In what situation should I keep the Brown-out Detection feature OFF on a microcontroller?
Everything has tolerances, so the brown out reset level must be set somewhat above the minimum level at which the chip is guaranteed to function properly.

Hence the brown out might kick in well before the chip would malfunction. So you have to ask yourself, for this region, where the chip might function OK but you can't be sure, would you choose


to let the chip work and hope the best of it (it might work!), or
to let the chip be reset (and kept in reset) by the brown-out circuit.


If the cost of malfunctioning is not much higher than the cost of not functioning at all the first option is to be preferred. Think of the ping-feature on an airplane 'black box'. By all means, let it go on if there is even the slightest chance that it will give a ping!

On the other side, consider the triggering of a bomb or a car airbag. If there is the slightest chance of it going off by accident due to a low power voltage, it should better shut itself off. That of course assumes that shutting of means not igniting!

There are situations where no good choice is available. Consider the infamous first Ariane V rocket launch. The direction control computer(s) malfunctioned (in this case not due to low power). What should it do? Going on most probably means steering in the wrong direction, but quitting means not steering at all, which has the same result. Neither is a nice prospect for the people in the control bunker that the rocket might wander into :(



As Ross comments, a backup is of course a good idea for a mission-ciritical system. But that shifts the design problem to that backup. What if that fails? (In practice there are often 3, active all the time, using a majority vote.) In the case of the Ariane 5 both primary and backup computers failed (Though not through their own fault, but that is another story.) What happened next was that some other system (maybe it was even a human in the control room) detected that everything was out of control and triggered the self-destruct. Better have the rocket explode in the air and fall down in small pieces in the sea that have it continue its flight in one piece in some random direction.