An STM32F103 combines a 72 MHz Cortex-M3, 64 KB of flash, and 20 KB of SRAM; what makes it a microcontroller rather than just a CPU?

It is a microcontroller because the CPU core, memory, and hardware peripherals are integrated on one chip. - The Cortex-M3 core fetches and executes the firmware instructions stored in the 64 KB flash. - The 20 KB SRAM holds mutable data such as the stack, globals, and communication buffers while power is on. - On-chip GPIO, timers, ADC, UART, I2C, and SPI blocks let firmware control hardware without separate controller chips. - The 72 MHz core clock sets the upper instruction rate, but peripheral clocks and bus dividers may run those blocks more slowly.

On a 48 MHz Cortex-M0+ with 32 KB of flash and 8 KB of RAM, a GPIO output register is mapped at address 0x41004410; what does memory-mapped I/O mean when firmware writes there?

Memory-mapped I/O means a normal-looking load or store accesses peripheral hardware at that address instead of RAM. - Firmware should use the vendor register definition or a volatile uint32_t pointer for the 32-bit register at 0x41004410. - A store changes GPIO hardware bits, so the value may drive physical pins rather than remain as ordinary memory. - The GPIO peripheral clock must be enabled before access or the write may have no effect or cause a bus fault. - The reference manual defines writable and reserved bits, so firmware must preserve fields it does not own.

After reset, an STM32 Cortex-M4 has flash physically mapped at 0x08000000; through which address does the core fetch the first vectors, and what do their first two entries contain?

The core initially fetches the vectors through the boot alias at 0x00000000, which STM32 can map to flash physically located at 0x08000000. - The first word at the alias is loaded into MSP by hardware before any software instruction runs. - The second word is loaded as the reset handler address, with bit 0 set for Thumb state. - Boot pins, option bytes, and remapping determine which physical memory appears at 0x00000000, so the initial fetch is not inherently from 0x08000000. - The reset handler then initializes memory and clocks before main, and firmware may later relocate vectors through VTOR.

A board starts from an 8 MHz crystal but the Cortex-M3 must run at 72 MHz with 64 KB of flash; what clock setup steps must firmware perform before switching to the PLL?

Firmware must configure and stabilize the clock sources before selecting the 72 MHz PLL output as the system clock. - Enable the 8 MHz external oscillator and wait for its ready flag instead of assuming it starts instantly. - Configure the PLL multiplier for 8 MHz times 9 and set APB dividers so no peripheral bus exceeds its rated frequency. - Set the flash wait states required for 72 MHz before raising the core clock, or instruction fetches can fail. - Switch the system clock source to the PLL and verify the status bits report the intended source.

On a 72 MHz STM32F103, an active-low LED is wired to PC13; how would you configure and drive it through GPIO registers without disturbing the other 15 port pins?

I would enable port C, configure only pin 13 as an output, and use the GPIO set/reset register to drive the active-low LED. - First set the port C clock-enable bit and read the reference manual for the configuration field that controls PC13. - Clear only PC13's four configuration bits, then select a push-pull output speed suitable for a slow LED. - Write the pin-13 reset half of BSRR to turn the LED on and the set half to turn it off. - BSRR changes one pin without a read-modify-write that could overwrite concurrent changes to other port bits.

A 1 kHz timer ISR sets a uint32_t flag and a 10 ms main loop checks and clears it on a 32-bit Cortex-M3; is declaring the flag volatile sufficient?

No, volatile makes accesses observable to the compiler, but it does not make the check-and-clear sequence atomic or synchronized. - Volatile prevents the compiler from caching the flag in a register or removing accesses that can change outside normal flow. - The ISR can set the flag between the main loop's read and clear, causing one timer event to be lost. - An aligned 32-bit load or store is individually atomic on this core, but the two-operation sequence is not. - Use a short critical section, an atomic primitive supported by the toolchain, or a counter with a deliberately safe handoff design.

A 32-bit peripheral register at 0x40021000 uses bits 4 through 6 for a clock divider; how would you change that field to binary 101 on a 48 MHz MCU while preserving every other bit?

I would clear the three-bit field with a mask and then insert 101 shifted into bits 4 through 6. - The field mask is 0x7 shifted left by 4, which covers exactly bits 4, 5, and 6. - Read the register once, apply value &= ~mask, then apply value |= (0x5 << 4) & mask. - Write the combined value back through the vendor's volatile 32-bit register definition. - If hardware offers dedicated set and clear registers, prefer them when concurrent writers make read-modify-write unsafe.

A 12-bit ADC on a 64 MHz MCU produces 1,000 samples up to 4095; which integer widths would you use for each sample and for their sum, and why?

I would store each sample in uint16_t and accumulate the 1,000-sample sum in uint32_t. - Twelve bits fit in uint16_t, while uint8_t would truncate values above 255. - The maximum sum is 4,095,000, which exceeds the uint16_t maximum of 65,535. - A uint32_t accumulator safely holds that maximum and allows an integer average afterward. - Fixed-width types make the storage and range assumptions explicit across compilers and MCU families.

A Cortex-M0+ runs at 48 MHz and must produce a 10 microsecond pulse; why is a counted empty loop a poor timing method even if 480 clock cycles seems correct?

