I wonder if it is possible at run time to detect that an external Oscillator has gone bad and the application now falls back to internal Oscillator.. specially for the case of STM32F407 MCU?enter image description here

  • 1
    \$\begingroup\$ How do you plan to run the code which changes the clock source whilst there is no clock? \$\endgroup\$ – Oldfart Feb 14 '19 at 12:39
  • \$\begingroup\$ Thats a good question ;) Possibly by some smart hardware move instead of under software control. \$\endgroup\$ – scico111 Feb 14 '19 at 13:07
  • \$\begingroup\$ The reason to use a crystal over an internal oscillator are numerous but generally it comes down to precision/consistency. If your project can happy work with the internal oscillator why bother with the crystal in the first place? \$\endgroup\$ – IC_Eng Feb 14 '19 at 14:39
  • 1
    \$\begingroup\$ The clock security system, if enabled, will switch to an internal clock so you can still recover from that and shut down things gracefully, or continue at reduced speed or reduced accuracy if necessary. In this case, it falls back to the 16MHz HSI RC, and triggers a clock fail interrupt. User code can then do whatever it likes, like reconfigure it via PLL to get 168 MHz core clock again, or just run at the 16 MHz directly, or wait for the external clock to start again. The internal oscillator is only factory calibrated to 1% which may not be accurate enough for some interfaces like Ethernet. \$\endgroup\$ – Justme Feb 14 '19 at 17:49

Read the manual instead of some "datasheet". Manual chapter 6.2.7

6.2.7 Clock security system (CSS)

The clock security system can be activated by software. In this case, the clock detector is enabled after the HSE oscillator startup delay, and disabled when this oscillator is stopped. If a failure is detected on the HSE clock, this oscillator is automatically disabled, a clock failure event is sent to the break inputs of advanced-control timers TIM1 and TIM8, and an interrupt is generated to inform the software about the failure (clock security system interrupt CSSI), allowing the MCU to perform rescue operations. The CSSI is linked to the Cortex®-M4 with FPU NMI (non-maskable interrupt) exception vector.

As explained in another answer, the internal RC oscillator will kick in to let you continue executing code dealing with the failure. This is sometimes referred to as "limp home mode" and is pretty much standard on modern MCUs.


From the datasheet you link,

2.2.12 Clocks and startup

On reset the 16 MHz internal RC oscillator is selected as the default CPU clock. The 16 MHz internal RC oscillator is factory-trimmed to offer 1% accuracy over the full temperature range. The application can then select as system clock either the RC oscillator or an external 4-26 MHz clock source. This clock can be monitored for failure. If a failure is detected, the system automatically switches back to the internal RC oscillator and a software interrupt is generated (if enabled).

There is already hardware in the chip, and a system in place to do what you want.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.