Why STM32’s PLL Keeps Running After HSE Failure and How to Fix It

Problem Description

A customer observed on an STM32F103VDT6 board that when the external 8 MHz HSE crystal was grounded (stopping its oscillation), the external watchdog did not reset the MCU as expected. The MCU kept sending the required pulse to the watchdog, preventing a reset.

Investigation Steps

The engineers verified the phenomenon by repeating the test and inspecting the firmware, discovering that the CSS (Clock Security System) feature was not enabled. They modified the code to output the PLL‑derived clock on the MCO pin for measurement.

When the HSE was operating, the MCO signal measured 36 MHz; when the crystal was grounded, the MCO frequency dropped to about 1.7 MHz, as shown in the following screenshots:

Reading the RCC_CFGR register showed the SWS bits set to 10, confirming that the system clock was still sourced from the PLL.

According to the STM32F103VD datasheet, the PLL output frequency range is 16 MHz – 72 MHz. If the input frequency falls below the minimum, the PLL can lose lock and its output may drop below 16 MHz or even to zero, matching the observed behavior where “zero input yields zero output.”

Conclusion

The PLL can continue to oscillate at its lowest frequency even when the HSE input is absent, allowing the CPU and peripherals to keep running. Therefore, simply checking whether the CPU is executing instructions is not a reliable method to detect HSE failure.

Solution

To handle HSE loss correctly, the firmware should:

Enable the STM32 Clock Security System (CSS) during initialization.

Modify the NMI interrupt service routine to include a while(1) trap (or other recovery logic).

When CSS detects HSE failure, the MCU automatically switches the system clock to the internal HSI, generates an NMI, and disables the HSE (and the PLL if its source is HSE). The NMI allows the application to attempt recovery or to remain trapped, after which the external watchdog will eventually reset the MCU.

Recommendations

Since CSS is disabled after a reset, software must explicitly enable it. The NMI generated by CSS also provides a brake signal for advanced timers, useful for motor‑control applications. Developers should implement appropriate NMI handling to either recover the HSE/PLL or let the watchdog perform a full system reset.