At design review, partition an STM32G4 with 128 KB RAM and 512 KB flash between bare metal and an RTOS. Its 170 MHz core must close a 20 kHz current loop within 8 us while telemetry runs at 1 kHz. What stays in the ISR, and what moves behind the scheduler?

I would keep the current loop in a timer-driven bare-metal ISR and put telemetry, diagnostics, and communications behind an RTOS scheduler. - The ADC trigger, fixed-point control calculation, and PWM update own the highest-priority interrupt and must complete in a measured 6 us budget, leaving 2 us margin. - RTOS tasks exchange double-buffered samples with the ISR and never take locks or call the kernel from the control path. - I would reserve 40 KB RAM for task stacks and queues and 96 KB flash for the bootloader, then enforce both limits in the linker map and CI.

Linux on a 1 GHz Cortex-A53 and SIL-2 firmware on a 200 MHz Cortex-M4 share DDR, reset, and power fabric. Present the interference argument and tests proving that a Linux reboot or DDR saturation cannot delay the 250 us power trip.

I would make the M4 trip path independent of every shared service that Linux can stall or reset. - The M4 executes sensing and trip code from local SRAM, owns the safety input and relay gate, and never waits for DDR, Linux, or a shared mailbox before de-energizing. - Reset, clock, power, and peripheral controls give the M4 a separate domain or a hardware interlock; an A53 reset cannot gate the M4 clock, erase its state, or re-enable the output. - Fabric QoS and firewalls bound any remaining shared-bus access, and tests combine maximum Linux DDR traffic with repeated A53 resets while measuring input edge to relay trip against 250 us.

Define core and peripheral ownership for an ASIL-C actuator whose 480 MHz Cortex-M7 and 240 MHz Cortex-M4 share memory. The 10 kHz control chain has a 50 us deadline while 2 kHz diagnostics run concurrently; how should IPC be bounded?

I would give each core private control resources and include shared-bus interference in the 50 us proof. - The M7 owns ADC, timers, PWM, and private SRAM for the 10 kHz chain; the M4 owns CAN-FD and diagnostics and cannot write control registers. - Fixed-size SPSC messages use a defined shared-SRAM region with sequence, CRC, and timeout, while cache and barrier rules are part of the IPC contract. - Response-time tests saturate the shared SRAM fabric, flash, DMA, and interconnect from the M4 while measuring the M7 path, because nominal core separation does not bound memory interference.

A $9 controller budget limits you to a dual 160 MHz Cortex-M33 with 512 KB RAM and 1 MB flash. To meet SIL-3, two pressure channels are sampled at 4 kHz and power must drop within 500 us. Compare lockstep, redundant checking, and a functional split.

I would choose two independently compiled diagnostic channels with one core controlling and the other checking, rather than a functional split that hides common control faults. - Both cores sample independently routed ADC channels and compute the trip decision every 250 us, then a hardware voter removes output power on disagreement or timeout. - Each core receives 192 KB private RAM and a separate 384 KB flash image, while only a 16 KB mailbox is shared and protected by the MPU. - The remaining budget goes to an external supervisor and diverse clock monitor because two cores on one die do not cover shared power, clock, or silicon failures.

At design review, four 16-bit SPI ADC streams each deliver 2 Msamples/s to a 300 MHz MCU with 768 KB RAM. Each 100 us frame must be processed within 70 us; the 16 MB/s sample payload excludes SPI framing and command overhead, which must be budgeted separately. Define task, DMA, buffer, and peripheral ownership.

I would use two 1,600-byte frame banks and transfer ownership once per 100 us frame. - Four streams at 2 Msamples/s with 16-bit samples produce 16 MB/s of payload, so one 100 us frame is 1,600 bytes, or 400 bytes from each ADC. - Four synchronized DMA channels fill the corresponding regions of bank A while the CPU processes bank B, then swap only after every channel completes that frame. - SPI command and framing bits, chip-select gaps, DMA descriptors, and alignment are budgeted separately from the 16 MB/s payload and 3,200 bytes of two-bank payload storage; processing must still finish within 70 us before DMA returns to the bank.

Decide whether a 64 MHz Cortex-M0+ with 32 KB RAM needs an RTOS when it wakes at 100 Hz and must react within 2 ms. A 900 mAh cell must last five years; show the current budget and assign peripheral ownership.

I would keep the event model bare metal only if the measured whole-device current fits a five-year budget below 20.5 uA average. - A 900 mAh cell over five years provides only about 20.5 uA before self-discharge, temperature derating, cell variation, and regulator loss, so the usable design target must be lower. - A low-power timer triggers ADC DMA at 100 Hz, and the threshold decision completes within the 2 ms requirement without waking BLE or a general scheduler. - Current integration includes MCU wake charge, ADC, sensor, regulator quiescent current, and radio events; if that measured sum cannot meet the derated budget, the requirement or battery must change.

Draw the Linux, RTOS, and hardware safety boundary for a smart camera. A quad Cortex-A53 handles 30 frames/s, while a 400 MHz Cortex-R5 must stop the motor within 100 us for SIL-2.

I would keep imaging and product services on Linux, run motor protection on the R5 RTOS, and make a hardware gate enforce the final stop. - Linux owns the camera, codec, storage, and network stack because their throughput matters but their scheduling is not bounded to 100 us. - The R5 owns encoder capture and motor PWM, calculates the stop condition every 50 us, and can disable the gate without an A53 command. - A versioned RPMsg channel carries setpoints at 1 kHz, while stale or invalid messages force the R5 to a locally defined safe state.

Design the clean update architecture for a SIL-2 drive whose FPGA bitstream and MCU firmware must change as one secure-boot pair. Programming can fail on either side; how do you prevent mixed versions and retain recovery?

