WHAT YOU'LL WORK ON
Safety architecture & partitioning — isolating safety-critical code on ARMv8-M TrustZone (Secure / Non-Secure) and MPU privilege levels; defining safety, interface and application thread classes; building the data/work-transfer layer across the safety boundary; packaging safety code as controlled, versioned static libraries.
FuSa RTOS & toolchain migration — moving every module from FreeRTOS/GCC to a certified RTOS (Keil RTX5 FuSa RTS, CMSIS-RTOS2) and the ARM Compiler 6 for FuSa, including thread safety classes, priorities and clang/newlib porting issues.
Diagnostics & self-tests — integrating the ST Self-Test Library (CPU register, clock, incremental Flash CRC and March-C RAM tests), internal/external and software watchdogs, program-flow and interrupt monitoring, and root-causing the hard faults that currently gate safe-state responses.
PCS safety functions — feeder and busbar protection, grid-outage detection and PLL/grid transitions, power and voltage rationality checks, relay feedback verification, and fault state machines that transition the panel into defined safe states (SS1–SS4) within required reaction times.
Safe inter-module communication — CAN heartbeat supervision and safety-message redesign with CRCs, receiver addressing and sequence numbers.
Verification & evidence — unit tests with enforced coverage in CI, HITL tests for nominal and abnormal PCS behaviour, fault-injection, static analysis, and the system tests used for certification witness testing.
Process & documentation — software FMEA, Jama requirement-to-code traceability, coding standards audits, and the Annex H deliverables (development plan, safety requirements, architecture, module design, test reports) submitted for certification.
ROLE A — SENIOR / STAFF FIRMWARE ENGINEER, FUNCTIONAL SAFETY
You will be the technical owner of Gen3's firmware safety case. You'll turn standards clauses and FMEA outcomes into concrete architecture and code, make the hard trade-off calls (what goes in the safety partition, what the safe response to a failed self-test is, what "periodic" means to an assessor), and defend those decisions in front of the certification lab. You'll lead by doing — writing the most critical safety code yourself — while setting the patterns, reviews and standards that the rest of the team follows, and mentoring the Junior FuSa engineer.
At Staff level, you'll also own the FuSa technical strategy across product lines — setting the safety architecture and process that future hardware inherits, being the final technical voice on safety trade-offs, and growing the team's safety expertise beyond yourself.
Representative Projects
Finalising the partitioning design across every module in the panel (Secure/Non-Secure, privileged/unprivileged, safety classes) and driving it to a working, HITL-tested implementation without destabilising a shipping product.
Owning the software FMEA for each module with systems engineering — declaring detection times and fault responses for every failure mode and producing the verification evidence behind them.
Designing the safety-related CAN message protocol (CRC, sequence number, timeout supervision) and the reaction logic on each module.
Acting as the firmware point of contact for the certification lab (e.g. Intertek / UL) through document review and witness testing.
Required Qualifications
Senior: 6+ years writing production firmware in C and C++ for microcontrollers, with at least 2–3 years on safety-related products. Staff: 10+ years, including technical leadership of a safety-certified product from architecture through certification
Hands-on delivery of firmware through a functional safety standard such as IEC/UL 60730 (Class B/C), IEC 61508, ISO 26262, IEC 62304, DO-178C or UL 1998 — including producing the safety evidence, not just following the process
Deep experience with ARM Cortex-M: MPU configuration, fault handlers and hard-fault analysis, and ideally ARMv8-M TrustZone
Strong RTOS fundamentals — priorities, priority inversion, ISR/thread interaction, stack sizing, deterministic timing
Practical experience implementing MCU diagnostics: CPU/RAM/Flash self-tests, watchdog strategies, program-flow monitoring
Experience with safety analyses (FMEA/FMEDA, FTA) and requirements traceability tools (e.g. Jama, DOORS, Polarion)
Solid test discipline: unit testing with mocks (GoogleTest or similar), coverage targets, HIL/HITL testing, static analysis and coding standards such as MISRA C/C++
Debugging with JTAG/SWD, logic analysers and oscilloscopes; comfortable with CAN, SPI, I2C, UART
Able to take an open-ended safety problem, break it down, drive decisions to resolution across firmware, systems, hardware and product, and explain the reasoning clearly to non-specialists and assessors
Bonus Qualifications
STM32 (especially STM32H5/U5/L5) and the ST X-CUBE-STL self-test library
Keil RTX5 / FuSa RTS, ARM Compiler 6 for FuSa, SafeRTOS, or similar certified toolchains
UL 3141, UL 1741 / IEEE 1547, or other grid/inverter/power-control standards
MCUboot or secure boot / OTA in safety-relevant systems
Experience leading witness testing or audits with a certification body (UL, Intertek, TÜV, CSA)
Energy metering ICs, relay/contactor control, or power electronics
ROLE B — FIRMWARE ENGINEER (JUNIOR), FUNCTIONAL SAFETY
You will build and prove the safety mechanisms that keep the panel safe. Working closely with the Senior FuSa engineer and the Gen3 firmware team, you'll implement well-scoped pieces of the safety design, write the tests that demonstrate they work, and help produce the evidence that gets us certified. This is a rare chance early in your career to learn functional safety on a real, shipping, grid-connected product — you'll come out of it knowing how safety-critical firmware is actually designed, verified and certified.
Representative Projects
Wiring the incremental Flash CRC and RAM March-C self-tests into the self-test runner on a module, including the post-build CRC script, linker changes and exclusion of DMA regions.
Expanding unit-test coverage on safety-partitioned code until it meets the CI coverage gate, and writing mocks/fakes for hardware interfaces.
Building HITL and fault-injection tests (e.g. loss of heartbeat, corrupted CAN CRC, stuck relay feedback) that verify the correct safe-state transition and reaction time.
Running code audits (coding standard, interrupt/callback, assert/result usage) and bringing code and Doxygen documentation into compliance.
Required Qualifications
1–3 years of experience (including substantial internships or thesis work) writing firmware in C and/or C++ for microcontrollers
Degree in Electronics, Electrical, Computer Engineering, Computer Science or a related field
Good grasp of embedded fundamentals: memory layout (stack/heap/linker sections), interrupts, volatile and concurrency hazards, bit manipulation
Working knowledge of an RTOS (FreeRTOS, Zephyr, RTX or similar) and at least one of CAN, SPI, I2C or UART
Comfortable debugging on real hardware with a debugger (JTAG/SWD) and basic lab equipment
Writes unit tests as a habit; familiar with Git and code review workflows
Careful, detail-oriented and genuinely interested in why things fail — you'd rather prove something works than assume it does
Bonus Qualifications
Exposure to any functional safety standard (IEC 60730, IEC 61508, ISO 26262) or to MISRA C
ARM Cortex-M / STM32 experience, MPU or TrustZone exposure
GoogleTest/CppUTest, CI pipelines, Python for test automation
Hardware-in-the-loop test rigs, or power electronics / energy metering projects
Benefits at SPAN India
⚡Generous paid leave
⚡Comprehensive Insurance & Health Benefits
⚡Centrally located office in Bengaluru with easy access to public transit, dining, and city amenities
Interested in joining our team? Apply today and we’ll be in touch with the next steps!
