Infineon XMC4000 series User guide

Microcontrollers
XMC4000
Microcontroller Series
for Industrial Applications
Application Guide
V1.0 2013-04
Fail-safe Features
Voltage Supervision
Clock Supervision
Memory Integrity
Fail-safe Flash
Software Supervision
System Traps
Special Peripheral Features

Edition 2013-04
Published by
Infineon Technologies AG
81726 Munich, Germany
© 2013 Infineon Technologies AG
All Rights Reserved.
Legal Disclaimer
The information given in this document shall in no event be regarded as a guarantee of conditions or
characteristics. With respect to any examples or hints given herein, any typical values stated herein and/or any
information regarding the application of the device, Infineon Technologies hereby disclaims any and all
warranties and liabilities of any kind, including without limitation, warranties of non-infringement of intellectual
property rights of any third party.
Information
For further information on technology, delivery terms and conditions and prices, please contact the nearest
Infineon Technologies Office (www.infineon.com).
Warnings
Due to technical requirements, components may contain dangerous substances. For information on the types in
question, please contact the nearest Infineon Technologies Office.
Infineon Technologies components may be used in life-support devices or systems only with the express written
approval of Infineon Technologies, if a failure of such components can reasonably be expected to cause the
failure of that life-support device or system or to affect the safety or effectiveness of that device or system. Life
support devices or systems are intended to be implanted in the human body or to support and/or maintain and
sustain and/or protect human life. If they fail, it is reasonable to assume that the health of the user or other
persons may be endangered.

Fail-Safe Features
XMC4000 Family
Revision History
Revision History
Page or Item
Subjects (major changes since previous revision)
V1.0, 2013-04
Trademarks of Infineon Technologies AG
AURIX™, C166™, CanPAK™, CIPOS™, CIPURSE™, EconoPACK™, CoolMOS™, CoolSET™,
CORECONTROL™, CROSSAVE™, DAVE™, EasyPIM™, EconoBRIDGE™, EconoDUAL™,
EconoPIM™, EiceDRIVER™, eupec™, FCOS™, HITFET™, HybridPACK™, I²RF™, ISOFACE™,
IsoPACK™, MIPAQ™, ModSTACK™, my-d™, NovalithIC™, OptiMOS™, ORIGA™, PRIMARION™,
PrimePACK™, PrimeSTACK™, PRO-SIL™, PROFET™, RASIC™, ReverSave™, SatRIC™,
SIEGET™, SINDRION™, SIPMOS™, SmartLEWIS™, SOLID FLASH™, TEMPFET™, thinQ!™,
TRENCHSTOP™, TriCore™.
Other Trademarks
Advance Design System™ (ADS) of Agilent Technologies, AMBA™, ARM™, MULTI-ICE™, KEIL™,
PRIMECELL™, REALVIEW™, THUMB™, µVision™ of ARM Limited, UK. AUTOSAR™ is licensed by
AUTOSAR development partnership. Bluetooth™ of Bluetooth SIG Inc. CAT-iq™ of DECT Forum.
COLOSSUS™, FirstGPS™ of Trimble Navigation Ltd. EMV™ of EMVCo, LLC (Visa Holdings Inc.).
EPCOS™ of Epcos AG. FLEXGO™ of Microsoft Corporation. FlexRay™ is licensed by FlexRay
Consortium. HYPERTERMINAL™ of Hilgraeve Incorporated. IEC™ of Commission Electrotechnique
Internationale. IrDA™ of Infrared Data Association Corporation. ISO™ of INTERNATIONAL
ORGANIZATION FOR STANDARDIZATION. MATLAB™ of MathWorks, Inc. MAXIM™ of Maxim
Integrated Products, Inc. MICROTEC™, NUCLEUS™ of Mentor Graphics Corporation. Mifare™ of
NXP. MIPI™ of MIPI Alliance, Inc. MIPS™ of MIPS Technologies, Inc., USA. muRata™ of MURATA
MANUFACTURING CO., MICROWAVE OFFICE™ (MWO) of Applied Wave Research Inc.,
OmniVision™ of OmniVision Technologies, Inc. Openwave™ Openwave Systems Inc. RED HAT™
Red Hat, Inc. RFMD™ RF Micro Devices, Inc. SIRIUS™ of Sirius Satellite Radio Inc. SOLARIS™ of
Sun Microsystems, Inc. SPANSION™ of Spansion LLC Ltd. Symbian™ of Symbian Software Limited.
TAIYO YUDEN™ of Taiyo Yuden Co. TEAKLITE™ of CEVA, Inc. TEKTRONIX™ of Tektronix Inc.
TOKO™ of TOKO KABUSHIKI KAISHA TA. UNIX™ of X/Open Company Limited. VERILOG™,
PALLADIUM™ of Cadence Design Systems, Inc. VLYNQ™ of Texas Instruments Incorporated.
VXWORKS™, WIND RIVER™ of WIND RIVER SYSTEMS, INC. ZETEX™ of Diodes Zetex Limited.
Last Trademarks Update 2011-02-24

