Tricky Embedded Systems interview questions

75 questions with answers (EMB-426 to EMB-500). Try each one aloud before reading the answer.

Embedded C & Bit Manipulation

EMB-426 · In if (ready && read_and_clear_status()), is the status register always read?

Trap: && short-circuits: if ready is false, the function is never called, so a status flag that must be read to clear an interrupt stays set and the interrupt can fire again. Side effects that must always happen belong in their own statement.

EMB-427 · Is i++ on a shared counter a single, safe operation on a Cortex-M?

Trap: It compiles to load, add and store. An interrupt between the load and store can update the counter, and the store then overwrites that update. Protect it with a critical section or atomic instructions.

EMB-428 · Is sizeof(int) always 4 bytes on embedded targets?

Trap: It depends on the compiler and architecture: 2 bytes on many 8- and 16-bit MCUs (AVR, MSP430), 4 bytes on Cortex-M. Use <stdint.h> fixed-width types when size matters.

EMB-429 · Is right-shifting a negative signed integer the same as dividing by 2?

Trap: Right-shifting a negative signed value is implementation-defined (usually arithmetic shift), and it rounds toward minus infinity, while division rounds toward zero (−3/2 = −1, but −3 >> 1 = −2).

EMB-430 · Does uint8_t a = 200, b = 100; if (a + b > 255) evaluate as 8-bit math and overflow?

Trap: Integer promotion converts both operands to int before adding, so a + b = 300 and the comparison is true. Overflow only happens if the result is stored back into a uint8_t.

EMB-431 · Are bit-fields a reliable way to map hardware registers?

Trap: Bit-field ordering, packing and access width are implementation-defined, and the compiler may use wrong-sized accesses on registers. Masks and shifts on fixed-width types are more portable and predictable.

EMB-432 · Does const guarantee a variable is placed in flash?

Trap: Usually const globals go in flash (.rodata), but the linker script and compiler decide; const locals may be on the stack, and volatile const hardware registers aren't in flash at all.

Pointers, Memory & Linker Scripts

EMB-433 · Is returning a pointer to a local array from a function safe if you use it immediately?

Trap: The local array lives on the stack and its memory is reused once the function returns; the next call or interrupt may overwrite it. This dangling pointer can appear to work in tests and fail randomly later.

EMB-434 · Does initialising a global variable to zero add it to the .data section?

Trap: Zero-initialised globals usually go to .bss, which is cleared at startup, not .data. Only non-zero initialised globals occupy .data (and flash space for their initial values).

EMB-435 · Is malloc always unsafe in embedded systems?

Trap: The concern is fragmentation and non-deterministic timing in long-running systems. Allocating once at startup, or using fixed-size pools, can be perfectly safe; many embedded Linux systems use malloc routinely.

EMB-436 · Can you safely cast a uint8_t buffer to a uint32_t * to read 4 bytes?

Trap: It can cause unaligned access faults (on Cortex-M0 or with LDM/STRD instructions), violates strict aliasing rules and assumes endianness. Use memcpy or explicit byte assembly.

EMB-437 · Is a stack overflow always detected by a HardFault?

Trap: Often the stack silently overwrites adjacent data, causing strange bugs elsewhere. Faults happen only if the overflow reaches an invalid address or a guard region.

EMB-438 · Does the program counter start at address 0 after reset on a Cortex-M?

Trap: The core loads the initial stack pointer from address 0 and the reset vector (address of the reset handler) from address 4, then jumps there. Address 0 holds data, not the first instruction.

EMB-439 · Does the debugger's "memory usage" figure show runtime heap and stack usage?

Trap: The build report shows static allocation (.data, .bss, reserved stack and heap sizes). Actual runtime usage depends on code paths and must be measured with stack painting or heap statistics.

Microcontroller Architecture (ARM Cortex-M)

EMB-440 · Does a higher CPU clock always make the firmware run proportionally faster?

Trap: Flash wait states, bus contention, peripheral clocks and memory latency limit gains. Code waiting on peripherals or I/O doesn't speed up at all.

EMB-441 · Is a Cortex-M7 always faster than a Cortex-M4 for the same code?

Trap: The M7 has a deeper superscalar pipeline and caches, so it is usually faster, but code with frequent cache misses, unpredictable branches or slow external memory can lose much of that advantage. Deterministic timing is also harder with caches.

EMB-442 · Does a Cortex-M3 have a floating-point unit?

Trap: No. The M3 has no FPU; floating-point operations run in software emulation and are slow. The M4F, M7 and M33 (optionally) include an FPU.

EMB-443 · Does enabling the FPU on a Cortex-M4F make every interrupt slower?

