Device - Software Engineer (Functional Safety)

Our Mission SPAN develops products that accelerate the rapid adoption of renewable energy in the home. The flagship SPAN Smart Panel is the first true evolution for the traditional home electric panel, harnessing enhanced technology for metering, monitoring, and control. An expanded product suite of intelligent, integrated solutions radically lowers the cost and complexity of energy upgrades–including solar, batteries and EVs–empowering homeowners to be active, resilient and informed players in the energy market. The Team and Role SPAN's Device Software team is responsible for all of the software that is physically embodied in our hardware products. The Gen3 SPAN Panel is a distributed system of STM32H5 (Arm Cortex-M33) microcontroller modules that talk over CAN, meter power in real time, and open or close relays that sit directly between the grid, the home and its solar, battery and EV equipment. When that firmware makes a decision, real current moves. We are building a dedicated Functional Safety (FuSa) firmware capability to take Gen3 firmware through certification as a Power Control System under UL 3141 and as Class B control software under UL/IEC 60730-1 Annex H . This is not a checkbox exercise: FuSa at SPAN spans how we architect and partition the firmware, how we detect faults and drive the system into defined safe states, how we test and prove coverage, and how we document and trace every safety requirement back to code. You will work alongside the Gen3 firmware team, systems/compliance engineers and our certification lab to make the panel provably safe. What You'll Work On Safety architecture & partitioning — isolating safety-critical code on ARMv8-M TrustZone (Secure / Non-Secure) and MPU privilege levels; defining safety, interface and application thread classes; building the data/work-transfer layer across the safety boundary; packaging safety code as controlled, versioned static libraries. FuSa RTOS & toolchain migration — moving every module from FreeRTOS/GCC to a certified RTOS (Keil RTX5 FuSa RTS, CMSIS-RTOS2) and the ARM Compiler 6 for FuSa, including thread safety classes, priorities and clang/newlib porting issues. Diagnostics & self-tests — integrating the ST Self-Test Library (CPU register, clock, incremental Flash CRC and March-C RAM tests), internal/external and software watchdogs, program-flow and interrupt monitoring, and root-causing the hard faults that currently gate safe-state responses. PCS safety functions — feeder and busbar protection, grid-outage detection and PLL/grid transitions, power and voltage rationality checks, relay feedback verification, and fault state machines that transition the panel into defined safe states (SS1–SS4) within required reaction times. Safe inter-module communication — CAN heartbeat supervision and safety-message redesign with CRCs, receiver addressing and sequence numbers. Verification & evidence — unit tests with enforced coverage in CI, HITL tests for nominal and abnormal PCS behaviour, fault-injection, static analysis, and the system tests used for certification witness testing. Process & documentation — software FMEA, Jama requirement-to-code traceability, coding standards audits, and the Annex H deliverables (development plan, safety requirements, architecture, module design, test reports) submitted for certification. Role A — Senior / Staff Firmware Engineer, Functional Safety You will be the technical owner of Gen3's firmware safety case. You'll turn standards clauses and FMEA outcomes into concrete architecture and code, make the hard trade-off calls (what goes in the safety partition, what the safe response to a failed self-test is, what "periodic" means to an assessor), and defend those decisions in front of the certification lab. You'll lead by doing — writing the most critical safety code yourself — while setting the patterns, reviews and standards that the rest of the team follows, and mentoring the Junior FuSa engineer. At Staff level , you'll also o