Advanced Embedded Systems interview questions

125 questions with answers (EMB-301 to EMB-425). Try each one aloud before reading the answer.

Embedded C & Bit Manipulation

EMB-301 · A register write works in a debug build but not with -O2. What would you suspect?

Missing volatile on the register pointer or a shared variable lets the compiler cache values, merge or remove accesses. Also check for undefined behaviour exposed by optimisation (strict aliasing, uninitialised variables, signed overflow) and missing memory barriers around peripheral or DMA accesses.

EMB-302 · How would you design a portable register access layer in C?

Use structs mapped to peripheral base addresses with volatile fields and fixed-width types, or CMSIS-style definitions, with inline accessor functions or macros for read-modify-write. Keep bit positions and masks as named constants and add static asserts on offsets.

EMB-303 · How would you implement a lock-free single-producer single-consumer ring buffer between an ISR and the main loop?

Use a power-of-two buffer with separate head (written only by producer) and tail (written only by consumer) indices of atomic width, mark them volatile, update the index only after writing data, and add memory barriers where the core reorders memory accesses.

EMB-304 · How do you safely compute a timeout with a 32-bit tick counter that wraps?

Use unsigned subtraction: if ((uint32_t)(now - start) >= timeout). Modular arithmetic gives the correct elapsed time across one wraparound, as long as the timeout is shorter than half the counter range.

EMB-305 · How would you reduce code size in a constrained firmware image?

Enable size optimisation (-Os) and link-time optimisation, use --gc-sections with function sections, avoid heavy library functions (printf with floats), use lookup tables wisely, share common code, and review the map file for the largest contributors.

EMB-306 · How would you implement a fixed-point PID controller on an MCU without an FPU?

Scale gains and signals into Q-format (e.g. Q15 or Q16.16), use 32- or 64-bit intermediate products to avoid overflow, saturate the integrator (anti-windup) and output, and test with worst-case inputs.

EMB-307 · How would you parse a binary protocol frame safely in C?

Check length fields before reading, avoid casting byte buffers to structs (alignment and endianness issues), extract fields byte by byte with explicit endianness conversion, validate CRCs and handle malformed frames without crashing.

EMB-308 · How do you avoid undefined behaviour with shifts in embedded C?

Never shift by an amount ≥ the type width or by a negative amount, use unsigned types for shifts, and cast before shifting when the result must be wider (e.g. (uint32_t)1 << 31).

EMB-309 · How would you implement CRC-16 efficiently on a small MCU?

Use a table-driven implementation (256-entry lookup) for speed, or a bitwise loop for minimal memory; or use the MCU's hardware CRC unit if available, matching polynomial, initial value and reflection settings.

EMB-310 · How do you handle endianness in a protocol between a little-endian MCU and a big-endian network?

Define the wire format explicitly (network byte order), convert with helper functions or byte-wise packing, and avoid relying on struct layouts or type punning.

EMB-311 · How do you design a configuration structure stored in flash that survives firmware updates?

Include a version number, size and CRC, keep backward-compatible layouts (append new fields), provide migration code for older versions, and use defaults when validation fails.

Pointers, Memory & Linker Scripts

EMB-312 · How would you place a DMA buffer in a specific non-cacheable RAM region?

Define the region in the linker script (MEMORY and a dedicated section), mark the buffer with __attribute__((section(".dma_buffer"))), configure the MPU to make that region non-cacheable or shareable, and align the buffer as the DMA requires.

EMB-313 · How would you find the cause of random memory corruption?

Enable the MPU with stack guards, add canaries around buffers, use watchpoints on corrupted addresses, check for buffer overruns, stack overflow, dangling pointers and DMA writing beyond buffers, and use static analysis.

EMB-314 · How do you measure worst-case stack usage of tasks?

Use static stack analysis from the compiler (-fstack-usage) and call graph tools, plus runtime stack painting (fill with a pattern and check the high-water mark) under worst-case scenarios.

EMB-315 · How would you run time-critical code from RAM on a Cortex-M?

Place functions in a .ramfunc section with an LMA in flash and VMA in RAM, copy them at startup, and ensure linker script and startup code handle the copy; this avoids flash wait states.

EMB-316 · How would you design a memory layout for a bootloader plus application on a 512 KB flash MCU?

