What trade‑offs define effective rate‑limited alert thresholds in resource‑constrained embedded C firmware?

Answer to the question

Effective rate‑limited alert thresholds in resource‑constrained embedded C firmware are defined by three intertwined trade‑offs:

• Severity weighting vs. suppression aggressiveness – critical alerts must bypass suppression, while low‑priority messages are silenced more aggressively.
• Window duration vs. ISR frequency – the suppression window should shrink as interrupt frequency rises to avoid backlog, and lengthen when interrupts are sparse.
• Static vs. dynamic thresholding – static values keep code simple but may be sub‑optimal under changing workloads; dynamic adjustment can keep suppression effective but adds CPU overhead.

Confirmed facts (based on typical ARM Cortex‑M toolchains)

• Critical alerts are delivered unconditionally; medium alerts are suppressed after N hits within a window; low alerts after M hits.
• Window duration is usually set to window = K / ISR_frequency, where K is a tunable constant.
• Dynamic adjustment monitors the average alert rate; if it exceeds a target, the window widens or the suppression threshold is raised; if it falls, the window narrows.
• ISR code must be minimal: set an atomic flag or increment a small counter; the actual suppression logic runs in a lower‑priority context to avoid priority inversion.
• A fixed‑size ring buffer of 8‑bit counters (e.g., 16 entries) is sufficient for most use‑cases and fits comfortably in the small SRAM of Cortex‑M devices.

Practical steps for your firmware

1. Define severity tiers – assign CRITICAL, MEDIUM, LOW to each alert type. Code critical alerts to skip suppression.
2. Choose a base window constant (K) – start with 10 ms for high‑frequency ISRs (<10 kHz) and 100 ms for low‑frequency ones (<1 kHz). Adjust based on measured ISR latency.
3. Implement a small ring buffer – each entry holds a timestamp and a hit counter for a given alert type. Use volatile and __atomic primitives to keep ISR safety.
4. ISR logic – on each alert, simply set a flag or increment the counter; defer the full suppression decision to a background task.
5. Background task – iterate over the buffer, compare current time with stored timestamps, and decide whether to emit the alert. Reset counters when the window expires.
6. Dynamic tuning (optional) – periodically (e.g., every 1 s) calculate the average alert rate. If it exceeds a target, increase K or raise N / M; if it falls below, tighten them.
7. Verification – run a real‑time stress test: inject alerts at peak rates, measure ISR latency, and confirm that critical alerts are always delivered while low‑priority ones are suppressed as configured.
8. Memory profiling – ensure the ring buffer and auxiliary variables fit within the available SRAM; adjust buffer size if necessary.

What diagnostic detail might change this recommendation?

To fine‑tune the window scaling, we need to know the maximum acceptable ISR latency for your system. If your real‑time requirement is tighter than the default 30 µs, the window may need to be shorter, or the suppression logic moved entirely out of the ISR.