Power Loss Protection

General Engineering Updated Sep 2026

Power-Loss Protection: Detection, Hold-Up, and Capacitor Health

A working reference on power-loss protection (PLP) circuits — using the discrete detector built for the Spitfire EV conversion as the worked example, then broadening out to IC-based detection, PMIC-integrated detection, hold-up capacitor charging (buck-boost territory — see buck-boost), and how to test and de-rate the capacitor bank so the protection is still real years into the vehicle's life.

1. What Power-Loss Protection Is Solving

PLP shows up in two superficially different domains that are actually the same problem: an enterprise SSD needs to know the instant its supply rail is going away so it can flush the write cache to NAND before the last few hundred microseconds of stored energy run out, and a vehicle needs to know the instant its 12V aux/ignition rail is going away — key turned off, a contactor opening, a wiring fault — so it can park actuators, log state, and shut down cleanly instead of just dying mid-instruction. Both cases decompose into the same three sub-problems: detect that the rail is failing, hold up a downstream rail long enough to act on that detection using stored energy (almost always capacitors), and know that the stored energy is still good before you actually need it.

Sections 2–4 below cover detection (the Spitfire's discrete circuit, then IC and PMIC alternatives); section 5 covers charging/ramping the hold-up capacitor bank; sections 6–7 cover testing and aging margin.

2. The Spitfire's Discrete Detection Circuit

This is the detector use in the EV spitfire project http://www.cospitfire.com. This is used to save the milage, charge used, and other info when the car is turned off. This is a from-scratch transistor-level detector: one TVS diode, one small-signal NPN, one zener, and five resistors/a filter cap, converting "12V aux rail present or not" into a 3.3V-logic "PowerFail Detect" flag for the MCU.)

spitfire plp detect

Component roles:

Ref Part Function
D1 SMBJ24A TVS (series-connected) Doubles as a reverse-battery blocking diode (forward Vf drop, ~0.7–1V) and a transient/surge clamp — absorbs automotive load-dump and other transients on the 12V line before they reach the sense divider. This is a common trick: a unidirectional TVS placed in-line does double duty instead of needing a separate series diode plus a separate shunt TVS.
C1 1 nF Forms a low-pass/de-glitch filter with the surrounding resistances so brief noise on the 12V line (switching transients, alternator ripple, connector bounce) doesn't false-trigger a power-fail flag.
R2 5k Feeds sense current from the (post-D1) 12V node down into the base-drive path and the R3/zener clamp branch.
R3 + D2 680Ω + 8.2V zener A secondary clamp: holds the node feeding R5/Q1's base at roughly the zener voltage even if a transient gets past D1, protecting the base-emitter junction and R5 from ever seeing a large fraction of a 12V (or higher, during a transient) swing directly.
R5 220k Base current-limiting resistor — sets Q1's base drive to a level that keeps steady-state power dissipation in the divider low (µW–mW range) while still driving Q1 hard into saturation when 12V is present.
Q1 BC547 NPN The actual threshold element. Conducts (saturates) when there's enough base drive — i.e., 12V is present — pulling its collector low. Stops conducting when the sense voltage collapses, letting the collector float up.
R6 4.7k, pull-up to 3.3V Defines the logic-level output: "PowerFail Detect" reads low while Q1 is saturated (healthy), and gets pulled to 3.3V when Q1 turns off (fault).
R7 220Ω Emitter resistor to ground — provides mild emitter degeneration and the DC return path for the sense circuit.

Operation:

  • 12V present (normal): current flows through D1 → R2 → R5 into Q1's base; the base drive available is large enough to drive Q1 solidly into saturation regardless of normal hFE/temperature variation, pulling the collector down close to ground. PowerFail Detect reads logic LOW — no fault.
  • 12V lost (ignition off, a contactor opens, a harness fault, a blown fuse upstream): the sense node collapses quickly (bounded by the R2/C1 filter's time constant), base drive disappears, Q1 turns off, and R6 pulls PowerFail Detect up to 3.3V. The MCU sees that transition on a GPIO and runs its power-loss handling routine — functionally the same role as the GPIO-based detection enterprise SSD controllers use to trigger a cache flush.

Characteristics worth knowing before relying on this design:

  • This is fundamentally a presence/absence detector, not a precision brownout comparator. Because R5 (220k) dominates the base-drive path and Q1's own Vbe (~0.6–0.7V) sets the real turn-off point, the circuit trips close to "12V is essentially gone," not at a clean, calibrated intermediate threshold like 9.5V. That's usually exactly what you want for a "did we lose the rail" flag, but it's worth being explicit about, since it's a different design goal than an undervoltage/brownout detector.
  • There's no factory-trimmed accuracy here — the actual trip voltage depends on Q1's Vbe (which has a roughly −2 mV/°C temperature coefficient) and hFE, plus resistor tolerances, so it will drift a bit with engine-bay temperature and part-to-part variation. Worth bench-verifying the actual trip point (sweep the 12V supply down slowly and note where the GPIO flips) rather than trusting a hand calculation.
  • No hysteresis/Schmitt action — the transition from "on" to "off" is a soft, gain-limited roll-off rather than a snap transition, and there's a single threshold rather than separate assert/deassert points. In a noisy electrical environment this is where C1's filtering is doing real work, and it's the main thing a dedicated comparator IC (§3) buys you back.
  • No self-check: if Q1 (or a solder joint) fails, the circuit can silently stop reporting anything. For roughly a dollar in parts and an evening of debugging, that's a reasonable trade for a one-off build; it's the first thing to reconsider if this circuit graduates from a hobby project toward something you'd trust unsupervised.

