Understanding STM32 Clock Failure and Its Continued Operation

The issue was raised by a customer and occurred on the STM32F103VDT6 device.

According to their engineer, in the product design, the STM32’s HSE external 8MHz crystal generates oscillation, and then through the STM32’s internal PLL, it is multiplied to 72MHz, serving as the system clock to drive the chip.

There is a dedicated watchdog chip outside the STM32, monitoring its operation. The internal software of the STM32 will generate pulses on a pin to reset the watchdog. If the STM32 fails to generate the reset pulse in time, the watchdog will consider the STM32 is running abnormally and will reset it.

During reliability testing of the product, a test was conducted to verify the watchdog’s ability to monitor clock failure. The method was to ground the two terminals of the external HSE crystal to stop oscillation and verify if the watchdog could reset the STM32.

The test results showed that the watchdog did not generate a reset action. Further testing found that the STM32 was still sending reset pulses to the watchdog under failure conditions.

Repeated testing confirmed the phenomenon they described was true. Checking the software code confirmed that the software did not enable the STM32’s CSS function. The code was modified to send the PLL’s division output from the STM32’s MCO pin for easier observation with an oscilloscope.

By controlling whether the crystal’s pins are grounded, the HSE oscillation can be controlled. When the HSE oscillates normally, the signal frequency output from the MCO is 36MHz. When the HSE stops oscillating, the frequency of the signal sent from the MCO is around 1.7MHz, as shown in Figure (1):

By observing the control bits of SWS in the RCC_CFGR register, its value is [10], indicating that the system clock at this time indeed comes from the output of the PLL.

From the STM32F103VD data sheet, relevant parameters of the PLL were found as shown in Table (1):

The output frequency range of the PLL is 16MHz – 72MHz. This means that when the PLL is in a phase-locked state, it can output clock signals ranging from 16MHz to 72MHz.

However, when the input signal frequency is too low, causing the output signal frequency to drop below 16MHz, it may enter an unlocked state. In this state, the frequency of the output signal may not conform to the established multiplication and division relationship with the input signal frequency. More precisely, it cannot be concluded through the formula:

“When the input signal frequency is zero, the output signal frequency is also zero”. This point coincides with the measured results.

The PLL of the STM32 can still maintain oscillation at the lowest frequency point without an input signal, producing output. As a result, the CPU and other peripherals can continue to operate under the clock driven by the PLL. Therefore, judging whether the HSE has failed by determining whether there is a clock to drive the CPU to execute instructions is not feasible.

Handling:

The CSS function in STM32 is specifically designed to detect and handle HSE failures. However, this function is disabled after the STM32 resets and needs to be enabled by software to take effect.

When the CSS unit detects an HSE failure, it enables the HSI and switches the system clock to the HSI output. At the same time, it disables the HSE, and if the input signal to the PLL comes from the output of the HSE, it will also disable the PLL.

While adjusting the clock, the CSS unit will also generate an NMI interrupt request and a brake signal to the advanced timer. The NMI interrupt request will create an NMI interrupt so that the user program can perform emergency handling in the interrupt service routine, while the brake signal will put the advanced timer into a brake state to prevent the motor drive bridge arm controlled by it from overcurrent due to loss of control.

The user program can attempt to restore the HSE and PLL functions in the NMI interrupt service routine or can use a trap to keep the program flow in the service routine, waiting for the watchdog to reset the entire system.