Amrita 23ECE313: Embedded Systems Exam Master Portal

Direct Reference: 1 23ECE313_ES_Ch4 Text 1.pdf (Slide 16)

• 1. Low Power Consumption & High Energy Efficiency: Dedicated sleep modes (Sleep, Deep Sleep, Sleep-on-Exit) and the autonomous Wake-up Interrupt Controller (WIC), making it ideal for battery-operated IoT and wearable devices.
• 2. High Performance & Code Density (Thumb-2 Technology): Blends 16-bit and 32-bit instructions to achieve high performance (1.25 DMIPS/MHz) without state-switching penalties or memory bloat.
• 3. Deterministic, Low-Latency Interrupt Handling (Integrated NVIC): Hardware vector fetches, automatic context stacking/unstacking, tail-chaining, and late-arriving preemption achieve a deterministic 12-cycle interrupt latency.
• 4. Comprehensive OS Support: Features dual banked stack pointers (MSP and PSP), two operation modes (Thread and Handler), two privilege levels (Privileged and Unprivileged), SysTick timer, and dedicated OS software exceptions (SVC and PendSV).
• 5. Advanced Debug & Trace Capabilities (CoreSight Architecture): Integrates standard Serial Wire Debug (SWD - 2 pins) and JTAG, hardware breakpoints (FPB), data watchpoints (DWT), and non-intrusive real-time software tracing (ITM/ETM).

LDR R0, =0x40000000
LDR SP, =0x800000F0
LDR R1, =0x12349876
LDR R2, =0xABCDEF12
MOVS R3, 0x00
IT EQ
STMDB SP!, {R0-R2}
STOP B STOP

Step-by-Step Instruction Execution Trace:

1. LDR R0, =0x40000000 -> R0 = 0x40000000.
2. LDR SP, =0x800000F0 -> SP = 0x800000F0.
3. LDR R1, =0x12349876 -> R1 = 0x12349876.
4. LDR R2, =0xABCDEF12 -> R2 = 0xABCDEF12.
5. MOVS R3, 0x00 -> Moves 0 into R3. Because the instruction has the 'S' suffix, it updates the condition flags in APSR. Since result is 0, the Z (Zero) flag is set to 1.
6. IT EQ -> If-Then block with condition EQ (Equal / Z == 1). Since Z == 1, the condition evaluates to TRUE. The following instruction executes!
7. STMDB SP!, {R0-R2} -> Store Multiple Decrement Before with write-back (!).
   • Registers pushed in order: Lowest register number at lowest memory address (Full Descending Stack).
   • Total registers = 3 (12 bytes = 0x0C).
   • Final SP = 0x800000F0 - 0x0C = 0x800000E4.

(a) Contents of Registers R0-R2 and Stack Pointer [2 Marks]:

(b) Contents of Memory Locations from 0x800000E0 to 0x800000F0 [2 Marks]:

(c) How ICI (Interruptible-Continuable Instruction) is Used [1 Mark]:

(Directly from Slide Deck 1: Ch4 Text 1, Slide 42)
STMDB is a multi-cycle store instruction. If an interrupt occurs halfway through executing STMDB (e.g. after pushing R2 and R1, but before R0), the processor saves the transfer progress into the ICI bits inside the Execution Program Status Register (EPSR). Upon return from the interrupt via EXC_RETURN, the processor inspects the saved ICI bits and resumes execution directly from the remaining transfer (storing R0) instead of restarting the entire instruction from the beginning. This reduces interrupt latency and prevents duplicate bus transactions.

Diagram: Connection from Debug Host (PC) to Cortex-M3 Core

Cited from: 5 23ECE313_ES_Ch15_Txt 1a.pdf (Slide 5)

Key Points to Write in Exam:

• 1. Physical Pins:
  • JTAG (IEEE 1149.1): Uses 4-5 pins (TCK, TMS, TDI, TDO, optional nTRST) to interface with the on-chip Test Access Port (TAP) controller.
  • SWD (Serial Wire Debug): ARM alternative requiring only 2 pins: SWCLK (clock) and SWDIO (bidirectional data), with an optional SWO (Serial Wire Output) pin for trace data.
• 2. SWJ-DP: On-chip Serial Wire/JTAG Debug Port that detects and switches between JTAG and SWD protocols upon reset.
• 3. DAP (Debug Access Port) Bus: Internal debug bus that translates JTAG/SWD packet commands into internal bus transactions.
• 4. AHB-AP (AHB Access Port): Bridges the DAP directly to the internal AHB System Bus Interconnect.
• 5. Non-Intrusive Live Memory Access: Because AHB-AP is an independent master on the AHB bus matrix, the host debugger can read and write memory, Flash, and peripheral registers on the fly even while the Cortex-M3 core is running at full speed!

Diagram: A Simple Scenario Using SysTick to Switch between Two Tasks

Cited from: 3 23ECE313_ES_Ch12_Txt1.pdf (Slide 36)

Step-by-Step Context Switching Operation:

• 1. Initial State: Task A is running in Thread mode using the Process Stack Pointer (PSP).
• 2. Timer Expiry: The 24-bit SysTick down-counter reaches 0, sets COUNTFLAG, and asserts Exception 15 (SysTick).
• 3. Automatic Context Save: Hardware automatically pushes caller-saved registers (R0-R3, R12, LR, PC, xPSR) onto Task A's stack (PSP). The processor switches to Handler mode using the Main Stack Pointer (MSP).
• 4. Software Context Save: The SysTick ISR pushes the remaining callee-saved registers (R4-R11) onto Task A's stack and saves Task A's updated SP in its Task Control Block (TCB).
• 5. Scheduler Execution: The OS scheduler selects Task B as the next task to run and retrieves Task B's SP from its TCB.
• 6. Context Restore: Software pops R4-R11 from Task B's stack.
• 7. Exception Exit: Executing BX LR with EXC_RETURN = 0xFFFFFFFD triggers hardware unstacking of R0-R3, R12, LR, PC, xPSR from Task B's stack. The CPU resumes execution of Task B in Thread mode.

Diagram: Interrupt Pending and Activation Timing Behavior

Cited from: 2 23ECE313_ES_Ch_Txt1.pdf (Slide 44)

Key Points to Write in Exam:

• 1. Inactive State: The interrupt request signal is de-asserted; interrupt status in NVIC is inactive and not pending.
• 2. Pending State: When a peripheral pulses an interrupt request line, the NVIC latches this into the Interrupt Set-Pending Register (NVIC_ISPR). The interrupt is now Pending.
• 3. Arbitration & Acceptance: The processor accepts the pending interrupt if:
  • The interrupt is enabled in NVIC_ISER.
  • Its priority is higher than the currently executing context and the BASEPRI / PRIMASK registers.
• 4. Active State: When the core enters the exception entrance sequence (stacking), hardware automatically transitions the interrupt from Pending to Active. The pending flag is cleared unless a new pulse has arrived.
• 5. Multiple Pulses Latching: If multiple request pulses occur while the interrupt is already pending or active, the NVIC latches the pending state only once, ensuring exactly one subsequent ISR execution.

Diagram: Context Switch Problem inside SysTick Blocking Peripheral IRQ

Cited from: 3 23ECE313_ES_Ch12_Txt1.pdf (Slide 40)

Detailed Operational Explanation:

• Scenario: Task A is executing normally in Thread mode. A periodic SysTick timer interrupt triggers to initiate a task switch.
• The Conflict: While the SysTick handler is executing the context switch sequence, an urgent external peripheral interrupt (e.g., UART communication or Motor Control IRQ) arrives.
• The Failure: Because the processor is already executing inside an ISR (SysTick handler), and both have equal or configurable priorities, the external IRQ is blocked and delayed until the lengthy context switch operation completes.
• Consequence: Crucial real-time peripheral deadlines are missed, creating unacceptable interrupt latency.
• The Solution (PendSV): To resolve this, the OS delegates context switching to the Pendable Service Call (PendSV), which is programmed to the lowest possible interrupt priority. SysTick simply sets the PENDSVSET bit and exits immediately, allowing the external IRQ to run with zero delay. PendSV executes only after all pending IRQs complete!

Diagram: Wake-up Interrupt Controller (WIC) in Deep Sleep Mode

Cited from: 4 23ECE313_ES_Ch14_Txt 1a.pdf (Slide 11)

Sequence of Events:

1. Entering Deep Sleep: Software sets SLEEPDEEP in SCR and executes WFI.
2. Clock Gating: The Power Management Unit (PMU) shuts down high-speed system oscillators, gating clocks to the core and NVIC (NVIC is completely powered down).
3. WIC Monitoring: The Wake-Up Interrupt Controller (WIC) remains active in an ultra-low-power, always-on voltage domain, mirroring the enabled interrupt lines.
4. External Event Detection: An external interrupt signal arrives at a pin. The WIC detects the signal edge/level.
5. Waking PMU: The WIC asserts a wake-up signal to the Power Management Unit (PMU).
6. Restoring Clocks: The PMU restarts oscillators and restores power to the core and NVIC.
7. NVIC Vectoring: The NVIC resumes normal operation, detects the pending interrupt, and vectors the core to execute the ISR.

Circuit Interfacing Diagram:

Complete Embedded C Program:

#include "stm32f4xx.h"

int main(void) {
    // 1. Enable AHB1 clock for GPIOA and APB1 clock for TIM2
    RCC->AHB1ENR |= RCC_AHB1ENR_GPIOAEN;
    RCC->APB1ENR |= RCC_APB1ENR_TIM2EN;

    // 2. Configure PA5 as Alternate Function Mode ('10')
    GPIOA->MODER &= ~(3U << (5 * 2));
    GPIOA->MODER |=  (2U << (5 * 2));

    // 3. Connect PA5 to AF1 (TIM2_CH1) via AFR[0] (Bits [23:20] = 0001)
    GPIOA->AFR[0] &= ~(0xFU << (5 * 4));
    GPIOA->AFR[0] |=  (1U << (5 * 4)); // 0x1 selects AF1

    // 4. Set Timebase: 1 kHz PWM frequency at 16 MHz clock
    TIM2->PSC = 0;     // Clock = 16 MHz
    TIM2->ARR = 15999; // Period = 16 MHz / 16000 = 1 ms (1 kHz)

    // 5. Set 60% Duty Cycle for 3V average output from 5V supply: CCR1 = 9600
    TIM2->CCR1 = 9600;

    // 6. Configure Channel 1 for PWM Mode 1 (OC1M = 110) with Preload Enable
    TIM2->CCMR1 |= (6U << 4) | TIM_CCMR1_OC1PE;

    // 7. Enable Output on Channel 1
    TIM2->CCER |= TIM_CCER_CC1E;

    // 8. Enable Auto-Reload Preload and start counter
    TIM2->CR1 |= TIM_CR1_ARPE | TIM_CR1_CEN;

    while (1) {
        // Continuous 60% PWM waveform generated autonomously by hardware
    }
}

Circuit Interfacing Diagram:

Complete Embedded C Program:

#include "stm32f4xx.h"
#include 

void USART2_Init(void);
void USART2_SendChar(char c);
void USART2_SendString(char *str);
void ADC1_PA0_Init(void);
uint32_t ADC1_Read(void);

void delay_ms(uint32_t ms) {
    uint32_t count = (SystemCoreClock / 10000) * ms;
    for (volatile uint32_t i = 0; i < count; i++) { __NOP(); }
}

int main(void) {
    char buffer[80];
    uint32_t adc_val = 0;
    float voltage = 0.0f;

    // 1. Initialize Peripherals
    USART2_Init();
    ADC1_PA0_Init();

    // 2. Configure PA5 as General Output for Relay Control
    RCC->AHB1ENR |= RCC_AHB1ENR_GPIOAEN;
    GPIOA->MODER &= ~(3U << (5 * 2));
    GPIOA->MODER |=  (1U << (5 * 2)); // Output mode '01'

    USART2_SendString("--- Sensor & Relay Monitoring System Online ---
");

    while (1) {
        // Read 12-bit ADC value
        adc_val = ADC1_Read();

        // Convert code to voltage: V = (ADC / 4095) * 3.3
        voltage = ((float)adc_val / 4095.0f) * 3.3f;

        // Relay Control Logic: Threshold 2.2V corresponds to code 2730
        if (adc_val >= 2730) {
            GPIOA->ODR |= (1U << 5); // Relay ON (Fan runs)
        } else {
            GPIOA->ODR &= ~(1U << 5); // Relay OFF (Fan stopped)
        }

        // Transmit readings over UART to PuTTY Serial Monitor
        snprintf(buffer, sizeof(buffer), "ADC: %lu | Volt: %.2f V | Fan: %s
",
                 adc_val, voltage, (adc_val >= 2730) ? "ON" : "OFF");
        USART2_SendString(buffer);

        delay_ms(500); // 500 ms sampling period
    }
}

// USART2 Configuration: PA2 as TX (AF7), 9600 Baud at 16 MHz
void USART2_Init(void) {
    RCC->AHB1ENR |= RCC_AHB1ENR_GPIOAEN;
    RCC->APB1ENR |= RCC_APB1ENR_USART2EN;