Reserve the first sectors for the bootloader (e.g. 32–64 KB), then one or two application slots aligned to erase-sector boundaries, plus a small sector for persistent settings. Give each image its own linker script with the right flash origin, and relocate the application's vector table.

EMB-317 · How do you share data between a bootloader and the application across a reset?

Use a small .noinit RAM section at the same address in both linker scripts, protected by a magic number and CRC, or use backup registers or a dedicated flash/EEPROM area. Clear or validate the data after reading to avoid stale commands.

EMB-318 · How would you replace malloc in a safety-related embedded system?

Allocate statically at compile time, or use fixed-size memory pools allocated only during initialisation, so memory use is deterministic and fragmentation can't occur. Document worst-case usage and check pool exhaustion.

EMB-319 · How do you detect use of uninitialised or freed memory on an MCU?

Fill freed blocks with a known pattern and check it on reuse, use memory pool guards, run unit tests on the host with sanitizers (ASan, Valgrind), and use static analysis to catch uninitialised variable use.

EMB-320 · How do you use the linker map file to diagnose a flash overflow?

Look at section sizes per object file and symbol, find the largest functions and constant tables, check for unexpectedly linked library code (e.g. printf, float support), and verify --gc-sections is removing unused code.

EMB-321 · How would you implement a memory-mapped struct overlay for a peripheral safely?

Define a struct with volatile members and exact sizes and padding matching the register map, use static assertions on offsets (offsetof), and access it through a pointer to the base address.

EMB-322 · How do you prevent stack overflow from corrupting other memory?

Place the stack at the bottom of RAM so overflow faults on invalid addresses, use MPU guard regions or stack limit registers (PSPLIM/MSPLIM on Armv8-M), and size stacks with analysis plus margin.

Microcontroller Architecture (ARM Cortex-M)

EMB-323 · How would you choose a Cortex-M core for a motor control application?

Motor control needs fast math and deterministic interrupts, so a Cortex-M4 or M7 with FPU and DSP instructions suits field-oriented control; also check advanced timers with complementary PWM and dead time, fast ADCs synchronised to PWM, and safety features.

EMB-324 · How do you set up the clock tree for maximum performance on a Cortex-M4 at 168 MHz?

Configure the HSE and PLL multipliers/dividers to reach 168 MHz while keeping USB and peripheral clocks within limits, set flash wait states before switching the system clock, enable the prefetch and caches, and verify clocks with an MCO output.

EMB-325 · How do you make code deterministic on a Cortex-M7 with caches?

Place time-critical code and data in TCM, lock or disable caches for critical regions, avoid flash-wait variability by running from RAM, and measure worst-case timing with caches cold.

EMB-326 · What changes when you port firmware from a Cortex-M4 to a Cortex-M33 with TrustZone?

Decide what runs in the secure world (keys, crypto, boot, secure storage) and what stays non-secure, configure the SAU/IDAU and secure attribution of memory and peripherals, provide non-secure callable entry points (veneers), use stack limit registers, and update the toolchain flags, linker scripts and startup code for both images.

EMB-327 · How would you implement an atomic increment on Cortex-M3/M4?

Use LDREX/STREX in a loop (or C11 atomics which compile to them), or disable interrupts briefly around the read-modify-write. On Cortex-M0 without exclusives, use critical sections.

EMB-328 · How do you use the MPU to protect an RTOS kernel from tasks?

Run tasks unprivileged with PSP, define MPU regions so each task accesses only its stack, data and peripherals, place kernel code and data in privileged-only regions, and switch MPU settings on context switch.

EMB-329 · How would you diagnose a hard fault caused by an unaligned access?

Read the CFSR (UsageFault UNALIGNED bit) and stacked PC to locate the instruction, check for packed structs or casting byte buffers to wider types, and fix by using memcpy or aligned access.

EMB-330 · How do you choose between Cortex-M0+ and Cortex-M4 for a battery-powered sensor?

M0+ offers very low power and cost for simple tasks; M4 offers DSP and FPU for complex processing. If processing is brief, a faster M4 that sleeps more can use less energy overall.

EMB-331 · How would you measure the real CPU load of a bare-metal or RTOS system?

Count cycles spent in the idle loop or idle task using the DWT cycle counter, compare with total cycles over a window, or toggle a GPIO in idle and measure its duty cycle with a scope. Report average and worst-case load under heavy workloads.