A hardware timer is the reliable choice because an empty loop does not have a stable one-cycle-per-iteration duration. - Instructions, branches, flash wait states, and pipeline effects determine the real cycle count, not just the 48 MHz clock. - Compiler optimization can shorten, reorder, or remove an empty delay loop entirely. - Interrupts can pause the loop and stretch the 10 microsecond pulse unpredictably. - A timer compare or output-compare channel measures peripheral clock ticks and can toggle the pin at a defined count.

A device header defines a 32-bit status register on both a 32-bit Cortex-M4 and a host test build where unsigned long is 64 bits; why should the register use uint32_t rather than unsigned long?

The register should use uint32_t because its hardware width is exactly 32 bits regardless of the compiler data model. - uint32_t is 32 bits when provided, while unsigned long can be 32 or 64 bits across targets. - A wrong-width volatile access can touch adjacent addresses or generate an unsupported bus transaction. - Bit masks such as UINT32_C(1) << 31 then have a known width and predictable behavior. - A static assertion on the register type size can catch an unsuitable build configuration early.

A Cortex-M4 product has 32 KB of RAM, with 12 KB of static buffers and a planned 8 KB stack; how would you decide whether to use a heap for temporary 6 KB packet assembly?

I would avoid an unconstrained heap here and first account for the full worst-case RAM budget. - Static storage plus the planned stack already consumes 20 KB, leaving 12 KB before library and interrupt-stack needs. - A 6 KB allocation leaves little margin and can fail or fragment after varied allocation patterns. - A fixed 6 KB workspace with explicit ownership gives deterministic memory use if only one packet is assembled at a time. - The linker map and stack high-water measurement should confirm the remaining margin rather than relying on the nominal 32 KB.

A function receives a pointer to a 64-byte UART buffer on a 48 MHz MCU; why can it not determine the array length with sizeof(buffer) inside the function?

Inside that function, buffer is a pointer, so sizeof returns the pointer size rather than the original 64-byte array size. - An array argument is adjusted to a pointer parameter when passed to a function. - On a 32-bit Cortex-M, sizeof(buffer) is typically 4, not 64. - Pass the capacity explicitly, such as a pointer plus size_t length, and validate all indexes against it. - If the function truly requires exactly 64 bytes, the interface can use a wrapper type that preserves the size contract.

A setup function stores the address of a local 32-byte sensor buffer for a callback that runs 5 ms later; what is wrong with that lifetime?

The stored pointer becomes invalid when the setup function returns because the local buffer's automatic lifetime has ended. - The same stack bytes may be reused by another function before the callback runs 5 ms later. - Reading through the stale pointer is undefined behavior and may appear to work only in some builds. - Give the buffer static lifetime, place it in a longer-lived owner object, or copy the required data into callback-owned storage. - The ownership rule should state who may modify the 32 bytes while the callback is pending.

A byte stream places a 32-bit counter at offset 1 in a 16-byte packet, and a Cortex-M0 faults on some unaligned accesses; how should firmware read the counter?

Firmware should copy or assemble the four bytes into an aligned uint32_t instead of casting buffer + 1 to uint32_t pointer. - The address at offset 1 is not guaranteed to meet the counter's four-byte alignment requirement. - A direct cast can fault on the target and also violates C aliasing or object-representation rules. - memcpy into an aligned uint32_t is clear and compilers usually optimize the fixed four-byte copy efficiently. - Decode the specified byte order after the copy because alignment and endianness are separate concerns.

A little-endian Cortex-M3 must send the 16-bit value 0x1234 over UART in network byte order at 115200 baud; which bytes go first?

The UART packet must send 0x12 first and 0x34 second because network byte order is big-endian. - Little-endian describes how 0x1234 is laid out in MCU memory, normally 0x34 then 0x12 at increasing addresses. - The wire protocol defines its own byte order and must not depend on the CPU's memory layout. - Encode the high byte with value >> 8 and the low byte with value & 0xFF. - A receiver test using 0x1234 catches accidental host-endian serialization clearly.

On a 32-bit Cortex-M4, what size do you expect for a struct containing uint8_t type, uint32_t timestamp, and uint16_t value, and how would you avoid assuming it is 7 bytes?

I would expect padding and verify with sizeof rather than assume the three fields total 7 bytes. - The compiler commonly inserts three bytes before timestamp so the uint32_t starts at a four-byte boundary. - It may add two tail-padding bytes so consecutive struct elements keep the required alignment, producing 12 bytes. - Reordering to uint32_t, uint16_t, uint8_t can reduce the common size to 8 bytes without packed access. - For a wire or flash format, serialize fields explicitly because compiler layout is not a stable protocol.

A 64 KB flash MCU uses a 256-byte calibration lookup table that never changes; how would const affect its interface and placement?

I would declare the table const and expose it through a pointer-to-const so callers cannot modify calibration data accidentally. - const documents that the 256 bytes are read-only after the firmware image is built. - A typical embedded linker can keep such data in flash instead of copying it into scarce RAM at startup. - A parameter of type const uint8_t * allows reading through the pointer but rejects writes through that interface. - Placement still depends on the linker script and toolchain, so the map file should confirm that no RAM copy was allocated.

A protocol permits UART commands of at most 48 payload bytes into a 64-byte fixed buffer; how would you enforce that limit and preserve a terminator?