    GPIOA->MODER &= ~(3U << (2 * 2));
    GPIOA->MODER |=  (2U << (2 * 2)); // Alternate Function '10'

    GPIOA->AFR[0] &= ~(0xFU << (2 * 4));
    GPIOA->AFR[0] |=  (7U << (2 * 4)); // AF7 for USART2

    USART2->BRR = 0x0683; // 9600 Baud at 16 MHz
    USART2->CR1 = USART_CR1_TE | USART_CR1_UE; // Transmitter Enable & Module Enable
}

void USART2_SendChar(char c) {
    while (!(USART2->SR & USART_SR_TXE)); // Wait for TX data register empty
    USART2->DR = c;
}

void USART2_SendString(char *str) {
    while (*str) { USART2_SendChar(*str++); }
}

// ADC1 Configuration on PA0 (Channel 0)
void ADC1_PA0_Init(void) {
    RCC->AHB1ENR |= RCC_AHB1ENR_GPIOAEN;
    RCC->APB2ENR |= RCC_APB2ENR_ADC1EN;

    GPIOA->MODER |= (3U << (0 * 2)); // PA0 Analog Mode '11'

    ADC1->SQR1 = 0; // 1 conversion
    ADC1->SQR3 = 0; // Channel 0 first

    // Sample time: 84 cycles for Channel 0 (SMPR2 bits [2:0] = 100)
    ADC1->SMPR2 |= (4U << 0);

    ADC1->CR2 |= ADC_CR2_ADON; // Power ON ADC
}

uint32_t ADC1_Read(void) {
    ADC1->CR2 |= ADC_CR2_SWSTART;     // Trigger conversion
    while (!(ADC1->SR & ADC_SR_EOC)); // Wait for End Of Conversion
    return ADC1->DR;                  // Read 12-bit value (clears EOC)
}

Direct Reference: 2 23ECE313_ES_Ch_Txt1.pdf (Slide 11)

• 1. Bufferable: Write transfers to memory can be handled by an internal write buffer while the processor continues executing subsequent instructions without stalling. (Nuance: Write buffers can cause Imprecise Bus Faults if the bus later returns an error!)
• 2. Cacheable: Data or instruction reads from memory can be copied into high-speed local cache memories to accelerate subsequent accesses.
• 3. Executable (XN - Execute Never): Defines whether instructions can be fetched and executed from the region. Attempting to fetch code from an XN region (like Peripherals or System Space) triggers an immediate MemManage Fault.
• 4. Shareable: Indicates that memory is accessible by multiple bus masters (e.g. DMA and CPU core). The memory system enforces hardware coherency protocols across shared masters.

LDR R0, =0x20000000
LDR SP, =0x20000200
LDR R1, =0x11223344
LDR R2, =0x55667788
SUBS R3, R1, R2
IT MI
STMDB SP!, {R0, R2}
STOP B STOP

Step-by-Step Execution Analysis:

1. LDR R0, =0x20000000 -> R0 = 0x20000000.
2. LDR SP, =0x20000200 -> SP = 0x20000200.
3. LDR R1, =0x11223344 -> R1 = 0x11223344.
4. LDR R2, =0x55667788 -> R2 = 0x55667788.
5. SUBS R3, R1, R2 -> Subtracts R2 from R1. Since R1 < R2, the result is negative. The N (Negative) flag in APSR is set to 1.
6. IT MI -> If-Then block with condition MI (Minus / Negative: N == 1). Since N = 1, condition evaluates to TRUE.
7. STMDB SP!, {R0, R2} -> Pushes 2 registers (8 bytes = 0x08).
   • Final SP = 0x20000200 - 0x08 = 0x200001F8.
   • R2 is placed at 0x200001FC, R0 is placed at 0x200001F8.

Final State:

Diagram: Cortex-M3 Debug & Trace Architecture

Cited from: 5 23ECE313_ES_Ch15_Txt 1a.pdf (Slide 10)

Functions of Key CoreSight Units:

• DWT (Data Watchpoint and Trace): Monitors data address accesses, provides cycle counting, and event profiling.
• FPB (Flash Patch and Breakpoint): Hardware breakpoint comparator (6 instruction breakpoints, 2 literal slots).
• ITM (Instrumentation Trace Macrocell): Software printf debugging via Serial Wire Output (SWO) pin.
• ETM (Embedded Trace Macrocell): Instruction tracing streamed out via TPIU.

Comparison of Debug Modes:

Diagram: Reset Sequence Vector Fetch Flow

Cited from: 1 23ECE313_ES_Ch4 Text 1.pdf (Slide 76)

Step-by-Step Reset Sequence:

1. Step 1: System reset signal is de-asserted; clock stabilizes.
2. Step 2 (Fetch Vector 0): Hardware fetches the 32-bit word from memory address 0x00000000 and loads it directly into the Main Stack Pointer (MSP). This ensures a valid stack exists before executing any code!
3. Step 3 (Fetch Vector 1): Hardware fetches the 32-bit word from memory address 0x00000004 and loads it directly into the Program Counter (PC). This word contains the address of the Reset_Handler function. Bit 0 of this address must be 1 to specify Thumb state.
4. Step 4: Processor begins instruction execution at Reset_Handler in Privileged Thread Mode.

Diagram: AIRCR PRIGROUP Preempt vs Sub-Priority Splitting

Cited from: 2 23ECE313_ES_Ch_Txt1.pdf (Slide 32)

Priority Rules:

• Each interrupt priority level register holds an 8-bit priority value (microcontrollers implement top 3 to 8 bits). Smaller numerical values indicate higher logical priority (0 is highest).
• The PRIGROUP field in the Application Interrupt and Reset Control Register (AIRCR) splits the priority bits into two fields:
  • Preemption Priority: Determines whether an arriving interrupt can interrupt (nest inside) an currently executing ISR.
  • Sub-Priority: When two pending interrupts have the identical preemption priority, the one with the smaller sub-priority value executes first. Sub-priority does NOT cause preemption!

Diagram: ARMv7-M Fault Exceptions Summary Table

Cited from: 3 23ECE313_ES_Ch12_Txt1.pdf (Slide 5)

Fault Descriptions:

• MemManage (Exc #4): MPU permission violation, unprivileged task accessing privileged memory, or executing from Execute-Never (XN) regions.
• Bus Fault (Exc #5): Bus error response during read/write. Precise (immediate) vs Imprecise (buffered write).
• Usage Fault (Exc #6): Undefined instruction, division by zero, unaligned memory access, or clearing Thumb bit (T=0).
• HardFault (Exc #3): Fixed priority -1. Caused by:
  • Fault Escalation: When a configurable fault occurs while its handler is disabled in SHCSR.
  • A fault occurring inside an active fault handler with equal or higher priority.
  • Bus error during vector table fetch.

Diagram: Sleep-on-Exit Operation

Cited from: 4 23ECE313_ES_Ch14_Txt 1a.pdf (Slide 7)

Sleep-on-Exit Working:

Configured by setting SLEEPONEXIT in System Control Register (SCR). After ISR completes, the processor skips Thread Mode and returns directly to sleep, eliminating stack restore overhead in interrupt-only systems.

Diagram: Multiprocessor Task Synchronization Using Event Signals

Cited from: 4 23ECE313_ES_Ch14_Txt 1a.pdf (Slide 16)

Multiprocessor Signals:

SEV instruction pulses TXEV pin to wake other cores. WFE (Wait For Event) sleeps until RXEV is asserted.

Circuit Interfacing Diagram:

Complete Embedded C Code:

#include "stm32f4xx.h"

void delay_seconds(uint32_t seconds) {
    RCC->APB1ENR |= RCC_APB1ENR_TIM5EN; // Enable TIM5 clock
    TIM5->PSC = 15999;                  // 1 ms tick (16 MHz / 16000)
    TIM5->ARR = (seconds * 1000) - 1;   // Reload value
    TIM5->CNT = 0;                      // Reset count
    TIM5->CR1 |= TIM_CR1_CEN;           // Start timer
    while (!(TIM5->SR & TIM_SR_UIF));   // Wait for overflow UIF flag
    TIM5->SR  &= ~TIM_SR_UIF;           // Clear flag
    TIM5->CR1 &= ~TIM_CR1_CEN;          // Stop timer
}

int main(void) {
    RCC->AHB1ENR |= RCC_AHB1ENR_GPIOAEN;
    GPIOA->MODER &= ~(3U << (5 * 2));
    GPIOA->MODER |=  (1U << (5 * 2)); // Output mode '01'

    while (1) {
        GPIOA->ODR ^= (1U << 5); // Toggle LED
        delay_seconds(2);        // 2-second delay
    }
}

Circuit Interfacing Diagram:

Complete Embedded C Program:

#include "stm32f4xx.h"

void EXTI13_Init(void) {
    // 1. Enable Clocks for GPIOA (LED), GPIOC (Button), and SYSCFG
    RCC->AHB1ENR |= RCC_AHB1ENR_GPIOAEN | RCC_AHB1ENR_GPIOCEN;
    RCC->APB2ENR |= RCC_APB2ENR_SYSCFGEN;

    // 2. PA5 as Output (LED), PC13 as Input (Button)
    GPIOA->MODER |= (1U << (5 * 2));
    GPIOC->MODER &= ~(3U << (13 * 2));

    // 3. Connect EXTI13 to Port C in SYSCFG_EXTICR4 (bits [7:4] = 0010)
    SYSCFG->EXTICR[3] &= ~(0xFU << 4);
    SYSCFG->EXTICR[3] |=  (0x2U << 4); // Port C

    // 4. Configure Falling-edge Trigger in FTSR (Button press pulls to 0)
    EXTI->FTSR |= (1U << 13);
    EXTI->RTSR &= ~(1U << 13);

    // 5. Unmask interrupt line 13 in IMR
    EXTI->IMR |= (1U << 13);

    // 6. Enable in NVIC
    NVIC_SetPriority(EXTI15_10_IRQn, 2);
    NVIC_EnableIRQ(EXTI15_10_IRQn);
}

void EXTI15_10_IRQHandler(void) {
    if (EXTI->PR & (1U << 13)) {
        GPIOA->ODR ^= (1U << 5); // Toggle LED
        EXTI->PR = (1U << 13);   // Clear pending bit (WRITE 1 TO CLEAR!)
    }
}

int main(void) {
    EXTI13_Init();
    while (1) {
        __WFI(); // Sleep until button press interrupt
    }
}

Direct Reference: 1 23ECE313_ES_Ch4 Text 1.pdf (Slides 19, 23, 27)

Figure 2.1: Cortex-M3 Operating Modes & States (Ch 4 Slide 19)

1. Two Operating Modes:

• Thread Mode: The default mode entered upon reset. Used to execute regular application tasks / main program code. Can run in either Privileged or Unprivileged state.
• Handler Mode: Automatically entered whenever an exception or interrupt occurs. Always executes in Privileged state (cannot be switched to unprivileged). Returns to Thread mode upon exception completion via EXC_RETURN.

2. Two Privilege Levels:

• Privileged Level: Software has full access to all memory ranges and all core control registers (NVIC, MPU, SCB, SysTick). Allowed to switch to unprivileged state by modifying the CONTROL register.
• Unprivileged (User) Level: Restricts software from accessing System Control Space (PPB: 0xE0000000 - 0xE00FFFFF), and restricts MPU regions marked privileged-only. Prevents user bugs from crashing the operating system. Cannot directly switch back to privileged mode; must execute an SVC (Supervisory Call).

Figure 2.2: CONTROL Register Bit Layout (Ch 4 Slide 27)

3. The CONTROL Register (Bits [1:0]):

• CONTROL[0] (nPRIV):
  • 0 = Privileged thread execution.
  • 1 = Unprivileged thread execution.
• CONTROL[1] (SPSEL):
  • 0 = Use Main Stack Pointer (MSP) in Thread mode.
  • 1 = Use Process Stack Pointer (PSP) in Thread mode.
  • Note: Handler mode always uses MSP regardless of SPSEL setting!

4. Dual Stack Pointers (MSP vs PSP):

• MSP (Main Stack Pointer): Used by the OS kernel, exception handlers, and interrupts. Configured at boot from vector table index 0 (`0x00000000`).
• PSP (Process Stack Pointer): Dedicated stack pointer assigned to individual user application tasks in an RTOS.
• Key Advantage: If a user task overflows its stack (PSP), the system kernel and interrupt handlers (using MSP) remain completely uncorrupted and can safely catch the fault!