I would sign and activate the FPGA bitstream and MCU firmware as one compatible pair through a two-phase update. - One signed manifest binds both hashes, versions, hardware revision, interface version, and anti-rollback epoch, so neither image is accepted independently. - The updater programs inactive FPGA and MCU slots, reads them back, and verifies both before atomically marking the pair pending; the confirmed pair remains untouched. - An immutable first stage activates the pending pair and waits for joint health confirmation; if either side fails to configure, boot, or agree on the interface, it restores the last confirmed pair or signed recovery instead of running a mixed version.

Fourteen features compete inside a 1 kHz cycle on a 240 MHz MCU, but the SIL-2 critical chain must finish within 700 us across three board variants. Propose firmware partitions and enforceable CPU, RAM, and flash budgets.

I would partition by timing and hardware ownership, with a cyclic executive for the critical chain and RTOS tasks for bounded background features. - Acquisition, validation, control, and actuation receive fixed slots totaling 560 us, leaving 140 us measured margin against the 700 us deadline. - Variant drivers implement one compile-time interface and own their peripherals, while product logic remains identical across all three boards. - Linker regions cap critical RAM at 96 KB and flash at 384 KB, and CI fails on either budget or on target WCET growth above 5%.

Build an analyzable ASIL-D schedule on a 400 MHz Cortex-R5 for 5 kHz control, 1 kHz estimation, and 100 Hz diagnostics. Their deadlines are 80 us, 300 us, and 5 ms; assign priorities, WCET budgets, and overrun behavior.

I would use deadline-monotonic priorities and verify every response time because all three deadlines are shorter than their periods. - The 80 us control deadline receives highest priority with a 50 us WCET budget, followed by the 300 us estimator at 180 us; diagnostics are split into bounded chunks below their 5 ms deadline. - Response-time analysis includes WCET, release jitter, interrupt execution, cache and bus interference, and bounded blocking from every lower-priority owner. - Timing protection records overruns and invokes the defined ASIL-D safe reaction, while target traces validate the assumptions used by the analysis.

Cost rules an infusion pump onto one 160 MHz Cortex-M33 with 256 KB RAM. The Class C therapy loop runs at 500 Hz with a 1 ms deadline beside 2,000 BLE and logging events per second. Define the fault-containment and privilege boundary.

I would use TrustZone and the MPU to isolate the pump-control domain from BLE, logging, and update code on the same MCU. - Secure privileged code owns timers, motor outputs, dosage limits, and 96 KB RAM, while nonsecure tasks access them only through narrow checked calls. - BLE and logging use separate MPU regions, fixed queues, and capped CPU budgets so malformed traffic cannot corrupt or starve the 1 ms control path. - Memory faults, illegal peripheral access, or missed control releases immediately disable delivery and preserve a small fault record in protected flash.

For a 2 kHz SIL-2 control loop with a 250 us deadline and 500 CAN frames/s, define a watchdog scheme that proves useful progress rather than merely proving that an interrupt still runs.

I would use an external window watchdog supervised by an independent health monitor that validates useful progress, not task heartbeats alone. - The monitor checks fresh ADC sequence numbers, completed control outputs, CAN queue movement, and deadline counters before permitting one watchdog service in the 20 to 40 ms window. - The control task cannot write the watchdog peripheral, and a stalled scheduler, repeated stale data, or an impossibly fast service all cause reset and output disable. - Boot records reset cause and attempt count in a protected 8 KB flash journal, then enters a limited safe mode after three watchdog resets.

Hazard analysis shows that simply removing power from a SIL-3 valve can cause pressure damage. The loop runs at 10 kHz with a 60 us deadline and receives 1,500 commands/s; define safe states for sensor, CPU, and total-power failures.

I would define controlled pressure hold as the primary safe state, but CPU failure must still leave an independent hardware path to a safe pressure action. - A separate pressure comparator or safety controller drives a dump or hold circuit from independent sensing, clock, and power, so a stalled CPU cannot strand the valve in an unsafe command. - When firmware is healthy, it rejects remote commands and moves the 10 kHz loop toward the validated hold point; overpressure, disagreement, or missing CPU heartbeat transfers authority to hardware. - Requirements distinguish sensor faults, processor failure, and total power loss, with a physical safe action and fault-tolerant time defined for each case.

You have 40 us to derive a trusted ASIL-C angle from three sensors sampled at 20 kHz, with an $18 sensor budget. Compare voting, diverse sensing, and degraded operation, then define the diagnostic evidence.

I would use two diverse primary sensors plus a lower-cost plausibility channel, with fault-tolerant selection rather than blind three-way averaging. - Each primary uses an independent power and SPI path; the third channel derives angle from a different physical principle at 5 kHz to detect common sensor bias. - The 40 us path compares rate, range, freshness, and pairwise residuals, then selects one validated primary or enters degraded torque limits on ambiguity. - Diagnostic coverage claims come from the hardware fault model and injected open, short, stuck, drift, and timing faults, not from unit-test coverage alone.

The safety plan allows 14 months to release an ASIL-B braking ECU. Its 2 kHz control chain has a 200 us deadline; outline the ISO 26262 software partition and the evidence needed to defend it.

I would partition one qualified safety path from diagnostics and communications, then build traceable work products around the allocated ASIL-B requirements. - Safety requirements map to components, interfaces, timing budgets, failure reactions, and unit or integration verification with bidirectional traceability. - The MPU, static allocation, controlled concurrency, and freedom-from-interference analysis support the partition, while WCET and stack evidence cover the 200 us chain. - Reviews, tool qualification decisions, static analysis, HIL results, and configuration baselines support the safety case, but certification remains the assessor's decision.

For an IEC 61508 SIL-3 controller, 2,000 I/O points are scanned at 1 kHz and the physical trip must complete within 3 ms. Define the safety channel, timing allocation, and assurance evidence.

I would use a separate safety channel with deterministic scanning and a hardwired output cutoff, leaving non-safety control on an isolated domain. - The safety channel samples independently, completes logic within 1 ms, and commands the cutoff by 2 ms so the 3 ms trip retains margin. - A defined fault model drives redundancy, proof tests, diagnostic intervals, and safe-failure-fraction calculations rather than adding duplicate code without independence. - Requirements, design reviews, static analysis, timing tests, fault injection, and field proof-test procedures form evidence for assessment, not an automatic SIL-3 claim.