I would enforce the 48-byte protocol maximum and reserve one additional byte for the string terminator. - Before storing a payload byte, check that the current length is below 48 rather than using the buffer's larger physical capacity as the protocol limit. - After a valid command of length 0 through 48 completes, write the null terminator at buffer[length], so the largest valid string occupies 49 bytes. - On a 49th payload byte, enter a discard state until the frame delimiter instead of accepting a nonconforming command. - Return an explicit overlength status so no truncated prefix is parsed as a valid command.

A 32-bit millisecond tick on a 48 MHz Cortex-M wraps after about 49.7 days; how can firmware test whether a 500 ms timeout expired across the wrap?

Use unsigned subtraction and compare the elapsed difference with 500 rather than comparing absolute timestamps. - Store start as uint32_t and evaluate (uint32_t)(now - start) >= 500. - Unsigned arithmetic wraps modulo 2^32, so the difference remains correct across one counter rollover. - This pattern is safe when the measured interval is below half the counter range, which 500 ms easily satisfies. - A test with start near 0xFFFFFFF0 and now after zero should verify the boundary case.

A parser on a 64 KB RAM MCU reads a 16-bit item count and allocates count times 12 bytes; what integer-overflow check is needed before accepting count = 6000?

The parser must verify that count is no greater than SIZE_MAX divided by 12 and that the resulting 72,000 bytes fit the actual buffer budget. - Multiplication must be checked before it is performed in the allocation type, or a wrapped small size could be allocated. - Even without arithmetic wrap, 72,000 bytes exceeds the MCU's entire 64 KB RAM and must be rejected. - Convert the untrusted count to size_t only after validating its protocol range. - The same validated byte count must bound both allocation and the later item-processing loop.

Embedded Engineer interview questions

Q: A 12-bit ADC on a 64 MHz MCU produces 1,000 samples up to 4095; which integer widths would you use for each sample and for their sum, and why?

I would store each sample in uint16_t and accumulate the 1,000-sample sum in uint32_t. - Twelve bits fit in uint16_t, while uint8_t would truncate values above 255. - The maximum sum is 4,095,000, which exceeds the uint16_t maximum of 65,535. - A uint32_t accumulator safely holds that maximum and allows an integer average afterward. - Fixed-width types make the storage and range assumptions explicit across compilers and MCU families.

Q: A Cortex-M0+ runs at 48 MHz and must produce a 10 microsecond pulse; why is a counted empty loop a poor timing method even if 480 clock cycles seems correct?

A hardware timer is the reliable choice because an empty loop does not have a stable one-cycle-per-iteration duration. - Instructions, branches, flash wait states, and pipeline effects determine the real cycle count, not just the 48 MHz clock. - Compiler optimization can shorten, reorder, or remove an empty delay loop entirely. - Interrupts can pause the loop and stretch the 10 microsecond pulse unpredictably. - A timer compare or output-compare channel measures peripheral clock ticks and can toggle the pin at a defined count.

Q: A device header defines a 32-bit status register on both a 32-bit Cortex-M4 and a host test build where unsigned long is 64 bits; why should the register use uint32_t rather than unsigned long?

The register should use uint32_t because its hardware width is exactly 32 bits regardless of the compiler data model. - uint32_t is 32 bits when provided, while unsigned long can be 32 or 64 bits across targets. - A wrong-width volatile access can touch adjacent addresses or generate an unsupported bus transaction. - Bit masks such as UINT32_C(1) << 31 then have a known width and predictable behavior. - A static assertion on the register type size can catch an unsuitable build configuration early.

100 real questions with model answers and explanations for Junior Embedded Engineer candidates.

See a Embedded Engineer resume example →

Practice with flashcards

Spaced repetition · Hunter Pass

Questions

mcu

It is a microcontroller because the CPU core, memory, and hardware peripherals are integrated on one chip.

The Cortex-M3 core fetches and executes the firmware instructions stored in the 64 KB flash.
The 20 KB SRAM holds mutable data such as the stack, globals, and communication buffers while power is on.
On-chip GPIO, timers, ADC, UART, I2C, and SPI blocks let firmware control hardware without separate controller chips.
The 72 MHz core clock sets the upper instruction rate, but peripheral clocks and bus dividers may run those blocks more slowly.

Why interviewers ask this: The interviewer is checking whether you can distinguish a Cortex-M CPU core from the complete MCU around it.

firmwareperipheralsmcu

Memory-mapped I/O means a normal-looking load or store accesses peripheral hardware at that address instead of RAM.

Firmware should use the vendor register definition or a volatile uint32_t pointer for the 32-bit register at 0x41004410.
A store changes GPIO hardware bits, so the value may drive physical pins rather than remain as ordinary memory.
The GPIO peripheral clock must be enabled before access or the write may have no effect or cause a bus fault.
The reference manual defines writable and reserved bits, so firmware must preserve fields it does not own.

Why interviewers ask this: The interviewer wants evidence that you connect C register access to real peripheral hardware and its constraints.

mcu

The core initially fetches the vectors through the boot alias at 0x00000000, which STM32 can map to flash physically located at 0x08000000.

The first word at the alias is loaded into MSP by hardware before any software instruction runs.
The second word is loaded as the reset handler address, with bit 0 set for Thumb state.
Boot pins, option bytes, and remapping determine which physical memory appears at 0x00000000, so the initial fetch is not inherently from 0x08000000.
The reset handler then initializes memory and clocks before main, and firmware may later relocate vectors through VTOR.