Direct Reference: 2 23ECE313_ES_Ch_Txt1.pdf (Slide 12)

Figure 2.3: Bit-Band Region & Alias Region Mapping (Ch_Txt1 Slide 12)

1. Mathematical Derivation of the Formula:

Cortex-M3 provides two 1 MB bit-band regions mapped to 32 MB alias regions:

• SRAM Bit-Band: 0x20000000 - 0x200FFFFF ──► Alias: 0x22000000 - 0x23FFFFFF
• Peripheral Bit-Band: 0x40000000 - 0x400FFFFF ──► Alias: 0x42000000 - 0x43FFFFFF

In the alias region, every single bit in the bit-band region is mapped to an entire 32-bit (4-byte) word. Therefore:

• 1 byte in the bit-band region contains 8 bits, requiring 8 × 4 = 32 bytes in the alias region.
• Each individual bit n within that byte is offset by n × 4 bytes.

2. Step-by-Step Numerical Calculation for Bit 5 of GPIOA_ODR (0x40020014):

1. Target Address: 0x40020014 (Peripheral Region)
2. Bit Number (n): 5
3. Peripheral Base: 0x40000000
4. Peripheral Alias Base: 0x42000000
5. Byte Offset:
   0x40020014 - 0x40000000 = 0x00020014 (in decimal: 131,092 bytes)
6. Calculate (Byte_Offset × 32):
   Multiplying by 32 in hex is shifting left by 5 bits:
   0x00020014 × 0x20 = 0x00400280 (decimal: 131,092 × 32 = 4,194,944 = 0x400280)
7. Calculate (Bit_Number × 4):
   5 × 4 = 20 = 0x00000014
8. Total Alias Address:
   0x42000000 + 0x00400280 + 0x00000014 = 0x42400294

3. Real-Time & Multitasking Advantages:

• Atomic Operation: Performs atomic read-modify-write entirely in hardware without disabling interrupts.
• Eliminates Race Conditions: If an interrupt occurs between a read and write of a shared port register, software bit operations (ODR |= (1<<5)) corrupt adjacent bits. Bit-banding prevents this completely!
• Code Density & Speed: Replaces 3 assembly instructions (LDR, ORR, STR) with a single atomic STR instruction.

Direct Reference: 3 23ECE313_ES_Ch12_Txt1.pdf (Slides 10–14, 23)

Mechanism of the Imprecise Bus Fault (The Write Buffer Trap):

To maximize execution throughput, Cortex-M incorporates an internal Write Buffer on the system bus. When a program writes to memory, the write data is queued in the buffer, and the CPU immediately proceeds to execute subsequent instructions without waiting for bus acknowledgement. If the bus later rejects the transaction (e.g. invalid peripheral address, slave timeout), the error arrives cycles later. By then, the CPU is already executing unrelated code!

Diagnostic Method using ACTLR (Auxiliary Control Register):

Because imprecise bus faults make debugging nearly impossible (unknown PC and unknown address), ARM provides a hardware override:

// Set DISDEFWBUF bit (Bit 1) in ACTLR (Address: 0xE000E008)
SCB->ACTLR |= SCB_ACTLR_DISDEFWBUF_Msk; // Disables Write Buffer

Effect: Disabling the write buffer forces all write operations to complete synchronously before the next instruction executes. When the faulty write occurs, it immediately triggers a Precise Bus Fault, allowing the developer to inspect the exact stacked PC and read the faulty address from BFAR!

Direct Reference: 1 23ECE313_ES_Ch4 Text 1.pdf (Slide 17)

Figure 2.4: Cortex-M3 3-Stage In-Order Pipeline (Ch 4 Slide 17)

1. The Three Pipeline Stages:

• Stage 1 (Fetch): Fetches the 16-bit or 32-bit Thumb-2 instruction from memory (Flash/SRAM) via the I-Code or System bus and places it into the instruction buffer.
• Stage 2 (Decode): Decodes the instruction opcode, identifies register operands, and generates internal datapath control signals.
• Stage 3 (Execute): Executes the operation in the ALU, performs barrel shifter operations, updates status flags, or accesses memory (Load/Store).

2. Normal Sequential Execution (1 Instruction per Cycle Throughput):

Clock Cycle:     | T1 | T2 | T3 | T4 | T5 |
Instr 1 (ADD):   | Fe | De | Ex |    |    |
Instr 2 (SUB):   |    | Fe | De | Ex |    |
Instr 3 (MOV):   |    |    | Fe | De | Ex |

3. Branch Hazard & Pipeline Flush Penalty:

When a branch instruction (e.g., B label, BL, BX) reaches the Execute stage and the branch is taken, the instructions already fetched and decoded in stages 1 and 2 are invalid and must be flushed (discarded).

Clock Cycle:       | T1 | T2 | T3   | T4    | T5    |
Instr 1 (B target):| Fe | De | Ex   |       |       |  <-- Branch target computed in Ex
Instr 2 (Next):    |    | Fe | De   | FLUSH |       |  <-- Discarded!
Instr 3 (Next+1):  |    |    | Fe   | FLUSH |       |  <-- Discarded!
Target Instr 1:    |    |    |      | Fe    | De    | Ex  <-- 2 cycle branch penalty!

4. Mitigation in Cortex-M Architecture:

• Branch Speculation: Speculative prefetching fetches the target address early.
• Thumb-2 IT (If-Then) Blocks: Conditional execution allows up to 4 instructions to execute conditionally without taking a branch, completely eliminating branch flush penalties in short decision trees!

Direct Reference: 3 23ECE313_ES_Ch12_Txt1.pdf (Slides 28–34)

Figure 2.5: Hardware Stack Frame & Parameter Passing in SVC (Ch 12 Slide 30)

1. Purpose of SVC:

The SVC (Supervisory Call) instruction generates a synchronous software exception used by unprivileged user application tasks to request privileged operating system services (file system, hardware drivers, memory allocation).

2. Step-by-Step Hardware Execution:

1. User task executes SVC #number (e.g. SVC #3).
2. Hardware automatically saves the standard 8-word stack frame on the current stack (PSP):
   [SP+0] = R0, [SP+4] = R1, [SP+8] = R2, [SP+12] = R3, [SP+16] = R12, [SP+20] = LR, [SP+24] = Return PC, [SP+28] = xPSR.
3. Processor switches to Handler Mode (Privileged) and loads EXC_RETURN into LR.
4. Processor branches to SVC_Handler using the vector fetched from vector table entry 11 (offset 0x0000002C).

3. Assembly Trampoline to Detect Stack Pointer (MSP vs PSP):

__asm void SVC_Handler(void) {
    TST LR, #4          // Test Bit 2 of EXC_RETURN (0 = MSP, 1 = PSP)
    ITE EQ
    MRSEQ R0, MSP       // Stack pointer was MSP, pass in R0
    MRSNE R0, PSP       // Stack pointer was PSP, pass in R0
    B SVC_Handler_C     // Branch to C handler with stack frame pointer in R0
}

4. Extracting the SVC Number in C:

void SVC_Handler_C(uint32_t *svc_args) {
    // svc_args[6] is the stacked Return PC!
    // Since Thumb-2 SVC is a 2-byte opcode [0xDF, SVC_#],
    // subtract 2 bytes from Return PC to point directly to the SVC instruction!
    uint8_t svc_number = ((uint8_t *)svc_args[6])[-2];

    switch (svc_number) {
        case 0: // Read Service
            svc_args[0] = OS_Read(svc_args[1], svc_args[2]); // Return in R0
            break;
        case 1: // Write Service
            svc_args[0] = OS_Write(svc_args[1], svc_args[2]);
            break;
        default:
            break;
    }
}

Direct Reference: 1 23ECE313_ES_Ch4 Text 1.pdf (Slides 31–33)

Why RTOS Kernels Prefer BASEPRI over PRIMASK:

In hard real-time systems, critical tasks (e.g. emergency motor stop, radar timing) must never experience interrupt latency. By setting BASEPRI to a mid-level threshold (e.g. priority 3), the OS scheduler can protect its internal queues without blocking ultra-high-priority hard real-time interrupts (priorities 0, 1, and 2)!

Direct Reference: 2 23ECE313_ES_Ch_Txt1.pdf (Slides 25–28)

1. Tail-Chaining Mechanism:

Occurs when an interrupt arrives while the processor is already servicing another interrupt, or during the completion phase of an ISR.

• Traditional Microcontroller Flow: Unstacking previous registers (16 cycles) ──► Re-stacking registers for next interrupt (16 cycles) = 32+ clock cycles wasted!
• Cortex-M3 Tail-Chaining Flow: The NVIC skips the unstacking and re-stacking completely! It reuses the existing stack frame and transitions directly from the finishing ISR to the pending ISR in just 6 clock cycles.

Traditional: [ ISR 1 ] ──► [ Unstack (16c) ] ──► [ Restack (16c) ] ──► [ ISR 2 ] (32+ cycles)
Cortex-M3:   [ ISR 1 ] ──► [ Tail-Chain (6 cycles) ] ───────────────► [ ISR 2 ] (6 cycles!)

2. Late-Arrival Mechanism:

Occurs when a higher-priority interrupt arrives while the processor is in the middle of stacking registers for an earlier, lower-priority interrupt.

• Behavior: The processor does NOT abort or restart the stacking process. It completes the 12-cycle register stacking in progress, updates the vector fetch address to point to the higher-priority interrupt handler, and enters the high-priority ISR immediately!
• Result: Zero cycles wasted. When the high-priority ISR completes, the original lower-priority interrupt is serviced immediately via tail-chaining in 6 cycles.

Direct Reference: STM32F446RE_Timers_PWM_ADC_Mazidi.pdf (Slides 4–9)

1. Circuit Interfacing Schematic:

2. Mathematical Calculations (System Clock = 16 MHz HSI):

• Target PWM Frequency: f_PWM = 10 kHz
• Timer Clock: 16 MHz
• Set Prescaler: PSC = 0 (Counter frequency = 16 MHz / 1 = 16 MHz)
• Calculate Auto-Reload: ARR = (16,000,000 / 10,000) - 1 = 1600 - 1 = 1599
• Duty Cycle (75%): CCR1 = 0.75 × (ARR + 1) = 0.75 × 1600 = 1200

3. Complete CMSIS Register C Program:

#include "stm32f4xx.h"

void PWM_TIM2_PA5_Init(void) {
    // 1. Enable Clock for GPIOA (AHB1) and TIM2 (APB1)
    RCC->AHB1ENR |= RCC_AHB1ENR_GPIOAEN;
    RCC->APB1ENR |= RCC_APB1ENR_TIM2EN;

    // 2. Configure PA5 as Alternate Function mode (MODER bits [11:10] = '10')
    GPIOA->MODER &= ~(3U << (5 * 2));
    GPIOA->MODER |=  (2U << (5 * 2));

    // 3. Set Alternate Function to AF1 (TIM2_CH1) in AFR[0] (Bits [23:20] = 0x01)
    GPIOA->AFR[0] &= ~(0xFU << (5 * 4));
    GPIOA->AFR[0] |=  (1U   << (5 * 4));

    // 4. Configure TIM2 Time Base: 10 kHz
    TIM2->PSC = 0;       // Prescaler = 0 (16 MHz timer clock)
    TIM2->ARR = 1599;    // Auto-reload value (Period = 1600 cycles = 100 us)

    // 5. Configure 75% Duty Cycle
    TIM2->CCR1 = 1200;   // Compare match value (75% of 1600)

    // 6. Set PWM Mode 1 (OC1M = '110') and enable Preload (OC1PE = 1) in CCMR1
    TIM2->CCMR1 &= ~(7U << 4);
    TIM2->CCMR1 |=  (6U << 4);   // PWM Mode 1: High until counter > CCR1
    TIM2->CCMR1 |=  TIM_CCMR1_OC1PE;

    // 7. Enable Channel 1 Output in CCER (CC1E = 1, Active High polarity)
    TIM2->CCER |= TIM_CCER_CC1E;

    // 8. Enable Main Counter in CR1 (CEN = 1)
    TIM2->CR1 |= TIM_CR1_CEN;
}

int main(void) {
    PWM_TIM2_PA5_Init();
    while (1) {
        // Hardware timer generates 10 kHz 75% PWM automatically!
    }
}

Direct Reference: STM32F446RE_Timers_PWM_ADC_Mazidi.pdf (Slides 11–17)

1. Complete Circuit Interfacing Diagram:

2. Mathematical Calculations:

• ADC Resolution: 12-bit (0 to 4095 counts for 0V to 3.3V).
• Quantization Step: 3.3V / 4095 ≈ 0.8058 mV/count.
• Threshold Voltage: V_th = 2.0V.
• Threshold Digital Count: Threshold = (2.0V / 3.3V) × 4095 = 2481.8 ≈ 2482.
• USART2 Baud Rate: 16 MHz / (16 × 115200) = 8.6805.
  Mantissa = 8 = 0x08, Fraction = 0.6805 × 16 ≈ 11 = 0x0B.
  USART2->BRR = 0x008B.