EMB-332 · How do you decide between DMA and CPU copies for moving data?

DMA frees the CPU and handles continuous streams (ADC, UART, SPI) efficiently, but has setup overhead, bus contention and cache-coherency issues. For short, infrequent transfers the CPU is simpler; for large or periodic transfers DMA wins.

EMB-333 · How would you debug a system that runs slower than expected after enabling the instruction cache?

Check whether flash wait states, cache and prefetch are configured correctly, look for code executing from non-cacheable regions, measure cache hit rates if available, and check that clocks actually reached the intended frequency.

GPIO, Timers & PWM

EMB-334 · How would you generate three-phase PWM for a BLDC motor with dead time?

Use an advanced timer in centre-aligned mode with three complementary channel pairs, set dead time in the break and dead-time register based on the gate driver and MOSFET switching times, enable the break input for overcurrent shutdown, and trigger ADC sampling at the PWM centre.

EMB-335 · How do you measure a pulse width with high resolution and no CPU jitter?

Use timer input capture on both edges (or PWM input mode with two channels), capturing counter values in hardware, optionally via DMA. Resolution equals the timer tick; handle counter overflow between edges.

EMB-336 · How do you implement a reliable software PWM when no hardware channels are left?

Use a high-priority timer interrupt that updates GPIO states based on duty values, minimise ISR time, and accept the frequency and jitter limits; for many channels, use a sorted event list and one compare interrupt per edge.

EMB-337 · How would you choose PWM frequency for an LED dimmer and a motor drive?

LEDs need above about 1–2 kHz to avoid visible or camera flicker; motors typically use 16–20 kHz to avoid audible noise, balanced against switching losses and EMI. Also consider resolution: higher frequency reduces duty resolution for a given timer clock.

EMB-338 · How do you read a quadrature encoder at high speed?

Use the timer's encoder mode, which counts edges in hardware with direction, configure input filters to reject noise, extend the counter in software for overflow, and sample position periodically for velocity.

EMB-339 · How do you generate a precise timebase across a long period without drift?

Clock the timer from an accurate crystal, use hardware auto-reload rather than reloading in software, and compensate crystal error with calibration or an RTC with trimming.

EMB-340 · How would you protect a GPIO input connected to an industrial 24 V signal?

Use a voltage divider or optocoupler, add clamping diodes or TVS protection, an RC filter for noise, and Schmitt-trigger inputs, ensuring isolation where ground potentials differ.

EMB-341 · How would you design a watchdog strategy for a multitask RTOS system?

Don't feed the watchdog from a timer ISR or the idle task alone. Have each critical task set a flag or counter when it completes its loop, and let a supervisor task feed the watchdog only if every task has checked in within its expected period. A stuck or starved task then causes a reset, and the reset cause should be logged.

EMB-342 · How do you drive a stepper motor smoothly at high speed?

Use a driver with microstepping and current control, generate step pulses from a timer (not software delays), and apply acceleration and deceleration ramps (trapezoidal or S-curve) so the motor doesn't stall or lose steps. Raise supply voltage within limits to keep torque at speed, and tune current decay modes to reduce resonance.

EMB-343 · For a 20 MHz signal, would you use gated pulse counting or period measurement, and why?

Gated counting: feed the signal as an external clock into one timer and let a second timer open a precise gate window (e.g. 100 ms); the count gives frequency with ±1 count error, so high frequencies get excellent resolution. Period measurement suits low frequencies, where one period spans many timer ticks.

EMB-344 · How do you synchronise several timers on an MCU?

Configure one timer as master with a trigger output (TRGO) on update or enable, and set the others as slaves in trigger or reset mode, so they start or reset together. This aligns PWM channels across timers and lets a timer event trigger ADC sampling at precise points.

ADC, DAC & Sensors Interfacing

EMB-345 · ADC readings are noisy by ±20 LSB. How would you diagnose and reduce the noise?

Check the reference voltage and its decoupling, analog supply filtering, ground return paths, source impedance versus sampling time, nearby switching noise (PWM, DC-DC), and input filtering. Sample synchronously with PWM, add RC anti-aliasing filters, average or oversample, and improve layout.

EMB-346 · How would you design the sampling chain for a 1 kHz vibration signal?

