DoorDash Embedded Developer (Mid-Level) Interview Preparation Guide

Approach summary
For small divisors on a RISC‑V core without DIV, use: (1) reciprocal multiplication for fixed/constant divisors, (2) shift‑subtract long division for variable small divisors, (3) precomputed tables for very small ranges. Choose by code size, worst‑case cycles, and precision needs.

1) Reciprocal multiplication (best for constant divisors)

• Precompute multiplier M = ceil(2^k / d) and shift s = k. Then
  quotient = (uint32_t)(( (uint64_t) n * M ) >> s);
• Works for unsigned and can be extended for signed with corrections.
• Example C (unsigned, 32-bit, divisor d known):

// Precomputed for d=10: M=0xCCCCCCCD, s=35 (example)
static const uint64_t M = 0xCCCCCCCDULL; // 2^k/d
static const int s = 35;
static inline uint32_t div_by_10(uint32_t n){
  return (uint32_t)(((uint64_t)n * M) >> s);
}

• Cycle estimate: one 64-bit multiply (on RV32G usually a software sequence or mul instruction then shift) + shift = ~3–8 cycles on RV32M/mul support; if MUL absent, much slower.
• Trade-off: excellent average & worst-case; tiny code when divisor constant.

2) Shift‑subtract long division (variable small divisors)

• Classic restoring/non‑restoring algorithm: iterate up to W bits but can early-exit if divisor > remainder.
• For small divisors (d < 256) loop iterations ~log2(d) to align; average cycles often low.
• Pseudocode outline:

int div_var(uint32_t n, uint32_t d){
  uint32_t q=0, r=0;
  for(int i=31;i>=0;i--){
    r = (r<<1) | ((n>>i)&1);
    if(r >= d){ r -= d; q |= (1u<<i); }
  }
  return q;
}

• Cycle estimate: ~32 iterations, each ~6–10 cycles on RV32 -> ~200–320 cycles worst-case. For small d you can normalize and reduce iterations to ~8–12 -> ~50–120 cycles.
• Trade-off: works when divisor changes; larger worst-case than reciprocal method.

3) Precomputed tables (d in small range, e.g., 1..16)

• Store reciprocals or direct quotients for n ranges: for 8-bit n and small d, table lookup is O(1).
• Memory vs speed trade-off: extremely fast (1–3 cycles) but may consume significant ROM for larger domains.

Trade-offs & recommendations

• If divisor is constant: use reciprocal multiplication — minimal cycles, small code.
• If divisor variable but within small known range: use small lookup tables or several reciprocal paths.
• If no MUL instruction available: shift‑subtract may be better than expensive software 64-bit multiplies.
• Worst-case vs average: reciprocal gives tight worst-case; long division has predictable but higher worst-case; table lookup gives best avg/worst but uses memory.

Final practical note
Measure on target core: count cycles for MUL and shift sequences, verify off‑by‑one corrections (especially for signed), and prefer compiler intrinsics or hand‑tuned assembly for tight loops.

Definition / purpose
A context switch in an RTOS is the act of saving the currently running task’s execution state and restoring another task’s state so the CPU can continue execution on the new task with correct register/memory context. It enables multitasking and preemption for real‑time behavior.

CPU & memory state to save/restore

• CPU registers: program counter (PC / PC/PC-like), stack pointer (SP), status/flags (PSR/CPSR), general purpose registers (R0–Rn).
• Special registers: floating-point / DSP registers (if FPU used), control registers, banked registers (on some architectures).
• Memory-related: TCB pointers (task control block), MMU/TLB context if using memory protection, kernel bookkeeping (ready list pointers).
• Interrupt mask / priority state.

Stack implications (tasks vs ISRs)

• Each task requires its own stack; full CPU and optionally FPU registers are spilled onto the task stack during switch.
• ISRs often run on the current task’s stack or an interrupt stack depending on architecture; nesting increases stack usage—use separate IRQ stack to limit corruption and bound worst‑case stack depth.
• Ensure stack alignment for ABI and FPU context saves.

