With positive-going reset signals, especially with signals pegged to a concurrently changing positive supply, to which it's referenced, there will never be a precisely defined point at which everything will work. There can be a point at which it probably works, but never better than that.

Further, even with the help of a supervisor, all bets are off during the generally quite long decay of the positive supply once primary power is turned off. With CMOS circuitry that doesn't require much power, the on-board capacitance can hold the supply value in limbo for several seconds, and even for several minutes (remember the bit about that clock/calendar board that was misrouted in the mail for two weeks, yet still kept good time?) or longer. This condition occurs at a time when the on-chip charge pump for FLASH write and erase functions are in full operation.

If the MCU continues to operate external signals, which it should NOT when RESET is asserted, then the internal signals certainly also are able to do that. I'm persuaded that the power-down portion of the power cycle is the most likely to cause trouble, precisely because the positive supply, against which the RESET is compared, and on which both the oscillator and the brownout sensors rely, is wandering around. That's why I'm thinking it would be desirable to pull Vdd down to 0.5 volts or less within less than one machine cycle of determining that power has been shut off.

What I don't know is how, exactly, to make this (Vdd, RESET, oscillator) all work properly without requiring too complex a circuit. The same conditions, i.e. changing Vdd while trying to generate a reasonable RESET and getting the oscillator to start during the power-ON cycle does, in light of what Kai has said, give me some pause. The supervisor seems capable of managing the power-ON portion of the power cycle quite adequately, but I'm concerned about what it can do to help with the power-down portion, which, to my mind, is more likely to allow for some damage to "nonvolatile" memory, whether FLASH or BBRAM, internal or external. Once the MCU is doing things we don't want, it's likely to be doing damage. If we don't see to it that it can't, we're in trouble.

I've considered stopping the oscillator, which could easily be done with a gate or a transistor. Starting it back up is another thing, though.

That's why I was thinking a MOSFET half-bridge might be the way to pull down the positive supply quickly enough to avoid any run-on, and that same half-bridge could turn on the positive supply with enough energy to kick-start the oscillator. I am, however, concerned about the fact that pulling the Vdd pin down below the on-chip Vdd might do irreparable harm to the MCU. That's why I've been concerned about the lack of specifications on the behavior of Vdd.

The obvious thing to do is to give it a try, break a few MCU's, perhaps, and then try to draw some conclusions with long repetitive cycles under control of a test environment. Manufacturers have been unwilling to do this and publish the results because it really doesn't help them. They bought the core license and don't want to take responsibility for an already-established product. Perhaps that also explains the longevity of that 10 uF Cap and 8k2 resistor as a RESET generator that we see in many datasheets and app-notes.

RE