Embedded C questions check low-level skills: memory, bit manipulation and code that talks to hardware.
Below are 60 Embedded C questions with the correct answer and a short explanation, grouped from fresher to experienced level. Try each one before you open the answer.
Which C statement sets bit 5 of REG without changing the other bits?
Answer: C. REG |= (1U << 5);
OR with a mask sets the chosen bit and leaves others unchanged. Plain assignment clears all other bits, AND keeps only bit 5, and XOR with 5 toggles bits 0 and 2. To clear bit 5, use REG &= ~(1U << 5).
What does this code print?
uint8_t x = 250;
x += 10;
printf("%u", (unsigned)x);Answer: C. 4
The sum is 260, but storing it back into an 8-bit unsigned variable keeps only the value modulo 256, so x becomes 4. Unsigned wraparound is well defined in C. It does not saturate at 255, which is a common wrong assumption.
On a little-endian MCU, uint32_t v = 0x12345678; is stored at address A. Which byte is at address A?
Answer: B. 0x78
Little-endian stores the least significant byte at the lowest address, so the bytes in memory are 78 56 34 12. Most ARM Cortex-M and RISC-V MCUs run little-endian. Network protocols are often big-endian, so you must convert explicitly.
What does this code print?
#define SQUARE(x) x * x
printf("%d", SQUARE(1 + 2));Answer: D. 5
Macros do plain text substitution, so SQUARE(1 + 2) becomes 1 + 2 * 1 + 2, which is 5. The safe form is #define SQUARE(x) ((x) * (x)), or better a static inline function. MISRA C restricts function-like macros for this reason.
What does the function actually receive when you call send(buf) with uint8_t buf[64]?
void send(uint8_t *data); uint8_t buf[64]; send(buf);
Answer: D. A pointer to buf[0]
In most expressions an array name converts ("decays") to a pointer to its first element. The function gets only that address, not a copy and not the length, so the size must be passed separately.
Which statement toggles bit 5 of PORTB and leaves the other bits unchanged?
Answer: B. PORTB ^= (1u << 5);
XOR with a mask flips the bits where the mask has a 1 and leaves the rest alone. |= sets the bit, &= ~ clears it, and plain assignment overwrites every bit of the port.
What is the value of n?
uint16_t samples[100]; uint16_t *start = &samples[10]; uint16_t *end = &samples[35]; ptrdiff_t n = end - start;
Answer: D. 25
Subtracting pointers into the same array gives the number of elements between them, not bytes. 35 − 10 = 25 elements, even though the byte distance is 50.
A function calculates a CRC over a buffer and must not change it. What is the best parameter type?
Answer: B. const uint8_t *data
const uint8_t *data means the function cannot modify the bytes it points to, which documents the contract and lets callers pass const tables stored in flash. uint8_t *const only stops the pointer itself from changing.
On Cortex-M, the initial stack pointer is usually set to the top of RAM. Which way does the stack grow as functions are called?
Answer: D. Downwards, towards lower addresses
Cortex-M uses a full-descending stack: a push first decrements SP and then stores. That is why the stack starts at the top of RAM and grows down towards the heap and static data.
What does static do when placed in front of a variable at file scope in uart.c?
static uint8_t tx_busy;
Answer: C. Limits its visibility to uart.c
At file scope, static gives internal linkage: the name is visible only inside that translation unit. Other files cannot reach it with extern, which hides driver state and avoids name clashes. The variable is still in RAM.
A global counter is needed in several .c files. What is the usual pattern?
Answer: B. extern declaration in a header, definition in one .c file
extern uint32_t tick_count; in a header declares the name without creating storage. Exactly one .c file defines it, uint32_t tick_count;, so the linker sees one object that every file shares.
A task with a 1 KB stack calls a function that declares uint8_t buf[2048]; as a local. What is likely to happen?