3. Complete Embedded C Program:

#include "stm32f4xx.h"

void System_Init(void) {
    // 1. Enable Peripheral Clocks
    RCC->AHB1ENR |= RCC_AHB1ENR_GPIOAEN;  // GPIOA clock
    RCC->APB2ENR |= RCC_APB2ENR_ADC1EN;   // ADC1 clock (APB2)
    RCC->APB1ENR |= RCC_APB1ENR_USART2EN; // USART2 clock (APB1)

    // 2. Configure PA0 as Analog Mode for ADC1_IN0 (MODER[1:0] = '11')
    GPIOA->MODER |= (3U << (0 * 2));

    // 3. Configure PA5 as General Purpose Output for Fan Control (MODER[11:10] = '01')
    GPIOA->MODER &= ~(3U << (5 * 2));
    GPIOA->MODER |=  (1U << (5 * 2));

    // 4. Configure PA2 as Alternate Function AF7 for USART2_TX (MODER[5:4] = '10')
    GPIOA->MODER &= ~(3U << (2 * 2));
    GPIOA->MODER |=  (2U << (2 * 2));
    GPIOA->AFR[0] &= ~(0xFU << (2 * 4));
    GPIOA->AFR[0] |=  (7U   << (2 * 4)); // AF7 = USART2

    // 5. Configure ADC1
    ADC1->CR1 = 0;                        // 12-bit resolution
    ADC1->SMPR2 |= (4U << (0 * 3));       // 84 cycles sample time for Channel 0
    ADC1->SQR1 = 0;                       // 1 conversion in regular sequence
    ADC1->SQR3 = 0;                       // 1st conversion is Channel 0 (PA0)
    ADC1->CR2 |= ADC_CR2_ADON;            // Enable ADC1 power

    // 6. Configure USART2 (115200 Baud @ 16 MHz, 8-N-1)
    USART2->BRR = 0x008B;                 // 115200 baud
    USART2->CR1 |= USART_CR1_TE | USART_CR1_UE; // Transmitter enable & USART enable
}

uint16_t ADC1_Read(void) {
    ADC1->CR2 |= ADC_CR2_SWSTART;         // Start software conversion
    while (!(ADC1->SR & ADC_SR_EOC));     // Wait until End Of Conversion flag is set
    return ADC1->DR;                      // Read 12-bit data (clears EOC flag)
}

void UART2_SendString(char *str) {
    while (*str) {
        while (!(USART2->SR & USART_SR_TXE)); // Wait for Transmit Data Register Empty
        USART2->DR = (*str++ & 0xFF);         // Transmit byte
    }
}

int main(void) {
    System_Init();
    
    while (1) {
        uint16_t adc_val = ADC1_Read();

        // Check if analog voltage > 2.0V (ADC Count > 2482)
        if (adc_val > 2482) {
            GPIOA->ODR |= (1U << 5);           // Turn ON Fan
            UART2_SendString("ALERT: HIGH TEMP! FAN ACTIVATED
");
        } else {
            GPIOA->ODR &= ~(1U << 5);          // Turn OFF Fan
        }

        // Small software delay between readings
        for (volatile int i = 0; i < 500000; i++);
    }
}

Direct Reference: 2 23ECE313_ES_Ch_Txt1.pdf (Slides 14–18)

Figure 3.1: MPU 8 Sub-Regions & SRD Masking (Ch_Txt1 Slide 18)

1. MPU Architecture Overview:

The MPU divides the 4 GB memory map into up to 8 programmable regions (numbered 0 to 7). A background region with default privileged access permissions can be enabled via PRIVDEFENA.

2. Key MPU Control Registers:

• MPU->CTRL: Enables MPU (ENABLE bit), enables default memory map in privileged mode (PRIVDEFENA), and enables MPU during HardFault and NMI (HFNMIENA).
• MPU->RNR: Region Number Register (0 to 7) to select active region.
• MPU->RBAR: Region Base Address Register (must be aligned to region size).
• MPU->RASR: Region Attribute and Size Register:
  • SIZE bits [5:1]: Region size = 2^(SIZE+1) bytes (minimum 32 bytes).
  • AP bits [26:24]: Access Permissions (Privileged RW / User None, Privileged RO / User RO, etc.).
  • XN bit [28]: Execute Never (prevents code execution from data/stack).
  • TEX, C, B bits: Cache and write buffer memory attributes.
  • SRD bits [15:8]: Sub-Region Disable field.

3. Sub-Region Disable (SRD) Mechanism:

• Any MPU region of size ≥ 256 bytes is automatically split into 8 equal-sized sub-regions.
• The SRD field contains 8 bits (one bit for each sub-region).
• Writing a 1 to bit k disables sub-region k, allowing that slice to fall through to lower priority region rules or the background region.
• Exam Benefit: Allows carving out unprivileged memory "holes" without consuming multiple precious MPU region slots!

4. MemManage Fault Violation:

When an instruction fetch or data access violates MPU permissions (or attempts to execute in an XN region), the processor aborts the transaction and triggers a MemManage Fault. The fault address is stored in MMFAR, and status flags are set in MFSR.

Direct Reference: 1 23ECE313_ES_Ch4 Text 1.pdf (Slides 25, 48)

Figure 3.2: Execution Program Status Register (EPSR) & Thumb T-Bit (Ch 4 Slide 25)

1. The EPSR T-Bit (Bit 24) Rule:

ARM Cortex-M processors exclusively execute the Thumb-2 instruction set. They do NOT possess a 32-bit ARM instruction decoder state. Therefore, the T-bit (Bit 24) in the EPSR MUST ALWAYS BE 1 during instruction execution.

2. Function Pointers and Indirect Branches (BX / BLX):

In the ARM architecture, when executing an indirect branch via a register (e.g. BX R0, BLX R3, or loading PC via LDR PC, [R1]), Bit 0 of the target address is used by hardware to update the T-bit:

• If Bit 0 of target address = 1 ──► Sets EPSR T-bit to 1 (Thumb State). Target instruction executed at Address & ~1.
• If Bit 0 of target address = 0 ──► Attempts to clear EPSR T-bit to 0 (ARM State).

3. Why an Even Address Triggers UsageFault:

// Example: Function resides at Flash address 0x08001000
void (*my_func)(void) = (void (*)(void))0x08001000; // EVEN ADDRESS (Bit 0 = 0)
my_func(); // Executes BX R0 with R0 = 0x08001000

Hardware attempts to switch the CPU into ARM state by clearing the T-bit to 0. Since Cortex-M does not support ARM state, the core detects an illegal state transition and immediately triggers a UsageFault with INVSTATE (Invalid State) bit set in UFSR!

Direct Reference: 2 23ECE313_ES_Ch_Txt1.pdf (Slides 20, 34–37)

Figure 3.3: Vector Table Memory Structure (Ch_Txt1 Slide 20)

1. Mathematical Formula for Vector Table Size:

Every Cortex-M vector table begins with 16 system exception vectors (Vectors 0 to 15), followed by N external interrupt vectors (IRQ0 to IRQ N-1). Each vector entry is a 32-bit (4-byte) pointer.

2. ARMv7-M VTOR Alignment Rule:

The base address programmed into VTOR (Address: 0xE000ED08) must be aligned to a power-of-2 boundary that is greater than or equal to the total table size, with an absolute minimum hardware alignment of 128 bytes (32 words).

3. Calculation for Case A: Microcontroller with 32 External IRQs:

• Total Vector Entries: 16 + 32 = 48 words.
• Memory Size: 48 × 4 = 192 bytes.
• Required Power-of-2 Alignment: The smallest power of 2 ≥ 192 is 256 bytes (0x100).
• Conclusion: Base address in VTOR must end in 0x00 (Bits [7:0] = 0).

4. Calculation for Case B: Microcontroller with 75 External IRQs (e.g. STM32F446RE):

• Total Vector Entries: 16 + 75 = 91 words.
• Memory Size: 91 × 4 = 364 bytes.
• Required Power-of-2 Alignment: The smallest power of 2 ≥ 364 is 512 bytes (0x200).
• Conclusion: Base address in VTOR must end in a multiple of 0x200 (Bits [8:0] = 0).

Direct Reference: 4 23ECE313_ES_Ch14_Txt 1a.pdf (Slides 5–12); 5 23ECE313_ES_Ch15_Txt 1a.pdf (Slides 4–10)

Figure 3.4: CoreSight On-Chip Debug & Trace Architecture

1. Non-Intrusive Tracing vs Intrusive Debugging:

• Intrusive Debugging (Halt Mode): Halts the CPU clock. Breaks hard real-time systems (e.g., motor drive shorts out, CAN bus communication times out).
• Non-Intrusive Trace: CoreSight monitors execution in real-time at full CPU speed without halting the CPU, transmitting trace packets through external pins.

2. Detailed Functions of the Four CoreSight Trace Units:

Direct Reference: 1 23ECE313_ES_Ch4 Text 1.pdf (Slides 14–15)

Figure 3.5: Cortex-M3 Bus Interconnect & Harvard Architecture (Ch 4 Slide 15)

1. The Three Primary AHB-Lite Buses:

• I-Code Bus (Instruction Fetch): 32-bit AHB-Lite bus dedicated to fetching instructions from the Code space (0x00000000 - 0x1FFFFFFF), primarily Flash/ROM.
• D-Code Bus (Data Fetch from Code Space): 32-bit AHB-Lite bus used to fetch literal pools, constants, and table data stored within the Code space (0x00000000 - 0x1FFFFFFF).
• System Bus (S-Bus): 32-bit AHB-Lite bus used for all data accesses to SRAM (0x20000000), Peripherals (0x40000000), and External Memories (0x60000000). Can also fetch instructions from SRAM.

2. The Multi-Layer AHB Bus Matrix Advantage:

Cortex-M uses a Harvard architecture enabled by a multi-layer AHB matrix. Because instruction fetches (on I-Code) and data accesses (on System Bus or D-Code) travel over independent physical buses simultaneously, the processor can fetch an instruction and perform a data load/store in the exact same clock cycle without bus contention!

3. The APB (Advanced Peripheral Bus) Bridge:

Connects the high-speed AHB system bus to lower-power peripherals (USART, SPI, I2C, Timers, ADC). The APB bridge translates AHB burst transfers into simplified APB read/write cycles and operates at lower clock frequencies to save power.

Direct Reference: 1 23ECE313_ES_Ch4 Text 1.pdf (Slide 75); 3 23ECE313_ES_Ch12_Txt1.pdf (Slide 44)

1. Three Reset Types in Cortex-M Architecture:

1. Power-on Reset (POR): Cold reset initiated when power is first applied. Resets the entire microcontroller: processor core, system control logic, all peripherals, and debug blocks.
2. System Reset: Warm reset initiated by the external reset pin (NRST), independent watchdog timer, or software command (SYSRESETREQ). Resets processor core and all peripherals, but preserves debug logic so active debug sessions are not dropped.
3. Processor Reset: Resets only the processor core (internal registers, pipeline, and NVIC). Peripherals and bus bridges continue active operation. Driven by debuggers via VECTRESET.

2. Self-Reset Control via AIRCR (Address: 0xE000ED0C):

The Application Interrupt and Reset Control Register allows software to trigger a clean system reboot:

Figure 3.6: Self-Reset & AIRCR Control Bits (Ch 14 Slide 18)

3. The VECTKEY Security Protection:

To prevent accidental system resets caused by errant software or stack corruption, writes to AIRCR MUST write the secret unlock key 0x05FA into bits [31:16] (VECTKEY field). If any other value is written, the entire write is rejected by hardware!

4. CMSIS Register Implementation:

void System_SelfReset(void) {
    __DSB(); // Ensure all outstanding memory transactions finish
    SCB->AIRCR = (0x05FA << SCB_AIRCR_VECTKEY_Pos) | SCB_AIRCR_SYSRESETREQ_Msk;
    __DSB(); // Wait for reset to assert
    while (1); // Trap until hardware reset executes
}

Direct Reference: 3 23ECE313_ES_Ch12_Txt1.pdf (Slides 38–42)

Figure 3.7: Wakeup Interrupt Controller (WIC) Sequence in Deep Sleep (Ch 12 Slide 40)

1. SCR (System Control Register - Address: 0xE000ED10) Control Bits:

• Bit 1 (SLEEPONEXIT): When set to 1, processor automatically enters sleep mode immediately upon exiting the lowest-priority ISR, without executing thread background code. Perfect for purely interrupt-driven sensor nodes!
• Bit 2 (SLEEPDEEP): 0 = Enter standard Sleep mode on WFI; 1 = Enter Deep Sleep / Stop mode on WFI.
• Bit 4 (SEVONPEND): If 1, even disabled/masked pending interrupts generate an event to wake processor from WFE.

2. Wakeup Interrupt Controller (WIC):

In Deep Sleep mode, the main core power domain and NVIC clocks are shut down to achieve microamp currents. The WIC is a small, ultra-low-power shadow controller that stays powered. When an external line asserts an interrupt, the WIC signals the Power Management Unit to wake the main voltage regulator, restore clocks, and hand off the pending interrupt directly to the NVIC!

