Last Tuesday I had thirty minutes on the Embedded Software & AI stage at WoTS in Utrecht. Full room, everyone wearing those silent-disco headphones. The question I came to answer was not “will AI replace engineers” — it was something much more practical, and much more uncomfortable.
Here it is. You ask an assistant for a CAN bus monitor. You get 2 400 lines of C. It compiles. The tests are green. Nobody has read it.
Now explain it to the assessor.
“We generated it with AI and then we reviewed it” is not an argument. It has no volume, no depth, and no denominator. And if you work in automotive, aerospace, rail or medical, you already know that this conversation is coming.
We have been here before — and we were wrong before
I opened with 1865. British law required a man to walk sixty yards ahead of any self-propelled vehicle, carrying a red flag. Two miles per hour in town. The law stood until 1896.
But our own profession did exactly the same thing. In 1954, John Backus wrote that it was difficult to convey the strength of the scepticism about “automatic programming”. The objection was not that FORTRAN would take anyone’s job. The objection was that it could not possibly be as good as a human.
That is the same objection I hear today, and it deserves the same treatment: take it seriously, then check whether it is still true.
Two things that genuinely are different
I am not selling anything here, so let me be precise about what has changed.
It is probabilistic. Ask the same question twice, get two different answers. A compiler is deterministic. A generator is not.
It has no oracle. A compiler knows the rules of C. A language model has nothing to check itself against. It cannot distinguish a correct answer from a confident one.
Both of those matter enormously when the output is going into something safety-related. Neither of them is a reason to stay away. They are reasons to put something between the intent and the generated code.
The claim
This was the centre of the talk:
A model is a human-readable, machine-checkable statement of intent.
Code is what the machine does. The model is what we agreed it should do. As long as you wrote the code yourself, that distinction was fairly academic. The moment a generator writes it, the distinction becomes the whole ball game.
Take the same CAN monitor. As a state machine in Rhapsody: 23 states, 41 transitions. Readable in a review? Minutes. Traceable to a requirement? Directly. Those 2 400 lines of C: hours, if anyone really does it — and traceability by hand, if at all.
Two verification surfaces, same system. You get to choose which one you hand to the assessor.

The reversal that surprised me
Most of the talk runs in the familiar direction: requirements → model → code. The direction I did not expect runs the other way.
You have code you did not write. Legacy, or generated four minutes ago. Point the assistant at it and have it build the model: states, blocks, interfaces, relations. Then you read 23 states instead of 2 400 lines.
Modeling stops being the preparatory work. It becomes how the AI shows its work.
How the assistant actually reaches the model
This is where it gets concrete for Rhapsody users. The assistant does not need to be a plugin, and it does not need to swallow your whole project. It needs a described, callable interface to the model — which is exactly what the Model Context Protocol gives you. Any assistant you already use on one side, your model on the other.
SodiusWillert have built exactly this for Rhapsody. Their AI Modeling Assistant for IBM Rhapsody — SAM — is an MCP broker sitting between the model and whatever assistant you prefer. It reads and writes Rhapsody elements directly: statecharts, activity and sequence diagrams, requirements, AUTOSAR profiles, code generation settings. You point Claude or GPT at it and it works on the actual model, not on a copy of your export.
It was built with Andy Lapping, Technical Fellow at SodiusWillert — the same man behind Power Pack and Profile Builder, who knows Rhapsody about as thoroughly as anyone alive. He has put together a video series that is worth more than any slide of mine:
- 1. Introduction to the AI Modeling Assistant — start here, ten minutes.
- 3. Creating use cases and actors interactively — the requirements end of the spectrum.
- 10. Reverse engineering code and models into Rhapsody — this is the reversal I described above, running for real.
And two write-ups from their side that cover ground I only had thirty minutes for: Practical AI in MBE, and How to create a system model from a PDF — which is exactly the “first model from a requirements document” I mentioned as something that genuinely works today.
And here is a side effect I did not anticipate: the model makes the assistant better, too. It works as external memory — the assistant does not need your forty-state machine in its context window, it needs the three states that matter. Long contexts degrade in the middle; a model lets you avoid needing one. And it works as a constraint, which is precisely what a probabilistic generator is short of.
An honest report
I put up a slide with what does not work, because otherwise you should not believe the rest either.
Works today. Building a first model from a requirements document — not the final model, but a structured starting point, in minutes rather than days. And requirements coverage analysis: which requirements does this model not satisfy? That one alone has found gaps I had missed myself.
Does not work yet. Context — it cannot see the whole model, large models have to be sliced, and slicing well is a real skill that nobody is teaching. And determinism: same prompt, different answer. Fine for a proposal you are going to review. Not acceptable as a build step.
Where that leaves us
The man with the red flag was not wrong that cars were dangerous in 1865. He was wrong about how long you keep walking in front of them.
My guess is that we are somewhere inside those thirty-one years. Not out in front with a flag, but not climbing in blindfolded either. Making sure there is something between the intent and the generated code that a human being can actually read.
The slides are here (PDF). There is a shorter, more personal write-up in Dutch on vanderheiden.blog.
Image at the top: an IBM 704 at NACA Langley, 21 March 1957 — the machine John Backus and his team were writing FORTRAN for, and the scepticism he described was about. Photograph NASA, public domain, via Wikimedia Commons.






























![[Photo: Grand Canyon winter view - those layered rock formations]](https://rhapsody.blog/wp-content/uploads/2025/08/IMG_9886-1024x768.jpeg)
![[Screenshot placeholder: Rhapsody SE web interface - if someone can send me one!]](https://rhapsody.blog/wp-content/uploads/2025/08/Screenshot-2025-08-30-at-08.54.01-1024x596.png)
![[Photo: Me looking cold but happy at the Grand Canyon - because why not?]](https://rhapsody.blog/wp-content/uploads/2025/08/IMG_9921-1024x768.jpeg)
![[Screenshot placeholder: Rhapsody SE collaborative interface showing real-time updates - anyone?]](https://rhapsody.blog/wp-content/uploads/2025/08/Screenshot-2025-08-30-at-08.53.14-1024x588.png)
![[Photo: Final Grand Canyon shot - the vastness that puts everything in perspective]](https://rhapsody.blog/wp-content/uploads/2025/08/IMG_9890-768x1024.jpeg)









