Device - Software Engineer (Functional Safety)

OUR MISSION SPAN develops products that accelerate the rapid adoption of renewable energy in the home. The flagship SPAN Smart Panel is the first true evolution for the traditional home electric panel, harnessing enhanced technology for metering, monitoring, and control. An expanded product suite of intelligent, integrated solutions radically lowers the cost and complexity of energy upgrades–including solar, batteries and EVs–empowering homeowners to be active, resilient and informed players in the energy market. THE TEAM AND ROLE SPAN's Device Software team is responsible for all of the software that is physically embodied in our hardware products. The Gen3 SPAN Panel is a distributed system of STM32H5 (Arm Cortex-M33) microcontroller modules that talk over CAN, meter power in real time, and open or close relays that sit directly between the grid, the home and its solar, battery and EV equipment. When that firmware makes a decision, real current moves. We are building a dedicated Functional Safety (FuSa) firmware capability to take Gen3 firmware through certification as a Power Control System under UL 3141 and as Class B control software under UL/IEC 60730-1 Annex H. This is not a checkbox exercise: FuSa at SPAN spans how we architect and partition the firmware, how we detect faults and drive the system into defined safe states, how we test and prove coverage, and how we document and trace every safety requirement back to code. You will work alongside the Gen3 firmware team, systems/compliance engineers and our certification lab to make the panel provably safe. WHAT YOU'LL WORK ON - Safety architecture & partitioning — isolating safety-critical code on ARMv8-M TrustZone (Secure / Non-Secure) and MPU privilege levels; defining safety, interface and application thread classes; building the data/work-transfer layer across the safety boundary; packaging safety code as controlled, versioned static libraries. - FuSa RTOS & toolchain migration — moving every module from FreeRTOS/GCC to a certified RTOS (Keil RTX5 FuSa RTS, CMSIS-RTOS2) and the ARM Compiler 6 for FuSa, including thread safety classes, priorities and clang/newlib porting issues. - Diagnostics & self-tests — integrating the ST Self-Test Library (CPU register, clock, incremental Flash CRC and March-C RAM tests), internal/external and software watchdogs, program-flow and interrupt monitoring, and root-causing the hard faults that currently gate safe-state responses. - PCS safety functions — feeder and busbar protection, grid-outage detection and PLL/grid transitions, power and voltage rationality checks, relay feedback verification, and fault state machines that transition the panel into defined safe states (SS1–SS4) within required reaction times. - Safe inter-module communication — CAN heartbeat supervision and safety-message redesign with CRCs, receiver addressing and sequence numbers. - Verification & evidence — unit tests with enforced coverage in CI, HITL tests for nominal and abnormal PCS behaviour, fault-injection, static analysis, and the system tests used for certification witness testing. - Process & documentation — software FMEA, Jama requirement-to-code traceability, coding standards audits, and the Annex H deliverables (development plan, safety requirements, architecture, module design, test reports) submitted for certification. ROLE A — SENIOR / STAFF FIRMWARE ENGINEER, FUNCTIONAL SAFETY You will be the technical owner of Gen3's firmware safety case. You'll turn standards clauses and FMEA outcomes into concrete architecture and code, make the hard trade-off calls (what goes in the safety partition, what the safe response to a failed self-test is, what "periodic" means to an assessor), and defend those decisions in front of the certification lab. You'll lead by doing — writing the most critical safety code yourself — while setting the patterns, reviews and standards that the rest of the team follows, and mentoring the Junior FuSa engineer. At Staff level, you'll also own the FuSa technical strategy across product lines — setting the safety architecture and process that future hardware inherits, being the final technical voice on safety trade-offs, and growing the team's safety expertise beyond yourself. Representative Projects - Finalising the partitioning design across every module in the panel (Secure/Non-Secure, privileged/unprivileged, safety classes) and driving it to a working, HITL-tested implementation without destabilising a shipping product. - Owning the software FMEA for each module with systems engineering — declaring detection times and fault responses for every failure mode and producing the verification evidence behind them. - Designing the safety-related CAN message protocol (CRC, sequence