Fail-Safe Features
XMC4000 Family
Table of Contents
Application Guide 4 V1.0, 2013-04
Table of Contents
Voltage Supervision ..............................................................................................................................................6
1Voltage Supervision...........................................................................................................................7
1.1 Introduction...........................................................................................................................................7
1.2 Embedded Voltage Regulator..............................................................................................................7
1.3 Power-on Reset....................................................................................................................................7
1.4 PORST pin...........................................................................................................................................8
1.4.1 Power Validation ..................................................................................................................................9
1.4.2 Supply Watchdog...............................................................................................................................11
1.5 Supply Voltage Brown-out Detection .................................................................................................12
1.6 Hibernate Domain Power Management.............................................................................................13
1.6.1 Temporary Loss of VDDP Supply.........................................................................................................13
1.6.2 Prevention of Premature Coin Battery Discharging ...........................................................................13
Clock Supervision ...............................................................................................................................................15
2Clock Supervision............................................................................................................................16
2.1 Introduction.........................................................................................................................................16
2.2 Fail-safe System Clock ......................................................................................................................16
2.3 Backup Clock Source.........................................................................................................................17
2.3.1 High Precision Oscillator Watchdog Trap ..........................................................................................17
2.3.2 System PLL Loss-of-Lock Trap..........................................................................................................18
2.3.3 System PLL Loss-of-Lock Recovery..................................................................................................18
2.3.4 Emergency Mode...............................................................................................................................18
2.3.5 Fail-safe Clock Ratio Configuration....................................................................................................21
2.4 Fail-safe USB Clock...........................................................................................................................21
2.4.1 USB PLL Loss-of-Lock Trap ..............................................................................................................22
2.5 Fail-safe RTC Clock...........................................................................................................................22
2.5.1 RTC Clock Watchdog Trap................................................................................................................23
2.5.2 Emergency Mode Clock for RTC .......................................................................................................23
Memory Integrity..................................................................................................................................................24
3Memory Integrity Protection ...........................................................................................................25
3.1 Introduction.........................................................................................................................................25
3.2 Principle of Parity Check Operation...................................................................................................25
3.3 Parity Error on System SRAMs..........................................................................................................26
3.4 Parity Error on Peripheral Module SRAMs ........................................................................................26
3.5 System Reset Upon Parity Error........................................................................................................26
Fail-safe Flash......................................................................................................................................................27
4Fail-Safe Flash..................................................................................................................................28
4.1 Introduction.........................................................................................................................................28
4.2 Error Correction Codes (ECC) ...........................................................................................................28
4.2.1 Single-bit Error ...................................................................................................................................29
4.2.2 Double-bit Error..................................................................................................................................29
4.3 Reset During Flash Operation............................................................................................................29
4.3.1 Boot Fallback Mode (ABM) ................................................................................................................31
4.4 Flash Clock.........................................................................................................................................31
4.5 Wear-leveling .....................................................................................................................................31
4.6 Flash Write and OTP Protection ........................................................................................................32
4.6.1 Configuring Flash Protection in the UCB ...........................................................................................32
4.6.2 Write and OTP Protection Status.......................................................................................................33
4.7 Service Request Generation..............................................................................................................33
4.7.1 Interrupt Control .................................................................................................................................33

