S32K142: how do the clock monitors work and what types of errors can be detected?

[Matthias_LEHMANN]

Hi,

In our application we're using an external 8MHz Crystal Oscillator as a clock source for the S32K142. I'm now doing an FMEDA on system level. The failure modes I'm considering for the external oscillator are "total loss of signal output" and "frequency drift". From the datasheet and reference manual of the S32K142 it is not clear to me how the controller would react to these failures.

For the total loss of external signal input, how would the controller react? Would it simply halt because it's not being clocked anymore? Or would the PLL essentially go into an open loop mode and still output a certain clock signal to allow the controller to continue to run, only that it's now less accurate and probably not the intended frequency anymore? Which error signal would essentially indicate this fault?

For the frequency-drift of the external oscillator's signal: there is mention of the "SOSC clock monitor", wich apparently compares the external input to the SIRC, but no description on how that actually works. Would that monitor be able to detect a drift of the external oscillator's input or only a total loss of it? (given the fact that the external input can vary between 4 and 40MHz and I couldn't find any configuration options for that monitor to specify what the expected frequency is, drift detection appears unlikely to me...). Or would I also have to rely on the PLL in that case? I found another forum post that referred to the "lock exit frequency tolerance" (D_UNL) in the datasheet, which is 6% maximum. So can I assume that every frequency drift of more than 6% is detected, no matter what the base frequency of the external oscillator is?

What would be the typical or intended reaction in the "application space" to one of these faults? To switch to another clock source (e.g. the SIRC)?

Best regards

Matthias

[VaneB]

Hi @Matthias_LEHMANN 

The core clock does not change automatically to the FIRC if it detects a Loss of lock, so the core clock remains sourced from the PLL all the time. Still, if there is a time when the PLL does not receive the clock from the oscillator, then it will not clock the Core, and it will not continue operating.

My recommendation is not to reenable the OSC and the PLL, and if this cannot be avoided, then before making this change, ensure the core clock is sourced from an internal clock (FIRC), but you need to do It manually.

B.R.

VaneB

[Matthias_LEHMANN]

Thanks @VaneB.

we're using the S32K142 in a safety-related application, and the safety manual states:

[SM_078] Before executing any safety function, a high quality clock (low noise, low likelihood for glitches) based on an external clock source shall be configured as the system clock of the S32K14x and S32K14xW.

So based on that assumption, we've opted for the external oscillator as input for the SPLL, which we're using also on other non-safety products to ensure sufficient clock stability and accuracy. So your recommendation seems to contradict the assumption in the safety manual.

Coming back to my question: The controller provides error flags to indicate a loss of clock (LOC) or loss of lock (LOL). There's nowhere a description, how these flags are actually computed. For my analysis I think I need more details to be able to assess if a drift of the external clock-source is picked up by these flags or not. And if yes, which extend of drift would be detectable. Could you please provide additional details on these error flags to allow me to complete my analysis.

Thank you, Matthias

PS: I posted my question in this non-safety product forum, because I feel the general functionality of the "loss-of-lock" detection should be independent of the safety classification of the application.

[VaneB]

Hi @Matthias_LEHMANN 

Regarding my previous answer, what I explained was about what happens when you run out of the SOSC clock.

What is mentioned in the safety manual is regarding a recommendation regarding the qualities of the clock that you should use.

If you think I contradicted myself, I apologize for the misunderstanding.

Regarding LOC and LOL, as mentioned in the post to which you referred, the LOC error flag is set when SOSC pulses are not detected for 8 to 16 clock cycles of SIRC/256 and the LOL error flag is set when the PLL reference is out of range and is constantly modulated such that 3 consecutive un-locked samples of the reference clock are generated.