Resetting a microcontroller by powering it down - What could possibly go wrong ? - Page 1
Forum section: electronics / general

author: chris_leyson
author_rank: Super Contributor
timestamp: July 04, 2020, 05:21:12 pm
content: Quite a lot if you're not careful. So I've got this 5V microcontroller with a 1.8V core supplied by an internal linear regulator, nothing new there and it could also apply to a 3V3 part with a low voltage core. The scenario goes something like this as VDD drops.1. Switch of power to micro2. VDD drops at some dV/dt depending on load3. On chip brownout detect and reset doesn't work because supply dV/dt doesn't meet spec4. Firmware keeps on running because internal reset doesn't work, guaranteed by design. See 35. I/O input thresholds are changing as VDD drops. Is 1/3 2/3 VDD threshold still applicable ?6. Firmware does something unexpected possibly because an I/O pin has seen a change of state7. Oscillator stops, core stops at some unkown state8. I/O drive finally fails because VDD has droped to 20%9. Now the microcontroller is finally sleeping.It's a guaranteed recipe for disaster. I/O ports and level translation between the I/O and core is not defined outside of recommended supply operating conditions so anything can happen. At some point in time it's all going to become nondeterminisic and that point in time is highly variable due to the supply dV/dt. Moral of the story, should have blipped the reset pin.

author: Siwastaja
author_rank: Super Contributor
timestamp: July 04, 2020, 05:47:17 pm
content: Is there an actual part that measures dV/dt for the brownout detector? Or is that just speculation?Obviously, a proper brownout detector looks at the absolute voltage. This is easier to implement on silicon, as well; just a reference and a comparator.(Note not all microcontrollers necessarily use the term "brown-out detector".)

author: SiliconWizard
author_rank: Super Contributor
timestamp: July 04, 2020, 07:12:00 pm
content: Quote from: Siwastaja on July 04, 2020, 05:47:17 pmI don't think I remember a spec on required dV/dt for the brownout detectors or any MCU I've worked with. Not saying there isn't.But hypothetically, the only possible issue I can see is the case where VDD drops and rises back too fast for the drop to be detected properly by the brownout detector, yet the drop would still cause the MCU to fail in some way. For that to happen the brownout detector would likely have to be particularly slow AND VDD not properly bypassed IMHO. I've never seen that happen, but given that this would likely happen (if ever) only for ultra short drops, that's something you should be able to solve again by properly bypassing VDD.

author: retrolefty
author_rank: Super Contributor
timestamp: July 04, 2020, 07:51:57 pm
content: Often a RESET pin doesn't get the love and care it deserve.Just with avr 328 type chips I've seen where a too short an externally supplied reset signal 'locks up' the chip requiring a powering off to correct. Or try wiring an output pin to the reset pin so one can perform a programmed reset, doesn't work for the same reason.Also I've seen a voltage overshoot of the reset pin (about 10vdc) partially put the chip into HV programming mode.Sometimes a errata notes of a MC's datasheet will give hints of such vulnerabilities.

author: T3sl4co1l
author_rank: Super Contributor
timestamp: July 04, 2020, 08:17:22 pm
content: BOD and reset generators are notorious for misbehaving at low dV/dt.I take it these are more speculation than direct observation? Or, say, you might've confirmed a few of these in some systems, but not all of them simultaneously..? (That would be pretty hideous,but I'm not discounting the possibility..!)Regarding the scenario -- there should at least, be few things, persistent or destructive, a browned-out core can do. Peripherals aren't doing anything, they're subject to the same malfunctions as any other part; SRAM is going down, and always assumed on boot to be trashed; and EEPROM or Flash, even if accessed appropriately, probably don't have enough charge to finish a write or erase cycle. And even then, they're only likely to corrupt a few points, which could hopefully be detected, but then of course, you do need to implement a validator (CRC or hash, say) to show that the data is as expected at startup. Preferably in a fixed non-writable location; often some Flash is reserved for bootloader use, and protected by fuses that can't be written from software. (Of course, again, who knows what checks might fail during brownout conditions.)It's also effectively an overclock: at low supply, logic gates don't have enough bandwidth to run at full speed, and that's if the clock generator remains active. So race conditions may corrupt some operations but leave others alone.Good practice to add a reset generator to the project, just out of habit; they're cheap, small (SOT-23 or less) and better optimized than a digital process trying to fake it with analog circuitry.RST pins are also notorious for being noise antennas; a bypass cap is a good idea, if you can afford it. Typically 10nF. Cases where that might not be feasible: when the pin is used for serial programming (ATTINY I think for example?).Tim

author: ehughes
author_rank: Frequent Contributor
timestamp: July 04, 2020, 11:57:37 pm
content: The flash in the MSP430F1611 AND MSP4302618 will get corrupted if you do this. Ran into this about 10 years ago.... The brownout detection needs to be very agressive.

author: I wanted a rude username
author_rank: Frequent Contributor
timestamp: July 05, 2020, 01:07:58 am
content: Quote from: T3sl4co1l on July 04, 2020, 08:17:22 pmAny modern (relative term, I know) AVR with UPDI ... so alsothe ATmega4809, for example. For programming/debugging you can leave up to (no stronger than) a 10 kOhm pullup connected, but must temporarily remove any capacitor.