Answer: B. The stack overflows and corrupts nearby memory
Automatic arrays are allocated on the stack when the function is entered. 2 KB cannot fit in a 1 KB stack, so it overflows into whatever lies below. Make large buffers static or global, or give the task a bigger stack.
Why do many embedded coding standards, including MISRA C, discourage recursion?
Answer: A. Stack depth becomes hard to bound and verify
Each recursive call uses more stack, and the depth often depends on runtime data. On a small, fixed stack this makes worst-case usage hard to prove. An iterative loop has a fixed, known stack cost.
The build fails with "undefined reference to `spi_init'". The header spi.h is included in main.c. What is the most likely cause?
Answer: B. spi.c is not compiled or not linked into the build
The header gives the compiler a declaration, so main.c compiles. The linker then needs the actual function, which lives in spi.o. If spi.c is not in the build or the library is not linked, the linker reports an undefined reference.
What effect does the register keyword usually have with modern GCC or Clang at -O2?
register uint32_t i;
Answer: A. Almost none; the compiler allocates registers itself
Modern compilers do register allocation far better than hand hints, so register is mostly ignored for optimisation. Its one remaining effect in C is that you cannot take the address of such a variable.
On a 32-bit ARM target, how many bytes does reordering these members largest-first save in each struct?
struct a { uint8_t x; uint32_t y; uint8_t z; }; /* original */
struct b { uint32_t y; uint8_t x; uint8_t z; }; /* reordered */Answer: D. 4 bytes (12 down to 8)
struct a needs 3 padding bytes after x so y is 4-aligned, and 3 more after z to keep the size a multiple of 4: 12 bytes. struct b packs x and z after y and pads 2 bytes: 8 bytes. In an array of 1,000 records that saves 4 KB of RAM.
What value does x hold?
uint8_t x = -1;
Answer: D. 255
Converting a negative value to an unsigned type is well defined: it wraps modulo 2^8. −1 + 256 = 255, or 0xFF. This is why uint8_t x = -1 is a common way to get "all bits set".
Why might this condition be false?
float v = 0.1f + 0.2f;
if (v == 0.3f) { /* ... */ }Answer: B. 0.1 and 0.2 are not exact in binary floating point
Most decimal fractions cannot be stored exactly in binary floating point, so tiny rounding errors appear. Compare with a tolerance, such as fabsf(v - 0.3f) < 1e-6f, or use integers or fixed-point for exact values.
What is MISRA C?
Answer: B. Coding guidelines for safer, more predictable C
MISRA C is a set of rules that restrict risky C features, such as undefined behaviour, unclear conversions and dynamic memory. It started in automotive and is widely used in safety-related firmware, checked with static analysis tools.
A global "uint32_t error_count;" has no initialiser. What value does it hold when main() starts on a typical bare-metal toolchain?
Answer: B. 0, because startup code clears the .bss section
Uninitialised and zero-initialised globals go into .bss, and the C standard requires them to start at zero. The startup code (or C runtime) writes zeros over the whole .bss range before calling main().
On a typical 32-bit ARM compiler, what is sizeof(struct S)?
struct S {
uint8_t a;
uint32_t b;
uint8_t c;
};Answer: D. 12
b needs 4-byte alignment, so 3 padding bytes follow a. After c, 3 more bytes pad the struct to a multiple of 4: 1 + 3 + 4 + 1 + 3 = 12. Reordering to b, a, c gives 8. Be careful when sending structs over a wire, since padding and endianness vary.
A vendor library has many functions you never call, yet they all end up in flash. Which build settings let the linker remove them?
Answer: B. -ffunction-sections -fdata-sections with the linker flag --gc-sections
By default a whole object file's .text is one section, so the linker must keep all of it. Putting each function and data item in its own section lets --gc-sections discard anything unreferenced. This is a standard size saving in nearly every embedded build.
After switching to a custom startup file, int threshold = 50; reads a random value at the start of main, while zero-initialised globals look fine. What is wrong?