Choose a sampling rate well above Nyquist (e.g. 5–10 kHz), add an analog anti-aliasing filter with its cutoff near the band of interest, trigger the ADC from a timer for constant intervals, move samples by DMA into double buffers, and process blocks (FFT or RMS) in a lower-priority context.

EMB-347 · How do you interface a thermocouple to an MCU accurately?

Thermocouple voltages are tiny (about 40 µV/°C for type K), so use a dedicated amplifier or digitiser with cold-junction compensation (e.g. MAX31856), filter noise, linearise with standard polynomials or tables, and detect open-circuit faults.

EMB-348 · How would you calibrate an ADC's offset and gain errors in production?

Apply two known reference inputs near the ends of the range, measure the codes, compute gain and offset correction factors, store them in non-volatile memory with a CRC, and apply them in firmware. Re-check against a third point to verify linearity.

EMB-349 · How do you read a resistive bridge sensor such as a load cell?

Use an instrumentation amplifier or a high-resolution sigma-delta ADC with built-in PGA, excite the bridge with the same reference as the ADC (ratiometric), tare and calibrate with known weights, and filter to the needed bandwidth.

EMB-350 · How would you handle a sensor that occasionally returns outliers?

Validate readings against physical limits and rate-of-change limits, use median filtering to reject spikes, flag sensor faults after repeated failures, and fall back to safe values where the system requires.

EMB-351 · How do you generate a sine wave with a DAC efficiently?

Store a sine lookup table, use DMA triggered by a timer to stream samples to the DAC, choose table length and timer rate for the output frequency, and filter the output to remove stair-step harmonics.

EMB-352 · How do you design a temperature measurement with an NTC thermistor and achieve ±0.5 °C accuracy?

Use a precision reference resistor in a divider, ratiometric measurement, the Steinhart–Hart equation or lookup table for linearisation, calibration at known temperatures, and minimise self-heating with low current or duty-cycled excitation.

EMB-353 · How do you sample several ADC channels so they line up in time?

Use simultaneous-sampling ADCs, dual or triple ADC modes in which each ADC converts a channel at the same trigger, or external sample-and-hold amplifiers. A single ADC scanning channels introduces a fixed delay between them, which matters for phase measurements (e.g. power metering) and must be corrected in software.

EMB-354 · How do you minimise ADC power consumption in a battery device?

Sample only as often as the application needs, use lower resolution or faster conversions to shorten on-time, power down the ADC, reference and sensor excitation between conversions, trigger from a low-power timer and let DMA collect samples while the CPU sleeps.

EMB-355 · How do you make a sensor interface robust against EMI on long cables?

Use differential or current-loop signalling, twisted shielded pairs with the shield grounded at one point, RC filtering and TVS protection at the connector, adequate supply decoupling, and software filtering and plausibility checks. Keep sensitive traces away from switching circuits on the PCB.

Interrupts & Exceptions

EMB-356 · An ISR occasionally misses events at high rates. How would you fix it?

Measure ISR duration and latency, shorten the ISR by deferring work to a task or main loop, raise its priority, use DMA or hardware FIFOs to buffer data, and check whether higher-priority interrupts or long critical sections are blocking it.

EMB-357 · How would you design interrupt priorities for a motor control system with communication?

Give the PWM/ADC control loop the highest priority for deterministic timing, then safety faults (often non-maskable or very high), then communication interrupts at lower priority with FIFOs/DMA, and keep RTOS-aware interrupts below the configured syscall priority.

EMB-358 · How do you share a data structure between an ISR and a task without disabling interrupts for long?

Use lock-free queues or ring buffers, double buffering with a flag swap, or RTOS queues with ISR-safe APIs. Keep any critical section to a few instructions.

EMB-359 · How would you debug a system that hangs inside an ISR?

Check that the interrupt flag is cleared correctly (or the source is handled), look for blocking calls inside the ISR, check stack overflow, use a debugger to inspect the active exception number, and verify priorities and nesting.

EMB-360 · How do you measure interrupt latency precisely?

Toggle a GPIO at the event source (or use a timer capture) and inside the ISR entry, then measure the delay on a scope; or use DWT cycle counters and trace.

EMB-361 · How would you structure a fault handler that helps diagnose field crashes?

In the HardFault handler, determine which stack (MSP/PSP) was in use, capture the stacked registers (PC, LR, xPSR) and fault status registers (CFSR, HFSR, MMFAR, BFAR) into a .noinit RAM area or flash, then reset. On the next boot, report the crash record for analysis with the map file.