Fail-Safe Features
XMC4000 Family
Table of Contents
Application Guide 5 V1.0, 2013-04
4.7.2 Trap Control .......................................................................................................................................34
4.8 Handling Errors During Operation......................................................................................................35
4.8.1 SQER “Sequence Error” ....................................................................................................................35
4.8.2 PFOPER “Operation Error” ................................................................................................................36
4.8.3 PROER “Protection Error” ..................................................................................................................37
4.8.4 VER “Verification Error”......................................................................................................................38
4.8.5 PFSBER/DFSBER “Single-Bit Error” .................................................................................................39
4.9 Handling Flash Errors During Startup................................................................................................40
Software Supervision..........................................................................................................................................41
5Software Supervisory ......................................................................................................................42
5.1 Introduction.........................................................................................................................................42
5.2 Windowed Watchdog Timer (WDT) ...................................................................................................42
5.3 Flexible CRC Engine (FCE) ...............................................................................................................43
System Traps .......................................................................................................................................................44
6Traps and Interrupts ........................................................................................................................45
6.1 Introduction.........................................................................................................................................45
6.2 System Traps.....................................................................................................................................45
6.3 External Traps....................................................................................................................................46
6.4 System Critical Service Requests......................................................................................................47
Special Peripheral Features................................................................................................................................48
7Special Peripheral Features............................................................................................................49
7.1 Introduction.........................................................................................................................................49
7.2 WDT Special Functions......................................................................................................................49
7.2.1 Pre-warning Service Request ............................................................................................................49
7.2.2 WDT Service External Monitoring......................................................................................................50
7.3 Capture/Compare & PWM .................................................................................................................50
7.3.1 Hardware Emergency Shutdown .......................................................................................................50
7.3.2 Dead-Time Generation.......................................................................................................................51
7.3.3 Output Parity Checker........................................................................................................................51
7.3.4 Shadow Register and Hardware Register Update.............................................................................51
7.3.5 High Resolution PWM (HRPWM) Overload Protection......................................................................52
7.4 Digital I/Os..........................................................................................................................................53
7.4.1 Power Up and RESET .......................................................................................................................53
7.5 ADC Analog Input Out-of-Range Monitor ..........................................................................................53
7.6 Die Temperature Measurement.........................................................................................................53

Fail-Safe Features
XMC4000 Family
Voltage Supervision
Application Guide 6 V1.0, 2013-04
Voltage Supervision

Fail-Safe Features
XMC4000 Family
Voltage Supervision
Application Guide 7 V1.0, 2013-04
1 Voltage Supervision
Voltage Supervision fail-safe features enable monitoring of the voltage levels and automatic reaction
of the system to abnormal supply conditions in the application.
1.1 Introduction
The following fail-safe features are described in the subsequent sections:
Embedded Voltage Regulator
Power-on Reset
PORST pin
−Power Validation
−Supply Watchdog
Supply Voltage Brown-out Detection
−Temporary Loss of VDDP Supply
−Prevention of Premature Coin Battery Discharging
Hibernate Domain Power Management
1.2 Embedded Voltage Regulator
The Embedded Voltage Regulator (EVR) generates the core voltage VDDC out of the external supplied
voltage VDDP. A power-on reset is automatically generated on power-up when VDDP and VDDChave
reached valid levels. The EVR provides a Supply Watchdog (SWD) for the input voltage VDDP. The
generated core voltage VDDC is monitored by a power validation circuit (PV).
1.3 Power-on Reset
The EVR starts operation as soon as VDDP is above the defined minimum level.
Figure 1 Power-on Reset
The system is released from PORST reset when the external voltage VDDP and the generated voltage
VDDC are above the reset thresholds and have reached the nominal values (see Figure 1).

