Embedded, industrial & energy

A hardware down-counter that resets the chip unless software proves, in time and in a plausible pattern, that it is still healthy.

Run a controller at an exact period using absolute deadlines and a fixed dt, so jitter never accumulates and the math stays valid.

A timer's counter, period and compare registers draw the pulse train; preload, dead time and DMA make duty changes glitch-free, shoot-through-free and cheap.

A handful of base/size regions with permissions, checked on every access by the CPU, give microcontroller tasks isolation and stack-overflow traps without an MMU.

Two bootable slots and a small atomic metadata block: write the new image to the idle slot, try it once, and fall back by itself unless it reports healthy.

Always run the highest-priority ready task, switching the instant a higher one becomes ready; selection is O(1) with one FIFO per priority and a bitmap.

Turn raw process limits into a few actionable operator alarms with delay, deadband, acknowledge and shelving states, plus flood measurement.

A second, always-current controller shadows the primary and takes over within a few cycles of silence; epochs stop the old primary from fighting back.

Write the unwanted top event as AND/OR logic over component failures, reduce it to minimal cut sets, then compute its probability and each failure's share.

Which rule sets (MISRA C, CERT C, JPL Power of Ten, Rust lint subsets) apply when software must not fail, what they forbid, and how to enforce them in CI.

Exhaustively explore a model's reachable states (or prove its invariants with a solver or proof assistant) to find rule violations with a shortest counterexample trace.