Clock security system (CSS)
Hardware that notices the external crystal has gone quiet and switches to a backup clock before the processor grinds to a halt.
A crystal oscillator is precise but not immortal. Vibration can crack a solder joint, a drop can break the crystal, and moisture can stop it oscillating. Without protection the whole chip simply stops, and even the watchdog may lose its clock if it shares the source.
On STM32 the safeguard is called CSS. When enabled, a circuit monitors the external clock, HSE, and if it disappears the system falls back to the internal RC oscillator and raises a non-maskable interrupt. Firmware then gets a chance to enter a safe state, log the fault and reconfigure the clock tree. Microchip calls the same idea a Fail-Safe Clock Monitor. It's off by default — you have to ask to be rescued.