A DO-178C DAL B schedule must provide actuator control 250 us of CPU every 1 ms with a 400 us response deadline, while guidance needs 2 ms of CPU every 5 ms. Design feasible partitions and certification evidence without creating one contiguous 2 ms guidance slot.

I would use a deterministic partitioned executive with static memory and resumable time windows for DAL B control, separating maintenance and telemetry software. - Actuator control receives 250 us in every 1 ms frame, while guidance receives one resumable 400 us window in each of five consecutive frames for 2 ms total per 5 ms; lower-criticality work cannot borrow either allocation. - Response-time analysis budgets release jitter, context-switch cost, interrupt execution, cache and bus interference, and blocking, then proves the actuator response remains within 400 us and every guidance job finishes within 5 ms. - Interfaces use fixed-size messages and explicitly saved guidance state, with no heap, recursion, or unbounded library calls in the DAL B partition. - Plans, standards, traceability, reviews, structural coverage, object-code concerns, timing evidence, and configuration records are produced throughout development for certification authority review.

Vision at 60 frames/s and Ethernet at 10,000 packets/s share a quad-core SoC with a 10 kHz ASIL-D partition whose deadline is 50 us. Show how cores, memory, DMA, interrupts, and buses provide freedom from interference.

I would reserve one core and private memory bandwidth for control, then constrain vision and networking with hardware partitioning and measured budgets. - The control partition gets a dedicated core, locked code and data regions, private interrupts, and MPU or MMU mappings that exclude all shared device registers. - DMA masters use an IOMMU and bandwidth regulators, while shared cache ways and DRAM time slots are reserved so vision cannot create unbounded control stalls. - Interference tests saturate cores, cache, DRAM, DMA, and interrupts together, and the resulting maximum delay is included in the 40 us WCET budget plus 10 us margin.

A connected lock on a 160 MHz Cortex-M33 receives 20 updates per year but must authenticate and boot within 300 ms. Define the immutable root, mutable chain, signing-key custody, and recovery behavior.

I would anchor a small immutable first stage in ROM or OTP and verify each mutable stage with a device-trusted public key. - OTP stores a hash of the root public key and lifecycle state; private signing keys remain in an offline or HSM-backed release service. - The first stage verifies metadata, image hash, signature, target hardware, and version before jumping, with verification budgeted below 80 ms. - TrustZone isolates boot services and key slots, while failed verification enters a signed recovery path with no unsigned bypass.

A regulated factory gateway must boot within 2 seconds and prove its startup state to fleet services. With a TPM available, compare authenticated boot, measured boot, and the separate control needed for confidentiality.

I would use authenticated boot to block unapproved code and measured boot into a TPM to prove the exact boot state to fleet services. - ROM verifies the bootloader, which verifies the kernel, device tree, and read-only root image before execution. - Each stage extends hashes into TPM PCRs, and remote attestation accepts only approved measurements before issuing production credentials. - Secure boot authenticates code but does not encrypt it, so confidential binaries or data need separate storage encryption and key release policy.

Embedded Engineer interview questions

100 real questions with model answers and explanations for Senior Embedded Engineer candidates.

See a Embedded Engineer resume example →

Practice with flashcards

Spaced repetition · Hunter Pass

Questions

designrtosinterrupts

I would keep the current loop in a timer-driven bare-metal ISR and put telemetry, diagnostics, and communications behind an RTOS scheduler.

The ADC trigger, fixed-point control calculation, and PWM update own the highest-priority interrupt and must complete in a measured 6 us budget, leaving 2 us margin.
RTOS tasks exchange double-buffered samples with the ISR and never take locks or call the kernel from the control path.
I would reserve 40 KB RAM for task stacks and queues and 96 KB flash for the bootloader, then enforce both limits in the linker map and CI.

Why interviewers ask this: The interviewer is checking whether the candidate isolates a hard real-time loop while budgeting memory and scheduler interference explicitly.

firmwaremcutesting

I would make the M4 trip path independent of every shared service that Linux can stall or reset.

The M4 executes sensing and trip code from local SRAM, owns the safety input and relay gate, and never waits for DDR, Linux, or a shared mailbox before de-energizing.
Reset, clock, power, and peripheral controls give the M4 a separate domain or a hardware interlock; an A53 reset cannot gate the M4 clock, erase its state, or re-enable the output.
Fabric QoS and firewalls bound any remaining shared-bus access, and tests combine maximum Linux DDR traffic with repeated A53 resets while measuring input edge to relay trip against 250 us.

Why interviewers ask this: The interviewer is checking whether shared memory and reset fabric are treated as interference sources rather than assuming two processors are independent.

ownershipestimationperipherals

I would give each core private control resources and include shared-bus interference in the 50 us proof.

The M7 owns ADC, timers, PWM, and private SRAM for the 10 kHz chain; the M4 owns CAN-FD and diagnostics and cannot write control registers.
Fixed-size SPSC messages use a defined shared-SRAM region with sequence, CRC, and timeout, while cache and barrier rules are part of the IPC contract.
Response-time tests saturate the shared SRAM fabric, flash, DMA, and interconnect from the M4 while measuring the M7 path, because nominal core separation does not bound memory interference.

Why interviewers ask this: The interviewer evaluates core and peripheral ownership, deterministic IPC, and explicit containment on a heterogeneous MCU.

mcu

I would choose two independently compiled diagnostic channels with one core controlling and the other checking, rather than a functional split that hides common control faults.

Both cores sample independently routed ADC channels and compute the trip decision every 250 us, then a hardware voter removes output power on disagreement or timeout.
Each core receives 192 KB private RAM and a separate 384 KB flash image, while only a 16 KB mailbox is shared and protected by the MPU.
The remaining budget goes to an external supervisor and diverse clock monitor because two cores on one die do not cover shared power, clock, or silicon failures.

