Examples include space systems, undersea cables, navigational beacons, bore-hole systems, and automobiles. The system must be kept running for safety reasons. Reduced functionality in the event of failure may be intolerable. Often backups are selected by an operator. Examples include aircraft navigation, reactor control systems, safety-critical chemical factory controls, train signals. The system will lose large amounts of money when shut down: Telephone switches, factory controls, bridge and elevator controls, funds transfer and market making, automated sales and service. A variety of techniques are used, sometimes in combination, to recover from errors—both software bugs such as memory leaks, and also soft errors in the hardware: watchdog timer that resets and restarts the system unless the software periodically notifies the watchdog subsystems Designing with a trusted computing base (TCB) architecture ensures a highly secure and reliable system environment A hypervisor designed for embedded systems is able to provide secure encapsulation for any subsystem component so that a compromised software component cannot interfere with other subsystems, or privileged-level system software. This encapsulation keeps faults from propagating from one subsystem to another, thereby improving reliability. This may also allow a subsystem to be automatically shut down and restarted on fault detection. Immunity-aware programming can help engineers produce more reliable embedded systems code. Guidelines and coding rules such as MISRA C/C++ aim to assist developers produce reliable, portable firmware in a number of different ways: typically by advising or mandating against coding practices which may lead to run-time errors (memory leaks, invalid pointer uses), use of run-time checks and exception handling (range/sanity checks, divide-by-zero and buffer index validity checks, default cases in logic checks), loop bounding, production of human-readable, well commented and well structured code, and avoiding language ambiguities which may lead to compiler-induced inconsistencies or side-effects (expression evaluation ordering, recursion, certain types of macro). These rules can often be used in conjunction with code static checkers or bounded model checking for functional verification purposes, and also assist in determination of code timing properties. High vs. low volume For high-volume systems such as mobile phones, minimizing cost is usually the primary design consideration. Engineers typically select hardware that is just good enough to implement the necessary functions. For low-volume or prototype embedded systems, general-purpose computers may be adapted by limiting the programs or by replacing the operating system with an RTOS. Embedded software architectures In 1978 National Electrical Manufacturers Association released ICS 3-1978, a