Firmware track · First silicon to evidence

Probe the board. Rank the evidence. Prove the fix.

A hardware-first guide to turning first-silicon silence into one bounded experiment at a time, from rails and reset through the first instruction, minimal firmware, fault capture, and regression evidence.

  • Separate a physical measurement from the conclusion it can support.
  • Climb from power-on to useful firmware without assuming later subsystems work.
  • Turn every failure into a ranked hypothesis and the cheapest discriminating test.

ControlNode-M4 lab assumption: the teaching board uses a single-core Cortex-M4 at 80 MHz with internal flash and SRAM, SWD, a 115200 UART, a 1 kHz timer, ADC with DMA, PWM trip logic, and accessible debug probes. Electrical limits, addresses, and feature presence must be replaced with the real target manual, schematic, and errata.

Firmware, from reset to runtime

ControlNode-M4 evidence chain

A working application is the last conclusion, not the first test.

Physical inputRails and current
State boundaryClock and reset
Control accessSWD and halt
Execution proofSRAM and GPIO
Software evidenceUART and crash record

Method: each gate has a probe, an expected observation, a stop condition, and a next action. Passing a late gate supports earlier gates; failing it does not identify which earlier assumption broke.

01 / 06
Prepare evidence

Prepare the experiment before power-on.

The fastest bring-up sessions begin with expected observations, accessible probe points, known-good artifacts, and explicit stop conditions. A checklist is useful only when every item closes on evidence.

Freeze the configuration

Record board revision, serial number, assembly options, strap resistors, power source, probe grounds, image hash, tool versions, and debugger settings. A result without its configuration is not reproducible.

Name stop conditions

Stop for overcurrent, an unexpected rail, excessive component temperature, or reset releasing before required rails and clocks meet their documented limits. Do not keep experimenting through a possible damage condition.

Choose a smallest proof

Prefer a scope edge, register identity, SRAM write/read, or GPIO toggle over a full application. The smallest proof reduces the number of dependencies behind one observation.

Signature lab 1 · Probe map explorer

Ask one probe one precise question.

Select a ControlNode-M4 observation point. The readout separates the instrument, safe reference, expected signal, supported conclusion, and blind spot.

Evidence path

POWER EVIDENCE

Prove the core rail reaches a safe window

Measure ramp, steady voltage, ripple, and current against documented limits before allowing reset release.

Reference
Short probe ground at the designated local ground point.
Expected
Monotonic ramp into the target min/max window with bounded ripple.
It supports
The measured rail is present at this point under this load.
It cannot prove
Power at every die domain or correct sequencing of other rails.

Experiment record

Write the expected result before touching the board.

FieldExampleWhy it matters
ConfigurationRev A2, board 017, straps 101, build 84c2…Makes the observation repeatable.
HypothesisCore reset is held because the 1.2 V rail misses the valid window.Defines what the test can discriminate.
Probe and limitTP3 to TP_GND, compare ramp and steady voltage with datasheet limits.Prevents ambiguous measurement boundaries.
Observed and nextRail valid; reset still low. Move to reset-controller inputs.Preserves evidence without overclaiming.
02 / 06
Physical proof

Prove power, clock, and reset on the pins.

Registers cannot prove a clock that never reached the die. Physical prerequisites must be measured against datasheet minimum and maximum limits, not typical values or a schematic label.

Sequence is part of the value

A rail can settle at the correct voltage and still violate allowed ramp, monotonicity, or ordering. Capture related rails and reset on one time axis so causality is visible.

Measure the clock you use

An oscillator pin, exported clock, timer output, or DWT comparison can establish frequency at different boundaries. State which boundary the number represents before using it for baud or timing calculations.

Signature lab 2 · Shared-time waveform

Read the sequence before naming the failure.

Select a captured ControlNode-M4 startup. The visual state and next measurement update together.

NOMINAL CAPTURE

Reset releases once after every prerequisite

Both rails enter their documented operating windows, the oscillator becomes valid, and reset releases without reassertion.

Supported conclusion
The measured sequence satisfies this lab contract at the probe points.
Next gate
Attach through SWD and read the debug identity.
Do not claim
That every internal domain or firmware clock switch is correct.
Stop condition
None in this capture; retain it as the known-good baseline.

Measured-clock contract

Derive software timing from the measured boundary.

