The posting, in Span's own words
archived Oct 26, 2026Our Mission
SPAN develops products that accelerate the rapid adoption of renewable energy in the home. The flagship SPAN Smart Panel is the first true evolution for the traditional home electric panel, harnessing enhanced technology for metering, monitoring, and control. An expanded product suite of intelligent, integrated solutions radically lowers the cost and complexity of energy upgrades–including solar, batteries and EVs–empowering homeowners to be active, resilient and informed players in the energy market.
The Team and Role
SPAN's Device Software team is responsible for all of the software that is physically embodied in our hardware products. The Gen3 SPAN Panel is a distributed system of STM32H5 (Arm Cortex-M33) microcontroller modules that talk over CAN, meter power in real time, and open or close relays that sit directly between the grid, the home and its solar, battery and EV equipment. When that firmware makes a decision, real current moves. We are building a dedicated Functional Safety (FuSa) firmware capability to take Gen3 firmware through certification as a Power Control System under UL 3141 and as Class B control software under UL/IEC 60730-1 Annex H . This is not a checkbox exercise: FuSa at SPAN spans how we architect and partition the firmware, how we detect faults and drive the system into defined safe states, how we test and prove coverage, and how we document and trace every safety requirement back to code. You will work alongside the Gen3 firmware team, systems/compliance engineers and our certification lab to make the panel provably safe.
Read the full posting ↓
What You'll Work On
Safety architecture & partitioning — isolating safety-critical code on ARMv8-M TrustZone (Secure / Non-Secure) and MPU privilege levels; defining safety, interface and application thread classes; building the data/work-transfer layer across the safety boundary; packaging safety code as controlled, versioned static libraries. FuSa RTOS & toolchain migration — moving every module from FreeRTOS/GCC to a certified RTOS (Keil RTX5 FuSa RTS, CMSIS-RTOS2) and the ARM Compiler 6 for FuSa, including thread safety classes, priorities and clang/newlib porting issues. Diagnostics & self-tests — integrating the ST Self-Test Library (CPU register, clock, incremental Flash CRC and March-C RAM tests), internal/external and software watchdogs, program-flow and interrupt monitoring, and root-causing the hard faults that currently gate safe-state responses. PCS safety functions — feeder and busbar protection, grid-outage detection and PLL/grid transitions, power and voltage rationality checks, relay feedback verification, and fault state machines that transition the panel into defined safe states (SS1–SS4) within required reaction times. Safe inter-module communication — CAN heartbeat supervision and safety-message redesign with CRCs, receiver addressing and sequence numbers. Verification & evidence — unit tests with enforced coverage in CI, HITL tests for nominal and abnormal PCS behaviour, fault-injection, static analysis, and the system tests used for certification witness testing. Process & documentation — software FMEA, Jama requirement-to-code traceability, coding standards audits, and the Annex H deliverables (development plan, safety requirements, architecture, module design, test reports) submitted for certification.
Role A — Senior / Staff Firmware Engineer, Functional Safety
You will be the technical owner of Gen3's firmware safety case. You'll turn standards clauses and FMEA outcomes into concrete architecture and code, make the hard trade-off calls (what goes in the safety partition, what the safe response to a failed self-test is, what "periodic" means to an assessor), and defend those decisions in front of the certification lab. You'll lead by doing — writing the most critical safety code yourself — while setting the patterns, reviews and standards that the rest of the team follows, and mentoring the Junior FuSa engineer. At Staff level , you'll also own the FuSa technical strategy across product lines — setting the safety architecture and process that future hardware inherits, being the final technical voice on safety trade-offs, and growing the team's safety expertise beyond yourself. Representative Projects Finalising the partitioning design across every module in the panel (Secure/Non-Secure, privileged/unprivileged, safety classes) and driving it to a working, HITL-tested implementation without destabilising a shipping product. Owning the software FMEA for each module with systems engineering — declaring detection times and fault responses for every failure mode and producing the verification evidence behind them. Designing the safety-related CAN message protocol (CRC, sequence number, timeout supervision) and the reaction logic on each module. Acting as the firmware point of contact for the certification lab (e.g. Intertek / UL) through document review and witness testing. Required Qualifications Senior: 6+ years writing production firmware in C and C++ for microcontrollers, with at least 2–3 years on safety-related products. Staff: 10+ years, including technical leadership of a safety-certified product from architecture through certification Hands-on delivery of firmware through a functional safety standard such as IEC/UL 60730 (Class B/C), IEC 61508, ISO 26262, IEC 62304, DO-178C or UL 1998 — including producing the safety evidence, not just following the process Deep experience with ARM Cortex-M: MPU configuration, fault handlers and hard-fault analysis, and ideally ARMv8-M TrustZone Strong RTOS fundamentals — priorities, priority inversion, ISR/thread interaction, stack sizing, deterministic timing Practical experience implementing MCU diagnostics: CPU/RAM/Flash self-tests, watchdog strategies, program-flow monitoring Experience with safety analyses (FMEA/FMEDA, FTA) and requirements traceability tools (e.g. Jama, DOORS, Polarion) Solid test discipline: unit testing with mocks (GoogleTest or similar), coverage targets, HIL/HITL testing, static analysis and coding standards such as MISRA C/C++ Debugging with JTAG/SWD, logic analysers and oscilloscopes; comfortable with CAN, SPI, I2C, UART Able to take an open-ended safety problem, break it down, drive decisions to resolution across firmware, systems, hardware and product, and explain the reasoning clearly to non-specialists and assessors Bonus Qualifications STM32 (especially STM32H5/U5/L5) and the ST X-CUBE-STL self-test library Keil RTX5 / FuSa RTS, ARM Compiler 6 for FuSa, SafeRTOS, or similar certified toolchains UL 3141, UL 1741 / IEEE 1547, or other grid/inverter/power-control standards MCUboot or secure boot / OTA in safety-relevant systems Experience leading witness testing or audits with a certification body (UL, Intertek, TÜV, CSA) Energy metering ICs, relay/contactor control, or power electronics