Trap: If the FPU is used, extra registers may need stacking, but lazy stacking reserves space and only saves FPU registers if the ISR actually uses them, keeping latency low when it doesn't.

EMB-444 · Is "Harvard architecture" the reason a Cortex-M can't read constants from flash?

Trap: Cortex-M uses separate instruction and data buses but a single unified address map, so code can read constants from flash normally. Classic Harvard MCUs like AVR need special instructions for that.

EMB-445 · Is the vector table always fixed at address 0 on a Cortex-M3/M4?

Trap: The VTOR register lets software relocate the vector table, which is how bootloaders hand over control to an application at a different address.

EMB-446 · Does bit-banding exist on every Cortex-M core?

Trap: Bit-banding is optional on M3/M4 implementations and not present on M0, M0+, M7 or Armv8-M cores. Code relying on it isn't portable.

GPIO, Timers & PWM

EMB-447 · Can you drive an LED or relay directly from any GPIO pin?

Trap: GPIO pins typically source or sink only a few to about 20 mA, with a total package limit. Relays and motors need transistors or drivers plus flyback diodes, and LEDs need current-limiting resistors.

EMB-448 · Does a 50% duty cycle PWM always give half the average voltage to a load?

Trap: It gives half the average voltage into a resistive load with ideal switching, but inductive loads, diode drops, dead time and supply sag change the result. Motor speed also depends on load, not just duty.

EMB-449 · Is a floating input pin harmless if you never read it?

Trap: Floating CMOS inputs can sit near the switching threshold, causing extra current consumption and random toggling, and may pick up noise. Unused pins should be configured as outputs or with pull-ups/pull-downs.

EMB-450 · Does a higher timer resolution always mean better PWM?

Trap: At a fixed timer clock, higher resolution means lower PWM frequency. Applications must balance frequency and resolution.

EMB-451 · Can software debounce with a single 10 ms delay handle all buttons?

Trap: Bounce times vary by switch and ageing, and blocking delays waste CPU time and delay other events. Use periodic sampling with state machines and choose time constants from measured bounce.

EMB-452 · Can two push-pull GPIO outputs be wired together to make a shared signal line?

Trap: If one drives high while the other drives low, they short the supply through both output stages, causing high current and possible damage. Shared lines need open-drain outputs with a pull-up (wired-AND), tri-state control or a proper bus transceiver.

ADC, DAC & Sensors Interfacing

EMB-453 · Does a 12-bit ADC give 12 bits of accuracy?

Trap: Resolution is not accuracy. Noise, offset, gain error, INL, reference error and layout typically reduce effective accuracy to fewer bits (ENOB).

EMB-454 · Does averaging more samples always improve accuracy?

Trap: Averaging reduces random noise but not systematic errors like offset, gain error or reference drift; it also slows response.

EMB-455 · Is the ADC reference voltage always exactly equal to the supply?

Trap: If VREF is tied to a noisy or loaded supply, readings vary with supply changes. Use a stable reference or ratiometric designs.

EMB-456 · Can you sample a 10 kHz signal accurately at exactly 20 kHz because that meets Nyquist?

Trap: Nyquist requires strictly more than twice the highest frequency, and real anti-aliasing filters aren't brick walls. At exactly 2× you can sample only zero crossings and see nothing; practical systems sample at 2.5–10× with a filter.

EMB-457 · Does a higher sampling rate always give better sensor data?

Trap: Faster sampling increases noise bandwidth, CPU and memory load and power consumption, and slow sensors (e.g. thermistors) gain nothing. Sample at the rate the signal and application need, with filtering.

EMB-458 · Is a sensor's datasheet accuracy what you will get in your product?

Trap: Datasheet accuracy assumes ideal conditions; self-heating, supply noise, ADC errors, mounting, thermal gradients and calibration all affect system accuracy. Validate the full measurement chain.

Interrupts & Exceptions

EMB-459 · Is it fine to call printf inside an ISR for debugging?

Trap: printf is slow, often not re-entrant and may block on a UART, greatly increasing ISR time and breaking real-time behaviour. Log to a RAM buffer or toggle a GPIO instead, and print from a task.

EMB-460 · Does giving an interrupt the highest priority guarantee it is never delayed?

Trap: Code that disables interrupts (PRIMASK critical sections), higher-priority faults, flash stalls and bus contention can still delay it. Long critical sections are a common cause of missed deadlines.

EMB-461 · Does a lower priority number mean lower urgency on Cortex-M?

Trap: On Cortex-M, a lower numeric value means higher priority (0 is highest configurable). Confusing the two is a common bug, especially with RTOS limits like configMAX_SYSCALL_INTERRUPT_PRIORITY.

