Ten years inside other people's cars

Written down it reads as a list. Requirement specifications decomposed into architecture; functional and technical safety concepts under ISO 26262; hazard analysis and risk assessment, ASIL classification and decomposition down to the element that carries it; behavioural models in Matlab, Simulink and Stateflow, exercised on model-, software- and hardware-in-the-loop benches long before a part exists; traceability that holds from a line in a customer specification through design and code to the test that proves it; and the documentation that has to survive a safety assessment years after the people who wrote it have moved on.

It also means working inside somebody else's process — a vehicle manufacturer's release gates, a supplier's quality system, a programme that will not move its start of production because a workstream is late. Clean engineering that arrives after the gate is worth nothing.

Lived, the work is quieter than the list. A decade of it ends as a few hundred milliseconds of behaviour nobody is meant to notice: a warning that comes at the moment it is still useful, a display that stays readable exactly when it matters, a function that, when it fails, fails in the direction that is safe. Today a very large number of European drivers rely on that work every time they start the engine, and not one of them will ever know it is there.