Answer: C. The startup code no longer copies the .data section from flash to RAM
Initial values of .data variables are stored in flash, and the reset handler must copy them to RAM before main runs. Zeroing .bss is a separate loop, which explains why zero globals still work. Check the copy loop and the linker symbols it uses, such as _sidata, _sdata and _edata.
A 32-bit status register has a 3-bit field in bits 6..4. Which expression gives the field value as 0–7?
Answer: D. (reg >> 4) & 0x7u
Shift right by the field's lowest bit position so the field lands in bits 2..0, then mask with three 1-bits (0x7). Masking without shifting, as in the last option, keeps the value in place and gives multiples of 16.
src is "TEMPERATURE" (11 characters). What is wrong with dst afterwards?
char dst[8];
strncpy(dst, src, sizeof dst);
printf("%s", dst);Answer: C. dst has no null terminator, so printf reads past it
strncpy copies at most n bytes and does not add a terminator if the source is that long or longer. dst holds "TEMPERAT" with no '\0', so printf keeps reading memory. Set dst[sizeof dst - 1] = '\0' or use snprintf.
What does offsetof(struct pkt, crc) return?
#include <stddef.h>
struct pkt { uint8_t type; uint8_t len; uint16_t crc; uint8_t data[32]; };Answer: A. Byte offset of crc from the struct start
offsetof gives the distance in bytes from the start of the struct to the member, including any padding. Here it is 2, since crc is naturally aligned after two bytes. It is handy for checking a struct matches a wire format.
What can an optimising compiler do with the if test?
int get_len(struct buf *b) {
int n = b->len;
if (b == NULL) return -1;
return n;
}Answer: B. Remove it, since b was already dereferenced
Dereferencing NULL is undefined, so after b->len the compiler may assume b is not NULL and delete the check. Check pointers before using them; tests placed after the use give no protection.
Vendor headers often define a peripheral like this. What makes it work?
typedef struct {
volatile uint32_t CR;
volatile uint32_t SR;
volatile uint32_t DR;
} UART_TypeDef;
#define UART1 ((UART_TypeDef *)0x40011000u)Answer: A. Members map to consecutive 32-bit register offsets
Each uint32_t member is 4 bytes with no padding between them, so CR, SR and DR sit at offsets 0, 4 and 8 from the base address. UART1->SR then reads 0x40011004. Reserved gaps are filled with padding arrays in the struct.
What does the expression *p++ = 0; do?
Answer: A. Writes 0 where p points, then moves p forward
Postfix ++ binds tighter than unary *, so it is *(p++): the old p is used for the write, and p is advanced. This is the common pattern for filling buffers. (*p)++ would increment the pointed-to value instead.
A bare-metal system places the heap after .bss and the stack at the top of RAM. Random crashes appear after many malloc calls. What is a likely cause?
Answer: C. The heap grew up into the stack area
The heap grows up and the stack grows down into the same free gap. Without a check, they can overlap, so stack frames overwrite heap blocks or the reverse. A heap limit in _sbrk, a fixed heap size in the linker script, or no heap at all prevents this.
An STM32H7 needs a DMA buffer in the D2 SRAM, which the linker script maps to a section called .dma_buf. How is the buffer placed there with GCC?
Answer: A. static uint8_t buf[512] __attribute__((section(".dma_buf")));
The section attribute puts the object in a named output section, and the linker script decides which memory that section maps to. Note that a section other than .bss is not zeroed by default startup code unless you add it.
On reset, what does a Cortex-M core load from the first two 32-bit words of the vector table?
Answer: D. The initial stack pointer, then the reset handler address
Word 0 is loaded into MSP and word 1 into PC, with its Thumb bit set. No code runs before this, which is why C startup code can rely on a valid stack from the very first instruction.
In a typical GCC Cortex-M project, what does Reset_Handler do before calling main?
