What we actually do
Bare-metal C and C++ where the timing budget leaves no room for a scheduler, FreeRTOS where it does, and Embedded Linux where the product needs a filesystem, a network stack and a package of userspace tooling around it.
Most of the work that matters is not writing the happy path. It is bring-up on a board nobody has powered before, chasing an interrupt that fires once an hour, and building the instrumentation that makes an intermittent fault reproducible.
Bring-up and debugging
We expect to be handed a board that does not boot. Bring-up work is structured: power rails and clocks first, then a minimal boot path, then peripherals one at a time with a test that proves each. Every failure found gets written down, because the same class of fault usually reappears in the next revision.
Update pipelines
An OTA path is a safety feature, not a convenience. We design for the case where power is lost mid-write: A/B partitions or a validated staging slot, a watchdog that rolls back a boot that never reaches userspace, and a signed image so a field device cannot be persuaded to install someone else's firmware.
Handover
Firmware you cannot build is firmware you do not own. Everything ships with a build that runs from a clean checkout on a machine that has never seen the project, and a written account of what each subsystem does and where the known sharp edges are.
