When using bitstream encryption, you can take advantage of an uninterruptible clock source named CFGMCLK (configuration internal oscillator clock output) located as an output on the STARTUPE3 block primitive (refer to the example VHDL instantiation of the STARTUPE3 block in PROGRAM_B intercept). Because this clock is always active, it can be used as the basis for a user clock (or other critical user signal) monitoring function. Even though CFGMCLK can vary quite a bit from its nominal value of 50 MHz ± 15% 9 (refer to Kintex UltraScale FPGAs Data Sheet: DC and AC Switching Characteristics (DS892) and Virtex UltraScale FPGAs Data Sheet: DC and AC Switching Characteristics (DS893)), it can still be quite useful in a monitoring function to make sure a critical user clock or signal is still “alive” and toggling between a lower and upper frequency range (which takes into account the CFGMCLK variation). If the critical user clock or signal falls out of this range, it can indicate either that the design has malfunctioned or is being tampered with, and the appropriate penalty could be asserted.
CFGMCLK can be also used as the clock source for any other user-defined AT functions in FPGA logic. It is important that AT functions cannot be halted by simply removing an external clock source.