Skip to Content

Fail-Safe Clock Monitor (FSCM)

Last modified by Microchip on 2026/10/19 09:36

The Fail-Safe Clock Monitor (FSCM) is a hardware protection and recovery mechanism integrated into each CLKGEN and Phase-Locked Loop (PLL).

Key functions:

  • Detects clock generator and PLL failures
  • Automatically switches to a backup clock source on clock failure, generating an Oscillator Fail interrupt
  • Helps maintain safe system operation during clock fault conditions

In addition to the FSCM, the Oscillator Module also includes a separate Clock Monitor Module for advanced clock measurement and diagnostics.

Overview and Block Diagrams

Each CLKGEN and PLL includes an FSCM to provide clock protection and maintain safe system operation. FSCM is enabled using the CLKxCON.FSCMEN and/or PLLxCON.FSCMEN configuration bits.

Key FSCM functions include:

  • Automatically switching to a backup clock source
  • Generating an Oscillator Fail interrupt
  • Setting the associated CLKFAIL or PLLFAIL status flag

After a clock failure is detected, the fail-safe condition remains active until:

  • A device Reset occurs, or
  • The CLKGEN switches to a new stable clock source
PLL FSCM Block DiagramCLKGEN FSCM Block Diagram
FCSM Block Diagram PLLFCSM Block Diagram CLKGEN
  • FSCMs for PLL1 and PLL2
  • FSCM with Automatic Switchover to Backup Clock Source
  • Selectable backup sources: BOSC[3:0]
    • FRC, BFRC, POSC, REFI1, REFI2
  • FSCMs for each clock generator (1-14)
  • FSCM with Automatic Switchover to Backup Clock Source
  • Selectable backup sources: BOSC[3:0]
    • FRC, BFRC, POSC, REFI1, REFI2,  BFRC/244 (LPRC)
ex. PLL2CONbits.BOSC = CLK_SRC_FRC;
ex. CLK1CONbits.BOSC = CLK_SRC_FRC;

Before enabling FSCM for CLKGEN1, the backup clock source must already be active and stable, typically using FRC or BFRC.

Clock Selection Integrity Check

Each CLKGEN and PLL includes clock selection integrity checking to help detect clock selection errors. The logic continuously verifies the active clock source selection using the COSC bits.

If an invalid or corrupted clock selection is detected:

  • The SCSFAIL status bit is asserted
  • A clock error interrupt, CLKEInterrupt, is generated

The device also supports fault injection for validation and safety testing:

  • The CLKDIAG register can inject clock selection faults
  • This allows verification of fault detection and fail-safe operation

These features help improve:

  • Functional safety
  • Clock selection reliability
  • System robustness

Back to Top

Clock Monitor Module (CM) vs. FSCM

The Clock Monitor Module (CM) provides advanced clock monitoring, diagnostics, and validation, while the FSCM delivers real-time protection and automatic rollover.

Clock Monitor (CM)Fail-Safe Clock Monitor (FSCM)
  • The CM is a measurement and diagnostics tool
  • Measures clock behavior with precision
  • Detects drift, warnings, and failures
  • Provides detailed monitoring and analysis
  • CM deployed as a dedicated peripheral
  • FSCM is a protection and recovery mechanism
  • Detects core clock failures
  • Automatically switches to a backup clock on clock fail
  • Keeps the system running safely
  • FSCM integrated directly into each CLKGEN and PLL

Click Play ► to listen to commentary on the differences between the CM and FSCM:

Back to Top

Interrupts

The FSCM and clock selection integrity checking hardware functions provide interrupt features to help improve clock safety, fault detection and system reliability. Please visit the "Oscillator Module Interrupts" page to learn more.

Back to Top