EMB-362 · How do you handle a high-frequency interrupt on a Cortex-M0 that lacks BASEPRI?

Without BASEPRI you can only mask all interrupts with PRIMASK, so critical sections block the high-frequency interrupt too. Keep critical sections extremely short, use lock-free techniques, or move the time-critical function to hardware (DMA, timers) so it doesn't depend on the CPU.

EMB-363 · How would you implement a deferred interrupt pattern in an RTOS?

The ISR does minimal work (read data, clear flag), then signals a high-priority handler task through a task notification, semaphore or queue using the FromISR API, requesting a context switch if needed. The task does the heavy processing with full RTOS services.

EMB-364 · How do you protect against a stuck interrupt source that keeps firing?

Count interrupts per time window and disable the source if a threshold is exceeded, report a fault and recover later; also check hardware for floating inputs or noise, and use watchdog supervision.

EMB-365 · How do you handle interrupts during a flash erase or write?

On many MCUs, flash is stalled during erase, so code executing from the same bank stalls; place ISRs and vector table in RAM or another flash bank, or disable interrupts and accept latency during short operations.

Communication Protocols (UART, SPI, I2C, CAN, USB)

EMB-366 · An I2C bus hangs with SDA held low after a reset. How do you recover it?

A slave was interrupted mid-byte and is still driving SDA. Reconfigure SCL as GPIO and clock up to 9 pulses until the slave releases SDA, then generate a STOP condition and reinitialise the I2C peripheral. Add timeouts and this recovery routine to the driver.

EMB-367 · How would you design a robust UART protocol between two MCUs?

Use framing with start bytes or COBS/SLIP encoding, length fields, sequence numbers, CRC, acknowledgements with retries and timeouts, and DMA with idle-line detection for receiving variable-length frames.

EMB-368 · How do you achieve high SPI throughput with low CPU load?

Use DMA for both transmit and receive, maximise SPI clock within the slave's limits and signal integrity, use the peripheral's FIFOs, and avoid toggling chip select per byte when the slave allows continuous transfers.

EMB-369 · How do you calculate CAN bus bit timing for 500 kbit/s?

Bit time = 2 µs; with a 40 MHz CAN clock and a prescaler of 5, tq = 125 ns, giving 16 tq per bit: 1 sync segment + propagation and phase segment 1 = 13 tq + phase segment 2 = 2 tq, placing the sample point at about 87.5%, with SJW of 1–2 tq.

EMB-370 · How would you diagnose a CAN bus with frequent error frames?

Check termination (about 60 Ω between CANH and CANL with power off), bit timing and sample point consistency across nodes, cable length and stubs, ground offsets, and EMI. Use a CAN analyser to see error types and which node goes error-passive.

EMB-371 · How do you make a USB CDC device transfer data reliably?

Implement correct descriptors and class requests, use double-buffered endpoints, apply flow control so the application never overwrites data the host hasn't read (and vice versa), send zero-length packets when a transfer ends on a packet boundary, and handle suspend, disconnect and re-enumeration cleanly.

EMB-372 · How do you connect several I2C devices that share the same fixed address?

Use an I2C multiplexer or switch to put them on separate channels, use separate I2C peripherals, choose parts with address-select pins, or add an I2C address translator. Software tricks such as powering devices one at a time are fragile and best avoided.

EMB-373 · How do you choose between RS-485 and CAN for an industrial network?

RS-485 is simple and cheap and suits master-slave protocols like Modbus over long cables, but has no built-in arbitration or error handling. CAN gives multi-master arbitration, CRC, automatic retransmission and fault confinement, at the cost of shorter cables at high bit rates and more complex controllers.

EMB-374 · How would you implement a Modbus RTU slave on an MCU?

Use UART with an RS-485 transceiver and direction control, detect frame boundaries by silence of 3.5 character times (a timer reset on every byte), check the CRC-16 and slave address, process supported function codes (read and write registers or coils), and return exception codes for invalid requests.

EMB-375 · How do you test a communication driver for robustness?

Inject faults: corrupted CRCs, truncated and oversized frames, unexpected timing, bus errors and disconnections, and run at maximum load and temperature with noise. Check that the driver recovers without leaks, lock-ups or buffer overruns, and add fuzz tests on the host for the parser.

