2.4 Assumed Safe States

If an internal error is detected and the assumed safety goals can no longer be met, the system must be placed into a safe state. These devices do not themselves have a designated safe state, and therefore the safe state of the system must be reached by other means. The System Integrator shall ensure that the system is always safe.

The DPLL has a freerun mode in which the fractional frequency offset of the DPLL, synthesizer, and all output clocks connected to the synthesizer is the same as the fractional frequency offset of the local oscillator connected to the OSCI pin. See dpll_mode_refsel_0::mode=000.

The DPLL also has a holdover state (in its forced reference mode and its automatic mode) and a forced holdover mode. In holdover state or forced holdover mode, the fractional frequency offset of the DPLL, synthesizer, and all output clocks connected to the synthesizer is the same as the fractional frequency offset of the DPLL when it was last in its locked state. See dpll_mode_refsel_0::mode.

Output clock signals can be manually or automatically stopped low, high or high-impedance. See the output_ctrl_x registers, bits 3:1, the output_squelch and output_squelch_mask registers, and the output_config mailbox register bit 0 (auto_squelch).

The DPLL’s state can be read at any time over the SPI or I²C interface.