Why interviewers ask this: A strong answer distinguishes useful redundancy from superficial multicore partitioning and addresses common-cause failures.

designperipheralsconcurrency

I would use two 1,600-byte frame banks and transfer ownership once per 100 us frame.

Four streams at 2 Msamples/s with 16-bit samples produce 16 MB/s of payload, so one 100 us frame is 1,600 bytes, or 400 bytes from each ADC.
Four synchronized DMA channels fill the corresponding regions of bank A while the CPU processes bank B, then swap only after every channel completes that frame.
SPI command and framing bits, chip-select gaps, DMA descriptors, and alignment are budgeted separately from the 16 MB/s payload and 3,200 bytes of two-bank payload storage; processing must still finish within 70 us before DMA returns to the bank.

Why interviewers ask this: The interviewer checks whether high-rate peripherals have one owner and whether backpressure cannot enter the acquisition deadline.

rtosperipheralsmcu

I would keep the event model bare metal only if the measured whole-device current fits a five-year budget below 20.5 uA average.

A 900 mAh cell over five years provides only about 20.5 uA before self-discharge, temperature derating, cell variation, and regulator loss, so the usable design target must be lower.
A low-power timer triggers ADC DMA at 100 Hz, and the threshold decision completes within the 2 ms requirement without waking BLE or a general scheduler.
Current integration includes MCU wake charge, ADC, sensor, regulator quiescent current, and radio events; if that measured sum cannot meet the derated budget, the requirement or battery must change.

Why interviewers ask this: A strong answer avoids an RTOS when a small event model meets latency, memory, and battery constraints more simply.

rtosmcu

I would keep imaging and product services on Linux, run motor protection on the R5 RTOS, and make a hardware gate enforce the final stop.

Linux owns the camera, codec, storage, and network stack because their throughput matters but their scheduling is not bounded to 100 us.
The R5 owns encoder capture and motor PWM, calculates the stop condition every 50 us, and can disable the gate without an A53 command.
A versioned RPMsg channel carries setpoints at 1 kHz, while stale or invalid messages force the R5 to a locally defined safe state.

Why interviewers ask this: The interviewer evaluates whether Linux is excluded from the hard safety deadline and whether hardware provides final authority.

designfirmware

I would sign and activate the FPGA bitstream and MCU firmware as one compatible pair through a two-phase update.

One signed manifest binds both hashes, versions, hardware revision, interface version, and anti-rollback epoch, so neither image is accepted independently.
The updater programs inactive FPGA and MCU slots, reads them back, and verifies both before atomically marking the pair pending; the confirmed pair remains untouched.
An immutable first stage activates the pending pair and waits for joint health confirmation; if either side fails to configure, boot, or agree on the interface, it restores the last confirmed pair or signed recovery instead of running a mixed version.

Why interviewers ask this: The interviewer is checking cross-device update atomicity, compatibility enforcement, and recovery under secure boot.

partitioningfirmware

I would partition by timing and hardware ownership, with a cyclic executive for the critical chain and RTOS tasks for bounded background features.

Acquisition, validation, control, and actuation receive fixed slots totaling 560 us, leaving 140 us measured margin against the 700 us deadline.
Variant drivers implement one compile-time interface and own their peripherals, while product logic remains identical across all three boards.
Linker regions cap critical RAM at 96 KB and flash at 384 KB, and CI fails on either budget or on target WCET growth above 5%.

Why interviewers ask this: The interviewer checks whether architecture boundaries align with timing, memory, and hardware variation rather than team convenience.

estimationmcutiming

I would use deadline-monotonic priorities and verify every response time because all three deadlines are shorter than their periods.

The 80 us control deadline receives highest priority with a 50 us WCET budget, followed by the 300 us estimator at 180 us; diagnostics are split into bounded chunks below their 5 ms deadline.
Response-time analysis includes WCET, release jitter, interrupt execution, cache and bus interference, and bounded blocking from every lower-priority owner.
Timing protection records overruns and invokes the defined ASIL-D safe reaction, while target traces validate the assumptions used by the analysis.

Why interviewers ask this: A strong answer converts task rates and deadlines into analyzable priorities, budgets, and overrun behavior.

estimationloggingmcu

I would use TrustZone and the MPU to isolate the pump-control domain from BLE, logging, and update code on the same MCU.

Secure privileged code owns timers, motor outputs, dosage limits, and 96 KB RAM, while nonsecure tasks access them only through narrow checked calls.
BLE and logging use separate MPU regions, fixed queues, and capped CPU budgets so malformed traffic cannot corrupt or starve the 1 ms control path.
Memory faults, illegal peripheral access, or missed control releases immediately disable delivery and preserve a small fault record in protected flash.

Why interviewers ask this: The interviewer evaluates practical containment and safe reaction when cost prevents using separate processors.

interruptsreliabilityestimation

I would use an external window watchdog supervised by an independent health monitor that validates useful progress, not task heartbeats alone.

The monitor checks fresh ADC sequence numbers, completed control outputs, CAN queue movement, and deadline counters before permitting one watchdog service in the 20 to 40 ms window.
The control task cannot write the watchdog peripheral, and a stalled scheduler, repeated stale data, or an impossibly fast service all cause reset and output disable.
Boot records reset cause and attempt count in a protected 8 KB flash journal, then enters a limited safe mode after three watchdog resets.

Why interviewers ask this: A strong answer makes watchdog health checks independent, meaningful, and resistant to a stuck task that still toggles a flag.

estimation

I would define controlled pressure hold as the primary safe state, but CPU failure must still leave an independent hardware path to a safe pressure action.

A separate pressure comparator or safety controller drives a dump or hold circuit from independent sensing, clock, and power, so a stalled CPU cannot strand the valve in an unsafe command.
When firmware is healthy, it rejects remote commands and moves the 10 kHz loop toward the validated hold point; overpressure, disagreement, or missing CPU heartbeat transfers authority to hardware.
Requirements distinguish sensor faults, processor failure, and total power loss, with a physical safe action and fault-tolerant time defined for each case.

