ST STM32L4+ Series Reference Manual page 252

Reset and clock control (RCC)
6.2.10 Clock security system (CSS)
Clock Security System can be activated by software. In this case, the clock detector is
enabled after the HSE oscillator startup delay, and disabled when this oscillator is stopped.
If a failure is detected on the HSE clock, the HSE oscillator is automatically disabled, a clock
failure event is sent to the break input of the advanced-control timers (TIM1/TIM8 and
TIM15/16/17) and an interrupt is generated to inform the software about the failure (Clock
Security System Interrupt CSSI), allowing the MCU to perform rescue operations. The CSSI
is linked to the Cortex
Note: Once the CSS is enabled and if the HSE clock fails, the CSS interrupt occurs and a NMI is
automatically generated. The NMI will be executed indefinitely unless the CSS interrupt
pending bit is cleared. As a consequence, in the NMI ISR user must clear the CSS interrupt
by setting the CSSC bit in the
If the HSE oscillator is used directly or indirectly as the system clock (indirectly means: it is
used as PLL input clock, and the PLL clock is used as system clock), a detected failure
causes a switch of the system clock to the MSI or the HSI16 oscillator depending on the
STOPWUCK configuration in the
disabling of the HSE oscillator. If the HSE clock (divided or not) is the clock entry of the PLL
used as system clock when the failure occurs, the PLL is disabled too.
6.2.11 Clock security system on LSE
A Clock Security System on LSE can be activated by software writing the LSECSSON bit in
the Backup domain control register
hardware reset or RTC software reset, or after a failure detection on LSE. LSECSSON must
be written after LSE and LSI are enabled (LSEON and LSION enabled) and ready (LSERDY
and LSIRDY set by hardware), and after the RTC clock has been selected by RTCSEL and
LSIPREDIV is disabled.
Note: LSIPREDIV bit is available only on STM32L4P5xx and STM32L4Q5xx devices.
The CSS on LSE is working in all modes except VBAT. It is working also under system reset
(excluding power on reset). If a failure is detected on the external 32 kHz oscillator, the LSE
clock is no longer supplied to the RTC but no hardware action is made to the registers. If the
MSI was in PLL-mode, this mode is disabled.
In Standby mode a wakeup is generated. In other modes an interrupt can be sent to wakeup
the software (see
(RCC_CIFR),
The software MUST then disable the LSECSSON bit, stop the defective 32 kHz oscillator
(disabling LSEON), and change the RTC clock source (no clock or LSI or HSE, with
RTCSEL), or take any required action to secure the application.
The frequency of LSE oscillator have to be higher than 30 kHz to avoid false positive CSS
detection.
252/2301
®
-M4 NMI (Non-Maskable Interrupt) exception vector.
Clock interrupt clear register
Clock configuration register
Clock interrupt enable register
Clock interrupt clear register
RM0432 Rev 6
(RCC_BDCR). This bit can be disabled only by a
(RCC_CIER),
(RCC_CICR)).
(RCC_CICR).
(RCC_CFGR), and the
Clock interrupt flag register
RM0432