For a timer output, use the documented prescaler and period convention. For the lab assumption below, the counter toggles every compare event:

fout=ftimer/(2 × prescaler × compare)

Lab assumption: 80 MHz timer clock, prescaler 80, compare 500 produces 1 kHz: 80,000,000 / (2 × 80 × 500) = 1,000 Hz. Confirm whether the real timer divides by register value or register value plus one.

Source boundary: take rail, oscillator, reset, timer-clock, and register-encoding limits from the selected SoC and component datasheets, board schematic, and applicable errata. The equation is valid only after those target contracts are known.

03 / 06
Debug access

Climb the debug-access ladder one gate at a time.

A debugger GUI saying “cannot connect” merges electrical, protocol, reset, security, clock, and software causes. Split the path into gates whose pass and failure conditions are observable.

Attach under reset

Holding reset can prevent early firmware from disabling pins, entering deep sleep, changing clocks, or enabling protection before the debugger gains control. It does not repair a missing debug reference voltage or unpowered debug domain.

Prove memory in layers

Read CPUID, halt, inspect MSP/PC, write/read SRAM, execute a tiny SRAM loop, verify flash bytes, then branch to flash. Each step depends on fewer unproven components than a full image.

Signature lab 3 · First-instruction ladder

Stop at the first unsupported claim.

Choose the highest gate that passes. The lab reports what is now known, what remains possible, and the next smallest test.

Gate state

01Reference
02Debug port
03Core halt
04Vector
05SRAM
06Execute
07Flash
08GPIO

GATE 1 OF 8 · ELECTRICAL REFERENCE

The probe sees the target reference voltage

The debugger can level its I/O against the powered target. Protocol access is not yet proven.

Known
The debug connector has a valid reference at the measured pin.
Still possible
Wiring, pin mux, reset, clock, protection, and debug-port failures.
Next test
Lower SWD clock, attach under reset, and read DP/AP identity.
Evidence to save
Reference voltage, connector orientation, probe serial, and attach settings.

Vector sanity

Inspect values before executing them.

For the lab image at the boot alias, the first word must describe an aligned initial main stack pointer in implemented SRAM, and the reset entry must target executable memory with bit 0 set for Thumb state. These are lab checks, not a substitute for the target boot manual or security policy.

uint32_t initial_msp = read32(boot_alias + 0u);
uint32_t reset_pc    = read32(boot_alias + 4u);

bool stack_ok = in_sram(initial_msp) && ((initial_msp & 7u) == 0u);
bool entry_ok = in_executable(reset_pc & ~1u) && ((reset_pc & 1u) != 0u);

Use the Arm Debug Interface Architecture Specification for DP/AP behavior and the Armv7-M Architecture Reference Manual for processor state and vector-entry rules; the target manual owns boot aliases, access policy, and implemented memory.

04 / 06
Minimal firmware

Run the smallest firmware that can answer the question.

A production image combines startup, clocks, memory, drivers, interrupts, DMA, RTOS, and application state. Bring-up firmware removes dependencies until one observation has one useful interpretation.

SRAM loop

Load a bounded instruction loop into proven SRAM, halt at its address, single-step, and inspect registers. This bypasses flash fetch after setup and proves a small execution path.

GPIO heartbeat

Configure one documented pin and toggle it from a polled loop. Probe the pad, not just the output register. A register change and a pin edge close different boundaries.

Polled UART

Use static storage, a bounded timeout, measured clock, documented pin mux, and polling. Do not depend on heap, locks, interrupts, DMA, or an unproven scheduler for the earliest log.

Dependency ladder

Each proof introduces one new dependency.

01 · CoreSRAM single-step
02 · FabricSRAM loop
03 · I/OGPIO pad edge
04 · TimingTimer output
05 · SerialPolled UART
06 · RuntimeProduction image

Design rule: when a gate fails, return to the last passing artifact and add only one dependency. Do not “fix” a minimal test by reintroducing the full application.

Bounded early log

Logging must fail predictably.

bool early_uart_putc(uint8_t byte, uint32_t poll_limit) {
  while ((UART_STATUS & UART_TX_READY) == 0u) {
    if (poll_limit-- == 0u) return false;
  }
  UART_TXDATA = byte;
  return true;
}

This conceptual lab code shows the contract: initialized MMIO, a documented status bit, a bounded poll, and an explicit failure. It does not establish the real register address, width, write semantics, or clock configuration.