Why interviewers ask this: The interviewer is checking whether you distinguish the Cortex-M boot alias from the physical STM32 flash address.

firmwaremcu

Firmware must configure and stabilize the clock sources before selecting the 72 MHz PLL output as the system clock.

Enable the 8 MHz external oscillator and wait for its ready flag instead of assuming it starts instantly.
Configure the PLL multiplier for 8 MHz times 9 and set APB dividers so no peripheral bus exceeds its rated frequency.
Set the flash wait states required for 72 MHz before raising the core clock, or instruction fetches can fail.
Switch the system clock source to the PLL and verify the status bits report the intended source.

Why interviewers ask this: The interviewer checks that you know clock configuration is an ordered hardware sequence with flash and bus limits.

peripheralsconfig

I would enable port C, configure only pin 13 as an output, and use the GPIO set/reset register to drive the active-low LED.

First set the port C clock-enable bit and read the reference manual for the configuration field that controls PC13.
Clear only PC13's four configuration bits, then select a push-pull output speed suitable for a slow LED.
Write the pin-13 reset half of BSRR to turn the LED on and the set half to turn it off.
BSRR changes one pin without a read-modify-write that could overwrite concurrent changes to other port bits.

Why interviewers ask this: The interviewer is looking for safe, targeted register access and awareness of an active-low circuit.

interruptsmcu

No, volatile makes accesses observable to the compiler, but it does not make the check-and-clear sequence atomic or synchronized.

Volatile prevents the compiler from caching the flag in a register or removing accesses that can change outside normal flow.
The ISR can set the flag between the main loop's read and clear, causing one timer event to be lost.
An aligned 32-bit load or store is individually atomic on this core, but the two-operation sequence is not.
Use a short critical section, an atomic primitive supported by the toolchain, or a counter with a deliberately safe handoff design.

Why interviewers ask this: The interviewer is testing the crucial limit that volatile is neither atomicity nor a synchronization mechanism.

peripherals

I would clear the three-bit field with a mask and then insert 101 shifted into bits 4 through 6.

The field mask is 0x7 shifted left by 4, which covers exactly bits 4, 5, and 6.
Read the register once, apply value &= ~mask, then apply value |= (0x5 << 4) & mask.
Write the combined value back through the vendor's volatile 32-bit register definition.
If hardware offers dedicated set and clear registers, prefer them when concurrent writers make read-modify-write unsafe.

Why interviewers ask this: The interviewer checks whether you can manipulate a multi-bit field without corrupting unrelated hardware state.

I would store each sample in uint16_t and accumulate the 1,000-sample sum in uint32_t.

Twelve bits fit in uint16_t, while uint8_t would truncate values above 255.
The maximum sum is 4,095,000, which exceeds the uint16_t maximum of 65,535.
A uint32_t accumulator safely holds that maximum and allows an integer average afterward.
Fixed-width types make the storage and range assumptions explicit across compilers and MCU families.

Why interviewers ask this: The interviewer is evaluating whether you choose integer widths from actual ranges rather than habit.

mcu

A hardware timer is the reliable choice because an empty loop does not have a stable one-cycle-per-iteration duration.

Instructions, branches, flash wait states, and pipeline effects determine the real cycle count, not just the 48 MHz clock.
Compiler optimization can shorten, reorder, or remove an empty delay loop entirely.
Interrupts can pause the loop and stretch the 10 microsecond pulse unpredictably.
A timer compare or output-compare channel measures peripheral clock ticks and can toggle the pin at a defined count.

Why interviewers ask this: The interviewer wants to see that you translate frequency into timing while recognizing why software delay loops are fragile.

mcu

The register should use uint32_t because its hardware width is exactly 32 bits regardless of the compiler data model.

uint32_t is 32 bits when provided, while unsigned long can be 32 or 64 bits across targets.
A wrong-width volatile access can touch adjacent addresses or generate an unsupported bus transaction.
Bit masks such as UINT32_C(1) << 31 then have a known width and predictable behavior.
A static assertion on the register type size can catch an unsuitable build configuration early.

Why interviewers ask this: The interviewer checks whether you understand that C type sizes and hardware register widths must match explicitly.

mcudata-structures

I would avoid an unconstrained heap here and first account for the full worst-case RAM budget.

Static storage plus the planned stack already consumes 20 KB, leaving 12 KB before library and interrupt-stack needs.
A 6 KB allocation leaves little margin and can fail or fragment after varied allocation patterns.
A fixed 6 KB workspace with explicit ownership gives deterministic memory use if only one packet is assembled at a time.
The linker map and stack high-water measurement should confirm the remaining margin rather than relying on the nominal 32 KB.

Why interviewers ask this: The interviewer is assessing whether you make stack, static, and heap choices from a bounded RAM budget.

peripherals

Inside that function, buffer is a pointer, so sizeof returns the pointer size rather than the original 64-byte array size.

An array argument is adjusted to a pointer parameter when passed to a function.
On a 32-bit Cortex-M, sizeof(buffer) is typically 4, not 64.
Pass the capacity explicitly, such as a pointer plus size_t length, and validate all indexes against it.
If the function truly requires exactly 64 bytes, the interface can use a wrapper type that preserves the size contract.

