Firmware requirements, peripheral integration, task coordination, fault diagnosis and verification for microcontroller products. Start from the actual hardware and acceptance conditions before choosing an implementation.
A hierarchical state machine is correct only when its actions match the transition boundary. Moving between sibling states should not tear down their shared parent’s resource; leaving that parent should. In Zephyr SMF, verify the action sequence directly rather than checking only the final state pointer. A machine can arrive at the right state after…
Choose a zbus observer by what must survive between publication and consumption. A listener executes during dispatch. A subscriber receives a channel reference and later reads that channel’s current value. A message subscriber retains published message data for later consumption. These are different delivery contracts; increasing a subscriber’s notification queue does not turn channel references…
A FreeRTOS trace hook runs at its kernel call site, not in a separate logging task. It can execute while kernel data is mid-update, inside a critical section or during a context switch. Capture a small bounded record there and defer formatting and transport. Before interpreting the record, document precisely which transition has already occurred…
An atomic expression can compile into a library call. Before using GCC atomic builtins in an interrupt handler, verify the exact operation, object width, alignment and target options in the production build. Then inspect the emitted code and any helper it invokes. “Atomic” describes a concurrency guarantee; it does not by itself establish interrupt suitability…
FreeRTOS heap_5.c can allocate from several noncontiguous memory regions, but it cannot determine whether those addresses belong to the heap. Define valid, nonoverlapping regions in increasing address order, terminate the list correctly and initialize them before any dynamic kernel allocation. A successful allocator initialization is not proof that the linker, startup code and peripheral memory…
A worker’s final “done” semaphore is not proof that Zephyr has finished terminating the worker. The worker can signal, be preempted, and still have instructions or kernel exit processing ahead of it. Use a successful k_thread_join() as the kernel termination boundary before reusing its thread control storage or making completion-dependent reclamation decisions. Treat every nonzero…
Zephyr timer status is a consumable expiration count. Reading it clears it. If a worker, diagnostic command and expiry callback all read the same timer’s status, they divide or erase each other’s evidence. Assign one status consumer, then decide how that consumer converts a count into application work. A value greater than one is useful…
k_msgq_purge() is more than a queue-length operation. In upstream Zephyr 3.7.0 it discards buffered messages and releases blocked senders with -ENOMSG. Those send attempts have failed; they are not automatically reinserted into the newly empty queue. A producer that ignores the return value can report delivery of a message that was never accepted. This guide…
With Zephyr’s ordinary k_fifo_put(), the queued object carries the queue’s link inside its own first machine word. That storage is not application payload while the object is queued. The same object must not be active in two FIFO queues, or added again before removal. Debug this class of failure as a layout and membership problem…
A ring-buffer claim reserves a contiguous span; it does not promise the requested size and does not publish completed data. In Zephyr 3.7.0 byte mode, the finish call commits a valid prefix of all outstanding claims on that side. Carry the returned lengths through the producer and consumer paths. Passing the original request size to…