UART evidence

Calculate baud error from the measured peripheral clock.

error %=100 × (actual baud − target baud)/target baud

Lab assumption: if the measured peripheral clock and divider produce 114,943 baud against a 115,200 target, error is about −0.223%. Use the real UART’s oversampling and divider equation.

05 / 06
Fault evidence

Capture fault evidence without inventing a root cause.

Status bits describe detected conditions. A defensible diagnosis combines valid fault registers, a validated exception frame, code context, reset cause, and a reproducing experiment.

Validate before dereference

Use EXC_RETURN, implemented SRAM bounds, alignment, and stacking-fault status before reading a purported frame. A corrupted or inaccessible stack can make careless crash handling fault again.

Persist a versioned record

Store magic, version, length, sequence, CRC, reset cause, CFSR/HFSR, valid fault addresses, EXC_RETURN, MSP/PSP, and validated stacked registers in a bounded .noinit record.

Signature lab 4 · Fault evidence decoder

Decode the condition, then choose the next experiment.

Select a realistic evidence set. The decoder distinguishes a supported observation from a hypothesis and refuses unsafe frame reads.

Captured record

CFSR     = 0x00008200
HFSR     = 0x00000000
BFAR     = 0x40021003
EXC_RETURN = 0xFFFFFFF9
STACKED_PC = 0x0800248A
FRAME_VALID = true

PRECISE BUS FAULT · VALID BFAR

A precise data access faulted at a reported address

The architectural evidence associates the fault with a precise instruction boundary and a valid bus-fault address in this case.

Frame decision
Frame pointer is aligned, in implemented SRAM, and no stacking error is set; decode is allowed.
Supported
The stacked PC and BFAR are meaningful evidence for the access.
Not yet proven
Why the address or access width was wrong.
Next experiment
Disassemble the stacked PC, inspect the effective address and width, then compare the target register contract.

Cycle evidence

Convert DWT cycles with the measured CPU frequency.

elapsed time=cycle delta/measured CPU frequency

Lab assumption: 24,000 cycles at a measured 80 MHz equals 300 µs. The result measures the chosen DWT boundaries and includes any wrap, sleep, or counter-enable behavior defined by the target.

Interpret CFSR, HFSR, BFAR, EXC_RETURN, stack-frame shape, and DWT behavior from the Armv7-M architecture, the Cortex-M4 guide, and the selected device’s fault/debug documentation.

06 / 06
System synthesis

Localize, repair, and leave a regression behind.

Bring-up is complete only when the failure reproduces, the chosen experiment distinguishes the cause, the repair closes the original evidence, and an automated or documented check prevents silent return.

Dark capstone · Evidence contract

Turn silence into the next highest-information test.

01 · FreezeBoard, image, straps
02 · Bound riskCurrent and stop limits
03 · GatePower, clock, reset
04 · NarrowSWD and minimal code
05 · ExplainFault and context
06 · CloseFix and regression
Hypothesis
State one causal claim that predicts a measurable difference.
Discriminating probe
Choose the cheapest safe observation whose outcomes split the ranked causes.
Acceptance
Define values, units, boundaries, repetitions, and environmental conditions.
Regression
Convert the passing contract into a manufacturing test, boot self-check, crash assertion, or documented bench procedure.

A/B the artifact

Swap one board, image, clock source, probe, or power configuration at a time. Preserve the known-good baseline and record both results.

Verify the repair

Repeat the original failing test, boundary conditions, cold and warm starts, and a meaningful sample across boards. “It booted once” is not closure.

Publish the evidence

Capture the symptom, affected revisions, root cause, fix, proof, workaround, and detection method in errata or the engineering handoff.

Primary references

Verify the architecture and the exact target.

  1. Armv7-M Architecture Reference Manual, exception entry, fault status, debug and memory behavior.
  2. Cortex-M4 Devices Generic User Guide, core debug, fault handling, DWT and implementation context.
  3. Arm Debug Interface Architecture Specification, debug-port and access-port behavior.
  4. CMSIS-Core documentation, SCB, CoreDebug, DWT, startup and device-header interfaces.
  5. IEEE 1149.1-2013 boundary-scan standard, only when the selected device implements the relevant test access.
  6. The selected SoC datasheet, reference manual, programming manual and all applicable errata; board schematic, layout notes and BOM; PMIC, oscillator, flash and level-shifter datasheets. These target sources override every ControlNode-M4 lab assumption.