Why interviewers ask this: The interviewer checks your understanding of array-to-pointer conversion and safe buffer interfaces.

callbacks

The stored pointer becomes invalid when the setup function returns because the local buffer's automatic lifetime has ended.

The same stack bytes may be reused by another function before the callback runs 5 ms later.
Reading through the stale pointer is undefined behavior and may appear to work only in some builds.
Give the buffer static lifetime, place it in a longer-lived owner object, or copy the required data into callback-owned storage.
The ownership rule should state who may modify the 32 bytes while the callback is pending.

Why interviewers ask this: The interviewer is testing whether you can identify a dangling pointer caused by stack lifetime.

firmwaremcu

Firmware should copy or assemble the four bytes into an aligned uint32_t instead of casting buffer + 1 to uint32_t pointer.

The address at offset 1 is not guaranteed to meet the counter's four-byte alignment requirement.
A direct cast can fault on the target and also violates C aliasing or object-representation rules.
memcpy into an aligned uint32_t is clear and compilers usually optimize the fixed four-byte copy efficiently.
Decode the specified byte order after the copy because alignment and endianness are separate concerns.

Why interviewers ask this: The interviewer checks whether you handle unaligned binary data safely rather than relying on a risky pointer cast.

peripheralsmcu

The UART packet must send 0x12 first and 0x34 second because network byte order is big-endian.

Little-endian describes how 0x1234 is laid out in MCU memory, normally 0x34 then 0x12 at increasing addresses.
The wire protocol defines its own byte order and must not depend on the CPU's memory layout.
Encode the high byte with value >> 8 and the low byte with value & 0xFF.
A receiver test using 0x1234 catches accidental host-endian serialization clearly.

Why interviewers ask this: The interviewer is evaluating whether you separate CPU endianness from the byte order required by a protocol.

mcu

I would expect padding and verify with sizeof rather than assume the three fields total 7 bytes.

The compiler commonly inserts three bytes before timestamp so the uint32_t starts at a four-byte boundary.
It may add two tail-padding bytes so consecutive struct elements keep the required alignment, producing 12 bytes.
Reordering to uint32_t, uint16_t, uint8_t can reduce the common size to 8 bytes without packed access.
For a wire or flash format, serialize fields explicitly because compiler layout is not a stable protocol.

Why interviewers ask this: The interviewer checks that you understand alignment-driven struct padding and do not expose native layouts as formats.

types

I would declare the table const and expose it through a pointer-to-const so callers cannot modify calibration data accidentally.

const documents that the 256 bytes are read-only after the firmware image is built.
A typical embedded linker can keep such data in flash instead of copying it into scarce RAM at startup.
A parameter of type const uint8_t * allows reading through the pointer but rejects writes through that interface.
Placement still depends on the linker script and toolchain, so the map file should confirm that no RAM copy was allocated.

Why interviewers ask this: The interviewer is assessing both const correctness and its practical relationship to flash and RAM use.

peripheralstyping

I would enforce the 48-byte protocol maximum and reserve one additional byte for the string terminator.

Before storing a payload byte, check that the current length is below 48 rather than using the buffer's larger physical capacity as the protocol limit.
After a valid command of length 0 through 48 completes, write the null terminator at buffer[length], so the largest valid string occupies 49 bytes.
On a 49th payload byte, enter a discard state until the frame delimiter instead of accepting a nonconforming command.
Return an explicit overlength status so no truncated prefix is parsed as a valid command.

Why interviewers ask this: The interviewer checks whether you keep the protocol limit separate from the storage capacity and its terminator space.

resiliencefirmwaremcu

Use unsigned subtraction and compare the elapsed difference with 500 rather than comparing absolute timestamps.

Store start as uint32_t and evaluate (uint32_t)(now - start) >= 500.
Unsigned arithmetic wraps modulo 2^32, so the difference remains correct across one counter rollover.
This pattern is safe when the measured interval is below half the counter range, which 500 ms easily satisfies.
A test with start near 0xFFFFFFF0 and now after zero should verify the boundary case.

Why interviewers ask this: The interviewer is evaluating whether you use defined unsigned wraparound correctly for embedded timers.

The parser must verify that count is no greater than SIZE_MAX divided by 12 and that the resulting 72,000 bytes fit the actual buffer budget.

Multiplication must be checked before it is performed in the allocation type, or a wrapped small size could be allocated.
Even without arithmetic wrap, 72,000 bytes exceeds the MCU's entire 64 KB RAM and must be rejected.
Convert the untrusted count to size_t only after validating its protocol range.
The same validated byte count must bound both allocation and the later item-processing loop.

Why interviewers ask this: The interviewer checks that you distinguish arithmetic overflow from a result that is valid numerically but impossible for the device.

