Staff Embedded Developer Interview Preparation Guide - Airbnb

Read the map and compute safe stack margin

• Find the top-of-RAM symbol (often _estack or __StackTop) and the end of BSS (.bss end symbol like _ebss or bss_end).
• Stack grows downward, so safe margin = (stack_start_address) - (highest_address_used_by_bss_or_static) - safety_reserve.
• Example: Stack start 0x20010000, _ebss = 0x2000F200 → raw free = 0xE00 (3584 bytes). Choose safety_reserve (guard + scheduler/interrupt worst-case) and subtract to get usable stack.

Adjust linker script or move large buffers

• Move large buffers to external RAM region in linker script:

.ext_ram (NOLOAD) : {
  .ext_bss_start = .;
  *(.ext_bss)
  .ext_bss_end = .;
} > EXT_RAM

• In C:

uint8_t big_buf[64*1024] __attribute__((section(".ext_bss")));

• Or allocate on heap at init (malloc) if runtime placement acceptable. Or mark as dynamically allocated to avoid static BSS.

Reserve a red zone / stack canary

• Add a dedicated region between .bss and stack in linker script with a fill pattern:

.stack_guard_start = .;
.stack_guard = . + 1024; /* 1KB red zone */
.fill 0xDEADBEEF

• Or fill with known pattern at boot and check periodically/at context switch; or place a canary at stack base and verify on ISR/ task switch to detect overflow.

Practical tips

• Re-scan map after builds; identify largest static objects.
• Use smaller stacks for idle tasks; measure actual stack usage with fill-pattern runtime profiling.
• When moving buffers to external RAM, verify startup initialization (.data copy, zero .bss) covers external region or initialize manually.

Direct answer
Coaching a genuine underperformer starts with diagnosing why (skill gap, unclear expectations, motivation, or something outside work like a health or personal issue) before assuming it's a will problem, then moving to a private, honest conversation with specific examples, a written and time-bound improvement plan with objective checkpoints, and a clear, stated understanding of what happens if the bar still isn't met. The hard part isn't the first conversation, it's staying honest and consistent through every checkpoint after it.

Structured elaboration

Diagnose before you coach

Below-the-bar performance has different root causes that call for different responses:

• Skill gap: they don't yet know how to do the thing. Response: targeted teaching, pairing, smaller scoped tasks.
• Unclear expectations: they don't know what "good" looks like here. Response: make the bar explicit and concrete, with examples.
• Motivation or engagement: they can do it but aren't. Response: a more direct conversation about what's changed and why.
• Something outside work: a health issue, a personal crisis, burnout. A private, non-judgmental check-in on wellbeing belongs early in this process, both because it's the right thing to do and because it changes what the right intervention is (support and possibly a formal accommodation, not a performance plan).

Getting this wrong (coaching a skill gap like it's a motivation problem, or the reverse) wastes the improvement window on the wrong intervention.

The conversation and the plan

• Deliver the message privately, plainly, and with specific examples: what's below the bar, what the bar actually is, and why it matters.
• Put the plan in writing: two or three concrete, observable goals, a defined timeframe, and what evidence would count as "met."
• Set a regular check-in cadence shorter than your normal 1:1 rhythm; below-the-bar performance needs tighter feedback loops, not the same cadence as everyone else.

When to involve HR formally

This is a judgment call many candidates get wrong by either never mentioning HR (naive) or looping HR in immediately (overcautious, and it can undermine trust). A reasonable line: loop in HR or your manager as soon as the conversation could plausibly lead to a formal employment outcome (a documented warning, or separation), even if you're optimistic it won't get there, because that's exactly when documentation and process need to be right from the start rather than reconstructed after the fact.

Protecting the team

The rest of the team usually already knows something is off; silence reads as either denial or unfairness. Without disclosing private performance details, it's reasonable to acknowledge you're aware of the gap and are addressing it, and to be transparent about redistributing work if needed, so the team doesn't quietly conclude the issue is being ignored.

Worked example

Situation

An engineer on a team I was supporting had been reliably strong for over a year, then their output quality and delivery reliability dropped off sharply over a couple of months: reviews were taking longer, deadlines were slipping, and the pattern didn't match a normal bad sprint.

