Overview

The fastest way to lose trust in an AI coding tool is to watch it write a register address that doesn’t exist. Generic AI generates plausible-looking code, and in firmware “plausible” is dangerous: a wrong bit position or an invented peripheral compiles cleanly and then bricks a boot, corrupts a bus, or worse.

Hallucination Detection is the layer that checks every generated value against ground truth and flags anything it can’t cite — before it reaches your hardware. It’s the reason “grounded in the documentation” is a checked property in Embedder rather than a marketing sentence.

1. Why firmware punishes hallucination

In web code a hallucinated API throws an error you see in seconds. In firmware the same mistake is silent. A fabricated 0x4002 offset, a clock prescaler off by one, a DMA channel that belongs to a different peripheral — none of it is caught by the compiler, and all of it surfaces later as flaky hardware behavior that costs hours on a logic analyzer to trace back to a single generated line.

The cost of a confident wrong answer is higher here than almost anywhere else in software, and it lands hardest exactly where AI help is most tempting: unfamiliar silicon, where a wrong value is hardest to catch by eye.

2. Four checks against ground truth

Every value the agent emits — register addresses, bit fields, reset values, timing constants, peripheral names — is checked before it lands, against the same evidence the rest of the platform runs on:

Documentation grounding: each generated value is traced back to a specific section of the reference manual, datasheet, or SVD device file. No source, no ship — it’s flagged for review instead.
Schematic cross-check: pin assignments and peripheral routing are validated against the actual board via Schematic Ingestion, so a GPIO the firmware claims is free really is.
Errata awareness:generated code is checked against vendor errata, catching the cases where the “correct” datasheet value is itself wrong for your silicon revision.
Hardware confirmation: where Hardware Interaction is wired up, claims are confirmed against what the chip actually did — the bus waveform, the register read-back, the live debugger state.

The layers are ordered by cost. A citation check costs milliseconds; a schematic join costs seconds; the board costs a flash cycle. Most hallucinations die at the first gate, which is what keeps the loop fast.

3. Confidence scoring

Not every value is equally certain, and the agent says so. Each generated value carries a confidence score based on source corroboration, documentation recency, and how specifically the source matches your exact part — a value cited from your variant’s datasheet scores higher than one inferred from a sibling part’s. Anything below your configured threshold is flagged for human review rather than written into the code anyway.

The system is built to surface uncertainty instead of papering over it — the opposite of a generic tool that’s confidently wrong. In practice that reads as the agent pushing back: “this timing value has no documented basis for your part; here’s the closest source I have, review before use.”

4. What gets caught

Invented registers and offsets: addresses that don’t exist on the target part.
Wrong bit positions: within an otherwise real register — the class the compiler blesses and the board pays for.
Fabricated timing: setup/hold values or prescalers with no documented basis.
Cross-part contamination: a value valid on a sibling MCU leaking into the wrong one.
Peripheral mismatches: a DMA channel or alternate function mapped to the wrong block.

5. Where it shows up in the work

The check runs inline with Agent Orchestration: when the closed loop generates a change, verification happens before flash, and a failed citation sends the agent back to the documentation instead of out to the board.

In rapid prototyping: this is the check-before-flash step — a wrong bit position caught on paper costs seconds; caught on the board it costs a flash cycle and a debugging session.
In debugging: the same discipline applied to conclusions — a root-cause claim ships with its evidence, and when there’s no evidence, the agent says so rather than guessing.
In migrations: cross-part contamination is the migration failure mode, and this is where it dies — a register carried over from the source part has no citation on the target, and gets flagged instead of shipped.
In automated testing: autonomous patches are grounded in the documentation rather than a hunch, which is what makes an unattended fix loop safe to run.
In performance work: every optimization lands with the datasheet citation for why it’s safe on your part — the guard against the sleep-state change that works on the sibling MCU and locks up yours.

Every check leaves a trace — value, source, score, disposition — which is how the same workflow produces the evidence trail that migrations and safety-critical programs need, as a byproduct of running.

6. Seeing it push back

The quickest way to build trust in the layer is to watch it refuse. Talk to an engineer and run it against a part you know well — then watch it push back on the values it can’t cite. Engineers who’ve been burned by a generic tool hallucinating hardware details usually need exactly one demonstration.