EMB-462 · If you disable an interrupt in the NVIC, is any request that arrives meanwhile thrown away?

Trap: Disabling only stops the interrupt from being taken; a request that arrives still sets the pending bit (and the peripheral flag stays set). When you re-enable it, the stale interrupt fires at once. Clear the peripheral flag and the NVIC pending bit first if old events must be ignored.

EMB-463 · Are nested interrupts always beneficial?

Trap: Nesting reduces latency for urgent interrupts but increases stack usage and complexity, and can cause subtle shared-data bugs.

EMB-464 · Is a HardFault always caused by a bad pointer?

Trap: HardFaults can come from escalated usage faults (divide by zero, invalid instruction), bus faults, unaligned access, stack overflow, or executing from invalid memory. Check fault status registers to find the cause.

Communication Protocols (UART, SPI, I2C, CAN, USB)

EMB-465 · Does UART "9600 baud" mean 9600 bytes per second?

Trap: Baud rate is symbols (bits here) per second. With 8N1 framing (10 bits per byte), 9600 baud gives about 960 bytes per second.

EMB-466 · Does a faster SPI clock always give faster data transfer?

Trap: Signal integrity, slave limits, DMA throughput and software overhead between transfers often limit real throughput more than the SPI clock.

EMB-467 · Can an I2C bus be any length if you use strong pull-ups?

Trap: Bus capacitance (400 pF max for standard I2C) limits rise times and length; stronger pull-ups help but increase current and can exceed sink current limits. Long distances need buffers or differential extenders.

EMB-468 · Does a CAN message ID represent the sender's address?

Trap: In CAN, IDs represent message content and priority, not node addresses. Any node can receive any message.

EMB-469 · Is USB just a faster UART?

Trap: USB is a host-controlled, packet-based protocol with enumeration, descriptors, endpoints and transfer types. Devices can't initiate transfers on their own.

EMB-470 · Does adding parity to UART guarantee error-free data?

Trap: Parity detects only odd numbers of bit errors and doesn't correct them. Use CRC and retries for reliable communication.

RTOS Concepts

EMB-471 · Does using an RTOS automatically make a system real-time?

Trap: An RTOS provides deterministic scheduling primitives, but real-time behaviour depends on design: task priorities, worst-case execution times, blocking, interrupt latency and analysis. A badly designed RTOS system misses deadlines just like a superloop.

EMB-472 · Is a mutex just a binary semaphore with a different name?

Trap: A mutex has ownership (only the holder can release it), supports priority inheritance and may be recursive; a binary semaphore has no owner and is meant for signalling. Using a semaphore for mutual exclusion invites priority inversion.

EMB-473 · Does the highest-priority task always get the most CPU time?

Trap: Priority decides who runs when several are ready, not how much time each uses. A high-priority task that blocks most of the time may use very little CPU, while low-priority tasks consume the rest.

EMB-474 · Is a shorter RTOS tick period always better for timing precision?

Trap: Faster ticks give finer delays but increase interrupt overhead and power consumption. Use hardware timers for precise events and tickless idle for low power.

EMB-475 · Can you call any RTOS API from an interrupt?

Trap: Blocking APIs (waiting on queues, mutexes, delays) must not be called from ISRs; use ISR-safe variants and respect the maximum syscall interrupt priority.

EMB-476 · Does vTaskDelay(10) always wait exactly 10 ticks?

Trap: It waits until 10 tick interrupts have passed relative to the call time, which can be up to one tick shorter, and the task may run later if higher-priority tasks are busy. Use vTaskDelayUntil for periodic timing.

Bootloaders & Firmware Updates

EMB-477 · Does a CRC check prove that firmware hasn't been tampered with?

Trap: A CRC detects accidental corruption but anyone can recompute it after modifying the image. Authenticity needs a cryptographic signature verified with a protected public key.

EMB-478 · Is encrypting firmware the same as signing it?

Trap: Encryption protects confidentiality (people can't read it); signing protects authenticity and integrity (device runs only approved code). Secure update needs signing; encryption is an extra layer when IP protection matters.

EMB-479 · Can the bootloader jump to the application by just calling its reset handler address?

Trap: It must first set the main stack pointer from the application's vector table, relocate VTOR, disable or reset peripherals and interrupts the bootloader used, and clear pending interrupts, or the application starts in an inconsistent state.

EMB-480 · Does a successful flash write guarantee the data is stored correctly?

Trap: Writes can fail silently due to power drops, write-protection or wrong erase, and flash cells can degrade. Read back and verify CRCs after writing.

EMB-481 · Is OTA update only a convenience feature?