Diagnosis

Before assuming a motivation problem, I had a private, low-pressure conversation focused on checking in rather than accusing. That surfaced that part of the issue was a skill gap on a newer part of the codebase they'd been assigned to without much ramp-up, but there was also something going on outside work affecting their focus.

Action

We set a short, explicit improvement plan: two concrete, observable goals tied to real upcoming work, a shorter check-in cadence, and pairing time on the unfamiliar codebase area. I also made sure they knew about the option to talk to HR about support resources for the personal situation, kept separate from the performance conversation so the two didn't get conflated.

Result

Performance recovered within the plan's window once the skill gap closed and the external situation stabilized. Because the conversation started from genuine diagnosis rather than an assumption, the plan addressed the actual cause instead of just adding pressure, and the person stayed on the team and rebuilt trust with the group.

The other branch (when it doesn't turn around)

Not every case ends this way. When someone doesn't meet a documented plan's criteria despite real support, the path is a harder, well-documented conversation, formal HR involvement, and eventually separation if there's no path forward. The mentor's job at that point shifts from "close the gap" to making sure the process is fair, well-documented, and handled with dignity, and to being honest with the rest of the team (without violating privacy) that a change is coming so it doesn't land as a surprise.

Trade-offs & pitfalls

• Treating every case as a motivation problem. The single biggest junior mistake here is skipping diagnosis and going straight to "try harder" messaging, which fails skill-gap and external-cause cases and can be actively harmful if there's something like burnout or a health issue underneath.
• Involving HR too late (or too early). Too late, and you've lost the documentation trail that protects everyone, including the underperformer, if it does become formal. Too early or too visibly, and it can read as punitive before the person's had a real chance, damaging trust unnecessarily.
• Optimizing for the individual at the team's expense, or the reverse. A senior answer holds both: real support for the person, and honesty with the team about workload and timeline impact, rather than pretending nothing's happening.
• No exit criteria stated up front. A plan without a clear "what does not-met look like, and what happens then" isn't actually a plan, it's a delay, and it's unfair to the person because they don't know what they're actually being measured against.

Direct answer

Before building any recovery plan, diagnose the actual cause: a genuine readiness gap, ambiguous or inconsistently applied criteria, or a structural block (budget freeze, reorg) entirely outside your control, since the right two-quarter plan looks completely different depending on which one it is.

Structured elaboration

• Diagnose before acting, this is the step several answers skip. Ask directly, your manager and, if appropriate, a skip-level or HR (human resources), which bucket this falls into. The same discipline applies whether the specific situation is being passed over for promotion twice in a row, an HR or budget block despite clear manager support, mixed and inconsistent promotion-review feedback, or your team being disbanded in a reorg with nothing to do with your performance.
• Get the diagnosis in writing where you can (a short recap email after the conversation), so the criteria for next time are explicit and can't quietly drift again.
• Match the two-quarter plan to the diagnosis: a readiness gap calls for naming the one or two specific gaps and a concrete way to close them; ambiguous criteria call for pushing for a written, specific bar and calibrating against a recently promoted peer; a structural block calls for negotiating interim recognition (scope, title, or a compensation alternative) and simply continuing to deliver visibly, since the case itself doesn't need rebuilding.
• Keep a running log of impact regardless of cause, so the next review relies on a record rather than memory.

Worked example

I expected a promotion and didn't get it, and my first move wasn't a recovery plan, it was asking my manager directly what had actually driven the decision. It turned out to be a mix: the committee felt the case was strong on delivery but thin on evidence of cross-team impact, and separately, headcount for that level was frozen that cycle regardless of anyone's case. Knowing both halves changed what I did next. For the readiness half, I picked one initiative deliberately structured to touch two other teams and documented it as I went rather than after the fact. For the frozen-headcount half, I didn't spend energy trying to fix something outside my control, I asked for an interim scope change I could point to later and kept the impact log running so the next review had a record instead of the same ambiguous case.

Trade-offs & pitfalls

• The most common mistake is skipping the diagnosis and jumping straight into a remediation plan; if the real cause was budget, the plan solves the wrong problem and burns two quarters proving something nobody doubted.
• Accepting a vague answer ("just not quite there yet") instead of pushing for specifics sets up the same ambiguous outcome next cycle.
• Asking for interim recognition (title, scope) before you understand the real cause can read as entitled; sequence it after the diagnosis.
• Nursing a private grievance instead of a calibrated, written understanding of the criteria repeats the cycle.