Performance costs & latency sources

• Time to push/pop register set and FPU state.
• Kernel overhead: scheduler decision, ready list manipulation, TCB updates.
• Cache/TLB misses when resuming different address space.
• Interrupt disable/enable windows and priority handling add latency.
• Typical cost: tens to hundreds of cycles on simple MCUs; microseconds on faster cores when saving FPU + cache effects.

Two ways to reduce overhead

1. Minimize saved state: use lazy FPU context save (save FPU only on first use) and design convention to limit caller-saved vs callee-saved usage so fewer registers are saved on switch.
2. Reduce frequency of switches: increase task coalescing (longer time slices for non‑real tasks), use cooperative scheduling for low-priority work, or use lockless/event-driven design to avoid many short-lived tasks.

This approach balances predictability and resource constraints typical in embedded RTOS design.

Overview — NVIC preemption model
ARM Cortex‑M assigns each interrupt a priority field split into preempt (group) bits and subpriority (sub) bits. Higher-priority (numerically lower) preempt bits determine whether an active ISR can be interrupted by a new exception; subpriority only orders pending exceptions of the same preempt level (no preemption).

Preempt priority vs subpriority

• Preempt priority: decides actual preemption (can interrupt a lower preempt level). Lower numerical value = higher urgency.
• Subpriority: tie‑breaker for pending interrupts that share the same preempt bits; affects tail‑chaining order and hardware arbitration, not runtime preemption.

PRIGROUP

• PRIGROUP (in AIRCR) configures how many bits are allocated to preempt vs subpriority. Example: on a core with 4 priority bits, PRIGROUP selects N preempt bits and 4−N sub bits.
• Changing PRIGROUP changes interrupt nesting granularity and affects which interrupts can preempt others.

Practical firmware techniques (protect short critical sections)

• Prefer BASEPRI over PRIMASK: set BASEPRI to a threshold value to disable interrupts with priority numerically >= threshold while allowing higher-priority ISRs (e.g., faults or real‑time handlers) to run.
  • Use CMSIS: __set_BASEPRI(value) / __get_BASEPRI().
• For very short sections, use priority inheritance: raise current task’s interrupt priority via BASEPRI, do critical ops, then restore.
• Use atomic instructions (LDREX/STREX) and lockless ring buffers where possible to avoid global masking.
• Reserve at least one high-priority IRQ for time‑critical hooks and never mask it.
• Keep BASEPRI masking minimal and measured (benchmarks, JTAG trace) to avoid latency surprises.

These techniques allow bounded protection without globally disabling all interrupts and preserve real‑time responsiveness.

Opening / framing
I’d start by aligning on the user impact: “You’ve asked for 5 ms end-to-end latency. Let me explain what that means in hardware+firmware terms, what I measured, and the realistic options (and trade‑offs) to get there.”

Key metrics I’d present

• Measured baseline: current E2E = X ms (breakdown: ISR-to-task = A ms, processing = B ms, comms = C ms).
• CPU budget: cycles required per event = ~N cycles → translates to required clock = N / 0.005.
• Memory needs: stack + buffers + DMA descriptors = M KB; current MCU RAM = R KB → headroom?
• IO and bus latencies: SPI/I2C/UART worst-case delays, DMA vs CPU copy.
• Power and BOM delta: estimated cost increase and mA impact for candidate MCUs.

Trade-offs

• Higher-clock MCU: lower latency, but higher BOM cost, power, and sometimes longer qualification.
• More RAM: reduces fragmentation and avoids blocking due to memory pressure.
• Cache and pipeline hazards: can improve throughput but add jitter — affects determinism.
• Offload (DMA/co-processor): keeps MCU cheap but adds hardware complexity and design time.

Graceful degradation & incremental options

• Immediate: profile hot paths, optimize ISR/code (inline, lock-free queues, reduce copies), enable DMA — often 20–50% improvement with no hardware change.
• Mid-term: RTOS tuning (priority inheritance, reduce context switch), static allocation to avoid malloc jitter.
• Hardware-lite: move high-cost processing to a small DSP or dedicated accelerator on existing board.
• Full upgrade: select an MCU with required clock/RAM—present 2–3 SKUs with cost/power/lead-time.
• Tiered product: offer “standard” (current HW, optimized FW) vs “low-latency” (upgraded MCU) SKUs.