Answer: C. Copy .data from flash, zero .bss, then call SystemInit and libc init
The reset handler prepares the C environment: copy initial values for .data, clear .bss, set up clocks (often SystemInit) and run __libc_init_array for constructors. Only then is main called. Skipping any of these breaks C's guarantees about globals.
Is it safe to return this pointer and use it later?
const char *err_name(int e) {
if (e == 1) return "TIMEOUT";
return "UNKNOWN";
}Answer: D. Yes; string literals have static storage duration
String literals are arrays with static storage duration, typically in .rodata in flash, so the pointer stays valid for the whole program. This is different from a local char array, which lives on the stack.
Why is this risky in firmware?
void log_frame(size_t len) {
uint8_t tmp[len];
/* ... */
}Answer: B. Stack use depends on len, with no failure check
A VLA takes len bytes of stack at runtime. A large or corrupt len silently overflows the stack, and C gives no way to detect failure. Fixed-size buffers with a length check are safer, and MISRA C forbids VLAs.
An ISR does struct frame f = latest_frame; where struct frame is 512 bytes. What two costs does this add?
Answer: A. 512 bytes of stack and a slow copy in the ISR
The local copy needs 512 bytes on the interrupt stack (MSP on Cortex-M), and the copy itself takes many cycles, raising interrupt latency. Use a pointer to the data, or swap buffer pointers, instead of copying.
This code works in a PC unit test but the error branch never runs on an ARM Cortex-M build with GCC. Why?
char c = uart_getc(); /* returns 0xFF on error */ if (c == -1) handle_error();
Answer: D. Plain char is unsigned on ARM, so c is 255, not -1
Whether plain char is signed is implementation-defined: it is signed on x86 and unsigned by default on ARM. On ARM c holds 255, which never equals −1. Use int for values that can be −1, or uint8_t or int8_t explicitly.
A 32-bit millisecond tick wraps after about 49.7 days. Which timeout check keeps working across the wrap?
Answer: B. if ((uint32_t)(now - start) >= timeout)
Unsigned subtraction wraps modulo 2^32, so now − start gives the true elapsed time even if now has wrapped past zero. start + timeout can wrap to a small number, making now >= start + timeout true too early.
What does the C standard say about this line?
idx = idx++ + 1;
Answer: C. Undefined: idx is modified twice unsequenced
idx is written by ++ and by = with no sequence point between them, which is undefined behaviour. Different compilers or optimisation levels can give different results. Write idx += 2; or split it into separate statements.
A struct must exactly match a 16-byte flash record. How can the build fail if someone adds a field?
Answer: A. _Static_assert(sizeof(struct rec) == 16, "rec size");
_Static_assert (static_assert from <assert.h>) is checked by the compiler, so a wrong size stops the build. assert runs only at runtime, and the preprocessor cannot evaluate sizeof, so the #if version does not work.
Variables in one FreeRTOS task occasionally get corrupted after adding a feature that uses a large local array. What is the most likely cause?
Answer: A. The task's stack overflows into neighbouring memory; increase its stack, move the array to static storage, and enable stack overflow checking
Each task has a fixed-size stack. A large local array can exceed it and silently overwrite other data. FreeRTOS configCHECK_FOR_STACK_OVERFLOW, uxTaskGetStackHighWaterMark and the MPU help detect it.
On a Cortex-M7 with data cache enabled, the CPU reads old values from a buffer that DMA just filled from the ADC. What is the fix?
Answer: D. Invalidate the cache for that buffer before reading (cache-line aligned), or place DMA buffers in a non-cacheable region via the MPU
DMA writes directly to RAM, but the CPU may read stale data from its cache. Cache maintenance (SCB_InvalidateDCache_by_Addr after DMA receive, clean before DMA transmit) or non-cacheable memory keeps both views consistent. Buffers should be aligned to the 32-byte cache line.