Approach (brief)
Provide a safe, minimal blocking full-duplex SPI transfer: assert CS, configure mode/clock if changed, transfer N bytes by writing TXDR then waiting for RXDR, finally deassert CS. Support variable clock by reconfiguring baud register before asserting CS and protect shared peripheral with a mutex/lock.

Code (blocking, polling)

// Example minimal SPI transfer (polling) for MCU with registers SPI->CR, SPI->DR, SPI->SR
#include <stdint.h>
typedef enum { SPI_MODE0=0, SPI_MODE1, SPI_MODE2, SPI_MODE3 } spi_mode_t;
volatile uint32_t LOCK=0;

static inline void lock_acquire(void){ while(__atomic_test_and_set(&LOCK, __ATOMIC_ACQUIRE)); }
static inline void lock_release(void){ __atomic_clear(&LOCK, __ATOMIC_RELEASE); }

int spi_transfer(uint8_t *tx, uint8_t *rx, size_t n, uint32_t baud_div, spi_mode_t mode, void (*cs_assert)(int), void (*cs_deassert)(int), int dev_id){
    lock_acquire();
    // safe reconfigure
    SPI->CR &= ~SPI_CR_ENABLE;
    SPI->BR = baud_div;            // set clock
    SPI->CR = (SPI->CR & ~SPI_CR_MODE_MASK) | (mode << SPI_CR_MODE_SHIFT);
    SPI->CR |= SPI_CR_ENABLE;

    cs_assert(dev_id);
    for(size_t i=0;i<n;i++){
        SPI->DR = tx ? tx[i] : 0xFF;            // write to start transfer
        while(!(SPI->SR & SPI_SR_RXNE));       // poll RX ready
        uint8_t r = (uint8_t)SPI->DR;
        if(rx) rx[i]=r;
    }
    cs_deassert(dev_id);
    lock_release();
    return 0;
}

Interrupt vs Polling (trade-offs)

• Polling: simple, deterministic latency, good for short bursts and bare-metal; wastes CPU if transfers long.
• Interrupt-driven: lower CPU usage, better for multitasking or long transfers; more complex (state machine, circular buffers), higher ISR overhead and latency jitter.
• Choose polling for < few hundred bytes or realtime-critical inner loops; choose interrupts (or DMA) when offloading CPU and handling concurrent tasks.

Edge cases / safety

• Ensure CS asserted before transfers and deasserted after last byte (clocking).
• Protect config changes with a lock or run in critical section.
• Handle FIFO/full/overrun flags and timeouts in production code.

What 'bias to action' means. It is not speed for its own sake. It is a default toward a small, information-generating action instead of waiting for complete certainty, applied when the cost of delay is real and the action is cheap to reverse if you're wrong. The same underlying trait shows up under different labels depending on the company: some call it 'bias to action,' others call it 'ownership' or 'adaptability.' The label doesn't matter. What matters is the decision rule underneath it: act now when (1) the action is a 'two-way door' (cheap and fast to undo), (2) delay itself has a measurable cost (a blocked teammate, a closing window, decaying trust), and (3) the information you'd gather by waiting probably wouldn't change what you'd do anyway. Wait when the action is a 'one-way door' (expensive or slow to undo) or when the missing information could genuinely flip the decision.

Example where acting early was the right call. I was assigned a goal that was really just a one-line ask: 'improve model quality,' with no metric, no threshold, and no deadline attached. Rather than wait for a written spec, which historically took two to three weeks to arrive from that stakeholder, I spent two days drafting a one-page problem framing: a proposed metric (reduce the false-negative rate on high-value transactions from 4.1% to under 3.0%, while keeping precision at or above 92%), the baseline data I'd use, and an explicit list of what I was assuming. I sent it to the PM and the eng lead with a 48-hour silence-is-consent window and started the baseline analysis in parallel rather than waiting for a reply. One comment came back adjusting the precision floor from 92% to 90%, and I had clear, agreed direction about two weeks earlier than waiting for a formal spec would have gotten me. The action was reversible (a one-page doc, not a shipped change) and the cost of two more weeks of drift was real, so acting was correct.