Recommendation
I’d propose a two-step plan: (1) immediate profiling + firmware optimizations to see if 5 ms is achievable without new MCU; (2) parallel evaluation of 2 candidate MCUs with prototype to measure real E2E latency and BOM impact. That balances risk, cost, and schedule while giving a clear data-driven decision for the PM.

Step 0 — Safety first (minimally intrusive):

• If hardware is fragile, avoid power-cycling. Connect debugger with reset held (connect under reset) or use a high-value series resistor on SWD/TCK lines to limit currents.
• Prefer non-invasive reads (halt, read registers) before running.

Step 1 — Reproduce & observe

• Boot under the debugger, halt on exception (enable “halt on HardFault” / fault handlers).
• Read CPU registers: PC, LR, MSP/PSP, IPSR, CFSR, HFSR, BFAR, MMFAR to classify fault (bus/mem/usage).

Step 2 — Decode PC/LR with symbols

• Use map file and ELF symbols to translate PC/LR to function/line. If PC in Thumb, subtract 1 before lookup.
• Check instruction at fault address (disassemble) and surrounding code.

Step 3 — Analyze context

• If fault during vector fetch: inspect vector table address (VTOR) and stack pointers.
• If stack overflow suspected: inspect stack canary, compare SP against limits from map file.

Step 4 — Minimal instrumentation

• If single-step risky, use memory readouts: dump .data/.bss, check pointers passed to functions.
• Insert temporary fault-handling prints (ITM/semihosting) or toggle GPIO with current-limiting resistor.

Step 5 — Iterative fixes

• Fix root cause (null deref, bad ISR, wrong VTOR), rebuild with -g and link map, rerun.
• Add unit tests and enable MPU/stack guards.

Why this works: register fault status gives class, symbol/map pinpoints code, non-invasive reads protect fragile hardware while isolating the cause.

Brief comparison

• DVFS (Dynamic Voltage and Frequency Scaling): adjusts core voltage and clock frequency at runtime to trade performance for lower dynamic power (P ∝ V^2·f). Good for fine-grained, active-mode power control.
• Traditional sleep/idle modes: stop clocks, disable peripherals, or power domains; reduce both dynamic and static power. Often called idle, standby, deep-sleep, or power-down with increasing wake latencies.

When each is preferable

• DVFS:
  • CPU-bound tasks with variable load (sensor processing, ML inference with bursty load).
  • When you need responsiveness but can slow down execution to save energy.
  • Constrained wake latency — changes take microseconds–milliseconds.
• Sleep/idle modes:
  • Long idle periods (radio-off between periodic reports, event-driven sensors).
  • When leakage dominates or peripherals can be gated.
  • Deep sleep wakeup can be milliseconds to seconds (depends on oscillator/RTC).

Latency & overhead

• DVFS: low to moderate overhead — changing frequency/voltage requires clock and regulator transitions; latency typically tens of microseconds to a few milliseconds; energy cost for transition small relative to short active periods.
• Sleep modes: entry/exit overhead varies widely; light sleep: microseconds–ms; deep sleep: ms–100s ms; energy saved is large but only worth it if idle duration exceeds break-even time (consider state restore cost).

Combining strategies for IoT

• Tiered policy:
  • Use DVFS during active processing to run slower at lower voltage when deadlines allow.
  • Enter light sleep between short gaps (use fast wake sources).
  • Enter deep sleep for long inactivity; save full context to minimize restore time.
• Practical considerations:
  • Calculate break-even time for each mode (include state save/restore energy).
  • Keep critical peripherals on separate power domains (radio wake retention).
  • Use predictive workload scheduling or token-bucket to batch work and maximize deep-sleep opportunities.

This approach balances responsiveness and energy for constrained embedded IoT devices.