3. IC-Based Detection Options

The Spitfire circuit is, functionally, a divider feeding a bare transistor acting as a threshold comparator. Dedicated supervisor/monitor ICs do the same job with a factory-trimmed reference and comparator instead of a BJT's Vbe, buying back accuracy, hysteresis/deglitch, and (often) an early-warning stage ahead of a hard reset threshold.

IC family Example Threshold accuracy Notable features Good fit
Nanopower fixed-threshold supervisor TI TPS3839 ±1% (factory-trimmed) 150 nA typical supply current; threshold is fixed per part number (0.9V–4.38V range), but TI's app note SLVA534 shows using an external resistor divider ahead of it to monitor higher voltages — the same divider-into-a-comparator idea as the Spitfire circuit, just landing on a trimmed reference instead of a bare Vbe Battery-sensitive designs (a parked EV needs to sip almost nothing from the 12V battery over weeks)
Precision multi-channel supervisor ADI ADM1184 0.8% Monitors up to four rails simultaneously with sequencing/tracking support Designs already tracking several rails (12V aux, HV bus telemetry, 3.3V/5V logic) where one part can replace several single-channel detectors
Supply monitor with dedicated power-fail comparator ADI LTC2911 ±1.5% A separate PFI/PFO comparator (0.5V internal reference, externally adjustable via resistor divider) distinct from the main reset thresholds, plus a programmable glitch-filter/timeout (internal 200ms, or set externally at ~9.4ms/nF) Designs that want an early "power is degrading" warning that fires before a hard brownout/reset threshold, giving the MCU more time to act
Automotive-qualified variants AEC-Q100 (“-Q1”) parts across TI/ADI/onsemi/Microchip supervisor lines Datasheet-specified Wider temperature range and automotive qualification testing The step to take if this ever moves from a one-off hobby build toward something built to survive years of engine-bay temperature cycling

The practical upgrade path from the Spitfire circuit is straightforward: keep the same conceptual divider-into-a-comparator structure, but replace the bare BJT with one of these parts to get a guaranteed threshold, built-in deglitch, and (with something like the LTC2911) a genuine early-warning stage ahead of the point where the rail is actually gone.

4. Can a PMIC Do This Too?

Often, yes — and if a design already carries a PMIC for other rail generation, that's frequently the cheapest place to get power-loss detection rather than adding a dedicated part. Many multi-rail PMICs, particularly automotive- and industrial-grade ones, integrate an analogous input-undervoltage comparator as one block among the many they already provide — surfaced as a dedicated power-fail/early-warning pin (conceptually the same PFI/PFO idea as the LTC2911 above), a programmable VIN-UVLO threshold, or a PGOOD-style flag that can be repurposed as a power-loss signal to the host MCU. The tradeoff versus a standalone supervisor IC is the usual PMIC one: less flexibility in exactly which node/threshold you can wire to since the comparator is tied to the PMIC's own input pin, but one fewer part and one fewer connector/trace if a PMIC is already in the design. Worth specifically checking the datasheet's power-good/power-fail section on any PMIC already in a design before adding a separate detector — the function may already be sitting there unused.

5. Ramping Up (and Down) the Hold-Up Capacitor Bank

Detection only tells you the rail is failing; the actual protection comes from whatever energy is stored in the hold-up capacitor bank, and getting that energy in and back out cleanly is its own design problem — this is where buck-boost topology becomes directly relevant (see buck-boost for the full topology and equations).

Charging the bank: A fully discharged capacitor bank looks like close to a short circuit, so charging it directly off the rail without current limiting risks excessive inrush current — enough to trip a fuse, brown out the source rail, or stress the switches feeding it. The standard approach is a controlled, current-limited charge (a constant-current phase up to the target voltage, then a constant-voltage float, the same CC/CV shape used for battery charging), implemented with a switching charger rather than a raw resistor so the charge time stays reasonable without dissipating the inrush energy as heat.

There's also a reason to consider charging the bank to a voltage above the rail it's protecting, which is where a boost or buck-boost stage comes in rather than a plain buck: stored energy scales with the square of voltage (E = ½CV²), so for a given capacitor volume/cost, charging to a higher voltage stores meaningfully more usable energy than charging only to the rail voltage. A buck-boost charger can hit that higher target regardless of exactly where the source rail sits, and the same stage run in reverse during a power event can regulate the bank's falling voltage back down to a stable output rail as the caps discharge — letting the design draw the bank almost all the way down to empty rather than stopping once it sags below the minimum usable input voltage a simple direct connection would require. That difference is significant: usable energy is ½C(V_initial² − V_final²), and pulling V_final close to zero rather than stopping at, say, 70% of V_initial captures most of what's actually stored.