Example where acting early was not the right call. On a different initiative, I shipped a UI change intended to reduce onboarding friction based on a hunch, without waiting the two days it would have taken to pull server-side funnel logs. The logs, once I finally checked them (after the change was already live), showed the actual drop-off was happening at a completely different step than the one I'd 'fixed.' The build itself wasn't a one-page doc this time, it was two engineer-days of real work plus a rollback, and the two days I'd tried to save by skipping the log check cost more than two days once you count the wasted build and the revert. The mistake wasn't acting fast, it was skipping a cheap, fast source of real evidence (the two-day log pull) that would have changed the decision, in favor of a hunch that felt fast but wasn't actually cheaper.

How I documented and communicated each. For the first, the one-page framing itself was the documentation: assumptions, proposed metric, and an explicit 48-hour review window, shared in writing (not just discussed verbally) so there was a dated record of what was assumed and who had the chance to object. For the second, once the log data came back, I wrote a short note to my lead within a day of discovering the mistake, stating plainly what was shipped, what the logs actually showed, and what I was reverting, rather than quietly fixing it and hoping nobody noticed. In both cases, the goal of the documentation was the same: make the reasoning visible to someone who wasn't in my head, so a wrong call could be caught and corrected quickly instead of discovered by accident months later.

The trap. A mediocre answer treats 'bias to action' as just moving fast, or as a personality trait ('I'm just a doer'). That misses the actual judgment being tested: knowing when the cost of delay exceeds the cost of being wrong, and when it doesn't. The engineer who ships fast in the first example and the engineer who ships fast in the second example both 'had a bias to action.' Only one of them was applying it correctly.

Approach overview
Chunked download + resume means fetching the firmware in fixed-size blocks (e.g., 4–64 KiB) using HTTP Range or a custom protocol, verifying each block, storing progress persistently, and assembling/writing to flash with minimal RAM until fully validated and activated.

Tracking progress on device

• Persist a small download state in non-volatile storage (EEPROM/flash metadata): total size, chunk size, last-successful-chunk-index, and a compact bitmap or small vector of received-chunk flags.
• On boot/resume, read this metadata to know which ranges remain. Use sequence numbers to avoid races.

Verifying each chunk

• Server provides per-chunk integrity (SHA256 or CRC32) or a Merkle tree root; each chunk carries its hash.
• After receiving a chunk, compute its hash incrementally (streaming) and compare before committing to flash.
• For extra security, sign the final image and verify signature in bootloader.

Minimizing RAM while assembling

• Stream-write chunks directly to a staging flash area or secondary bank rather than buffering full image in RAM.
• Use a single small receive buffer (e.g., 4–8 KiB), verify, then write via flash driver/DMA. Keep only hash state in RAM.
• Align writes to flash page sizes; avoid whole-image copies by using two-bank (A/B) firmware scheme.

Safe resume after power/connectivity loss

• Make chunk writes and metadata updates atomic: write chunk → verify → flush cache → update bitmap and last-successful-chunk in persistent metadata.
• Use wear-friendly journaling: write new metadata record then mark old as invalid (or use checksumed ring).
• Bootloader should only switch to new image after full integrity and signature verification; if interrupted, it falls back to known-good bank.

Notes / trade-offs

• Smaller chunks improve resume granularity but add overhead; pick chunk size considering MTU, flash write cost, and hash compute cost.
• Use CRC32 for speed on constrained MCUs, SHA256 for stronger security (hardware accel if available).

Direct answer
I treat a company's published culture and values as a claim to be tested, not a fact to accept, and I look for evidence in three places: how people describe real, specific incidents (not slogans) when I ask about them, whether the org's actual structures and incentives would make the stated behavior easy or hard to practice, and whether the story is consistent across different people I talk to in the process.

