PIC18F2450/4450
The FSCM will detect failures of the primary or
secondary clock sources only. If the internal oscillator
fails, no failure would be detected, nor would any action
be possible.
18.4 Fail-Safe Clock Monitor
The Fail-Safe Clock Monitor (FSCM) allows the
microcontroller to continue operation in the event of an
external oscillator failure by automatically switching the
device clock to the internal oscillator. The FSCM function
is enabled by setting the FCMEN Configuration bit.
18.4.1
FSCM AND THE WATCHDOG TIMER
Both the FSCM and the WDT are clocked by the
INTRC oscillator. Since the WDT operates with a
separate divider and counter, disabling the WDT has
no effect on the operation of the INTRC oscillator when
the FSCM is enabled.
When FSCM is enabled, the INTRC oscillator runs at all
times to monitor clocks to peripherals and provide a
backup clock in the event of a clock failure. Clock
monitoring (shown in Figure 18-3) is accomplished by
creating a sample clock signal, which is the INTRC output
divided by 64. This allows ample time between FSCM
sample clocks for a peripheral clock edge to occur. The
peripheral device clock and the sample clock are
presented as inputs to the Clock Monitor latch (CM). The
CM is set on the falling edge of the device clock source,
but cleared on the rising edge of the sample clock.
If the WDT is enabled with a small prescale value, a
decrease in clock speed allows a WDT time-out to
occur and a subsequent device Reset. For this reason,
Fail-Safe Clock Monitor events also reset the WDT and
postscaler, allowing it to start timing from when execu-
tion speed was changed and decreasing the likelihood
of an erroneous time-out.
FIGURE 18-3:
FSCM BLOCK DIAGRAM
18.4.2
EXITING FAIL-SAFE OPERATION
Clock Monitor
Latch (CM)
The fail-safe condition is terminated by either a device
Reset or by entering a power-managed mode. On
Reset, the controller starts the primary clock source
specified in Configuration Register 1H (with any start-
up delays that are required for the oscillator mode,
such as OST or PLL timer). The INTRC provides the
device clock until the primary clock source becomes
ready (similar to a Two-Speed Start-up). The clock
source is then switched to the primary clock (indicated
by the OSTS bit in the OSCCON register becoming
set). The Fail-Safe Clock Monitor then resumes
monitoring the peripheral clock.
(edge-triggered)
Peripheral
Clock
S
Q
INTRC
Source
Q
÷ 64
C
488 Hz
(2.048 ms)
(32 μs)
Clock
Failure
Detected
Clock failure is tested for on the falling edge of the
sample clock. If a sample clock falling edge occurs
while CM is still set, a clock failure has been detected
(Figure 18-4). This causes the following:
The primary clock source may never become ready
during start-up. In this case, operation is clocked by the
INTRC. The OSCCON register will remain in its Reset
state until a power-managed mode is entered.
• the FSCM generates an oscillator fail interrupt by
setting bit, OSCFIF (PIR2<7>);
• the device clock source is switched to the internal
oscillator (OSCCON is not updated to show the cur-
rent clock source – this is the fail-safe condition); and
• the WDT is reset.
DS39760A-page 204
Advance Information
© 2006 Microchip Technology Inc.
MICROCHIP [ MICROCHIP ]