RTOS Concepts

EMB-376 · A high-priority task occasionally misses its deadline. How would you investigate?

Use trace tools (Tracealyzer, SEGGER SystemView) to see what ran before the miss: long critical sections, priority inversion on a mutex, a higher-priority task or ISR overrunning, or blocking calls in the task itself. Measure worst-case execution times and fix the cause rather than raising priorities blindly.

EMB-377 · How does priority inheritance solve priority inversion, and what are its limits?

When a low-priority task holds a mutex needed by a high-priority task, inheritance temporarily raises the holder to the waiter's priority so medium-priority tasks can't preempt it. It doesn't prevent deadlock or chained blocking; priority ceiling protocols and short critical sections help further.

EMB-378 · How would you partition an application into RTOS tasks?

Group work by timing requirements and independence: one task per periodic control loop rate, event-driven tasks for communication and UI, and a low-priority background task. Avoid too many tasks (memory and context-switch overhead) and assign priorities by rate or deadline.

EMB-379 · How do you check whether a task set is schedulable under rate-monotonic scheduling?

Compute total utilisation U = Σ Ci/Ti and compare with the Liu–Layland bound n(2^(1/n) − 1) (about 0.78 for 3 tasks); if U is below the bound, the set is schedulable. If above, run exact response-time analysis.

EMB-380 · How would you avoid deadlock in a system with several mutexes?

Impose a global lock ordering, avoid holding a lock while waiting on another resource, use timeouts on lock acquisition, and keep critical sections short. Review the design with a lock dependency graph.

EMB-381 · How do you pass large data between tasks efficiently?

Pass pointers to buffers through queues rather than copying data, use memory pools for buffer ownership, and document which task owns each buffer at each time.

EMB-382 · How would you design a low-power RTOS application?

Use tickless idle, block tasks on events instead of polling, consolidate wake-ups, use low-power timers, and put peripherals to sleep when unused.

EMB-383 · How do you choose an RTOS for a product?

Consider footprint, determinism, licensing, safety certifications (e.g. SafeRTOS, Zephyr with safety), ecosystem and middleware, vendor support and team familiarity.

EMB-384 · How do you use an RTOS message queue to implement an event-driven state machine?

Each task has a queue of events; it blocks on the queue, processes events through a state machine, and sends events to other tasks. This decouples components and avoids shared-state locking.

EMB-385 · How do you detect stack overflow in RTOS tasks?

Enable RTOS stack checking (canary patterns or stack-limit checks on context switch), use MPU guard regions, and monitor high-water marks during testing.

Bootloaders & Firmware Updates

EMB-386 · How would you design a fail-safe OTA update for an MCU with dual flash banks?

Download the new image into the inactive bank, verify its signature and CRC, mark it as pending, reboot into it, and only mark it confirmed after the application passes self-tests. If it fails or a watchdog reset occurs before confirmation, the bootloader rolls back to the previous bank.

EMB-387 · How do you verify firmware authenticity in a bootloader?

Hash the image (SHA-256) and verify a digital signature (ECDSA or Ed25519) using a public key stored in protected memory, then check version numbers for anti-rollback before jumping to the application.

EMB-388 · How would you update firmware on a device with only one flash bank and limited space?

Use a small update agent in the bootloader that receives and writes the image directly (with a recovery mode if interrupted), or use external flash to stage the image, or use delta updates with careful in-place patching and power-loss resilience.

EMB-389 · How do you store persistent settings in flash while minimising wear?

Use wear-levelling schemes such as journaling key-value records across multiple sectors, write new records rather than rewriting, and erase sectors only when full.

EMB-390 · How do you design an update protocol over UART for a bootloader?

Use framed packets with sequence numbers and CRC, acknowledgements and retries, a handshake to enter the bootloader, and verify the full image before switching.

EMB-391 · A device bricked after an update in the field. How would you design to prevent this?

Keep an immutable bootloader that never updates itself casually, use A/B slots or a recovery image, verify images before switching, confirm the new image only after self-test, use watchdog-triggered rollback, and make every flash operation resumable after power loss.

EMB-392 · How would you safely update the bootloader itself?

Avoid it where possible; if needed, use a two-stage design where a tiny immutable first-stage loader selects between two second-stage bootloader copies, so a failed update leaves a valid copy. Write and verify the new copy before switching.