Structured elaboration

1. Ask for a specific recent incident, not a description of the value. A question like "tell me about a time the team had to choose between shipping fast and following the documented review process" forces a real story; a question like "how would you describe the engineering culture here" invites a rehearsed, values-page-adjacent answer that tells you little.
2. Check whether the org's structure actually supports the stated value, independent of what anyone says. If a company claims to value psychological safety but every interviewer you meet is visibly guarded about naming any team problem, or if a company claims strong autonomy but every technical decision in the loop turns out to require a director's sign-off, the structural evidence contradicts the claim regardless of the wording used to describe it.
3. Triangulate across multiple people, ideally at different levels and tenures. A single enthusiastic interviewer proves little; a hiring manager, a peer-level engineer, and someone from a different function independently describing the same specific behavior (not the same slogan) is much stronger evidence.
4. Ask what the company would do differently if it stopped believing the value, and watch for a concrete, structural answer versus a vague one. People who work inside a genuinely lived value can usually name a real trade-off it costs them; people describing marketing usually cannot.
5. Treat your own discomfort as data. If a described norm (pace, feedback directness, decision-making style) makes you visibly uneasy during the process itself, that is a more reliable signal about fit than anything printed on the careers page, because it is your own live reaction rather than a claim you are being asked to evaluate secondhand.

Worked example
Suppose a company's careers page says it "empowers engineers with high autonomy." During the loop, ask the hiring manager for a specific recent example: "Tell me about the last time an engineer on this team made a production architecture decision without it going through a review committee first." A genuine, lived-autonomy answer sounds like: "Last quarter one of our engineers decided independently to switch a service from synchronous to async processing after noticing latency complaints; she looped in two people for a sanity check, shipped it, and reported the outcome in the next team sync." A marketing-only answer sounds like: "We really believe in empowering our engineers," repeated with no specific incident when pressed twice. If a peer engineer you speak to separately can also describe a comparable specific incident in their own words, that consistency is strong corroborating evidence; if the hiring manager's story turns out to be the ONLY example anyone can produce company-wide, that is itself informative about how common the behavior actually is.

Trade-offs & pitfalls
The main failure mode is accepting an interviewer's fluent, confident description of the culture as sufficient evidence on its own; confidence and specificity are not the same thing, and a well-rehearsed answer to a values-page question is exactly what a company under-delivering on its stated culture is most likely to have prepared. A second pitfall is over-weighting a single glowing anecdote from one enthusiastic interviewer without checking whether it generalizes; one great story is an anecdote, not a pattern. A third is treating any inconsistency you find as automatically disqualifying: it is normal for a large or growing organization to have real variance across teams, so the useful conclusion is usually about the SPECIFIC team and manager you'd actually join, not the company as a monolithic whole.

Overview — when an interrupt triggers a preemptive context switch
Briefly: the CPU’s exception entry does the first level saving, the ISR requests a context switch (typically by setting PendSV), the scheduler picks the next ready task, and the PendSV handler completes the full context switch by saving/restoring the remaining registers and swapping the PSP.

1) Hardware (automatic) stacking on exception entry

• Cortex‑M hardware automatically pushes this “stack frame” onto the active stack:
  • R0, R1, R2, R3, R12, LR (R14), PC (R15), xPSR
• That stack frame is placed on the stack in use by the interrupted thread (usually PSP when threads run); note FPU cores may also push S0–S15 and FPSCR (lazy stacking) if FP in use.

2) ISR context and requesting a switch

• The ISR runs (often on MSP or exception context) and must not perform the full task switch itself.
• To request a switch it sets the PendSV pending bit via the Interrupt Control and State Register (ICSR) — e.g., write to NVIC->ICSR = (1 << PENDSVSET) — or calls the RTOS API that does this.
• Setting PendSV defers the expensive stack manipulation until a lower-priority exception (PendSV) runs after all higher-priority IRQs complete.

3) Scheduler decision

• The ISR or RTOS scheduler computes the next task (priority-based, round‑robin, or RTOS-specific ready lists).
• Scheduler selects the highest-priority READY task; it updates TCBs but does not yet change CPU registers.

4) PendSV handler: full context switch

• PendSV runs in exception context. Typical sequence (assembly/C):
  • Read current PSP (process stack pointer) — this points to the interrupted task’s stack frame.
  • Push callee-saved registers R4–R11 (and FP callee-saved regs if used) onto the task stack at PSP. These are not saved by hardware and must be preserved.
  • Save the new PSP to the current task’s TCB (store task stack pointer).
  • Load the next task’s stack pointer from its TCB into PSP.
  • Pop R4–R11 from the new task’s stack (restoring its callee-saved registers).
  • Execute exception return (BX LR with EXC_RETURN value) which causes the CPU to pop the hardware-stacked frame (R0–R3,R12,LR,PC,xPSR) from the new task’s stack and resume thread mode in that task.