author: David Hess
author_rank: Super Contributor
timestamp: July 05, 2020, 02:53:00 am
content: Sometimes you can find an active pull-down on a critical power supply to increase dV/dt when power is lost to minimize the opportunity for improper operation. But holding a part in reset if possible is a better solution.Quote from: Siwastaja on July 04, 2020, 05:47:17 pmDepending on its sophistication, the brownout detector may have minimum dV/dt requirements for proper operation. This is a pretty common issue whether the datasheet specifies it or not.QuoteIt is also easy to get wrong because absolute voltages are not. The supply being monitored has reference noise, ripple, switching noise, etc. which can cause fault positives or false negatives.

author: chris_leyson
author_rank: Super Contributor
timestamp: July 05, 2020, 08:11:17 am
content: QuoteIt's a real part and the hardware doesn't meet the dV/dt spec for auto reset.QuoteSame part has built in programmable VDD detect for absolute voltage that works on rising and falling VDD but that doesn't seem to be working either. I'm curious as to why and at what supply voltage a part becomes nondeterministic.Thanks for all the comments guys, @Tim, good comment on logic bandwidth, I had forgotten about that one. @David Hess, there is plenty of supply ripple as well so potentially that could throw things either way. You can make little tweaks to parts of the supply circuit or change a pull-up resistor on an I/O pin and get different results. It's a good wake up call and it's fixed with a proper hardware reset pulling the reset pin to ground.

author: Siwastaja
author_rank: Super Contributor
timestamp: July 05, 2020, 08:41:06 am
content: It would be really helpful if you referred us to the part number. Working around broken-by-design MCU peripherals is everyday stuff, sometimes including reset circuitry. Knowing beforehand is helpful, if not to avoid using such part, at least being able to cope.If minimum dV/dt is indeed specified and you are exceeding that spec, then it's easy enough, just use an external BOR IC which does not have such limitation.

author: chris_leyson
author_rank: Super Contributor
timestamp: July 05, 2020, 09:25:08 am
content: Part number is MN101EF50Dhttps://industrial.panasonic.com/ww/products/semiconductors/microcomputers/mn101e/models/MN101EF50D

author: exe
author_rank: Unknown
timestamp: July 05, 2020, 11:11:48 am
content: Quote from: David Hess on July 05, 2020, 02:53:00 amShouldn't BOD have some hysteresis for that? Like stm32f103 has 40mV hysteresis (typical).

author: David Hess
author_rank: Super Contributor
timestamp: July 05, 2020, 05:51:37 pm
content: Quote from: exe on July 05, 2020, 11:11:48 amIt should but maybe not enough or it was left out.

author: cv007
author_rank: Frequent Contributor
timestamp: July 06, 2020, 05:12:11 am
content: >6. Firmware does something unexpected possibly because an I/O pin has seen a change of state>It's a guaranteed recipe for disaster.> and it's fixed with a proper hardware reset pulling the reset pin to ground.Your guaranteed disaster recipe is still there, unless you never lose power. Either it was a theoretical problem, or it was an actual problem, now with less frequency. If disasters await you, I doubt its much consolation that it now only occurs once a day/week/month whenever you lose power.Many mcu's have a way to notify of power loss before you reach bod levels, so if disaster awaits from a power loss then it would probably be a good idea to make use of that feature, or add some external help of some kind.

author: thm_w
author_rank: Super Contributor
timestamp: July 06, 2020, 10:03:01 pm
content: Quote from: chris_leyson on July 05, 2020, 09:25:08 amThe datasheet on their site doesn't mention brownout, just "low voltage interrupt".I'll assume you have a more complete datasheet that actually provides the BOD specs..

author: rcbuck
author_rank: Frequent Contributor
timestamp: July 07, 2020, 04:19:39 pm
content: QuoteI agree with Tim. I use the Microchip MCP120's for this task. It is available in several different VDD trip point voltages.

author: SiliconWizard
author_rank: Super Contributor
timestamp: July 07, 2020, 06:09:52 pm
content: Quote from: thm_w on July 06, 2020, 10:03:01 pmYeah. Apparently you need to register to get more complete documentation. I didn't bother.But I'm curious to see what the DS really says. As you said, the brief talks about a "low voltage interrupt". Is this what is used here as a brownout? Is there a proper brownout reset circuitry actually, or is it just a detector, linked to an interrupt, and all you can do is software reset the MCU in said interrupt? (I guess not, but I'd really be curious to see the full DS.)A "proper" brownout reset circuitry basically includes a decent comparator with some hysteresis and a voltage ref. If said comparator is not completely shaky, low dV/dt values shouldn't be a problem (very high ones could be, but they are less of a problem because they shouldn't happen with proper bypassing anyway.) Of course on some MCUs, it could be badly implemented. I've never run into this, but I'm sure that happens.One thing I've see though is the following, which you should certainly be wary of. On some MCUs, the brownout threshold is configurable (among a few fixed values), on some others, it's just a fixed value. One thing that can happen is that said threshold (whether the fixed value, or the value you set in the configuration if it's configurable) is just too LOW for the frequency at which the MCU core runs in your specific design. Some MCUs have an operating voltage range that depends on the core frequency (and conversely). If the BOR threshold it too low for a given clock frequency, it just won't work properly. When VDD drops, the MCU is likely to go bonkers before the BOR takes action. I've seen that happen, so that's not just theoretical, and certainly something to take a close look at.