number, timeout supervision) and the reaction logic on each module. - Acting as the firmware point of contact for the certification lab (e.g. Intertek / UL) through document review and witness testing. Required Qualifications - Senior: 6+ years writing production firmware in C and C++ for microcontrollers, with at least 2–3 years on safety-related products. Staff: 10+ years, including technical leadership of a safety-certified product from architecture through certification - Hands-on delivery of firmware through a functional safety standard such as IEC/UL 60730 (Class B/C), IEC 61508, ISO 26262, IEC 62304, DO-178C or UL 1998 — including producing the safety evidence, not just following the process - Deep experience with ARM Cortex-M: MPU configuration, fault handlers and hard-fault analysis, and ideally ARMv8-M TrustZone - Strong RTOS fundamentals — priorities, priority inversion, ISR/thread interaction, stack sizing, deterministic timing - Practical experience implementing MCU diagnostics: CPU/RAM/Flash self-tests, watchdog strategies, program-flow monitoring - Experience with safety analyses (FMEA/FMEDA, FTA) and requirements traceability tools (e.g. Jama, DOORS, Polarion) - Solid test discipline: unit testing with mocks (GoogleTest or similar), coverage targets, HIL/HITL testing, static analysis and coding standards such as MISRA C/C++ - Debugging with JTAG/SWD, logic analysers and oscilloscopes; comfortable with CAN, SPI, I2C, UART - Able to take an open-ended safety problem, break it down, drive decisions to resolution across firmware, systems, hardware and product, and explain the reasoning clearly to non-specialists and assessors Bonus Qualifications - STM32 (especially STM32H5/U5/L5) and the ST X-CUBE-STL self-test library - Keil RTX5 / FuSa RTS, ARM Compiler 6 for FuSa, SafeRTOS, or similar certified toolchains - UL 3141, UL 1741 / IEEE 1547, or other grid/inverter/power-control standards - MCUboot or secure boot / OTA in safety-relevant systems - Experience leading witness testing or audits with a certification body (UL, Intertek, TÜV, CSA) - Energy metering ICs, relay/contactor control, or power electronics ROLE B — FIRMWARE ENGINEER (JUNIOR), FUNCTIONAL SAFETY You will build and prove the safety mechanisms that keep the panel safe. Working closely with the Senior FuSa engineer and the Gen3 firmware team, you'll implement well-scoped pieces of the safety design, write the tests that demonstrate they work, and help produce the evidence that gets us certified. This is a rare chance early in your career to learn functional safety on a real, shipping, grid-connected product — you'll come out of it knowing how safety-critical firmware is actually designed, verified and certified. Representative Projects - Wiring the incremental Flash CRC and RAM March-C self-tests into the self-test runner on a module, including the post-build CRC script, linker changes and exclusion of DMA regions. - Expanding unit-test coverage on safety-partitioned code until it meets the CI coverage gate, and writing mocks/fakes for hardware interfaces. - Building HITL and fault-injection tests (e.g. loss of heartbeat, corrupted CAN CRC, stuck relay feedback) that verify the correct safe-state transition and reaction time. - Running code audits (coding standard, interrupt/callback, assert/result usage) and bringing code and Doxygen documentation into compliance. Required Qualifications - 1–3 years of experience (including substantial internships or thesis work) writing firmware in C and/or C++ for microcontrollers - Degree in Electronics, Electrical, Computer Engineering, Computer Science or a related field - Good grasp of embedded fundamentals: memory layout (stack/heap/linker sections), interrupts, volatile and concurrency hazards, bit manipulation - Working knowledge of an RTOS (FreeRTOS, Zephyr, RTX or similar) and at least one of CAN, SPI, I2C or UART - Comfortable debugging on real hardware with a debugger (JTAG/SWD) and basic lab equipment - Writes unit tests as a habit; familiar with Git and code review workflows - Careful, detail-oriented and genuinely interested in why things fail — you'd rather prove something works than assume it does Bonus Qualifications - Exposure to any functional safety standard (IEC 60730, IEC 61508, ISO 26262) or to MISRA C - ARM Cortex-M / STM32 experience, MPU or TrustZone exposure - GoogleTest/CppUTest, CI pipelines, Python for test automation - Hardware-in-the-loop test rigs, or power electronics / energy metering projects Benefits at SPAN India ⚡Generous paid leave ⚡Comprehensive Insurance & Health Benefits ⚡Centrally located office in Bengaluru with easy access to public transit, dining, and  city amenities Interested in joining our team? Apply today and we’ll be in touch with the next steps!