Direct Reference: 3 23ECE313_ES_Ch12_Txt1.pdf (Slides 35–37); lab/systick.c

Figure 3.8: SysTick 24-Bit Down-Counter Registers (Ch 14 Slide 3)

1. Mathematical Derivation for 1 Millisecond Delay:

• Processor Clock: f_CPU = 16 MHz = 16,000,000 Hz
• Time for 1 millisecond: T = 1 ms = 0.001 s
• Number of clock cycles required: N = 16,000,000 × 0.001 = 16,000 cycles
• Since counter counts from LOAD down to 0 (a total of LOAD + 1 states):
• SysTick->LOAD = 16,000 - 1 = 15,999 (0x3E7F)

2. Complete CMSIS Register Implementation:

#include "stm32f4xx.h"

void SysTick_Delay_ms(uint32_t ms) {
    // 1. Disable SysTick during configuration
    SysTick->CTRL = 0;

    // 2. Load count value for 1 ms (16,000 cycles at 16 MHz)
    SysTick->LOAD = 15999;

    // 3. Clear current value register and clear COUNTFLAG
    SysTick->VAL = 0;

    // 4. Enable SysTick with Processor Clock (Bit 2: CLKSOURCE = 1, Bit 0: ENABLE = 1)
    // No interrupt enable (TICKINT = 0)
    SysTick->CTRL = SysTick_CTRL_CLKSOURCE_Msk | SysTick_CTRL_ENABLE_Msk;

    // 5. Loop for the requested number of milliseconds
    for (uint32_t i = 0; i < ms; i++) {
        // Wait until COUNTFLAG (Bit 16) is set to 1 by hardware
        while (!(SysTick->CTRL & SysTick_CTRL_COUNTFLAG_Msk));
    }

    // 6. Disable SysTick after delay finishes
    SysTick->CTRL = 0;
}

int main(void) {
    // Enable GPIOA clock and configure PA5 as output
    RCC->AHB1ENR |= RCC_AHB1ENR_GPIOAEN;
    GPIOA->MODER &= ~(3U << (5 * 2));
    GPIOA->MODER |=  (1U << (5 * 2));

    while (1) {
        GPIOA->ODR ^= (1U << 5);      // Toggle PA5 LED
        SysTick_Delay_ms(500);        // Accurate 500 ms delay
    }
}

Direct Reference: 7 23ECE313_ES_ Mazidi.pdf & STM32F446RE_Timers_PWM_ADC_Mazidi.pdf

1. Complete Multi-Peripheral Circuit Diagram:

2. System Architecture & Operation Flow:

1. Standby State: System operates in low-power sleep (__WFI()) while TIM2 continuously outputs PWM on PA5.
2. Interrupt Event: User presses PC13 button, asserting falling edge on EXTI13.
3. ISR Execution (EXTI15_10_IRQHandler):
   • Trigger software conversion on ADC1 (SWSTART).
   • Poll until EOC flag is set in ADC1->SR.
   • Read 12-bit ADC result (0 to 4095).
   • Scale and write the ADC result directly to TIM2->CCR1.
   • Clear pending bit by writing 1: EXTI->PR = (1U << 13);.

3. Complete Embedded C Program:

#include "stm32f4xx.h"

void System_Peripherals_Init(void) {
    // 1. Enable Peripheral Clocks
    RCC->AHB1ENR |= RCC_AHB1ENR_GPIOAEN | RCC_AHB1ENR_GPIOCEN; // GPIOA & GPIOC
    RCC->APB2ENR |= RCC_APB2ENR_SYSCFGEN | RCC_APB2ENR_ADC1EN; // SYSCFG & ADC1
    RCC->APB1ENR |= RCC_APB1ENR_TIM2EN;                        // TIM2

    // 2. Configure PC13 as Digital Input with Pull-Up (Pushbutton)
    GPIOC->MODER &= ~(3U << (13 * 2)); // Input mode ('00')
    GPIOC->PUPDR &= ~(3U << (13 * 2));
    GPIOC->PUPDR |=  (1U << (13 * 2)); // Pull-Up ('01')

    // 3. Configure PA0 as Analog Mode (ADC1_IN0)
    GPIOA->MODER |= (3U << (0 * 2));   // Analog mode ('11')

    // 4. Configure PA5 as Alternate Function AF1 (TIM2_CH1 PWM)
    GPIOA->MODER &= ~(3U << (5 * 2));
    GPIOA->MODER |=  (2U << (5 * 2));  // Alternate function ('10')
    GPIOA->AFR[0] &= ~(0xFU << (5 * 4));
    GPIOA->AFR[0] |=  (1U   << (5 * 4)); // AF1 = TIM2_CH1

    // 5. Configure EXTI13 for PC13
    SYSCFG->EXTICR[3] &= ~(0xFU << 4);
    SYSCFG->EXTICR[3] |=  (2U   << 4); // Port C = 0x2
    EXTI->FTSR |= (1U << 13);          // Falling trigger
    EXTI->IMR  |= (1U << 13);          // Unmask interrupt line 13

    NVIC_SetPriority(EXTI15_10_IRQn, 2);
    NVIC_EnableIRQ(EXTI15_10_IRQn);

    // 6. Configure ADC1 (Channel 0, PA0)
    ADC1->SMPR2 |= (4U << 0);          // 84 cycles sample time
    ADC1->SQR1 = 0;                    // 1 conversion
    ADC1->SQR3 = 0;                    // Channel 0
    ADC1->CR2 |= ADC_CR2_ADON;         // Turn on ADC

    // 7. Configure TIM2 for 1 kHz PWM with 12-bit range (ARR = 4095)
    TIM2->PSC = 3;                     // 16 MHz / 4 = 4 MHz timer clock
    TIM2->ARR = 4095;                  // Matches 12-bit ADC resolution!
    TIM2->CCR1 = 2048;                 // Initial 50% duty cycle
    TIM2->CCMR1 |= (6U << 4) | TIM_CCMR1_OC1PE; // PWM Mode 1
    TIM2->CCER  |= TIM_CCER_CC1E;      // Enable channel 1 output
    TIM2->CR1   |= TIM_CR1_CEN;        // Start counter
}

// EXTI15_10 Interrupt Handler for Button Press
void EXTI15_10_IRQHandler(void) {
    if (EXTI->PR & (1U << 13)) {
        // Start ADC conversion on PA0
        ADC1->CR2 |= ADC_CR2_SWSTART;
        while (!(ADC1->SR & ADC_SR_EOC)); // Wait for conversion

        uint16_t adc_val = ADC1->DR;      // Read 12-bit analog value (0-4095)
        
        // Dynamically update PWM duty cycle (matches ARR = 4095)
        TIM2->CCR1 = adc_val;

        // Clear interrupt pending bit (WRITE 1 TO CLEAR)
        EXTI->PR = (1U << 13);
    }
}

int main(void) {
    System_Peripherals_Init();

    while (1) {
        __WFI(); // Sleep until button press interrupt arrives
    }
}

Direct Reference: 7 23ECE313_ES_ Mazidi.pdf (Chapter 1 & 2) / TM4C123GH6PM Datasheet

1. Core Architecture Overview:

• Processor Core: ARM Cortex-M4F operating at up to 80 MHz, with 32-bit Harvard architecture, single-precision Hardware Floating Point Unit (FPU), and Thumb-2 ISA.
• On-Chip Memory: 256 KB Flash memory, 32 KB SRAM, 2 KB EEPROM, and dedicated ROM containing TivaWare peripheral driver library.
• Bus Interconnect: Multi-layer Advanced Microcontroller Bus Architecture (AMBA) featuring high-speed AHB (Advanced High-Performance Bus) for Flash/SRAM and APB (Advanced Peripheral Bus) for legacy peripherals. Certain ports (Port A-F) can be software-configured to operate on either APB or advanced AHB for higher throughput.

2. Run-Mode Clock Gating Control (RCGC) System:

In TM4C123, all peripherals are powered down by default to conserve energy. Before accessing any peripheral register, software must explicitly gate the clock using the System Control Block (Base: 0x400FE000):

• SYSCTL_RCGCGPIO_R (Offset 0x608): Clock gating for GPIO Ports A through F (Bit 0 = Port A, Bit 1 = Port B, ..., Bit 5 = Port F).
• SYSCTL_RCGCTIMER_R (Offset 0x604): Clock gating for 16/32-bit General Purpose Timer Modules (Timer 0 to Timer 5).
• SYSCTL_RCGCADC_R (Offset 0x638): Clock gating for ADC Modules (Bit 0 = ADC0, Bit 1 = ADC1).
• SYSCTL_RCGCPWM_R (Offset 0x640): Clock gating for PWM Modules 0 and 1.

Direct Reference: 7 23ECE313_ES_ Mazidi.pdf (Chapter 2, Section 2.3)

1. Why Address-Bit Masking is Needed:

Traditional microcontrollers require software read-modify-write sequences (PORT |= (1<<2)) to modify individual I/O pins, which creates severe race conditions when interrupts fire between the read and write. TM4C123 eliminates this by mapping address bus bits [9:2] directly as an 8-bit pin mask!

2. How the Address Mask Works:

• Every GPIO port occupies a 1 KB address space for its data register (from offset 0x000 to 0x3FC).
• The base address is 0x40025000 for Port F. Bits [9:2] of the address offset determine which of the 8 pins (PF7–PF0) can be read or written.
• If address bit (2 + n) is 1, then pin n is affected by the read/write. If bit (2 + n) is 0, pin n is hardware-protected and remains unmodified!

3. Key TM4C123 GPIO Configuration Registers:

• GPIODIR: 0 = Input, 1 = Output.
• GPIODEN: Digital Enable (1 = Digital I/O enabled; 0 = Disabled for analog mode).
• GPIOPUR / GPIOPDR: Internal Pull-Up / Pull-Down resistor enable.
• GPIOLOCK & GPIOCR: Used to unlock special pins (e.g., PF0 and PD7 which default to NMI/JTAG). Write 0x4C4F434B to GPIOLOCK, then set commit register GPIOCR to 0xFF.

Direct Reference: 7 23ECE313_ES_ Mazidi.pdf (Chapter 8, ADC Programming)

1. ADC Core Specifications:

TM4C123 features two independent 12-bit Successive Approximation ADC modules (ADC0 and ADC1) with up to 12 shared analog input channels (AIN0 to AIN11) and sample rates up to 1 MSPS.

2. The Four Sample Sequencers:

3. Key ADC Registers & Configuration Steps:

1. ADC0_ACTSS_R: Active Sample Sequencer. Clear bit 3 to disable SS3 during configuration, then set bit 3 to enable it afterwards.
2. ADC0_EMUX_R: Event Multiplexer Select. Writing 0x0000 configures software trigger (Processor trigger) for SS3.
3. ADC0_SSMUX3_R: Sample Sequencer 3 Input Multiplexer. Write channel number (e.g. 0 for AIN0 on PE3).
4. ADC0_SSCTL3_R: Sample Sequencer 3 Control. Set bit 1 (END0) to mark it as the last sample, and bit 2 (IE0) to assert raw interrupt flag when conversion completes (Write 0x0006).
5. ADC0_PSSI_R: Processor Sample Initiate. Write 0x0008 to start SS3 conversion by software.
6. ADC0_RIS_R: Raw Interrupt Status. Poll Bit 3 to wait for conversion completion.
7. ADC0_SSFIFO3_R: Read 12-bit result (0 to 4095).

Direct Reference: 3 23ECE313_ES_Ch12_Txt1.pdf (Slides 16–22)

1. Structure of the CFSR Register (Address: 0xE000ED28):

The 32-bit CFSR register is physically partitioned into three sub-registers:

Bit:  [31 ------------- 16] [15 -------------- 8] [7 ---------------- 0]
      |        UFSR        |        BFSR        |        MMFSR         |
      | (Usage Fault Stat) | (Bus Fault Status) | (MemManage Status)   |

• MMFSR (Bits [7:0] - MemManage Fault Status):
  • IACCVIOL (Bit 0): Instruction access violation (e.g. attempted execution from an XN region).
  • DACCVIOL (Bit 1): Data access violation (e.g. unprivileged write to privileged region).
  • MMARVALID (Bit 7): MemManage Fault Address Register (MMFAR) holds valid fault address.
• BFSR (Bits [15:8] - Bus Fault Status):
  • IBUSERR (Bit 8): Instruction bus error during fetch.
  • PRECISERR (Bit 9): Precise data bus error (stacked PC is exact; BFAR is valid).
  • IMPRECISERR (Bit 10): Imprecise data bus error from Write Buffer (stacked PC is delayed; BFAR invalid!).
  • BFARVALID (Bit 15): Bus Fault Address Register (BFAR) contains valid fault address.
• UFSR (Bits [31:16] - Usage Fault Status):
  • UNDEFINSTR (Bit 16): Attempted execution of undefined/illegal opcode.
  • INVSTATE (Bit 17): Illegal state transition (EPSR T-bit cleared to 0 by branch to even address).
  • INVPC (Bit 18): Invalid PC load from illegal EXC_RETURN.
  • UNALIGNED (Bit 24): Unaligned memory access (if trap enabled in CCR).
  • DIVBYZERO (Bit 25): Divide-by-zero executed (if trap enabled in CCR).

