STM32 PVD (Programmable Voltage Detector): Replacing External Supervisor ICs with On-Chip Brownout Detection

Every production embedded system needs reliable brownout detection. An MCU running at 3.3 V that experiences a slow ramp-down to 2.7 V will start producing bit-flips in SRAM, erratic GPIO levels, and corrupted flash writes long before the internal POR (Power-On Reset) threshold kicks in at roughly 1.7 V. The standard mitigation is an external supervisor IC — TPS3823, MAX809, MCP1316 — adding cost, PCB area, and a potential procurement headache.

Every STM32 built on a Cortex-M3 or newer core includes a Programmable Voltage Detector (PVD) that does exactly this, without external components. The PVD continuously compares V_DD against a programmable threshold and generates either an interrupt or a reset when the supply drops below (or rises above) the selected level. On the G4, the PVD lives in the PWR peripheral, controlled via PWR_CR2 and monitored via PWR_SR2. On the U5 and H5 series, the block is even more flexible, with additional window modes and hysteresis options.

This article covers the register-level configuration of the STM32 PVD: threshold selection, interrupt versus event mode, typical brownout use cases, and the one pitfall that catches everyone on first use.

PVD Architecture Overview

The PVD is an analog comparator with an internal voltage reference. One input is the scaled V_DD supply; the other is a programmable reference derived from the internal bandgap. The block diagram is remarkably simple:

V_DD ─┬─► Voltage Divider ─► [[PVD Comparator]] ─► PVDO flag (PWR_SR2 bit 11)
         │                              │
   External pin                Programmable threshold
   (optional)                  via PLS[2:0] in PWR_CR2

When V_DD drops below the selected threshold, the comparator output goes high and the PVDO flag is set. This flag can trigger an interrupt on EXTI line 16 (PVD input), a wake-up event from low-power modes, or — on newer series — a direct hardware reset via the PVDR bit.

Available threshold levels (STM32G4 reference)

The PLS[2:0] field in PWR_CR2 selects one of eight rising thresholds. The falling threshold is approximately 100 mV lower due to built-in hysteresis:

PLS[2:0]	Rising threshold (V)	Typical falling (V)	Designation
000	2.00	1.90	LEV0
001	2.10	2.00	LEV1
010	2.30	2.19	LEV2
011	2.50	2.39	LEV3
100	2.65	2.54	LEV4
101	2.80	2.69	LEV5
110	2.95	2.84	LEV6
111	3.05	2.94	LEV7

For a 3.3 V system, LEV7 (3.05 V rising / 2.94 V falling) is the closest match. This gives you roughly 300 mV of margin above the POR threshold of ~1.7 V, leaving comfortable headroom for an orderly shutdown.

Register-Level Configuration: PVD Interrupt Mode

Interrupt mode is the most common use case: the PVD generates an interrupt on EXTI line 16, and your ISR performs an emergency save (NVRAM write, EEPROM commit, actuator park) before V_DD drops far enough to corrupt anything.

Step-by-step configuration (STM32G4, register level)

// 1. Enable the PVD clock (PWR is always in APB1 clock domain)
RCC->APB1ENR1 |= RCC_APB1ENR1_PWREN;

// 2. Configure threshold to LEV7 (3.05 V rising) and enable PVD
PWR->CR2 &= ~PWR_CR2_PLS_Msk;            // Clear threshold bits
PWR->CR2 |= PWR_CR2_PLS_LEV7;            // Select LEV7
PWR->CR2 |= PWR_CR2_PVDE;                // Enable PVD

// 3. Connect PVD output to EXTI line 16
EXTI->IMR1  |= EXTI_IMR1_IM16;           // Unmask interrupt on line 16
EXTI->RTSR1 |= EXTI_RTSR1_RT16;          // Rising edge: VDD crosses threshold upward
EXTI->FTSR1 |= EXTI_FTSR1_FT16;          // Falling edge: VDD crosses threshold downward

// 4. Enable NVIC interrupt for PVD
NVIC_SetPriority(PVD_PVM_IRQn, 3);
NVIC_EnableIRQ(PVD_PVM_IRQn);

ISR implementation

void PVD_PVM_IRQHandler(void)
{
    // Clear the EXTI pending flag
    EXTI->PR1 |= EXTI_PR1_PIF16;

