The first rule of writing safety-critical systems in C: Don't write safety-critical systems in C.