Firmware development

The engineering objective

Implement dependable device behaviour from startup through normal operation, updates and fault recovery.

The work starts from processor documentation, memory map, board revision, peripheral interfaces and boot requirements. The team should identify the authoritative revision of each input and record any assumptions needed to proceed. This prevents a later result from being interpreted against a different specification or configuration.

What needs technical attention

Interrupt context and shared state need deliberate ownership; recovery paths should be tested on the target hardware.

The review centres on watchdog behaviour, timing limits, resource use, reset causes and interrupted updates. Each finding should identify the input revision, observed behaviour and supporting evidence. Distinguish a confirmed defect from a configuration issue, an unsupported case or an open engineering question before deciding how to resolve it.

How the work is reviewed

The practical sequence is: bring up clocks and memory; implement peripheral services; integrate application state machines; test update and recovery paths. Intermediate reviews allow the client to resolve decisions while changes are still manageable. If an input changes, identify the affected activities and repeat the checks that depend on it.

The expected package comprises firmware source, reproducible builds, configuration notes, tests and release artifacts. Acceptance criteria should specify what the receiving team needs to reproduce, inspect or integrate these artifacts. Include known limitations and outstanding actions in that package, rather than assuming that delivery of a file implies acceptance.

Design for transitions, concurrency and recovery

Embedded behaviour is shaped by the target hardware as well as application code. Keep the processor, board revision, memory map, boot flow and peripheral configuration visible in the project baseline. Define ownership of buffers and shared state across tasks, interrupts and DMA. Specify whether an API can block, which context may call it and how errors are reported to its caller.

Testing should follow the device lifecycle: startup, configuration, normal work, overload, low-power transitions, update and recovery. Host-side tests are valuable for deterministic logic, while target tests are needed for hardware timing and peripheral behaviour. Record which environment produced each result. A passing simulated test should not be presented as a measurement from the physical board.

Observe resource use under realistic contention, including stack and heap peaks, interrupt latency, queue growth and deadline misses. Inject failures where the product must recover: a disconnected peripheral, failed initialisation, timeout or interrupted update. Release notes should state the compatible hardware and configuration, how the image was built and how a previous known-good state can be restored when the product’s update design supports it.

An illustrative review scenario

A peripheral times out while an application task is being stopped. Check that callbacks cannot access released memory, locks are released and a later restart can initialise the device cleanly. Keep a repeatable fault-injection test alongside the normal transfer test. The exact sequence depends on the target platform and is agreed during implementation.