What Is an External Voltage Supervisor/Watchdog IC?

Detailed Explanation

An MCU's own power-on reset circuit and internal watchdog peripheral (see What Is a Watchdog Timer? for the STM32 IWDG/WWDG implementation) handle the great majority of reset and fault-recovery needs in embedded designs. An external supervisor IC exists for the cases where a second, physically independent layer of protection is worth its added board space and BOM cost: functional-safety-driven diverse redundancy, a rail whose brownout behaviour needs tighter or more specific control than the MCU's own BOR provides, or a manual reset button that needs clean debouncing without relying on MCU firmware being alive to process it.

What a Supervisor IC Actually Monitors

A typical supervisor/watchdog IC combines two independent functions in one small package:

• Voltage supervision — continuously compares the monitored supply rail against an internal (or externally set) reference threshold. If the rail drops below threshold, the IC immediately asserts its reset output, and holds it asserted for a defined reset pulse width after the rail recovers above threshold — ensuring the MCU doesn't come out of reset into a still-marginal supply.
• Watchdog timing — a watchdog input (WDI) pin that firmware must toggle periodically, entirely analogous to kicking an internal IWDG. If the WDI pin doesn't transition within the configured timeout, the supervisor asserts reset exactly as if a brownout had occurred.

Because these two checks live in a separate IC on a separate silicon process, a failure mode that somehow disables the MCU's own BOR or watchdog logic — a manufacturing defect, an unanticipated silicon errata, or (in the diverse-redundancy safety-standard sense) any single-point failure in that one design's supervisory logic — does not simultaneously disable the external check.

Reset Threshold Accuracy and Hysteresis

MCU-internal brownout detectors are typically specified with fairly wide accuracy tolerances and a limited number of selectable trip points. Dedicated external supervisor ICs are built specifically to monitor voltage precisely, and typically specify threshold accuracy in the region of 1–3% (verify the exact figure against the selected part's datasheet — accuracy varies by family and grade), considerably tighter than most MCU BOR specifications.

Supervisors also build in hysteresis — the voltage must rise a small amount above the trip threshold before the reset is released, not merely return to exactly the trip point — to prevent the reset output from chattering on and off if the supply rail is noisy or hovering near the threshold. Datasheets specify this as a hysteresis voltage or percentage; confirm it's adequate for your rail's expected ripple before finalising a threshold selection.

Manual Reset Input Debouncing

Many supervisor ICs include a dedicated manual reset (MR) input pin with internal debouncing, intended to be wired directly to a physical reset button with no external RC debounce network required. This is a common secondary reason to add a supervisor IC even in designs that don't need diverse watchdog redundancy: a clean, bounce-free manual reset button without an extra R and C on the schematic, and without relying on the MCU's own GPIO/NRST debounce behaviour (which, if the MCU itself is misbehaving, may not be trustworthy).

Reset Output Configuration

Supervisor ICs are offered with different reset output polarities and drive types, and the correct choice depends on the MCU's reset pin requirements:

The open-drain option matters in multi-rail or multi-supervisor systems: several supervisor ICs (one per monitored rail, for example) can share a single reset line to the MCU, with any one of them able to assert reset without conflicting drive from the others.

Selecting Between Common Families

Choosing between them is largely a question of how much external configurability is needed (adjustable vs pin/factory-fixed thresholds and timeouts) against BOM simplicity — a fixed-threshold, pin-strapped part like the MAX6369 needs no external timing components at all, while an adjustable part like the TPS3813 trades a couple of passive components for threshold and timeout values that don't require ordering a different factory-trimmed part number if the design changes.

Integrating With the MCU's Internal Watchdog

For designs pursuing diverse redundancy under a functional safety standard, the external supervisor's watchdog input and the MCU's internal IWDG are typically kicked from the same firmware health-check logic but wired to genuinely independent reset paths — both must be satisfied for the system to keep running, and either one alone is capable of forcing a reset. This differs from simply using a longer or shorter timeout on one versus the other; the value is in the independence of the two implementations, not in layering two timers with different periods.

For firmware architecture that incorporates this kind of layered supervisory design, Zeus Design's electronics engineering team designs both the reset/supervisory circuit and the firmware health-check logic that drives it.

Design Considerations

• Set the reset pulse width to cover the MCU's full power-up sequence. The reset output must stay asserted long enough for the MCU's internal power rails, oscillator startup, and any PLL lock time to complete before release — check the reset IC's pulse-width specification against the MCU's documented startup timing, not just its own default value.
• Confirm hysteresis is adequate for your rail's actual ripple, not just the nominal supply. A supervisor with too little hysteresis on a rail with switching-regulator ripple close to the threshold can chatter the reset line repeatedly rather than resetting cleanly once.
• Decide reset output polarity and drive type before finalising the MCU's reset pin design, particularly if multiple supervisors or reset sources need to share one reset line via open-drain wire-OR.
• Treat threshold selection as a system-level decision, not just an MCU spec lookup. Other ICs sharing the same rail (sensors, radios, memory) may have their own minimum operating voltage requirements that are more restrictive than the MCU's — the supervisor threshold should protect the most voltage-sensitive device on that rail, not just the MCU.

Common Mistakes

• Choosing a threshold too close to the nominal rail voltage. A 3.3 V rail with a 3.2 V supervisor threshold will trigger nuisance resets from entirely normal regulator tolerance and ripple. Leave adequate margin between nominal voltage and the reset threshold.
• Assuming every supervisor IC includes a watchdog function. Some parts in these families are voltage-supervisor-only, with no WDI pin at all — a straightforward mistake when swapping between package/family variants without re-checking the specific part number's feature set.
• Wiring the watchdog input from an interrupt handler, mirroring the same mistake as an internal watchdog. Exactly as with an internal IWDG (see the Common Mistakes section of What Is a Watchdog Timer?), toggling the external WDI pin from an ISR that keeps running even while the main application is hung defeats the entire purpose of adding the external supervisor.
• Not accounting for reset pulse width in fast power-cycle testing. Products that are power-cycled rapidly during production test can trigger a supervisor's undervoltage lockout or minimum reset pulse timing in ways that don't occur during normal single power-up — validate supervisor behaviour under the actual production test power-cycling profile, not just a single clean power-up.