2. Fault Escalation to HardFault:

If a configurable fault occurs while its handler is disabled in SHCSR (System Handler Control and State Register), or if a fault occurs inside an existing fault handler of equal or higher priority, the processor escalates the exception to a HardFault. In HFSR, the FORCED bit (Bit 30) is set to indicate escalation!

Direct Reference: 3 23ECE313_ES_Ch12_Txt1.pdf (Slides 23–25)

1. Step 1: Assembly Trampoline (Determines MSP vs PSP):

__asm void HardFault_Handler(void) {
    TST LR, #4          // Test Bit 2 of EXC_RETURN (0 = MSP was used, 1 = PSP was used)
    ITE EQ
    MRSEQ R0, MSP       // Stack pointer was MSP -> pass to C handler in R0
    MRSNE R0, PSP       // Stack pointer was PSP -> pass to C handler in R0
    B HardFault_Handler_C // Branch to C diagnostic function
}

2. Step 2: C Diagnostic Handler Function:

void HardFault_Handler_C(uint32_t *stack_frame) {
    // Extract hardware stacked registers from stack pointer
    uint32_t stacked_r0  = stack_frame[0];
    uint32_t stacked_r1  = stack_frame[1];
    uint32_t stacked_r2  = stack_frame[2];
    uint32_t stacked_r3  = stack_frame[3];
    uint32_t stacked_r12 = stack_frame[4];
    uint32_t stacked_lr  = stack_frame[5];
    uint32_t stacked_pc  = stack_frame[6]; // FAULTING INSTRUCTION ADDRESS!
    uint32_t stacked_psr = stack_frame[7];

    // Read System Control Block Fault Status Registers
    uint32_t cfsr = SCB->CFSR; // Configurable Fault Status
    uint32_t hfsr = SCB->HFSR; // HardFault Status
    uint32_t bfar = SCB->BFAR; // Bus Fault Address (if BFARVALID is set)
    uint32_t mmfar = SCB->MMFAR; // MemManage Fault Address (if MMARVALID is set)

    // Check if HardFault was forced by an unhandled configurable fault
    if (hfsr & (1U << 30)) {
        // FORCED bit set: Escalated from BusFault, MemManage, or UsageFault
    }

    // Hang or initiate safe system reset
    __disable_irq();
    while (1); // Trap debugger here to inspect registers
}

Direct Reference: 3 23ECE313_ES_Ch12_Txt1.pdf (Slide 26)

1. Definition of Lockup:

The Lockup state is a terminal fault condition in the ARM Cortex-M core that occurs when an exception/fault is triggered while the processor is already executing inside the HardFault Handler or NMI Handler (known as a Double Fault or recursive fault).

2. Primary Root Causes:

• Corrupted Stack Pointer: The stack pointer points to invalid memory or unmapped RAM. When HardFault attempts to push registers to the stack, a BusFault occurs, which cannot be serviced because HardFault is already active!
• Corrupted Vector Table: The vector table entry for HardFault_Handler or NMI_Handler points to invalid memory or has its LSB cleared to 0 (violating Thumb state).
• Bus Error during Vector Fetch at Reset: Address 0x00000000 or 0x00000004 returns a bus error during boot.

3. Hardware Response during Lockup:

• The processor halts all instruction fetching and execution immediately.
• The core asserts the external hardware output signal LOCKUP.
• In silicon implementations (like STM32 and TM4C), the LOCKUP signal can be wired directly to an internal Watchdog Timer or System Reset Controller to force an automatic warm reboot.

4. Recovery:

Lockup cannot be exited by software or regular interrupts. Recovery is only possible via a hardware Power-on Reset (POR), External Reset pin assertion (NRST), or a Watchdog Timer Reset.

Direct Reference: 7 23ECE313_ES_ Mazidi.pdf (Chapter 6, Interrupts)

1. Five-Stage Register Pipeline for GPIO Interrupts:

2. Status Registers:

• GPIORIS (Raw Interrupt Status): Shows if an interrupt condition occurred on the pin, regardless of mask.
• GPIOMIS (Masked Interrupt Status): Shows if an active interrupt is currently sent to the NVIC (RIS AND IM).

Direct Reference: 7 23ECE313_ES_ Mazidi.pdf (Chapter 2 & 3)

1. Hardware Interfacing & Port F Pin Map:

• PF4: On-board Pushbutton SW1 (Active-Low: Pressed = 0, Released = 1). Requires internal pull-up!
• PF2: On-board Blue LED (Active-High: 1 = ON, 0 = OFF).

2. Complete C Program:

#include 
#include "tm4c123gh6pm.h"

void PortF_Init(void) {
    // 1. Enable Clock for Port F in RCGCGPIO (Bit 5 = 1)
    SYSCTL_RCGCGPIO_R |= 0x20;
    
    // 2. Wait for clock to stabilize (3 cycles)
    volatile uint32_t delay = SYSCTL_RCGCGPIO_R;

    // 3. Unlock Port F commit register (Required for PF0, good practice)
    GPIO_PORTF_LOCK_R = 0x4C4F434B; // Secret unlock key
    GPIO_PORTF_CR_R |= 0x14;        // Commit PF4 and PF2

    // 4. Configure Directions: PF4 is Input (0), PF2 is Output (1)
    GPIO_PORTF_DIR_R &= ~0x10;      // Clear bit 4 (PF4 Input)
    GPIO_PORTF_DIR_R |=  0x04;      // Set bit 2 (PF2 Output)

    // 5. Disable Analog Mode
    GPIO_PORTF_AMSEL_R &= ~0x14;

    // 6. Disable Alternate Functions (Regular GPIO)
    GPIO_PORTF_AFSEL_R &= ~0x14;

    // 7. Enable Internal Pull-Up Resistor on PF4 (Active-Low button)
    GPIO_PORTF_PUR_R |= 0x10;

    // 8. Enable Digital Functionality on PF4 and PF2
    GPIO_PORTF_DEN_R |= 0x14;
}

int main(void) {
    PortF_Init();

    while (1) {
        // Read PF4: If button is pressed (PF4 reads 0)
        if ((GPIO_PORTF_DATA_R & 0x10) == 0) {
            GPIO_PORTF_DATA_R |= 0x04;  // Turn ON Blue LED
        } else {
            GPIO_PORTF_DATA_R &= ~0x04; // Turn OFF Blue LED
        }
    }
}

Direct Reference: 7 23ECE313_ES_ Mazidi.pdf (Chapters 8 & 11)

1. Complete Circuit Schematic:

2. Operational Logic & Calculations:

• ADC0 SS3: Configured for single-sample conversion on Channel 0 (PE3 / AIN0). 12-bit output = 0 to 4095.
• PWM Module 0 (PB6): Uses PWM Generator 0. Clock source = 16 MHz System Clock / 64 (PWMDIV) = 250 kHz.
• Period Load Value = LOAD = 250 - 1 = 249 (gives 1 kHz PWM).
• Compare Value: CMPA = (ADC_Value × 249) / 4095 (Dynamically varies motor speed from 0% to 100%).

3. Complete C Program:

#include 
#include "tm4c123gh6pm.h"

void ADC0_SS3_Init(void) {
    // 1. Enable Clocks for ADC0 and Port E
    SYSCTL_RCGCADC_R |= 0x01;
    SYSCTL_RCGCGPIO_R |= 0x10; // Port E
    volatile uint32_t delay = SYSCTL_RCGCGPIO_R;

    // 2. Configure PE3 as Analog Input (AIN0)
    GPIO_PORTE_DIR_R &= ~0x08;   // Input
    GPIO_PORTE_AFSEL_R |= 0x08;  // Enable Alternate Function
    GPIO_PORTE_DEN_R &= ~0x08;   // Disable Digital
    GPIO_PORTE_AMSEL_R |= 0x08;  // Enable Analog Mode

    // 3. Configure Sample Sequencer 3
    ADC0_ACTSS_R &= ~0x08;       // Disable SS3 during setup
    ADC0_EMUX_R &= ~0xF000;      // Software trigger for SS3
    ADC0_SSMUX3_R = 0;           // Select Channel 0 (AIN0)
    ADC0_SSCTL3_R = 0x0006;      // Set IE0 and END0 (Bit 2 & Bit 1)
    ADC0_ACTSS_R |= 0x08;        // Enable SS3
}

uint16_t ADC0_Read(void) {
    ADC0_PSSI_R = 0x08;                 // Start SS3 conversion
    while ((ADC0_RIS_R & 0x08) == 0);   // Wait for conversion completion
    uint16_t result = ADC0_SSFIFO3_R;   // Read 12-bit value
    ADC0_ISC_R = 0x08;                  // Clear completion flag
    return result;
}

void PWM0_PB6_Init(void) {
    // 1. Enable Clocks for PWM0 and Port B
    SYSCTL_RCGCPWM_R |= 0x01;
    SYSCTL_RCGCGPIO_R |= 0x02; // Port B
    volatile uint32_t delay = SYSCTL_RCGCGPIO_R;

    // 2. Configure PB6 as Alternate Function M0PWM0
    GPIO_PORTB_AFSEL_R |= 0x40;
    GPIO_PORTB_PCTL_R &= ~0x0F000000;
    GPIO_PORTB_PCTL_R |=  0x04000000; // AF4 = PWM
    GPIO_PORTB_DEN_R   |= 0x40;

    // 3. Configure PWM Clock Divider (System Clock / 64)
    SYSCTL_RCC_R |= (1 << 20);        // Enable PWMDIV
    SYSCTL_RCC_R &= ~0x000E0000;      // Clear divider bits
    SYSCTL_RCC_R |=  0x00060000;      // Divide by 64 (250 kHz clock)

    // 4. Configure PWM Generator 0
    PWM0_0_CTL_R = 0;                 // Down-count mode
    PWM0_0_LOAD_R = 249;              // 250 kHz / 250 = 1 kHz PWM
    PWM0_0_CMPA_R = 125;              // Initial 50% duty cycle
    PWM0_0_GENA_R = 0x8C;             // High on LOAD, Low on CMPA
    PWM0_0_CTL_R |= 0x01;             // Enable Generator 0

    // 5. Enable PWM Output on PB6
    PWM0_ENABLE_R |= 0x01;
}

int main(void) {
    ADC0_SS3_Init();
    PWM0_PB6_Init();

    while (1) {
        uint16_t sensor_val = ADC0_Read(); // Read 0 to 4095
        
        // Scale 12-bit ADC value to PWM LOAD (0 to 249)
        uint32_t pwm_duty = (sensor_val * 249) / 4095;
        if (pwm_duty == 0) pwm_duty = 1; // Prevent underflow
        
        PWM0_0_CMPA_R = pwm_duty;        // Dynamically adjust motor speed
    }
}

Direct Reference: lab/Exp 5 and 6.pdf / FreeRTOS Kernel Reference (Chapter 3)

1. Task State Diagram:

               ┌───────────────┐
               │   SUSPENDED   │ ◄────────── vTaskSuspend()
               └───────▲───────┘
                       │ vTaskResume()
                       ▼
        ┌────────► ┌───────────────┐ ◄────── Event occurs / Timeout
        │          │     READY     │
        │ Yield /  └───────┬───────┘
Preempt │ TimeSlice        │ Scheduler selects highest priority
        │                  ▼
        │          ┌───────────────┐
        └───────── │    RUNNING    │
                   └───────┬───────┘
                           │ Block for delay (vTaskDelay) or Semaphore/Queue
                           ▼
                   ┌───────────────┐
                   │    BLOCKED    │
                   └───────────────┘

2. Detailed State Descriptions & Transition Triggers:

• Running: The task currently utilizing the CPU core. Only one task can be in this state at any instant on a single-core Cortex-M.
• Ready: Tasks that are able to execute immediately but are waiting for the CPU because another task of equal or higher priority is currently running.
• Blocked: A task waiting for an event (temporal event like vTaskDelay(), or synchronization event like awaiting a Semaphore, Mutex, or Queue message). Blocked tasks consume zero CPU cycles.
• Suspended: Tasks removed from scheduler evaluation via vTaskSuspend(). Remains suspended until explicitly awakened by vTaskResume().

Direct Reference: lab/Exp 5 and 6.pdf; Course Plan Lecture 20

1. Structure of the Task Control Block (TCB):

Each task created via xTaskCreate() has a dedicated TCB allocated in RAM containing:

• pxTopOfStack: Pointer to the last memory location used on the task's private stack (MUST be the first member of TCB for assembly context switcher!).
• xStateListItem: Node reference placing the task in Ready, Blocked, or Suspended lists.
• uxPriority: Numerical priority assigned to the task (0 = Idle task, highest = configMAX_PRIORITIES - 1).
• pxStack: Pointer to the start of the allocated stack memory.
• pcTaskName: Text name for debugging.