Situation & goal
I’d lead a cross-functional transformation to make reliability the default decision for firmware, HW integration, and QA — measurable, repeatable, and balanced with delivery.

Process changes (what I’d introduce)

• Reliability acceptance criteria (RAC) per feature: functional, safety, performance, and failure-mode tests required before merge.
• Design-for-reliability reviews: checklist-driven reviews early (power, EMC, watchdogs, brownout, bootloader resilience, OTA rollback).
• Gated checklists in CI: hardware-in-the-loop (HIL) smoke, unit, integration, and golden-image flashing before release.
• Failure-mode catalogs and test-matrix mapping (temp, vibration, power cycles, memory leaks).

Tooling & automation

• CI with cross-compiled builds + hardware test benches (Jenkins/GitLab runners + test harnesses).
• Lab automation: ATE/HIL rigs, power-cycle controllers, network impairment tools, telemetry collectors (Influx/Grafana).
• Telemetry+postmortem: structured logs, core dumps, crash-symbolication pipeline, Sentry-like for embedded.

KPIs

• Field MTBF trends, escaped defects/week, mean-time-to-detect (MTTD), mean-time-to-recover (MTTR), regression test pass rate, flakiness rate.

Balancing velocity

• Risk-tier features: high-risk require full RAC; low-risk incremental features use canary/HOT code-paths and monitor.
• Shift-left: invest early (architectural reviews, automated unit tests) to reduce late rework.
• Sprints include reliability spikes and measurable technical debt repayment. Use feature flags and staged rollouts to ship quickly but safely.

Example outcome
I led a team that added watchdog/rollback and HIL gating; escaped-field crashes dropped 60% in 6 months while release cadence stayed steady via staged rollouts and automated pre-flights.

Direct answer

Detecting whether a + b would overflow a 32-bit signed integer, without widening to 64 bits, means reasoning about the operation BEFORE it happens using only the bounds of int32_t itself: check whether b is positive and a is already close enough to the maximum that adding b would exceed it, and symmetrically for a negative b against the minimum.

Structured elaboration

Why you can't just compute a + b and check the result. Computing the sum first and then checking whether it looks wrong is undefined behavior for signed integer overflow in C++, meaning the compiler is permitted to assume overflow never happens and can optimize the check away entirely, silently producing incorrect results specifically in the case you were trying to detect. The check has to be done using only values that are guaranteed to be representable, before the actual addition occurs.

The two symmetric cases. If b is positive, overflow happens when a is already greater than INT32_MAX - b (equivalently, adding b would push past the maximum); this comparison, a > INT32_MAX - b, is always computable without overflow since INT32_MAX - b cannot itself overflow when b is positive. If b is negative, overflow (underflow past the minimum) happens when a is less than INT32_MIN - b; note INT32_MIN - b is safe to compute here specifically because b is negative, making this subtraction move away from, not toward, the boundary.

The zero and boundary cases. b == 0 never overflows regardless of a, and the two comparisons above naturally handle this correctly without a special case, since a > INT32_MAX - 0 is simply a > INT32_MAX, which is never true for a valid int32_t value of a.

Worked example

bool add_will_overflow(int32_t a, int32_t b) {
    if (b > 0 && a > std::numeric_limits<int32_t>::max() - b) return true;
    if (b < 0 && a < std::numeric_limits<int32_t>::min() - b) return true;
    return false;
}

Executed and verified (g++, -Wall -Wextra): add_will_overflow(INT32_MAX, 0) is false (no overflow); add_will_overflow(INT32_MAX, 1) is true (the classic overflow case); add_will_overflow(INT32_MAX - 1, 1) is false (exactly at the boundary, still valid); add_will_overflow(INT32_MIN, -1) is true (the symmetric underflow case); add_will_overflow(INT32_MIN, 0) is false; add_will_overflow(INT32_MIN + 1, -1) is false (exactly at the boundary on the negative side); ordinary values like add_will_overflow(100, 200) and add_will_overflow(-100, -200) are both false; and add_will_overflow(INT32_MAX/2 + 1, INT32_MAX/2 + 1) is true, confirming the check also catches an overflow that occurs from two moderately-large positive values rather than only from a value already at the exact boundary.

