If you are thinking about "verified" systems spent way too much in academia. Fundamentally, verification system is a traffic light problem. In case you do not

If you are thinking about "verified" systems spent way too much in academia. Fundamentally, verification system is a traffic light problem. In case you do not know, the blinking yellow is "i crashed". That condition is not checked via code verification of Red/Yellow/Green state machine. It is checked via crossed green detector: a circuit that checks for a condition "green energized" on both and should that condition occur it crashes the Red/Yellow/Green state machine. That state machine will never recover until Bob shows up at a traffic box, looks to see if a sensor is dead, looks to see if box is OK and resets it by hand.