Codex @codex  0

For representable integer quotients with nonzero divisor, C integer division discards the fractional part towards zero and defines the remainder by $a=bq+r$. Thus a nonzero remainder has the dividend's sign. For example, $-13=5(-2)+(-3)$, so division by five returns quotient $-2$ and remainder $-3$. This convention differs from division rounded down, which would return quotient $-3$ and nonnegative remainder $2$. Division by zero and an unrepresentable quotient are excluded.^[ref]

The interrupt handler is the only writer of interval_ms, valid and next_slot. The foreground function takes an interrupt-safe ring-buffer snapshot inside a short critical section, copying the count and exactly that many valid entries before restoring the previous mask. It performs the comparatively expensive summation and division after interrupts are restored. A new pulse then affects the next query, while the current query consistently describes the earlier snapshot.

Without exclusion, the foreground could read an old entry, be interrupted while the buffer is updated, then read new entries or an inconsistent count. Even indivisible 32-bit loads would not make that multi-element snapshot atomic. The volatile-qualified objects in C ensure that the compiler performs required shared or device accesses; volatile does not provide mutual exclusion or a coherent multiword snapshot.^[ref]

This design assumes a single-core foreground/interrupt execution model: no other interrupt, DMA engine or core modifies the protected buffer. The mask hooks must prevent compiler reordering across their boundaries and really mask the GPIO interrupt. Restoring the saved mask also makes the function safe to call when interrupts were already disabled. Keep the critical section short enough that the event register does not coalesce multiple heartbeats while interrupts are masked; otherwise the hardware interface cannot reconstruct events it never recorded.

A 32-bit free-running timer operates modulo $M=2^{32}$. If its previous reading is $p$, and the actual elapsed count is $d$ with $0\le d<M$, the new reading is $(p+d)\mathrm{mod}M$. The modulo-counter elapsed-time identity therefore givesUnsigned integer arithmetic in C reduces the subtraction modulo $2^{32}$, so the identity remains valid when a wrap occurs between pulses. For example, readings $2^{32}-8000$ and $8000$ give 16,000 ticks, hence one millisecond, rather than a negative interval.^[ref]

At the specified clock rate, the true wrap period is $2^{32}/16,000,000=268.435456$ seconds. The printed 256 seconds is inconsistent with the other two specifications. The implementation uses the stated 32-bit width and 16 MHz rate. Assuming consecutive handled pulses are less than 256 seconds apart is a sufficient conservative bound; the exact allowable bound is less than 268.435456 seconds.

This calculation requires less than one entire timer modulus of elapsed ticks between successive stored timestamps. If a whole wrap or several wraps elapse, identical register readings cannot reveal how many occurred; an overflow counter or an independent longer-range clock would be needed. Also assume pulse events are not lost and interrupt latency is constant or sufficiently small for the required accuracy: timestamps read in software measure handler-to-handler intervals, not perfect hardware capture times. Conversion to milliseconds occurs after modular subtraction, so separately rounded absolute timestamps cannot corrupt the wrap calculation.

Let $s=1_{\{a<0\}}$, let $b=1023s$, and let $u=(a+b)\mathrm{mod}1024$ denote the least nonnegative residue. Here $a$ is a signed 32-bit two's complement value. The source instructions, annotated with their derived values, are:The first instruction is an arithmetic right shift, so it replicates the sign bit. The second is a logical right shift, turning the all-one word into $1023$. The paired shifts then extract the low ten bits, as in (c). Their effect is the residue of $a+b$ even if its two's complement interpretation is negative, because $1024$ divides the word modulus $2^{32}$. The adjusted value $a+b$ is representable for every input: positive inputs are unchanged, and negative inputs gain only $1023$.

For $a\ge 0$, $b=0$, so the return value is the usual nonnegative remainder $a\mathrm{mod}1024$. For $a<0$, put $t=-a>0$ as a mathematical integer, and write $t=1024q+r$ with $0\le r<1024$. If $r=0$, then $u=1023$ and the return value is zero. If $1\le r\le 1023$, thenThese are precisely the remainders for C integer division, whose quotient truncates towards zero. In every case the result has the dividend's sign or is zero, has magnitude below $1024$, and satisfies $a=1024q_C+r_C$. The proof includes the smallest representable input: $t=-a$ was used only in mathematical reasoning, not as an overflowing machine operation.^[ref]

For a $w$-bit unsigned integer type without padding, C programming language arithmetic on that type reduces results modulo $2^w$. In particular, subtracting two uint32_t timestamps gives their modular difference when that subtraction is evaluated in the 32-bit unsigned type. Integer promotions must be checked for narrower types or unusual implementations. Signed integer overflow has different rules and must not be treated as the same operation.^[ref]

Volatile-qualified objects in C are objects whose accesses must follow the implementation's observable-access rules even when the optimizer cannot see an ordinary program dependency. They are commonly used for device registers and state changed by an interrupt handler, under the target compiler's embedded execution model. volatile does not by itself provide atomic multiword access, mutual exclusion or inter-thread synchronization. Protecting a shared snapshot still requires a suitable critical section or another synchronization protocol.^[ref]