Why is the CPU still running after the clock fails?

Problem:

This issue was reported by a client using the STM32F103VDT6 microcontroller. In their design, the STM32's High-Speed External (HSE) crystal oscillator operates at 8 MHz and is multiplied to 72 MHz via the internal Phase-Locked Loop (PLL). This 72 MHz clock serves as the system clock driving the entire chip. Additionally, an external watchdog IC monitors the STM32's operation. Software running on the STM32 periodically sends a pulse to the watchdog pin to reset it. If the STM32 fails to send these pulses on time, the watchdog assumes the MCU isn’t functioning correctly and triggers a reset. During product reliability testing, a specific test was conducted to check the watchdog’s response to HSE clock failures. The test involved grounding the terminals of the HSE crystal to stop its oscillation. Surprisingly, the watchdog failed to reset the STM32 despite the expected clock failure. Further investigation revealed that the STM32 continued to send reset pulses to the watchdog even when the HSE stopped oscillating.

Investigation:

To confirm the issue, we repeated the test and verified the phenomenon. Upon reviewing the software code, we discovered that the Clock Security System (CSS) feature in the STM32 wasn't enabled. To better analyze the situation, we modified the code to route the PLL's divided-by-two frequency to the MCO pin, allowing us to easily observe the output using an oscilloscope. By grounding the HSE crystal pins, we could control whether the HSE oscillated. When the HSE oscillated normally, the MCO output was 36 MHz. When the HSE stopped oscillating, the MCO output dropped to approximately 1.7 MHz, as illustrated in Figure (1):

Using the debugger, we observed that the SWS control bits in the RCC_CFGR register were set to [10], confirming that the system clock was still sourced from the PLL output.

From the STM32F103VD datasheet, we extracted the PLL configuration parameters, as shown in Table (1):

According to the datasheet, the PLL's output frequency ranges between 16 MHz and 72 MHz when locked. If the input signal frequency drops below a certain threshold, the PLL may lose lock and fail to maintain the correct multiplication ratio. In extreme cases, where the input frequency is zero, the PLL's output frequency effectively becomes zero, which aligns with our measurements.

In Conclusion:

Even without an input signal, the STM32's PLL can continue to oscillate at a very low frequency, providing a clock output. This means the CPU and peripherals remain functional, making it impossible to determine the HSE's validity solely based on the presence of a clock driving the CPU to execute instructions.

Solution:

We implemented the following software modifications:

1. Enabled the CSS feature during the STM32's initialization process.

2. Modified the Non-Maskable Interrupt (NMI) service routine to include a while(1) trap statement.

With the CSS feature enabled, the STM32 automatically switches to the High-Speed Internal (HSI) oscillator when the HSE fails, switching the system clock source to HSI. This also triggers an NMI interrupt. The program flow remains trapped in the NMI handler, preventing the generation of watchdog reset pulses. When the external watchdog times out, it resets the STM32, restoring normal operation.

Suggestions:

The CSS feature in STM32 is specifically designed to detect and respond to HSE failures. However, this feature is disabled after a reset and must be re-enabled by software. When the CSS unit detects an HSE failure, it activates the HSI, disables the HSE, and, if applicable, disables the PLL. During this process, the CSS unit generates an NMI interrupt and a brake signal for the advanced timer. The NMI interrupt allows the user program to handle emergencies in the interrupt service routine, while the brake signal halts the advanced timer to prevent失控 behavior in motorized systems. In the NMI handler, users can attempt to restore HSE and PLL functionality or use traps to hold the program flow until the watchdog resets the system.