What does restrict tell the compiler, and what happens if the caller breaks the promise?
void mix(int16_t *restrict out, const int16_t *restrict a,
const int16_t *restrict b, size_t n);Answer: A. The buffers do not overlap; if they do, behaviour is undefined
restrict promises that, during the call, each object is accessed only through that pointer. The compiler can then keep values in registers and vectorise without reloading after each store. Passing overlapping buffers breaks the promise and is undefined, with no runtime check.
What does this definition contain, and is it valid C?
char id[5] = "HELLO";
Answer: C. Valid; five chars and no null terminator
C allows a char array initialised from a literal of exactly its size, and the terminator is simply dropped (C++ rejects this). id is not a string, so strlen or printf("%s") will read past it. Use char id[] = "HELLO"; to get six bytes.
A list stores pointers to struct node embedded inside struct timer. Given struct node *n, how does container_of get the timer?
struct node { struct node *next; };
struct timer { uint32_t period; struct node link; };
#define container_of(p, T, m) ((T *)((char *)(p) - offsetof(T, m)))
struct timer *t = container_of(n, struct timer, link);Answer: A. It subtracts link's offset from n's address
link sits at a fixed offset inside struct timer. Subtracting that offset from the node's address gives the start of the timer. The cast to char * makes the subtraction work in bytes. This intrusive pattern avoids separate allocations for list nodes.
A calibration table is declared static const and placed in flash. Code casts away const and writes to it. What happens?
static const uint16_t cal[4] = { 100, 200, 300, 400 };
((uint16_t *)cal)[1] = 250;Answer: D. Undefined; the write may fault or be ignored
Modifying an object defined as const is undefined behaviour even if you cast the qualifier away. The table sits in flash, so a plain store usually raises a bus fault or does nothing, and the compiler may already have folded the old value into code.
A DMA engine on a Cortex-M7 needs buffers aligned to the 32-byte cache line. Which declaration gives that in standard C11?
Answer: C. alignas(32) static uint8_t buf[256];
alignas (from <stdalign.h>, or _Alignas) sets the minimum alignment. Matching the cache line and rounding the size to whole lines lets you clean and invalidate the cache for the buffer without touching neighbouring data. packed lowers alignment, which is the opposite.
Is this macro safe, given that it appears to dereference a null pointer?
#define MEMBER_SIZE(T, m) sizeof(((T *)0)->m) uint8_t n = MEMBER_SIZE(struct pkt, data);
Answer: D. Yes; sizeof does not evaluate its operand
Except for variable-length arrays, sizeof only looks at the type of its operand and never evaluates it, so no memory access happens. The result is a compile-time constant. This is a common way to get a member size without an object.
arm-none-eabi-size prints this for the firmware. How much flash and how much static RAM does it use?
text data bss dec hex filename 48200 600 9400 58200 e358 app.elf
Answer: D. Flash 48,800 bytes; RAM 10,000 bytes
Flash holds code and constants (text) plus the initial values of .data, so 48,200 + 600 = 48,800. RAM holds .data and .bss: 600 + 9,400 = 10,000. Stack and heap are on top of that unless they are reserved as .bss-like sections.
A developer adds uint16_t lut[1024] = { /* values */ }; and both flash and RAM use rise by 2 KB. What change saves the RAM, if the table never changes?
Answer: B. Declare it const so it stays in .rodata in flash
An initialised writable array lives in .data: its values are stored in flash and copied to RAM at boot, so it costs both. A const table goes to .rodata and is read directly from flash on Cortex-M, using no RAM.
A team wants an immediate fault the moment a task stack overflows, rather than silent corruption. What Cortex-M feature is commonly used?
Answer: C. An MPU no-access region just below each stack
A small MPU region with no access placed at the stack limit turns any write past the end into a MemManage fault at the bad instruction. ARMv8-M also offers stack limit registers (PSPLIM, MSPLIM). Canary checks only notice the damage later.
