Gametime
System software developer at Gametime Technologies. Owned the software stack from architecture through dev-board bring-up.
- Bluetooth audio frames in a 50-minute soak, 0 underruns
- 1.05M
- clock-rate mismatch absorbed by a PI servo
- 3000 ppm
- ECDSA-signed OTA with automatic rollback
- P-256
Real-time audio path
Phone audio arrives as SBC over Bluetooth and the STM32 decodes it itself. A lock-free SPSC ring with barrier-ordered publishes sits between the decoder task and the SAI DMA interrupt, turning a hard 10.7 ms deadline into a soft 341 ms one. An empty ring plays silence and counts an underrun instead of stopping DMA.
Clock-rate servo
Even with a quiet radio the buffer drained at about 3 ms/s, emptying in under two minutes. A PI servo on the resampler's step holds a 200 ms target to within ±6 ms, slew-limited to 150 ppm/s so corrections stay inaudible. When it limit-cycled instead of settling, I reproduced that in a simulator before touching the gains.
Signed OTA and rollback
Images land in the inactive flash bank and the hardware bank-swap bit flips them. The ECDSA signature is checked over the bytes read back from flash, not the network stream. A new image has to prove itself (every task alive, then 5 s of healthy watchdog feeds) or the watchdog is starved on purpose and the bank flips back. A security-version floor blocks downgrades.
Concurrency rules
A depth-4 command queue whose sends are bounded at 50 ms and fail with queue_full. A state snapshot that its single writer updates with try-and-skip and readers hold for at most 5 ms. A fixed lock order on the shared I2C bus, and every internal-flash write on one task so OTA and the rollback counter can never interleave.