or an event when a failure is detected.
Clock Failure Detection
The CFD is disabled at reset. The CFD does not monitor the XOSC clock when the oscillator is disabled (XOSCCTRL.ENABLE = 0).
Before starting CFD operation, the user must start and enable the safe clock source (OSC48M oscillator).
CFD operation is started by writing a '1' to the CFD Enable bit in the External Oscillator Control register (XOSCCTRL.CFDEN). After starting or restarting the XOSC, the CFD does not detect failure until the start-up time has elapsed. The start-up time is configured by the Oscillator Start-Up Time in the External Multipurpose Crystal Oscillator Control register (XOSCCTRL.STARTUP). Once the XOSC Start-Up Time is elapsed, the XOSC clock is constantly monitored.
During a period of 4 safe clocks (monitor period), the CFD watches for a clock activity from the XOSC. There must be at least one rising and one falling XOSC clock edge during 4 safe clock periods to meet non-failure conditions. If no or insufficient activity is detected, the failure status is asserted: The Clock Failure Detector status bit in the Status register (STATUS.XOSCFAIL) and the Clock Failure Detector interrupt flag bit in the Interrupt Flag register (INTFLAG.XOSCFAIL) are set. If the XOSCFAIL bit in the Interrupt Enable Set register (INTENSET.XOSCFAIL) is set, an interrupt is generated. If the Event Output enable bit in the Event Control register (EVCTRL.CFDEO) is set, an output event is generated.
After a clock failure is issued the monitoring of the XOSC clock continues, and the Clock Failure Detector status bit in the Status register (STATUS.XOSCFAIL) reflects the current XOSC activity. If the CFD is disabled (XOSCCTRL.CFDEN=0) the XOSC must be disabled (XOSCCTRL.ENABLE=0) before re-enabling the CFD. Not following this guideline can lead to a false clock failure detection.
When the XOSC Clock Failure Detector is enabled (XOSCCTRL.CFDEN=1) and a failure is detected (STATUS.XOSCFAIL=1), the XOSC ready bit is not cleared (STATUS.XOSCRDY=1). When checking the XOSC ready status, the state of the XOSC clock failure status (STATUS.XOSCFAIL) must be checked before the XOSC ready status bit and dismiss the XOSC ready status if the XOSC clock failure status is set (STATUS.XOSCFAIL=1).
Clock Switch
When a clock failure is detected, the XOSC clock is replaced by the safe clock in order to maintain an active clock during the XOSC clock failure. The safe clock source is the OSC48M oscillator clock. The safe clock source frequency can be scaled down by a configurable prescaler to ensure that the safe clock frequency does not exceed the operating conditions selected by the application. When the XOSC clock is switched to the safe clock, the Clock Switch bit in the Status register (STATUS.XOSCCKSW) is set.
When the CFD has switched to the safe clock, the XOSC is not disabled. If desired, the application must take the necessary actions to disable the oscillator. The application must also take the necessary actions to configure the system clocks to continue normal operations.
In case the application can recover the XOSC, the application can switch back to the XOSC clock by writing a '1' to Switch Back Enable bit in the Clock Failure Control register (XOSCCTRL.SWBEN). Once the XOSC clock is switched back, the Switch Back bit (XOSCCTRL.SWBEN) is cleared by hardware.
Prescaler
The CFD has an internal configurable prescaler to generate the safe clock from the OSC48M oscillator. The prescaler size allows to scale down the OSC48M oscillator so the safe clock frequency is not higher than the XOSC clock frequency monitored by the CFD. The division factor is 2^P, with P being the value of the CFD Prescaler bits in the CFD Prescaler Register (CFDPRESC.CFDPRESC).
Event
If the Event Output Enable bit in the Event Control register (EVCTRL.CFDEO) is set, the CFD clock failure will be output on the Event Output. When the CFD is switched to the safe clock, the CFD clock failure will not be output on the Event Output.
Sleep Mode
The CFD is halted depending on configuration of the XOSC and the peripheral clock request. For further details, refer to the Sleep Behavior table above. The CFD interrupt can be used to wake up the device from sleep modes.