5) Where each register ends up

• Hardware-stacked frame (R0–R3,R12,LR,PC,xPSR): on the active thread stack (PSP) by the CPU on exception entry.
• Software-saved callee-saved (R4–R11): pushed by PendSV onto the task’s stack (PSP).
• Floating-point registers: handled by lazy stacking or explicitly saved/restored by RTOS if FPU used.

6) Notes and pitfalls

• Ensure PendSV priority is lowest so it runs after all IRQs.
• Use atomic operations or disable interrupts briefly when manipulating ready lists/TCBs.
• Pay attention to stack alignment (8‑byte aligned) and EXC_RETURN codes for correct return-to-thread behavior.
• FPU and lazy stacking require explicit handling to avoid corrupting FP state.

This sequence keeps ISR short, defers heavy work to PendSV, and ensures full CPU state is restored for the next task.

Brief guidelines (goal: correctness then performance)

• Place DMA buffers in well-defined memory regions:
  • Use non-cacheable (device/strongly-ordered) memory for control blocks, small I/O rings, and status registers.
  • Use cached DDR/TCM for large data but treat with explicit cache maintenance.
  • Never have two different cacheability attributes mapped to the same physical RAM.

Cached vs non-cached tradeoffs

• Cached: best CPU throughput; requires extra cache ops around DMA.
• Non-cached: simpler coherency and lower latency for small I/O, but higher CPU memory-access cost.

Cache maintenance rules

• DMA reading from CPU buffer (CPU -> device): before starting DMA, CLEAN (write-back) D-cache lines covering the buffer so device sees latest data.
• DMA writing to CPU buffer (device -> CPU): after DMA completes, INVALIDATE D-cache lines covering the buffer before CPU reads, so stale cache lines are not used.
• For bidirectional mixed access, CLEAN + INVALIDATE the range.
• Always align ranges to cache line boundaries (round start down, end up).
• Use provided CPU instructions / HAL APIs (e.g., arm_dcache_clean, arm_dcache_invalidate) — don’t rely on software flushing single bytes.

Alignment and sizing

• Use cache-line-aligned buffer start and lengths rounded up to line size.
• Prefer buffer sizes that are multiples of cache line and DMA burst sizes for max throughput.
• Respect peripheral DMA alignment and maximum transfer/descriptor length (split if needed).

Coordinating CPU and DMA for large transfers

• Split very large transfers into chunks sized to balance DMA max transfer and cache maintenance cost.
• Use double-buffering (ping-pong): while DMA fills buffer A, CPU processes buffer B. On completion, perform invalidate only for the completed buffer.
• Use descriptor chaining if hardware supports scatter-gather.
• Use ownership flags and memory barriers:
  • CPU sets up descriptor and does cache CLEAN on descriptor metadata, then issue DMA start and a store-release barrier.
  • DMA completion interrupt triggers: in ISR, perform invalidate on the specific buffer region, then do a load-acquire before signalling worker thread.
• Protect shared indices/flags with atomic ops or disable interrupts briefly; ensure those control words are in non-cached memory or cleaned/invalidated with barriers.

Practical tips

• Prefer placing small control structures and flags in non-cacheable memory to avoid maintenance overhead.
• Measure and tune: batch operations to reduce number of cache ops; avoid frequent small DMA that force many clean/invalidate cycles.
• Document memory map and cacheability so firmware and bootloader agree.

Example sequence (device->CPU):

1. Allocate buffer aligned to cache line.
2. Start DMA into buffer.
3. On DMA interrupt: invalidate D-cache for buffer range.
4. CPU reads buffer.

Example sequence (CPU->device):

1. CPU fills buffer.
2. Clean D-cache for buffer range.
3. Start DMA to device.

Design summary (constraints)

• Flash: erase block = 4 KB, program granularity = 256 B.
• Goals: lock-free, ISR-safe logging, atomic append across power loss, wear-leveling, minimal ISR latency.