Fail-Safe Features
XMC4000 Family
Voltage Supervision
Application Guide 8 V1.0, 2013-04
Failure condition
During power-up VDDP voltage still too low to ensure proper function of
modules supplied with VDDP, which may potentially lead to for example to
Flash malfunction, I/O pads misbehavior, or unreliable VDDC generation in
EVR.
Fail-safe effect
PORST reset remains active preventing any activity when VDDP is too low.
1.4 PORST pin
The XMC4000 devices allow an unlimited long ramping of VDDP voltage without any side effects.
However, if the XMC4000 device is the reset master on the application board, it is required to ensure
a fast PORST reset release (below 2 µs), as specified in the Datasheet. In some application scenarios
this requirement may impose limitations that can be easily overcome.
The bi-directional PORST pin needs to be able to overcome an external load imposed by other
components on the application board. This may be realized with a pull-up resistor to VDDP on the
PORST pin. Typically it would be sufficient to apply a 90kΩpull-up resistor if no other application
components on the board are connected to the PORST pin. The pull-up resistance needs to be
adapted to the application constraints and in case of a greater load imposed on the PORST pin, a
stronger pull-up may need to be applied (see example scenario in Figure 2). This requirement applies
in the case of VDDP ramping times longer than 500 µs. A pull-down resistance and/or capacitor to VSS
may severely degrade the ramping release speed of the PORST and result in multiple low spikes on
the PORST.
Note:XMC4000 devices do not require an external capacitor to filter noise on the PORST pin as they
implement an on-chip spike filter.
Exceptions
The PORST ramping requirement does not apply when:
VDDP ramping is faster than 500 µs
the XMC4000 device is not a reset master on the application board and is held in reset state by an
external reset control device until the power-up sequence is completed

Fail-Safe Features
XMC4000 Family
Voltage Supervision
Application Guide 9 V1.0, 2013-04
Figure 2 Pull-up on PORST
Failure condition
A load on the PORST reset pin prevents the bi-directional PORST from releasing
reset faster that 2 µs during VDDP ramping (time longer than 500 µs) leading to a
risk of multiple low spikes on the PORST
Fail-safe effect
Improve PORST release time (below 2 µs) by applying a sufficient pull-up to the
PORST pin
1.4.1 Power Validation
A power validation circuit monitors the internal core supply VDDC voltage of the core domain.

Fail-Safe Features
XMC4000 Family
Voltage Supervision
Application Guide 10 V1.0, 2013-04
Figure 3 Power Validation
It monitors that the core voltage is above the voltage threshold VPV which guarantees a save
operation. Whenever the voltage falls below the threshold level a power-on reset is generated.
Failure condition
VDDC voltage remains, or has dropped down below a minimum level VPV, which
may lead to severe core logic malfunction, that may result in a system hang-up
condition.
Fail-safe effect
PORST reset is asserted and remains active as long as the core voltage VDDC has
not recovered to a level that guarantees proper functionality.

Fail-Safe Features
XMC4000 Family
Voltage Supervision
Application Guide 11 V1.0, 2013-04
1.4.2 Supply Watchdog
The supply watchdog compares the supply voltage against the reset threshold VPOR (see Figure 4).
The Datasheet defines the nominal value and applied hysteresis.
Figure 4 Supply Voltage Monitoring
While the supply voltage is below VPOR the device is held in reset.
As soon as the voltage falls below VPOR a power on reset is triggered.
Failure condition
During normal operation VDDP voltage drops to a level that is too low to ensure the
proper function of modules supplied with VDDP, which may potentially lead to Flash
malfunction, I/O pads misbehavior, or unreliable VDDC generation in EVR for
example.
Fail-safe effect
PORST reset is activated to prevent any activity when VDDP is too low.
Note:Recovery from this supply state results in Power-on Reset release.

