PIC18F2331/2431/4331/4431
To use a higher clock speed on wake-up, the INTOSC
or postscaler clock sources can be selected to provide
23.4 Fail-Safe Clock Monitor
The Fail-Safe Clock Monitor (FSCM) allows the
microcontroller to continue operation, in the event of an
external oscillator failure, by automatically switching
the system clock to the internal oscillator block. The
FSCM function is enabled by setting the Fail-Safe
Clock Monitor Enable bit, FCMEN (CONFIG1H<6>).
a higher clock speed by setting bits, IRCF<2:0>, imme-
diately after Reset. For wake-ups from Sleep, the
INTOSC or postscaler clock sources can be selected
by setting the IRCF<2:0> bits prior to entering Sleep
mode.
Adjustments to the internal oscillator block using the
OSCTUNE register also affect the period of the FSCM
by the same factor. This can usually be neglected, as
the clock frequency being monitored is generally much
higher than the sample clock frequency.
When FSCM is enabled, the INTRC oscillator runs at
all times to monitor clocks to peripherals and provide
an instant backup clock in the event of a clock failure.
Clock monitoring (shown in Figure 23-3) is
accomplished by creating a sample clock signal, which
is the INTRC output divided by 64. This allows ample
time between FSCM sample clocks for a peripheral
clock edge to occur. The peripheral system clock and
the sample clock are presented as inputs to the Clock
Monitor latch (CM). The CM is set on the falling edge of
the system clock source, but cleared on the rising edge
of the sample clock.
The FSCM will detect failures of the primary or second-
ary clock sources only. If the internal oscillator block
fails, no failure would be detected, nor would any action
be possible.
23.4.1
FSCM AND THE WATCHDOG TIMER
Both the FSCM and the WDT are clocked by the
INTRC oscillator. Since the WDT operates with a
separate divider and counter, disabling the WDT has
no effect on the operation of the INTRC oscillator when
the FSCM is enabled.
FIGURE 23-3:
FSCM BLOCK DIAGRAM
Clock Monitor
Latch (CM)
(edge-triggered)
As already noted, the clock source is switched to the
INTOSC clock when a clock failure is detected.
Depending on the frequency selected by the
IRCF<2:0> bits, this may mean a substantial change in
the speed of code execution. If the WDT is enabled
with a small prescale value, a decrease in clock speed
allows a WDT time-out to occur and a subsequent
device Reset. For this reason, Fail-Safe Clock Monitor
events also reset the WDT and postscaler, allowing it to
start timing from when execution speed was changed
and decreasing the likelihood of an erroneous time-out.
Peripheral
Clock
S
Q
INTRC
Source
C
Q
÷ 64
(32 s)
488 Hz
(2.048 ms)
Clock
Failure
Detected
23.4.2
EXITING FAIL-SAFE OPERATION
The fail-safe condition is terminated by either a device
Reset, or by entering a power-managed mode. On Reset,
the controller starts the primary clock source specified in
Configuration Register 1H (with any required start-up
delays that are required for the oscillator mode, such as
the OST or PLL timer). The INTOSC multiplexer provides
the system clock until the primary clock source becomes
ready (similar to a Two-Speed Start-up). The clock system
source is then switched to the primary clock (indicated by
the OSTS bit in the OSCCON register becoming set). The
Fail-Safe Clock Monitor then resumes monitoring the
peripheral clock.
Clock failure is tested for on the falling edge of the
sample clock. If a sample clock falling edge occurs
while the CM is still set, a clock failure has been
detected (Figure 23-4). This causes the following:
• the FSCM generates an oscillator fail interrupt by
setting bit, OSCFIF (PIR2<7>);
• the system clock source is switched to the internal
oscillator block (OSCCON is not updated to show
the current clock source – this is the fail-safe
condition); and
• the WDT is reset.
Since the postscaler frequency from the internal
oscillator block may not be sufficiently stable, it may be
desirable to select another clock configuration and
enter an alternate power-managed mode (see
Section 23.3.1 “Special Considerations for Using
Two-Speed Start-up” and Section 4.1.4 “Multiple
Sleep Commands” for more details). This can be
done to attempt a partial recovery or execute a
controlled shutdown.
The primary clock source may never become ready
during start-up. In this case, operation is clocked by the
INTOSC multiplexer. The OSCCON register will remain in
its Reset state until a power-managed mode is entered.
Entering a power-managed mode by loading the
OSCCON register and executing a SLEEP instruction
will clear the fail-safe condition. When the fail-safe
condition is cleared, the clock monitor will resume
monitoring the peripheral clock.
2010 Microchip Technology Inc.
DS39616D-page 277
MICROCHIP [ MICROCHIP ]
