Licensed PE for Wireless Protocol Analysis

We manufacture a wireless consumer therapy device — a handheld remote control that wirelessly operates two receiver units ("pods"). We need a licensed Professional Engineer with strong embedded-RF expertise to independently test, characterize, and document how the remote communicates with and selects between the pods, and to deliver a signed/stamped engineering report of the findings. This is an independent verification engagement. We have an internal understanding of how the system works, but we need it rigorously and impartially confirmed and documented to professional standards. We are looking for objective findings — we need the truth of how the device behaves, documented in a way that stands on its own. What we need verified The central technical question is how the system selects which pod acts on a given command. Specifically, we need you to determine and document whether: the remote transmits to each pod on its own dedicated RF frequency/channel; or the remote broadcasts over a shared, frequency-hopping link to all pods simultaneously, and each pod independently decides whether to act based on a device identifier (UID) contained in the data packet — i.e., selection occurs at the receiver, by address, not by frequency. We need the actual mechanism established with evidence, not assumed. Scope of work Identify the RF transceiver and microcontroller on the device and the protocol/architecture in use. Characterize the over-the-air RF behavior (center frequencies, channel usage, and whether/how the link frequency-hops) using appropriate instrumentation (e.g., SDR, spectrum analysis). Probe and document the control-level behavior — e.g., capturing the SPI bus between the MCU and the RF transceiver — to determine what the device does when a specific pod is selected (which registers are written: frequency/channel vs. address/UID). Determine how pods are distinguished from one another (frequency assignment vs. UID/address filtering at the receiver) and capture supporting evidence (frame/packet structure, transmit/receive logs across multiple sessions, with one pod active, then both). Establish whether the hopping sequence (if any) is shared across all pods or assigned per pod. Tie all findings to the specific production firmware version in the units tested, and document that version. Produce a clear, well-documented engineering report — methodology, equipment, settings, procedures, captures, and conclusions — signed and PE-stamped. Required qualifications Active US Professional Engineer (PE) license in Electrical Engineering (in good standing) — please state your license state(s) and number. A current stamp is mandatory; this is a hard requirement. Hands-on experience with embedded RF and proprietary (non-Bluetooth) wireless protocols — sub-GHz / 2.4 GHz transceivers, register-level configuration, frequency-hopping schemes. Experience with SDR capture (e.g., HackRF, USRP, BladeRF) and logic-analyzer / SPI bus probing (e.g., Saleae) for embedded systems. Ability to read a transceiver datasheet/register map and interpret device behavior from it. Experience producing formal, stamped engineering reports relied upon by third parties — clear, defensible, and standalone. Nice to have Prior reverse-engineering or protocol-characterization work on wireless consumer or medical devices. Experience working with overseas manufacturers, including reviewing materials under NDA. Deliverable A signed, PE-stamped engineering report documenting the methodology, evidence, and conclusions regarding the device's communication and pod-selection mechanism, tied to a specific production firmware version. Raw capture files and supporting data to accompany the report. To apply, please answer: Are you an actively licensed US PE in Electrical Engineering? State(s) and license number. Briefly describe your experience with embedded RF / proprietary wireless protocols and the instrumentation you'd use here. How would you determine whether a device assigns a dedicated frequency per receiver versus broadcasting on a shared hopping link and selecting by UID at the receiver? What's your approach and equipment? Have you produced stamped engineering reports that other parties relied on? Briefly describe. Estimated timeline and your rate structure.