Locked questions

21
PB5 was reassigned to the UART alternate function, and later LED writes to the same pin no longer change its voltage; how would you diagnose and safely return the pin to GPIO output?
peripherals
22
A push button connects PA0 to ground and is read every 1 ms on a 3.3 V Cortex-M0+ board; why does the input need a pull-up and what values should firmware observe?
firmwaremcu
23
A mechanical button sampled every 5 ms can bounce for 12 ms; how would you debounce it with a stability interval of about 20 ms?
debounce
24
A general-purpose timer receives a 48 MHz clock and must interrupt every 1 ms; give one valid prescaler and auto-reload combination and explain the off-by-one rule.
interrupts
25
A 48 MHz timer must generate 20 kHz PWM at 25 percent duty cycle for a fan; what period and compare counts would you choose?
26
A 12-bit ADC uses a 3.3 V reference and returns code 2048; what input voltage does that represent approximately, and what assumptions affect the result?
27
A 12-bit ADC must measure a 200 Hz sensor waveform on a 64 MHz MCU; is a 1 kHz sample rate reasonable, and what simple buffer would you allocate for 100 ms of data?
28
A button on EXTI0 can bounce into ten interrupts within 3 ms on a 48 MHz Cortex-M0+; what should the ISR do and where should the 20 ms debounce run?
interruptsmcudebounce
29
On a Cortex-M4, a 10 kHz ADC interrupt is assigned NVIC priority 2 and a 115200-baud UART interrupt priority 5; which has higher urgency and what happens if both become pending together?
interruptsperipheralsmcu
30
A windowed watchdog accepts a refresh only 200 to 400 ms after the previous one, while the healthy superloop period is 100 ms; how should firmware aggregate health and time the refresh?
firmwarereliabilityaggregation
31
At 115200 baud with UART configured as 8N1, how long does one byte take on the wire and what is the approximate maximum payload rate?
peripheralsconfig
32
A 48 MHz MCU sends UART at 115200 8N1, but the receiver is configured for 9600 8E1; why will it report framing or parity errors?
peripheralsconfig
33
Two 3.3 V devices share a 400 kHz I2C bus on a 10 cm PCB; why are SDA and SCL open-drain and why do both lines need pull-up resistors?
peripherals
34
A temperature sensor has 7-bit I2C address 0x48 and register 0x00; describe a 400 kHz transaction that reads two data bytes and includes the ACK decisions.
transactionsperipherals
35
A 400 kHz I2C bus has about 150 pF total capacitance and slow rising edges with 10 kilohm pull-ups; why may 4.7 kilohms still be too weak, and what would you try on a 3.3 V board?
peripherals
36
An SPI sensor requires mode 3, an 8 MHz maximum clock, and chip-select low for a 3-byte transfer; how would you configure and perform the transaction on a 48 MHz MCU?
evmtransactionsconfig
37
During a 4-byte full-duplex SPI transfer at 4 MHz, the MCU only wants to send a command; why must it still handle received bytes, and how does it know whether the peripheral accepted the command?
peripheralsevm
38
Two nodes begin transmitting standard CAN frames at 500 kbit/s with identifiers 0x120 and 0x080 at the same instant; which frame wins arbitration and what happens to the other node?
39
A standard CAN data frame at 500 kbit/s carries identifier 0x321 and DLC 8; what do the identifier, DLC, CRC, and ACK field each do?
40
A 3.3 V board has four temperature sensors producing 2 bytes each at 10 Hz over 15 cm traces, and the MCU has one I2C bus at 400 kHz and one SPI bus at 8 MHz; which protocol would you choose?
peripheralstypingevm
41
A bare-metal 48 MHz MCU must sample a button every 1 ms, update an LED every 10 ms, and report status every 100 ms; how would you structure the superloop without blocking delays?
bare-metal
42
A sensor takes 50 ms to convert and its 12-byte UART report takes about 1.1 ms at 115200 8N1; design a simple IDLE, MEASURING, and REPORTING state machine for a 100 ms cycle.
designperipherals
43
A status input produces one event per second but its minimum pulse width is not specified, while UART delivers 64-byte bursts at 115200 baud; which signals can be polled safely?
peripherals
44
A UART ISR receives one byte every 86.8 microseconds at 115200 8N1, while the main loop may pause for 5 ms; how would a 128-byte ring buffer work?
interruptsperipherals
45
A linker map for a 128 KB flash MCU shows 72 KB of .text, 10 KB of .rodata, and 4 KB of flash load image for .data; how much flash remains and what would you inspect next?
46
A 32 KB RAM MCU map shows 4 KB of .data, 12 KB of .bss, a reserved 6 KB stack, and a 2 KB heap; what RAM margin remains?
cssdata-structures
47
At reset, a Cortex-M image has 2 KB of initialized .data and 6 KB of .bss in 32 KB RAM; what does hardware do before the reset handler, and what does startup inside that handler do before main?
mcu
48
You change a 48 MHz board's UART from 9600 to 115200 baud and modify three register definitions; what basic Git workflow would you use before asking for review?
zero-to-onegitperipherals
49
A build for a 64 MHz Cortex-M4 warns that a 12-bit uint16_t ADC value is converted to uint8_t before transmission; how should you handle the warning under -Wall -Wextra -Wconversion?
mcu
50
A 12-bit ADC with a 3300 mV reference feeds a temperature calculation every 100 ms; where would you place the unit-test boundary so tests do not require the Cortex-M hardware?
hypothesis-testingtestingmcu
51
A quadrature encoder's A and B signals produce 4,000 edges per second and occasionally show invalid transitions; how would you count direction reliably?
52
A timer receives a 1 MHz clock, and an LED must complete one on-off cycle every 500 ms. Which timer period would you use if the ISR toggles the LED?
interrupts
53
A digital input has a 37 microsecond high pulse; how would you measure it with a free-running 1 MHz timer input-capture channel?
54
An active-low LED is connected to a PWM pin, but a compare setting of 75% makes it look about 25% bright. What would you check?
55
A 12-bit ADC reads consistently low from a sensor with about 100 kilohms output impedance when the shortest sample time is selected; what would you change?
56
A steady sensor sampled by a 12-bit ADC at 10 ksample/s jumps over a 20-count range. How would you investigate and reduce the noise?
57
A free-running 16-bit timer ticks at 1 MHz, but firmware must measure intervals of several seconds; how would you extend and read it safely?
firmware
58
A GPIO input on a 2 m cable chatters in a noisy installation even though firmware enables the logical pull-up; how would you make it reliable?
firmwareperipherals
59
A red LED with a 330 Ω resistor should be driven from 3.3 V, but the configured GPIO high measures only 0.2 V. What safe checks would you make?
peripheralsconfig
60