Trap: OTA is a critical security mechanism for deploying vulnerability fixes; devices without secure updates remain exposed for their lifetime.

EMB-482 · Is it safe to erase the old firmware before receiving the new image fully?

Trap: A power loss or connection drop during the update would leave the device without valid firmware. Download and verify first, then switch.

Low-Power Design

EMB-483 · Does the lowest clock frequency always use the least energy?

Trap: Lower frequency reduces power but makes tasks take longer, so static leakage and fixed overheads accumulate. Often running fast and sleeping sooner uses less energy overall.

EMB-484 · Is the MCU the main power consumer in most battery devices?

Trap: Radios, sensors, displays, LEDs and voltage regulator quiescent current often dominate. Optimise the whole system, not just the MCU.

EMB-485 · Does the datasheet's lowest sleep current apply to your board as designed?

Trap: Datasheet sleep numbers assume most peripherals and the RTC are off and pins configured optimally. Leakage from pull-ups, external components and debug connections often raises real sleep current.

EMB-486 · Is a battery's rated mAh what your device can actually use?

Trap: Usable capacity drops at high load currents, low temperatures and with ageing, and the device may brown out before the battery is fully empty. Coin cells in particular deliver far less than rated capacity under pulsed radio loads without bulk capacitors.

EMB-487 · Does turning off a peripheral's clock remove all of its power consumption?

Trap: Clock gating stops dynamic power, but the peripheral's analog parts (references, comparators, oscillators) and I/O states may still draw current. Some blocks need explicit power-down bits or domain switching.

EMB-488 · Do LEDs left on for status cost negligible energy?

Trap: A single LED at a few milliamps can draw hundreds of times more than a microcontroller's sleep current. Use short blinks at low duty cycle or only on demand.

Debugging & Testing

EMB-489 · If firmware passes all unit tests on the host, will it work on target?

Trap: Host tests can't catch hardware timing, interrupt interactions, peripheral behaviour, endianness or memory constraints. On-target integration and HIL tests are still needed.

EMB-490 · Does adding debug prints never change program behaviour?

Trap: Prints change timing, stack usage and memory layout, which can hide or create race conditions and timing bugs. Prefer low-overhead tracing.

EMB-491 · Is 100% statement coverage enough for safety-critical firmware?

Trap: Statement coverage doesn't show that every decision and condition was exercised. Standards require branch or MC/DC coverage for higher integrity levels.

EMB-492 · Does a watchdog reset mean the firmware has a bug?

Trap: Watchdog resets can also result from hardware issues (brown-out, EMI), external peripherals blocking, or incorrect watchdog timing. Log reset causes and context before concluding.

EMB-493 · Is static analysis a replacement for testing?

Trap: Static analysis finds certain classes of defects but not logic errors, timing problems or requirement mismatches. It complements testing.

EMB-494 · Does a fault that can't be reproduced in the lab mean it doesn't exist?

Trap: Field conditions (temperature, noise, usage patterns) differ from the lab. Collect field data and reproduce conditions rather than dismissing reports.

Embedded Linux, Safety & Security

EMB-495 · Does PREEMPT_RT make Linux a hard real-time OS like a small RTOS?

Trap: PREEMPT_RT greatly reduces worst-case latency, often to tens of microseconds, but guarantees still depend on hardware, drivers and configuration, and are hard to prove formally. Safety-critical hard deadlines often run on an RTOS or a separate core.

EMB-496 · Is security through obscurity a valid protection for firmware?

Trap: Hiding protocols or code only delays determined attackers; firmware can be extracted and analysed. Use real security controls: signed updates, secure boot, encryption and access control.

EMB-497 · Does using MISRA C guarantee code is safe?

Trap: MISRA reduces risky language usage, but it doesn't verify requirements, algorithms or system safety. It is one part of a safety process.

EMB-498 · Is disabling the debug port enough to secure a device?

Trap: Locking debug helps, but attackers can use fault injection, side channels or software vulnerabilities. Defence in depth is needed.

EMB-499 · Is running every service as root on an embedded Linux device harmless because it's a closed product?

Trap: If any network-facing service is compromised, root access gives the attacker the whole device, including keys and firmware update paths. Use separate users, drop privileges, apply capabilities and sandboxing (namespaces, seccomp), and mount read-only file systems where possible.

EMB-500 · Does a device that passed safety certification stay compliant after a small software update?

Trap: Even small changes can affect timing, memory or safety mechanisms. Each update needs change impact analysis, regression and re-verification of affected safety requirements, updated documentation, and sometimes re-assessment by the certification body.

Other levels: Basic · Intermediate · Advanced · All Embedded Systems questions