Embedded engineer system design interview questions

As asked

Design an OTA firmware update system for a device deployed in homes where physical recovery is expensive.

Sample answer outline

Use A/B firmware slots or a golden fallback image so a bad update does not brick the device. Download and verify the image with signatures and checksums before marking it bootable, then use a bootloader that only commits the new slot after the application reports healthy startup. Roll out gradually by device cohort, model, region, and power or network conditions, with telemetry on download failures, boot loops, and rollback rates. Include version anti-rollback if security requires it, but design a support path for emergency downgrade. Strong candidates discuss power loss during update and how the bootloader state machine handles it.

Expect these follow-ups

• How do you test the bootloader update path itself?
• What telemetry do you need before expanding rollout from 1 percent to 50 percent?
• How do you handle a device that loses power halfway through flashing?

As asked

Design the firmware architecture for a sensor hub that reads data from an IMU over SPI at 1kHz, a barometer over I2C at 100Hz, and a GPS over UART at 1Hz, then fuses and logs the data to SPI Flash. Walk me through your task decomposition, inter-task communication, and how you meet the timing requirements.

Sample answer outline

The candidate should propose separate tasks for each sensor driver (or ISR-driven callbacks), a data fusion task, and a logging task. Inter-task communication should use FreeRTOS queues to decouple producers from consumers with bounded latency. The IMU task must run at 1kHz with a deadline, so it should be high priority. The logging task can be lower priority and drain a queue asynchronously. They should address what happens when the Flash write is slow (backpressure, overflow detection) and how to size queues.

Expect these follow-ups

• How do you guarantee the 1kHz IMU deadline is met even when the logging task is writing a large block to Flash?
• How do you handle SPI bus contention between the IMU and the Flash chip?

As asked

Design an end-to-end OTA firmware update system for 10,000 battery-powered IoT devices in the field. Cover the device-side bootloader, the transport protocol over BLE or cellular, rollback, and how you handle partial updates caused by power loss.

Sample answer outline

The candidate should describe a backend with signed firmware packages, a chunked transfer protocol with per-chunk sequence numbers and checksums, the device writing chunks to a staging partition, and the bootloader verifying the full image signature before committing. Power-loss resilience requires that no single write commits the switch; only a final flag write after full verification. Rollback should be automatic after N failed boot attempts. They should address bandwidth throttling to avoid battery drain and the risk of a bad update bricking the fleet.

Expect these follow-ups

• How do you prevent a bad update from bricking all 10,000 devices simultaneously?
• What is the minimum information you need to store in non-volatile memory to support automatic rollback?

As asked

Design the firmware power management strategy for an IoT sensor node that must run for 10 years on a pair of AA batteries. The node wakes every 60 seconds, reads a temperature sensor over I2C, and transmits the reading over LoRaWAN.

Sample answer outline

The candidate should calculate the energy budget: two AA cells provide roughly 5000mAh at 1.5V, so 10 years is 87,600 hours, giving an average current budget of about 57 microamps. They should describe minimizing active time (fast sensor read, short LoRa transmission), maximizing deep sleep duration, powering down the sensor and radio between cycles, using the RTC to wake the MCU, and choosing a Cortex-M0+ in Stop mode which can draw under 5 microamps. They should also address the LoRaWAN join procedure energy cost and ADR.

Expect these follow-ups

• How does the LoRaWAN class (A, B, or C) affect your power budget?
• What is the energy cost of a typical LoRaWAN uplink at SF7 vs SF12?

As asked

Design a framed serial protocol over UART for communicating between two microcontrollers. It must handle variable-length messages up to 256 bytes, detect corruption, and recover from partial frames caused by power loss or buffer overflow.

Sample answer outline

The candidate should describe a frame format with a start byte or preamble, a length field, a payload, and a CRC-16 or CRC-32 trailer. They should propose COBS (Consistent Overhead Byte Stuffing) or a simple escape-byte scheme to guarantee the start byte is unique. On the receiver side, a state machine processes bytes, detects the start byte, accumulates length bytes, then payload, then checks the CRC. On CRC failure or timeout, the receiver resets to the IDLE state. They should also discuss how to handle a stream of invalid bytes after a power glitch.

Expect these follow-ups

• Why is COBS superior to a simple escape scheme for embedded framing?
• How does your protocol handle a receiver that is faster than the sender, and vice versa?

