Code that runs for years unattended.
WHAT RELIABILITY REQUIRES
No path that halts No memory growth over time Recovery from every error Defined behaviour on every input
WHAT TO AVOID
Dynamic allocation after initialisation Unbounded loops Recursion with unbounded depth Blocking calls without timeouts
WHY DYNAMIC ALLOCATION SPECIFICALLY
Fragmentation over months causes failures that never appear in testing.
WHAT TO USE INSTEAD
Fixed buffers, sized at compile time.
WHAT A WATCHDOG PROVIDES
Automatic restart if the device stops responding.
WHERE TO RESET IT
At a point only reached when the device is genuinely working.
WHY THAT MATTERS
Resetting it from a timer defeats its purpose entirely.
WHAT TO RECORD BEFORE A RESTART
The reason, in persistent storage.
WHY
It is the only diagnostic available for a device that rebooted in the field.
WHAT TO VALIDATE
Every sensor reading, for plausibility Every received message, before acting Every configuration value, against bounds
WHAT TO DO WITH IMPLAUSIBLE VALUES
Report them as faults, rather than transmitting them as data.
WHY
Bad data propagated downstream causes wrong decisions.
WHAT TO TEST
Running for weeks, uninterrupted.
