Our position
Engineering Tomorrow
The systems worth building now are the ones that run when nobody is watching. That changes what engineering has to prove.
The argument
For most of computing history there was someone in the loop. Software proposed and a person disposed, and that person was the last line of defence against everything the software got wrong.
That arrangement is quietly ending. A robot on a night shift, a model approving a transaction, a protocol settling a trade, a controller holding a reactor at temperature — none of them has a supervisor reading every output. The human has moved from inside the loop to somewhere near it, and in some systems has left the building entirely.
This is not a claim that the technology got better. It is a claim that the burden of proof moved. When a person checked the work, a system only had to be usually right, because the failures were caught downstream by someone with judgement. When nobody checks, the system has to carry its own evidence — it has to detect that it is wrong, bound how wrong it can get, and fail into a state somebody survives.
Almost everything we work on is a version of that problem.
The operator moves out — and the burden of proof moves in
What is changing
Five shifts we are engineering against. None of them is a prediction — each is already underway, and each moves cost from one place to another.
01
Autonomy moves from demonstration to duty
A machine that performs under observation and a machine that runs three shifts unattended are different engineering problems. The first is judged on capability, the second on its worst hour in a bad month. Once nobody is watching, the question stops being what the system can do and becomes what it cannot be made to do.
02
Models begin making decisions nobody reviews
When inference sits inside an operational loop, correctness stops being something established at launch and becomes something that decays. The world the model described keeps moving. A system that cannot detect its own drift is not deployed — it is abandoned in place, still answering.
03
Trust shifts from institutions to protocols
Settlement, custody and identity increasingly rest on what a protocol guarantees rather than on who is standing behind it. That is a real improvement and an unforgiving one: there is no counterparty to call when the logic is wrong, and no discretion available after the fact.
04
Cryptography acquires an expiry date
Everything encrypted today has a shelf life set by a machine that does not exist yet. Traffic captured now can be read later, which means the deadline for migration is not the arrival of that machine — it is today, minus however long your data must stay confidential.
05
Compute becomes an energy problem
The constraint on large-scale computing is no longer silicon. It is power delivery, heat rejection and grid interconnection queues measured in years. Architecture decisions that ignore the thermodynamics are decisions about a building that cannot be built.
How we engineer
Four commitments that follow from the argument. They are written this way on purpose — each is specific enough that failing to keep it would show.
Bound the worst case, not the average
A control loop that meets its deadline 99.9% of the time produces a defect several times per shift. We size systems on the tail — the slowest response under the heaviest load on the worst day — because that is the number that appears in the incident report.
Physics before models
Where a mechanism is calculable, we calculate it. A bearing defect frequency follows from geometry and shaft speed, so it needs no training data and works on an asset that has never failed. Learning is for the part of the problem that genuinely resists derivation.
Publish the reasoning
We write our engineering down in public, with the formulas and the failure modes intact. It is the most honest hiring signal we can produce, and it means a prospective client can evaluate how we think before deciding whether to pay us to think.
Design for the day it fails
Rollback that is a configuration change rather than a redeploy. A safe state that is reachable without the software that failed. Degradation that is predictable rather than sudden. The recovery path is a feature, and it is the one that gets used under pressure.
RD-A7 — aerial inspection platform
Where to check it
A position is only worth as much as the work behind it.
The RD-A7 is one place we have had to hold to it. Its endurance follows from momentum theory, the smallest crack it can find follows from sensor geometry, and it decides onboard because the radio link cannot carry what the camera produces. The notes work all of that out in full.
Read the engineering notesIf your system has to be right without you, we should talk.
Most engagements start with a constraint someone has already tried to engineer around twice. That is usually the interesting part.
Schedule a consultation