A board prints unreadable UART text, and a logic analyzer measures each data bit at about 8.68 microseconds while the terminal is set to 9600 baud. What is wrong?
peripherals
61
Two boards both use 57600 baud, but the receiver reports framing errors on many bytes. The analyzer shows an extra parity bit before the stop bit. What would you change?
62
An I2C analyzer shows address bits and 9 SCL pulses, but SDA remains high on the 9th pulse and the MCU reports no acknowledgment. What would you inspect?
peripherals
63
A sensor datasheet lists 0xD0 for write and 0xD1 for read, but an MCU API expects a 7-bit I2C address. Which value should the driver pass?
peripheralsapi
64
After an MCU reset during a 400 kHz transfer, SDA stays low while SCL is high and the I2C peripheral cannot start. How would you recover the small board safely?
peripherals
65
An SPI sensor returns shifted, inconsistent bytes at 2 MHz. Its datasheet requires CPOL 1 and CPHA 1, while the analyzer decodes correctly only in mode 3. What would you do?
evmperipherals
66
Two SPI devices share MISO, and the line sits near 1.4 V whenever both chip-select pins are accidentally low. What is the likely fault and safe fix?
evmperipherals
67
Firmware sends SPI byte 0x96, but the peripheral interprets 0x69. The clock mode and chip select look correct. What should you check next?
firmwareperipheralsevm
68
A 500 kbit/s CAN bus has three 120 Ω terminators and frequent error frames. What resistance should you expect across CAN_H and CAN_L with power off?
peripherals
69
After repeated transmit errors, a CAN node moves from error-active to error-passive and then bus-off; what do those states mean and how would you investigate?
70
A protocol at 115200 baud permits exactly one 100-byte frame before the receiver is serviced; what is the minimum usable buffer capacity, and when does a 20 ms service gap require more?
capacitytyping
71
A 1 kHz timer interrupt performs a calculation that takes 2 ms, and other interrupts are missed. What would you change?
interrupts
72
On an 8-bit MCU, an ISR increments a 16-bit sample counter while the main loop reads it. The main loop occasionally sees an impossible value. Why?
interrupts
73
UART idle-line detection delimits variable frames of 20 to 200 bytes received by circular DMA; how would you find each frame boundary without losing data at DMA wrap?
peripherals
74
A binary frame starts near the end of a 128-byte ring buffer and continues at index zero; how would you parse and validate it without assuming contiguous memory?
indexesvalidationmemory
75
An ADC samples at 10 ksample/s into a circular DMA buffer of 200 samples. When should half-transfer and full-transfer callbacks occur, and how should they be used?
peripheralscallbacks
76
A 12-bit ADC writes into a uint16_t array, but DMA is configured for 32-bit peripheral and memory widths and the 100-sample buffer contains gaps. What would you correct?
peripheralsconfigmemory
77
An ISR fills a 32-byte packet buffer and sets ready, but the main loop sometimes reads a packet containing bytes from two frames. How would you hand data off safely?
interrupts
78
A GPIO produces five edges while its interrupt is disabled for 10 ms, but firmware sees only one interrupt after re-enabling it. Why, and how would you count every edge?
firmwareinterruptsperipherals
79
A fault in a 100 microsecond pulse handler disappears whenever you stop at a breakpoint inside it. How would you debug without hiding the timing bug?
80
A configuration variable changes unexpectedly about once every 3 seconds. How would a JTAG or GDB watchpoint help?
configdebugging
81
A Cortex-M4 board enters HardFault after 30 seconds. Which values in the exception stack frame would you capture first, and what can they tell you?
mcuerror-handling
82
Firmware reaches assert(state == READY) after a command leaves state as IDLE; how would you use GDB to find the bad transition?
firmware
83
A Cortex-M HardFault handler runs on MSP, but the interrupted task may have used PSP; how do you locate the automatically stacked exception frame?
interruptsmcuerror-handling
84
A crash report contains PC 0x0800432A, but you only have a map file and ELF from yesterday. How would you identify the source reliably?
85
SWD connects after reset but disconnects about 50 ms later when new firmware enters sleep and reconfigures pins. How would you regain control?
firmware
86
An I2C sensor returns the wrong value, but a logic analyzer shows address 0x48, register 0x01, ACKs, and the two expected data bytes. What would you investigate next?
peripherals
87
SPI works at 1 MHz but fails at 12 MHz. The logic analyzer decodes cleanly, while a scope at the receiver shows about 30 ns rise time and strong ringing. What would you do?
evmperipherals
88
UART is reliable through a 10 cm jumper but corrupts data through a 1 m cable at 115200 baud. How would you separate firmware from a physical-link problem?
firmwareperipherals
89
A function declares a 512-byte local array and runs in a task with a 1 KiB stack. Why is that risky, and what would you change?
90
An 8 KiB embedded heap receives random allocations from 20 to 200 bytes and frees them in a different order. After hours, a 300-byte allocation fails although 2 KiB is free. What happened?
embeddeddata-structures
91
Firmware grows by 14 KiB after one commit even though the feature looks small; how would you find the cause and prevent another size surprise?
firmware
92
A 2 KiB stack is filled with 0xA5 at startup, and after a stress run 600 bytes at the low end remain untouched. What does the watermark suggest?
93
The compiler warns that array subscript 10 is above the bounds of int values[10] in a loop using i <= 10. What should you do?
94
A function's local state variable is read before any assignment, and the board starts in different modes across 20 repeated resets. How would you fix and verify it?
95
A build for an MCU with 32 KiB SRAM fails after an 8 KiB debug buffer is added; the map now reports 40 KiB of .bss. What would you do?
96
A FreeRTOS task must run every 100 ms, but it busy-waits between runs and starves a lower-priority logging task. What should it use?
rtoslogging
97
A GPIO ISR must send an event to an 8-slot FreeRTOS queue that a higher-priority task is waiting on. Which API and yield behavior are required?
rtosinterruptsperipherals
98
A developer passes 256 as xTaskCreate stack depth and documents it as 256 bytes. Why may that be wrong?
99
A battery board should wake from RTC every 5 seconds and draw 10 microamps asleep, but the meter shows 2 mA continuously. How would you debug it?
100
A 1-second watchdog is fed from a timer ISR, so the board never resets when the main loop deadlocks. Who should own the watchdog feed?
interruptsreliabilitylocking