    // Read the PVDO flag: 1 = VDD below threshold, 0 = VDD above threshold
    if (PWR->SR2 & PWR_SR2_PVDO)
    {
        // VDD dropped below threshold — emergency actions
        disable_interrupts();
        save_critical_registers_to_backup_sram();
        commit_pending_eeprom_pages();
        park_actuators();
        // Optionally enter STOP mode to reduce consumption during brownout
    }
    else
    {
        // VDD rose above threshold — power restored
        restore_normal_operation();
    }
}

The PVDO flag must be read inside the ISR because the EXTI line fires on both edges. A common mistake is to only check one edge — if your code assumes the interrupt always means "brownout", it will misinterpret a power-restored event as another brownout and call park_actuators() when it should be resuming normal operation.

PVD Event Mode: Wake from Low-Power States

The PVD can also generate a wake-up event from Stop or Standby mode without enabling the interrupt. This is useful for battery-powered devices that must shut down gracefully when the battery voltage drops below the safe operating range:

// Configure PVD (same threshold setup)
RCC->APB1ENR1 |= RCC_APB1ENR1_PWREN;
PWR->CR2 &= ~PWR_CR2_PLS_Msk;
PWR->CR2 |= PWR_CR2_PLS_LEV7;     // 3.05 V
PWR->CR2 |= PWR_CR2_PVDE;         // Enable

// Connect to EXTI line 16 as event (not interrupt)
EXTI->EMR1 |= EXTI_EMR1_EM16;     // Event mask, not interrupt mask
EXTI->FTSR1 |= EXTI_FTSR1_FT16;   // Falling edge only

// Enter Stop mode
PWR->CR1 |= PWR_CR1_LPMS_STOP0;   // Stop 0 mode
__WFI();                           // Will wake when VDD drops below threshold

// After wake: read PVDO, handle shutdown sequence

In event mode the CPU wakes directly without executing an ISR — the wake-up is treated as a reset-like exit from Stop. Check PVDO in the first few lines of main() to determine the wake source.

PVD Direct Reset Mode (STM32U5 / H5 / G0)

On newer STM32 families, the PVD can trigger a direct hardware reset when V_DD drops below the threshold, completely eliminating the software response path. This is the closest you get to a zero-BOM supervisor IC:

// STM32U5 example: PVDR bit in PWR_CR1
RCC->APB1ENR1 |= RCC_APB1ENR1_PWREN;
PWR->CR2 &= ~PWR_CR2_PLS_Msk;
PWR->CR2 |= PWR_CR2_PLS_LEV5;     // 2.80 V
PWR->CR2 |= PWR_CR2_PVDE;         // Enable PVD
PWR->CR1 |= PWR_CR1_PVDR;         // PVD reset mode (available on U5, H5, G0)

The part resets cleanly when V_DD falls below the threshold. No ISR, no firmware response, no external IC. The reset source register (RCC_RSR / RSR) will show a PVD reset, which you can log for post-mortem analysis.

Practical Example: Emergency State Save on STM32G474

I recently used the PVD on a G474-based motor controller to save rotor position and PWM state during a brownout. The system runs at 3.3 V; below 2.9 V the gate drivers become unreliable, but the MCU continues operating until roughly 1.7 V. That gives us a ~1.2 V window — approximately 15 ms at a moderate discharge rate — to commit critical state.

Setup

#define PVD_THRESHOLD_LEV6  PWR_CR2_PLS_LEV6  // 2.95 V rising, 2.84 V falling

void pvd_init(void)
{
    RCC->APB1ENR1 |= RCC_APB1ENR1_PWREN;
    (void)PWR->CR2;  // Delay after clock enable

    PWR->CR2 &= ~PWR_CR2_PLS_Msk;
    PWR->CR2 |= PVD_THRESHOLD_LEV6;
    PWR->CR2 |= PWR_CR2_PVDE;

    EXTI->IMR1  |= EXTI_IMR1_IM16;
    EXTI->RTSR1 |= EXTI_RTSR1_RT16;
    EXTI->FTSR1 |= EXTI_FTSR1_FT16;