Why interviewers ask this: The interviewer checks whether safe state is derived from the physical hazard rather than assumed to mean power off.

I would use two diverse primary sensors plus a lower-cost plausibility channel, with fault-tolerant selection rather than blind three-way averaging.

Each primary uses an independent power and SPI path; the third channel derives angle from a different physical principle at 5 kHz to detect common sensor bias.
The 40 us path compares rate, range, freshness, and pairwise residuals, then selects one validated primary or enters degraded torque limits on ambiguity.
Diagnostic coverage claims come from the hardware fault model and injected open, short, stuck, drift, and timing faults, not from unit-test coverage alone.

Why interviewers ask this: A strong answer ties redundancy to independence, fault hypotheses, deadline, and a defensible diagnostic-coverage argument.

estimationpartitioning

I would partition one qualified safety path from diagnostics and communications, then build traceable work products around the allocated ASIL-B requirements.

Safety requirements map to components, interfaces, timing budgets, failure reactions, and unit or integration verification with bidirectional traceability.
The MPU, static allocation, controlled concurrency, and freedom-from-interference analysis support the partition, while WCET and stack evidence cover the 200 us chain.
Reviews, tool qualification decisions, static analysis, HIL results, and configuration baselines support the safety case, but certification remains the assessor's decision.

Why interviewers ask this: The interviewer evaluates practical ISO 26262 evidence without confusing test success with certification.

I would use a separate safety channel with deterministic scanning and a hardwired output cutoff, leaving non-safety control on an isolated domain.

The safety channel samples independently, completes logic within 1 ms, and commands the cutoff by 2 ms so the 3 ms trip retains margin.
A defined fault model drives redundancy, proof tests, diagnostic intervals, and safe-failure-fraction calculations rather than adding duplicate code without independence.
Requirements, design reviews, static analysis, timing tests, fault injection, and field proof-test procedures form evidence for assessment, not an automatic SIL-3 claim.

Why interviewers ask this: A strong answer connects SIL architecture to the hazard model, timing path, and lifecycle evidence required by an assessor.

estimationdesignpartitioning

I would use a deterministic partitioned executive with static memory and resumable time windows for DAL B control, separating maintenance and telemetry software.

Actuator control receives 250 us in every 1 ms frame, while guidance receives one resumable 400 us window in each of five consecutive frames for 2 ms total per 5 ms; lower-criticality work cannot borrow either allocation.
Response-time analysis budgets release jitter, context-switch cost, interrupt execution, cache and bus interference, and blocking, then proves the actuator response remains within 400 us and every guidance job finishes within 5 ms.
Interfaces use fixed-size messages and explicitly saved guidance state, with no heap, recursion, or unbounded library calls in the DAL B partition.
Plans, standards, traceability, reviews, structural coverage, object-code concerns, timing evidence, and configuration records are produced throughout development for certification authority review.

Why interviewers ask this: The interviewer checks whether the candidate understands both deterministic partitioning and practical DO-178C lifecycle evidence.

interruptsperipheralspartitioning

I would reserve one core and private memory bandwidth for control, then constrain vision and networking with hardware partitioning and measured budgets.

The control partition gets a dedicated core, locked code and data regions, private interrupts, and MPU or MMU mappings that exclude all shared device registers.
DMA masters use an IOMMU and bandwidth regulators, while shared cache ways and DRAM time slots are reserved so vision cannot create unbounded control stalls.
Interference tests saturate cores, cache, DRAM, DMA, and interrupts together, and the resulting maximum delay is included in the 40 us WCET budget plus 10 us margin.

Why interviewers ask this: A strong answer treats multicore interference as a hardware resource problem that requires partitioning and worst-case evidence.

mcuimmutability

I would anchor a small immutable first stage in ROM or OTP and verify each mutable stage with a device-trusted public key.

OTP stores a hash of the root public key and lifecycle state; private signing keys remain in an offline or HSM-backed release service.
The first stage verifies metadata, image hash, signature, target hardware, and version before jumping, with verification budgeted below 80 ms.
TrustZone isolates boot services and key slots, while failed verification enters a signed recovery path with no unsigned bypass.

Why interviewers ask this: The interviewer evaluates a complete chain of trust, key separation, boot-time cost, and failure behavior.

gateway

I would use authenticated boot to block unapproved code and measured boot into a TPM to prove the exact boot state to fleet services.

ROM verifies the bootloader, which verifies the kernel, device tree, and read-only root image before execution.
Each stage extends hashes into TPM PCRs, and remote attestation accepts only approved measurements before issuing production credentials.
Secure boot authenticates code but does not encrypt it, so confidential binaries or data need separate storage encryption and key release policy.

Why interviewers ask this: A strong answer separates prevention, attestation, and confidentiality instead of treating secure boot as all three.