Fail-Safe Features
XMC4000 Family
Voltage Supervision
Application Guide 12 V1.0, 2013-04
1.5 Supply Voltage Brown-out Detection
Brown-out detection is an additional voltage monitoring feature that enables the user software to
perform some corrective action that brings the chip into safe operation in case of a critical supply
voltage drop, and avoids a System Reset generated by the Supply Voltage Monitoring (see Figure 5).
Figure 5 Power Validation
A drop of supply voltage to a critical threshold level, programmed by the user, can be signaled to the
CPU with a Trap. An emergency corrective action may involve for example, the reduction of current
consumption by switching off some modules, or some interaction with external devices that should
result in recovery of the supply voltage level. The threshold value and the inspection interval are
configured in the PWRMON register.
Automatic monitoring of the voltage against programmed voltage allows efficient operation without a
need for software interaction if the supply voltage remains at a safe level. The supply voltage can also
be monitored directly by software in the register EVRVADCSTAT.
Failure condition
Supply voltage VDDP has dropped down to a level that may indicate a severe
overload of the external voltage regulator caused by excessive activity of the
XMC4000 device resulting in high current consumption. A further drop of the VDDP
voltage may occur unless a corrective action is taken in order to bring the device
into safe operation.
Fail-safe effect
A system Trap is generated on crossing the brown-out threshold and is propagated
to the CPU as an NMI interrupt. User software shall immediately apply a corrective
action that results in a reduction of current consumption, such as clock rate
reduction, inactivation of some modules, reduction of CPU activity, and so on. In
effect PORST reset assertion may be avoided and normal device activity may be
resumed without context loss with minimum effect on the overall system.

Fail-Safe Features
XMC4000 Family
Application Guide 13 V1.0, 2013-04
1.6 Hibernate Domain Power Management
Hibernate domain must be supplied with a valid VBAT level during startup and while in active mode.
This can be ensured by a direct VDDP connection to VBAT.
Invalid VBAT voltage level may lead to unpredictable behavior of the device.
1.6.1 Temporary Loss of VDDP Supply
Hibernate domain reset is asserted whenever VBAT drops below a certain minimum level. Hibernate
domain reset release needs to be performed with software access.
Figure 6 Hibernate domain voltage supply with VDDP
If the Real-Time Counter (RTC) is activated and counting time is required in the application, it may be
necessary to reduce the potential risk of spikes or temporary loss of power that might result from a
Hibernate domain reset. This can be avoided with a capacitor connected between VBAT and VSS (see
Figure 6). Typically 100 µF would allow compensating for several seconds of VDDP loss without a risk
of losing RTC state. The schottky diode between VDDP and VBAT prevents discharge of the capacitor
towards VDDP when VDDP is lower than VBAT.
Failure condition
Unexpected short drop of VDDP below minimum VBAT level that may lead to loss of
RTC state.
Fail-safe effect
Preservation of RTC state upon VDDP supply voltage shortage by supplying VBAT
voltage from the capacitor.
1.6.2 Prevention of Premature Coin Battery Discharging
Typically, the VBAT supply voltage of the Hibernate domain (e.g. a coin battery) is lower than VDDP (see
Figure 7).

Fail-Safe Features
XMC4000 Family
Application Guide 14 V1.0, 2013-04
Note:It is strongly recommended to supply Hibernate domain with VDDP when available in order to
extend the battery life time.
An external supply voltage switching solution based on schottky diodes is shown in Figure 7. The
scenario may apply to applications where RTC is activated and will also preserve its operation during
longer periods of device inactivity, while in hibernate mode for example, or when simply powered-off
for a period of time.
Figure 7 Hibernate domain voltage supply with a coin battery
Failure condition
Direct battery connected to VBAT voltage supplied to Hibernate domain during
active operation will result in draining the battery permanently. This would lead to
dramatically shortened battery life, and a drop of the VBAT voltage to a level that
may result in severe system failure (valid VBAT must always be supplied when in
active mode).
Fail-safe effect
Applying a schottky diode between VDDP and VBAT prevents the battery draining
while in active operation mode (i.e. when VDDP is supplied), and prevents discharge
of the battery towards the VDDP pin when the main supply voltage is not available.
In case of end-of-life of the coin battery, the Hibernate domain can still be properly
supplied while in active mode, even if the hibernate mode and RTC module are
reset during power-off. The schottky diode between a coin battery and VBAT input
prevents reverse current through the battery which might cause battery damage.

