Which is an appropriate clock-monitoring safety mechanism for an automotive microcontroller?

Answer: A. Use a separate oscillator independent of the main clock as a reference to detect stoppage or frequency deviation of the main clock

If the clock stops or its frequency drifts, timer intervals and communication speeds go wrong and control can no longer be performed correctly. Therefore, the clock period is counted against a separate reference independent of the main clock, such as an internal oscillator, and an anomaly is reported if it falls outside a defined range. With a reference derived from the same clock being monitored, monitoring stops when that clock stops, so the anomaly cannot be found. Setting the frequency above specification actually causes malfunctions.