EMB-393 · How do you manage firmware versions across a large device fleet?

Embed semantic versions and build IDs in image headers, report them to a device management backend, roll out updates in stages with monitoring, and keep the ability to halt or roll back a release.

EMB-394 · How would you reduce OTA update size for a cellular IoT device?

Use delta (differential) updates against the installed version, compress images, separate rarely-changing components, and schedule updates when data costs and battery allow.

EMB-395 · How do you validate a new firmware image before marking it good?

Run power-on self-tests (memory, peripherals, communication), check that critical tasks start and the device connects to its backend, and only then set the confirmation flag; otherwise reboot to roll back.

Low-Power Design

EMB-396 · A device's battery lasts half the expected time. How would you find out why?

Profile current over time with a power analyser to see sleep current, wake-ups and peaks, compare with the power budget, and check for peripherals left on, floating GPIOs, pull-up currents, debug interfaces enabled, unexpected wake-ups from interrupts, and radio retries.

EMB-397 · Estimate battery life for a sensor that sleeps at 5 µA and wakes for 50 ms at 15 mA every 60 s on a 1000 mAh battery.

Average current = (5 µA × 59.95 s + 15 mA × 0.05 s)/60 s ≈ 4.996 µA + 12.5 µA ≈ 17.5 µA. Life ≈ 1000 mAh/0.0175 mA ≈ 57,000 h ≈ 6.5 years, before derating for self-discharge, temperature and battery ageing.

EMB-398 · How would you design a sensor node to run for 10 years on a coin cell?

Keep average current in the low µA range: deep sleep with RAM retention, RTC wake-ups, batch sensor readings and radio transmissions, minimise radio on-time, use low-leakage components and power-switch sensors off between readings, and account for battery peak current limits with bulk capacitance.

EMB-399 · How do you choose between running fast and sleeping or running slowly at low frequency?

Compare energy per task: running fast finishes sooner so static leakage and fixed overheads accrue for less time (race to sleep), while lower frequency allows lower voltage if DVFS is available. Measure both on the actual hardware.

EMB-400 · How would you reduce the current consumption of a BLE sensor?

Increase advertising and connection intervals, reduce TX power where range allows, send fewer, larger packets, use slave latency, and keep the MCU asleep between radio events.

EMB-401 · How do you handle peripherals that lose state in deep sleep?

Save configuration before sleep and restore it on wake, use retention RAM or backup registers, and reinitialise peripherals in a structured wake-up routine.

EMB-402 · How do you design a power supply for very low quiescent current?

Choose regulators with nanoamp-to-microamp quiescent current (or a bypass/load-switch mode at light load), switch sensors and peripherals off with load switches, use high-value or switchable resistor dividers for battery sensing, and check every always-connected component (pull-ups, LEDs, level shifters) against the sleep budget.

EMB-403 · How would you power a sensor node from energy harvesting?

Use a harvesting PMIC with maximum power point tracking for the source (solar, thermal, vibration), store energy in a supercapacitor or small rechargeable cell, monitor storage voltage, and make firmware energy-aware: start tasks only when enough energy is stored and save state before brown-out.

EMB-404 · How do you measure microamp-level sleep current accurately?

Use a source-measure unit or power analyser with auto-ranging and high dynamic range (nA to hundreds of mA), disconnect or disable the debug probe, measure over a long enough window to include periodic wake-ups, and make sure the measurement shunt's burden voltage doesn't disturb the device.

EMB-405 · How do you minimise wake-up time from deep sleep?

Wake on a fast internal oscillator and switch to the crystal or PLL later, keep critical state in retention RAM to avoid reinitialisation, run only the minimum initialisation needed for the immediate task, and defer the rest. Shorter wake-ups also save energy on every cycle.

Debugging & Testing

EMB-406 · A bug appears only on some production units, never on the bench. How would you approach it?

Collect data from failing units (crash logs, reset causes, versions), look for hardware differences (component batches, tolerances, temperature, supply ripple), reproduce under stress (temperature chambers, voltage margining), and add diagnostics or logging to capture the failure in the field.

EMB-407 · How would you set up continuous integration with hardware-in-the-loop tests?