Fail-Safe Features
XMC4000 Family
Application Guide 15 V1.0, 2013-04
Clock Supervision

Fail-Safe Features
XMC4000 Family
Clock Supervision
Application Guide 16 V1.0, 2013-04
2 Clock Supervision
2.1 Introduction
The XMC4000 clocking system implements various clock sources and operating modes. Fail-safe
features cover a wide range of aspects of operation that can be utilized in order to ensure stable
operation.
The following sections cover the basic introduction to the clocking system elements and associated
fail-safe mechanisms:
Fail-safe System Clock
−Backup Clock Source
−High Precision Oscillator Watchdog Trap
−System PLL Loss-of-Lock Trap
−System PLL Loss-of-Lock RecoverySystem PLL Loss-of-Lock Recovery
−Emergency Mode
Fail-safe USB Clock
−USB PLL Loss-of-Lock Trap
Fail-safe RTC ClockFail-safe RTC Clock
−RTC Clock Watchdog Trap
−Emergency Mode Clock for RTC
2.2 Fail-safe System Clock
The central element of the system clock fail-safe mechanism is clock monitoring. The monitoring is
performed using a High Precision Oscillator Watchdog implemented as a part of the PLL module.
Figure 8 System Clock Supervisor
The watchdog circuit is capable of detecting the malfunction of the external crystal oscillator and to
trigger a service request and/or a corrective reaction in hardware.
The following sections describe various aspects of the fail-safe mechanism.

Fail-Safe Features
XMC4000 Family
Clock Supervision
Application Guide 17 V1.0, 2013-04
2.3 Backup Clock Source
The backup clock fOFI generated internally, is the default clock after start-up. It is used for by-passing
the PLL for startup of the system without an external clock. Furthermore it can be used as an
independent clock source for the watchdog module, or even as the system clock source during
normal operation. While in prescaler mode this clock is automatically used as the emergency clock if
external clock failure is detected.
Clock adjustment is required to reach the desired level of fOFI precision. The backup clock source
provides two adjustment procedures:
loading of adjustment value during start-up
continuous adjustment using the high-precision fSTDBY clock as reference
Failure condition
External clock input or crystal resonator/oscillator not present, not configured, or
damaged.
Fail-safe effect
The internal Backup Clock Source is the most reliable clock source and remains
active for all conditions while the chip is in normal operation mode. This clock
cannot be disabled accidently by mistake with software, as long as the power
supply is valid.
2.3.1 High Precision Oscillator Watchdog Trap
The oscillator watchdog monitors the incoming clock frequency fOSC. A stable and defined input
frequency is a mandatory requirement for operation in both Prescaler Mode and Normal Mode. It is
required that the input frequency fOSC is in a certain frequency range to obtain a stable master clock.
The expected input frequency range is selected via the bit field OSCHPCTRL.OSCVAL. The
oscillator watchdog checks for spikes, too low frequencies, and for too high frequencies. The clock
that is monitored is fOSCREF, which is derived from fOSC.
The monitored frequency is too low if it is below 1.25 MHz and too high if it is above 7.5 MHz. This
leads to the following two conditions:
Too low: fOSC < 1.25 MHz ×(OSCHPCTRL.OSCVAL+1)
Too high: fOSC > 7.5MHz ×(OSCHPCTRL.OSCVAL+1)
The divider value OSCHPCTRL.OSCVAL shall to be selected in a way that fOSCREF is approximately
2.5 MHz.
Note: fOSCREF shall be within the range of 2 MHz to 3 MHz and should be as close as possible to 2.5
MHz.
Failure condition
External clock outside of expected frequency range and/or spikes present (e.g.
failing crystal).
Fail-safe effect
A Trap generated and flagged in the TRAPSTAT register. An appropriate
corrective action can be taken in user software.

