I guess Toyota forgot to get those line-by-line coder reviews.
https://users.ece.cmu.edu/~koopman/pubs/koopman14_toyota_ua_...
https://users.ece.cmu.edu/~koopman/pubs/koopman14_toyota_ua_...
• “Near-perfect” software
• Design out single points of failure
• Justify real time scheduling with analysis
• Watchdog timers that have real “bite”
• Good software architecture
• Good safety culture
This seems like mostly good concrete advice, although I think we can all agree that simply creating "near-perfect software" is a goal, not a solution. If you read up on Toyota's unintended breaking legal issues, it appears that it was most likely driver error, as Toyota did not issue a firmware change to the affected vehicles, and no software problems were ever identified.