Questions

1An STM32F103 combines a 72 MHz Cortex-M3, 64 KB of flash, and 20 KB of SRAM; what makes it a microcontroller rather than just a CPU?

2On a 48 MHz Cortex-M0+ with 32 KB of flash and 8 KB of RAM, a GPIO output register is mapped at address 0x41004410; what does memory-mapped I/O mean when firmware writes there?

3After reset, an STM32 Cortex-M4 has flash physically mapped at 0x08000000; through which address does the core fetch the first vectors, and what do their first two entries contain?

4A board starts from an 8 MHz crystal but the Cortex-M3 must run at 72 MHz with 64 KB of flash; what clock setup steps must firmware perform before switching to the PLL?

5On a 72 MHz STM32F103, an active-low LED is wired to PC13; how would you configure and drive it through GPIO registers without disturbing the other 15 port pins?

6A 1 kHz timer ISR sets a uint32_t flag and a 10 ms main loop checks and clears it on a 32-bit Cortex-M3; is declaring the flag volatile sufficient?

7A 32-bit peripheral register at 0x40021000 uses bits 4 through 6 for a clock divider; how would you change that field to binary 101 on a 48 MHz MCU while preserving every other bit?

8A 12-bit ADC on a 64 MHz MCU produces 1,000 samples up to 4095; which integer widths would you use for each sample and for their sum, and why?

9A Cortex-M0+ runs at 48 MHz and must produce a 10 microsecond pulse; why is a counted empty loop a poor timing method even if 480 clock cycles seems correct?

10A device header defines a 32-bit status register on both a 32-bit Cortex-M4 and a host test build where unsigned long is 64 bits; why should the register use uint32_t rather than unsigned long?

11A Cortex-M4 product has 32 KB of RAM, with 12 KB of static buffers and a planned 8 KB stack; how would you decide whether to use a heap for temporary 6 KB packet assembly?

12A function receives a pointer to a 64-byte UART buffer on a 48 MHz MCU; why can it not determine the array length with sizeof(buffer) inside the function?

13A setup function stores the address of a local 32-byte sensor buffer for a callback that runs 5 ms later; what is wrong with that lifetime?

14A byte stream places a 32-bit counter at offset 1 in a 16-byte packet, and a Cortex-M0 faults on some unaligned accesses; how should firmware read the counter?

15A little-endian Cortex-M3 must send the 16-bit value 0x1234 over UART in network byte order at 115200 baud; which bytes go first?

16On a 32-bit Cortex-M4, what size do you expect for a struct containing uint8_t type, uint32_t timestamp, and uint16_t value, and how would you avoid assuming it is 7 bytes?

17A 64 KB flash MCU uses a 256-byte calibration lookup table that never changes; how would const affect its interface and placement?

18A protocol permits UART commands of at most 48 payload bytes into a 64-byte fixed buffer; how would you enforce that limit and preserve a terminator?

19A 32-bit millisecond tick on a 48 MHz Cortex-M wraps after about 49.7 days; how can firmware test whether a 500 ms timeout expired across the wrap?

20A parser on a 64 KB RAM MCU reads a 16-bit item count and allocates count times 12 bytes; what integer-overflow check is needed before accepting count = 6000?

Locked questions