Also “using memory safe languages for critical components” and “detecting failures to load and automatically using the last-known-good configuration”