In short: A brown-out reset (BOR) is a hardware circuit that forces the MCU into reset whenever the supply voltage sags below a defined threshold, keeping the CPU, flash, and peripherals out of the undefined grey zone where instructions misexecute and memory corrupts.
Why a sagging rail is more dangerous than a dead one
Engineers instinctively worry about power loss, but a partial collapse is the nastier failure. When VDD drops to zero the MCU simply stops. When it droops to, say, 1.9 V on a 3.3 V part, the CPU keeps fetching and executing — but the flash sense amplifiers, the PLL, the SRAM retention margin, and the logic timing are all out of spec. The result is silent, non-deterministic misbehaviour: a program counter that jumps to a garbage address, a flash write that lands half-programmed, an I2C EEPROM transaction torn in the middle, or stack corruption that surfaces minutes later as an unrelated hard fault.
Brown-outs are common in the field: motor inrush on a shared rail, a solenoid or relay firing, a weak USB host, a draining battery, or a bulk capacitor that cannot hold up during a load step. The brown-out reset peripheral exists precisely to convert these analog grey-zone events into a clean, digital "stop and restart" the firmware can trust.
How the detector actually works
At the core of every BOR is an analog comparator. One input sees a scaled copy of VDD (a resistor divider or a switched-capacitor network); the other sees a stable band-gap reference of roughly 1.2 V that barely moves over temperature. When the scaled supply falls below the reference, the comparator trips and the reset controller asserts the internal reset, holding the whole digital domain in a known state until the supply recovers and the power-on reset (POR) sequence completes.
The reference is the whole trick: you cannot detect "low voltage" by comparing the supply to itself, because the threshold would sag along with it. A temperature-stable band-gap gives the comparator a fixed yardstick independent of the collapsing rail.
Two refinements make this robust. Hysteresis adds a gap between the falling trip point (VBOR-) and the rising release point (VBOR+) — typically 50–150 mV — so a rail hovering right at the edge does not chatter in and out of reset thousands of times. A debounce / glitch filter ignores dips shorter than a few microseconds, preventing a harmless decoupling transient from triggering a full restart.
Choosing the threshold
The BOR trip level must sit comfortably above the minimum voltage at which the slowest on-chip resource is still guaranteed. Flash read margin and maximum CPU clock usually set this floor. On an STM32, for example, the BOR level is programmable in option bytes across several steps; many designers pick level 2 or 3 (around 2.4–2.7 V) for a 3.3 V system running at full frequency, because flash and the high-speed oscillator are not characterised below that. An AVR or PIC typically offers a 1.8/2.7/4.3 V style selection.
| Parameter | Typical value | Why it matters |
|---|---|---|
| Band-gap reference | ~1.2 V | Temperature-stable yardstick |
| BOR threshold (3.3 V part) | 2.4–2.9 V | Above flash/clock min spec |
| Hysteresis | 50–150 mV | Prevents reset chatter |
| Glitch filter | 1–10 µs | Ignores harmless transients |
| Quiescent current | 1–100 µA | Battery-life trade-off |
There is a power penalty: an always-on comparator and reference draw quiescent current. In a coin-cell design you may route BOR through a low-power sampled mode, where the detector wakes periodically instead of running continuously, trading a slightly slower response for microamps of saving.
Protecting non-volatile memory
The highest-value job of BOR is guarding writes to flash and EEPROM. A flash program/erase needs charge-pump voltages and a minimum VDD; if the rail collapses mid-operation you can get a partially programmed word or a corrupted page that reads back as neither the old nor the new value. Firmware should therefore treat non-volatile writes as critical sections: raise the BOR level before a bulk EEPROM commit, and use a journaled or double-buffered scheme (write to a shadow copy, then flip a validity flag last) so an interrupted write is always recoverable. BOR guarantees that once the voltage is unsafe, the CPU is no longer issuing those writes at all.
Pair BOR with a watchdog timer: BOR catches the cause (bad voltage) while the watchdog catches the symptom (hung firmware). Neither alone covers both failure modes.
BOR in the reset hierarchy and verification
On start-up the status registers record why the chip reset — POR, BOR, external pin, watchdog, or software. Reading the reset-cause flags lets firmware distinguish a clean power-up from a brown-out recovery and, for example, re-initialise peripherals conservatively or log the event. In a field product this telemetry is gold: a device logging frequent BOR events is almost always a power-integrity problem, not a software bug.
For verification, mixed-signal teams simulate the comparator and reference in SPICE (Cadence Spectre or Synopsys PrimeSim), confirm threshold and hysteresis across process-voltage-temperature corners, and validate the digital reset sequencing with Siemens Questa. On the bench, a programmable source with a slow voltage ramp sweeps the rail through the trip point while a scope captures nRST timing — the classic way to confirm the datasheet numbers on real silicon. Teams building custom silicon often lean on a dedicated analog/mixed-signal partner such as Avecas design services to characterise these cells at the transistor level.
If you are designing the board rather than the chip, the companion topic is the external supervisor — see our note on the power supervisor IC for when an on-chip BOR is not enough and you need a separate, more precise watchdog-plus-reset device.
Want to design and debug reset, power-sequencing, and fault-recovery like a pro? CourseTron's embedded systems track walks through BOR, watchdogs, and safe NVM design with real hardware labs — explore the courses.
Frequently asked questions
What is the difference between POR and BOR?
Power-on reset (POR) fires once as the supply first rises past a valid level to initialise the chip. Brown-out reset (BOR) monitors continuously thereafter and re-asserts reset any time the supply later sags below the brown-out threshold. POR handles start-up; BOR handles mid-operation dips.
Does enabling BOR increase power consumption?
Yes, modestly. The comparator and band-gap reference draw a steady quiescent current, typically a few microamps to tens of microamps. For ultra-low-power battery designs, use a sampled or low-power BOR mode that periodically checks the rail instead of monitoring it continuously.
How do I pick the right BOR threshold?
Set it above the minimum voltage at which your slowest critical resource is still guaranteed — usually flash read margin or the maximum CPU clock. For a 3.3 V part at full speed, that is commonly 2.4–2.9 V. Leave margin for supply ripple so you do not trip on normal load steps.
Can BOR fully prevent flash corruption?
It greatly reduces the risk by halting the CPU before writes execute at unsafe voltages, but it is not a substitute for robust firmware. Combine BOR with journaled or double-buffered NVM writes and a validity flag written last, so any interrupted operation is still recoverable.