2. Dual Stack Pointer Usage in Cortex-M RTOS:

• MSP (Main Stack Pointer): Strictly reserved for the FreeRTOS Kernel, SysTick, PendSV, and all hardware interrupt handlers (ISRs).
• PSP (Process Stack Pointer): Used by the currently executing user task.
• Context Switch Execution: During a task switch in PendSV, the CPU saves software registers (R4–R11) onto the current task's PSP, saves PSP into pxCurrentTCB->pxTopOfStack, updates pxCurrentTCB to the next task, restores R4–R11 from the new task's stack, and loads PSP with the new stack pointer!

Direct Reference: course_plan.txt (Lectures 20–22)

SysTick as the RTOS Heartbeat:

The SysTick timer generates a periodic interrupt (typically configured for 1 ms: configTICK_RATE_HZ = 1000). In the SysTick ISR, FreeRTOS increments the global tick count (xTickCount), unblocks tasks whose delay timers have expired, and triggers a PendSV exception if a higher priority task is ready or if time slicing is needed.

Direct Reference: lab/Exp 5 and 6.pdf; Course Plan Lecture 24

1. Differences Between Synchronization Primitives:

• Binary Semaphore: Has maximum count of 1. Used purely for signaling / event notification (e.g., ISR signals task that ADC conversion is ready). Does not track ownership!
• Counting Semaphore: Has count from 0 to N. Used for resource tracking (e.g. managing a pool of 5 memory buffers).
• Mutex (Mutual Exclusion): A binary semaphore with ownership and Priority Inheritance. Used strictly to protect shared resources (e.g. shared UART port, I2C bus).

2. The Priority Inversion Problem:

Task High   (Priority 3): ---------[ Wants Mutex: BLOCKED! ]----------------------► [ Runs ]
Task Medium (Priority 2): -----------------[ Preempts Task Low! ]-----------------►
Task Low    (Priority 1): --[ Takes Mutex ]-----------------------[ Releases Mutex ]►
Time:                     T1               T2                    T3                T4

• At T1, Task Low acquires a shared mutex.
• At T2, Task High wakes up and attempts to acquire the mutex. Because Task Low holds it, Task High is forced into the Blocked state.
• At T2.5, Task Medium (which does NOT even need the mutex) wakes up and preempts Task Low because its priority is higher than Task Low!
• The Disaster: Task High is indirectly blocked by Task Medium! This unbounded delay caused the famous 1997 Mars Pathfinder spacecraft reboot failure!

3. The Priority Inheritance Solution:

When Task High blocks on the mutex, FreeRTOS automatically raises Task Low's effective priority to match Task High's priority! Now, Task Medium cannot preempt Task Low. Task Low runs to completion, releases the mutex, its priority drops back to normal, and Task High immediately acquires the mutex and runs!

Direct Reference: lab/Exp 5 and 6.pdf; Course Plan Lecture 25

1. Message Queue Architecture:

• FreeRTOS queues are circular FIFO (First-In, First-Out) buffers capable of holding a fixed number of fixed-size data items.
• Copy-by-Value: Data is copied into the queue buffer byte-by-byte (not by reference), meaning the original variable can go out of scope or be reused immediately without data corruption.
• Thread-Safe Blocking: Tasks can block with a timeout waiting to write to a full queue or waiting to read from an empty queue.

2. Core Queue APIs:

// 1. Create a queue of 10 elements, each holding a uint16_t ADC reading
QueueHandle_t xAdcQueue = xQueueCreate(10, sizeof(uint16_t));

// 2. Task writes to queue (blocks for up to 100 ticks if queue is full)
xQueueSend(xAdcQueue, &adc_val, pdMS_TO_TICKS(100));

// 3. Task reads from queue (blocks indefinitely until data arrives)
uint16_t rx_data;
xQueueReceive(xAdcQueue, &rx_data, portMAX_DELAY);

3. Why xQueueSendFromISR() is Required in Interrupts:

Regular xQueueSend() can block the caller if the queue is full. In Cortex-M, an ISR CANNOT BLOCK (an ISR has no task context and no private stack to sleep on). The FromISR variant guarantees:

1. Non-blocking execution (zero wait time).
2. Uses a pointer BaseType_t *pxHigherPriorityTaskWoken. If sending the message unblocks a higher priority task, the ISR calls portYIELD_FROM_ISR() to trigger an immediate context switch upon ISR return!

Direct Reference: 2 23ECE313_ES_Ch_Txt1.pdf (Slide 13)

Role of TEX, C, and B Bits in MPU_RASR:

• TEX[2:0] (Type Extension): Selects cache policy (Write-Through, Write-Back, Allocate on Write).
• C (Cacheable): Enables data/instruction caching for the region.
• B (Bufferable): Permits internal write buffers to absorb writes, allowing the CPU to continue executing without bus stalls.

Direct Reference: 5 23ECE313_ES_Ch15_Txt 1a.pdf (Slides 4–7)

1. Structure of the Debug Access Port (DAP):

The DAP provides the physical hardware bridge between external debug probes (ST-Link, J-Link, Keil ULINK) and the internal microcontroller buses:

[ External Debugger ] ──► [ SWJ-DP ] ──┬──► [ AHB-AP ] ──► Memory Bus Matrix (SRAM/Flash/Peripherals)
                                        └──► [ APB-AP ] ──► Core Debug Space (DWT, ITM, FPB, ETM)

2. SWJ-DP (Serial Wire / JTAG Debug Port):

• Combines both 4-pin JTAG (TCK, TMS, TDI, TDO) and 2-pin SWD (SWCLK, SWDIO) into a single hardware block.
• Default state at boot is JTAG. The debugger can transmit a special 16-bit switching sequence (0xE79E) over the wire to switch the pins into 2-pin SWD mode!

3. AHB-AP vs APB-AP:

• AHB-AP (Advanced High-Performance Bus Access Port): Directly connected to the chip's internal bus matrix. Allows the debugger to read and write system RAM, Flash, and peripheral registers while the processor is running at full speed without halting the CPU!
• APB-AP (Advanced Peripheral Bus Access Port): Dedicated to accessing the private CoreSight debug units (DWT, FPB, ITM, ETM) inside the Private Peripheral Bus (PPB).

4. The CoreSight ROM Table:

A standardized memory table located in PPB space that lists the exact base addresses of all CoreSight components implemented on that specific silicon chip. When a debugger connects, it reads the ROM Table to automatically auto-configure its trace and breakpoint capabilities without requiring chip-specific hardcoded drivers!

Direct Reference: lab/Exp 5 and 6.txt (Lab Experiment 5)

1. Complete CMSIS-RTOS2 FreeRTOS Program:

#include "stm32f4xx.h"
#include "cmsis_os2.h"

// Task Thread Identifiers
osThreadId_t LedTaskHandle;
osThreadId_t UartTaskHandle;

// Hardware Initialization
void Hardware_Init(void) {
    // 1. Configure PA5 as Output (LED)
    RCC->AHB1ENR |= RCC_AHB1ENR_GPIOAEN;
    GPIOA->MODER &= ~(3U << (5 * 2));
    GPIOA->MODER |=  (1U << (5 * 2));

    // 2. Configure PA2 as Alternate Function AF7 for USART2 TX
    RCC->APB1ENR |= RCC_APB1ENR_USART2EN;
    GPIOA->MODER &= ~(3U << (2 * 2));
    GPIOA->MODER |=  (2U << (2 * 2));
    GPIOA->AFR[0] |= (7U << (2 * 4));

    USART2->BRR = 0x008B; // 115200 Baud @ 16 MHz
    USART2->CR1 |= USART_CR1_TE | USART_CR1_UE;
}

void UART2_Send(char *str) {
    while (*str) {
        while (!(USART2->SR & USART_SR_TXE));
        USART2->DR = (*str++ & 0xFF);
    }
}

// Task 1: Blinks LED every 500 ms
void LedTask(void *argument) {
    while (1) {
        GPIOA->ODR ^= (1U << 5); // Toggle PA5
        osDelay(500);            // Non-blocking RTOS delay
    }
}

// Task 2: Transmits telemetry string every 1000 ms
void UartTask(void *argument) {
    while (1) {
        UART2_Send("AMRITA 23ECE313 RTOS RUNNING
");
        osDelay(1000);           // Non-blocking RTOS delay
    }
}

int main(void) {
    Hardware_Init();

    // Initialize CMSIS-RTOS2 Kernel
    osKernelInitialize();

    // Create Tasks with Normal Priority
    LedTaskHandle  = osThreadNew(LedTask,  NULL, NULL);
    UartTaskHandle = osThreadNew(UartTask, NULL, NULL);

    // Start Real-Time Multitasking Scheduler
    osKernelStart();

    while (1); // Never reached
}

Direct Reference: lab/Exp 5 and 6.pdf; Lab Session 6

1. System Architecture Block Diagram:

2. Complete Embedded C Program using CMSIS-RTOS2:

#include "stm32f4xx.h"
#include "cmsis_os2.h"
#include 

// Data structure passed through the queue
typedef struct {
    uint16_t adc_value;
    uint32_t timestamp_ms;
} SensorMsg_t;

// OS Identifiers
osMessageQueueId_t sensorQueueHandle;
osThreadId_t producerTaskHandle;
osThreadId_t consumerTaskHandle;

void Peripherals_Init(void) {
    RCC->AHB1ENR |= RCC_AHB1ENR_GPIOAEN;
    RCC->APB2ENR |= RCC_APB2ENR_ADC1EN;
    RCC->APB1ENR |= RCC_APB1ENR_USART2EN;

    // PA0 Analog (ADC1_IN0)
    GPIOA->MODER |= (3U << 0);
    ADC1->SMPR2 |= (4U << 0); // 84 cycles sample time
    ADC1->SQR3 = 0;           // Channel 0
    ADC1->CR2 |= ADC_CR2_ADON;

    // PA5 Output (Relay / Fan)
    GPIOA->MODER &= ~(3U << 10);
    GPIOA->MODER |=  (1U << 10);

    // PA2 Alternate Function AF7 (USART2 TX)
    GPIOA->MODER &= ~(3U << 4);
    GPIOA->MODER |=  (2U << 4);
    GPIOA->AFR[0] |= (7U << 8);
    USART2->BRR = 0x008B; // 115200 baud
    USART2->CR1 |= USART_CR1_TE | USART_CR1_UE;
}

uint16_t ADC_Read_Sample(void) {
    ADC1->CR2 |= ADC_CR2_SWSTART;
    while (!(ADC1->SR & ADC_SR_EOC));
    return ADC1->DR;
}

void UART2_Send_Text(char *buf) {
    while (*buf) {
        while (!(USART2->SR & USART_SR_TXE));
        USART2->DR = (*buf++ & 0xFF);
    }
}

// Producer Task: Reads ADC and posts to queue
void ProducerTask(void *arg) {
    SensorMsg_t msg;
    while (1) {
        msg.adc_value = ADC_Read_Sample();
        msg.timestamp_ms = osKernelGetTickCount();

        // Push to message queue with 10 ms timeout
        osMessageQueuePut(sensorQueueHandle, &msg, 0, 10);

        osDelay(100); // Sample rate: 10 Hz
    }
}

// Consumer Task: Blocks on queue, processes data
void ConsumerTask(void *arg) {
    SensorMsg_t rxMsg;
    char log_buf[64];

    while (1) {
        // Block indefinitely until a message arrives
        if (osMessageQueueGet(sensorQueueHandle, &rxMsg, NULL, osWaitForever) == osOK) {
            // Threshold: 2.0V -> Digital 2482
            if (rxMsg.adc_value > 2482) {
                GPIOA->ODR |= (1U << 5); // Energize Relay
                snprintf(log_buf, sizeof(log_buf), "[%lu ms] ALARM: ADC=%u (OVER 2.0V)
", 
                         rxMsg.timestamp_ms, rxMsg.adc_value);
            } else {
                GPIOA->ODR &= ~(1U << 5); // De-energize Relay
                snprintf(log_buf, sizeof(log_buf), "[%lu ms] NORMAL: ADC=%u
", 
                         rxMsg.timestamp_ms, rxMsg.adc_value);
            }
            UART2_Send_Text(log_buf);
        }
    }
}

int main(void) {
    Peripherals_Init();
    osKernelInitialize();

    // Create Message Queue: 8 elements of SensorMsg_t
    sensorQueueHandle = osMessageQueueNew(8, sizeof(SensorMsg_t), NULL);

    // Create Tasks
    producerTaskHandle = osThreadNew(ProducerTask, NULL, NULL);
    consumerTaskHandle = osThreadNew(ConsumerTask, NULL, NULL);

    osKernelStart();
    while (1);
}

Direct Reference: 1 23ECE313_ES_Ch4 Text 1.pdf (Slides 5–10)

1. Embedded System Requirements:

• Hardware Requirements: Microcontroller core, volatile/non-volatile memory (SRAM/Flash), clock generation oscillators, power management unit, Watchdog timer, peripheral interfaces (GPIO, Timers, ADC, UART/SPI/I2C), and debugging interface.
• Software Requirements: Startup code & vector table, hardware device drivers (CMSIS / HAL), real-time operating system (RTOS) or super-loop scheduler, application firmware, deterministic response, and minimal memory footprint.