Locked questions

21
Monthly updates for a payment terminal must preserve a 250 ms boot target and use an available secure element. Design anti-rollback so a vulnerable old image is blocked without losing recovery from a faulty new image.
vulnerabilitiesdesignrollback
22
Fit an A/B update scheme into 4 MB flash while a SIL-2 application samples at 5 kHz with a 100 us deadline. Twelve releases per year are expected, and each activation may take the device offline for at most 30 seconds.
activationestimation
23
A controller must accept signed releases for 12 years without replacing firmware whenever a production signing key rotates or is revoked. Define the root, trust-manifest transition, overlap, and rollback rules.
firmwarerollback
24
After both application slots fail, a 100 MHz MCU with 1 MB flash must resume a 200 Hz SIL-2 monitor within 5 seconds without technician access. Specify the minimal recovery image, entry policy, and authenticated repair path.
monitoring
25
Production releases four connected meters per second, giving device identity provisioning a 180 ms station budget. Design key generation or injection, certificate binding, fuse locking, retries, and audit records for two million units.
lockinginjectiondesign
26
Plan a 36-hour OTA rollout to 1.2 million devices without disturbing a 2 ms control deadline during download. Define on-device resource caps, cohort gates, delivery shaping, and stop criteria for a 0.1% support budget.
cohortsestimation
27
A 1 kHz loop must finish within 300 us while proprietary calibration resides in 8 MB external flash. Separate the authenticated-boot design from calibration confidentiality and keep decryption latency out of control.
designlatency
28
At 40 MB/s RX DMA, a cacheable-memory Cortex-M7 pipeline must process each 4 kHz frame within 100 us. Define full-cache-line buffer placement, maintenance and barrier order, ownership transfer, and the CPU-only role of DTCM.
peripheralsmcucaching
29
Place a 2 kHz SIL-2 control task with a 200 us deadline beside a parser receiving 5,000 untrusted events per second on one Cortex-M33. Define privilege, MPU regions, peripheral capabilities, and the checked message boundary.
peripheralsmcuestimation
30
A memory review must divide 768 KB SRAM among 16-channel acquisition at 10 kHz, a 75 us ASIL-C path, DMA banks, stacks, and growth. Give enforceable region sizes and explain what ECC does and does not consume.
peripheralsmemory
31
Resolve a flash-layout conflict: normal control must start within 120 ms from 1 MB internal flash, while a low-cost external device must support A/B packages and power-safe repair. Where does execution occur, and how is the previous package preserved?
32
An Ethernet ingress path receives 80 MB/s, but selected commands must reach a 10 kHz control task within 100 us on a SoC with 2 MB RAM. Draw the zero-copy ownership path and the point where a bounded safety copy is preferable.
ownershipkubernetes
33
An encoder arrives at 20 kHz and requires a response within 100 us with less than 5 us jitter, while logging produces 10,000 records/s on the same Cortex-M7. Allocate ISR, task, queue, and drop behavior, then state the worst-case test.
interruptsmculogging
34
A wearable power review must reconcile 200 Hz motion sampling, 20 BLE packets/s, fall detection within 50 ms, and 14 days from a 180 mAh cell. Which work can be batched, and which work must remain causal?
causalbatchsampling
35
Production ASIL-C units expose only 4 KB trace RAM and no continuous ETM pins, yet a 5 kHz Cortex-R5 loop needs evidence against a 120 us deadline. Design low-overhead production profiling and its lab correlation.
designmcuprofiling
36
A 10 kHz task averages 35 us but has a 100 us SIL-2 deadline while 3,000 bus frames/s create burst interference. What bounded implementation and acceptance metric replace the misleading average?
estimationmonitoring
37
Network design has 45 nodes at 70% classic CAN load, 180 signals at 100 Hz, and a 5 ms ASIL-B command deadline. Compare staying on CAN, moving to CAN-FD, and using a compatibility segment.
estimationdesign
38
Build a CAN-FD schedule for 60 ECUs and 2,500 frames/s on a 2 Mbit/s bus while ASIL-C brake requests must arrive within 2 ms. State priority assignment, reserved load, and sender policing.
39
Eight camera feeds share switched Ethernet with an ASIL-B actuator message whose end-to-end deadline is 250 us. Produce the TSN schedule, guard-band or preemption choice, and admission rules rather than naming protocols generically.
genericstypinge2e
40
Each wearable sample is 16 bits, the stream is 1 kHz, and the radio sends 50 BLE notifications/s while alarms must arrive within 100 ms. The negotiated ATT MTU is at least 43, so 20 samples fit the 40-byte notification value; if that MTU is unavailable, fragmentation or a different notification rate must be addressed. Define batching, alarm priority, and connection timing.
batch
41
Five firmware generations must interoperate for ten years while processing 4,000 protocol messages/s and delivering SIL-2 commands within 1 ms. Define version negotiation and rules for evolving safety-command semantics.
concurrencytypingfirmware
42
Review the bootloader-to-application ABI for an ASIL-B MCU that boots in 200 ms and must survive 15 independent firmware releases. What handoff data and services remain stable, and what happens on version mismatch?
firmware
43
Three product lines use 100, 200, and 400 MHz MCUs but share a 5 kHz acquisition contract with a 150 us deadline. With six platform engineers, decide what belongs in common driver interfaces and what must remain target-specific.
estimationtypes
44
For one million ASIL-C ECUs, 2,000 vehicle signals run at 100 Hz and a control runnable has a 2 ms deadline. Compare Classic AUTOSAR, an RTOS framework, and custom firmware given multiple suppliers and a 24-month program.
firmwarertosestimation
45
Six HIL racks must support a nine-month SIL-2 validation program with 1,200 requirements and a 1 kHz critical chain due within 300 us. Allocate tests by risk and define timing evidence, rack scheduling, and traceability.
validationjobstesting
46
You have 12 weeks to verify an ASIL-C ECU whose 5 kHz loop has a 100 us deadline beside 2,000 CAN-FD frames/s. Design a fault-injection campaign traced from fault hypotheses to detection and safe-reaction timing.
estimationinjectiondesign
47
An IEC 62304 Class C release has 900 software requirements and eight months to prove a 500 Hz therapy loop meets its 1 ms deadline. Define the maintained chain from hazards and requirements to code and verification.
estimation
48
Board freeze is approaching for a SIL-2 platform whose sole MCU vendor quotes 40 weeks and whose revision B adds a cache erratum. The 10 kHz loop must remain within 80 us; propose a second-source and requalification strategy.
procurementcaching
49
A transparent MCU implementation filters 12 channels at 100 kHz but misses its 50 us SIL-3 loop deadline by 18 us. With $4 BOM headroom and six weeks before board freeze, compare a faster MCU with a small FPGA or DSP block and define the decision evidence.
estimation
50
Architecture reviews find nine interface defects per release, and timing regressions in a 400 us ASIL-B control path reach HIL two weeks late. Design a mentoring and CI gate intended to cut both measures by 60% within two releases.
designtypesmentoring
51
A Cortex-M task with a 512-byte stack starts causing HardFaults after a release, but the device reboots before logs flush. How do you contain and diagnose it?
mcu
52
A compiler upgrade adds 20 microseconds of jitter to a 100-microsecond control loop whose allowed jitter is plus or minus 5 microseconds. What do you do?
53
A fixed pool of 64 modem DMA descriptors is exhausted after repeated cellular reconnects while heap usage stays stable, and telemetry stops. How do you trace ownership, recover safely, and enforce a bounded descriptor lifecycle?
data-structuresdescriptorsownership
54
A dual-core controller corrupts a command queue roughly once per million operations, and the failure disappears when tracing is enabled. How do you find and fix the race?
data-structures
55
After enabling the Cortex-M7 data cache, configuration records occasionally fail CRC after a low-power resume. How would you isolate the cache corruption?
