Chief Technology Officer / India
What changed when the expected sequence stopped
- Engineers led
- 154
- Through five heads in a 520-person company
- Annual engineering expense
- ₹36.8 crore
- Separate from ₹7.2 crore laboratory/equipment programme
- Embedded engineering experience
- 26 years
- July 2000 to October 2026
Decisions & consequences
01Paying for a recoverable update path
A client manufacturer's data recorder could install new firmware through its service connection. The ordinary update demonstration passed, but our scheduled power-interruption exercise exposed a problem: seventeen of 200 trials left the unit needing bench recovery. No customer field incident was claimed in this experiment. The issue arose before acceptance, when we could still change the design. I declined to treat the successful uninterrupted demonstration as sufficient evidence for release.
Our team proposed retaining an earlier usable software image while the replacement was prepared and checked. The design required additional memory, adding ₹180 to the client's estimated per-device component cost, and ₹48 lakh in Pelvori engineering work. The client's product manager challenged both the cost and the schedule. I asked that the discussion compare the recovery obligation and service model as well as the component figure. A lower-cost design was not automatically economical if an interrupted update required physical access that the product's support plan did not provide.
The manufacturer approved the revised arrangement for its acceptance programme. We repeated the defined 200-trial interruption matrix and observed no cases requiring bench recovery. The test conditions and device configuration accompanied the result. I did not describe the outcome as proof that updates could never fail, or as a certification of the complete product. Other environmental conditions and the manufacturer's wider validation remained outside this specific experiment.
The decision delayed our engineering handover by four weeks and required the commercial team to explain why a familiar update feature had become a material design discussion. I would now insist on that conversation earlier, before a component estimate and delivery date become difficult to reopen. The useful result was not merely a cleaner test report. It was agreement on how the device should behave after an interrupted transition, what that behaviour cost and which organisation retained authority to accept the complete product.
Letting a holdout set reopen a parser correction
A device-message parser failed on eighty-four cases within a laboratory set of 12,000 malformed messages. The failures involved input handling rather than a reported attack on a deployed customer product. Engineering lead Manoj Delvethi's team corrected the identified mechanisms and reran the set without those failures. A project review proposed closing the issue at that point. I asked for a separate challenge prepared without simply repeating the examples that had guided the repair.
The validation group supplied a holdout set of 4,000 messages. Two cases exposed additional failure paths. We kept the distinction between the sets in the record: the original correction remained useful, but it did not cover every condition the next exercise examined. The commercial lead was concerned about another delay after the first clean rerun. I supported the validation team in reopening the item and explaining the consequence to the client's acceptance owner rather than describing the new failures as irrelevant because the agreed regression set had passed.
A further ₹31 lakh engineering and validation allocation funded correction and retesting over three weeks. The revised parser passed both recorded sets under the stated laboratory configuration. The report retained the earlier failures and their causes; they were not overwritten by the final result. We also recorded the expected rejection behaviour so that a malformed message could be handled deliberately rather than merely cease to trigger the observed fault.
This was a bounded improvement in input handling, not a declaration that the device was secure against every possible message or use. The manufacturer retained responsibility for broader product acceptance and any specialist assessment it required. My lesson was to separate regression evidence from an independent challenge and to plan time for both. A test that discovers another weakness has done useful work, even when its result makes the delivery conversation less comfortable than the previous status report suggested.
Counting records rather than successful transmissions
In a disconnected-recording trial, a device produced 10,000 original monitoring records and delivered them through a connection that was deliberately interrupted. The receiving system saw 10,312 deliveries because 312 records were transmitted again after uncertain acknowledgements. A demonstration focused on successful transport could have described the exercise as complete. I asked the teams to examine what the receiving application would count, because a repeat delivery was not a second underlying observation.
We agreed a record-identity scheme with the client and the receiving-system owner. The revised design retained enough identity state for the defined replay window and treated a repeated identity as the same record. It also specified how restart and the end of the retained identity history would be handled. We did not promise unlimited recognition from a device with finite storage, or assume that a sender's local success message established what the receiver had accepted.
The engineering change cost ₹42 lakh and added five weeks to the integration plan. In the repeated 10,000-record trial, all original identities were reconciled and the 312 repeated deliveries were recognised without being counted as additional observations. The result described that trial and its agreed replay conditions. It did not establish that every future network outage would be lossless, nor did it certify the accuracy of the sensor readings represented by the records.
The receiving-system team initially preferred to remove repeats using matching values and times. We rejected that shortcut because two legitimate observations could share those fields. The decision required both sides to agree meaning before optimising transport. I would bring the record-identity discussion into the first interface review on future projects, including storage limits and the consequences of an outage beyond the agreed window. The most useful completion measure was that the receiving application could account for the intended records, not that every transmission attempt had eventually received a favourable status.
Rejecting the largest compression percentage
A client wanted to reduce transmission volume from an industrial diagnostic accessory. Our first compression candidate reduced bytes by 46% on an agreed sample, an attractive result for the project review. The same experiment showed a 71% increase in device processing time. I asked the team to keep both observations in the decision and examine the effect on the client's available processing margin. The software had improved one measure by consuming more of another resource.
We compared a lighter candidate under the same recorded workload and configuration. It reduced transmitted bytes by 27% and increased processing time by 12%. The client product owner preferred that compromise after reviewing the device's other work. The choice was not based on a claim that the lighter algorithm was universally superior. Different payloads, processors or operating schedules could produce a different result, and the sample did not support a general conclusion about energy use or battery life.
The comparison and implementation required ₹24 lakh engineering effort. We retained the uncompressed reference, the two candidate measurements and the reason for the selected setting in the handover. Commercial colleagues initially wanted to keep the 46% figure in the benefit summary because it was the strongest headline produced by the project. I insisted that the summary describe the configuration actually chosen. A rejected experiment can inform the engineering account without becoming a promised customer benefit.
There were still questions for later validation, including behaviour on less typical payloads and the effect of concurrent device activity. Those were assigned to the manufacturer's acceptance programme and our agreed follow-up work. We did not infer a 27% reduction in network charges, since the charging arrangement was a separate question. The decision made the trade-off legible: fewer bytes were useful only within the processing constraints of the device that had to produce them. I would judge future optimisation proposals by the whole relevant resource account, not the largest isolated improvement.