Fail-Safe Features
XMC4000 Family
Clock Supervision
Application Guide 18 V1.0, 2013-04
2.3.2 System PLL Loss-of-Lock Trap
The System PLL Loss-of-Lock is signaled as a system Trap in case VCO lock has been lost and it
continues in a free running mode. The user software shall apply a corrective action in order to re-lock
the PLL and bring the system into safe operation.
Failure condition
PLL configuration and/or input clock rate causes unstable operation of the VCO,
leading to a loss-of-lock condition.
Fail-safe effect
A system Trap is generated and handled as an NMI request. System can be
brought into safe operation with user software.
2.3.3 System PLL Loss-of-Lock Recovery
The System PLL Loss-of-Lock is signaled as a system Trap in case VCO lock has been lost.
However, the PLL will try to re-lock without software interaction if the SCU_PLLCON0.VCODISDIS bit
is set. The user software may still apply some corrective action but does not need to re-lock PLL.
Failure condition
System PLL configuration and/or input clock rate causes unstable operation of the
VCO leading to a loss-of-lock condition.
Fail-safe effect
The PLL will re-lock automatically, without software interaction. A system Trap is
generated and handled as an NMI request. System can be brought into safe
operation with user software.
2.3.4 Emergency Mode
An Emergency in the clocking system occurs when the clock source stops working correctly; i.e. the
frequency is outside of the tolerance range, or because of the presence of spikes.
A typical element prone to cause Emergency mode is an external crystal on the application board.
The high precision oscillator circuit can drive an external crystal or accept an external clock source.
External Crystal Mode
For the external crystal mode, external oscillator load circuitry is required. The circuitry must be
connected to both pins, XTAL1 and XTAL2 (see Figure 9). It consists normally of the two load
capacitances C1 and C2. For some crystals a series damping resistor might be necessary. The exact
values and related operating range depend on the crystal and have to be determined and optimized
together with the crystal vendor using the negative resistance method. The crystal frequency must be
in the range from 4 to 25 MHz.
Figure 9 External Crystal Mode Circuitry for the High-Precision Oscillator

Fail-Safe Features
XMC4000 Family
Clock Supervision
Application Guide 19 V1.0, 2013-04
2.3.4.1 Emergency System Clock for PLL Normal Mode
The main PLL converts a low-frequency external clock signal to a high-speed internal clock. The PLL
also has fail-safe logic that detects de-generative external clock behavior such as abnormal frequency
deviations or a total loss of the external clock. The PLL triggers autonomously emergency action if it
loses its lock on the external clock and switches to a free-running VCO of the PLL (see Figure 8).
PLL Normal Mode
In PLL Normal Mode the Voltage Controlled Oscillator (VCO) receives input clock from fOSC and
multiplies its frequency. The output clock from the VCO is phase-locked to the input clock.
Figure 10 PLL Normal Mode
The high frequency output clock is then scaled down accordingly with the Prescaler (see Figure 10).
The phase–locked output is supervised with the Lock Detection circuit.
Failure condition
The external clock is outside of the expected frequency range and/or spikes are
present (e.g. caused by a failing crystal) while PLL is running in Normal Mode; i.e.
VCO output is configured to be phase locked to the input clock.
Fail-safe effect
The PLL will unlock the VCO and provide a free running VCO output as the system
clock fSYS. A Trap is also generated and flagged in the TRAPSTAT register. An
appropriate corrective action can be taken in user software.

Fail-Safe Features
XMC4000 Family
Clock Supervision
Application Guide 20 V1.0, 2013-04
2.3.4.2 Emergency System Clock for PLL Prescaler Mode
The PLL offers a VCO Power-Down mode. This mode can be entered to save power within the PLL.
The VCO Power-Down mode is entered by setting bit PLLCON0.VCOPWD. While the PLL is in this
mode only the Prescaler mode is operable.
Note:Selecting the VCO Power-Down mode does not automatically switch to the Prescaler mode.
Before the VCO Power-Down mode is entered, the Prescaler mode must be active.
PLL Prescaler mode
In Prescaler mode the VCO is by-passed (and, optionally powered-down). The output clock is a direct
scale down of the input clock (see Figure 11).
Figure 11 PLL Prescaler mode
Failure condition
The external clock is outside of the expected frequency range and/or spikes are
present (e.g. caused by a failing crystal) while PLL running in Prescaler mode; i.e.
VCO by-passed and/or in power-down.
Fail-safe effect
The system clock fSYS will automatically switch to the Back-up Clock Source output
fOFI. A Trap is also generated and flagged in the TRAPSTAT register. An
appropriate corrective action can be taken in user software.