STM8 restarts with due to illegal opcode when clock security system (CSS) switches from HSE to HSI

[NikolaiW]

I have the following issue: When the clock security system detects a clock fault on the HSE (running at 16 MHz), the controller sometimes resets with an illegal opcode as the reset cause, even though the deglitch filter is enabled.

I couldn’t find any information about this in the reference manual or the errata sheet.

The controller is an STM8L151G6U6. The external clock runs at 16 MHz, and the clock prescaler is set to 1 (CLK_CKDIVR = 0).

[AA1]

Clock fault on the HSE is difficult to happen unless you force it. How do you know this happens?

You said that sometimes the controller resets with an illegal opcode and sometimes the program continues to run.

CSS on HSE interrupt is enable?

Do you have an interrupt handier?

[NikolaiW]

The HSE is supplied by an FPGA that generates a 16 MHz clock for the STM8. Currently, I am testing how the system responds if the FPGA core voltage malfunctions. I have not yet verified whether the HSE clock simply stops, or if it first passes through a phase with random glitches caused by timing issues.

The CSS interrupt is enabled and has a handler function. Using the debugger, I sometimes observe that the controller enters the interrupt handler, but about 50% of the time it resets immediately due to an illegal opcode.

When the CSS interrupt handler is executed, I can single-step through a few instructions. Occasionally, the controller resets upon returning from the interrupt handler; other times, it continues running on the HSI clock.

[AA1]

Disable the CSS interrupt and try again.

[NikolaiW]

I’ve already tried this, but it doesn’t help (and wouldn’t really be a viable option anyway).
The only explanation I can see is that if the clock is distorted (e.g., by a glitch), the STM8 either reads an invalid instruction or decodes it incorrectly. If this results in an invalid opcode, the STM8 resets itself, otherwise unpredictable behavior may occur.

I will try to use the internal RC oscillator in combination with the trimming function to get it stable over a wide temperature range.