28.5 Fail-Safe Clock MonitorThe Fail-Safe Clock Monitor (FSCM) allows themicrocontroller to continue operation in the event of anexternal oscillator failure by automatically switching thedevice clock to the internal oscillator block. The FSCMfunction is enabled by setting the FCMEN Configurationbit.When FSCM is enabled, the LF-INTOSC oscillator runsat all times to monitor clocks to peripherals and providea backup clock in the event of a clock failure. Clockmonitoring (shown in Figure 28-4) is accomplished bycreating a sample clock signal, which is the output fromthe LF-INTOSC divided by 64. This allows ample timebetween FSCM sample clocks for a peripheral clockedge to occur. The peripheral device clock and thesample clock are presented as inputs to the ClockMonitor (CM) latch. The CM is set on the falling edge ofthe device clock source, but cleared on the rising edgeof the sample clock.FIGURE 28-4: FSCM BLOCK DIAGRAMClock failure is tested for on the falling edge of thesample clock. If a sample clock falling edge occurswhile CM is still set, a clock failure has been detected(Figure 28-5). This causes the following:• The FSCM generates an oscillator fail interrupt bysetting bit, OSCFIF (PIR2)• The device clock source switches to the internaloscillator block (OSCCON is not updated to showthe current clock source – this is the fail-safecondition)• The WDT is resetDuring switchover, the postscaler frequency from theinternal oscillator block may not be sufficiently stable fortiming-sensitive applications. In these cases, it may bedesirable to select another clock configuration and enteran alternate power-managed mode. This can be done toattempt a partial recovery or execute a controlled shutdown. See Section 4.1.4 “Multiple Sleep Commands”and Section 28.4.1 “Special Considerations forUsing Two-Speed Start-up” for more details.To use a higher clock speed on wake-up, the INTOSCor postscaler clock sources can be selected to providea higher clock speed by setting bits, IRCF,immediately after Reset. For wake-ups from Sleep, theINTOSC or postscaler clock sources can be selectedby setting the IRCF bits prior to entering Sleepmode.The FSCM will detect only failures of the primary orsecondary clock sources. If the internal oscillator blockfails, no failure would be detected nor would any actionbe possible.28.5.1 FSCM AND THE WATCHDOG TIMERBoth the FSCM and the WDT are clocked by theINTOSC oscillator. Since the WDT operates with aseparate divider and counter, disabling the WDT hasno effect on the operation of the INTOSC oscillatorwhen the FSCM is enabled.As already noted, the clock source is switched to theINTOSC clock when a clock failure is detected.Depending on the frequency selected by theIRCF bits, this may mean a substantial change inthe speed of code execution. If the WDT is enabledwith a small prescale value, a decrease in clock speedallows a WDT time-out to occur and a subsequentdevice Reset. For this reason, Fail-Safe Clock eventsalso reset the WDT and postscaler, allowing it to starttiming from when execution speed was changed anddecreasing the likelihood of an erroneous time-out.