mcucachingconfig
56
A noisy field input creates an interrupt storm that consumes 98% CPU and starves a safety task. What is your response?
interrupts
57
An MPU fault begins immediately after an unprivileged task receives an RX DMA buffer from a privileged driver. How do you capture the fault and validate the buffer region, lifetime, and privilege handoff?
validationperipherals
58
A new firmware causes rare HardFaults across a 400,000-device fleet, but no lab unit reproduces them. How do you investigate without destroying fleet evidence?
firmware
59
An RTOS image reaches 92% CPU during peak traffic and starts missing a 10-millisecond sensor deadline. How do you contain and redesign scheduling?
jobsrtosestimation
60
Five percent of devices enter a boot loop after an OTA update while the rest boot normally. How do you recover the fleet and find the cohort-specific cause?
cohortsrest
61
A power loss during a bootloader update bricks devices before the ROM can reach the application. How would you redesign the update path?
firmware
62
The production OTA signing key is confirmed compromised while many devices will remain offline for months. What is your containment and key-rotation design?
design
63
OTA verification fails on devices whose RTC lost time because certificate validity is evaluated against untrusted wall clock. How do you authorize releases with a signed epoch or trusted-time bootstrap without disabling signature checks?
decision-making
64
After a field reset, evidence shows the MCU activated v8 while its communications coprocessor remained on v7, and their incompatible commands leave the product unavailable. How do you contain the mismatch, recover a coherent pair, and fix activation?
activation
65
A security review finds that the recovery partition accepts unsigned USB packages even though normal boot uses secure boot. What do you do?
partitioning
66
Adding signature verification increases cold boot from 350 milliseconds to 1.8 seconds, violating a 700-millisecond startup requirement. How do you recover time without weakening secure boot?
67
You must deploy new secure-boot and application firmware to one million devices across six hardware revisions. Design the staged rollout and stop criteria.
designfirmwaredeployment
68
Delta OTA packages fail CRC on 0.2% of older boards because their factory base images differ by a few bytes. How do you prevent partial or wrong-base updates?
69
A fleet of vehicle controllers enters CAN bus-off during a specific actuator sequence and repeatedly disconnects. How do you handle the incident?
soft-skillsincidentsperipherals
70
A fail-operational controller has two CAN buses and must continue accepting critical commands after either bus fails. How do you schedule duplicate commands, detect stale copies, and prove controlled failover?
formsperipherals
71
A safety product has two I2C buses, and any one sensor can hold its bus low indefinitely. How do you partition sensors, switches, reset domains, and degraded operation so one fault does not remove all sensing?
partitioningperipherals
72
Four DMA channels contend for one SRAM bus and increase a control chain from 70 us to 110 us against a 100 us deadline. How do you change arbitration, bursts, and memory placement and then prove WCET?
memorytimingestimation
73
An embedded Ethernet gateway loses 0.3% of packets at line rate but shows no application queue overflow. Where do you look?
gatewayembeddeddata-structures
74
A BLE medical sensor disconnects when a new high-priority task runs, but only at a 7.5-millisecond connection interval. How do you resolve the timing conflict?
75
A new MCU stepping has a silicon erratum that can lock a peripheral when DMA completion and clock gating coincide. How do you introduce the workaround safely?
peripherals
76
A vendor HAL update silently clears a reserved control bit and resets a communications peripheral in production. How do you manage the defect and vendor dependency?
procurementdependenciesdefects
77
A factory fixture corrupts calibration records on one production lot, causing sensors to drift in the field. What is your response?
fixturesiac
78
Battery life falls from 12 months to 6 months after a firmware release, while deep-sleep current itself is unchanged. How do you find the energy regression?
firmware
79
Deep-sleep current rises from 8 microamps to 220 microamps after adding a sensor driver. How do you isolate the leaking domain?
80
Devices reset from brownout when the radio transmits while a motor starts, but bench supplies hide the failure. How do you correct it?
81
External flash reads fail only above 80 degrees Celsius on one board revision, leading to corrupted assets. How do you handle the temperature-only failure?
soft-skills
82
A product fails radiated-emissions testing because a PWM edge creates a narrow peak, but changing the PWM affects actuator control. How do you lead the fix?
testing
83
A low-cost oscillator drifts enough at minus 40 degrees Celsius to break radio timing after several minutes. What design would you choose?
designiac
84
Fleet telemetry shows a flash sector nearing its endurance limit years earlier than planned because a counter is written every second. How do you respond?
85
An FPGA timestamps a sensor in one clock domain while the MCU fuses data in another, causing rare one-sample jumps. How do you fix the cross-domain timing?
86
An ISO 26262 review finds diagnostic coverage is 92% for an actuator feedback path, below the 99% safety requirement. What do you do?
feedbackcoverage
87
A watchdog reset can briefly re-enable an actuator before software restores the safe state. How do you redesign the startup and watchdog behavior?
reliability
88
A scheduled fault-injection campaign fails to trigger the diagnostic that supports a safety claim. How do you decide whether the product or test rig is wrong?
injection
89
Before certification, you discover a safety requirement cannot be traced to the shipped binary because generated code and compiler inputs were not archived. What do you do?
90
A production line programmed the wrong brownout fuse into 12,000 controllers before the readback check was noticed missing. How do you scope and correct the defect?
defects
91
A released protocol parser swaps byte order for one 32-bit actuator limit, and some field units may accept a dangerously high value. How do you run the recall?
typing
92
An assessor rejects your safety case because the claim that a control deadline is always met relies only on a month of field logs. What evidence do you add?
estimation
93
A safety release has completed validation, but two unexplained resets occurred during 100,000 HIL hours. The launch date is tomorrow. How do you make a controlled go or no-go decision?
formsvalidation
94
You must migrate a mature product from FreeRTOS to Zephyr without changing its 2-millisecond control deadline or field behavior. How do you plan the migration?
estimationmigrationsrtos
95
An MCU shortage gives you 12 weeks to port a safety-related product from an STM32 to an NXP part. What do you protect and what do you revalidate?
96
A wireless module vendor announces end-of-life in nine months for a product with seven years of support remaining. How do you choose between a last-time buy and a replacement?
procurement
97
A vendor DSP library cuts an algorithm from 1.3 ms to 600 us against an 800 us deadline, but source, WCET evidence, and safety-qualification material are unavailable. How do you compare transparent optimization, a new MCU, and a degraded option, and when do you reject the library?
optimizationtimingalgorithms
98
In review, an engineer removes a memory barrier and a range check to save 12 microseconds from a safety-critical loop. How do you respond?
memory
99
An engineer fixes a single-core ISR race by disabling interrupts for 400 us in a path with a 100 us deadline. How do you contain the change, teach a minimal critical section or ownership fix, and strengthen review?
ownershipestimationinterrupts
100
An intermittent reset appears only on production lot C, and hardware, manufacturing, and validation each suspect another team. How do you brief and drive the incident?
incidentsvalidation

