Firmware that has to be right the first time
Application software gets a redeploy. Firmware gets a truck roll. That asymmetry shapes every decision we make in embedded work.
We build with bounded resources and bounded behaviour: static or pool allocation instead of a heap that fragments after six weeks of uptime, watchdogs that are actually fed by the work rather than by a timer, stack usage measured rather than assumed, and interrupt latency treated as a specified number rather than an emergent property.
Bring-up: from bare board to booting system
Board bring-up is where hardware and software assumptions meet, and it is where schedules usually slip. We work through it methodically — power sequencing, clock tree, DDR calibration, boot ROM behaviour, then the first-stage bootloader, then a kernel and a device tree that actually match the schematic.
Working alongside hardware engineers rather than after them saves entire weeks. Being able to read a schematic, put a scope on a rail and reason about signal integrity means an ambiguous failure gets classified as hardware or software in hours instead of days of finger-pointing.
Embedded Linux, done properly
A Yocto build that only works on one engineer’s laptop is a liability. We
deliver reproducible BSPs: pinned layers, a documented local.conf, builds that
run in CI from a clean container, and images that are bit-for-bit reproducible
where the toolchain permits.
Kernel-side work covers platform drivers, character devices, network drivers, device tree overlays, and the unglamorous but decisive work of getting DMA, cache coherency and memory barriers right on a specific SoC.
Security and updates are the same problem
A device that can be updated but not authenticated is a device that an attacker can update. We design the two together:
- Chain of trust from the immutable boot ROM through each stage, with keys held where they belong and a documented provisioning process.
- A/B partitioned updates with atomic switch-over, automatic rollback on failed health checks, and anti-rollback counters against downgrade attacks.
- Signed, versioned artefacts with a manifest the device validates before it writes a single byte to flash.
- A recovery path that survives power loss at the worst possible moment, because eventually it will happen.
Power, timing and the physics of the thing
For battery products, the energy budget is the product specification. We profile real current draw across duty cycles, chase down the peripheral left clocked in sleep, and tune radio scheduling — the difference between an eighteen-month battery life and a six-month one is usually a handful of decisions made early.
For deterministic systems, we quantify the timing chain end to end: interrupt latency, scheduler jitter, bus contention and DMA arbitration, verified with a logic analyser rather than a print statement.