Data layout (per 4KB block)

• Divide block into sixteen 256 B slots. Each slot stores one record segment (header + payload up to 240 B, remainder reserved).
• Slot format (all aligned inside 256 B):
  • 4 B sequence number (monotonic, wraps)
  • 2 B record id / flags (type, continuation)
  • 2 B payload length
  • N bytes payload (<= 240)
  • 4 B CRC32 of header+payload
  • 4 B commit magic (0xA5A5A5A5 when committed; default 0xFFFFFFFF when erased)
  • padding to 256 B
• Multi-slot records use a continuation flag and sequence numbers monotonic per-record.

Rationale: 256 B program unit lets us write complete slot atomically (no partial-program smaller than 256 B). Commit magic at end of slot confirms successful programming.

Atomic append algorithm (lock-free, ISR-safe)

• ISR path: extremely short — push log item into an in-RAM single-writer circular buffer (SPSC ring) without locks (head++). If ring full, drop or increment drop-counter. No flash access in ISR.
• Flash writer (lower-priority thread/idle): consumes RAM ring, formats one or more slots, computes CRC, writes slot(s) to next free slot(s) in current flash page:
  1. Prepare slot buffer in RAM (sequence = next_seq).
  2. Program entire 256 B slot to flash using flash-program API (one 256 B write).
  3. Read-back (or rely on ECC/flash API status) and then program the commit magic in the same slot (commit magic is part of the 256 B content written; ensure write of slot includes final commit magic). To be atomic on power-loss, write must complete fully; partial-program appears as invalid CRC/commit (0xFF).
  4. Increment next_seq. If record spans multiple slots, ensure continuation flag set and sequence increments.
• Important: Do not erase in append path. Erase happens only by GC thread.

Why atomic: a fully-programmed slot contains valid CRC and commit magic. A power-loss during programming leaves corrupted CRC and/or commit magic (0xFF), which recovery interprets as incomplete.

Recovery on boot

• Scan all blocks and slots in fixed order (wear sequence). For each slot:
  • If commit magic == expected and CRC matches => valid record; track highest sequence per record stream.
  • If commit magic invalid or CRC mismatch => incomplete; discard.
• Reconstruct append pointer as (block,slot) after the highest valid sequence. Resume writer with next_seq = highest_seq+1.

Wear-leveling & block allocation

• Maintain circular erase queue of blocks (rotate physical blocks). Track erase counts per block in metadata stored in reserved slots (or in separate NVM). Allocate next append block as the one with the lowest erase count among a sliding window to distribute wear.

Garbage collection (minimize real-time impact)

• GC runs in low-priority context or background thread; never in ISR. Steps:
  • Select victim block (oldest or highest erased count imbalance).
  • Copy any still-live records from victim into a new block by writing fresh slots (writer may pause briefly at slot granularity if necessary; but design: writer writes only to current tail block — GC copies from older blocks).
  • After successful copies and verification, schedule erase of victim block (erase is slow and blocking; perform only in background). Use hardware flash erase API which may support background/interruptible erase on some MCUs — prefer non-blocking erase if available.
  • Update wear metadata and move victim to tail of arena.
• To minimize impact:
  • Throttle GC with tokens/time-slice (e.g., erase only when CPU idle or between higher-priority task windows).
  • Limit number of pages erased per second.
  • Pre-erase spare blocks proactively during long idle periods to guarantee immediate free pages for high-throughput bursts.

Edge cases & robustness

• Power loss during copy: use sequence numbers and CRC so copied records are written as new sequences; original remains until erase completes. Recovery chooses highest sequence.
• Full flash: backpressure to ISR ring (drop or overwrite oldest depending on policy). Monitor dropped-count metric.
• Wear metadata corruption: keep redundant copies of metadata in multiple slots and verify with CRC.

Why this works

• 256 B atomic program units + commit magic + CRC ensure corrupted partial writes are detectable.
• ISR path never touches flash and is O(1) — lock-free SPSC ring guarantees no blocking.
• GC and erases isolated to background thread preserve real-time guarantees.
• Sequence numbers + block rotation implement wear-leveling and allow deterministic recovery.