This table of menu strings uses RAM for the pointer array. Which declaration puts both the strings and the pointer array in flash?
const char *menu[] = { "Start", "Stop", "Setup" };Answer: C. const char *const menu[] = { ... };
In const char *menu[], the strings are const but the pointers are writable, so the array goes in .data. Adding const after the * makes the pointers themselves const, letting the whole table live in .rodata. static alone only changes visibility.
The map file shows uart_isr at 0x08000420, but printing (uint32_t)&uart_isr gives 0x08000421. Why?
Answer: D. Bit 0 marks Thumb state for Cortex-M branches
Cortex-M runs only Thumb code, and interworking branches use bit 0 of the target address to select Thumb state. Function pointers and vector table entries therefore have bit 0 set. Branching to an even address raises a UsageFault (INVSTATE).
A mask helper is called with n = 32. What happens on a 32-bit target?
uint32_t mask_n(unsigned n) { return (1u << n) - 1u; }Answer: A. Undefined; on ARM it may return 0xFFFFFFFF, on x86 0
Shifting by a count greater than or equal to the type width is undefined. Hardware differs: x86 masks the count to 5 bits (1u << 32 acts as 1u << 0), while ARM register shifts yield 0, giving different results. Handle n == 32 separately.
On an AVR (16-bit int), why does this not give 1,000,000?
uint32_t us = 1000 * 1000;
Answer: A. It is a 16-bit int multiply; write 1000UL * 1000
Both literals are int, so the product is computed as a 16-bit int before being stored. 1,000,000 does not fit, so it overflows (undefined; compilers warn). Making one operand long, as 1000UL, makes the whole multiply 32-bit.
On a Cortex-M4, a timer ISR clears the peripheral flag as its very last instruction. The ISR sometimes runs a second time for one event. Why?
Answer: B. The flag write is still in flight on the bus when the ISR exits
Peripheral writes go through buffers and slower buses, so the interrupt request can still be active when the exception returns, and the NVIC takes it again. Clear the flag early in the ISR, or read the register back or use __DSB() after clearing so the write completes first.
Bit 8 of STATUS is set, yet ready is 0. Why, and what fixes it?
uint8_t ready = STATUS & (1u << 8);
Answer: A. 0x100 is cut to 8 bits, giving 0; use != 0 to get 1
STATUS & 0x100 gives 0x100 when the bit is set. Storing that in a uint8_t keeps only the low 8 bits, which are 0. Writing (STATUS & (1u << 8)) != 0, or using bool, turns any nonzero result into 1.
A PWM duty is computed as a float that can reach 300.0, then stored with (uint8_t)duty. What does C say?
Answer: C. Undefined: the value does not fit, so clamp first
Converting a floating value to an integer type whose range cannot hold the truncated value is undefined, unlike integer to unsigned conversion, which wraps. Different FPUs and compilers give different results. Clamp to 0–255 before converting.
On a Cortex-M3, x / 0 with unsigned ints returns 0 instead of crashing. What is happening, and how can it be caught?
Answer: C. UDIV returns 0 by default; set DIV_0_TRP to trap it
Division by zero is undefined in C. On ARMv7-M, the hardware divide instructions return 0 unless the DIV_0_TRP bit in SCB->CCR is set, which makes them raise a UsageFault. Enabling the trap during development exposes these bugs.
A project moved to C++. A global object's constructor sets up a driver, but the driver is never initialised and members read zero. The custom startup file was written for C. What is missing?
Answer: A. A call to __libc_init_array before main()
Constructors of global C++ objects are listed in .init_array, and the C runtime runs them via __libc_init_array (or equivalent) before main(). A minimal C startup that only copies .data and zeroes .bss skips this, so objects keep their zeroed memory. Also avoid depending on the order of global constructors across files.
Take a 15-question Embedded C MCQ test with a score at the end, or practise the full Embedded C question bank and earn points on the leaderboard.