Trade-offs and pitfalls

The single most common mistake is writing the intuitive-looking but broken version, int32_t sum = a + b; if (sum < a) return true; (checking whether the result "wrapped around" to something smaller than one of the inputs): this relies on signed overflow actually wrapping, which is undefined behavior in C++ and not guaranteed to behave that way at all, especially under compiler optimizations that are explicitly permitted to assume signed overflow never occurs and can eliminate the check entirely. A second, more subtle mistake is getting the comparison direction backwards for the negative-b case (checking a < INT32_MIN + b instead of a < INT32_MIN - b), which happens to work correctly by luck for some inputs and silently fails for others; testing both boundary directions explicitly, as in the worked example, is what catches this class of subtle sign error.

Clarify goal

Provide fault handlers that capture useful state with minimal footprint, perform safe logging (or mark for post-mortem), and either recover when safe or fail into a known safe state.

Approach (high-level)

• Capture CPU state (stack pointer, LR, PC, xPSR, core registers) immediately in the fault handler.
• Use safe, non-blocking logging: store data to a reserved RAM crash buffer or toggle an LED; avoid heap, printf, or interrupts.
• Minimize code/stack use and make handlers reentrant-safe.
• Provide recovery options: guarded restart, safe shutdown, or halt with watchdog to reset.

Concrete techniques & example

• In assembly or C, read stacked registers saved by hardware on exception entry. Store to a fixed RAM struct (no malloc). Example extracting stacked PC/LR:

// Called from a naked handler that provides stack pointer
void HardFault_Handler_C(uint32_t *stacked_regs) {
    // stacked_regs: r0, r1, r2, r3, r12, lr, pc, xPSR
    crash_buffer.pc = stacked_regs[6];
    crash_buffer.lr = stacked_regs[5];
    crash_buffer.xpsr = stacked_regs[7];
    // capture other registers via manual reads if needed
    safe_mark_crash(); // set flag in RAM / checksum
    system_safe_halt();
}

• Use a small CRC/checksum to validate buffer on next boot and store a timestamp or reset reason.
• For BusFault/MemManage read CFSR, HFSR, BFAR/MMFAR to identify faulting address.

Safe logging & footprint

• Pre-allocate a fixed-size crash buffer in no-init RAM, keep writes atomic (disable interrupts briefly).
• Avoid syscalls, dynamic allocations, or peripheral drivers that may be in bad state.
• Optionally use DMA to persist log to flash or external store during reboot sequence—but use conservative retries.

Recovery & fail-safe

• If fault is transient and stack/registers sane, attempt controlled restart of offending task or peripheral.
• Else: disable outputs, put actuators to safe state, feed watchdog to force a reset or enter infinite loop to allow external monitor to act.
• Ensure bootloader reads crash buffer and reports via serial/telemetry, and include a mechanism to prevent boot loops (failcount threshold).

Trade-offs / best practices

• Maximize post-mortem data while keeping handler tiny.
• Prefer RAM buffer + boot-time reporter over complex in-handler I/O.
• Test handlers by fault injection and validate buffer integrity across resets.

I would raise three issues: alignment, strict aliasing, and endianness. Alignment means some CPUs require a uint32_t * to start on a 4-byte boundary. Strict aliasing means the compiler assumes pointers to unrelated types do not point to the same object, so casting a uint8_t * buffer and dereferencing it can miscompile under optimization. Endianness means byte order differs between CPUs.

A raw byte buffer is not automatically a real uint32_t object, so the safe pattern is to copy, not cast:

#include <stdint.h>
#include <string.h>

uint32_t word;
memcpy(&word, p, sizeof word);

Then convert from the protocol's byte order explicitly if needed. To prove the cast is not safe, I would test on a strict-alignment target, build with sanitizers or warnings like cast alignment, and compare the optimized build against the memcpy version. If behavior changes, the cast was relying on undefined behavior.