2. RISC vs CISC Architectural Comparison:

3. Von Neumann vs Harvard Architecture:

Direct Reference: 2 23ECE313_ES_Ch_Txt1.pdf (Slides 22–24)

Direct Reference: STM32F446RE_Timers_PWM_ADC_Mazidi.pdf (Slides 4–7); lab/23ECE387 ES Lab exp 2.txt

1. Derivation of the Universal Timer Delay Formula:

The timer counter frequency is derived by dividing the input peripheral clock by (PSC + 1):

2. Numerical Problem 1: 100 ms Time Delay at 16 MHz Clock:

• f_CLK = 16,000,000 Hz, Target Time = 0.1 s.
• Set PSC = 1599 (Prescaler divides clock by 1599 + 1 = 1600).
• Counter frequency: f_CNT = 16,000,000 / 1600 = 10,000 Hz (10 kHz). Each tick = 0.1 ms.
• Calculate ARR: (ARR + 1) = Target Time × f_CNT = 0.1 s × 10,000 = 1000.
• ARR = 1000 - 1 = 999.
• Verification: ((1599 + 1) × (999 + 1)) / 16,000,000 = (1600 × 1000) / 16,000,000 = 0.1 s = 100 ms. Exactly matches!

3. Numerical Problem 2: 2.5 kHz PWM with 60% Duty Cycle at 84 MHz APB1 Timer Clock:

• f_CLK = 84 MHz = 84,000,000 Hz, Target f_PWM = 2,500 Hz.
• Set PSC = 0 (Counter runs at full 84 MHz).
• Calculate ARR: (ARR + 1) = 84,000,000 / 2,500 = 33,600.
• ARR = 33,600 - 1 = 33,599.
• Calculate CCR1 for 60% Duty Cycle: CCR1 = 0.60 × (ARR + 1) = 0.60 × 33,600 = 20,160.

Direct Reference: course_plan.txt (Lectures 30–33)

SPI Clock Modes (CPOL and CPHA):

• CPOL = 0: SCK idles LOW; CPOL = 1: SCK idles HIGH.
• CPHA = 0: Data sampled on the first clock edge; CPHA = 1: Data sampled on the second clock edge.
• Mode 0 (0,0): Data sampled on rising edge, shifted on falling edge (most common).
• Mode 3 (1,1): Data sampled on falling edge, shifted on rising edge.

I2C Frame Signaling:

• START Condition: High-to-Low transition on SDA while SCL is HIGH.
• Address Frame: 7-bit slave address + 1-bit R/W flag (0 = Write, 1 = Read).
• ACK Bit: Slave pulls SDA LOW during the 9th SCL clock pulse.
• Data Transfer: 8-bit data bytes transmitted MSB first, each followed by ACK.
• STOP Condition: Low-to-High transition on SDA while SCL is HIGH.

Direct Reference: lab/4th exp.txt (Lab Experiment 4)

1. RTC Hardware Block Diagram:

The RTC operates in the Backup Power Domain, powered by V_BAT during main power loss. It uses a dedicated 32.768 kHz Low Speed External (LSE) crystal oscillator.

2. Binary Coded Decimal (BCD) Hardware Storage:

In STM32 RTC, time and date registers store values in BCD format (each decimal digit 0–9 occupies 4 bits). For example, 59 seconds is stored as 0x59 (not 0x3B!).

3. Mathematical Conversion Macros:

// Convert standard integer to hardware BCD format
#define BYTE_TO_BCD(val) ((uint8_t)((((val) / 10) << 4) | ((val) % 10)))

// Convert hardware BCD format to standard integer
#define BCD_TO_BYTE(val) (((val) >> 4) * 10 + ((val) & 0x0F))

Direct Reference: 5 23ECE313_ES_Ch15_Txt 1a.pdf (Slides 15–16)

Why Safety-Critical Embedded Systems Require Debug Monitor Mode:

In applications such as electric vehicle motor controllers, unmanned aerial vehicles (drones), or medical ventilators, halting the CPU for even 10 milliseconds causes disastrous hardware failure (e.g. motor MOSFET bridge shoot-through without active PWM commutation, aircraft loss of altitude, or patient hypoxia). Debug Monitor Mode allows developers to inspect application threads while safety-critical emergency ISRs continue active closed-loop control!

Direct Reference: 4 23ECE313_ES_Ch14_Txt 1a.pdf (Slides 12–14)

1. Hardware Interconnect in Dual-Core Systems:

2. Instruction Mechanisms:

• SEV (Send Event): Transmits an active pulse on the external TXEV output pin to signal partner cores, and sets the local Event Register to 1.
• WFE (Wait For Event):
  • If the internal Event Register is already 1, the instruction clears the Event Register to 0 and continues execution immediately without sleeping.
  • If the Event Register is 0, the CPU enters low-power sleep mode and halts until an event signal arrives on the RXEV pin or an interrupt occurs!

3. Advantages over Polling:

Eliminates bus thrashing and wasteful spinning locks (while(flag == 0);). Slave processors sleep at microamp currents until work is dispatched by the master via SEV!

Direct Reference: lab_plan.txt (Lab Session 3b)

1. Hardware Interfacing Diagram:

2. MCP4921 16-Bit Command Word Format:

• Bit 15: 0 (Write to DAC register).
• Bit 14: 0 (Input buffer disabled).
• Bit 13: 1 (Output gain = 1x).
• Bit 12: 1 (Active mode / output enabled).
• Bits [11:0]: 12-bit DAC data word (0 to 4095).
• Control Prefix: 0x3000. Packet = 0x3000 | (val & 0x0FFF).

3. Complete CMSIS Register C Program:

#include "stm32f4xx.h"

void SPI1_Init(void) {
    // 1. Enable Clocks: GPIOA on AHB1, SPI1 on APB2
    RCC->AHB1ENR |= RCC_AHB1ENR_GPIOAEN;
    RCC->APB2ENR |= RCC_APB2ENR_SPI1EN;

    // 2. Configure PA5 (SCK) and PA7 (MOSI) as Alternate Function AF5
    GPIOA->MODER &= ~((3U << 10) | (3U << 14));
    GPIOA->MODER |=  ((2U << 10) | (2U << 14));
    GPIOA->AFR[0] |= (5U << 20) | (5U << 28); // AF5 = SPI1

    // 3. Configure PA4 as General Purpose Output for CS
    GPIOA->MODER &= ~(3U << 8);
    GPIOA->MODER |=  (1U << 8);
    GPIOA->ODR   |=  (1U << 4); // Deselect DAC (CS High)

    // 4. Configure SPI1: Master mode, Baud = fPCLK/8, 16-bit data, Mode 0 (CPOL=0, CPHA=0)
    SPI1->CR1 = SPI_CR1_MSTR | SPI_CR1_BR_1 | SPI_CR1_DFF | SPI_CR1_SSM | SPI_CR1_SSI;
    SPI1->CR1 |= SPI_CR1_SPE; // Enable SPI1
}

void DAC_Write(uint16_t val) {
    uint16_t packet = 0x3000 | (val & 0x0FFF); // 12-bit data with 0x3 control nibble

    GPIOA->ODR &= ~(1U << 4);           // Select DAC (CS Low)
    while (!(SPI1->SR & SPI_SR_TXE));   // Wait until Transmit Buffer empty
    SPI1->DR = packet;                  // Transmit 16-bit word
    while (SPI1->SR & SPI_SR_BSY);      // Wait until transfer completes
    GPIOA->ODR |= (1U << 4);            // Deselect DAC (CS High)
}

int main(void) {
    SPI1_Init();

    uint16_t ramp = 0;
    while (1) {
        DAC_Write(ramp); // Generate Sawtooth wave
        ramp = (ramp + 64) % 4096;
        for (volatile int i = 0; i < 100; i++); // Adjust frequency
    }
}

Direct Reference: lab_plan.txt (Term Project System Level Design)

1. Complete Circuit Schematic:

2. System Operation Flow:

1. System resides in low-power sleep state (__WFI()).
2. Button press on PC13 triggers EXTI15_10_IRQHandler.
3. ISR starts conversion on ADC1 (PA0) and polls until complete.
4. If ADC reading > 2482 (Analog voltage > 2.0V):
   • Activates 2 kHz PWM audible alarm on PA5 via TIM2.
   • Transmits timestamped alert over USART2: "ALARM! HIGH VOLTAGE EXCEEDED ".
5. Else, shuts down TIM2 PWM alarm (silent).
6. ISR writes 1 to clear interrupt pending bit: EXTI->PR = (1U << 13);.

3. Complete Embedded C Program:

#include "stm32f4xx.h"

void System_Init(void) {
    // 1. Enable Peripheral Clocks
    RCC->AHB1ENR |= RCC_AHB1ENR_GPIOAEN | RCC_AHB1ENR_GPIOCEN; // GPIOA & GPIOC
    RCC->APB2ENR |= RCC_APB2ENR_SYSCFGEN | RCC_APB2ENR_ADC1EN; // SYSCFG & ADC1
    RCC->APB1ENR |= RCC_APB1ENR_TIM2EN | RCC_APB1ENR_USART2EN; // TIM2 & USART2

    // 2. Configure PC13 Pushbutton (Input with Pull-Up)
    GPIOC->MODER &= ~(3U << (13 * 2));
    GPIOC->PUPDR |=  (1U << (13 * 2)); // Pull-Up

    // 3. Configure EXTI13
    SYSCFG->EXTICR[3] &= ~(0xFU << 4);
    SYSCFG->EXTICR[3] |=  (2U   << 4); // Port C
    EXTI->FTSR |= (1U << 13);          // Falling edge trigger
    EXTI->IMR  |= (1U << 13);          // Unmask EXTI13
    NVIC_EnableIRQ(EXTI15_10_IRQn);

    // 4. Configure PA0 as Analog (ADC1_IN0)
    GPIOA->MODER |= (3U << 0);
    ADC1->SMPR2 |= (4U << 0); // 84 cycles sample time
    ADC1->SQR3 = 0;           // Channel 0
    ADC1->CR2 |= ADC_CR2_ADON;

    // 5. Configure PA5 as AF1 (TIM2_CH1 PWM Alarm)
    GPIOA->MODER &= ~(3U << 10);
    GPIOA->MODER |=  (2U << 10);
    GPIOA->AFR[0] |= (1U << 20); // AF1 = TIM2
    TIM2->PSC = 15;              // 16 MHz / 16 = 1 MHz timer clock
    TIM2->ARR = 499;             // 1 MHz / 500 = 2 kHz audible frequency
    TIM2->CCR1 = 0;              // Start with 0% duty (Off)
    TIM2->CCMR1 |= (6U << 4);    // PWM Mode 1
    TIM2->CCER  |= TIM_CCER_CC1E;
    TIM2->CR1   |= TIM_CR1_CEN;

    // 6. Configure USART2 (115200 Baud)
    GPIOA->MODER &= ~(3U << 4);
    GPIOA->MODER |=  (2U << 4);
    GPIOA->AFR[0] |= (7U << 8); // AF7 = USART2
    USART2->BRR = 0x008B;
    USART2->CR1 |= USART_CR1_TE | USART_CR1_UE;
}

void UART2_Print(char *str) {
    while (*str) {
        while (!(USART2->SR & USART_SR_TXE));
        USART2->DR = (*str++ & 0xFF);
    }
}

// EXTI Pushbutton ISR
void EXTI15_10_IRQHandler(void) {
    if (EXTI->PR & (1U << 13)) {
        // Read Analog Sensor
        ADC1->CR2 |= ADC_CR2_SWSTART;
        while (!(ADC1->SR & ADC_SR_EOC));
        uint16_t adc = ADC1->DR;

        // Threshold check (> 2.0V)
        if (adc > 2482) {
            TIM2->CCR1 = 250; // 50% duty cycle: Sound 2 kHz alarm!
            UART2_Print("[SECURITY ALERT] Critical Sensor Limit Exceeded!
");
        } else {
            TIM2->CCR1 = 0;   // Turn off alarm
            UART2_Print("[NORMAL] Sensor in safe operational range.
");
        }

        // Clear Pending Bit (Write 1 to clear)
        EXTI->PR = (1U << 13);
    }
}

int main(void) {
    System_Init();
    while (1) {
        __WFI(); // Low-power sleep until button interrupt
    }
}