As asked

Design the firmware architecture for a closed-loop brushless DC motor controller using field-oriented control. Cover the control loop timing, ADC and PWM peripheral configuration, the ISR structure, and how you keep jitter in the current control loop below 1 microsecond.

Sample answer outline

The candidate should describe triggering ADC conversion from the PWM center point (bottom of the counter) to sample current at midpoint, running the FOC calculation inside the ADC interrupt or DMA complete interrupt, and updating PWM compare registers before the next PWM period. The ISR must complete in under one PWM period minus deadband margin. They should mention that the Clarke and Park transforms are fixed-point on Cortex-M4 using the DSP library, and that the outer speed loop runs at a lower rate in a task.

Expect these follow-ups

• Why is it important to sample phase currents at the center of the PWM period?
• How do you implement the Park inverse transform without floating point on Cortex-M4?

As asked

Design a multi-stage bootloader for a Cortex-M33 with TrustZone. You need a ROM-based first stage, a trusted second stage in Secure Flash, and an application in Non-Secure Flash. Walk me through memory partitioning, secure gateway calls, and how the chain of trust is maintained.

Sample answer outline

The candidate should describe SAU and IDAU configuration to partition Flash and SRAM into Secure and Non-Secure regions, the ROM bootloader verifying stage 2 with a hardware-fused key, stage 2 setting up SAU before jumping to the Non-Secure application, and Non-Secure Callable (NSC) veneer functions exposing a cryptographic API to the application. They should mention that the Non-Secure vector table must be relocated before the jump and that no Secure data addresses are ever exposed to Non-Secure code.

Expect these follow-ups

• What prevents the Non-Secure application from calling into arbitrary Secure memory addresses?
• How do you debug a Secure fault triggered by a Non-Secure access violation?

As asked

Design a fixed-size block memory pool allocator for an RTOS-based system that must provide O(1) allocation and deallocation with no fragmentation. Walk me through the data structure, the allocation path, and how you make it ISR-safe.

Sample answer outline

The candidate should describe a statically allocated array of fixed-size blocks with a free-list pointer embedded in each free block (or a separate free-list index array). Allocation pops the head of the free list in O(1); deallocation pushes back in O(1). ISR safety requires that the free-list head update is atomic, which on Cortex-M can be done by disabling interrupts briefly or using LDREX/STREX. They should note that this approach works only if all allocations are the same size or if multiple pools with different sizes are used.

Expect these follow-ups

• How do you detect a double-free in your pool allocator in a debug build?
• What is the overhead of embedding the free-list pointer inside free blocks vs a separate index array?

As asked

Design the CAN bus message architecture for a vehicle with an engine ECU, a transmission ECU, a body control module, and a dashboard. Cover message ID assignment, bus loading analysis, and error containment strategy.

Sample answer outline

The candidate should assign lower CAN IDs (higher priority) to safety-critical messages like engine RPM and brake status, and higher IDs to non-critical dashboard messages. Bus loading is calculated as sum of (frame_length_bits / period) across all messages; it should stay below 70 to 80 percent for stability. Error containment means each ECU has an independent error counter and can enter bus-off without affecting others. They should mention using CAN FD for higher-bandwidth needs and the importance of proper termination resistance.

Expect these follow-ups

• How does CAN arbitration ensure that higher-priority messages always win without collisions?
• What is the maximum number of CAN nodes on a single bus segment and what limits it?

As asked

Design a hardware-in-the-loop (HIL) test framework for validating the firmware of an embedded motor controller. Cover how you simulate the motor and sensors, inject faults, and automate test execution in CI.

Sample answer outline

The candidate should describe a HIL rig where a real-time simulator (e.g., a second Cortex-M or an FPGA) generates realistic ADC voltage levels to represent motor currents and encoder pulses, connected to the DUT's analog inputs. A host PC runs test scripts that command the simulator to inject faults (overcurrent, Hall sensor drop-out), read back the DUT's response over CAN or UART, and compare against expected behavior. CI integration triggers the rig after each build via a USB-connected JTAG debugger flashing the DUT.

Expect these follow-ups

• How do you synchronize the HIL simulator's output timing with the DUT's PWM period?
• What makes a HIL test suite a maintenance burden and how do you reduce it?