Questions

1At design review, partition an STM32G4 with 128 KB RAM and 512 KB flash between bare metal and an RTOS. Its 170 MHz core must close a 20 kHz current loop within 8 us while telemetry runs at 1 kHz. What stays in the ISR, and what moves behind the scheduler?

2Linux on a 1 GHz Cortex-A53 and SIL-2 firmware on a 200 MHz Cortex-M4 share DDR, reset, and power fabric. Present the interference argument and tests proving that a Linux reboot or DDR saturation cannot delay the 250 us power trip.

3Define core and peripheral ownership for an ASIL-C actuator whose 480 MHz Cortex-M7 and 240 MHz Cortex-M4 share memory. The 10 kHz control chain has a 50 us deadline while 2 kHz diagnostics run concurrently; how should IPC be bounded?

4A $9 controller budget limits you to a dual 160 MHz Cortex-M33 with 512 KB RAM and 1 MB flash. To meet SIL-3, two pressure channels are sampled at 4 kHz and power must drop within 500 us. Compare lockstep, redundant checking, and a functional split.

6Decide whether a 64 MHz Cortex-M0+ with 32 KB RAM needs an RTOS when it wakes at 100 Hz and must react within 2 ms. A 900 mAh cell must last five years; show the current budget and assign peripheral ownership.

7Draw the Linux, RTOS, and hardware safety boundary for a smart camera. A quad Cortex-A53 handles 30 frames/s, while a 400 MHz Cortex-R5 must stop the motor within 100 us for SIL-2.

8Design the clean update architecture for a SIL-2 drive whose FPGA bitstream and MCU firmware must change as one secure-boot pair. Programming can fail on either side; how do you prevent mixed versions and retain recovery?

9Fourteen features compete inside a 1 kHz cycle on a 240 MHz MCU, but the SIL-2 critical chain must finish within 700 us across three board variants. Propose firmware partitions and enforceable CPU, RAM, and flash budgets.

10Build an analyzable ASIL-D schedule on a 400 MHz Cortex-R5 for 5 kHz control, 1 kHz estimation, and 100 Hz diagnostics. Their deadlines are 80 us, 300 us, and 5 ms; assign priorities, WCET budgets, and overrun behavior.

11Cost rules an infusion pump onto one 160 MHz Cortex-M33 with 256 KB RAM. The Class C therapy loop runs at 500 Hz with a 1 ms deadline beside 2,000 BLE and logging events per second. Define the fault-containment and privilege boundary.

12For a 2 kHz SIL-2 control loop with a 250 us deadline and 500 CAN frames/s, define a watchdog scheme that proves useful progress rather than merely proving that an interrupt still runs.

13Hazard analysis shows that simply removing power from a SIL-3 valve can cause pressure damage. The loop runs at 10 kHz with a 60 us deadline and receives 1,500 commands/s; define safe states for sensor, CPU, and total-power failures.

14You have 40 us to derive a trusted ASIL-C angle from three sensors sampled at 20 kHz, with an $18 sensor budget. Compare voting, diverse sensing, and degraded operation, then define the diagnostic evidence.

15The safety plan allows 14 months to release an ASIL-B braking ECU. Its 2 kHz control chain has a 200 us deadline; outline the ISO 26262 software partition and the evidence needed to defend it.

16For an IEC 61508 SIL-3 controller, 2,000 I/O points are scanned at 1 kHz and the physical trip must complete within 3 ms. Define the safety channel, timing allocation, and assurance evidence.

17A DO-178C DAL B schedule must provide actuator control 250 us of CPU every 1 ms with a 400 us response deadline, while guidance needs 2 ms of CPU every 5 ms. Design feasible partitions and certification evidence without creating one contiguous 2 ms guidance slot.

18Vision at 60 frames/s and Ethernet at 10,000 packets/s share a quad-core SoC with a 10 kHz ASIL-D partition whose deadline is 50 us. Show how cores, memory, DMA, interrupts, and buses provide freedom from interference.

19A connected lock on a 160 MHz Cortex-M33 receives 20 updates per year but must authenticate and boot within 300 ms. Define the immutable root, mutable chain, signing-key custody, and recovery behavior.

20A regulated factory gateway must boot within 2 seconds and prove its startup state to fleet services. With a TPM available, compare authenticated boot, measured boot, and the separate control needed for confidentiality.

Locked questions