Build firmware on every commit, run host-based unit tests, flash the image to devices in a test rack via debug probes, run automated functional tests with instrumented inputs and outputs, and collect logs and results, gating merges on success.

EMB-408 · How do you debug a timing bug that disappears when a debugger is attached?

Debuggers change timing, halt clocks and may keep peripherals running differently. Use non-intrusive methods: GPIO toggles, trace (ITM/ETM), logging to RAM buffers, and logic analysers to observe behaviour in real time.

EMB-409 · How would you profile where firmware spends its time?

Use DWT cycle counters around functions, statistical PC sampling via SWO, ETM trace for full instruction history, or GPIO toggling measured on a scope; focus optimisation on the hot spots found.

EMB-410 · How do you unit test firmware that depends on an RTOS?

Abstract RTOS calls behind an interface, use mocks or a host-based RTOS port (e.g. FreeRTOS POSIX port) for tests, test logic separately from scheduling, and run integration tests on target.

EMB-411 · How do you test interrupt-driven code for race conditions?

Use stress tests with high interrupt rates, randomised timing, static analysis for shared variables, and code review for critical sections; tools like thread sanitizers on host builds can help.

EMB-412 · How would you measure code coverage on a microcontroller?

Use instrumentation with gcov on target with limited memory (transferring data via debugger or UART), or trace-based coverage with ETM that doesn't need instrumentation.

EMB-413 · How do you write a test plan for a new embedded product?

Cover unit, integration, system, environmental (temperature, EMC, vibration), performance, power, safety and regression testing, with requirements traceability.

EMB-414 · How do you capture field logs on devices with limited storage?

Use a circular log buffer in RAM or flash, compress or encode logs, store only critical events, and upload logs periodically or on request.

EMB-415 · How do you test a firmware update process thoroughly?

Test interrupted downloads, power loss at every stage, corrupted images, wrong signatures, version rollback attempts, and recovery behaviour.

Embedded Linux, Safety & Security

EMB-416 · How would you reduce the boot time of an embedded Linux device to under 2 seconds?

Profile with bootchart or grabserial, trim U-Boot (remove delays, unused drivers), use a minimal kernel configuration with built-in drivers, compress or use XIP appropriately, start only essential services early (systemd tuning or custom init), and defer non-critical initialisation.

EMB-417 · How would you write a Linux driver for a custom SPI sensor?

Add a device tree node with the sensor's compatible string and SPI parameters, write a driver that binds via the SPI subsystem, expose data through IIO, sysfs or a character device, handle interrupts and power management, and test with user-space tools.

EMB-418 · How would you secure an IoT device against common attacks?

Use secure boot with signed firmware, unique device credentials stored in a secure element, encrypted communication (TLS), disable or lock debug ports in production, minimise exposed services, apply least privilege, and provide secure OTA updates for patches.

EMB-419 · How do you approach ISO 26262 for an automotive ECU software component?

Determine ASIL from hazard analysis, derive safety requirements, apply ASIL-appropriate development processes (requirements traceability, MISRA, unit testing with MC/DC for higher ASILs), use safety mechanisms (watchdogs, memory protection, plausibility checks) and produce a safety case.

EMB-420 · How do you protect sensitive keys on a microcontroller?

Store keys in secure elements or protected key storage (TrustZone, OTP, PUF-based), restrict debug access, avoid hard-coding keys in firmware, and use per-device keys.

EMB-421 · How would you implement secure logging of security events on a device?

Record critical events with timestamps and integrity protection (MACs), store them in protected memory, and forward them to a backend securely.

EMB-422 · How do you design a safe state for a motor controller?

Define the safe state (e.g. disable PWM outputs, apply braking), ensure hardware paths can force it independently of software, and test transitions under fault conditions.

EMB-423 · How do you handle software updates in a safety-certified system?

Follow change impact analysis, re-verify affected components, maintain traceability and documentation, and ensure updates don't compromise safety requirements.

EMB-424 · How do you use a hypervisor or separation kernel in embedded systems?

Partition safety-critical and non-critical software into isolated partitions with guaranteed resources, enforced by an MMU/MPU-based hypervisor.

EMB-425 · How do you assess security of an embedded product before release?

Perform threat modelling, code reviews, static analysis, dependency scanning, and penetration testing by authorised testers, then fix findings and document residual risks.

Other levels: Basic · Intermediate · Tricky · All Embedded Systems questions