Why is the CPU still running after the clock fails?

problem:

This issue was raised by a customer and occurred on the STM32F103VDT6 device. According to his engineers, in the design of its products, the STM32's HSE external 8MHz crystal oscillates and then multiplies to 72MHz through the STM32's internal PLL, which acts as the STM32's system clock to drive the chip. There is a dedicated watchdog chip on the outside of the STM32 to monitor the operation of the STM32. Software within the STM32 will generate a pulse on one of the STM32 pins to reset the watchdog. Once the STM32 does not generate a pulse to reset the dog in time, the watchdog will assume that the STM32 is not functioning properly, thus resetting the STM32. During the reliability test of the product, a test was performed on the ability of the watchdog to monitor the clock failure. The test method is to ground the two terminals of the external crystal of HSE to stop the oscillation, so as to verify whether the watchdog can make a reset action on the STM32. The test results show that the watchdog did not produce a reset action. Further testing found that the STM32 is still sending a reset pulse to the watchdog in the event of a failure.

Research:

Repeat the test to confirm that the phenomenon is true. Check the software code to verify that the software does not have the CSS feature enabled for STM32. Modify the code to send the PLL's divide-by-2 frequency from the STM32's MCO pin for easy viewing with an oscilloscope. Controls whether the HSE oscillates by controlling whether the pins of the crystal are grounded. When the HSE oscillates normally, the frequency of the signal sent by the MCO is 36MHz. When the HSE stops oscillating, the frequency of the signal sent by the MCO is around 1.7MHz, as shown in Figure (1):

The SWS control control bit in the RCC_CFGR register is observed by the debugger with a value of [10], indicating that the system clock at this time does come from the output of the PLL.

Find the PLL related parameters from the data sheet of the STM32F103VD as shown in Table (1):

Among them, the output frequency range of the PLL is 16MHz – 72MHz. In other words, the PLL can output a 16MHz – 72MHz clock signal while it is in phase lock. When the input signal frequency is too low and the output signal frequency is lower than 16MHz, it may be in a state of loss of lock. In this state, the frequency of its output signal and the frequency of the input signal do not necessarily match the set multiplier and frequency division relationship. More precisely, you can't pass the formula:

It is concluded that the frequency of the output signal is zero when the input signal frequency is zero. This is consistent with the measured results.

in conclusion:

The STM32's PLL can still oscillate at the lowest frequency without an input signal, producing an output. As a result, the CPU and other peripherals can still be driven by the clock sent by the PLL. Therefore, it is not feasible to judge whether the HSE is invalid or not by judging whether or not there is a clock to drive the CPU to execute an instruction.

deal with:

Make the following modifications to the software:

1. In the initialization section of the software, enable the CSS function of STM32;

2. Modify the NMI interrupt service routine and add the while(1) trap statement.

When the CSS function is enabled, when the HSE fails, the STM32 automatically turns on the HSI and switches the source of the system clock to the HSI output, which also generates an NMI interrupt. In this way, the flow of the program will stay in the NMI and will not generate a pulse of the watchdog that resets the off-chip. When the off-chip watchdog overflows, the STM32 is reset to return it to its normal position.

Suggest:

The CSS functionality in STM32 is specifically designed to detect and handle HSE failures. However, this function is disabled after the STM32 is reset and will need to be enabled by the software. When the CSS unit detects an HSE failure, it enables the HSI and switches the system clock to HSI. At the same time, it turns off the HSE, and if the PLL's input signal comes from the HSE's output, it also turns off the PLL. While the CSS unit is making clock adjustments, it also generates an NMI interrupt request and a brake signal to the advanced timer. The NMI interrupt request generates an NMI interrupt so that the user program can perform emergency processing in the interrupt service routine, and the brake signal causes the advanced timer to enter the braking state to prevent the motorized drive arm controlled by it from losing control. flow. The user program can attempt to recover the HSE and PLL functions in the NMI Interrupt Service Routine, or use traps to keep the program's flow in the service program, waiting for the watchdog to reset the entire system.