    NVIC_SetPriority(PVD_PVM_IRQn, 2);
    NVIC_EnableIRQ(PVD_PVM_IRQn);
}

void PVD_PVM_IRQHandler(void)
{
    EXTI->PR1 |= EXTI_PR1_PIF16;

    if (PWR->SR2 & PWR_SR2_PVDO)
    {
        // Brownout: save rotor angle to backup SRAM
        BACKUP_SRAM->rotor_theta = hrtim_get_theta();
        BACKUP_SRAM->pwm_duty_a = HRTIM1->CH1CVR;
        BACKUP_SRAM->pwm_duty_b = HRTIM1->CH2CVR;
        BACKUP_SRAM->pwm_duty_c = HRTIM1->CH3CVR;
        BACKUP_SRAM->checksum = crc32(&BACKUP_SRAM, sizeof(BACKUP_SRAM) - 4);
        BACKUP_SRAM->magic = 0xA5A5A5A5;

        // Disable PWM outputs immediately
        HRTIM1->CR2 &= ~HRTIM_CR2_MEN;
        GPIO_WriteLow(GPIOB, HRTIM_FAULT_PIN); // Assert brake

        __WFI();  // Wait for POR or external reset
    }
    else
    {
        // Power restored — can resume if the MCU hasn't fully discharged
        if (BACKUP_SRAM->magic == 0xA5A5A5A5)
            restore_from_backup();
    }
}

The discharge time depends on the decoupling capacitor bank. A 10 µF + 100 nF on V_DD provides roughly 10 ms from the LEV6 threshold (2.84 V) down to 1.7 V POR at a 50 mA load. If you need more time, add bulk capacitance — 100 µF gives ~100 ms, enough to write multiple flash pages.

Practical Checklist

Threshold choice: pick the highest threshold that does not trigger during normal supply ripple. For a 3.3 V rail with ±5% tolerance, LEV7 (3.05 V) works. For 3.0 V LDOs, drop to LEV6 (2.95 V) or LEV5 (2.80 V).
Hysteresis is your friend: PVD has ~100 mV built-in hysteresis. Never add software debouncing unless the supply is extremely noisy — the analog filter is better than any digital workaround.
EXTI edge polarity: enable both rising and falling edges, then read PVDO inside the ISR. A single edge will miss half the transitions.
PWR clock enable: the PWR peripheral registers are in the APB1 clock domain. Read PWR->CR2 after enabling the clock to insert the required wait state before the first write.
Backup SRAM vs RTC backup registers: Backup SRAM (4 KB on G4) survives Standby and VBAT modes. The 20 RTC backup registers are limited — use them for the magic/checksum only, not full state.
Post-brownout reset handling: check RCC->RSR (or RCC->CSR on older series) at startup to distinguish a PVD-triggered reset from a normal power-up. Log it for manufacturing test coverage.

How I Would Approach This on a Client Project

On a production project I would use PVD interrupt mode with the following architecture:

Set PLS to LEV6 (2.95 V rising) on a 3.3 V rail — gives ~250 mV of margin after regulator tolerance.
Enable both rising and falling EXTI edges; use PVDO to distinguish brownout from recovery.
Save critical state to backup SRAM with a CRC32 and magic word. On brownout entry, disable all PWM/comms outputs, assert a hardware brake line, then enter Stop mode.
On recovery (power restored event), check the magic word in backup SRAM. If valid, restore state and resume. If invalid, perform a full re-init — the SRAM contents degraded during the brownout.
Log the PVD reset cause in a dedicated backup-SRAM counter so firmware can report "3 brownout events since last power cycle" over the debug UART or via a diagnostic tool.
_Beware the VBAT-domain gotcha_: the PVD monitors V_DD, not V_BAT. If your RTC runs on battery while V_DD is off, the PVD will not detect a V_BAT drop. Use a separate PVM (Peripheral Voltage Monitor) on G4/U5 if you need to detect low battery on a secondary rail.

Sources

STM32G4 Reference Manual (RM0440) — PWR chapter, PVD register descriptions (PWR_CR2, PWR_SR2, EXTI line 16)
STM32U5 Reference Manual (RM0456) — PVDR reset mode and advanced PVD features
ST Application Note AN3109 — STM32 PVD application note
ST Application Note AN3309 — Using the STM32F2/F4 PVD (legacy but still valid for interrupt/event modes)
STM32G4 CMSIS header (stm32g431xx.h) — PWR register bit definitions
Arm Cortex-M3/M4/M7 Technical Reference Manual — EXTI event handling for low-power wake

STM32 PVD (Programmable Voltage Detector):Replacing External Supervisor ICs with On-Chip Brownout Detection