Generation and Verification: Human-Agent Collaboration for Safety-Critical Automotive Software Engineering
Elizaveta Zinovyeva, Aiham Taleb, Nikita Kozodoi and colleagues at Amazon Web Services, with automotive supplier AUMOVIO, build a coding assistant for safety-critical automotive C/C++ that treats verification as a separate tool the developer calls, and report a two-week pilot on live production projects.
Ask this paper
Design. The assistant exposes three MCP tools to the developer: generate, edit and verify. Developers can run verify on any code on demand instead of relying on the agent to check its own output.
Domain data. The team built a dataset from AUMOVIO production code in which each function is paired with its requirement text and UML behavior, and compared prompt engineering against fine-tuning for the domain.
Pilot result. In a two-week pilot, developers named verify the most-used tool and used it on their own hand-written code, not only on generated output. 75% preferred the faster prompt-engineered configuration.
Standards checks. MISRA- and AUTOSAR-inspired checkers show fewer violations from prompt engineering on C, while fine-tuning conforms better to architecture patterns in C++.
Abstract
Research on coding agents mainly focuses on generation quality. Yet, safety-critical automotive software makes two additional demands. It prioritizes verification, since every change is reviewed, traced to a requirement, and checked against industry standards such as MISRA and AUTOSAR before it can be committed. It is also a narrow domain, written against layered architectures, embedded resource constraints, and organization-specific interface conventions that are scarce in the data general-purpose LLMs are trained on. We present a coding assistant for automotive C/C++ that addresses both demands. First, it exposes three tools to the user over the Model Context Protocol (generate, edit, and verify), allowing developers to run verify on any code on demand rather than relying on the agent to check its own output. Second, rather than using a general-purpose model, we customize the underlying LLM for the automotive domain through prompt engineering and fine-tuning. We construct a dataset from automotive production code of AUMOVIO, where each function is paired with the requirement texts and Unified Modeling Language (UML) behavior it must satisfy. In a two-week pilot on active production projects, developers report verify as the most-used tool and confirm using it on their own code and not only on generated output. Comparing model customization strategies, 75% prefer the faster prompt-engineered configuration. MISRA- and AUTOSAR-inspired pattern checkers indicate that prompt engineering achieves a lower number of violations on C, while fine-tuning shows better conformance with architecture patterns for C++.