Series stacks and balancing: If the target voltage requires stacking multiple capacitors (or supercapacitor cells) in series, cell-to-cell capacitance tolerance — often ±20% on supercapacitors — causes uneven voltage division during charge, which can push an individual cell over its rated voltage even while the stack as a whole reads fine. Passive balancing (bleeder resistors across each cell) is the simple fix for a hobby-scale build; active balancing (per-cell shunt regulators) is worth it once the stack gets large enough that bleeder losses become a real efficiency hit.

6. Testing Whether the Capacitors Are Still Good

The failure mode that matters most for PLP isn't the capacitor bank failing outright — it's the capacitor bank quietly having less capacity and higher ESR than the design assumed, so it silently no longer covers the hold-up time it was sized for. A few ways to check, roughly in order of how accessible they are for a home-built EV vs. a lab bench:

  • Visual inspection (electrolytics only): bulging or domed can tops, a vented pressure-relief slit that's actually opened, or visible electrolyte leakage/staining are late-stage but unambiguous failure signs — free, and worth a glance at every service interval.
  • In-circuit ESR meter: dedicated ESR meters inject a small AC signal (commonly ~100 kHz) and read impedance without needing to desolder the part, useful for a quick spot-check against the datasheet's rated ESR.
  • Out-of-circuit LCR/impedance analyzer: the accurate way to get both capacitance and ESR, but requires pulling the part — appropriate for a periodic teardown check, not something to build into the vehicle itself.
  • Functional constant-current discharge test (the method actually used in SSD PLP self-tests): charge the bank to its rated voltage, then discharge it through a known current while logging voltage vs. time. Capacitance falls out of the discharge slope (C = I·Δt/ΔV between two reference voltage points), and ESR falls out of the instantaneous voltage step at the moment the current load engages (ESR = ΔV_step/ΔI). This is exactly the non-invasive approach enterprise SSDs use — the controller periodically runs a self-test discharge and reports capacitor health over SMART — and it translates directly to an EV build: the MCU that already watches PowerFail Detect can trigger a controlled partial discharge through a known load at safe moments (car parked, ignition off) and log the resulting capacitance/ESR trend over time.
  • Trend, don't just threshold: a single measurement against a fixed pass/fail line is less useful than comparing against the bank's own baseline taken when new — a capacitor bank aging faster than its rated curve predicts is the thing worth catching early, and that only shows up as a trend across repeated tests.

One practical caution: a full discharge test consumes the very reserve the circuit exists to protect, so it should run at a moment where a real power-loss event during the test would be low-consequence (parked, not mid-drive), or be scoped to a partial discharge depth rather than a full cycle every time, so the test itself isn't what wears the capacitors out.

7. Margin to Build In for Capacitor Aging

Capacitor aging is well-characterized enough to design margin around rather than guess at:

  • Temperature — the "10°C rule": aluminum electrolytic capacitor life follows an Arrhenius relationship, commonly approximated as life doubling for every 10°C the operating temperature runs below the capacitor's rated maximum core temperature (life multiplier ≈ 2^(ΔT/10)). An engine-bay or under-dash mounting location running meaningfully hotter than a benign 25°C office environment can cut rated life dramatically compared to the datasheet's headline number — worth checking the actual expected mounting temperature against the part's rated life curve rather than assuming the datasheet life figure applies as-is.
  • Voltage derating: running a capacitor below its rated voltage extends life further, following a power-law relationship (vendor-dependent exponents, commonly in the 3–5 range for the ratio of applied to rated voltage) — a common and cheap way to buy extra service life is simply not charging the bank all the way to the capacitor's rated voltage ceiling, if the energy budget allows the slack.
  • What "end of life" means for the part: capacitor manufacturers commonly define rated life by parametric drift limits — capacitance having drifted on the order of ±20% from its initial value, and/or ESR having risen to roughly double its initial spec — rather than the part failing outright. That's the standard worth designing against: a hold-up bank that just barely meets its energy budget with fresh, nameplate capacitance will fall short well before the capacitor is "dead" by any obvious measure.
  • Design margin recommendation: size the bank against its end-of-life capacitance and ESR, not its nameplate values — re-run the hold-up energy budget (E = ½C(V_initial² − V_final²) from §5) using a derated capacitance (e.g., knock 20–30% off nameplate) and a doubled ESR, at the hottest realistic mounting temperature the bank will see, and confirm the hold-up time requirement is still met under those numbers. Then use the self-test data from §6 to actually confirm the real bank is aging in line with that assumption over the vehicle's life, rather than trusting the derating math alone indefinitely.

Sources

Contact

Have an Idea?
Let's Build It.

Whether you're a startup with a hardware concept, an established company needing deep design help, or an enthusiast with a wild project — we want to hear about it.

Emailaglucas@globaltrendanalysis.com
Phone(303) 921-4492
LocationBoulder, Colorado